mercury-agent 0.23.2 → 0.24.1

package/docs/plans/bench-patterns-0915/sessions/S7.md

@@ -0,0 +1,30 @@
+## Launched — 2026-09-23T11:39Z
+Branch: —
+
+## Report — 2026-09-23T15:10Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/backlog/ratchet-shapes-the-summaries-named.md
+- docs/ideas/ratchet-shapes-the-summaries-named.md (deleted — promoted)
+- docs/ROADMAP.md (Inbox row → Next #20)
+Siblings must know:
+- The spec predicts 17 surfaces, all under scripts/, tests/, package.json and CLAUDE.md; no src/ file is edited. --rebuild must re-cut the implementation session against them.
+- It edits package.json (the check:* scripts and the lint / lint:fix lists) and scripts/check.ts (LINKS). Any session touching either collides.
+- The new gates scan src/ and examples/. Any item landing code there first changes the day-one baselines; the implementation session re-measures, so nothing blocks on it.
+- Two candidate bugs were found by the measurement and are not filed (a planning session writes only its own doc): src/core/handler.ts:315 (the "denied" sendReply awaited outside any try) and src/core/media.ts:233 (no content-length means the whole body is buffered before the size check). OQ4 recommends /f-bug-report for both before /f-feature-dev.
+- Open Questions 1–5 carry recommendations; the owner approved the Goal and the Architecture, but has not answered the questions one by one.
+--- final report (verbatim) ---
+~~~
+/f-feature-planning ratchet-shapes-the-summaries-named — Goal approved, Architecture approved (2026-09-23).
+Idea promoted to docs/backlog/ratchet-shapes-the-summaries-named.md; ROADMAP Next #20.
+Design: scripts/lib/ratchet.ts (masking lexer, brace-depth block walker, scan, baseline diff, runGate) plus four
+gates, check:early-return-no-log (A), check:bare-delivery-await (B), check:absent-allows (C) and
+check:unbounded-race (D). Each has its own baseline and check.ts link, and each prints file:line and a fix line.
+tests/check-ratchets.test.ts pins each post-mortem's pre-fix code as a fixture (9739fa0, 00ffdc0^, 1794a25^, bb3ca14^,
+a24eb6d) and negative-tests each detector. The old gates are untouched. Dev-only: no deploy.
+Planning measurement (not the baseline): A 0, B 1, C 5+4, D 0+17.
+Next step: /f-ops-plan bench-patterns-0915 --rebuild, then /f-feature-dev ratchet-shapes-the-summaries-named.
+~~~

package/docs/plans/bench-patterns-0915/sessions/S8.md

@@ -0,0 +1,30 @@
+## Launched — 2026-09-23T11:40Z
+Branch: —
+
+## Report — 2026-09-23T15:10Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/backlog/inventories-as-files.md
+- docs/ideas/inventories-as-files.md (deleted — promoted)
+- docs/ROADMAP.md (Inbox row → Next #19)
+Siblings must know:
+- The spec predicts 20 surfaces, all under tests/ plus CLAUDE.md and docs; none under src/, examples/, resources/ or scripts/. --rebuild must add the implementation session (/f-feature-dev inventories-as-files) against them.
+- Read-only sources (src/config.ts, src/core/runtime.ts, the spawn files) are named in plain text on purpose, so they are not predicted as write surfaces; the inventories read them at test time.
+- sensitive-bugs-0922 S1–S5: if this feature lands first, each fix that archives its bug doc turns tests/inventory-guard-axes.test.ts red, and that fix must rewrite its `none` cell to cite the new test. Intended; either landing order works.
+- feed-watch-triaged-roundup: its triage.ts is a fifth pi spawn; whichever lands second adds the row to tests/inventories/pi-spawns.ts.
+- CLAUDE.md's pi-spawn gotcha links docs/ideas/inventories-as-files.md, deleted by this session; implementation Step 7 repoints it (a planning session may not edit CLAUDE.md).
+- S7 (ratchet-shapes-the-summaries-named) has no coupling to this spec; its Goal no longer reads an inventory.
+--- final report (verbatim) ---
+~~~
+/f-feature-planning inventories-as-files — Goal approved, Architecture approved (2026-09-23).
+Idea promoted to docs/backlog/inventories-as-files.md; ROADMAP Next #19.
+Design: four typed-TS inventories in tests/inventories/ (pi-spawns 4, run-entries 12 occurrences / 7 calls,
+host-limits 22 keys, guard-axes 5 legs × 12 axes), each with a two-way closure test built on a fail-closed
+lexer + multi-line scan in tests/helpers/ (no AST, no new dependency); every gap names an open bug doc;
+no line numbers stored; permanent negative controls plus recorded manual negatives. Tests + docs only →
+deploy class none. Re-checked after S4 (shadow-own-credential): no effect on the four sets.
+Next step: /f-ops-plan bench-patterns-0915 --rebuild, then /f-feature-dev inventories-as-files.
+~~~

