mercury-agent 0.23.2 → 0.24.1

package/docs/plans/bench-patterns-0915/briefs/S12.md

@@ -0,0 +1,87 @@
+# Brief S12 — inventories as files, each with a closure test
+
+**Plan**: docs/plans/bench-patterns-0915/plan.md   **Session**: S12   **Round**: 1   **Kind**: feature
+**Item slug**: inventories-as-files
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work bench-patterns-0915 S12
+
+## Run
+
+/f-feature-dev inventories-as-files
+
+## Scope notes
+
+Follow the doc's eight-step sequence. Step 4 (run entries) comes before Step 6 (guard axes). Tests and docs only: no edit under `src/`, `examples/`, `resources/` or `scripts/`.
+
+A `none` cell names an open bug doc, and a missing one is filed with `/f-bug-report`, never fixed. For Step 6, derive `sensitive-bugs-0922`'s state then (`bash .claude/scripts/plan-state.sh docs/plans/sensitive-bugs-0922`). Whichever of its fixes have landed change their cells.
+
+If you land first, put this in "Siblings must know": every later sensitive-guard fix that archives its bug doc turns `tests/inventory-guard-axes.test.ts` red on purpose, and the fixer rewrites that cell.
+
+The tests that are predicted but only copied from (`container-copy-list-closure`, `env-claims-declare-hostonly`, `no-module-eviction`, `release-gate-map`) are read-only patterns. The doc names them so their shape is copied, not edited.
+
+**Deploy needs: none** (tests, `CLAUDE.md`, docs).
+
+## Owned surfaces (predicted)
+
+- tests/container-copy-list-closure.test.ts
+- tests/env-claims-declare-hostonly.test.ts
+- tests/helpers
+- tests/helpers/inventory.ts
+- tests/helpers/source-scan.ts
+- tests/inventories/guard-axes.ts
+- tests/inventories/host-limits.ts
+- tests/inventories/pi-spawns.ts
+- tests/inventories/run-entries.ts
+- tests/inventory-guard-axes.test.ts
+- tests/inventory-host-limits.test.ts
+- tests/inventory-pi-spawns.test.ts
+- tests/inventory-run-entries.test.ts
+- tests/no-module-eviction.test.ts
+- tests/release-gate-map.test.ts
+- tests/source-scan.test.ts
+- CLAUDE.md
+- docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md
+- docs/backlog/feed-watch-triaged-roundup.md
+- docs/bugs/*.md
+
+## Do not touch
+
+- src/cli/mercury.ts, src/config.ts, src/ops/shadow-root.ts, src/ops/shadow-service.ts, src/ops/shadow-snapshot.ts, tests/shadow-*.test.ts, docs/configuration.md, docs/live-testing.md   (owned by S9 this plan)
+- examples/extensions/feed-watch/fixtures.ts, examples/extensions/feed-watch/index.ts, tests/feed-watch-fixtures.test.ts, tests/fixtures/feed-watch/shadow/   (owned by S10 this plan)
+- package.json, scripts/ (every file), tests/check-ratchets.test.ts, tests/check-sync-calls.test.ts   (owned by S11 this plan)
+- `CLAUDE.md`: S11 also adds one Gotchas line. Rewrite only the `pi`-spawn gotcha, and rebase over theirs.
+- Files plans `p0-plan-0922` (S6–S8: `src/core/runtime.ts`, `src/main.ts`, `src/storage/db.ts`, …) and `sensitive-bugs-0922` are changing are read, never edited. Your inventories read `src/config.ts` and `src/core/runtime.ts`: a `limit`-shaped key or a new run entry those plans add lands as a red test for whoever lands second. That is the gate working.
+- Not ours (avishai tsabari, last 14 d): `tests/container-copy-list-closure.test.ts`, which you copy from and do not edit. The lane is cleared by Q13 (ours). Re-check with `/f-ops-plan next bench-patterns-0915`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none. S6 → S8 (merge-after) is satisfied because S6 has landed. It was the planning pair; this session is the implementation.
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q13: ours (owner, 2026-09-23).
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/inventories-as-files.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan bench-patterns-0915 / S12`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. Run `bun install` once in the fresh worktree. The check gate is `bun run check`: every link runs to completion, so read every line. Lint is proven only by `~/check-mercury.sh check <worktree>` in WSL (CLAUDE.local.md).
+
+## Report
+
+Your command's final report is appended to `docs/plans/bench-patterns-0915/sessions/S12.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/bench-patterns-0915/briefs/S9.md

