@staix/agent-hub 0.21.0 → 0.23.0

package/docs/verification/2026-10-30-adapter-operational-settings.md

@@ -0,0 +1,261 @@
+# H5 adapters and handshakes: H0 ledger
+
+Reconciliation for #489 group 4. H0 coordinates are frozen inventory locations, not current source line claims. Source audit used main `b974320742752e1d39827cc5c2e39510367444ab`; implementation is based on merged H4 `0c15f546353343c6193bfd33465e55e8ef37daa8`.
+
+The complete area has **232 unique identities**: 96 operational, 96 safety floors, 30 contracts and 10 test seams. The detailed inventory has 259 occurrences; duplicate display rows are counted once. The `src/adapters/` subset contains 154 identities, and all 78 support/benchmark identities are included below.
+
+**3 identities are converted; 229 are excluded**, each with its reason. All use the H1 fixed descriptor/schema/settings/default mechanism in the existing config store. The namespace `adapter_timing` avoids the executable declaration map `adapters`.
+
+| Setting | Bounds | Default | Apply boundary |
+| --- | --- | --- | --- |
+| `adapter_timing.acp_tool_ceiling_min` | 1-30 min | 30 min | next peer launch; effective `max(watchdogMs, ceiling)` and remaining-only rearm |
+| `adapter_timing.acp_activity_batch_ms` | 10-50 ms | 50 ms | next peer launch; no retiming of pending activity batches; existing privacy/text caps |
+| `adapter_timing.jcode_steer_timeout_s` | 5-60 s | 5 s | next Jcode launch; one captured deadline for all native steer phases |
+
+ACP startup/mode/cancel and Jcode readiness remain fixed at 30 seconds. The 65/70-second caller budgets leave no useful raise-only startup range without changing those callers. The MCP reconnect cap remains fixed at 30 seconds; the plugin has no accepted config access and this conversion adds no cross-process projection seam. The unmanaged recovery window retains its existing relationship to that cap.
+
+## Full identity ledger
+
+Each row is one unique JSON identity. H0 classification is retained as evidence; disposition reevaluates its actual runtime role.
+
+| Stable identity | Frozen H0 location(s) | H0 class | Disposition | Reason |
+| --- | --- | --- | --- | --- |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(s.reason).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1129:89 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(s.reason).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:ACTIVE_TRACE_CAP:constant:ACTIVE_TRACE_CAP=4096#0` | scripts/benchmarks/native-pi-qwen.ts:802:7 | operational | Excluded: benchmark follow-up | Trace retention for benchmark evidence only, not daemon delivery retention. |
+| `scripts/benchmarks/native-pi-qwen.ts:activeExit:inline:state.quietMs >= 1000=1000#0` | scripts/benchmarks/native-pi-qwen.ts:727:43 | operational | Excluded: benchmark follow-up | Benchmark quiet-window completion observation, not native session completion authority. |
+| `scripts/benchmarks/native-pi-qwen.ts:allow:inline:a.text.length <= 4000=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1515:137 | safety floor | Excluded: benchmark safety | Benchmark-only allow/a.text.length <= 4000 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#0` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#1` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=25#0` | scripts/benchmarks/native-pi-qwen.ts:1557:47 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#1` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#2` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only arm/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:batchMs:inline:batchMs=0#0` | scripts/benchmarks/native-pi-qwen.ts:1387:44 | operational | Excluded: benchmark follow-up | Benchmark-local delivery batching input, not the production Bus descriptor. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only cmd/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:timeoutMs=180_000#0` | scripts/benchmarks/native-pi-qwen.ts:1138:62 | test seam | Excluded: benchmark seam | Benchmark-only cmd/timeoutMs bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:contextWindow:inline:contextWindow=262144#0` | scripts/benchmarks/native-pi-qwen.ts:1438:121 | operational | Excluded: benchmark follow-up | Benchmark synthetic model declaration; not observed native context admission. |
+| `scripts/benchmarks/native-pi-qwen.ts:effectiveBuild:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only effectiveBuild/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#1` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:error.replace(/(token\|secret\|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1746:125 | safety floor | Excluded: benchmark safety | Benchmark-only error/error.replace(/(token|secret|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:executeTool:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only executeTool/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:failureClass:inline:reason.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:697:64 | safety floor | Excluded: benchmark safety | Benchmark-only failureClass/reason.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:fetch:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only fetch/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:main:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only main/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:maxTokens:inline:maxTokens=4096#0` | scripts/benchmarks/native-pi-qwen.ts:1438:140 | operational | Excluded: benchmark follow-up | Benchmark inference request budget, not adapter handshake latency. |
+| `scripts/benchmarks/native-pi-qwen.ts:max_tokens:inline:max_tokens=20#0` | scripts/benchmarks/native-pi-qwen.ts:1367:149 | operational | Excluded: benchmark follow-up | Benchmark tiny probe output budget, not production model policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#0` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#1` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:observe:inline:this.calls.size > 128=128#0` | scripts/benchmarks/native-pi-qwen.ts:446:38 | operational | Excluded: benchmark follow-up | Benchmark outstanding-call evidence retention; changing it would alter measurement. |
+| `scripts/benchmarks/native-pi-qwen.ts:onUsageDiagnostic:inline:qwenUsageDiagnostics.length < 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:1509:89 | operational | Excluded: benchmark follow-up | Benchmark usage diagnostic sample retention, not native quota policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:signal:inline:AbortSignal.timeout=30_000#0` | scripts/benchmarks/native-pi-qwen.ts:1367:185 | operational | Excluded: benchmark follow-up | Benchmark fetch deadline, not production native startup. |
+| `scripts/benchmarks/native-pi-qwen.ts:text:inline:clean(s).slice=500#0` | scripts/benchmarks/native-pi-qwen.ts:1510:75 | safety floor | Excluded: benchmark safety | Benchmark-only text/clean(s).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:timer:inline:opts.timeoutMs ?? 60_000=60_000#0` | scripts/benchmarks/native-pi-qwen.ts:1099:115 | test seam | Excluded: benchmark seam | Benchmark-only timer/opts.timeoutMs ?? 60_000 bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(String(u.title ?? )).slice=350#0` | scripts/benchmarks/native-pi-qwen.ts:1585:115 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(String(u.title ?? )).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(req.title).slice=900#0` | scripts/benchmarks/native-pi-qwen.ts:1523:99 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(req.title).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:verifySurfaceSource:inline:entries.length > 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:199:45 | safety floor | Excluded: benchmark safety | Benchmark-only verifySurfaceSource/entries.length > 32 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#0` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#1` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `src/adapters/acp-owned-group.ts:READ_MS:constant:READ_MS=1000#0` | src/adapters/acp-owned-group.ts:18:7 | operational | Excluded: process proof/cleanup | READ_MS/READ_MS bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-owned-group.ts:stop:inline:killMs > 10_000=10_000#0` | src/adapters/acp-owned-group.ts:62:61 | operational | Excluded: process proof/cleanup | stop/killMs > 10_000 bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-quota.ts:windowMins:inline:windowMins=300#0` | src/adapters/acp-quota.ts:12:43 | operational | Excluded: provider quota contract | 300minutes is the verified Kimi5h refusal window, not an adapter scheduling preference. |
+| `src/adapters/acp.ts:<anonymous>:inline:activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice=80#0` | src/adapters/acp.ts:516:200 | safety floor | Excluded: ACP input/preview safety | <anonymous>/activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:HANDSHAKE_MS:constant:HANDSHAKE_MS=30000#0` | src/adapters/acp.ts:135:7 | operational | Excluded: fixed startup/fallback contract | Ruling3384d552 leaves HANDSHAKE_MS at30s: configured ACP start caller70s, plus coupled mode ACK/cancel proof fallbacks. No startup knob or split in H5. |