package/docs/plans/bench-patterns-0915/sessions/S9.md

@@ -0,0 +1,2 @@
+## Launched — 2026-09-24T23:28Z
+Branch: worktree-feature-shadow-own-credential

package/docs/plans/flat-0916/briefs/S1.md

@@ -0,0 +1,55 @@
+# Brief S1 — video understanding: a global extension that watches and listens
+
+**Plan**: docs/plans/flat-0916/plan.md   **Session**: S1   **Round**: 0   **Kind**: plan
+**Item slug**: video-understanding-extension
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work flat-0916 S1
+
+## Run
+
+/f-feature-planning video-understanding-extension
+
+## Scope notes
+
+Read the idea in full — its "How It Might Work" table and "Numbers collected on 2026-09-15" are the architecture's raw material, and its six Open Questions are the decisions to settle with the owner (hook vs skill; where the visual track runs for provider `anthropic`; the Gemini free-tier privacy warning; whether quoted video gets its own lower cap; whether `voice-transcribe`'s provider code factors out or `video` depends on it; which extension owns `yt-dlp`). Key files: `src/adapters/whatsapp-media.ts` (`QUOTED_DOWNLOAD_TYPES`, L329), `examples/extensions/voice-transcribe/index.ts` (the transcriber providers and the `mercury.config` shape to mirror), `examples/extensions/pdf/` (the `mercury.cli` + `install:` shape), `src/extensions/image-builder.ts` (how `install:` becomes RUN lines in the derived image), `src/agent/container-env.ts` L88 (`MODEL_PROVIDER_ENV_VARS` — why `GEMINI_API_KEY` leaks in today; the extension must claim its own `hostOnly` keys instead), `src/config-file.ts` L205 (`media.max_size_mb`), `src/core/trigger.ts` L24 (`media_in_groups`), `examples/profiles/tel-aviv-flat-search/AGENTS.md` L148 (the paragraph the feature replaces — a facts rule: the card quotes the `[Video]` block, never "as you saw"). Any nested model call must follow the pi-spawn rule in `CLAUDE.md` (own the whole system prompt, the space's own leg) and the host-thread rule (a bound and a log line). Deploy class to state in the spec: the ingest line is a host restart; the `install:` string is a **derived-image rebuild** on the first container run; the profile paragraph is an `apply`. Live checks belong in `docs/pending-verification.md` under `## Plan flat-0916 / S1` only.
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/video-understanding-extension.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/` — planning sessions write docs only. Plan `bugs-0915` owns `src/bridges/`, `src/core/conversation.ts`, `src/ops/shadow-snapshot.ts`, `src/ops/shadow-service.ts`, `src/storage/pi-auth.ts`; name them in your Architecture if you must, do not edit them.
+- `docs/ROADMAP.md`: your command's Step 4.5 row is the one edit; you share the file with sibling planning sessions (this plan's S2 and `bench-patterns-0915` S4–S8) and there is no lock — planning sessions run one at a time for that reason.
+- `examples/profiles/tel-aviv-flat-search/`: the implementation session revises it; you only name the change.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none — no `Q` rows at build; the idea's open questions are yours to settle with the owner.
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions — touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine; run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`) — `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. A planning session opens no worktree; `~/.bun/bin/bun`, never bare `bun`, for any probe you run.
+
+## Report
+
+Your command's final report is appended to `docs/plans/flat-0916/sessions/S1.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md` — in a public repo the plan folder lives only in the primary checkout, and an append into a missing directory must fail loudly, never create one inside the worktree). `work` verifies the append.