@@ -0,0 +1,81 @@
+# Brief S9 — the shadow gets a model credential of its own (M1.3c)
+
+**Plan**: docs/plans/bench-patterns-0915/plan.md   **Session**: S9   **Round**: 1   **Kind**: feature
+**Item slug**: shadow-own-credential
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work bench-patterns-0915 S9
+
+## Run
+
+/f-feature-dev shadow-own-credential
+
+## Scope notes
+
+Follow the doc's Implementation Sequence, Steps 0–7. **Step 0 is a hard stop before any code** (owner decision Q8): print the probe exactly as the doc gives it, ask the owner to run it on the box, and wait. The probe uses `auth login` into `~/mercury-shadow/auth.json` from a scratch directory, then confirms the live bot answers and its next rotation has no 400. You never run `auth login` yourself, never read a token, and never print a fingerprint. If the owner reports that live broke: stop, report `Outcome: blocked` with `Blocked-on: Step 0 — option B`, and write nothing under `src/`.
+
+Option C (API key) is rejected by the owner at every stage. The Non-Negotiable Rules are the contract, in particular the rule that deleting shape (a) and adding the gate land in one change.
+
+**Deploy needs: restart**, plus one `mercury shadow login` (or Step 0's file) and a fresh `shadow snapshot`, because every existing snapshot is refused by design. Say so in the report's `Deploy needs:` line. Gap-check before the restart (CLAUDE.local.md Gotchas: nothing running, cron gap).
+
+## Owned surfaces (predicted)
+
+- src/cli/mercury.ts
+- src/config.ts
+- src/ops/shadow-root.ts
+- src/ops/shadow-service.ts
+- src/ops/shadow-snapshot.ts
+- tests/shadow-login.test.ts
+- tests/shadow-mode.test.ts
+- tests/shadow-root.test.ts
+- tests/shadow-service-cli.test.ts
+- tests/shadow-service.test.ts
+- tests/shadow-snapshot.test.ts
+- docs/configuration.md
+- docs/live-testing.md
+- docs/pending-verification.md
+
+## Do not touch
+
+- examples/extensions/feed-watch/fixtures.ts, examples/extensions/feed-watch/index.ts, tests/feed-watch-fixtures.test.ts, tests/fixtures/feed-watch/shadow/   (owned by S10 this plan)
+- package.json, scripts/ (every file), tests/check-ratchets.test.ts, tests/check-sync-calls.test.ts   (owned by S11 this plan)
+- tests/helpers/, tests/inventories/, tests/inventory-*.test.ts, tests/source-scan.test.ts, tests/container-copy-list-closure.test.ts, tests/env-claims-declare-hostonly.test.ts, tests/no-module-eviction.test.ts, tests/release-gate-map.test.ts   (owned by S12 this plan)
+- src/storage/pi-auth.ts: read-only for this item (the doc says so).
+- `docs/goals/rehearsal-bench/decisions.md` and `roadmap.md`: D-016's extension to the model credential stays in the spec until archive. Put it in your log's "Siblings must know".
+- Not ours (avishai tsabari, last 14 d): `src/ops/shadow-root.ts`, `src/ops/shadow-service.ts`, `src/config.ts`, `src/cli/mercury.ts`, `tests/shadow-root.test.ts`, `tests/shadow-service.test.ts`. The lane is cleared by Q11 (ours). Re-check with `/f-ops-plan next bench-patterns-0915`.
+- Plan `p0-plan-0922` S6 also changes `src/config.ts`. You launch only after it has landed (the start-after edge), so rebase onto it and do not re-do its hunks.
+
+## Edges
+
+- start-after: `p0-plan-0922/S6` (file: src/config.ts)   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: yes. The bench order is M1.3c → M1.7 → M2.4 (owner, 2026-09-23). The goal roadmap's order line is the owner's edit, not yours.
+- Q2: option A (a second OAuth login). The spec settles it, and the API key is rejected (owner, 2026-09-23).
+- Q8: Step 0 is your first in-session stop, not a launch gate (owner, 2026-09-24).
+- Q11: ours. Avishai Tsabari is a co-owner, not a lane (owner, 2026-09-23).
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/shadow-own-credential.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan bench-patterns-0915 / S9`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree, and `CLAUDE.local.md` Gotchas for the box steps (WSL `PATH`, bare `bun`, gap check). Nothing from them is copied here. Run `bun install` once in the fresh worktree. The check gate is `bun run check`: every link runs to completion, so read every line.
+
+## Report
+
+Your command's final report is appended to `docs/plans/bench-patterns-0915/sessions/S9.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.

