mercury-agent 0.23.2 → 0.24.0

package/docs/plans/p0-plan-0922/sessions/S6.md

@@ -0,0 +1,60 @@
+## Launched — 2026-09-24T12:35Z
+Branch: worktree-feature-ledger-misses-interrupted-runs
+
+## Report — 2026-09-24T15:52Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: rebuild + schema migration — container/build.sh (src/types.ts is baked), then restart in a proven gap; first boot rebuilds task_runs (finished_at nullable). Rehearse on a shadow first (release-gate gate 2), paste the §4 evidence block. Rollback: DELETE FROM task_runs WHERE finished_at IS NULL before starting an older build.
+Files changed:
+- docs/ARCHITECTURE.md
+- docs/archive/ops/2026-09-24-ledger-misses-interrupted-runs.md
+- docs/configuration.md
+- docs/graceful-shutdown.md
+- docs/pending-updates/ledger-misses-interrupted-runs.md
+- docs/pending-verification.md
+- scripts/football-audit.ts
+- src/audit/ledger-queries.ts
+- src/core/boot-reconcile.ts
+- src/core/operator-alerts.ts
+- src/core/routes/dashboard.ts
+- src/core/runtime.ts
+- src/core/system-messages.ts
+- src/core/task-scheduler.ts
+- src/dashboard/index.html
+- src/main.ts
+- src/storage/db.ts
+- src/types.ts
+- tests/api.test.ts
+- tests/boot-reconcile.test.ts
+- tests/container-hooks-carry-source.test.ts
+- tests/dashboard-task-last-run.test.ts
+- tests/ledger-queries.test.ts
+- tests/scheduled-post-platform-id.test.ts
+- tests/scheduler-heartbeat.test.ts
+- tests/scheduler-interrupted-shutdown.test.ts
+- tests/scheduler-missed-runs.test.ts
+- tests/scheduler-noop-not-persisted.test.ts
+- tests/task-run-ledger.test.ts
+- tests/task-runs-migration.test.ts
+Siblings must know:
+- Seam, as in the code (`src/core/boot-reconcile.ts`): exports `BootReconcileContext {db, bootAt}`, `InterruptedWork {kind, id, spaceId, startedAt, detail}`, `BootReconciler {name, reconcile(ctx): InterruptedWork[]}` (sync, DB-only, idempotent, only `startedAt < ctx.bootAt`), `BootReconcileReport {bootAt, items, failed, byKind(kind)}`, `runBootReconciliation(reconcilers, ctx)`, `BOOT_RECONCILERS` (today `[taskRunReconciler]`), `TASK_RUN_KIND = "task_run"`, `InterruptedTaskRunDetail {taskId, manual, attempt}`. S7 appends its `chat_run` reconciler to `BOOT_RECONCILERS` — never a second sweep.
+- `main()`: `const bootAt = Date.now();` is the FIRST statement; `const bootReport = runBootReconciliation(BOOT_RECONCILERS, { db: core.db, bootAt });` runs immediately before `core.startScheduler(messageSender, bootReport)`, which is before every adapter `initialize`. A structural test (`tests/boot-reconcile.test.ts`) pins both — S7 moving or wrapping the call must keep it green.
+- The report is held on the runtime as `core.bootReconcileReport` (null until startScheduler). A consumer that notifies (S7's "your request was interrupted") reads `bootReconcileReport.byKind("chat_run")` from its own post-adapter step. The scheduler does NOT consume the report: it reads each task's newest `task_runs` row (so the graceful leg is covered too).
+- Per-item log line `Reconciled interrupted work` spreads `detail` first, then kind/id/spaceId/startedAt/ageMs; summary `Boot reconciliation finished` with `interrupted: {<reconciler name>: n}` prints even at zero; a throwing reconciler logs `Boot reconciliation failed` and lands in `report.failed`.
+- `src/core/system-messages.ts` (S7's file) gained 8 additive keys `alert_interrupted_*` / `alert_missed_runs_line_interrupted_*` in en + he (owner-approved 2026-09-24). No existing string changed; S7 rebases onto it.
+- `TaskScheduler.stop()` now sets a `stopping` flag: a handler failure after it is ledgered `interrupted` (no retry/notice/schedule change), the in-flight tick starts no further due task and does not re-arm, and `triggerTask` returns `unavailable`. `start()` clears it.
+- Tests that waited on "a task_runs row exists" as the finish signal must wait for `status !== "running"` — rows are now written at start.
+--- final report (verbatim) ---
+~~~
+S6 ledger-misses-interrupted-runs — squashed to LOCAL dev as 4e497de, NOT pushed (owner approval required per CLAUDE.local.md; landing derives once it is on origin/dev).
+- task_runs rows are written 'running' at start and closed by id at the end; a run that never ends becomes 'interrupted' — by the scheduler's graceful leg (stop() then a failure: no retry, no "task failed", no heartbeat, next_run_at left on the slot) or by the boot reconciliation (hard kill; finished_at NULL).
+- Migration: finished_at loses NOT NULL via a one-transaction rebuild from the single TASK_RUNS_COLUMNS constant; ids and the AUTOINCREMENT high-water mark kept; failure rolls back and refuses to open. Rehearsed on a VACUUM INTO copy of the live DB: 1,209 rows, id/cost sums identical, seq 1243, 10 ms.
+- Seam src/core/boot-reconcile.ts wired in main() before startScheduler (bootAt first statement); report held on the runtime for S7.
+- Missed-run boot pass relabels an interrupted slot (from the task's newest ledger row); catch_up policy unchanged; the graceful leg now matches the hard kill, so catch_up: once makes up after a graceful restart. Creator's report reworded, en + he (8 new message keys in system-messages.ts — owner-approved scope growth into S7's file).
+- Readers: dashboard running/interrupted badges + null-safe duration; outcomeMix.interrupted; running rows out of every count, interrupted rows out of drift/prefix; football-audit column (run against a fixture).
+- Docs: configuration.md "Interrupted is not missed", graceful-shutdown.md step 1, ARCHITECTURE invariant, 5 MANUAL-VERIFY lines under "## Plan p0-plan-0922 / S6".
+- Gate after rebase onto dev: 12/12 links, 5928 pass / 9 skip / 0 fail. Every new guard negative-tested (deleted → red). Code review: 1 real bug (graceful slot still labelled missed) fixed + 2 reader fixes + trigger-while-stopping; 1 accepted residual. QA: 29/34 pass, 5 deferred to the box, 0 fail.
+- Out-of-list files: system-messages.ts (approved), tests/api.test.ts (S5's, landed), src/dashboard/index.html (2 badge colours), 4 tests switched to wait for a closed row.
+- PLAN-PASSED(overlap): none — preflight overlap check was clean (exit 0).
+~~~