package/docs/plans/flat-0916/briefs/S2.md

@@ -0,0 +1,55 @@
+# Brief S2 — feed-watch owns the roundup: a managed lane per space
+
+**Plan**: docs/plans/flat-0916/plan.md   **Session**: S2   **Round**: 0   **Kind**: plan
+**Item slug**: feed-watch-owns-the-roundup
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work flat-0916 S2
+
+## Run
+
+/f-feature-planning feed-watch-owns-the-roundup
+
+## Scope notes
+
+Read the idea in full. Story one is the reconciled, managed roundup row (`feed-watch.roundup_cron` → one `tasks` row per enabled space, `managed_by`/`created_by` marker, dashboard read-only, extension-owned generic prompt); story two (floor + ceiling trigger on the residue count) is explicitly behind it — scope the Goal to one and name the other. The four Open Questions are the decisions to settle with the owner (reconcile on startup only vs on config change; schema column vs `created_by` + dashboard rule; migrating live row 621 without losing its cursor `last_digest_at:<spaceId>:roundup` and run history; whether the daily article stays profile-owned). Key files: `examples/extensions/feed-watch/index.ts` (`createTask` for the verify one-shots is the existing pattern; the `[feed-watch:digest:<lane>]` marker), `examples/extensions/feed-watch/config.ts` (the space-config keys), `examples/extensions/feed-watch/prompts/verify.md` (the generic-prompt precedent), `examples/profiles/football-reporter/tasks/roundup.md` and its `config.yaml` task entry (what becomes one config key), `src/storage/db.ts` (`tasks` columns — `created_by` exists), the dashboard's task routes (where "pause allowed, edit/delete not" is enforced), `src/profile/space-profile.ts` (`apply` refuses foreign task ids — the migration must not trip it). Decide **with the owner** where this lands: a `docs/backlog/` spec of its own, or an M2 row of `docs/goals/feed-watch-social-sources/roadmap.md` (the idea says M2-shaped; the roadmap's M2 is decomposed at the M1 checkpoint, which is a separate `/f-goal checkpoint` session, not yours). Deploy class: feed-watch reaches the box as the installed snapshot — restart + verify the installed copy; a `db.ts` column is a restart with a migration on boot. Live checks under `## Plan flat-0916 / S2` only.
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/feed-watch-owns-the-roundup.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/` — planning sessions write docs only. Plan `bugs-0915` owns `src/bridges/`, `src/core/conversation.ts`, `src/ops/shadow-snapshot.ts`, `src/ops/shadow-service.ts`, `src/storage/pi-auth.ts`; name them if you must, do not edit them.
+- `docs/ROADMAP.md`: your command's Step 4.5 row is the one edit; you share the file with sibling planning sessions (this plan's S1 and `bench-patterns-0915` S4–S8) and there is no lock — planning sessions run one at a time for that reason.
+- `docs/goals/feed-watch-social-sources/decisions.md` and `roadmap.md`: never edit — if the owner chooses the M2 row, write the row text into your log's "Siblings must know" for the checkpoint session to place.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none — no `Q` rows at build; the idea's open questions are yours to settle with the owner.
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions — touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine; run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`) — `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. A planning session opens no worktree; `~/.bun/bin/bun`, never bare `bun`, for any probe you run.
+
+## Report
+
+Your command's final report is appended to `docs/plans/flat-0916/sessions/S2.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md` — in a public repo the plan folder lives only in the primary checkout, and an append into a missing directory must fail loudly, never create one inside the worktree). `work` verifies the append.

package/docs/plans/flat-0916/decisions.md

@@ -0,0 +1,8 @@
+# Decisions — plan flat-0916
+
+> Answer in the `Answer` column. Everything blocked on a question stays blocked until this column is non-empty for it. `build` and `next` add rows; only you write answers. Delete nothing — an answered row is the audit trail.
+
+| ID | Blocks | Question | Options | Answer | Answered |
+|----|--------|----------|---------|--------|----------|
+
+> No rows at build (2026-09-16): both items are ideas whose open questions are design questions the planning sessions settle with the owner inside `/f-feature-planning`. Lane rows are added by `next` if a re-measure finds a foreign author in a predicted surface.

