@staix/agent-hub 0.30.0 → 0.32.0

package/docs/verification/2026-11-05-hardcoded-values-classification-rules.md

@@ -0,0 +1,311 @@
+# Hard-coded values inventory: how a key is classified (#1180, task #738)
+
+Date: 2026-11-05. Refs #1180. `scripts/inventory-hardcoded-values.classifications.json` is plain JSON that the generator parses as a map from key to class, so it has no place for a header: this file is that header. It was written **before** any key of the baseline was labelled, from two sources only: the K01 to K18 reasons of [the closure](2026-10-30-operational-settings-closure.md) and the finding of [the ratchet record](2026-11-05-hardcoded-values-ratchet.md) that a reader who knew only the closure agreed with the committed file on 58% of a sample. It is not fitted to the sample that checks it.
+
+A key names one literal in one function (`file:function:kind:name=value#n`). Ask the questions in order and stop at the first that answers. The class says **why the value is a constant**, not how important it is.
+
+1. **Test seam.** The literal is the fallback of an injection point that exists for tests, and the code or its name says so: a `/** Test seam ... */` option, a `*ForTest` helper, a port a test replaces, or an environment variable that only a test, a gate or a benchmark sets (`AHUB_CHECK_HANG_S`, `AHUB_*_MS` knobs read with `${VAR:-N}` or `process.env.X ?? N`). A default parameter (`ms = 90000`, `limit = 20`) or a bare `opts.x ?? N` is **not** a test seam: see rule 5.
+2. **Contract.** The value is part of a representation, a wire or storage shape, or an accepted API: a protocol or schema number, a format or identifier width, a unit conversion (`1000`, `86400000`, `60`), an index or position in a stored or parsed structure, a bound that is part of a control message's or a tool's documented shape, `?? 0` or `Math.max(x, 1)` that gives the meaning of an absent or zero stored value, and a default that is **exported or published**: the default of a configuration key (`DEFAULT_CONFIG`, a `*_SETTING.defaultValue`), a tool schema's `minimum` or `maximum`, a declared model context size. A default that only lives in the function that reads it is not published: it is operational (rule 5). Changing a contract changes what stored or exchanged data means.
+3. **Safety floor.** The value bounds what comes from outside the hub's own control, or what could exhaust it: a cap on a path, name, id, command, request, model or foreign-hub text, a truncation of such text before it is shown or stored, a limit on a parser, a proof or a diagnostic read, a native-session ownership record limit. Changing it changes what untrusted input the hub accepts or shows.
+4. **Operational.** Everything else that tunes how the hub behaves without changing what its data means or what it accepts: timeouts, deadlines, polling and batching intervals, retry and backoff numbers, retention and window lengths, TTLs, hub-internal caps on its own queues, caches and lists, display and page sizes, benchmark and smoke-script deadlines and sizes, the numbers inside a backoff expression.
+5. **The three confusable cases, which the first reader got wrong** (the committed file treats each as operational unless rule 1 to 3 applies on its own):
+   - a **hub-internal cap** on the hub's own lists, queues, caches or batches (`slice(0, 50)` of the hub's own rows, a queue cap) is operational, not a safety floor. A cap on text that came from a peer, a model or another project is a safety floor.
+   - an **injected default** (`opts.x ?? N`, `config.x ?? N`, `input.x ?? N`) and a **default parameter** (`function f(ms = 90000)`, `list(limit = 20)`) are operational: the injection point or the parameter makes the value tunable, it does not make it a seam. They are a test seam only under rule 1 (an environment knob or a documented test seam), and a contract only under rule 2 (exported or published).
+   - a **script or smoke deadline** (`scripts/`, `AbortSignal.timeout(N)`, a benchmark's window or size) is operational.
+
+A key that none of these decides is **not labelled**: it stays in the baseline and is reported for a ruling. The rules are the reason a label is written, so a label that needs a new rule adds that rule here first.
+
+## How a batch is checked
+
+Before a batch is written, a fresh blind sample of 80 already-decided keys is drawn at random with a recorded seed, each is labelled from the code with only these rules (the committed label is not shown), and the labels are compared with the file. The batch is written only at 85% agreement or more, and the figure and the disagreements go in the batch's PR. A sample that fails the bar sends the disagreement back to these rules before any key is labelled.
+
+## What a batch labels, and what it leaves in the baseline
+
+A batch labels only shapes where the committed file is consistent with these rules: module constants, timers, deadlines and `Math.min`/`Math.max` clamps, injected defaults, script and benchmark values, and bounds and truncations in `src/adapters`, `src/models`, `scripts/` and `src/local`. The baseline keeps every length bound and every truncation (`.slice`, `.substring`) in `src/hub`, `src/cli`, `src/ui`, `src/rooms` and `src/broker`: the file labels those inconsistently (in `src/hub`, 91 safety floor, 61 contract and 63 operational for length bounds), so no reading of the code can reach the bar there, and their convention is a separate decision by the conductor (the working rule: a bound on text, ids or input from a peer, model or another project is a safety floor; a wire-shape limit on our own protocol is a contract; the hub's own list caps are operational). The sample that checks a batch is drawn only from the same population.
+
+## Calibration record
+
+| Round | Seed | Population | Reader | Agreement | Result |
+| --- | --- | --- | --- | ---: | --- |
+| 1 | 738001 | every decided key | blind reader, these rules | 62 of 80 (77.5%) | below the 85% bar: 18 misses, 12 of them in length bounds, truncations and defaults; the rules were corrected for default parameters and environment knobs and the population narrowed |
+| 2 | 738002 | decided keys outside the `src/hub`, `src/cli`, `src/ui`, `src/rooms`, `src/broker` length bounds and truncations | blind reader, corrected rules | 56 of 80 (70.0%) | below the bar: 24 misses (below) |
+| 3 | 738005 | the 303 decided keys the mechanical rules below cover | the mechanical rules | 78 of 80 (97.5%) | passes, **in-sample**: the rules were written after reading the file's labels |
+
+Round 2 misses, by cause (the starting evidence for #739): 10 literals read as a contract that the file calls operational (a `= 0` reduce start, a `?? 2048` max-tokens default, config-shaped `*_s = 90` defaults, a `timeout_s > 86_400` bound, `hops = 2`, `id = 0`, `start = 0`); 7 read as operational that the file calls a safety floor (200-character error and output truncations, `Math.min(8000, ...)` timeout clamps); 4 read as operational that the file calls a test seam (default parameters such as `timeoutMs = 2000`, `idleTimeoutMs = 600_000`, `opts.pollMs ?? 2000`); 2 read as a safety floor that the file calls operational (`MAX_FILES = 4096`, `totalBytes = 512 MiB`); 1 read as operational that the file calls a contract. The file itself is internally consistent only 78 to 88% on these shapes (default-parameter timeouts 78%, `Math.min(<ms>, ...)` 87%, constants named `MAX_*` 50%), and for `src/hub` length bounds and truncations it is 42% and 48%, so no reading of the code reaches 85% on them.