package/docs/plans/p0-plan-0922/sessions/S7.md

@@ -0,0 +1,69 @@
+## Launched — 2026-09-24T23:22Z
+Branch: worktree-feature-orphaned-run-recovery
+
+## Report — 2026-09-24T23:51Z
+Outcome: delivered
+Delivered: local — squashed into dev as b7b33e2, NOT pushed (owner chose merge-locally)
+Blocked-on: —
+Deploy needs: restart
+Files changed:
+- docs/ARCHITECTURE.md
+- docs/archive/2026-09-25-orphaned-run-recovery.md
+- docs/configuration.md
+- docs/graceful-shutdown.md
+- docs/ideas/stopped-scheduled-run-is-not-retried.md
+- docs/ideas/whatsapp-outbound-queue-survives-restart.md
+- docs/pending-updates/orphaned-run-recovery.md
+- docs/pending-verification.md
+- src/agent/container-error.ts
+- src/agent/container-runner.ts
+- src/core/boot-reconcile.ts
+- src/core/chat-run-journal.ts
+- src/core/handler.ts
+- src/core/instance-lock.ts
+- src/core/runtime.ts
+- src/core/space-queue.ts
+- src/core/system-messages.ts
+- src/main.ts
+- src/storage/db.ts
+- tests/ambient-group-context.test.ts
+- tests/chat-run-journal.test.ts
+- tests/container-error.test.ts
+- tests/handler.test.ts
+- tests/instance-lock.test.ts
+- tests/orphaned-run-recovery.e2e.test.ts
+- tests/reply-to-member-does-not-trigger.test.ts
+- tests/shutdown.test.ts
+- tests/simulate-ingress.test.ts
+- tests/space-queue.test.ts
+- tests/system-messages.test.ts
+Siblings must know:
+- `src/core/handler.ts` (S8 shares it): `runIngress` now wraps a new `runTracked(ingress, run)`; it owns a `ChatRunHandle` and closes the row in `finally` unless the settle type is `"interrupted"`. The heartbeat records the new ⏳ id (`core.noteChatRunStatus`) BEFORE deleting the old one. Any fake core handed to `createMessageHandler` needs `noteChatRunStatus` and `closeChatRun` (no-ops are fine) — without them the handler's outer catch swallows a TypeError and tests stay green while the path is broken.
+- `SpaceQueue.cancelAll(makeError = ContainerError.shutdown)` and `cancelPending(spaceId, makeError = ContainerError.cancelled)` now REJECT every dropped entry. A caller that enqueues must handle the rejection. `ContainerFailureReason` gained `"shutdown"` and `"cancelled"`; the runtime rethrows `shutdown` and maps `cancelled` to `{type:"ignore"}`.
+- `BOOT_RECONCILERS` is now `[taskRunReconciler, chatRunReconciler]`; `main()` calls `deliverInterruptedChatRuns` (not awaited) after the adapter initialize loop. S8's replay-on-boot, if it joins the seam, appends a third reconciler and keeps delivery after the adapters.
+- `main()` takes `acquireInstanceLock` right after `configureLogger` (exit 78 on refusal); `tests/instance-lock.test.ts` pins it before `Bun.serve`, `core.initialize` and `runBootReconciliation`.
+- Follow-ups filed: `docs/ideas/stopped-scheduled-run-is-not-retried.md` (task-scheduler lane), `docs/ideas/whatsapp-outbound-queue-survives-restart.md`.
+--- final report (verbatim) ---
+~~~
+orphaned-run-recovery — implemented, reviewed, QA'd, archived, squash-merged into local dev as b7b33e2 (not pushed).
+
+- Single-instance lock per data dir (src/core/instance-lock.ts), first in main(); a second process exits 78 naming the holder.
+- chat_runs journal (src/storage/db.ts) opened at enqueue, closed by the handler on every path except a shutdown interruption.
+- ContainerError.shutdown/.cancelled; SpaceQueue cancels now settle their promises; killAll records "shutdown".
+- chat_run reconciler on the boot seam + deliverInterruptedChatRuns after the adapters (readiness-bounded, per-thread notice, ⏳ delete).
+- run_interrupted_restart(_many) en + he; docs: graceful-shutdown, configuration, ARCHITECTURE.
+- Gate: bun run check — 16/16 links PASS, 6088 pass / 9 skip / 0 fail (before the review fix; targeted suites green after it).
+- Session review: 1 fix (⏳ recorded before the old one is deleted); 2 accepted residuals. QA: 30/30 PASS, 4 DEFERRED to the live bot (pending-verification.md, "Plan p0-plan-0922 / S7").
+- Spec: docs/archive/2026-09-25-orphaned-run-recovery.md; docs/pending-updates/orphaned-run-recovery.md written (run /f-doc-sync); ARCHITECTURE.md updated.
+- Not done: step 8 shadow rehearsal, deploy and live check — restart-only, in a gap, owner's go-ahead.
+~~~
+
+## Report — 2026-09-25T18:25Z
+Outcome: delivered
+Delivered: pushed — dev (b7b33e2 + shadow/deploy/verify docs through d55f31e)
+Blocked-on: —
+Deploy needs: none — deployed 2026-09-25 03:42:55 IDT (restart-only, gap), all 4 MANUAL-VERIFY lines ticked
+--- final report (verbatim) ---
+~~~
+S7 deployed and verified live. Shadow rehearsal (graceful + SIGKILL legs) passed; live second instance exits 78 naming the holder; live restart mid-answer with two queued messages produced exactly one "please send them again" notice (count=2), ⏳ deleted, chat_runs empty — owner confirmed on the phone. §4 evidence in docs/archive/2026-09-25-orphaned-run-recovery.md. Open: docs/pending-updates/orphaned-run-recovery.md awaits /f-doc-sync.
+~~~

