mercury-agent 0.24.2-beta.0 → 0.24.2

package/docs/plans/archive/2026-10-02-media-bugs-0928/plan.md

@@ -0,0 +1,111 @@
+# Plan: media-bugs-0928
+
+**Status**: Archived
+**Created**: 2026-09-28   **Last updated**: 2026-10-02
+**Landing mode**: pr
+**Max width**: 4
+**Inputs**: media-bugs-0928 outbox-scan-drops-files-whose-mtime-predates-the-run url-bridges-drop-over-limit-attachments-without-a-note media-download-buffers-before-size-check-without-content-length (the implementation half of the 2026-09-28 general-priorities scan, split out of `general-0928` so these three launch now instead of waiting behind its five-session Round 0)
+**Me**: saharw01, Saharw01@gmail.com (also 92163791+saharw01@users.noreply.github.com, avishailevi2@gmail.com)
+
+> Written by `/f-ops-plan` build (and `--rebuild`) and `archive` only. Nothing perishable lives here — no base sha, no other author's file list, no story counts; `next` measures those every time it runs. `plan-state.sh` parses the tables below by their header row, so keep the column order.
+
+> **Why this batch.** Three moderate, general (every-space) bugs on the file path in and out of a run, all of CLAUDE.md's "a limit the actor cannot read is a trap" / "absent allows" shape: a file the agent put in `outbox/` is silently not sent while the model says "attached" (S1); an over-limit or over-quota attachment on Slack / Telegram / Discord / Teams / quoted WhatsApp is dropped with only a log line (S2); a chunked download with no `Content-Length` is buffered whole before the size check (S3). None needs a decision. S2 and S3 share `src/core/media.ts` — the S2 doc says one `/f-bug-fix` could take both; they are chained instead so each post-mortem stays about one defect.
+
+## Items
+
+| ID | Kind | Slug | Doc | Command | Round | Needs |
+|----|------|------|-----|---------|-------|-------|
+| S1 | bug | outbox-scan-drops-files-whose-mtime-predates-the-run | docs/bugs/outbox-scan-drops-files-whose-mtime-predates-the-run.md | /f-bug-fix outbox-scan-drops-files-whose-mtime-predates-the-run | 1 | — |
+| S2 | bug | url-bridges-drop-over-limit-attachments-without-a-note | docs/bugs/url-bridges-drop-over-limit-attachments-without-a-note.md | /f-bug-fix url-bridges-drop-over-limit-attachments-without-a-note | 1 | — |
+| S3 | bug | media-download-buffers-before-size-check-without-content-length | docs/bugs/media-download-buffers-before-size-check-without-content-length.md | /f-bug-fix media-download-buffers-before-size-check-without-content-length | 2 | — |
+
+> Kind ∈ `feature` | `bug` | `refactor` | `plan` (a Round 0 planning session) | `story` (from `--goal`; runs `/f-feature-dev`).
+> Needs = decision IDs from `decisions.md` that must be answered before this session may launch, or `—`.
+> IDs are never renumbered; `--drop` moves a row to Deferred, `--add` takes the next unused ID.
+
+## Edges
+
+| From | To | Kind | Basis |
+|------|----|------|-------|
+| S2 | S3 | start-after | file: src/core/media.ts (both predicted) |
+
+> Kind ∈ `start-after` (To may not launch until From is landed) | `merge-after` (To may launch now, may not land until From is landed).
+> Basis starts with `file:` (inferred from the collision map) or `semantic:` (asked) — never mixed in one row.
+> From may name a session of ANOTHER active plan as `{plan-slug}/S{n}` — always `start-after`, always `file:`; resolved at `next` time by deriving that plan's state.