+
+## The mechanical rules of the first batch (#738)
+
+A key is labelled by a rule only when the rule is a pure function of its name, kind, value and file, and the committed file agrees with that rule on at least 94% of the keys it already decides. The rules, with how the file agrees with each over every decided key (the whole file, not the sample):
+
+| Rule | Label | Decided keys it covers | File agrees |
+| --- | --- | ---: | ---: |
+| R1 a `constant` named `*_MS`, except unit conversions (`DAY_MS`, `MIN_MS`, ...), `*DATE_MAX_MS`, `*WINDOW_MS` and the security exclusion R1x below | operational | 51 | 94% |
+| R1x a `*_MS` constant that bounds replay, revocation or rate: the window in which a replayable request is still accepted, how long a revoked or rotated credential stays valid, or the floor on how often an agent turn may be triggered | safety floor | 0 | none |
+| R2 an inline literal that is the argument of `setTimeout`, `setInterval`, `Bun.sleep`, `sleep`, `AbortSignal.timeout` or `this.backOff` | operational | 134 | 98% |
+| R3 an inline default named `*_s`, `*_min` or `*_ms` (a config-shaped value) | operational | 37 | 100% |
+| R5 a `0` or `1` that starts a reduce, loop or counter (`start`, `id`, `count`, `sum`, `i`, `*.reduce`) | operational | 8 | 100% |
+| R6 a `.slice` or `.substring` of error, output or message text in `scripts/benchmarks/` | safety floor | 28 | 96% |
+
+R1x is the conductor's ruling on the review of PR #1212, not a calibrated rule: the committed file had no decided key of that kind (its decided `*GRACE_MS` keys are process-kill grace periods and `RATE_LIMIT_MS` throttles a log line, all operational), so its agreement is not measured. It labels four baseline keys: `tool-request.ts` `MAX_FUTURE_MS` (the replay window of request ids), `broker/store.ts` and `rooms/store.ts` `GRACE_MS` (how long a rotated epoch's frames stay accepted, which bounds how long a revoked member's key still works) and `schedules.ts` `MIN_EVERY_MS` (the floor that stops a schedule triggering an agent turn more often than every 15 minutes, a spend guard).
+
+R4 (a `maxTokens` or `contextWindow` default, 97%) and R7 (a length bound in `src/adapters`, `src/models`, `src/local`, 91%) agree with the file, but no baseline key was labelled by R4, and R7's five baseline keys have no exact agreeing precedent, so they stay in the baseline. Taken together the rules agree with 303 of the 311 decided keys they cover (97.4%) and with 97% and 98% on the two halves of a by-file hold-out (files split by a hash of their path), which is the same data seen differently, not an independent reader.
+
+Not labelled, on purpose: every length bound and truncation in `src/hub`, `src/cli`, `src/ui`, `src/rooms` and `src/broker`; `Math.min`/`Math.max` clamps of a timeout; default-parameter timeouts (`timeoutMs = 2000`); `MAX_*` and `*_BYTES` constants; unit conversions. #739 settles their convention first and then relabels the inconsistent existing entries by name.
+
+## The `src/hub` convention for bounds and truncations (#739)
+
+Ruled by the conductor on 2026-11-05. It decides bounds (`x.length > N`, `Object.keys(x).length > N`, a byte limit) and truncations (`.slice(0, N)`, `.substring`) in `src/hub`. Ask in order:
+
+1. A validation bound on an argument of a **documented tool or control message** is a **contract**, whether or not `hub-tools.ts` repeats the number: it is part of that message's shape.
+2. A bound or truncation on **free text, ids or raw input that no message shape defines** (a peer's body, a model's output, another project's or GitHub's text, a person's input) is a **safety floor**.
+3. A cap on **the hub's own lists, batches or reports**, which the hub trims, pages or reports as truncated, is **operational**.
+4. A bound on the **shape of a documented file format the person writes** (config, profile, role, extension, text projection) is a **contract**, like a documented message.
+
+Truncations (`.slice`, `.substring`) are decided by what is cut:
+
+5. A **shortened id, hash or commit** (`commit.slice(0, 12)`, `sha256.slice(0, 16)`, a log timestamp used as an evidence id) is a **contract**: a displayed identity format that other tools and people match on.
+6. The **hub's own list** cut to N (`pending.slice(0, 64)`, `history.slice(-5)`) is **operational**, and so is a **display cap on the hub's own report** (`pool.walk.length > 16`, `paths.length > 20`, a held-rows cap).
+7. **Text cut for a log line, notice or reply** is a **safety floor** only when the cut text **originates outside the hub process**: a model, a peer, a person, another project, a native hook process, or a subprocess, network, git or file-parse error that can carry external content. The hub's own composed message, or its own internal error text logged locally, is **operational**. Ask where the text comes from, not where it goes.
+
+Rulings of #741 (the conductor, 2026-11-06), added after a fresh blind sample (seed 741001) agreed on 70% and the misses fell into six shapes. They extend lines 1 to 7; where one differs, the later line decides its shape:
+
+8. A cap on **the hub's own cache, set, map or concurrency limiter** is **operational**, and so is the line 3 reading of lists, batches and reports. Exception: decide by **what one insert is caused by, not by the name**. A set or map that gains one entry per event **another process controls** (a peer's envelope, a remote room frame, a native hook's tool call, a file a person or agent writes, an acknowledgement a caller names) is a **safety floor**: it bounds memory against outside input. A set the hub fills only from its own decisions (a check run, a launch candidate, an approval, a prepared review) is operational.