package/docs/plans/sensitive-bugs-0922/briefs/S1.md

@@ -0,0 +1,63 @@
+# Brief S1 — the sensitive-guard replay runs with the yes message's reply metadata
+
+**Plan**: docs/plans/sensitive-bugs-0922/plan.md   **Session**: S1   **Round**: 1   **Kind**: bug
+**Item slug**: sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work sensitive-bugs-0922 S1
+
+## Run
+
+/f-bug-fix sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata
+
+## Scope notes
+
+Store the **blocked turn**, not the `yes`: extend `PendingSensitiveEntry` with `replyMeta` + `replyFlags`, and replay them. Build the stored shape so S2 can add `droppedAttachments` to it without reshaping it. Name the type and the reader (`readPendingSensitive`) in your log's **Siblings must know**. Every new stored field gets the refuse-whole validation that `readAttachmentRefs` applies, because `src/core/routes/console.ts` writes `space_config` keys unvalidated. A pre-fix row replays with the metadata **absent**, never borrowed from the `yes`. Do **not** add the dropped-attachment note here: that is S2's bug.
+
+**Read first:** `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md` § *Legs × axes*. It maps every leg and axis of this guard. A fix that is right for its own cell and blind to the next one is how seven post-mortems happened. **Deploy needs: restart** (`src/core/runtime.ts` and the tests are not baked). Confirm with the release-gate §1 classification.
+
+## Owned surfaces (predicted)
+
+- src/core/routes/console.ts
+- src/core/runtime.ts
+- tests/sensitive-guard-replay.test.ts
+
+## Do not touch
+
+- tests/sensitive-guard-audience.test.ts   (owned by S3 this plan)
+- tests/sensitive-guard-audience.test.ts   (owned by S4 this plan)
+- tests/api-chat-auth.test.ts, tests/sensitive-guard-audience.test.ts, tests/sensitive-guard-scope.test.ts   (owned by S5 this plan)
+- `src/core/runtime.ts` is shared by all five sessions here. Change only the code your bug names; the other guard bugs are sibling sessions.
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next sensitive-bugs-0922`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core/runtime.ts` is this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan sensitive-bugs-0922 / S1`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/sensitive-bugs-0922/sessions/S1.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/sensitive-bugs-0922/briefs/S2.md

@@ -0,0 +1,62 @@
+# Brief S2 — the sensitive-guard replay loses the dropped-attachment note
+
+**Plan**: docs/plans/sensitive-bugs-0922/plan.md   **Session**: S2   **Round**: 2   **Kind**: bug
+**Item slug**: sensitive-guard-replay-loses-the-dropped-attachment-note
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work sensitive-bugs-0922 S2
+
+## Run
+
+/f-bug-fix sensitive-guard-replay-loses-the-dropped-attachment-note
+
+## Scope notes
+
+S1 has landed the stored blocked-turn shape. Read it from the code on `dev` and from S1's log **Siblings must know**, then add `droppedAttachments` (a validated `DroppedAttachment[]`, refuse-whole like `readAttachmentRefs`). Merge it into `dropNote` at the replay call site. A row stored before this fix replays with no note, and does not crash.
+
+**Read first:** `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md` § *Legs × axes*. It maps every leg and axis of this guard. A fix that is right for its own cell and blind to the next one is how seven post-mortems happened. **Deploy needs: restart** (`src/core/runtime.ts` and the tests are not baked). Confirm with the release-gate §1 classification.
+
+## Owned surfaces (predicted)
+
+- src/core/runtime.ts
+
+## Do not touch
+
+- src/core/routes/console.ts, tests/sensitive-guard-replay.test.ts   (owned by S1 this plan)
+- tests/sensitive-guard-audience.test.ts   (owned by S3 this plan)
+- tests/sensitive-guard-audience.test.ts   (owned by S4 this plan)
+- tests/api-chat-auth.test.ts, tests/sensitive-guard-audience.test.ts, tests/sensitive-guard-scope.test.ts   (owned by S5 this plan)
+- `src/core/runtime.ts` is shared by all five sessions here. Change only the code your bug names; the other guard bugs are sibling sessions.
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next sensitive-bugs-0922`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: land only after S1 is landed (it will be: S1 is also a start-after predecessor). Check with `/f-ops-plan next sensitive-bugs-0922` before the rebase step.
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core/runtime.ts` is this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/sensitive-guard-replay-loses-the-dropped-attachment-note.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan sensitive-bugs-0922 / S2`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/sensitive-bugs-0922/sessions/S2.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/sensitive-bugs-0922/briefs/S3.md