+| `src/adapters/acp.ts:TOOL_CEILING_MS:constant:TOOL_CEILING_MS=30 * 60000#0` | src/adapters/acp.ts:138:7 | operational | Converted: acp_tool_ceiling_min | Existing toolCeilingMs host option; total wait ceiling remains max(watchdogMs, configured ceiling) and rearming uses only remaining allowance. |
+| `src/adapters/acp.ts:TOOL_INPUT_CAP:constant:TOOL_INPUT_CAP=64#0` | src/adapters/acp.ts:137:7 | safety floor | Excluded: ACP input/preview safety | TOOL_INPUT_CAP/TOOL_INPUT_CAP bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:alive:inline:Math.max=10#0` | src/adapters/acp.ts:721:107 | operational | Excluded: derived liveness | Math.max is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:alive:inline:Math.min=30_000#0` | src/adapters/acp.ts:721:120 | operational | Excluded: derived liveness | Math.min is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:cut:inline:full.length > 600=600#0` | src/adapters/acp.ts:705:31 | safety floor | Excluded: ACP input/preview safety | cut/full.length > 600 bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:input:inline:full.slice=600#0` | src/adapters/acp.ts:706:72 | safety floor | Excluded: ACP input/preview safety | input/full.slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:updateWatch:inline:setTimeout=50#0` | src/adapters/acp.ts:223:69 | operational | Converted: acp_activity_batch_ms | Coalesces pending activity emission only; configure next peer construction with10..50ms conservative bounds, never recreate a timer already pending. |
+| `src/adapters/acp.ts:updateWatch:inline:this.activityPending.text.length + item.text.length > 4096=4096#0` | src/adapters/acp.ts:220:110 | operational | Excluded: activity buffer safety | 4096-character pending text boundary forces an immediate flush and bounds memory; it is not a batching timeout. |
+| `src/adapters/adapter-api.ts:ADAPTER_API:constant:ADAPTER_API=1#0` | src/adapters/adapter-api.ts:2:14 | contract | Excluded: wire/schema contract | ADAPTER_API/ADAPTER_API defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/agy/entry.ts:timeout:inline:timeout=5000#0` | src/adapters/agy/entry.ts:59:80 | operational | Excluded: version proof bound | 5s bounds native binary/version probe before launch; preserve bounded output and identity checks. |
+| `src/adapters/agy/hooks.ts:<anonymous>:inline:path.length <= 4096=4096#0` | src/adapters/agy/hooks.ts:16:87 | safety floor | Excluded: hook input safety | <anonymous>/path.length <= 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:cap:inline:cap=4 * 1024 * 1024#0` | src/adapters/agy/hooks.ts:58:17 | safety floor | Excluded: hook input safety | cap/cap bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:call.name.length > 128=128#0` | src/adapters/agy/hooks.ts:19:124 | safety floor | Excluded: hook input safety | decodeAgyHook/call.name.length > 128 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.transcriptPath.length > 4096=4096#0` | src/adapters/agy/hooks.ts:14:119 | safety floor | Excluded: hook input safety | decodeAgyHook/value.transcriptPath.length > 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.workspacePaths.length > 32=32#0` | src/adapters/agy/hooks.ts:15:110 | safety floor | Excluded: hook input safety | decodeAgyHook/value.workspacePaths.length > 32 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:readAgyTranscript:inline:Math.min=window * 2#0` | src/adapters/agy/hooks.ts:59:59 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/agy/hooks.ts:window:inline:window=64 * 1024#0` | src/adapters/agy/hooks.ts:59:23 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/channel-peer.ts:waitForAttach:inline:this.attachmentWaiters.length >= 64=64#0` | src/adapters/channel-peer.ts:39:99 | safety floor | Excluded: attachment safety | Attachment waiter count bounds parked native attachment work; no unbounded attach queue. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#0` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#1` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#0` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#1` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:setTimeout=1000#0` | src/adapters/claude-channel.ts:333:86 | operational | Excluded: bounded metadata retry | <anonymous>/setTimeout is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-channel.ts:HELD_CLOSE:constant:HELD_CLOSE=4000#0` | src/adapters/claude-channel.ts:103:7 | contract | Excluded: wire/schema contract | HELD_CLOSE/HELD_CLOSE defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:INBOX_CAP:constant:INBOX_CAP=200#0` | src/adapters/claude-channel.ts:105:7 | safety floor | Excluded: offline inbox safety | Plugin inbox count bounds retained disconnected envelopes; no new storage/retention authority. |
+| `src/adapters/claude-channel.ts:MAX_RECONNECT_DELAY_MS:constant:MAX_RECONNECT_DELAY_MS=30000#0` | src/adapters/claude-channel.ts:91:7 | operational | Excluded: reconnect ruling | Ruling3384d552 refuses reconnect conversion under any name. Preserve fixed30s cap, both loops and upgrade coupling; add no status projection, policy reader or other seam. |
+| `src/adapters/claude-channel.ts:callTool:inline:args.tool_use_id.length > 256=256#0` | src/adapters/claude-channel.ts:401:104 | contract | Excluded: wire/schema contract | callTool/args.tool_use_id.length > 256 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.count >= 3=3#0` | src/adapters/claude-channel.ts:424:92 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.count >= 3 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.minutes <= 10=10#0` | src/adapters/claude-channel.ts:424:212 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.minutes <= 10 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:reannounce:inline:tries < 2=2#0` | src/adapters/claude-channel.ts:333:44 | operational | Excluded: bounded metadata retry | reannounce/tries < 2 is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-implementer.ts:maxFrameBytes:inline:maxFrameBytes=4096#0` | src/adapters/claude-implementer.ts:57:107 | safety floor | Excluded: bounded native output | maxFrameBytes/maxFrameBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:maxOutputBytes:inline:maxOutputBytes=4096#0` | src/adapters/claude-implementer.ts:57:129 | safety floor | Excluded: bounded native output | maxOutputBytes/maxOutputBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:timer:inline:setTimeout=3000#0` | src/adapters/claude-implementer.ts:59:91 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/claude-print-child.ts:frameLimit:inline:options.maxFrameBytes ?? 256 * 1024=256 * 1024#0` | src/adapters/claude-print-child.ts:45:49 | safety floor | Excluded: bounded native output | frameLimit/options.maxFrameBytes ?? 256 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print-child.ts:outputLimit:inline:options.maxOutputBytes ?? 4 * 1024 * 1024=4 * 1024 * 1024#0` | src/adapters/claude-print-child.ts:45:101 | safety floor | Excluded: bounded native output | outputLimit/options.maxOutputBytes ?? 4 * 1024 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:DIFF_CAP:constant:DIFF_CAP=100000#0` | src/adapters/claude-print.ts:49:7 | safety floor | Excluded: bounded native output | DIFF_CAP/DIFF_CAP caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:timeout:inline:timeout=15_000#0` | src/adapters/claude-print.ts:57:224 | operational | Excluded: metadata proof group | 15s Git diff read supports bounded review/private screening; do not create adapter-level Git budget alongside metadata policy. |
+| `src/adapters/codex-appserver.ts:<anonymous>:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-appserver.ts:adopt:inline:this.opts.usagePollMs ?? 600_000=600_000#0` | src/adapters/codex-appserver.ts:678:84 | operational | Excluded: already configured | Daemon supplies usagePollMs from budget.poll_min; preserve that single accepted configuration authority. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.max=10#0` | src/adapters/codex-appserver.ts:635:77 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.min=30_000#0` | src/adapters/codex-appserver.ts:635:90 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:data:inline:launchId.length <= 128=128#0` | src/adapters/codex-appserver.ts:174:78 | safety floor | Excluded: Codex identity safety | data/launchId.length <= 128 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:interceptActionApproval:inline:link.approvalIds.size >= 1024=1024#0` | src/adapters/codex-appserver.ts:621:34 | safety floor | Excluded: Codex identity safety | interceptActionApproval/link.approvalIds.size >= 1024 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:readUsage:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: pending-request cleanup | 30s expires a usage request bookkeeping entry; does not admit quota/context by guess. |
+| `src/adapters/codex-appserver.ts:spawnAppServer:inline:Bun.sleep=100#0` | src/adapters/codex-appserver.ts:448:23 | operational | Excluded: readiness arithmetic | 100ms poll combines with100-iteration health loop and stated10s readiness; do not tune cadence separately from deadline. |