package/docs/plans/bench-patterns-0915/decisions.md

@@ -4,10 +4,16 @@
 
 | ID | Blocks | Question | Options | Answer | Answered |
 |----|--------|----------|---------|--------|----------|
-| Q1 | — (the implementation sessions of S4/S5, added at `--rebuild`; retargeted 2026-09-15 — a planning session does not depend on execution order) | Bench order: do M1.3c `shadow-own-credential` and M1.7 `shadow-feed-fixtures` cut in front of M1.4 `shadow diff` and M1.5 `longview file target` on the rehearsal-bench roadmap? (`docs/goals/rehearsal-bench/roadmap.md` § *Order* already says M1.3c → M1.7 → M2.4; only the *Execution order since 2026-09-03* line at the top of the file is stale.) | yes — rewrite the top order line M1.3c → M1.7 → M2.4 / no — plan them but land after M1.4–M1.5 / other | | |
+| Q1 | — (the implementation sessions of S4/S5, added at `--rebuild`; retargeted 2026-09-15 — a planning session does not depend on execution order) | Bench order: do M1.3c `shadow-own-credential` and M1.7 `shadow-feed-fixtures` cut in front of M1.4 `shadow diff` and M1.5 `longview file target` on the rehearsal-bench roadmap? (`docs/goals/rehearsal-bench/roadmap.md` § *Order* already says M1.3c → M1.7 → M2.4; only the *Execution order since 2026-09-03* line at the top of the file is stale.) | yes — rewrite the top order line M1.3c → M1.7 → M2.4 / no — plan them but land after M1.4–M1.5 / other | yes — rewrite the top order line M1.3c → M1.7 → M2.4 (the goal roadmap edit is the owner's; no implementation session touches it) | 2026-09-23 (owner, at the `--rebuild`) |
 | Q2 | S4 | Does the shadow get its own model credential as a second OAuth login on the same Anthropic account (`mercury auth login` against the shadow root — the roadmap's assumption) or as an API key in the shadow's env? | oauth-login / api-key / decide in the spec | decide in the spec — the Architecture's credential section presents both and recommends one; D-016 already assumes oauth-login | 2026-09-15 (owner, via the adversarial review: "apply all the fixes") |
 | Q3 | S6 | `sensitive-guard-one-read` is a read-only audit, not a feature. Run it as this plan's `/f-feature-planning` session (its "architecture" is the axis × site × test table and the list of bugs to file), or outside the plan as `/f-refactor-audit src/core/runtime.ts` with the same brief? | planning-session / refactor-audit | planning-session — `refactor-audit` writes `docs/refactor/audits/`, which `plan-state.sh` can never read as `landed`, so S8 (merge-after S6) and the whole Round 0 gate would hang | 2026-09-15 (owner, via the adversarial review) |
 | Q4 | — (was S3; moved with it to plan `bugs-0915`) | Lane: does Avishai Tsabari own `src/bridges/` (2 files in 14d — `b9b5c94` reply-in-its-chat, 2026-09-03)? | ours / theirs / split: … | ours — co-owner, not a lane (re-asked as `bugs-0915` Q1) | 2026-09-15 (owner, via the adversarial review) |
 | Q5 | — (was S3; moved to plan `bugs-0915`) | Lane: does Avishai Tsabari own `src/core/conversation.ts` (1 commit in 14d — `0f546a5` contextMode default, 2026-09-07)? | ours / theirs / split: … | ours (re-asked as `bugs-0915` Q2) | 2026-09-15 (owner, via the adversarial review) |
 | Q6 | — (was S1; moved to plan `bugs-0915`) | Lane: does Avishai Tsabari own `src/main.ts` (5 commits in 14d, latest `2bbe68f` sandbox latches, 2026-09-11)? S1 adds one `idleTimeout` option to `Bun.serve` there. | ours / theirs / split: … | ours — `Me` has 10 commits on the file in the same window; and S1's fix no longer touches it (re-asked as `bugs-0915` Q3) | 2026-09-15 (owner, via the adversarial review) |
 | Q7 | — (was S2; moved to plan `bugs-0915`) | Lane: does Avishai Tsabari own `tests/fixtures/release-gate/regression-map.json` (1 commit in 14d — `974f042` allowlist, 2026-09-14)? S2's post-mortem adds one allowlist entry. | ours / theirs / split: … | ours (re-asked as `bugs-0915` Q4) | 2026-09-15 (owner, via the adversarial review) |
+| Q8 | S9 | **Step 0 of `shadow-own-credential` — the owner's probe, no code.** On the box, from a scratch directory `~/shadow-login-probe` whose `.env` holds only `MERCURY_AUTH_PATH=/home/guysaha/mercury-shadow/auth.json`, run `~/.bun/bin/bun run ~/mercury-src/src/cli/mercury.ts auth login` → anthropic. Then confirm the live bot answers a real message and its next `Rotated anthropic oauth refresh token` line has no 400 before it. Did the second login leave live alive? | alive — S9 may launch (option A) / live broke — ran `mercury auth login` from `~/whatsapp-bot`; S9 goes back to planning with option B (drop S9 at the next `--rebuild`) | not a launch gate — Step 0 is S9's first action and a hard stop inside the session: it asks the owner to run the probe and writes no code until the owner reports live alive; if live broke, S9 reports `Outcome: blocked` (`Blocked-on: Step 0 — option B`) | 2026-09-24 (owner, at the `--rebuild`) |
+| Q9 | — (S11; answered) | `ratchet-shapes-the-summaries-named` Open Questions 1–5: OQ1 ratchet D2 at 17 (not a sweep first); OQ2 skip `src/bridges/` + `src/adapters/`; OQ3 zero-dependency lexer; OQ4 file the two candidate bugs before `/f-feature-dev` starts; OQ5 no suppression marker | accept all / per-OQ | accept all five recommendations | 2026-09-23 (owner, at the `--rebuild`) |
+| Q10 | S11 | Per Q9/OQ4: have the two candidate bugs been filed with `/f-bug-report`? (a) `src/core/handler.ts:315` — the `denied` reply is an `await bridge.sendReply` outside any `try`; (b) `src/core/media.ts:233` — with no `content-length` the whole body is buffered by `arrayBuffer()` before the size check. Their fixes then lower S11's baselines instead of being hidden in them. | filed: `{slug-a}`, `{slug-b}` | not a launch gate — S11 runs `/f-bug-report` for both as its first step, before the worktree and before any detector; the two slugs go into its log's Siblings must know | 2026-09-24 (owner, at the `--rebuild`) |
+| Q11 | — (S9; answered) | Lane: does avishai tsabari own `src/ops/shadow-*`, `src/config.ts`, `src/cli/mercury.ts`, `tests/shadow-{root,service}.test.ts` (6 files in 14d — `9e8268c` shadow live-project resolution, version bumps, `1812d41`)? | ours / theirs / split: … | ours — co-owner, not a lane (standing answer, as Q4–Q7) | 2026-09-23 (owner, at the `--rebuild`) |
+| Q12 | — (S11; answered) | Lane: does avishai tsabari / dependabot own `package.json` (version bumps, dependency PRs #100 #111 in 14d)? | ours / theirs / split: … | ours | 2026-09-23 (owner, at the `--rebuild`) |
+| Q13 | — (S12; answered) | Lane: does avishai tsabari own `tests/container-copy-list-closure.test.ts` (`53e9ca7`, 2026-09-14)? S12 copies its pattern and does not edit it. | ours / theirs / split: … | ours | 2026-09-23 (owner, at the `--rebuild`) |