@@ -0,0 +1,61 @@
+# Brief S3 — the sensitive gate is re-checked when the queued turn runs
+
+**Plan**: docs/plans/sensitive-bugs-0922/plan.md   **Session**: S3   **Round**: 3   **Kind**: bug
+**Item slug**: sensitive-gate-is-checked-before-the-space-queue
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work sensitive-bugs-0922 S3
+
+## Run
+
+/f-bug-fix sensitive-gate-is-checked-before-the-space-queue
+
+## Scope notes
+
+Add a re-check at dequeue, inside the `queue.enqueue` callback in `executePrompt`. It covers the space policy (`security.sensitive_connections_allowed`) and, for interactive turns, the caller's consent. What admitted the turn (the consent key, or "policy only" for a scheduled run) is passed to it **as a literal from the admitting leg**, never re-derived at dequeue. **Severity is an open owner question** (`moderate` now; `major` if `allowed=false` should cut off in-flight work). It does not change the fix. This fix unblocks the deferred `sensitive-opt-out-should-deny-not-block` idea: name the dequeue hook in your log's **Siblings must know**.
+
+**Read first:** `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md` § *Legs × axes*. It maps every leg and axis of this guard. A fix that is right for its own cell and blind to the next one is how seven post-mortems happened. **Deploy needs: restart** (`src/core/runtime.ts` and the tests are not baked). Confirm with the release-gate §1 classification.
+
+## Owned surfaces (predicted)
+
+- src/core/runtime.ts
+- tests/sensitive-guard-audience.test.ts
+
+## Do not touch
+
+- src/core/routes/console.ts, tests/sensitive-guard-replay.test.ts   (owned by S1 this plan)
+- tests/api-chat-auth.test.ts, tests/sensitive-guard-scope.test.ts   (owned by S5 this plan)
+- `src/core/runtime.ts` is shared by all five sessions here. Change only the code your bug names; the other guard bugs are sibling sessions.
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next sensitive-bugs-0922`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core/runtime.ts` is this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/sensitive-gate-is-checked-before-the-space-queue.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan sensitive-bugs-0922 / S3`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/sensitive-bugs-0922/sessions/S3.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/sensitive-bugs-0922/briefs/S4.md

@@ -0,0 +1,61 @@
+# Brief S4 — a scheduled run skipped by the sensitive deny gets a reader
+
+**Plan**: docs/plans/sensitive-bugs-0922/plan.md   **Session**: S4   **Round**: 4   **Kind**: bug
+**Item slug**: scheduled-run-skipped-by-sensitive-deny-has-no-reader
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work sensitive-bugs-0922 S4
+
+## Run
+
+/f-bug-fix scheduled-run-skipped-by-sensitive-deny-has-no-reader
+
+## Scope notes
+
+Send one operator notice when the scheduler gate skips a run, through the `announceTaskFailure` channel **with its own label or kind**, because a block is not a failure (the 2026-09-07 post-mortem's reason). S3 has moved or duplicated the scheduler policy check to dequeue. Send the notice from whichever point now actually skips the run, once and not twice.
+
+**Read first:** `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md` § *Legs × axes*. It maps every leg and axis of this guard. A fix that is right for its own cell and blind to the next one is how seven post-mortems happened. **Deploy needs: restart** (`src/core/runtime.ts` and the tests are not baked). Confirm with the release-gate §1 classification.
+
+## Owned surfaces (predicted)
+
+- src/core/runtime.ts
+- tests/sensitive-guard-audience.test.ts
+
+## Do not touch
+
+- src/core/routes/console.ts, tests/sensitive-guard-replay.test.ts   (owned by S1 this plan)
+- tests/api-chat-auth.test.ts, tests/sensitive-guard-scope.test.ts   (owned by S5 this plan)
+- `src/core/runtime.ts` is shared by all five sessions here. Change only the code your bug names; the other guard bugs are sibling sessions.
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next sensitive-bugs-0922`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core/runtime.ts` is this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/scheduled-run-skipped-by-sensitive-deny-has-no-reader.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan sensitive-bugs-0922 / S4`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/sensitive-bugs-0922/sessions/S4.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/sensitive-bugs-0922/briefs/S5.md