+> Semantic edges asked 2026-09-28: none among these three (owner). Cross-plan: none — `sensitive-bugs-0922` S2–S5 predict `src/core/runtime.ts` and `tests/sensitive-guard-*`; `bench-patterns-0915` S11/S12 (the `scripts/absent-allows-*` and `tests/inventories/*` owners) are landed. `general-0928` predicts nothing yet; its video implementation will take a `start-after` onto S3 at its `--rebuild` (`src/adapters/whatsapp-media.ts`).
+
+## Rounds
+
+### Round 0 — unblock
+
+| Session | Action | Clears |
+|---------|--------|--------|
+| — | owner commits this plan folder before the first launch (session logs are written into it) | the `sessions/` logs have a tracked home |
+
+### Round 1
+
+| Session | Item | Predicted surfaces (count) |
+|---------|------|----------------------------|
+| S1 | outbox-scan-drops-files-whose-mtime-predates-the-run | 2 |
+| S2 | url-bridges-drop-over-limit-attachments-without-a-note | 7 |
+
+### Round 2
+
+| Session | Item | Predicted surfaces (count) |
+|---------|------|----------------------------|
+| S3 | media-download-buffers-before-size-check-without-content-length | 4 |
+
+## Collision map
+
+> Whole files, predicted; `docs/` and infrastructure paths are excluded exactly as `overlap-check.sh` excludes them (2 such paths ignored: `docs/bugs` from S2, `docs/ideas/url-download-drops-not-reported-to-agent.md` from S3). Directory-only predictions (`src/bridges`, `src/adapters`) were narrowed to the files each doc names.
+
+| File | Sessions |
+|------|----------|
+| src/core/media.ts | S2, S3 |
+
+## Predicted surfaces
+
+### S1
+
+- src/agent/container-runner.ts
+- src/core/outbox.ts
+
+### S2
+
+- src/bridges/discord.ts
+- src/bridges/slack.ts
+- src/bridges/teams.ts
+- src/bridges/telegram.ts
+- src/bridges/whatsapp.ts
+- src/core/media.ts
+- tests/inventories/host-limits.ts
+
+### S3
+
+- scripts/absent-allows-baseline.json
+- scripts/check-absent-allows.ts
+- src/adapters/whatsapp-media.ts
+- src/core/media.ts
+
+## Adjudicated overlaps
+
+> Pre-answers for the execution commands' preflight overlap prompt. Scoped to exact branch + file pairs on branches that belong to NO active plan (a hand-opened worktree, another contributor). A branch of a sibling plan's session is never listed here — it becomes a cross-plan edge instead.
+
+| Session | Branch (not in this plan) | Files | Verdict | Decided |
+|---------|---------------------------|-------|---------|---------|
+
+## Not ours
+
+> Last measurement (`git log --since=14.days`, authors not in `Me`), 2026-09-28 on `origin/dev`. Re-measured on every `next`; this table is the snapshot the briefs were written from. Nothing below intersects any session's predicted surfaces.
+
+| File / area | Author | Basis |
+|-------------|--------|-------|
+| examples/extensions/office-365-mail/, tests/office-365-mail-extension.test.ts | avishai tsabari | 14-day log, no intersection |
+| src/cli/build-context.ts, src/cli/mercury.ts, tests/build-context.test.ts, tests/container-copy-list-closure.test.ts | avishai tsabari | 14-day log, no intersection |
+| src/storage/db.ts, tests/archive-queue.test.ts, tests/shadow-snapshot.test.ts | avishai tsabari | 14-day log, no intersection |
+| package.json, bun.lock, tsconfig.examples.json | avishai tsabari / dependabot[bot] | 14-day log; lockfiles are excluded from the collision map |
+
+## Deferred
+
+| Item | Reason | Home |
+|------|--------|------|