package/docs/plans/flat-0916/plan.md

@@ -0,0 +1,88 @@
+# Plan: flat-0916
+
+**Status**: Active
+**Created**: 2026-09-16   **Last updated**: 2026-09-16
+**Landing mode**: pr
+**Max width**: 4
+**Inputs**: flat-0916 video-understanding-extension feed-watch-owns-the-roundup
+**Me**: saharw01, Saharw01@gmail.com (also 92163791+saharw01@users.noreply.github.com, avishailevi2@gmail.com)
+
+> Written by `/f-ops-plan` build (and `--rebuild`) and `archive` only. Nothing perishable lives here — no base sha, no other author's file list, no story counts; `next` measures those every time it runs. `plan-state.sh` parses the tables below by their header row, so keep the column order.
+
+> **Why this batch.** The `tel-aviv-flat-search` space (profile `examples/profiles/tel-aviv-flat-search/`, applied 2026-09-15, live in the friends' group) is a notebook by design and produced two ideas on its first day: the friends send walk-through **videos** the bot must refuse (`AGENTS.md` L148, `docs/ideas/video-understanding-extension.md`), and the space is the stated second adopter of feed-watch, whose roundup lane is hand-wired per space (`docs/ideas/feed-watch-owns-the-roundup.md`). Both are ideas, so both are Round 0 by construction — their implementation sessions are added by `--rebuild` once the architectures exist. **Not in this plan, on purpose:** the apartment-source rungs of `feed-watch-social-sources` (Realta RSS, `nester_rent_telaviv`, the Yad2-alert mail bridge, the apartment-hunter profile row — `docs/goals/feed-watch-social-sources/roadmap.md` § Future milestones) are gated on `/f-goal checkpoint feed-watch-social-sources` decomposing M2; `--goal` would pull M1's "built"/"absorbed" rows as noise today. When the checkpoint has written the M2 stories to `docs/backlog/`, they join here with `--rebuild --add`. The profile's own five open live checks (`docs/pending-verification.md` L1936–1954) need the group, not a session.
+
+## Items
+
+| ID | Kind | Slug | Doc | Command | Round | Needs |
+|----|------|------|-----|---------|-------|-------|
+| S1 | plan | video-understanding-extension | docs/ideas/video-understanding-extension.md | /f-feature-planning video-understanding-extension | 0 | — |
+| S2 | plan | feed-watch-owns-the-roundup | docs/ideas/feed-watch-owns-the-roundup.md | /f-feature-planning feed-watch-owns-the-roundup | 0 | — |
+
+> Kind ∈ `feature` | `bug` | `refactor` | `plan` (a Round 0 planning session) | `story` (from `--goal`; runs `/f-feature-dev`).
+> Needs = decision IDs from `decisions.md` that must be answered before this session may launch, or `—`.
+> IDs are never renumbered; `--drop` moves a row to Deferred, `--add` takes the next unused ID.
+
+## Edges
+
+| From | To | Kind | Basis |
+|------|----|------|-------|
+
+> Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
+> Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
+> From may name a session of ANOTHER active plan as `{plan-slug}/S{n}` — always `start-after`, always `file:`; resolved at `next` time by deriving that plan's state.
+> Semantic edges asked 2026-09-16: **none** (owner). Cross-plan: none — `bugs-0915` S3/S4 run in `src/bridges/`, `src/core/conversation.ts`, `src/ops/`, `src/storage/pi-auth.ts`; `bench-patterns-0915` S4–S8 are planning sessions with no surfaces. The implementation sessions added at `--rebuild` are re-cut against whatever is live then.
+
+## Rounds
+
+### Round 0 — unblock
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| — | owner commits this plan folder before the first launch (session logs are written into it) | the `sessions/` logs have a tracked home |
+| S1 | plan video-understanding-extension — Goal + Architecture into `docs/backlog/`; settles hook-vs-skill, the visual-track provider and where it runs, the quoted-video cap, the `voice-transcribe` factoring and who owns `yt-dlp` (the idea's six open questions) with the owner | the implementation session(s), added by `--rebuild` |
+| S2 | plan feed-watch-owns-the-roundup — Goal + Architecture; settles reconcile timing, the `managed` marker, the live-row-621 migration and whether the daily article stays profile-owned; decides with the owner whether it lands as a `docs/backlog/` spec or as an M2 row of `feed-watch-social-sources` | same |
+
+> **One planning session at a time — across plans.** Every `/f-feature-planning` edits `docs/ROADMAP.md` (its Step 4.5) in the shared checkout with no lock, and `bench-patterns-0915` has five Round 0 sessions of its own. Open the next only after the previous one has reported, whichever plan it belongs to.
+> **Do not open an implementation session until the Round 0 commit line has been run.** `plan-state.sh` derives a planning session `landed` the moment its Architecture predicts a surface, which is before its self-review and the owner's approval pause.
+> **Expected collision at `--rebuild`, named now so nobody is surprised:** S1's implementation revises `examples/profiles/tel-aviv-flat-search/AGENTS.md` (the video paragraph) and the apartment-source adoption into the same space edits `AGENTS.md` and `config.yaml` too — a whole-file `start-after` edge, not a parallel pair.
+
+### Round 1
+
+| Session | Item | Predicted surfaces (count) |
+|---------|------|----------------------------|
+| — | none yet — the implementation sessions are added by `/f-ops-plan flat-0916 --rebuild` once the Round 0 docs are committed (and the M2 apartment stories by `--rebuild --add` after the feed-watch checkpoint) | — |
+
+## Collision map
+
+> Whole files, predicted; `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them (0 such paths ignored — both items predict no surfaces yet; the preflight was run on the idea docs only, 1 docs path ignored per item, no overlap).
+
+| File | Sessions |
+|------|----------|
+
+## Predicted surfaces
+
+### S1
+
+### S2
+
+## Adjudicated overlaps
+
+> Pre-answers for the execution commands' preflight overlap prompt. Scoped to exact branch + file pairs on branches that belong to NO active plan (a hand-opened worktree, another contributor). A branch of a sibling plan's session is never listed here — it becomes a cross-plan edge instead.
+
+| Session | Branch (not in this plan) | Files | Verdict | Decided |
+|---------|---------------------------|-------|---------|---------|
+
+## Not ours
+
+> Last measurement (`git log --since=14.days`, authors not in `Me`), 2026-09-16 on `origin/dev`. Re-measured on every `next`; this table is the snapshot the briefs were written from. No session has surfaces yet, so nothing intersects and no lane row exists; the two rows below are the prefixes the architectures are likely to name, recorded so `--rebuild` starts from them.
+
+| File / area | Author | Basis |
+|-------------|--------|-------|
+| `src/extensions/image-builder.ts` (S1 may add the `install:` RUN lines here) | avishai tsabari (322 files in 14d) | co-owner of the tree, not a lane — every prior plan answered `ours`; re-ask only if the file is mid-change at `--rebuild` |
+| `src/storage/db.ts` (S2 may add a `managed_by` column) | avishai tsabari | same |
+| `examples/extensions/feed-watch/`, `examples/extensions/voice-transcribe/`, `src/adapters/whatsapp-media.ts`, `examples/profiles/` | — | no foreign commits in 14d |
+
+## Deferred
+
+| Item | Reason | Home |
+|------|--------|------|