@@ -0,0 +1,62 @@
+# Brief S5 — tests for sensitive-guard cells that hold only by construction
+
+**Plan**: docs/plans/sensitive-bugs-0922/plan.md   **Session**: S5   **Round**: 5   **Kind**: bug
+**Item slug**: sensitive-guard-axis-coverage-gaps
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work sensitive-bugs-0922 S5
+
+## Run
+
+/f-bug-fix sensitive-guard-axis-coverage-gaps
+
+## Scope notes
+
+Tests and stale comments only, with no behaviour change. Add one test per numbered cell in the bug: relink → warned afresh in B, `POST /api/chat` gated, `triggerTask` in a denied space, and `createdBy` without the permission runs ungated. Each test gets its negative control. S1–S4 have landed and may already cover a cell. Re-check each one against `dev` first, and tick an already-covered cell with the test that covers it rather than adding a duplicate. `tests/api-chat-auth.test.ts` was reshaped by p0-plan-0922 S5 (container caller tokens), so read it as landed.
+
+**Read first:** `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md` § *Legs × axes*. It maps every leg and axis of this guard. A fix that is right for its own cell and blind to the next one is how seven post-mortems happened. **Deploy needs: restart** (`src/core/runtime.ts` and the tests are not baked). Confirm with the release-gate §1 classification.
+
+## Owned surfaces (predicted)
+
+- src/core/runtime.ts
+- tests/api-chat-auth.test.ts
+- tests/sensitive-guard-audience.test.ts
+- tests/sensitive-guard-scope.test.ts
+
+## Do not touch
+
+- src/core/routes/console.ts, tests/sensitive-guard-replay.test.ts   (owned by S1 this plan)
+- `src/core/runtime.ts` is shared by all five sessions here. Change only the code your bug names; the other guard bugs are sibling sessions.
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next sensitive-bugs-0922`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core/runtime.ts` is this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/sensitive-guard-axis-coverage-gaps.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan sensitive-bugs-0922 / S5`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/sensitive-bugs-0922/sessions/S5.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/sensitive-bugs-0922/decisions.md

@@ -0,0 +1,9 @@
+# Decisions — plan sensitive-bugs-0922
+
+> Answer in the `Answer` column. Everything blocked on a question stays blocked until this column is non-empty for it. `build` and `next` add rows; only you write answers. Delete nothing — an answered row is the audit trail.
+
+| ID | Blocks | Question | Options | Answer | Answered |
+|----|--------|----------|---------|--------|----------|
+| Q1 | S1, S2, S3, S4, S5 | Lane: does avishai tsabari own `src/core/runtime.ts` (latest touch 2026-09-13)? | ours / theirs / split | ours: no worktree open, not mid-change | 2026-09-22 (owner) |
+
+> Open, non-blocking: B1's severity (`moderate` vs `major`, if an admin's `allowed=false` is meant to cut off in-flight work). Re-rate it in the bug doc if you want to. It does not change the fix.