+| `src/adapters/codex-appserver.ts:timer:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: mutation ACK bound | 30s thread/revert acknowledgement bound preserves unknown/refusal and identity fence on missing reply. |
+| `src/adapters/codex-appserver.ts:timer:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-review-isolation.ts:CAP:constant:CAP=128 * 1024#0` | src/adapters/codex-review-isolation.ts:16:7 | safety floor | Excluded: isolation safety | CAP/CAP bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:MAX_SERVERS:constant:MAX_SERVERS=64#0` | src/adapters/codex-review-isolation.ts:16:25 | safety floor | Excluded: isolation safety | MAX_SERVERS/MAX_SERVERS bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:names.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:22 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/names.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segment.length > 256=256#0` | src/adapters/codex-review-isolation.ts:43:57 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segment.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segments.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:46 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segments.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:source.length > 256=256#0` | src/adapters/codex-review-isolation.ts:23:55 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/source.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:deadline:inline:deadline=12_000#0` | src/adapters/codex-review-isolation.ts:190:42 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:hostCredentialRoots:inline:configured.length > 64=64#0` | src/adapters/codex-review-isolation.ts:84:27 | safety floor | Excluded: isolation safety | hostCredentialRoots/configured.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:killMs:inline:killMs=500#0` | src/adapters/codex-review-isolation.ts:205:81 | safety floor | Excluded: isolation safety | killMs/killMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:prepare:inline:ctx.privatePaths.length > 128=128#0` | src/adapters/codex-review-isolation.ts:221:77 | safety floor | Excluded: isolation safety | prepare/ctx.privatePaths.length > 128 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:proveDisabledFeatures:inline:rows.length > 512=512#0` | src/adapters/codex-review-isolation.ts:162:21 | safety floor | Excluded: isolation safety | proveDisabledFeatures/rows.length > 512 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:termMs:inline:termMs=100#0` | src/adapters/codex-review-isolation.ts:205:68 | safety floor | Excluded: isolation safety | termMs/termMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.max=1#0` | src/adapters/codex-review-isolation.ts:201:102 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.min=2000#0` | src/adapters/codex-review-isolation.ts:201:114 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/compat.ts:MAX_BYTES:constant:MAX_BYTES=64 * 1024#0` | src/adapters/compat.ts:104:7 | safety floor | Excluded: compatibility safety | MAX_BYTES/MAX_BYTES bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:MAX_TRUST:constant:MAX_TRUST=64#0` | src/adapters/compat.ts:101:7 | safety floor | Excluded: compatibility safety | MAX_TRUST/MAX_TRUST bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:plain:inline:text.length <= 64=64#0` | src/adapters/compat.ts:28:48 | safety floor | Excluded: compatibility safety | plain/text.length <= 64 bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/configured-acp.ts:configuredAcpDefinitions:inline:Object.keys(declarations).length > 64=64#0` | src/adapters/configured-acp.ts:53:42 | safety floor | Excluded: declaration safety | configuredAcpDefinitions/Object.keys(declarations).length > 64 bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/configured-acp.ts:text:inline:max=4096#0` | src/adapters/configured-acp.ts:29:47 | safety floor | Excluded: declaration safety | text/max bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/conformance/acp.ts:permissionModeTimeoutMs:inline:permissionModeTimeoutMs=40#0` | src/adapters/conformance/acp.ts:61:36 | test seam | Excluded: existing seam | permissionModeTimeoutMs/permissionModeTimeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:deadline:inline:deadline=5000#0` | src/adapters/conformance/kit.ts:7:33 | test seam | Excluded: existing seam | deadline/deadline is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:until:inline:Bun.sleep=10#0` | src/adapters/conformance/kit.ts:8:65 | test seam | Excluded: existing seam | until/Bun.sleep is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/local-pi.ts:<anonymous>:inline:expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe=200#0` | src/adapters/conformance/local-pi.ts:90:109 | contract | Excluded: wire/schema contract | <anonymous>/expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-cli-entry-jcode.ts:timer:inline:setTimeout=200#0` | src/adapters/definitions/native-cli-entry-jcode.ts:32:40 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:document:inline:stat.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:13:82 | safety floor | Excluded: MCP input safety | document/stat.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:info.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:89:82 | safety floor | Excluded: MCP input safety | readBoundedJson/info.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:open.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:95:59 | safety floor | Excluded: MCP input safety | readBoundedJson/open.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:timeout:inline:timeout=3000#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:55:119 | operational | Excluded: MCP provenance proof | 3s bounds Git metadata read that verifies MCP configuration provenance; unknown remains refused. |
+| `src/adapters/definitions/native-cli-preview-claude.ts:previewClaude:inline:launch.args.slice=2#0` | src/adapters/definitions/native-cli-preview-claude.ts:29:58 | contract | Excluded: wire/schema contract | previewClaude/launch.args.slice defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#0` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#1` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=0#0` | src/adapters/definitions/native-config-policy.ts:12:126 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=119999#0` | src/adapters/definitions/native-config-policy.ts:12:129 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#0` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#1` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#0` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#1` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-policy-aux.ts:absoluteContinuityPath:inline:value.length <= 4096=4096#0` | src/adapters/definitions/native-policy-aux.ts:127:75 | safety floor | Excluded: native policy safety | absoluteContinuityPath/value.length <= 4096 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/definitions/native-policy-aux.ts:text:inline:st.size > 1024 * 1024=1024 * 1024#0` | src/adapters/definitions/native-policy-aux.ts:65:35 | safety floor | Excluded: native policy safety | text/st.size > 1024 * 1024 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/external-metadata.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-metadata.ts:5:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:code:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | code/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:template:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | template/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-modules.ts:16:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULE_BYTES:constant:MAX_MODULE_BYTES=2 * 1024 * 1024#0` | src/adapters/external-modules.ts:16:25 | safety floor | Excluded: external module safety | MAX_MODULE_BYTES/MAX_MODULE_BYTES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MODULE_IMPORT_TIMEOUT_MS:constant:MODULE_IMPORT_TIMEOUT_MS=2000#0` | src/adapters/external-modules.ts:196:7 | safety floor | Excluded: external module safety | MODULE_IMPORT_TIMEOUT_MS/MODULE_IMPORT_TIMEOUT_MS bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:path:inline:text=4096#0` | src/adapters/external-modules.ts:26:33 | safety floor | Excluded: external module safety | path/text bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:snapshot:inline:depth > 12=12#0` | src/adapters/external-modules.ts:106:15 | safety floor | Excluded: external module safety | snapshot/depth > 12 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/jcode.ts:<anonymous>:inline:buffer.length > 1024 * 1024=1024 * 1024#0` | src/adapters/jcode.ts:109:27 | safety floor | Excluded: Jcode input safety | <anonymous>/buffer.length > 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:<anonymous>:inline:setTimeout=3000#0` | src/adapters/jcode.ts:259:174 | operational | Excluded: failed-start cleanup | 3s waits for the owned failed-start child to exit; it is cleanup proof, not successful startup admission. |
+| `src/adapters/jcode.ts:STEER_TIMEOUT_MS:constant:STEER_TIMEOUT_MS=5000#0` | src/adapters/jcode.ts:80:7 | operational | Converted: jcode_steer_timeout_s | Existing steerTimeoutMs host option, captured once by nativeSteer; ONE timer spans ping/subscribe/state/sent, with uncertain outcome after send. |