+9. A **silent truncation of a tool argument** (the hub cuts it and goes on, with no refusal) is a **contract** when the limit is stated in that tool's schema (`maxLength` in `hub-tools.ts`) or in `docs/operations.md`; otherwise it is a **safety floor**. The same argument in two tools is decided per tool: `hub_backlog_split` states `title` 300 and `detail` 8000, `hub_task_propose` does not, so its cut is a safety floor.
+10. **Error or stack text** cut for a log, notice or reply is a **safety floor**, unless the text is a **fixed phrase the hub composed**: then the cut is a display cap and **operational**.
+11. A cap on **what a read tool returns** (edges, lines, bytes of one result) is a **contract**: it is the documented shape of that result.
+12. A bound on **a field of a documented message or envelope** (a task handoff key's project id, the `refs.paths` of a deferred envelope, a hub task envelope's `refs.backlog`) is a **contract** under line 1, as is a shortened id or hash (`lease.holder.slice(0, 8)`).
+13. A bound on something **parsed from git, GitHub or a subprocess** (a path inventory, a control line, a config key listing, a documents list, a tail of runner output) is a **safety floor**: it fails closed against content the hub does not write.
+
+A number is never evidence by itself. Many unrelated schema entries share `32`, `64`, `256` or `4096`, so "the same number appears in `hub-tools.ts`" decides nothing: the first measurement of #739 counted 280 of 378 `src/hub` bounds as mirrors of a schema by number, and only a handful really repeat a tool schema's limit once the call sites are read.
+
+### What the committed file did before this change (measured on `8e44babc`)
+
+| Shape | Decided keys | operational | safety floor | contract |
+| --- | ---: | ---: | ---: | ---: |
+| `src/hub` length bounds | 213 | 63 | 91 | 59 |
+| `src/hub` truncations (`.slice`) | 151 | 73 | 47 | 31 |
+
+Among the 213, those that refuse or validate input (171) were 77 safety floor, 53 contract and 41 operational, and the file labelled the same kind of check differently by file: `tasks.ts` 19 of 20 contract, `sdlc.ts` 14 of 22 safety floor, `test-integrity.ts` 6 of 6 safety floor. Across the whole decided file 214 expressions appear in more than one place and 28 of them carried conflicting labels (133 keys), mostly default-parameter timeouts and `Math.min`/`Math.max` clamps, which this change does not touch.
+
+### Existing labels changed by this convention (44, by key, old to new)
+
+All 173 decided `src/hub` validation bounds (outside `hub-tools.ts`) were read at their call sites. 44 contradicted the convention and are changed; every other decided bound already agrees with it and was left alone, including `deferred-hub.ts` `env.body.length > 1_000_000` and `delivery-hints.ts` `row.id.length > 256` (a peer's raw body and a hub-built hint, no message shape: safety floor). Group membership is a reading of each call site, reviewed by the conductor.
+
+#### A. Argument of a documented tool or control message: to contract (19)
+
+Reason: Each is an argument of a documented tool or control message (`taskOpBody`, `uiAction`, `recoveryOp`, `onMessage`, the check runner's `files`, the planning `deps` list). The bound is part of that message's shape, whether or not `hub-tools.ts` repeats the number.
+
+| Key | Old | New |
+| --- | --- | --- |
+| `check-runner.ts` `request.files.length > 32=32` (in `start`) | operational | contract |
+| `daemon.ts` `a.files.length > 32=32` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `a.delivery_id.length > 256=256` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `a.delivery_id.length > 256=256` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `a.reason.length > 2000=2000` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `a.superseded_by.length > 2000=2000` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `a.release.length > 100=100` (in `taskOpBody`) | safety floor | contract |
+| `daemon.ts` `liveIssues.length > 32=32` (in `uiAction`) | operational | contract |
+| `daemon.ts` `a.to.length > 32=32` (in `uiAction`) | operational | contract |
+| `daemon.ts` `msg.operationId.length > 128=128` (in `recoveryOp`) | operational | contract |
+| `daemon.ts` `msg.launchId.length <= 128=128` (in `onMessage`) | operational | contract |
+| `daemon.ts` `msg.launchId.length <= 128=128` (in `onMessage`) | operational | contract |
+| `daemon.ts` `msg.launchId.length <= 128=128` (in `onMessage`) | operational | contract |
+| `daemon.ts` `msg.reason.length > 2000=2000` (in `onMessage`) | operational | contract |
+| `daemon.ts` `msg.id.length > 256=256` (in `onMessage`) | operational | contract |
+| `daemon.ts` `msg.reason.length > 2000=2000` (in `onMessage`) | operational | contract |
+| `daemon.ts` `(msg.liveIssues ?? []).length > 32=32` (in `onMessage`) | operational | contract |
+| `daemon.ts` `(msg.liveIssues ?? []).length > 32=32` (in `onMessage`) | operational | contract |
+| `planning.ts` `value.length > 64=64` (in `planningPatch`) | operational | contract |
+
+#### B. Text or replies from GitHub, another project or a person: to safety floor (6)
+
+Reason: Each bounds text or a reply that comes from GitHub, another project or a person, which no tool or control message defines, so it limits untrusted input.
+
+| Key | Old | New |
+| --- | --- | --- |
+| `dogfood-read.ts` `r.pull_requests.length <= 100=100` (in `validRun`) | operational | safety floor |
+| `github-import.ts` `row.title.length>300=300` (in `<anonymous>`) | operational | safety floor |
+| `github-import.ts` `row.body.length>8000=8000` (in `<anonymous>`) | operational | safety floor |
+| `sdlc-queue.ts` `p.baseRefName.length > 200=200` (in `<anonymous>`) | operational | safety floor |
+| `sdlc-queue.ts` `threads.nodes.length > 100=100` (in `finalSnapshot`) | operational | safety floor |
+| `sdlc-queue.ts` `checks.nodes.length > 100=100` (in `finalSnapshot`) | operational | safety floor |
+
+#### C. The hub's own derived list: to operational (1)
+
+Reason: A cap on the hub's own derived list, which the hub builds itself and reports as truncated, so it tunes a list size and is not an input bound.
+
+| Key | Old | New |
+| --- | --- | --- |
+| `task-code-symbols.ts` `brief.reviewable.length > 500=500` (in `buildTaskCodeSymbols`) | safety floor | operational |
+
+#### D. Shape of a documented file the person writes: to contract (18)
+
+Reason: Each is the bound on the shape of a documented file format the person writes (config, profile, role, extension or text projection), which is a contract like a documented message (the conductor's wording of the convention).