package/docs/plans/sensitive-bugs-0922/plan.md

@@ -0,0 +1,147 @@
+# Plan: sensitive-bugs-0922
+
+**Status**: Active
+**Created**: 2026-09-22   **Last updated**: 2026-09-22
+**Landing mode**: pr
+**Max width**: 4
+**Inputs**: sensitive-bugs-0922 sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata sensitive-guard-replay-loses-the-dropped-attachment-note sensitive-gate-is-checked-before-the-space-queue scheduled-run-skipped-by-sensitive-deny-has-no-reader sensitive-guard-axis-coverage-gaps (the four bugs bench-patterns-0915 S6 filed, plus the open drop-note bug; split out of the p0-plan-0922 rebuild)
+**Me**: saharw01, Saharw01@gmail.com (also 92163791+saharw01@users.noreply.github.com, avishailevi2@gmail.com)
+
+> Written by `/f-ops-plan` build (and `--rebuild`) and `archive` only. Nothing perishable lives here — no base sha, no other author's file list, no story counts; `next` measures those every time it runs. `plan-state.sh` parses the tables below by their header row, so keep the column order.
+
+> **Why this batch.** The sensitive-connection guard read (`docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md`) filed four bugs and cross-linked a fifth. Its recommended order is kept: B2 with the drop-note bug (one shared fix: store the blocked turn), then B1 (re-check at dequeue), then B3, with B4 riding along. **Features first (owner, 2026-09-22).** Every session here touches `src/core/runtime.ts`, and so do `p0-plan-0922` S6–S8. The owner put those P0 features ahead of these bugs, so S1 starts after p0-plan-0922's last runtime.ts session. The rest follow in a strict chain on the same file.
+
+## Items
+
+| ID | Kind | Slug | Doc | Command | Round | Needs |
+|----|------|------|-----|---------|-------|-------|
+| S1 | bug | sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata | docs/bugs/sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata.md | /f-bug-fix sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata | 1 | — |
+| S2 | bug | sensitive-guard-replay-loses-the-dropped-attachment-note | docs/bugs/sensitive-guard-replay-loses-the-dropped-attachment-note.md | /f-bug-fix sensitive-guard-replay-loses-the-dropped-attachment-note | 2 | — |
+| S3 | bug | sensitive-gate-is-checked-before-the-space-queue | docs/bugs/sensitive-gate-is-checked-before-the-space-queue.md | /f-bug-fix sensitive-gate-is-checked-before-the-space-queue | 3 | — |
+| S4 | bug | scheduled-run-skipped-by-sensitive-deny-has-no-reader | docs/bugs/scheduled-run-skipped-by-sensitive-deny-has-no-reader.md | /f-bug-fix scheduled-run-skipped-by-sensitive-deny-has-no-reader | 4 | — |
+| S5 | bug | sensitive-guard-axis-coverage-gaps | docs/bugs/sensitive-guard-axis-coverage-gaps.md | /f-bug-fix sensitive-guard-axis-coverage-gaps | 5 | — |
+
+> Kind ∈ `feature` | `bug` | `refactor` | `plan` (a Round 0 planning session) | `story` (from `--goal`; runs `/f-feature-dev`).
+> Needs = decision IDs from `decisions.md` that must be answered before this session may launch, or `—`.
+> IDs are never renumbered; `--drop` moves a row to Deferred, `--add` takes the next unused ID.
+
+## Edges
+
+| From | To | Kind | Basis |
+|------|----|------|-------|
+| p0-plan-0922/S5 | S1 | start-after | file: src/core/routes/console.ts (predicted by plan p0-plan-0922, S5 not landed) |
+| p0-plan-0922/S6 | S1 | start-after | file: src/core/runtime.ts (predicted by plan p0-plan-0922, S6 not landed) |
+| p0-plan-0922/S7 | S1 | start-after | file: src/core/runtime.ts (predicted by plan p0-plan-0922, S7 not landed) |
+| p0-plan-0922/S8 | S1 | start-after | file: src/core/runtime.ts (predicted by plan p0-plan-0922, S8 not landed) |
+| p0-plan-0922/S5 | S5 | start-after | file: tests/api-chat-auth.test.ts (predicted by plan p0-plan-0922, S5 not landed) |
+| S1 | S2 | start-after | file: src/core/runtime.ts (both predicted) |
+| S2 | S3 | start-after | file: src/core/runtime.ts (both predicted) |
+| S3 | S4 | start-after | file: src/core/runtime.ts (both predicted; also tests/sensitive-guard-audience.test.ts) |