+| `src/adapters/jcode.ts:jcodeVersionAsync:inline:timeoutMs=10_000#0` | src/adapters/jcode.ts:160:79 | test seam | Excluded: existing seam | jcodeVersionAsync/timeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/jcode.ts:savedSession:inline:before.size > 32 * 1024 * 1024=32 * 1024 * 1024#0` | src/adapters/jcode.ts:53:65 | safety floor | Excluded: Jcode input safety | savedSession/before.size > 32 * 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:timeout:inline:timeout=10_000#0` | src/adapters/jcode.ts:140:169 | operational | Excluded: version proof bound | Synchronous native version/capability preflight has bounded10s execution/output; not model startup readiness. |
+| `src/adapters/jcode.ts:timer:inline:setTimeout=30_000#0` | src/adapters/jcode.ts:222:114 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/kimi-review.ts:<anonymous>:inline:text.length > 4096=4096#0` | src/adapters/kimi-review.ts:94:94 | safety floor | Excluded: reviewer input safety | <anonymous>/text.length > 4096 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:read:inline:limit=262_144#0` | src/adapters/kimi-review.ts:32:37 | safety floor | Excluded: reviewer input safety | read/limit bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:Object.keys(value).length <= 32=32#0` | src/adapters/kimi-review.ts:40:53 | safety floor | Excluded: reviewer input safety | scalar/Object.keys(value).length <= 32 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:depth > 4=4#0` | src/adapters/kimi-review.ts:37:15 | safety floor | Excluded: reviewer input safety | scalar/depth > 4 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:Bun.sleep=50#0` | src/adapters/kimi-review.ts:105:114 | operational | Excluded: OAuth-lock cleanup cadence | 50ms observes native lock disappearance during existing grace; never bypass or widen token-lock policy. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:graceMs=10_000#0` | src/adapters/kimi-review.ts:100:95 | test seam | Excluded: existing seam | stopKimiReview/graceMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/kimi-review.ts:timer:inline:setTimeout=5_000#0` | src/adapters/kimi-review.ts:91:37 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/kimi-wire-usage.ts:DEFAULT_CHUNK:constant:DEFAULT_CHUNK=1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:71:7 | operational | Excluded: existing read-budget seam | DEFAULT_CHUNK already overridden by options.maxBytes with a LINE_CAP*2 floor; preserve cursor/parser contract instead of new timer settings. |
+| `src/adapters/kimi-wire-usage.ts:INDEX_CAP:constant:INDEX_CAP=16 * 1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:70:7 | safety floor | Excluded: usage parser safety | INDEX_CAP/INDEX_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:LINE_CAP:constant:LINE_CAP=64 * 1024#0` | src/adapters/kimi-wire-usage.ts:69:7 | safety floor | Excluded: usage parser safety | LINE_CAP/LINE_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:MAX_AGENTS:constant:MAX_AGENTS=256#0` | src/adapters/kimi-wire-usage.ts:67:7 | safety floor | Excluded: usage parser safety | MAX_AGENTS/MAX_AGENTS bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_HEAD:constant:PRINT_HEAD=64#0` | src/adapters/kimi-wire-usage.ts:78:7 | contract | Excluded: storage identity contract | PRINT_HEAD/PRINT_HEAD fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_TAIL:constant:PRINT_TAIL=256#0` | src/adapters/kimi-wire-usage.ts:78:24 | contract | Excluded: storage identity contract | PRINT_TAIL/PRINT_TAIL fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:id:inline:createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice=32#0` | src/adapters/kimi-wire-usage.ts:300:146 | contract | Excluded: storage identity contract | id/createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:readFile:inline:buffer.subarray=256#0` | src/adapters/kimi-wire-usage.ts:267:42 | safety floor | Excluded: usage parser safety | readFile/buffer.subarray bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/local-worker.ts:HISTORY_CHARS:constant:HISTORY_CHARS=100000#0` | src/adapters/local-worker.ts:56:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:TURN_CHARS:constant:TURN_CHARS=120000#0` | src/adapters/local-worker.ts:58:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:alive:inline:setInterval=30_000#0` | src/adapters/local-worker.ts:267:104 | operational | Excluded: tool liveness heartbeat | 30s marks a still-running managed tool active; changing independent of watchdog can falsely cancel valid work. |
+| `src/adapters/local-worker.ts:elide:inline:(m.content?.length ?? 0) > 200=200#0` | src/adapters/local-worker.ts:482:59 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:max_tokens:inline:maxTokens ?? 2048=2048#0` | src/adapters/local-worker.ts:113:137 | operational | Excluded: existing model seam | maxTokens already comes from host/model routing; no adapter-wide competing output budget. |
+| `src/adapters/local-worker.ts:note:inline:e.message.slice=200#0` | src/adapters/local-worker.ts:204:119 | safety floor | Excluded: error text safety | Error-note text is capped before transport/logging; not native timeout policy. |
+| `src/adapters/pi.ts:<anonymous>:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | <anonymous>/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#1` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:TERMINAL_OWNER_MAX_AGE_MS:constant:TERMINAL_OWNER_MAX_AGE_MS=1000#0` | src/adapters/pi.ts:62:7 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:deadline:inline:deadline=2_000#0` | src/adapters/pi.ts:583:33 | operational | Excluded: verified cleanup cadence | deadline/deadline bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:expiresAt:inline:expiresAt=30_000#0` | src/adapters/pi.ts:330:105 | operational | Excluded: one-use authority expiry | 30s expires idle-bash reservation authority; never turn an old reservation into durable permission. |
+| `src/adapters/pi.ts:grace:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | grace/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.id.length <= 100=100#0` | src/adapters/pi.ts:780:112 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/event.id.length <= 100 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.toolCallId.length <= 512=512#0` | src/adapters/pi.ts:752:108 | contract | Excluded: wire/schema contract | handleBridgeEvent/event.toolCallId.length <= 512 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.abortedToolIds.size >= 64=64#0` | src/adapters/pi.ts:758:41 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.abortedToolIds.size >= 64 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.usageSeen.size > 1000=1000#0` | src/adapters/pi.ts:782:33 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.usageSeen.size > 1000 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleToolRequest:inline:setTimeout=10#0` | src/adapters/pi.ts:303:12 | operational | Excluded: event-ordering yield | 10ms lets expiration reply finish before sibling abort/native turn end; not a tool timeout knob. |
+| `src/adapters/pi.ts:idleTimeout:inline:idleTimeout=60#0` | src/adapters/pi.ts:367:77 | operational | Excluded: bridge transport contract | 60s is HTTP bridge idle socket behavior; not native owner freshness or conversation inactivity. |
+| `src/adapters/pi.ts:maxRequestBodySize:inline:maxRequestBodySize=2_000_000#0` | src/adapters/pi.ts:367:101 | safety floor | Excluded: Pi input/lifecycle safety | maxRequestBodySize/maxRequestBodySize bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:snapshot:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:startOwnerMonitor:inline:setInterval=500#0` | src/adapters/pi.ts:895:62 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:state:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:stop:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stop/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#1` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#0` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#1` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/registry.ts:roleValues:inline:roles.length <= 4=4#0` | src/adapters/registry.ts:123:87 | contract | Excluded: wire/schema contract | roleValues/roles.length <= 4 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/reviewer-mcp.ts:BODY_CAP:constant:BODY_CAP=256 * 1024#0` | src/adapters/reviewer-mcp.ts:15:7 | safety floor | Excluded: reviewer transport safety | BODY_CAP/BODY_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:RESULT_CAP:constant:RESULT_CAP=4 * 1024 * 1024#0` | src/adapters/reviewer-mcp.ts:15:30 | safety floor | Excluded: reviewer transport safety | RESULT_CAP/RESULT_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:message:inline:sanitize(failure.message).slice=4000#0` | src/adapters/reviewer-mcp.ts:77:87 | safety floor | Excluded: reviewer transport safety | message/sanitize(failure.message).slice caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-print.ts:onSpawn:inline:setInterval=100#0` | src/adapters/reviewer-print.ts:343:93 | operational | Excluded: review-token revocation | 100ms checks current task/head/revision authorization while child runs; widening permits stale review work. |