package/docs/plans/archive/2026-10-02-media-bugs-0928/sessions/S1.md

@@ -0,0 +1,34 @@
+## Launched — 2026-09-29T15:10Z
+Branch: worktree-fix-outbox-scan-drops-files-whose-mtime-predates-the-run
+
+## Report — 2026-09-30T08:08Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner push approval — squashed to local dev as 5348136, not pushed (CLAUDE.local.md)
+Deploy needs: restart
+Files changed:
+- docs/debug/moderate/2026-09-30-outbox-scan-drops-files-whose-mtime-predates-the-run.md
+- docs/debug/outbox-scan-drops-files-whose-mtime-predates-the-run.md
+- src/agent/container-runner.ts
+- src/core/outbox.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/outbox.test.ts
+Siblings must know:
+- `scanOutbox` now returns `{ files, skipped }` (was `EgressFile[]`); new export `outboxSkipNotice(skipped)`.
+- dev carries a pre-existing red test from S2: `moderate/2026-09-29-url-bridges-drop-over-limit-attachments-without-a-note.md` has no `Gate check:` line and no row in tests/fixtures/release-gate/regression-map.json.
+- Residual (runtime.ts, owned by sensitive-bugs-0922): an after_container hook that replaces the reply (longview) drops the skip notice.
+--- final report (verbatim) ---
+~~~
+Fixed: outbox-scan-drops-files-whose-mtime-predates-the-run (moderate). Squashed to local dev as 5348136; NOT pushed.
+Files: src/core/outbox.ts, src/agent/container-runner.ts, tests/outbox.test.ts,
+tests/fixtures/release-gate/regression-map.json, post-mortem at
+docs/debug/moderate/2026-09-30-outbox-scan-drops-files-whose-mtime-predates-the-run.md.
+- Freshness is max(mtime, ctime), so cp -p / cp -a / rsync -a / mv / tar x copies are sent.
+- A fresh entry that is not sent (over 25 MB, unreadable, a link or folder) adds "(X was not sent: …)" to the reply; dotfiles are logged only.
+- lstat, never stat: links are never followed (they resolve on the host).
+- The scanOutbox suite (describe.skip since the initial release) runs again; negative-tested (mtime-only → cp -p/mv red; stat → symlink red).
+Gate: 6200 pass / 1 fail, the one fail pre-existing on dev (S2's post-mortem has no Gate check line).
+Deploy: restart only — neither file is a Dockerfile COPY source.
+ARCHITECTURE.md: no update needed.
+Residuals (in the post-mortem): longview-style reply-replacing hooks drop the notice (runtime.ts); the agent's platform intro (container-entry.ts, image-baked) names neither the size cap nor the plain-files rule.
+~~~

package/docs/plans/archive/2026-10-02-media-bugs-0928/sessions/S2.md

@@ -0,0 +1,43 @@
+## Launched — 2026-09-29T15:11Z
+Branch: worktree-fix-url-bridges-drop-over-limit-attachments-without-a-note
+
+## Report — 2026-09-30T08:01Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: restart
+Files changed:
+- docs/debug/moderate/2026-09-29-url-bridges-drop-over-limit-attachments-without-a-note.md
+- docs/debug/url-bridges-drop-over-limit-attachments-without-a-note.md
+- docs/ideas/url-download-drops-not-reported-to-agent.md
+- docs/pending-verification.md
+- src/bridges/discord.ts
+- src/bridges/slack.ts
+- src/bridges/teams.ts
+- src/bridges/telegram.ts
+- src/bridges/whatsapp.ts
+- src/core/media.ts
+- tests/bridge-limit-drops.test.ts
+- tests/inventories/host-limits.ts
+- tests/inventory-host-limits.test.ts
+Siblings must know:
+- S3: all three size checks in `downloadMediaFromUrl` (src/core/media.ts) now call `options.onSkipped({ reason: "too_large", sizeBytes, maxBytes })`. When you bound the `arrayBuffer()` read, the check that fires mid-stream must keep that call, or `tests/bridge-limit-drops.test.ts` ("buffered length over the limit") goes red.
+- S3: residual handed over: `QUOTED_DOWNLOAD_TYPES` in src/adapters/whatsapp-media.ts is private, so the WhatsApp quoted over-quota note fires even for a video or sticker that would never be downloaded. Exporting a predicate there and checking it in src/bridges/whatsapp.ts closes it.
+- Delivered is local only: f83fd59 on local `dev`, not pushed (push awaits owner approval). This session reads `delivered` until `dev` is pushed, then `landed`.
+--- final report (verbatim) ---
+~~~
+Fixed url-bridges-drop-over-limit-attachments-without-a-note, squash-merged into local dev as f83fd59 (not pushed).
+
+- src/core/media.ts: the three size checks in downloadMediaFromUrl report too_large through onSkipped.
+- src/bridges/telegram.ts: the getFile over-limit leg reports too_large; the quota branch reports quota.
+- src/bridges/slack.ts, discord.ts: the quota branch reports quota; Slack shares one attachmentUrl helper.
+- src/bridges/teams.ts: now enforces the quota (isOverQuota) and reports it.
+- src/bridges/whatsapp.ts: the quoted-media quota branch reports quota (once per message).
+- tests/bridge-limit-drops.test.ts: new; negative-tested per file.
+- tests/inventories/host-limits.ts + inventory test: maxDiskMb / mediaMaxSizeMb name their reader; no none readers remain.
+- Post-mortem: docs/debug/moderate/2026-09-29-url-bridges-drop-over-limit-attachments-without-a-note.md
+- Gate on the branch: 16/16 links, 6163 pass / 9 skip / 0 fail; affected tests on dev after squash: 126 pass / 0 fail.
+- ARCHITECTURE.md: no update needed.
+- Deploy: restart only (no baked file). MANUAL-VERIFY under "## Plan media-bugs-0928 / S2".
+- Residuals: WhatsApp quoted video/sticker over quota gets a quota note (needs S3's file); download_failed still silent (docs/ideas/url-download-drops-not-reported-to-agent.md).
+~~~