+| S4 | S5 | start-after | file: src/core/runtime.ts (both predicted; also tests/sensitive-guard-audience.test.ts) |
+| S1 | S2 | merge-after | semantic: the drop-note fix adds `droppedAttachments` to the stored blocked turn that the reply-metadata fix introduces (user) |
+
+> Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
+> Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
+> From may name a session of ANOTHER active plan as `{plan-slug}/S{n}` — always `start-after`, always `file:`; resolved at `next` time by deriving that plan's state.
+> Every pair of sessions here shares `src/core/runtime.ts`. Only the chain edges are written, because the remaining pairs follow from it. S2–S4 reach the cross-plan predecessors through S1.
+
+## Rounds
+
+### Round 0 — unblock
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| — | nothing to plan; Q1 (lane) answered at build | — |
+
+### Round 1 — width 1 (after p0-plan-0922 S5–S8 land)
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| S1 | /f-bug-fix sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata | S2 |
+
+### Round 2 — width 1
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| S2 | /f-bug-fix sensitive-guard-replay-loses-the-dropped-attachment-note | S3 |
+
+### Round 3 — width 1
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| S3 | /f-bug-fix sensitive-gate-is-checked-before-the-space-queue | S4; the deferred opt-out idea |
+
+### Round 4 — width 1
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| S4 | /f-bug-fix scheduled-run-skipped-by-sensitive-deny-has-no-reader | S5 |
+
+### Round 5 — width 1
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| S5 | /f-bug-fix sensitive-guard-axis-coverage-gaps | — |
+
+## Collision map
+
+> Whole files, predicted; `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them (7 such paths ignored, 19 predicted → 12 kept).
+
+| File | Sessions |
+|------|----------|
+| src/core/runtime.ts | S1, S2, S3, S4, S5 (+ p0-plan-0922 S6, S7, S8) |
+| tests/sensitive-guard-audience.test.ts | S3, S4, S5 |
+| src/core/routes/console.ts | S1 (+ p0-plan-0922 S5) |
+| tests/api-chat-auth.test.ts | S5 (+ p0-plan-0922 S5) |
+
+## Predicted surfaces
+
+### S1
+
+- src/core/routes/console.ts
+- src/core/runtime.ts
+- tests/sensitive-guard-replay.test.ts
+
+### S2
+
+- src/core/runtime.ts
+
+### S3
+
+- src/core/runtime.ts
+- tests/sensitive-guard-audience.test.ts
+
+### S4
+
+- src/core/runtime.ts
+- tests/sensitive-guard-audience.test.ts
+
+### S5
+
+- src/core/runtime.ts
+- tests/api-chat-auth.test.ts
+- tests/sensitive-guard-audience.test.ts
+- tests/sensitive-guard-scope.test.ts
+
+## Adjudicated overlaps
+
+> Pre-answers for the execution commands' preflight overlap prompt. Scoped to exact branch + file pairs on branches that belong to NO active plan (a hand-opened worktree, another contributor). A branch of a sibling plan's session is never listed here — it becomes a cross-plan edge instead.
+
+| Session | Branch (not in this plan) | Files | Verdict | Decided |
+|---------|---------------------------|-------|---------|---------|
+
+> Build measurement 2026-09-22: no worktree other than the primary checkout, and no `worktree-*` branch.
+
+## Not ours
+
+> Last measurement (`git log --since=14.days`, authors not in `Me`). Re-measured on every `next`; this table is the snapshot the briefs were written from.
+
+| File / area | Author | Basis |
+|-------------|--------|-------|
+| src/core/runtime.ts | avishai tsabari / Avishai-Tsabari | 14-day log (latest `eaf58ba` 2026-09-13, /spaces link, which added the relink axis); every session. Lane: Q1 = ours |
+
+## Deferred
+
+| Item | Reason | Home |
+|------|--------|------|
+| sensitive-opt-out-should-deny-not-block | an idea with no architecture; plan it after S3 (B1) lands, because it changes the policy half B1 moves to dequeue, and it must deny at the broker (L4) and env injection (L5) too. Moved here from p0-plan-0922 (2026-09-22) | docs/ideas/sensitive-opt-out-should-deny-not-block.md |