package/docs/plans/bench-patterns-0915/plan.md

@@ -1,7 +1,7 @@
 # Plan: bench-patterns-0915
 
 **Status**: Active
-**Created**: 2026-09-15   **Last updated**: 2026-09-15 (rebuilt: `--drop S1 S2 S3` after the adversarial review — the bugs run as plan `bugs-0915`)
+**Created**: 2026-09-15   **Last updated**: 2026-09-23 (rebuilt: `--add` the four implementation sessions S9–S12 after Round 0 landed in `d5ca1b0`; `--drop S6` refused — S6 was launched and has a log, and it is landed; earlier, 2026-09-15: `--drop S1 S2 S3` after the adversarial review — the bugs run as plan `bugs-0915`)
 **Landing mode**: pr
 **Max width**: 4
 **Inputs**: bench-patterns-0915 shadow-simulate-stream-dies-at-bun-serve-10s-idle-timeout smoke-admin-fixture-promotes-the-bare-jid-so-the-run-resolves-it-as-member slack-and-teams-bridges-report-a-group-as-a-dm shadow-own-credential shadow-feed-fixtures sensitive-guard-one-read ratchet-shapes-the-summaries-named inventories-as-files
@@ -20,17 +20,23 @@
 | S6 | plan | sensitive-guard-one-read | docs/ideas/sensitive-guard-one-read.md | /f-feature-planning sensitive-guard-one-read | 0 | Q3 |
 | S7 | plan | ratchet-shapes-the-summaries-named | docs/ideas/ratchet-shapes-the-summaries-named.md | /f-feature-planning ratchet-shapes-the-summaries-named | 0 | — |
 | S8 | plan | inventories-as-files | docs/ideas/inventories-as-files.md | /f-feature-planning inventories-as-files | 0 | — |
+| S9 | feature | shadow-own-credential | docs/backlog/shadow-own-credential.md | /f-feature-dev shadow-own-credential | 1 | — |
+| S10 | feature | shadow-feed-fixtures | docs/backlog/shadow-feed-fixtures.md | /f-feature-dev shadow-feed-fixtures | 1 | — |
+| S11 | feature | ratchet-shapes-the-summaries-named | docs/backlog/ratchet-shapes-the-summaries-named.md | /f-feature-dev ratchet-shapes-the-summaries-named | 1 | — |
+| S12 | feature | inventories-as-files | docs/backlog/inventories-as-files.md | /f-feature-dev inventories-as-files | 1 | — |
 
 > Kind ∈ `feature` | `bug` | `refactor` | `plan` (a Round 0 planning session) | `story` (from `--goal`; runs `/f-feature-dev`).
 > Needs = decision IDs from `decisions.md` that must be answered before this session may launch, or `—`.
 > IDs are never renumbered; `--drop` moves a row to Deferred, `--add` takes the next unused ID. S1–S3 are in Deferred (moved to plan `bugs-0915`).
-> Q1 (bench order) blocks no planning session — it is answered when the implementation sessions of S4/S5 are added at `--rebuild`; a planning session does not depend on execution order.
+> Q1 (bench order) blocks no planning session — it is answered when the implementation sessions of S4/S5 are added at `--rebuild`; a planning session does not depend on execution order. Answered `yes` at the 2026-09-23 rebuild.
+> S4–S8 rows are frozen (each has a session log) and copied unchanged, including their `docs/ideas/` Doc paths; the specs now live in `docs/backlog/`, which is the Doc of S9–S12. S6 stays: a launched session is never removed, and it is landed.
 
 ## Edges
 
 | From | To | Kind | Basis |
 |------|----|------|-------|
 | S6 | S8 | merge-after | semantic: the guard-axes inventory S8 specifies is the table S6's read produces (user) |
+| p0-plan-0922/S6 | S9 | start-after | file: src/config.ts (predicted by plan p0-plan-0922, S6 not landed) |
 
 > Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
 > Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
@@ -55,19 +61,25 @@
 > **One planning session at a time.** Every `/f-feature-planning` edits `docs/ROADMAP.md` (its Step 4.5) in the shared checkout with no lock — the rules allow two kind-`plan` sessions to be `running` together, this plan does not. Open the next only after the previous one has reported.
 > **Do not open an implementation session until the Round 0 commit line has been run.** `plan-state.sh` derives a planning session `landed` the moment its Architecture predicts a surface (evidence outranks the log), which is Step 7 of `/f-feature-planning` — before its self-review and the owner's approval pause. Between those two points the session is still editing the shared checkout and `next` can no longer see it as running (`agentic-project-boilerplate` idea `ops-plan-landed-outranks-running`).
 
-### Round 1
+### Round 1 — width 4
 
 | Session | Item | Predicted surfaces (count) |
 |---------|------|----------------------------|
-| — | none yet — the implementation sessions are added by `/f-ops-plan bench-patterns-0915 --rebuild` once the Round 0 docs are committed | — |
+| S9 | shadow-own-credential (M1.3c) — waits for `p0-plan-0922/S6` (src/config.ts); Step 0 (the owner's probe, Q8) is its first in-session stop | 14 |
+| S10 | shadow-feed-fixtures (M1.7) | 7 |
+| S11 | ratchet-shapes-the-summaries-named — files the two OQ4 bugs as its first step (Q10) | 17 |
+| S12 | inventories-as-files | 20 |
+
+> No two of S9–S12 share a file, so all four sit in one round. Deploy classes differ: S9 and S10 are **restart** (host-only; S9 also needs one `mercury shadow login` and a fresh snapshot — every existing snapshot is refused by design; S10 is verified against the installed feed-watch snapshot), S11 and S12 are **none** (scripts/tests/docs only). Bundle the S9 + S10 restart into one gap.
+> Q1 was answered `yes`: the rehearsal-bench roadmap's *Execution order since 2026-09-03* line (`docs/goals/rehearsal-bench/roadmap.md` L19) becomes M1.3c → M1.7 → M2.4. That goal file is not this plan's to edit and no implementation session may touch it (ledger rule) — the owner rewrites it, or it rides along with S9's archive.
 