+| `src/hub/action-enforce.ts:<anonymous>:inline:limits[key] > 1=1#0` | src/hub/action-enforce.ts:87:67 | safety floor | Excluded: authority safety | The single admitted action limit is an authorization ceiling, not a tuning parameter. |
+| `src/hub/child-process.ts:check:inline:setTimeout=1_000#0` | src/hub/child-process.ts:203:89 | operational | Excluded: shared cleanup proof | check/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:processTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | processTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:readProcessTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | readProcessTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#1` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=50#0` | src/hub/child-process.ts:313:23 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopOwnedProcess:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopOwnedProcess/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timeout:inline:timeout=10_000#0` | src/hub/child-process.ts:73:93 | operational | Excluded: shared cleanup proof | timeout/timeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timer:inline:setTimeout=10_000#0` | src/hub/child-process.ts:88:57 | operational | Excluded: shared cleanup proof | timer/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/instance-execution.ts:GIT_BUDGET_MS:constant:GIT_BUDGET_MS=5000#0` | src/hub/instance-execution.ts:14:7 | operational | Excluded: root validation proof budget | 5s is one total synchronous Git allowance over up to4 calls; exposed host seam already exists, and overflow must refuse workspace authority. |
+| `src/hub/instance-execution.ts:GIT_OUTPUT_BYTES:constant:GIT_OUTPUT_BYTES=1024 * 1024#0` | src/hub/instance-execution.ts:14:29 | safety floor | Excluded: root proof safety | Git output byte cap bounds synchronous workspace/root validation; preserve unknown/refusal on overflow. |
+| `src/hub/permission-payload.ts:title:inline:full.length > 600=600#0` | src/hub/permission-payload.ts:14:45 | safety floor | Excluded: permission preview safety | title/full.length > 600 bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/permission-payload.ts:title:inline:full.slice=600#0` | src/hub/permission-payload.ts:14:65 | safety floor | Excluded: permission preview safety | title/full.slice bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/start-mode.ts:PEER_START_RETRY_MS:constant:PEER_START_RETRY_MS=30000#0` | src/hub/start-mode.ts:8:14 | operational | Excluded: start authority/retry guard | 30s shared terminal-start guard and dashboard unconfirmed-response hold prevent duplicate native launch; changing it requires caller/launch proof coordination. |
+| `src/hub/terminal-open.ts:SETTLE_MS:constant:SETTLE_MS=1500#0` | src/hub/terminal-open.ts:16:7 | operational | Excluded: terminal readiness contract | 1.5s classifies still-running template as terminal success (documented shortcut); not native ready/session evidence and outside H5 adapter paths. |
+| `src/local/proxy.ts:onData:inline:head.length > 8192=8192#0` | src/local/proxy.ts:97:27 | safety floor | Excluded: proxy input safety | Header byte cap bounds sandbox network proxy parsing; do not expand bridge attack surface. |
+| `src/local/sandbox.ts:<anonymous>:inline:setTimeout=500#0` | src/local/sandbox.ts:213:94 | operational | Excluded: sandbox execution/cleanup seam | <anonymous>/setTimeout is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:OUTPUT_CAP:constant:OUTPUT_CAP=20000#0` | src/local/sandbox.ts:10:14 | safety floor | Excluded: sandbox safety | OUTPUT_CAP/OUTPUT_CAP bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/sandbox.ts:timer:inline:opts.timeoutMs ?? 120_000=120_000#0` | src/local/sandbox.ts:199:55 | operational | Excluded: sandbox execution/cleanup seam | timer/opts.timeoutMs ?? 120_000 is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:walk:inline:depth > 8=8#0` | src/local/sandbox.ts:63:17 | safety floor | Excluded: sandbox safety | walk/depth > 8 bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/tools.ts:maximum:inline:maximum=600#0` | src/local/tools.ts:105:258 | contract | Excluded: tool schema contract | maximum/maximum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#0` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#1` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#2` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:out:inline:Number(a.limit) \|\| 2000=2000#0` | src/local/tools.ts:143:74 | safety floor | Excluded: local tool safety | out/Number(a.limit) || 2000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:command.length > 4000=4000#0` | src/local/tools.ts:181:30 | safety floor | Excluded: local tool safety | runTool/command.length > 4000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:statSync(file).size > 5_000_000=5_000_000#0` | src/local/tools.ts:140:35 | safety floor | Excluded: local tool safety | runTool/statSync(file).size > 5_000_000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:timeoutMs:inline:Number(a.timeout_s) \|\| 120=120#0` | src/local/tools.ts:184:189 | operational | Excluded: public per-call tool timeout | 120s is bash default under existing1..600s public schema; no new per-call override/control path. |
+| `src/local/tools.ts:timeoutMs:inline:timeoutMs=(Number(a.timeout_s) \|\| 120) * 1000#0` | src/local/tools.ts:184:165 | contract | Excluded: tool schema contract | timeoutMs/timeoutMs declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/pi/ceiling.ts:piToolStepCeiling:inline:e.sessionId.length > 200=200#0` | src/pi/ceiling.ts:51:79 | safety floor | Excluded: ceiling evidence safety | Session-id length bounds structured tool-ceiling evidence before it is associated with the native turn. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=250#0` | src/pi/extension.ts:124:66 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=5_000#0` | src/pi/extension.ts:76:112 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:contextWindow:inline:m.contextWindow ?? 131072=131072#0` | src/pi/extension.ts:135:178 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/extension.ts:maxSteps:inline:process.env.AGENTHUB_PI_MAX_STEPS ?? 30=30#0` | src/pi/extension.ts:29:62 | operational | Excluded: already configured | Existing Pi max_steps is passed by host launch; extension fallback must agree with that same native schema. |
+| `src/pi/extension.ts:maxTokens:inline:m.maxTokens ?? 8192=8192#0` | src/pi/extension.ts:135:212 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/launch.ts:AGENTHUB_PI_MAX_STEPS:inline:opts.maxSteps ?? 30=30#0` | src/pi/launch.ts:18:594 | operational | Excluded: already configured | opts.maxSteps is existing native Pi config; host passes it through the native environment, not a new H5 env setting. |
+| `src/pi/tool-receipts.ts:PI_TOOL_RESULT_CAP:constant:PI_TOOL_RESULT_CAP=100000#0` | src/pi/tool-receipts.ts:7:14 | contract | Excluded: receipt contract | PI_TOOL_RESULT_CAP/PI_TOOL_RESULT_CAP bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:callId.length > 512=512#0` | src/pi/tool-receipts.ts:40:72 | contract | Excluded: receipt contract | execute/callId.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:session.length > 512=512#0` | src/pi/tool-receipts.ts:40:49 | contract | Excluded: receipt contract | execute/session.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+
+## Runtime boundaries
+
+- The daemon captures accepted values as primitive constructor options at the new peer start. Active peers keep their original values and deadlines.
+- Tool-ceiling, activity privacy/size and Jcode pre-send/post-send outcome fences retain their existing implementations. No session, permission, recovery, cleanup or quota capability is inferred from a timing value.
+- The excluded proof/identity/teardown bounds, wire/storage caps, existing configuration/test seams and benchmark-only values remain unchanged. The complete rows below preserve H0's classification separately from the code-read disposition.
+- Default and configured behavior tests are fixtures, not native/account timing evidence. Exact-head test and gate results are recorded in the PR; live editing and account-backed execution remain unverified.

package/docs/verification/2026-10-30-bus-delivery-operational-settings.md

@@ -0,0 +1,77 @@
+# H3 bus and delivery H0 audit
+
+Inventory reconciliation for #489 H3, based on H0 and main 26a8a835d3c01838eee4ecf374b87c7666676612. H0 locations below are frozen inventory locations, not current source lines.
+
+Reconciliation: 68 detailed markdown rows, 59 unique rows, and 59 classification JSON identities. Nine duplicate markdown display rows are counted once. Unique classifications: 21 operational, 19 safety floor, 14 contract, 5 test seam.
+
+Implemented scope: five operational controls through the H1 fixed descriptor mechanism; preserve existing hard ceilings and all queue/lifecycle/security behavior. The keys and bounds below are approved for this group.