package/docs/release-gate.md

@@ -266,7 +266,7 @@ re-proposed as a rule:
 - **What each preflight check proves**: `container-lifecycle.md`
   § "`mercury preflight`".
 - **What the dump contains and what the diff blocks on**:
-  `archive/2026-09-07-env-dump.md`, `archive/2026-09-09-env-diff.md`.
+  `archive/release-gate/2026-09-07-env-dump.md`, `archive/release-gate/2026-09-09-env-diff.md`.
 - **The shadow's refusals and the snapshot's exclusions**:
   `archive/rehearsal/2026-09-03-shadow-snapshot.md`,
   `archive/rehearsal/2026-09-07-shadow-service.md`.

package/docs/smoke-fixtures.md

@@ -89,6 +89,15 @@ reply** of the run — the model's own text as the bridge was asked to send it
 (`sent[]` raw form), before the platform's markdown rewrite. `produced-file`
 reads every send of the run.
 
+**And one the fixture does not write: the role read-back.** Every fixture
+fails when the run resolved the sender as a role other than the one the
+fixture asked for (see *Roles* below) — the report's `role.ran` beside
+`role.expectedReadBack`, the `because` line naming both. It is a check the
+runner always applies, not an assertion key, and its gate id in a
+post-mortem's `Gate check:` line is `smoke.role`. It is what saw the runner
+promote its synthetic admin under the bare jid so every `admin` fixture ran
+as `member` (2026-09-13).
+
 ## The refusal lexicon
 
 `src/smoke/refusal.ts` — `REFUSAL_LEXICON`, keyed by primary language subtag,