 ## Collision map
 
-> Whole files, predicted; `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them (0 such paths ignored — no session predicts any path yet).
+> Whole files, predicted; `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them (7 such paths ignored — `docs/configuration.md`, `docs/live-testing.md`, `docs/pending-verification.md`, `CLAUDE.md`, `docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md`, `docs/backlog/feed-watch-triaged-roundup.md`, `docs/bugs/*.md`; `CLAUDE.md` is predicted by both S11 and S12 and `docs/pending-verification.md` by S9 and S10 — each adds its own lines, so land the second one with a rebase, not a collision).
 
 | File | Sessions |
 |------|----------|
-| — | no session predicts a file yet |
+| — | no whole-file collision among S9–S12 (measured 2026-09-23). Cross-plan: `src/config.ts` S9 ↔ `p0-plan-0922/S6` → the start-after edge above |
 
 ## Predicted surfaces
 
@@ -81,13 +93,83 @@
 
 ### S8
 
+### S9
+
+- src/cli/mercury.ts
+- src/config.ts
+- src/ops/shadow-root.ts
+- src/ops/shadow-service.ts
+- src/ops/shadow-snapshot.ts
+- tests/shadow-login.test.ts
+- tests/shadow-mode.test.ts
+- tests/shadow-root.test.ts
+- tests/shadow-service-cli.test.ts
+- tests/shadow-service.test.ts
+- tests/shadow-snapshot.test.ts
+- docs/configuration.md
+- docs/live-testing.md
+- docs/pending-verification.md
+
+### S10
+
+- examples/extensions/feed-watch/fixtures.ts
+- examples/extensions/feed-watch/index.ts
+- tests/feed-watch-fixtures.test.ts
+- tests/fixtures/feed-watch/shadow/README.md
+- tests/fixtures/feed-watch/shadow/feeds
+- tests/fixtures/feed-watch/shadow/feeds/*
+- docs/pending-verification.md
+
+### S11
+
+- package.json
+- scripts/absent-allows-baseline.json
+- scripts/bare-delivery-await-baseline.json
+- scripts/check-absent-allows.ts
+- scripts/check-bare-delivery-await.ts
+- scripts/check-early-return-no-log.ts
+- scripts/check-silent-catch.ts
+- scripts/check-sync-calls.ts
+- scripts/check-unbounded-race.ts
+- scripts/check.ts
+- scripts/early-return-no-log-baseline.json
+- scripts/lib/ratchet.ts
+- scripts/silent-catch-baseline.json
+- scripts/unbounded-race-baseline.json
+- tests/check-ratchets.test.ts
+- tests/check-sync-calls.test.ts
+- CLAUDE.md
+
+### S12
+
+- tests/container-copy-list-closure.test.ts
+- tests/env-claims-declare-hostonly.test.ts
+- tests/helpers
+- tests/helpers/inventory.ts
+- tests/helpers/source-scan.ts
+- tests/inventories/guard-axes.ts
+- tests/inventories/host-limits.ts
+- tests/inventories/pi-spawns.ts
+- tests/inventories/run-entries.ts
+- tests/inventory-guard-axes.test.ts
+- tests/inventory-host-limits.test.ts
+- tests/inventory-pi-spawns.test.ts
+- tests/inventory-run-entries.test.ts
+- tests/no-module-eviction.test.ts
+- tests/release-gate-map.test.ts
+- tests/source-scan.test.ts
+- CLAUDE.md
+- docs/archive/permissions-and-config/2026-09-22-sensitive-guard-one-read.md
+- docs/backlog/feed-watch-triaged-roundup.md
+- docs/bugs/*.md
+
 ## Adjudicated overlaps
 
 > Pre-answers for the execution commands' preflight overlap prompt. Scoped to exact branch + file pairs on branches that belong to NO active plan (a hand-opened worktree, another contributor). A branch of a sibling plan's session is never listed here — it becomes a cross-plan edge instead.
 
 | Session | Branch (not in this plan) | Files | Verdict | Decided |
 |---------|---------------------------|-------|---------|---------|
-| — | no live worktrees at build time | — | — | — |
+| — | no live worktrees at build time (re-measured at the 2026-09-23 rebuild: only the primary checkout) | — | — | — |
 
 ## Not ours
 
@@ -95,7 +177,9 @@
 
 | File / area | Author | Basis |
 |-------------|--------|-------|
-| — | — | no session predicts a surface; re-measured at `--rebuild` |
+| `src/ops/shadow-root.ts`, `src/ops/shadow-service.ts`, `src/config.ts`, `src/cli/mercury.ts`, `tests/shadow-root.test.ts`, `tests/shadow-service.test.ts` (S9) | avishai tsabari | 14 d to 2026-09-23 (`9e8268c` shadow live-project resolution, version bumps, `1812d41` office-365-mail); lane Q11 → ours |
+| `package.json` (S11) | avishai tsabari / Avishai-Tsabari / dependabot[bot] | version bumps and dependency PRs (#100, #111); lane Q12 → ours |
+| `tests/container-copy-list-closure.test.ts` (S12) | avishai tsabari / Avishai-Tsabari | `53e9ca7` mercury build stages the Dockerfile's COPY sources; S12 copies its pattern and does not edit it; lane Q13 → ours |
 