+
+| Frozen H0 location | Name | Value | H0 class | Disposition | Code-read reason / proposed control |
+| --- | --- | --- | --- | --- | --- |
+| src/hub/bus.ts:101:7 | `SEEN_CAP` | `2048` | operational | keep replay/storage contract | SEEN_CAP=2048 is both the retained dedupe/reply_to window and delivery-journal validateBus seen-array ceiling. A lower policy forgets replay/reply context earlier; a higher one violates existing snapshot acceptance. Leave the compatibility-sensitive bound fixed. |
+| src/hub/bus.ts:102:7 | `MAX_ATTEMPTS` | `3` | operational | convert | MAX_ATTEMPTS=3 is the definitive safe-failure poison-envelope retry policy. Read the current configured value once per failed() evaluation; retain existing attempt counters, quota-paused exemption, presence restoration and undeliverable handling. Proposed bus.max_attempts integer1..100/default3, live at next safe failure; journal attempt validation remains fixed1..100. |
+| src/hub/bus.ts:105:7 | `DIGEST_MAX` | `10` | operational | convert within existing ceiling | DIGEST_MAX=10 limits originals in a new push delivery. Proposed bus.digest_max integer1..10/default10, live at next take(); preserve important-first ordering, poison-alone and remote-singleton rules. Do not increase the documented10-original ceiling. |
+| src/hub/bus.ts:108:7 | `PULL_BUDGET_BYTES` | `64 * 1024` | operational | convert within existing ceiling | PULL_BUDGET_BYTES=65536 bounds aggregate rendered text in a new pull. Proposed bus.pull_budget_bytes integer1..65536/default65536, live at next takeBudget(); preserve oldest-first, first-item-always-goes and poison-alone behavior. Do not increase the existing64KiB ceiling. |
+| src/hub/bus.ts:109:7 | `NOTES_KEPT` | `10` | operational | convert within existing ceiling | NOTES_KEPT=10 is the shared-note preface tail, not durable memory deletion. Proposed bus.notes_kept integer1..10/default10, live on next note() or restorePreface() merge. Never rewrite existing prefaces or discard queued envelopes merely on reload. |
+| src/hub/bus.ts:365:17 | `delay` | `1` | operational | defer recovery polling group | Initial1ms polling delay belongs to fenceRecovery(timeoutMs), the coordinator quiescence wait. It is not delivery retry delay; defer with recovery-wait settings so its shared timeout/hold semantics remain one change. |
+| src/hub/bus.ts:372:24 | `Math.min` | `delay * 2` | operational | keep derived arithmetic | delay*2 is the exponential-backoff recurrence inside the bounded recovery fence, not an independent duration default. Do not add a setting for a derived expression. |
+| src/hub/bus.ts:372:35 | `Math.min` | `50` | operational | defer recovery polling group | 50ms caps polling sleeps inside fenceRecovery. Defer with the1ms initial poll and injectable overall fence timeout; keep queues/in-flight work and prior recovery hold unchanged. |
+| src/hub/bus.ts:892:31 | `this.withdrawn.size > 256` | `256` | operational | keep cancellation safety bound | The256-entry withdrawn tombstone window is consulted after awaited condensation/preparation and during retry queue restoration. Configuring it downward can forget cancellation evidence and revive withdrawn originals; leave this control fence fixed. |
+| src/hub/delivery-journal.ts:22:3 | `TERMINAL_CAP` | `2048` | operational | convert within existing ceiling | TERMINAL_CAP=2048 is a target for pruning eligible completed/discarded/failed history. Proposed bus.terminal_history_limit integer1..2048/default2048, live at next normal terminal-settlement prune. Do not prune on reload, touch pending/uncertain rows, remove previous_id protection or change durable consumed-retry proof. Protected rows can keep the actual count above the target. |
+| src/hub/limits.ts:15:63 | `sender_per_min` | `0` | operational | already configured | No-project sender_per_min=0 deliberately disables sender limiting. Existing LimitsConfig and config.limits own it; keep this separate from the configured-project default12. |
+| src/hub/limits.ts:15:80 | `pair_per_min` | `0` | operational | already configured | No-project pair_per_min=0 deliberately disables recipient limiting. Existing LimitsConfig and config.limits own it; keep this separate from the configured-project default6. |
+| src/hub/limits.ts:15:123 | `repeat_window_s` | `0` | operational | already configured | No-project repeat_window_s=0 deliberately disables repeat suppression. Existing LimitsConfig and config.limits own it; preserve configured-project default120s separately. |
+| src/hub/limits.ts:17:63 | `sender_per_min` | `12` | operational | already configured | PROJECT_LIMITS.sender_per_min=12 is already overridable by limits.sender_per_min and read on each admission. Preserve no-project default0 and currently shared live cfg object; no second numeric control. |
+| src/hub/limits.ts:17:81 | `pair_per_min` | `6` | operational | already configured | PROJECT_LIMITS.pair_per_min=6 is already overridable by limits.pair_per_min and read per admission. Preserve the no-project default0 and recipient/group bucket semantics. |
+| src/hub/limits.ts:17:104 | `important_per_hour` | `6` | operational | already configured | PROJECT_LIMITS.important_per_hour=6 is already overridable by limits.important_per_hour. Preserve important-only charging, atomic group/peer scopes and no-project default0. |
+| src/hub/limits.ts:17:124 | `repeat_window_s` | `120` | operational | already configured | PROJECT_LIMITS.repeat_window_s=120 is already overridable by limits.repeat_window_s. Preserve no-project default0 and the current dedupe key including parent and sorted audience. |
+| src/hub/limits.ts:47:46 | `now - last < this.cfg.repeat_window_s * 1000` | `this.cfg.repeat_window_s * 1000` | operational | keep derived arithmetic | repeat_window_s*1000 converts the configured seconds into milliseconds for repeat admission. It already follows the operator value; no independent setting. |
+| src/hub/limits.ts:51:30 | `this.recent.size > 1000` | `1000` | operational | keep implementation scan trigger | recent.size>1000 triggers deletion of EXPIRED entries only. It is not a retention cap and does not evict fresh duplicate evidence. A new cache-cap setting would misdescribe/change semantics; leave the maintenance trigger fixed. |
+| src/hub/limits.ts:51:87 | `now - at >= this.cfg.repeat_window_s * 1000` | `this.cfg.repeat_window_s * 1000` | operational | keep derived arithmetic | repeat_window_s*1000 is the same configured-window expiry comparison used for cleanup. Keep the arithmetic coupled to limits.repeat_window_s. |
+| src/hub/peers.ts:54:14 | `DEFAULT_WATCHDOG_MS` | `300000` | operational | already configured | DEFAULT_WATCHDOG_MS=300000 is already daemon watchdog_ms and constructor-injectable. Reload reaches BasePeer.configureWatchdog and takes effect on the next busy turn, never rearming the running watchdog. |
+| src/hub/bus.ts:78:51 | `retryMs` | `1000` | test seam | existing test seam | DEFAULT_BUS.retryMs=1000 is already a constructor option used by arm() after a failure. H0 marks it test seam rather than operational; leave the injectable API, and do not introduce a second retry-delay control in this operational-only conversion. |
+| src/hub/bus.ts:78:67 | `batchMax` | `3` | test seam | already configured/test seam | batchMax=3 is BusOptions plus daemon batch_max. Bus.configureScheduling already applies future scheduling only; no new default conversion needed. |
+| src/hub/bus.ts:78:79 | `batchMs` | `15_000` | test seam | already configured/test seam | batchMs=15000 is BusOptions plus daemon batch_ms. Preserve the oldest original ts-based deadline and no reload re-arm. |
+| src/hub/bus.ts:78:97 | `queueCap` | `200` | test seam | already configured/test seam | queueCap=200 is BusOptions plus daemon queue_cap. Preserve later admission only; reload never trims existing queues. |