+
+| Key | Old | New |
+| --- | --- | --- |
+| `github-import.ts` `value.length<=100=100` (in `selectionText`) | operational | contract |
+| `path-policy.ts` `raw.length > 64=64` (in `policyPaths`) | safety floor | contract |
+| `config-tier.ts` `part.length > 64=64` (in `<anonymous>`) | safety floor | contract |
+| `text-projection.ts` `Object.keys(raw).length > 16=16` (in `projectionConfig`) | safety floor | contract |
+| `text-projection.ts` `argv.length > 16=16` (in `projectionConfig`) | safety floor | contract |
+| `text-projection.ts` `arg.length > 2000=2000` (in `<anonymous>`) | safety floor | contract |
+| `profiles.ts` `Object.keys(data.classes).length > 32=32` (in `resolveProfile`) | safety floor | contract |
+| `profiles.ts` `Object.keys(data.role_text).length > 8=8` (in `resolveProfile`) | operational | contract |
+| `profiles.ts` `data.example_checks.length > 16=16` (in `resolveProfile`) | operational | contract |
+| `profiles.ts` `data.review_checklist.length > 16=16` (in `resolveProfile`) | safety floor | contract |
+| `profiles.ts` `value.length > 500=500` (in `<anonymous>`) | operational | contract |
+| `planning.ts` `Object.keys(input).length > 64=64` (in `planningWipLimits`) | operational | contract |
+| `roles.ts` `sanitize(body).length > 2000=2000` (in `parseRole`) | safety floor | contract |
+| `roles.ts` `files.length > 64=64` (in `loadRoleCatalog`) | safety floor | contract |
+| `roles.ts` `Object.keys(raw).length > 64=64` (in `catalogAssignments`) | safety floor | contract |
+| `roles.ts` `ids.length > 2=2` (in `catalogAssignments`) | safety floor | contract |
+| `roles.ts` `roles.length > 2=2` (in `catalogSection`) | safety floor | contract |
+| `roles.ts` `text.length > 2000=2000` (in `taskRoleText`) | safety floor | contract |
+
+
+### Additional relabels (47, by key, old to new)
+
+A second round, after the first sample showed the convention did not decide truncations. Each change was asserted against its old label when applied; nothing else changed. The 17 truncations that fit no line (for example `action-class.ts` `text.slice(i, i + 256)`, `permission-payload.ts` `full.slice` 600, `envelope.ts` `noteLine`) keep their labels.
+
+#### Shortened id, hash or commit: to contract (6)
+
+| Key | Old | New |
+| --- | --- | --- |
+| `ask.ts` `l.slice=10` (in `id`) | operational | contract |
+| `daemon.ts` `publicStatus.generation.slice=8` (in `generation`) | operational | contract |
+| `deliverables.ts` `createHash(sha256).update(${format}\0${path}).digest(hex).slice=12` (in `deliverableId`) | operational | contract |
+| `registry.ts` `createHash(sha256).update(root).digest(hex).slice=24` (in `idFor`) | operational | contract |
+| `research.ts` `createHash(sha256).update(projectId).digest(hex).slice=16` (in `projectKey`) | operational | contract |
+| `task-code-group.ts` `r.head.slice=8` (in `head`) | operational | contract |
+
+#### The hub's own list cut to N: to operational (10)
+
+| Key | Old | New |
+| --- | --- | --- |
+| `activity.ts` `u.locations.slice=12` (in `updateActivity`) | safety floor | operational |
+| `tasks.ts` `(Array.isArray(v) ? v : typeof v === string ? [v] : []).map(text).filter((p): p is string => !!p).slice=50` (in `textList`) | safety floor | operational |
+| `tasks.ts` `holders.slice=8` (in `detail`) | safety floor | operational |
+| `tasks.ts` `history.slice=-5` (in `publicHistory`) | safety floor | operational |
+| `tasks.ts` `[...this.incomingBacklog].sort((a, b) => a - b).slice=64` (in `incoming`) | contract | operational |
+| `tasks.ts` `[...pending].sort((a, b) => a - b).slice=64` (in `ids`) | contract | operational |
+| `tasks.ts` `pool.walk.slice=16` (in `walk`) | safety floor | operational |
+| `tasks.ts` `paths.slice=20` (in `list`) | safety floor | operational |
+| `tasks.ts` `[...new Set([taskNode, ...symbols.nodes, ...about])].slice=64` (in `saveNative`) | safety floor | operational |
+| `text-projection.ts` `(process.env.PATH ?? /usr/bin:/bin).split(:).slice=32` (in `choices`) | safety floor | operational |
+
+#### Text cut for a log line, notice or reply: to safety floor (origin test noted per entry) (21)
+
+| Key | Old | New | Origin of the cut text |
+| --- | --- | --- | --- |
+| `ask.ts` `raw.slice=2000` (in `answer`) | operational | safety floor | model output |
+| `conflicts.ts` `String(r.title).slice=100` (in `<anonymous>`) | operational | safety floor | another agent's task title |
+| `daemon.ts` `sanitize(row.key).slice=160` (in `retainedConfigAfterReload`) | operational | safety floor | a rejected config key the person wrote |
+| `daemon.ts` `sanitize(row.reason).slice=1200` (in `retainedConfigAfterReload`) | operational | safety floor | a rejected config reason built from the person's config value |
+| `daemon.ts` `${v.title ? ${v.title}: : }${v.text}.replace(/\s+/g, ).slice=160` (in `memoryLine`) | operational | safety floor | memory text written by peers and the model |
+| `daemon.ts` `${v.title ?? }\n${v.text}.slice=1500` (in `note`) | operational | safety floor | memory note text written by peers and the model |
+| `daemon.ts` `${c.title ?? }\n${c.text}.slice=600` (in `note`) | operational | safety floor | memory note text written by peers and the model |
+| `daemon.ts` `JSON.stringify(v).slice=60` (in `peerArg`) | operational | safety floor | the caller's tool argument echoed in a refusal |
+| `daemon.ts` `sanitize(e.reason ?? delivery retries exhausted).replace(/\s+/g, ).slice=300` (in `reason`) | operational | safety floor | a delivery retry reason, which can carry a native adapter's error text |
+| `daemon.ts` `e.env.body.slice=200` (in `<anonymous>`) | operational | safety floor | a peer's message body logged |
+| `daemon.ts` `v.text.slice=600` (in `text`) | operational | safety floor | memory text written by peers and the model |