 ## Deferred
 

package/docs/plans/bench-patterns-0915/sessions/S10.md

@@ -0,0 +1,40 @@
+## Launched — 2026-09-24T12:25Z
+Branch: worktree-feature-shadow-feed-fixtures
+
+## Report — 2026-09-24T15:47Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: restart
+Files changed:
+- docs/archive/rehearsal/2026-09-24-shadow-feed-fixtures.md
+- docs/pending-updates/shadow-feed-fixtures.md
+- docs/pending-verification.md
+- examples/extensions/feed-watch/fixtures.ts
+- examples/extensions/feed-watch/index.ts
+- tests/feed-watch-fixtures.test.ts
+- tests/fixtures/feed-watch/shadow/README.md
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Ffeeds.bbci.co.uk%2Fsport%2Ffootball%2Frss.xml
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Fwww.maccabi-tlv.co.il%2Ffeed
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Fwww.one.co.il%2Frss
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Fwww.theguardian.com%2Ffootball%2Frss
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Fwww.whoscored.com%2Frss
+- tests/fixtures/feed-watch/shadow/feeds/rss%3Ahttps%3A%2F%2Fwww.youtube.com%2Ffeeds%2Fvideos.xml%3Fchannel_id%3DUCWV3obpZVGgJ3j9FVhEjF2Q
+- tests/fixtures/feed-watch/shadow/feeds/telegram%3ABeitarNews
+- tests/fixtures/feed-watch/shadow/feeds/telegram%3Amanunitedisraell
+Siblings must know:
+- The spec's Open Question is not closed here: `docs/bugs/feed-watch-gnews-status-key-is-the-array-index.md` still reads Open although `expandSources` keys gnews by `gnewsSourceKey` — a verify-and-archive for whoever runs `/f-bug-fix` on it.
+- `docs/pending-verification.md`: S10 appended its section at the end, after the pi 0.87.1 / Opus 5.5 section (rebased, nothing overwritten).
+- M2.4 `harness-on-shadow`: a MATCHED fixture cannot be rerun on the same snapshot (the carried `buffer:` fingerprint collapse); dropped fixtures can. Fresh snapshot per rehearsal.
+- Squash commit 759d04e is on local `dev` only — not pushed (owner approval pending).
+--- final report (verbatim) ---
+~~~
+S10 shadow-feed-fixtures — delivered to local dev as 759d04e (not pushed).
+- New examples/extensions/feed-watch/fixtures.ts; index.ts wires it into buildDeps.fetchFeed and the poll job (shadow === true only).
+- tests/feed-watch-fixtures.test.ts (34 tests; three guards negative-tested red); 8 checked-in fixtures + README under tests/fixtures/feed-watch/shadow/.
+- docs/pending-verification.md: S10 section with 2 MANUAL-VERIFY lines and pointers to the 8 unlocked lines.
+- Spec archived to docs/archive/rehearsal/2026-09-24-shadow-feed-fixtures.md; docs/pending-updates/shadow-feed-fixtures.md written; ARCHITECTURE.md unchanged.
+- bun run check: all 12 links passed after the rebase onto dev. Code review: 2 findings, fixed. QA: 32/34 pass, 2 deferred to the box.
+- Deviation: a matched fixture is not new on a same-snapshot rerun (buffer fingerprint collapse); pinned by tests and documented.
+- Deploy: restart (host-only extension code), verified against ~/whatsapp-bot/.mercury/extensions/feed-watch/.
+~~~

package/docs/plans/bench-patterns-0915/sessions/S11.md

@@ -0,0 +1,53 @@
+## Launched — 2026-09-24T12:27Z
+Branch: worktree-feature-ratchet-shapes-the-summaries-named
+
+## Report — 2026-09-24T16:00Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- CLAUDE.md
+- docs/archive/dev-tooling/2026-09-24-ratchet-shapes-the-summaries-named.md
+- docs/ideas/old-ratchets-onto-the-shared-lexer.md
+- docs/pending-updates/ratchet-shapes-the-summaries-named.md
+- package.json
+- scripts/absent-allows-baseline.json
+- scripts/bare-delivery-await-baseline.json
+- scripts/check-absent-allows.ts
+- scripts/check-bare-delivery-await.ts
+- scripts/check-early-return-no-log.ts
+- scripts/check-unbounded-race.ts
+- scripts/check.ts
+- scripts/early-return-no-log-baseline.json
+- scripts/lib/ratchet.ts
+- scripts/unbounded-race-baseline.json
+- tests/check-ratchets.test.ts
+Siblings must know:
+- Two bugs filed (owner Q9/OQ4, Q10), never fixed here: `denied-reply-send-is-unguarded` (src/core/handler.ts:315, minor) and `media-download-buffers-before-size-check-without-content-length` (src/core/media.ts:233, moderate). Whoever fixes one must lower `scripts/bare-delivery-await-baseline.json` / `scripts/absent-allows-baseline.json` in the same commit, or the gate reports a stale baseline.
+- Four new links in `bun run check` / the pre-push hook: check:early-return-no-log, check:bare-delivery-await, check:absent-allows, check:unbounded-race. Any session adding one of the four shapes under src/ or examples/ will go red; a fix that removes one will go red as stale until the baseline row is lowered.
+- CLAUDE.md: one Gotchas line appended at the end of the list (S12 also edits CLAUDE.md; rebase over it).
+- package.json `lint` / `lint:fix` gained five `scripts/` paths right after `scripts/check-sync-calls.ts`.
+--- final report (verbatim) ---
+~~~
+S11 — ratchet-shapes-the-summaries-named: implemented, archived, squash-merged into local dev as c5975b3. NOT pushed (owner rule: push waits for approval).
+
+What shipped:
+- scripts/lib/ratchet.ts — zero-dependency masking lexer (comments, strings, templates, regex bodies blanked at the same length), brace-depth block walker (try/catch/finally/fn/other), scanRoots / diffBaseline / formatReport / runGate.
+- Four gates, each a pure `text -> Hit[]` detector plus an exported `gate` spec:
+  A check-early-return-no-log  baseline 0
+  B check-bare-delivery-await  baseline 1  (src/core/handler.ts:315; bridges/adapters skipped)
+  C check-absent-allows        baseline 9  (C1 5 + C2 4)
+  D check-unbounded-race       baseline 17 (D1 0 + D2 17)
+  The measurement on the branch was identical to the planning table, before and after the rebase over S10 and the scheduler ledger.
+- tests/check-ratchets.test.ts — 58 tests: lexer hard cases; each post-mortem's pre-fix code (9739fa0, 00ffdc0^, 1794a25^, bb3ca14^, a24eb6d) counts > 0, its fix counts 0, comment/string plants count 0; wired-gate plant test over a copy of the real handler. Every rule clause negative-tested; two probes found a vacuous clause and dead code, both closed.
+- Wiring: package.json check:* x4 and lint/lint:fix x5 paths; scripts/check.ts LINKS x4; one CLAUDE.md Gotchas line.
+- check-silent-catch.ts / check-sync-calls.ts byte-identical.
+
+Gates: `bun run check` and `~/check-mercury.sh check` all 16 links PASS on the rebased branch — 5986 pass / 9 skip / 0 fail, lint Checked 552 files. QA 24/24, 0 deferred. Code review: 5 findings, all fixed (try/finally not a guard; walker ternary + type-literal return; D1 `new` prefix; per-match slice; bug (b) overclaimed an event-loop stall — corrected on dev as 2d54d0d).
+
+Bugs filed first, not fixed: docs/bugs/denied-reply-send-is-unguarded.md, docs/bugs/media-download-buffers-before-size-check-without-content-length.md.
+Follow-up idea: docs/ideas/old-ratchets-onto-the-shared-lexer.md.
+Spec archived: docs/archive/dev-tooling/2026-09-24-ratchet-shapes-the-summaries-named.md. docs/pending-updates/ratchet-shapes-the-summaries-named.md written — /f-doc-sync applies the ROADMAP change. ARCHITECTURE.md: not updated (dev tooling only).
+Deploy needs: none (scripts/ and tests/ are not in the image and not run by the service).
+~~~