+| src/hub/bus.ts:185:55 | `batchMax < 1` | `1` | contract | keep contract | batchMax minimum1 is the positive delivery-count contract checked by configureScheduling; settings metadata must fit inside it. |
+| src/hub/bus.ts:185:71 | `batchMax > 2_147_483_647` | `2_147_483_647` | contract | keep contract | batchMax upper2147483647 is the existing numeric scheduling contract; do not replace it with an operator-controlled bound. |
+| src/hub/bus.ts:186:63 | `batchMs > 2_147_483_647` | `2_147_483_647` | contract | keep contract | batchMs upper2147483647 is the JavaScript timer-domain ceiling; retained as a fixed validator. |
+| src/hub/bus.ts:187:55 | `queueCap < 1` | `1` | contract | keep contract | queueCap minimum1 forbids nonsensical zero-cap scheduling; retained as a fixed validator. |
+| src/hub/bus.ts:187:71 | `queueCap > 2_147_483_647` | `2_147_483_647` | contract | keep contract | queueCap upper2147483647 is the existing Bus scheduling numeric contract; retained as a fixed validator. |
+| src/hub/bus.ts:361:35 | `timeoutMs` | `5_000` | test seam | existing test seam | fenceRecovery timeoutMs=5000 is already an injectable overall quiescence deadline. Do not add per-call or environment overrides; leave H3 delivery configuration separate. |
+| src/hub/bus.ts:616:98 | `backlog.length > 64` | `64` | safety floor | keep safety floor | backlog length64 bounds untrusted/persisted task-id metadata decoded from one envelope before queue observation; do not expose it as a work policy. |
+| src/hub/bus.ts:1222:67 | `reason.replace(/\s+/g, ).slice` | `300` | safety floor | keep safety floor | Failure reason slice300 is a sanitized public diagnostic-size ceiling. Keep fixed independently of retry settings. |
+| src/hub/deferred-hub.ts:4:14 | `MAX_DEFERRED_HUB` | `2048` | safety floor | keep safety floor | MAX_DEFERRED_HUB2048 is the bounded recovery outbox admission/restore contract. A full outbox refuses new publication without dropping accepted notices; larger support requires the documented paged durable outbox. |
+| src/hub/deferred-hub.ts:21:21 | `text` | `256` | safety floor | keep safety floor | id text256 bounds a restored deferred envelope identifier before trust. |
+| src/hub/deferred-hub.ts:21:46 | `text` | `256` | safety floor | keep safety floor | trace text256 bounds the restored trace identifier before trust. |
+| src/hub/deferred-hub.ts:22:57 | `env.body.length > 1_000_000` | `1_000_000` | safety floor | keep safety floor | body1000000 is the deferred envelope untrusted text ceiling and must remain compatible with the journal envelope validator. |
+| src/hub/deferred-hub.ts:27:50 | `env.to.length > 256` | `256` | safety floor | keep safety floor | Recipient count256 bounds restored deferred fan-out metadata; not an operator audience policy. |
+| src/hub/deferred-hub.ts:27:90 | `text` | `256` | safety floor | keep safety floor | Per-recipient text256 bounds restored peer identifiers independently of count. |
+| src/hub/deferred-hub.ts:35:88 | `refs.paths.length > 256` | `256` | safety floor | keep safety floor | refs.paths count256 bounds restored path metadata before downstream policy checks. |
+| src/hub/delivery-hints.ts:13:31 | `result.rows.length >= 32` | `32` | safety floor | keep safety floor | Producer hint rows32 is the bounded body-free advisory projection; count/truncated still report omitted rows. |
+| src/hub/delivery-hints.ts:23:112 | `held.rows.length > 32` | `32` | safety floor | keep safety floor | Consumer hint rows32 validates untrusted hint payload and matches the producer ceiling. |
+| src/hub/delivery-hints.ts:23:240 | `Buffer.byteLength(JSON.stringify(held), utf8) > 4096` | `4096` | safety floor | keep safety floor | Consumer hint JSON4096 bytes is the closed metadata budget; do not tie it to user-configured retention. |
+| src/hub/delivery-hints.ts:24:130 | `row.id.length > 256` | `256` | safety floor | keep safety floor | Held delivery id256 bounds untrusted identifier text in recipient-visible hints. |
+| src/hub/delivery-hints.ts:24:305 | `sender.length > 256` | `256` | safety floor | keep safety floor | Held sender256 bounds untrusted sender text in recipient-visible hints. |
+| src/hub/delivery-journal.ts:20:14 | `MAX_ENVELOPE_BODY` | `1000000` | contract | keep contract | MAX_ENVELOPE_BODY1000000 is a wire/storage acceptance ceiling also used by retry-warning decoration and deferred validation. Keep byte/path/protocol compatibility unchanged. |
+| src/hub/delivery-journal.ts:21:7 | `SCHEMA_VERSION` | `1` | contract | keep contract | SCHEMA_VERSION1 identifies the journal storage/import format, never a setting. |
+| src/hub/delivery-journal.ts:23:3 | `MAX_ROWS` | `100000` | safety floor | keep safety floor | MAX_ROWS100000 bounds imported lists/serialized history and protects restore resources. Terminal-history target cannot raise it. |
+| src/hub/delivery-journal.ts:24:3 | `MAX_JSON` | `20 * 1024 * 1024` | contract | keep contract | MAX_JSON20MiB is the whole serialized journal acceptance contract. Keep unchanged across retention conversion. |
+| src/hub/delivery-journal.ts:75:51 | `max` | `4096` | safety floor | keep safety floor | Generic journal text maximum4096 bounds untrusted persisted/imported string fields before use. |
+| src/hub/delivery-journal.ts:76:51 | `value.length < 1` | `1` | contract | keep contract | text minimum length1 is the nonempty identifier/string shape contract. |
+| src/hub/delivery-journal.ts:83:9 | `min` | `0` | contract | keep contract | integer default minimum0 encodes nonnegative counters/timestamps; per-field overrides remain fixed. |
+| src/hub/delivery-journal.ts:144:36 | `Object.keys(queues).length > 4096` | `4096` | safety floor | keep safety floor | Queue peer-map count4096 bounds imported bus state, not configured capacity per peer. |
+| src/hub/delivery-journal.ts:147:43 | `list` | `2048` | safety floor | keep safety floor | Queue list2048 bounds imported envelopes for one peer; preserve compatibility even if normal live queue_cap differs. |
+| src/hub/delivery-journal.ts:608:53 | `Math.max` | `1` | contract | keep contract | attempt Math.max1 records a positive attempt number in normalized delivery history; it is not a retry-budget default. |
+| src/hub/envelope.ts:23:14 | `MAX_HOP` | `3` | contract | keep contract | MAX_HOP3 is the cross-peer loop-prevention/wire hop cap. No configurable retry budget may alter it. |
+| src/hub/envelope.ts:45:52 | `hop` | `0` | contract | keep contract | Initial hop0 starts a new trace; not a duration or retry policy. |
+| src/hub/envelope.ts:121:98 | `Array.from(note from ${from} [${kind}]: ${text.replace(/\s+/g, ).trim()}).slice` | `300` | safety floor | keep safety floor | Public note-line300 codepoints is the sanitized rendering ceiling. NOTES_KEPT can only affect count, never this per-note bound. |
+| src/hub/peers.ts:78:49 | `ms > 2_147_483_647` | `2_147_483_647` | contract | keep contract | Watchdog maximum2147483647 is the JavaScript timer-domain ceiling, not the configurable watchdog interval itself. |
+
+## Runtime boundaries and verification
+
+- The five values follow the existing accepted configuration and H1 publication path. Each is read at its documented next operation; reload itself does not replay work, re-arm deadlines, trim queues, mutate attempts or rewrite prefaces.
+- Journal retention is read in the existing `pruneTerminal` path. The `previous_id` protection and separate consumed-retry proof are unchanged, so protected parents and the current mutation receipt can keep history above the configured target.
+- Existing limits retain separate no-project-off and configured-project defaults. This conversion adds no limits UI rows or duplicate controls, and leaves `configureScheduling` and `configureWatchdog` timing unchanged.