+| `daemon.ts` `msg.tool.slice=64` (in `tool`) | operational | safety floor | a native hook process's tool name |
+| `daemon.ts` `msg.toolUseId.slice=128` (in `toolUseId`) | operational | safety floor | a native hook process's tool use id |
+| `daemon.ts` `msg.sessionId.slice=128` (in `sessionId`) | operational | safety floor | a native hook process's session id |
+| `daemon.ts` `String(msg.question).slice=80` (in `title`) | operational | safety floor | a person's question to ahub ask |
+| `daemon.ts` `String(msg.question).slice=300` (in `text`) | operational | safety floor | a person's question to ahub ask |
+| `deliverables.ts` `extra[0]!.slice=32` (in `own`) | operational | safety floor | an unknown field name from the caller's deliverable |
+| `packs.ts` `(error as Error).message.slice=200` (in `reason`) | operational | safety floor | a project role-pack file's parse error, which echoes the file's content |
+| `progress.ts` `tool.slice=80` (in `name`) | operational | safety floor | a native hook process's tool name |
+| `progress.ts` `item.name.slice=80` (in `name`) | operational | safety floor | a progress item sent by a peer |
+| `progress.ts` `item.source.slice=40` (in `source`) | operational | safety floor | a progress item sent by a peer |
+
+#### Display caps on the hub's own report: to operational (5)
+
+| Key | Old | New |
+| --- | --- | --- |
+| `tasks.ts` `pool.walk.length > 16=16` (in `walk`) | safety floor | operational |
+| `tasks.ts` `paths.length > 20=20` (in `list`) | safety floor | operational |
+| `tasks.ts` `result.length < 32=32` (in `outsideIds`) | safety floor | operational |
+| `daemon.ts` `guarded.length > 200=200` (in `prepareConfiguration`) | safety floor | operational |
+| `delivery-hints.ts` `result.rows.length >= 32=32` (in `heldDeliveryHints`) | safety floor | operational |
+
+#### Bounds on the shape of the person's config (`config-reload.ts`): to contract (5)
+
+| Key | Old | New |
+| --- | --- | --- |
+| `config-reload.ts` `Object.keys(v).length > 256=256` (in `table`) | operational | contract |
+| `config-reload.ts` `v.length > 4096=4096` (in `text`) | operational | contract |
+| `config-reload.ts` `v.length > 128=128` (in `peers`) | safety floor | contract |
+| `config-reload.ts` `v.length > 16_384=16_384` (in `openValue`) | operational | contract |
+| `config-reload.ts` `v.length > 1024=1024` (in `openValue`) | safety floor | contract |
+
+#### Three omissions found by the second sample: to contract (3)
+
+The first list of argument bounds missed three that the convention (line 1) already covers; found when the blind reader labelled them contract.
+
+| Key | Old | New | Why |
+| --- | --- | --- | --- |
+| `workflow.ts` `p.criteria.length > 32=32` (in `criteriaReceipt`) | operational | contract | the `criteria` argument of `hub_sdlc_record` (schema `maxItems: 32`) |
+| `workflow.ts` `c.refs.length > 8=8` (in `<anonymous>`) | operational | contract | the `refs` of one criterion of `hub_sdlc_record` (schema `maxItems: 8`) |
+| `claude-launch-proof.ts` `row.launchId.length > 128=128` (in `readClaudeLaunchProof`) | operational | contract | the `launchId` control field, the same bound that `daemon.ts` `onMessage` already labels contract |
+
+### Calibration of the `src/hub` convention (#739)
+
+The population is the 365 decided `src/hub` bounds and truncations (`hub-tools.ts` excluded). Each round is a blind 80-sample read with only the convention, the committed labels hidden.
+
+| Round | Seed | File state | Agreement | Bounds | Truncations |
+| --- | --- | --- | ---: | ---: | ---: |
+| 1 | 739101 | after the first 44 relabels, lines 1 to 4 only | 56 of 80 (70.0%) | 36 of 44 (82%) | 20 of 36 (56%) |
+| 2 | 739202 | after 47 more relabels, lines 1 to 7 | 71 of 80 (88.8%) | 42 of 47 (89%) | 29 of 33 (88%) |
+
+Round 2 clears the 85% bar. It is **in-sample in one respect**: lines 5 to 7 and the 47 relabels were written after round 1's misses, so the sample measures whether the convention now decides what it was extended to decide, not an independent reader. A fresh seed drawn from the relabelled file is the check that matters, and it was drawn only after the relabels were applied.
+
+Round 2's nine misses: three are keys the first list left out (`workflow.ts` criteria 32, criterion refs 8 and `claude-launch-proof.ts` launchId 128, relabelled contract above); `check-runner.ts` `lines.slice(-40)` (a cut of a subprocess's output, which line 7 calls safety floor, labelled by me operational) and `version.stdout.trim().slice(0, 80)` (the converse); `daemon.ts` `schedules pass failed: ...message.slice(0, 160)` and `tasks.ts` `task.title.slice(0, 120)` (a memory title from the task's own title, where whether the origin is outside the hub is a judgement); `execution-budget.ts` `input.id.length > 200` and `delivery-hints.ts` `held.rows.length > 32`. The remaining disagreements are about where text originates, and line 7 is the place to sharpen if a later sample falls short.
+
+No baseline key is labelled in this change. That is #741 (below).
+
+## Batch 1 of #741: 149 `src/hub` length bounds (#741)
+
+Date: 2026-11-06. Refs #1180. The population is the 187 baseline keys in `src/hub` that are a length or size bound and not a truncation. The 38 left in the baseline are the keys no line decides without a ruling or a caller trace: lower bounds that only say "not empty" or "at least N" (`< 1`, `>= 2`, `< 8`, `before.size < 1`), bounds whose message the key does not name (`daemon.ts` `values.length > 256`, `tool-request.ts` scope and bucket 4096, `operational-view.ts` metadata lists, `specs.ts` `base.length > 200`), research-campaign and experiment bounds in `board.ts` (`owners`, `hostEvidence`, runner receipts), and read-side display caps in `publicReadValue`. A key left here is reported for a ruling, not guessed. Truncations (`.slice`, `.substring`) are batch 2.