package/docs/plans/bench-patterns-0915/sessions/S12.md

@@ -0,0 +1,44 @@
+## Launched — 2026-09-24T12:30Z
+Branch: worktree-feature-inventories-as-files
+
+## Report — 2026-09-24T16:06Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- CLAUDE.md
+- docs/archive/dev-tooling/2026-09-24-inventories-as-files.md
+- docs/backlog/feed-watch-triaged-roundup.md
+- docs/bugs/url-bridges-drop-over-limit-attachments-without-a-note.md
+- docs/pending-updates/inventories-as-files.md
+- tests/helpers/inventory.ts
+- tests/helpers/source-scan.ts
+- tests/inventories/guard-axes.ts
+- tests/inventories/host-limits.ts
+- tests/inventories/pi-spawns.ts
+- tests/inventories/run-entries.ts
+- tests/inventory-guard-axes.test.ts
+- tests/inventory-host-limits.test.ts
+- tests/inventory-pi-spawns.test.ts
+- tests/inventory-run-entries.test.ts
+- tests/source-scan.test.ts
+Siblings must know:
+- Every later sensitive-guard fix (plan sensitive-bugs-0922 S1–S5) that archives its bug doc turns `tests/inventory-guard-axes.test.ts` red ON PURPOSE; the fixer rewrites that cell to cite the test the fix added.
+- New bug `url-bridges-drop-over-limit-attachments-without-a-note` is the `none` reader of `mediaMaxSizeMb` and `maxDiskMb` in `tests/inventories/host-limits.ts`; its fix turns that test red the same way. `src/bridges/` is owned by plan bugs-0915.
+- A new `pi` spawn (feed-watch-triaged-roundup's `triage.ts`), a new occurrence of handleRawInput/executePrompt/runTask/replyWithRetry, a new limit-shaped key in src/config.ts, or a new guard-function call is red until it has a row in `tests/inventories/`.
+- Local `dev` @ a0ac9cc, not pushed (CLAUDE.local.md: push waits for owner approval).
+--- final report (verbatim) ---
+~~~
+S12 inventories-as-files — delivered to local dev as a0ac9cc (squash), not pushed.
+
+Four inventories under tests/inventories/ (pi-spawns 4 rows, run-entries 12 rows / 7 calls,
+host-limits 22 keys, guard-axes 5 legs x 12 axes), each with a both-directions closure test on a
+fail-closed lexer (tests/helpers/source-scan.ts, tests/helpers/inventory.ts, tests/source-scan.test.ts).
+Every inventory negative-tested (remove a row → red naming file:line; plant a site → red), all reverted.
+Bug filed: docs/bugs/url-bridges-drop-over-limit-attachments-without-a-note.md (moderate).
+CLAUDE.md pi-spawn gotcha now points at the test; feed-watch-triaged-roundup gate row updated.
+Gate after rebase on dev: 16/16 links, 6044 pass / 9 skip / 0 fail; WSL mirror check 12/12 (pre-rebase).
+Spec archived: docs/archive/dev-tooling/2026-09-24-inventories-as-files.md; docs/pending-updates/inventories-as-files.md written.
+Deploy: none (tests + docs).
+~~~

package/docs/plans/bench-patterns-0915/sessions/S4.md

@@ -0,0 +1,29 @@
+## Launched — 2026-09-23T11:30Z
+Branch: —
+
+## Report — 2026-09-23T13:05Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/backlog/shadow-own-credential.md
+- docs/ideas/shadow-own-credential.md (deleted — promoted)
+- docs/ROADMAP.md (Inbox row → Next #17)
+Siblings must know:
+- The spec predicts 14 surfaces, including src/cli/mercury.ts, src/config.ts, src/ops/shadow-{root,service,snapshot}.ts and six tests; --rebuild must re-cut the implementation session against them.
+- Q2 is settled: a second OAuth login (option A). A shared file + lock is the documented fallback only if Step 0 fails. An API key is rejected by the owner outright.
+- Step 0 of the implementation is an owner-run probe with no code (a second login must leave live alive); the implementation session must stop at it and not code past it.
+- After deploy, every existing snapshot is refused (snapshot-shares-credential); take a fresh one.
+- Separate item to file (owner, 2026-09-23): the extension-state refresh tokens (tradestation, office-365-mail) that snapshots copy through state.db. Not yet known to be a bug; to be investigated thoroughly first. Not filed here: a planning session writes only its own doc.
+--- final report (verbatim) ---
+~~~
+/f-feature-planning shadow-own-credential — Goal approved, Architecture approved (2026-09-23).
+Idea promoted to docs/backlog/shadow-own-credential.md; ROADMAP Next #17.
+Design: shadow-own credential at ~/mercury-shadow/auth.json via `mercury shadow login`; snapshot no longer
+copies auth.json and blanks the two env carriers; `shadow up` loses the shape-(a) copy and gains five
+refusals (snapshot-shares-credential, credential-absent, credential-unreadable, credential-shared,
+live-credential-unknown); loadConfig refuses a shadow auth path outside the root. Host-only → restart.
+Next step: /f-ops-plan bench-patterns-0915 --rebuild, then /f-feature-dev shadow-own-credential
+(Step 0 is an owner probe before any code).
+~~~