package/docs/plans/archive/2026-10-02-media-bugs-0928/sessions/S3.md

@@ -0,0 +1,35 @@
+## Launched — 2026-09-30T08:46Z
+Branch: worktree-fix-media-download-buffers-before-size-check-without-content-length
+
+## Report — 2026-09-30T09:09Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: restart
+Files changed:
+- docs/bugs/whatsapp-media-download-buffers-before-size-check-without-file-length.md
+- docs/debug/media-download-buffers-before-size-check-without-content-length.md
+- docs/debug/moderate/2026-09-30-media-download-buffers-before-size-check-without-content-length.md
+- scripts/absent-allows-baseline.json
+- src/core/media.ts
+- tests/bridge-limit-drops.test.ts
+- tests/inventories/host-limits.ts
+- tests/media.test.ts
+Siblings must know:
+- `downloadMediaFromUrl` (src/core/media.ts) now reads through the exported `readBodyCapped(response, maxBytes)`. A drop that stops mid-stream calls `onSkipped({ reason: "too_large", maxBytes })` with NO `sizeBytes`, because the real size is unknown, so the note reads "unknown size, limit X".
+- Bun's fetch has no backpressure. A body reader that stops without `cancel()` keeps buffering (measured ~1 GB for a 512 MB body). Any other capped read must cancel explicitly.
+- The absent-allows ratchet DOES count src/adapters/whatsapp-media.ts (baseline 2); the brief's "skips src/adapters/" was wrong. That twin is filed as docs/bugs/whatsapp-media-download-buffers-before-size-check-without-file-length.md.
+- Owner-approved edit to S2's tests/inventories/host-limits.ts: the mediaMaxSizeMb needle is now `if (total > maxBytes) {`.
+- Delivered is local only: 61f9fb7 on local `dev`, not pushed (push awaits owner approval).
+--- final report (verbatim) ---
+~~~
+Fixed: URL media download buffered the whole body when Content-Length was absent.
+Commit 61f9fb7 on local dev (not pushed). Gate in worktree: bun run check 16/16 links, 6206 pass / 0 fail.
+Files: src/core/media.ts (readBodyCapped, streamed + cancel() past cap; declared sizes kept as early exits whose absence falls through),
+scripts/absent-allows-baseline.json (media.ts row removed, 2 -> 0), tests/media.test.ts (unit + end-to-end chunked tests, negative-tested twice),
+tests/bridge-limit-drops.test.ts (no sizeBytes on a mid-stream drop), tests/inventories/host-limits.ts (needle, owner-approved),
+docs/bugs/whatsapp-media-download-buffers-before-size-check-without-file-length.md (residual).
+Post-mortem: docs/debug/moderate/2026-09-30-media-download-buffers-before-size-check-without-content-length.md
+ARCHITECTURE.md: no change needed.
+Deviation from /f-bug-fix: promotion and squash commits kept local per CLAUDE.local.md (no push without approval).
+~~~

package/docs/plans/{sensitive-bugs-0922 → archive/2026-10-02-sensitive-bugs-0922}/plan.md