+
+### Calibration
+
+| Round | Seed | File state | Reader | Agreement | Result |
+| --- | --- | --- | --- | ---: | --- |
+| 1 | 741001 | after #739, lines 1 to 7 | blind reader, lines 1 to 7 | 56 of 80 (70.0%) | below the bar: 24 misses in six shapes (below) |
+| 2 | 741002 | after the 17 relabels below, lines 1 to 13 | blind reader, lines 1 to 13 | 68 of 80 (85.0%) | meets the 85% bar |
+
+Both samples are drawn from the decided `src/hub` bounds and truncations (`hub-tools.ts` excluded), without replacement across rounds (round 2 excludes round 1's 80 keys). The reader read each key at its call site with the committed label hidden and wrote every label before scoring.
+
+Round 1's misses, by shape: 6 bounds on a message or envelope field the file called safety floor or operational (line 12); 5 bounds on content parsed from git, GitHub or a subprocess (line 13); 4 caches, sets and limiters (line 8); 4 cuts of error or stack text (line 10); 3 silent truncations of a tool argument (line 9); 2 caps on a read tool's output (line 11). The conductor ruled each; the rulings are lines 8 to 13 above.
+
+Round 2's 12 misses. Five are **relabelled** in this PR (the rule decides and the file contradicted it, so they follow #739's practice of changing a contradicting entry by name): `plan-conformance.ts` `planPaths.length > 1000` (operational to safety floor, rule 13: it is the same check as `completePlanInventory`, on the plan paths compared with a PR's file list read from GitHub), `usage.ts` transcript size 32 MiB (operational to safety floor, rule 13: it bounds a file a Claude process writes), `github-import.ts` 2 MiB read (operational to safety floor, rule 13: GitHub's output), `deferred-hub.ts` `env.to.length > 256` (safety floor to contract, rule 12: a field of the deferred envelope, like its `refs.paths`) and `deliverable-files.ts` `message.replace(path, "the path").slice(0, 160)` (safety floor to operational, rule 10: a guardPath refusal the hub composed). One is **decided and left**: `delivery-journal.ts` `Object.keys(queues).length > 4096` stays safety floor, because `queues` is a field of the journal snapshot the hub writes and reads back, which no document names, so rule 12 does not apply and rule 13 reads a damaged file as outside content. Six **stay open for batch 2**: `settings.ts` `presetValue` 4096, `dogfood-read.ts` `line.slice(0, 24)`, `claude-launch-proof.ts` `executionCwd` 4096, `board.ts` `failure.head.length > 300`, `code-facts.ts` `a.at.length < 9` and `spec-read.ts` `issues.size > 3`: no line decides them without a ruling.
+
+### Existing labels changed by the rulings (17, by key, old to new; the five round 2 relabels are listed in the round 2 paragraph above)
+
+| Rule | Key | Old | New |
+| --- | --- | --- | --- |
+| 8 | `check-runner.ts` `this.entries.size >= 3` (in `start`) | safety floor | operational |
+| 8 | `code-facts.ts` `this.cache.size>128` (in `query`) | safety floor | operational |
+| 8 | `memory-observations.ts` `this.pending.size > 2048` (in `delivery`) | safety floor | operational |
+| 8 | `daemon.ts` `injected.size > 512` (in `readTranscript`, one entry per hook line a native process writes) | operational | safety floor |
+| 8 | `limits.ts` `this.recent.size > 1000` (in `admit`, one entry per distinct message a peer sends) | operational | safety floor |
+| 8 | `daemon.ts` `retainedCliAudits.size > 4096` (in `drainCliAuditsNow`, one entry per audit a CLI process sends) | operational | safety floor |
+| 10 | `daemon.ts` `sanitize(error.message).slice=1000` (in `error`, a fixed Pi version refusal) | safety floor | operational |
+| 12 | `deferred-hub.ts` `refs.paths.length > 256` (in `validateDeferredEnvelope`) | safety floor | contract |
+| 12 | `tasks.ts` `projectId.length > 200` (in `handoffStateByKey`) | safety floor | contract |
+| 12 | `bus.ts` `backlog.length > 64` (in `queuedBacklogIds`) | safety floor | contract |
+| 12 | `daemon.ts` `g.lease.holder.slice=8` (in `goalLine`) | operational | contract |
+| 13 | `plan-conformance.ts` `evidence.paths.length > 1000` (in `completePlanInventory`) | operational | safety floor |
+| 13 | `code-facts.ts` `keys.length>128` (in `nativeEnv`) | operational | safety floor |
+| 13 | `code-facts.ts` `control.length>64` (in an anonymous stream handler) | operational | safety floor |
+| 13 | `sdlc-release-authorization.ts` `value.documents.length > 128` (in `docsVerdict`) | contract | safety floor |
+| 13 | `check-runner.ts` `lines.length > 40` (in `cut`) | operational | safety floor |
+| 13 | `check-runner.ts` `Buffer.byteLength(result) > 4096` (in `cut`) | operational | safety floor |
+
+(The 17 are the 15 of the first pass and two found when rule 8 was read by cause. `daemon.ts` `error` is the Pi refusal, a fixed phrase, and the other `sanitize(error.message).slice=1000` keeps safety floor.)
+
+### The 149 keys labelled, by label
+
+Each key was read at its call site and decided by the rule named. 25 operational (rule 8 for the hub's own caches and display caps, rule 6 for a hub-built report), 77 safety floor (rule 13 for content parsed from git, GitHub or a subprocess, the config or environment values the hub reads and fails closed on, rule 8 for sets one outside event fills, rule 2 for free text no message defines), 47 contract (rule 1 and 12 for a documented message or envelope field, rule 4 for a documented file the person writes, rule 11 for a read tool's result). The keys are in `scripts/inventory-hardcoded-values.classifications.json`; the baseline file lost exactly those 149 and gained none (1155 to 1006).

package/docs/verification/2026-11-05-hardcoded-values-ratchet.md

@@ -0,0 +1,55 @@
+# Hard-coded values inventory: why it drifted, and the ratchet that stops it (#1180, task #719)
+
+Date: 2026-11-05. Refs #1180. The issue stays open: its AC1 (zero unknown keys) is not met by this change. This record exists so the follow-up that classifies the rest starts from measurements, not from a guess.