package/docs/plans/bench-patterns-0915/sessions/S5.md

@@ -0,0 +1,30 @@
+## Launched — 2026-09-23T11:40Z
+Branch: —
+
+## Report — 2026-09-23T13:36Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/backlog/shadow-feed-fixtures.md
+- docs/ideas/shadow-feed-fixtures.md (deleted — promoted)
+- docs/ROADMAP.md (Inbox row → Next #18)
+Siblings must know:
+- The spec predicts 7 surfaces, all inside examples/extensions/feed-watch/ (new fixtures.ts, index.ts), tests/feed-watch-fixtures.test.ts, tests/fixtures/feed-watch/shadow/ and docs/pending-verification.md. It touches no src/ file, so it does not collide with shadow-own-credential (S4) or with bugs-0915's files; --rebuild must still re-cut the implementation session against these surfaces.
+- `--reset-feed-state` is dropped: an empty `seen` map triggers the silent seed tick. Novelty comes from a per-process `{{nonce}}` token, so no state is deleted and nothing in src/ops/ changes.
+- Only 8 of the 11 feed-shaped pending lines are unlocked (L1574, L1575, L1598, L1621, L1623, L1640, L1641, L1718); L1691, L1698 and L1535 are not fixture-drivable.
+- M1.3c is not a build dependency, but it sets two operating constraints: fixture rehearsals stay short and supervised until it ships (a matched fixture opens a model-calling verify run), and after it ships every fresh snapshot needs the fixtures copied in again.
+- Stale doc to fix separately: docs/bugs/feed-watch-gnews-status-key-is-the-array-index.md reads Open against code that already keys gnews targets by content (spec Open Questions).
+--- final report (verbatim) ---
+~~~
+/f-feature-planning shadow-feed-fixtures — Goal approved, Architecture approved (2026-09-23).
+Idea promoted to docs/backlog/shadow-feed-fixtures.md; ROADMAP Next #18.
+Design: in shadow mode only (ctx.config.shadow === true), feed-watch's buildDeps.fetchFeed looks up
+<resolved dataDir>/fixtures/feeds/<encodeURIComponent(target key)> and answers fetchForTarget from the file
+(200 + rendered body, or 503 for `dead`); parser, caps, matching, dedup, seen and the verify task stay the
+real code. Tokens {{nonce}} (9 digits, per process), {{now}}, {{now_iso}}. Unknown file names warned once
+with the valid keys. Nine checked-in fixtures + README under tests/fixtures/feed-watch/shadow/.
+Host-only extension code → restart; verify against the installed copy.
+Next step: /f-ops-plan bench-patterns-0915 --rebuild, then /f-feature-dev shadow-feed-fixtures.
+~~~

package/docs/plans/bench-patterns-0915/sessions/S6.md

@@ -0,0 +1,46 @@
+## Report — 2026-09-22T20:22Z
+Outcome: delivered
+Delivered: local (uncommitted — shared checkout, no git write per brief; owner commits Round 0)
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/backlog/sensitive-guard-one-read.md
+- docs/ideas/sensitive-guard-one-read.md (deleted — promoted)
+- docs/ROADMAP.md (row 14 in Next + its Inbox row removed; rows 15-18 in the same file belong to p0-plan-0922 sessions)
+- docs/bugs/sensitive-gate-is-checked-before-the-space-queue.md
+- docs/bugs/sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata.md
+- docs/bugs/scheduled-run-skipped-by-sensitive-deny-has-no-reader.md
+- docs/bugs/sensitive-guard-axis-coverage-gaps.md
+- docs/bugs/sensitive-guard-replay-loses-the-dropped-attachment-note.md (one cross-link bullet)
+- docs/plans/bench-patterns-0915/sessions/S6.md
+Siblings must know:
+- S8 (`inventories-as-files`): the guard inventory input is `docs/backlog/sensitive-guard-one-read.md` § `### Legs × axes (the table S8 copies)`, with 5 legs (L1-L5) × 12 axes. Cells marked `none` are "construction, not test" until B4 closes them.
+- `sensitive-opt-out-should-deny-not-block` (deferred in p0-plan-0922): plan it after B1. The capability broker (L4) and env injection (L5) are the legs an opt-out must also deny at.
+--- final report (verbatim) ---
+~~~
+S6 — sensitive-guard-one-read — DELIVERED (read only; no src/ or tests/ edit)
+
+Legs: executePrompt is the single container choke point (runtime.ts:3219),
+two callers: handleRawInput (chat-sdk via handler.ts:249 — bridges,
+simulate-ingress, shadow, smoke; cli via routes/chat.ts:314) and the scheduler
+handler (cron poll + triggerTask: dashboard ▶, mrctl tasks run). The broker
+(capability.ts:52) and the env injection (runtime.ts:3127) are downstream
+enforcement points.
+
+Axes: the idea's seven + replay-meta, check→use, relink (+ skip visibility,
+manual trigger as leg-specific rows).
+
+Bugs filed:
+- B1 moderate  sensitive-gate-is-checked-before-the-space-queue
+- B2 moderate  sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata
+- B3 minor     scheduled-run-skipped-by-sensitive-deny-has-no-reader
+- B4 minor     sensitive-guard-axis-coverage-gaps (test-only + stale comments)
+Open bug sensitive-guard-replay-loses-the-dropped-attachment-note not refiled;
+cross-linked to B2 (one fix: store the blocked turn).
+
+Recommended order at --rebuild: B2 + drop-note bug together, then B1, then B3;
+B4 rides along. --drop S6.
+
+Gate: bun run check — all 12 links passed; 5799 pass / 9 skip / 0 fail;
+lint "Checked 538 files".
+~~~