+- No safety floor, wire/storage constant, imported-state bound, sanitizer limit, unknown/PII gate, receipt rule or remote queue contract changes.
+- Tests cover independent legacy pins, schema/row/apply parity, next-operation configuration reads, poison-alone and paused-quota retries, oversized first-pull progress, and history protection. Their execution result belongs to the exact-head PR receipt; live console/dashboard editing and native delivery performance remain unverified.

package/docs/verification/2026-10-30-jcode-ac4.md

@@ -0,0 +1,24 @@
+# Jcode native hub-tool receipt (#332 AC4)
+
+Readback date: 2026-10-30. Historical host records only; no new task, message or model call was sent for this receipt. Task titles, message bodies, arguments and native payloads are omitted.
+
+## Correlated identifiers
+
+All three operations belong to host turn `jcode#mvlpussw.165`, bounded by `events.jsonl` line 291728 (`turn_start`, 2026-10-24T05:05:58.480Z) and line 291975 (`turn_end`, 2026-10-24T05:12:21.788Z).
+
+| Operation | UTC | Host event identity | Matching hub.log record |
+| --- | --- | --- | --- |
+| `hub_task_accept` | 2026-10-24T05:06:25.607Z | line 291765; task `406`; event `accepted`; by/owner `jcode`; state `in_progress` | line 26001, 2026-10-24T05:06:25.666Z; task `406`; accepted by `jcode` |
+| `hub_send` | 2026-10-24T05:06:25.805Z | line 291766; envelope `00e7e800-1373-49fc-bc37-6c75307ee354`; from `jcode`; to `kimi`, `codex` | line 26002, same UTC; `msg jcode` |
+| `hub_task_done` | 2026-10-24T05:12:14.206Z | line 291964; task `406`; event `done`; by/owner `jcode`; state `in_review`; reviewer `codex-review` | line 26026, 2026-10-24T05:12:14.259Z; task `406` notification |
+| `hub_send` | 2026-10-24T05:12:21.096Z | line 291973; envelope `e5832f38-4c7e-4e54-bce2-c09cd795e8c5`; from `jcode`; to `hub` | line 26031, same UTC; `msg jcode` |
+
+Sources are the project's append-only `.agenthub/state/events.jsonl` and `.agenthub/state/hub.log`. The task records have `pii: false`. Line numbers identify the readback prefix; timestamp, task/turn/envelope IDs provide the correlation if logs are later rotated. No raw log excerpt is published.
+
+## Scope
+
+This is a receipt of the historical native peer's accepted host effects, not a new provider/model probe. The logical tool names correspond to the host task/send entry points; individual MCP RPC frame IDs and the historical native binary version are not retained in these records and are not inferred from the later installed version.
+
+`test/jcode-peer.test.ts` separately covers the person-owned MCP writer and override/link/foreign-entry refusals, the configured MCP SDK bridge reaching this project's tools as `jcode`, owned launch/version/stop behavior, and refusal of a load without identity proof. Those are fixtures; they do not replace this historical receipt or establish a fresh native/account turn.
+
+Refs #332. AC6 identity re-probe is recorded separately.

package/docs/verification/2026-10-30-jcode-ac6.md

@@ -0,0 +1,52 @@
+# Jcode 0.99.1 session/load identity re-probe (#332 AC6)
+
+Probe UTC: `2026-10-30T05:14:34.859Z`. Host: macOS arm64, probe parent Bun 1.4.2. This is a model-free native id-echo prerequisite check, not a restored conversation or account/model receipt.
+
+Probe adapter source: `3af9255d355a29bc1d63eaa5b7535f1c48018cd9`; isolated worktree dependency `@staix/agent-mem` 0.13.0. Scratch probe script SHA-256: `27ba447c4fed211fa01234d069a44b4db96e2de31402ab562c7ffe98487cf8e3`.
+
+## Native version and boundary
+
+- Selected installed binary: `~/.jcode/builds/versions/0.99.1/jcode`; SHA-256 `eccb33c08a21764317b0e0bf217e60c745b90f51c7bf6d2ff90b548b9fe7383e`.
+- Native version JSON and ACP `agentInfo` both identify `jcode` `0.99.1`.
+- The current adapter calls `assessVersion("jcode", version)`; this run returned `ok: true`, state `verified`. `COMPAT.jcode` accepts releases from `0.98.0` up to, excluding, `1.0.0`; `0.99.1` is explicitly verified.
+- The product adapter still sets `requireLoadSessionEcho: true`. No source, range, trust or recovery setting changed.
+
+## Isolation and lifecycle
+
+- Fresh, distinct `HOME` and `JCODE_HOME`, temp directory and project repository were created below scratch probe id `j428-tNBKn0`. No auth or other real config contents were copied.
+- The isolated native home and all three project MCP files (`.jcode/mcp.json`, `.mcp.json`, `.claude/mcp.json`) held empty `mcpServers` maps. Child environment was an explicit allowlist; it carried no hub token, peer/launch identity or inherited agent markers.
+- `JCODE_NO_TELEMETRY=1`, `DO_NOT_TRACK=1` and `JCODE_DISABLE_CLAUDE_MCP=1` were supplied. No claim is made that the last flag selects MCP servers or that network attempts were measured.
+- Both native command arrays came from the adapter's `jcodeCommand`: private `.sock` path, `--cwd`, `--no-update`, `--no-selfdev`; serve also used `--temporary-server`, `--owner-pid` and the server name, ACP used `--mcp-tools eager`. Readiness used `JCODE_READY_FD=3` and a verified private socket.
+- Sequence: native version, owned serve readiness, first ACP initialize/new, stop only that ACP group, second ACP initialize/load, then teardown. No `session/prompt`, provider request or native permission grant was sent.
+- Owned process ids: `63478, 63479, 63480, 63492`. The repository's `trackGroup`/`stopOwnedProcess` stopped only these owned groups. Final process-table readback confirmed no member of those groups and no command naming the probe root remained. No global Jcode stop command was used.
+
+## Protocol identifiers
+
+| Step | Recorded result |
+| --- | --- |
+| First initialize | requested protocol 1; `agentInfo` jcode 0.99.1; `agentCapabilities.loadSession: true` |
+| session/new | `sessionId: session_retriever_1793337275047_fe44650598b973ee`; result keys `configOptions`, `models`, `sessionId` |
+| Second initialize | completed on a new ACP client against the same private serve |
+| session/load | requested exactly `session_retriever_1793337275047_fe44650598b973ee`; successful result keys `configOptions`, `models` only |
+| Identity echo | `sessionId` absent; exact equality false |
+
+No raw native response, model catalog, stderr, task text or prompt body is published. The native saved-session file was absent after this zero-prompt run. The successful load therefore demonstrates only the reply shape for a freshly created native session; it does not prove on-disk conversation restoration, server-restart recovery or TUI resume.
+
+## Real configuration comparison
+
+The four real `~/.jcode` files were SHA-256 compared before the first native process and after teardown. All were regular, bounded files; all four comparisons were unchanged. The hash values remain in private scratch evidence and are not published. No file contents are published.
+
+| File | Before/after comparison |
+| --- | --- |
+| `auth.json` | unchanged |
+| `auth-refresh-state.json` | unchanged |
+| `config.toml` | unchanged |
+| `mcp.json` | unchanged |
+
+## Outcome
+
+**AC6 remains blocked on native 0.99.1 id-echo proof.** A successful `session/load` acknowledgement without the selected native id cannot authorize verified restore. The adapter's existing refusal and withheld automatic recovery remain unchanged; the historical conversation and emitted full recovery path are not claimed verified. No enable-restore follow-up is proposed from a non-echoing response.
+
+This confirms the missing-echo boundary recorded in [the earlier 0.99.1 receipt](2026-10-26-jcode-0.99.1.md) with a fresh isolated run. A future native release must independently echo the actual selected id before the verified-restore follow-up is considered.
+
+Refs #332.