+
+## Cause
+
+Not a generator bug. `scripts/inventory-hardcoded-values.ts` and `scripts/inventory-hardcoded-values.classifications.json` were committed together by #764 on 2026-10-24, and nothing ever ran the generator again: no step of `scripts/check.sh`, no workflow and no test. The file was edited by hand twice (#1099 changed one value, #1167 removed 11 keys), and every other change to `src/` and `scripts/` added constants nobody classified.
+
+Measured by running the generator at past commits:
+
+| Commit | Date | Unknown keys |
+| --- | --- | ---: |
+| `7c1d2065` (#764, the commit that added the inventory) | 2026-10-24 | 22 |
+| `b454e527` | 2026-10-25 | 63 |
+| `438e9b23` | 2026-10-28 | 527 |
+| `9680a4db` | 2026-11-02 | 1065 |
+| `8511d01a` (#1099) | 2026-11-02 | 1087 |
+| main at `4b34fab1` | 2026-11-05 | 1438 |
+
+The 22 at #764's own head are the memory-code files that landed in the same week. The 1282 in the issue and the 1438 here are the same drift counted at two commits. At this commit 3243 inventory entries exist, 1805 were decided, 1438 were unknown and 36 committed keys matched nothing (the code they named had moved or changed).
+
+## What this change does
+
+1. Removes the 36 stale keys.
+2. Classifies 216 unknown keys by precedent in the file itself, and nothing else. A key is adopted only when every already-decided key sharing its parts agrees, taking the tiers in this order and stopping at the first that decides:
+   - same file, kind, name and value (82 keys): leave-one-out accuracy over the committed decisions 99.4%;
+   - same file, kind and name (44 keys): 97.6%;
+   - same kind, name and value, with at least two agreeing precedents (72 keys): 95.7%;
+   - same kind and name, with at least two agreeing precedents (18 keys): 94.1%.
+   The same two weaker tiers with a single precedent measured 92.6% and 89.2%, which is why they need two. The 216 are 109 contract, 81 operational, 23 safety floor and 3 test seam.
+3. Puts the other 1222 unknown keys in `scripts/inventory-hardcoded-values.baseline.json`, the list of known-unclassified keys. They are not classified. `bun scripts/inventory-hardcoded-values.ts --check` fails on any unknown key that is not in that list, on a baseline key that has since been classified, and on a baseline key that matches no entry. The baseline only shrinks. `scripts/check.sh` runs the check with the other once-only steps.
+
+## What this change does not do, and why
+
+It classifies none of the 1222 remaining keys. The attempt was measured first. 190 of them were labelled by reading each literal's source line against the K01-K18 reasons of `2026-10-30-operational-settings-closure.md`, then 80 already-decided entries (seeded random draw, labels hidden) were labelled the same way and compared with the committed file: **47 of 80 agreed (58%)**. The disagreements were systematic, not noise:
+
+| Committed class | I labelled | Count | Typical case |
+| --- | --- | ---: | --- |
+| operational | safety floor | 12 | a hub-internal cap constant (`MAX_STATES = 256`, `tasks.length > 500`, a 1024-entry map) |
+| operational | contract | 7 | a saturating `Math.max(0, ...)`, a `limit < 1` check |
+| operational | test seam | 6 | a smoke script's `deadline`, an injected `opts.x ?? N` default |
+| contract | safety floor | 5 | a short id or text slice bound |
+| safety floor | operational | 2 | a `termMs`/`killMs` in a review-isolation stop |
+
+So the file's operative rule for `operational` is wider than the prose of the K groups: a hub-internal cap, an injected default and a script deadline all count as operational, and the prose does not say so. A rule pass built from the K-group text was 65% accurate on the 1805 decided entries and a text-feature classifier 71%, so neither decides anything. Writing 1222 labels at 58% would be the blind classification the issue forbids.
+
+## How the remaining 1222 get classified
+
+As a separate task, in batches a person can review, under these rules:
+
+- Before the first batch, write the rule for each confusable case into the header of the classifications file or this record: hub-internal caps, injected `opts.x ?? N` defaults, script deadlines, short id and hash slices, saturating zero bounds.
+- Each batch is labelled by those written rules, never by feel.
+- Each batch needs a fresh blind sample of 80 already-decided entries labelled by the same rules, and an agreement of 85% or more with the committed file, before the batch is written.
+- Classifying a key means adding it to the classifications file and removing it from the baseline in the same commit; `--check` refuses the half-done state.
+- Do not regenerate `docs/verification/2026-10-24-hardcoded-values.md`: `test/operational-settings.test.ts` reads it by row.

package/docs/verification/2026-11-06-0.32.0.md

@@ -0,0 +1,149 @@
+# 0.32.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.32.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.32.0, prepared from main eddbd522 (2 commits since v0.31.0, 1 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.31.0: #1229, #1227.
+
+The board approval head equals each merged PR head (`mismatch: false`), and
+GitHub readback shows no failed or pending check. These head-specific hosted
+results are not live or mixed-room acceptance:
+
+| PR / task | Approved head | Merge commit | Hosted CI |
+| --- | --- | --- | --- |
+| [#1227](https://github.com/STAIxBWLB/agent-hub/pull/1227), task 741 | `20f6e4b6ea18333fa1e45a6ad6cd36eaf40f7eeb` | `307a91a0fb3d8ce38b812753444de388c86b191d` | 19 success, 2 skipped |
+| [#1229](https://github.com/STAIxBWLB/agent-hub/pull/1229), task 736 | `4d666223491ac6aff7c5347d4250c7eb6268b20a` | `eddbd5228d6d6f5e6638a617b112a4ca83ab000a` | 20 success, 2 skipped |
+
+Neither merge is bound to an earlier approval head. No merge was performed by
+task 745.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.31.0: none.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.32.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+Eleven stale documents were reviewed against only #1229 (T3) and #1227
+(inventory conventions). Corrected content:
+
+- `README.md`: generated Status 0.32.0 and the current release-report link.
+- `docs/quickstart.md`: generated 0.32.0 upgrade section, concrete room changes,
+  N-1 baseline and the required matching global CLI/plugin step.
+- `docs/agent-notes/bus.md`: add `holdRemoteEpochRotated` to the host-port list,
+  keep aging advisory and status read-only, and preserve disposition/proof rules.
+- `docs/agent-notes/daemon.md`: await the new asynchronous room stop before
+  shared storage closes, without bypassing the attempted FIFO head.