package/docs/plans/p0-plan-0922/briefs/S1.md

@@ -0,0 +1,60 @@
+# Brief S1 — make the caller-token fallback a decision, not an if
+
+**Plan**: docs/plans/p0-plan-0922/plan.md   **Session**: S1   **Round**: 0   **Kind**: plan
+**Item slug**: require-caller-token-for-container-originated-requests
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work p0-plan-0922 S1
+
+## Run
+
+/f-feature-planning require-caller-token-for-container-originated-requests
+
+## Scope notes
+
+Settle the idea's four Open Questions with evidence before choosing a design:
+- **Config flag or transport refusal.** The idea leans towards transport refusal: no new key and no allowlist.
+- **runsc.** Does `containerRuntime: "runsc"`'s per-agent socket already constrain headers or paths?
+- **Admin self-heal.** Is the config-admin self-heal in `src/core/permissions.ts` reachable with a forged `x-mercury-caller`? If so this is privilege escalation, and it should be said so in the Goal.
+- **Console route.** Does `src/core/routes/console.ts` have its own identity model?
+
+Preflight's header-mode roundtrip (`src/preflight/checks/roundtrip.ts`) is the one known legitimate token-less caller. Exempt it by its own principal, never by the *shape* of an absent header. That is the CLAUDE.md rule on whitelisting finite real values. The Architecture must list every leg that reaches identity (every route that calls `checkPerm`, plus `mrctl`, the capability broker and the console) and must end with the negative test: API secret, forged caller and no token must be denied, and deleting the check must turn the test red. **Related, not a dependency:** `bench-patterns-0915`/S6 (`sensitive-guard-one-read`) narrows on the same caller identity, so cite it. If the change adds a config key, it touches four sites (type, schema, allowlist, merge).
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/require-caller-token-for-container-originated-requests.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/`. Planning sessions write docs only. Plan `p0-bugs-0922` owns `src/core/storage-cleanup.ts`, `src/storage/db.ts`, `src/core/reply-context.ts`, `src/agent/container-entry.ts`, `container/agent-package.json`, `resources/pi-extensions/subagent/index.ts` and `src/config.ts`. Name them in your Architecture; do not edit them.
+- `docs/ROADMAP.md`: your command's ROADMAP row is the only edit. Sibling planning sessions share the file and there is no lock, which is why this plan runs its planning sessions one at a time.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions. Touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine. Run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`); `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas (and `docs/graceful-shutdown.md` where the item touches shutdown) before writing the Architecture. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step, so `work` appends this session's report to `docs/plans/p0-plan-0922/sessions/S1.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). The report is `delivered` once `docs/backlog/require-caller-token-for-container-originated-requests.md` predicts at least one surface.

package/docs/plans/p0-plan-0922/briefs/S2.md

@@ -0,0 +1,54 @@
+# Brief S2 — the run ledger cannot see a run that never finished
+
+**Plan**: docs/plans/p0-plan-0922/plan.md   **Session**: S2   **Round**: 0   **Kind**: plan
+**Item slug**: ledger-misses-interrupted-runs
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work p0-plan-0922 S2
+
+## Run
+
+/f-feature-planning ledger-misses-interrupted-runs
+
+## Scope notes
+
+Design the insert-at-start row for `task_runs` (`status='running'`), which `recordRun` then updates, plus the boot reconciliation that turns stale `running` rows into `interrupted`, plus retention-prune safety for in-flight rows. **Sibling in this plan:** S3 (`orphaned-run-recovery`) designs a startup sweep for interrupted *interactive* runs and lands after you. Per the CLAUDE.md rule that two code paths doing the same operation share one implementation, **write the boot-reconciliation seam as a contract S3 can extend** (one sweep with two consumers, not two sweeps), and state it under a "Contract for siblings" heading so S3 can read it. Also reuse or subsume what already runs at boot: missed-cron reporting (`631c3b5`). Schema changes land in `src/storage/db.ts`; there is no migrations directory. `interrupted` renders as its own badge and is counted separately from `error`.
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/ledger-misses-interrupted-runs.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/`. Planning sessions write docs only. Plan `p0-bugs-0922` owns `src/core/storage-cleanup.ts`, `src/storage/db.ts`, `src/core/reply-context.ts`, `src/agent/container-entry.ts`, `container/agent-package.json`, `resources/pi-extensions/subagent/index.ts` and `src/config.ts`. Name them in your Architecture; do not edit them.
+- `docs/ROADMAP.md`: your command's ROADMAP row is the only edit. Sibling planning sessions share the file and there is no lock, which is why this plan runs its planning sessions one at a time.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions. Touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine. Run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`); `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas (and `docs/graceful-shutdown.md` where the item touches shutdown) before writing the Architecture. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step, so `work` appends this session's report to `docs/plans/p0-plan-0922/sessions/S2.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). The report is `delivered` once `docs/backlog/ledger-misses-interrupted-runs.md` predicts at least one surface.

package/docs/plans/p0-plan-0922/briefs/S3.md

@@ -0,0 +1,58 @@
+# Brief S3 — recover orphaned agent runs after a hard process kill
+
+**Plan**: docs/plans/p0-plan-0922/plan.md   **Session**: S3   **Round**: 0   **Kind**: plan
+**Item slug**: orphaned-run-recovery
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work p0-plan-0922 S3
+
+## Run
+
+/f-feature-planning orphaned-run-recovery
+
+## Scope notes
+
+Two halves, from the idea:
+- **(a) Single-instance guard.** Before designing one, check what already exists: `shadow up`'s port guard and the `MERCURY_SHADOW` data-dir refusal both prevent some forms of a second instance. Then decide pidfile or flock (question 1).
+- **(b) Startup sweep.** Post a belated failure notice for runs that were mid-flight when the previous process died.
+
+Question 2 (still in progress vs orphaned) has an easy answer on this box: on boot, the new process knows that nothing it did not start itself can still be running. Say so explicitly, and say what changes if the process ever runs as more than one instance. Where does the "⏳ Processing…" state live today? Trace it from the in-process crash-reply fix (`agent-run-dies-silently-no-error-reply-to-chat`). Every swallowed failure must log or reply (CLAUDE.md).
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/orphaned-run-recovery.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/`. Planning sessions write docs only. Plan `p0-bugs-0922` owns `src/core/storage-cleanup.ts`, `src/storage/db.ts`, `src/core/reply-context.ts`, `src/agent/container-entry.ts`, `container/agent-package.json`, `resources/pi-extensions/subagent/index.ts` and `src/config.ts`. Name them in your Architecture; do not edit them.
+- `docs/ROADMAP.md`: your command's ROADMAP row is the only edit. Sibling planning sessions share the file and there is no lock, which is why this plan runs its planning sessions one at a time.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: land only after S2 (`ledger-misses-interrupted-runs`) is landed. Its boot-reconciliation contract is the seam your startup sweep extends. Check with `/f-ops-plan next p0-plan-0922` before finishing the Architecture. If S2 is not landed yet, write the concurrency-guard half and leave the sweep as an explicit `depends on S2's contract` section.
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions. Touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine. Run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`); `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas (and `docs/graceful-shutdown.md` where the item touches shutdown) before writing the Architecture. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step, so `work` appends this session's report to `docs/plans/p0-plan-0922/sessions/S3.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). The report is `delivered` once `docs/backlog/orphaned-run-recovery.md` predicts at least one surface.