+- `docs/agent-notes/tests.md`: replace the obsolete wait-for-739 convention with
+  the committed bounds/truncation rules and fresh blind 80-sample/85% procedure;
+  keep calibrated mechanical rules outside that settled slice and baseline-only
+  shrink behavior.
+- `docs/operations.md`: update the current protocol/N-1 version table and
+  distinguish the exact epoch journal reason from its shorter `holdReason` label.
+
+Reviewed without content change:
+
+- `docs/agent-notes/README.md`: historical explanation remains valid.
+- `docs/agent-notes/adapters.md`: no native adapter change; existing owned-work
+  shutdown/await rules still apply.
+- `docs/agent-notes/budget.md`: quota, pause and context contracts are unchanged.
+- `docs/agent-notes/tasks.md`: room holds do not mutate task authority or routing.
+- `docs/security.md`: T3 already states advisory-only liveness, legacy broker
+  behavior, bounded FIFO stop, signed identity and local rotation fences.
+
+These 11 reviewed documents were restamped through the official
+`release-prepare restamp ... --reviewed` path after the reviewed content commit
+`2f4c372a6ce48dc01acb4a002f6a46e9557cbd17`. Following the approved fixture
+exception, the tests note was reviewed again and its final stamp points to
+`4ad77748c96383bdef8e55a11ff53808a1359500`; the other ten retain `2f4c372a`.
+Fresh benchmarks, local-worker, models and help stamps were not refreshed.
+All watched path definitions remain unchanged.
+
+## Checks
+
+The official generator was dry-run first, then executed on dgx02 from committed
+`eddbd5228d6d6f5e6638a617b112a4ca83ab000a`, on exact branch `release/0.32.0`,
+after fetching the existing published v0.31.0 tag and a frozen root install.
+Bun 1.4.2 generated the bundle/manifest and the separately retargeted fixture
+lock. Approved artifact-return exception `981f5052` returned only the bundle and
+manifest plus task source/generator outputs and fixture lock; no node_modules,
+target or other build output returned. Producer hashes:
+
+- `server.js`: `6f48c2f68e062798eab50b00b14c3319f03f06465f194d8b133f5641607e4bce`.
+- Plugin manifest: `a8c5f3b2295ac58c935eb6df65617dfc887f1fd357cc989ee0400752d8232606`.
+- N-1 `bun.lock`: `de66be194ed847153324d9715422355e0984d49fa7c903ac15451a49db171a91`.
+
+npm readback confirms 0.31.0 is the only published 0.31.x patch and pins agent-mem
+0.21.0. The fixture manifest/matrix now match; protocol floor 0.25.0 is unchanged.
+The initial full run at `a182b06b` exposed a fixture-only positive-host gap:
+the now-retargeted published 0.31.0 plugin already requires native parent-row
+evidence, while the fixture injected it only for current source. The unchanged
+published bundle correctly attached tools-only under the test runner parent.
+Approved exception `67147dad` bootstraps that published import with one exact
+`/bin/ps` raw parent-row observation and delegates every other subprocess call.
+Pinned-runtime inspection showed Bun 1.4.2 does not rebind static builtin named
+exports after a default-export mutation and syncBuiltinESMExports. Approved
+amendment `06f31614` therefore uses Bun's built-in `mock.module` only inside the
+published-leg child for `child_process` and `node:child_process`. Every real
+function is exported; only `spawnSync` gets the same exact ps predicate and
+other calls delegate. It adds no runtime dependency or product change.
+Both fixture forms use the shared synthetic row constant; published bytes,
+classifier, marker, parent check and every assertion/timeout remain unchanged.
+This is synthetic host setup, not real native-launch acceptance. The original
+red run was intentionally stopped after the known setup failure (697 seconds,
+exit 143); it is not a completed full-suite result. Pinned Bun 1.4.2 validation
+of the corrected setup passed as recorded below.
+
+At committed `b9c5e1ffb13f0991bfe66b1dd5bcd8621f8538b9`, dgx02 used frozen
+root and published-fixture installs, Bun 1.4.2 and typecheck. The focused actual
+published 0.31.0 client/unchanged plugin and protocol-floor 0.25.0 legs passed
+in both directions, followed by production evidence-classifier tests: 7 pass,
+0 fail, 79 assertions across two files in 2.09 seconds. These are common-control
+and MCP interoperability results under synthetic native-host observations;
+they are not mixed-room or real-Claude acceptance.
+
+The same committed-head run then executed
+`node scripts/check-docs.mjs --require-fresh && scripts/check.sh --changed`.
+The changed gate selected the full suite and passed:
+
+```text
+ 12014 pass
+ 101 skip
+ 0 fail
+ 311749 expect() calls
+Ran 12115 tests across 934 files. [2010.22s]
+check: no current-invocation agent-hub daemon leaks
+check: OK
+remote_dev: verify dev/agent-hub/.worktrees/release-0.32.0 b9c5e1ffb13f exit 0 in 2067s
+```
+
+Documentation was fresh with 0 stale documents; roles, inventory (3281 entries,
+2276 classified, 1005 baseline), bundle freshness and package contents (795 files,
+0.32.0) passed. The run's total wall time includes the focused leg above.
+This following report-only commit records that completed result; it does not
+inherit a new full-suite claim for itself. Final-head documentation/delta checks
+and hosted CI are recorded in the PR, and exact-head CI remains the merge gate.
+
+## Known gaps, not blocking
+
+- No installation, running-hub upgrade, real account, live TLS/proxy or two-machine
+  room run is performed by this preparation. No mixed published-version room
+  execution is claimed: the N-1 room directions in CHANGELOG follow unchanged
+  codecs/source comparison and isolated current-version broker tests.
+- An offline stop snapshot is a bounded attempt behind the existing FIFO head,
+  not a guarantee under backpressure. Legacy brokers without ephemeral support
+  do not refresh or age; upgrade the broker for that liveness behavior.
+- A 0.31.0 CLI drops additive advisory/hold fields and outstanding preview IDs,
+  including in JSON. A 0.32.0 client accepts absent metadata from a 0.31.0 daemon
+  and keeps its prior state-only/fingerprint-confirmation behavior. New displays
+  require the matching CLI and daemon.
+- #1204 remains open for T4 visibility, deferred-inbound wake and full codec
+  features. #1173 still waits for supported activation/fresh host attestation in
+  agent-mem#281. Existing live gates for #1053, #1056 and #1196 remain separate.
+- No merge, tag, npm publication or release-consent record is made by this task.