package/docs/plans/p0-plan-0922/briefs/S4.md

@@ -0,0 +1,54 @@
+# Brief S4 — wire message-debounce flushAll() to the shutdown hook
+
+**Plan**: docs/plans/p0-plan-0922/plan.md   **Session**: S4   **Round**: 0   **Kind**: plan
+**Item slug**: wire-debounce-flush-to-shutdown-hook
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work p0-plan-0922 S4
+
+## Run
+
+/f-feature-planning wire-debounce-flush-to-shutdown-hook
+
+## Scope notes
+
+Decide flush or persist under a shutdown deadline (the idea's two Open Questions). The deadline is real: read the systemd unit's stop timeout and what `docs/graceful-shutdown.md` already budgets. A full LLM turn per pending batch will not fit. The likely answer is to persist the pending batches and replay them on the next boot as unread. If so, that replay is a boot-time consumer like `orphaned-run-recovery`'s sweep: design it as a separate call site that can later join a shared boot seam, and say so. Do not merge the ideas. Any bound on the shutdown path needs a log line for when it fires (the CLAUDE.md single-thread and bounds rules). The regression test starts a batch, triggers shutdown, and asserts the batch is not lost.
+
+## Owned surfaces (predicted)
+
+- (none yet — `docs/backlog/wire-debounce-flush-to-shutdown-hook.md` is the deliverable)
+
+## Do not touch
+
+- Everything outside your item's doc and `docs/backlog/`. Planning sessions write docs only. Plan `p0-bugs-0922` owns `src/core/storage-cleanup.ts`, `src/storage/db.ts`, `src/core/reply-context.ts`, `src/agent/container-entry.ts`, `container/agent-package.json`, `resources/pi-extensions/subagent/index.ts` and `src/config.ts`. Name them in your Architecture; do not edit them.
+- `docs/ROADMAP.md`: your command's ROADMAP row is the only edit. Sibling planning sessions share the file and there is no lock, which is why this plan runs its planning sessions one at a time.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none
+
+## Shared checkout (kind `plan`)
+
+You share the primary checkout with sibling planning sessions. Touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine. Run **no git write command at all** (`add`, `commit`, `stash`, `checkout`, `pull`); `next` hands the owner one commit line for Round 0.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas (and `docs/graceful-shutdown.md` where the item touches shutdown) before writing the Architecture. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step, so `work` appends this session's report to `docs/plans/p0-plan-0922/sessions/S4.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). The report is `delivered` once `docs/backlog/wire-debounce-flush-to-shutdown-hook.md` predicts at least one surface.

package/docs/plans/p0-plan-0922/briefs/S5.md

@@ -0,0 +1,79 @@
+# Brief S5 — containers stop holding API_SECRET; container calls authenticate by caller token
+
+**Plan**: docs/plans/p0-plan-0922/plan.md   **Session**: S5   **Round**: 1   **Kind**: feature
+**Item slug**: require-caller-token-for-container-originated-requests
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work p0-plan-0922 S5
+
+## Run
+
+/f-feature-dev require-caller-token-for-container-originated-requests
+
+## Scope notes
+
+Follow the doc's Implementation Sequence, starting with the negative suite (red first, cases a–g). The owner decided `mrctl disk` for members is **admin-only**, via `media.purge` (Open Questions). **Deploy needs: rebuild.** It is image-class: `src/cli/mrctl.ts` is baked, so run `container/build.sh`, restart, then wait for the derived ext image `Built` line. Verify by grepping the image, never the repo. The box runs `headers` mode (no `MERCURY_CALLER_TOKEN_KEY`), so exercise token mode once in a shadow with a key set. If a key is minted, the global CLAUDE.md rule applies: remind the owner, in the same sitting, to write it into the gitignored local env file, and never paste the value anywhere. `src/config.ts` and `src/agent/container-runner.ts` are shared with S6 and S7, which start after you land. Add only what the doc names there.
+
+## Owned surfaces (predicted)
+
+- container/build.sh
+- src/agent/container-entry.ts
+- src/agent/container-env.ts
+- src/agent/container-runner.ts
+- src/cli/mrctl.ts
+- src/config.ts
+- src/core/api.ts
+- src/core/auth.ts
+- src/core/caller-token.ts
+- src/core/routes/console.ts
+- src/core/routes/media.ts
+- src/core/routes/storage.ts
+- src/preflight/checks/roundtrip.ts
+- tests/api-chat-auth.test.ts
+- tests/api-container-credential.test.ts
+- tests/api.test.ts
+- tests/console-routes.test.ts
+- tests/container-runner-create-args.test.ts
+- tests/media-storage-route.test.ts
+- tests/mrctl-http.test.ts
+- tests/preflight-roundtrip.test.ts
+
+## Do not touch
+
+- scripts/football-audit.ts, src/audit/ledger-queries.ts, src/core/boot-reconcile.ts, src/core/operator-alerts.ts, src/core/routes/dashboard.ts, src/core/runtime.ts, src/core/task-scheduler.ts, src/main.ts, src/storage/db.ts, src/types.ts, tests/boot-reconcile.test.ts, tests/dashboard-task-last-run.test.ts, tests/ledger-queries.test.ts, tests/operator-alerts.test.ts, tests/scheduler-interrupted-shutdown.test.ts, tests/scheduler-missed-runs.test.ts, tests/task-run-ledger.test.ts, tests/task-runs-migration.test.ts   (owned by S6 this plan)
+- src/adapters/whatsapp.ts, src/agent/container-error.ts, src/bridges/whatsapp.ts, src/core/boot-reconcile.ts, src/core/chat-run-journal.ts, src/core/handler.ts, src/core/instance-lock.ts, src/core/runtime.ts, src/core/space-queue.ts, src/core/system-messages.ts, src/main.ts, src/storage/db.ts, tests/chat-run-journal.test.ts, tests/container-error.test.ts, tests/handler.test.ts, tests/instance-lock.test.ts, tests/orphaned-run-recovery.e2e.test.ts, tests/shutdown.test.ts, tests/space-queue.test.ts, tests/system-messages.test.ts   (owned by S7 this plan)
+- src/core/debounce.ts, src/core/handler.ts, src/core/pending-ingress.ts, src/core/runtime.ts, src/main.ts, src/storage/db.ts, src/types.ts, tests/debounce.test.ts, tests/handler.test.ts, tests/pending-ingress.test.ts, tests/shutdown.test.ts   (owned by S8 this plan)
+- Not ours (avishai tsabari / Avishai-Tsabari, last 14 d): `src/core/runtime.ts`, `src/main.ts`, `src/storage/db.ts`, `src/config.ts`, `src/agent/container-runner.ts`, `src/agent/container-entry.ts`, `src/preflight/checks/roundtrip.ts`: see plan.md "Not ours". The lane is cleared by Q1 (ours). Re-check with `/f-ops-plan next p0-plan-0922`.
+- Plan `sensitive-bugs-0922` fixes the sensitive-guard bugs in `src/core/runtime.ts` *after* this plan. Do not fix any of them here, even if you pass the code: `handleRawInput` → `checkSensitiveConnectionGuard`, the replay at ~1728, and the scheduler skip at ~1047.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: ours (owner, 2026-09-22). `src/core` and `src/agent` are this plan's lane.
+
+## Ledger rules
+
+- `docs/ROADMAP.md`: never edit. Your command writes `docs/pending-updates/require-caller-token-for-container-originated-requests.md` as usual.
+- `docs/pending-verification.md`: append only under `## Plan p0-plan-0922 / S5`.
+- Any goal's `decisions.md`: never edit; put decisions in your log's "Siblings must know".
+
+## Environment
+
+- Read `CLAUDE.md` → Worktree Setup and Gotchas before opening the worktree. Nothing from them is copied here. `bun install` once in the fresh worktree; the check gate is `bun run check` (every link runs to completion — read every line).
+
+## Report
+
+Your command's final report is appended to `docs/plans/p0-plan-0922/sessions/S5.md` by its report step (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`). `work` verifies the append.