@@ -1,7 +1,7 @@
 # Plan: sensitive-bugs-0922
 
-**Status**: Active
-**Created**: 2026-09-22   **Last updated**: 2026-09-22
+**Status**: Archived
+**Created**: 2026-09-22   **Last updated**: 2026-10-02
 **Landing mode**: pr
 **Max width**: 4
 **Inputs**: sensitive-bugs-0922 sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata sensitive-guard-replay-loses-the-dropped-attachment-note sensitive-gate-is-checked-before-the-space-queue scheduled-run-skipped-by-sensitive-deny-has-no-reader sensitive-guard-axis-coverage-gaps (the four bugs bench-patterns-0915 S6 filed, plus the open drop-note bug; split out of the p0-plan-0922 rebuild)

package/docs/plans/archive/2026-10-02-sensitive-bugs-0922/sessions/S1.md

@@ -0,0 +1,35 @@
+## Launched — 2026-09-28T11:50Z
+Branch: worktree-fix-sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata
+
+## Report — 2026-09-28T12:18Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: restart
+Files changed:
+- docs/bugs/sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata.md
+- docs/debug/moderate/2026-09-28-sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata.md
+- src/core/runtime.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/inventories/guard-axes.ts
+- tests/sensitive-guard-replay.test.ts
+Siblings must know:
+- `PendingSensitiveEntry` (src/core/runtime.ts) now = { prompt, at, attachments?, replyMeta?: PendingReplyMeta, replyFlags?: PendingReplyFlags }. S2 adds `droppedAttachments?` as one more optional field, with one more refuse-whole block in `readPendingSensitive`.
+- `checkSensitiveConnectionGuard(spaceId, prompt, callerId, audience, turn)` — `turn` is { attachments, replyMeta, replyFlags } (required). The `yes` arm returns `{ action: "proceed", replay: PendingSensitiveEntry }`; `replayPrompt` / `replayAttachments` are gone. handleRawInput reads `replay.*`.
+- Absent fields on a stored row are ABSENT on replay, never borrowed from the `yes`; absent `replyFlags` fails closed (isReplyToBot true). A row with `replyMeta` but no `replyFlags` is refused.
+- tests/inventories/guard-axes.ts: replay-meta × L1 is now `lit` citing tests/sensitive-guard-replay.test.ts, L2 `shared` with L1; the B2 const was removed. Each sibling rewrites its own cells there when its bug archives.
+- Squash is on LOCAL dev only (0d5720b), not pushed — plan-state reads landed only once it reaches origin/dev.
+--- final report (verbatim) ---
+~~~
+Fixed: sensitive-guard-replay-runs-with-the-yes-messages-reply-metadata (moderate).
+Squash commit 0d5720b on local dev (not pushed; push awaits owner approval).
+Files: src/core/runtime.ts, tests/sensitive-guard-replay.test.ts, tests/inventories/guard-axes.ts,
+tests/fixtures/release-gate/regression-map.json, bug doc -> docs/debug/moderate/2026-09-28-….md.
+The pending entry stores the blocked turn's replyMeta + replyFlags; the yes replays the entry whole.
+Absent flags fail closed (isolating); malformed fields refuse the row whole.
+Gate: bun run check — 16/16 links pass, 6124 pass / 0 fail. Negative controls: yes-metadata swap -> 5 red;
+absent-flags default false -> 2 red.
+Deviation: promotion commit on dev was refused by the auto-mode classifier (another session's staged
+work in the shared index); the bug-doc move rode the fix branch instead.
+Deploy needs: restart (runtime.ts not baked; no version change).
+~~~

package/docs/plans/archive/2026-10-02-sensitive-bugs-0922/sessions/S2.md

@@ -0,0 +1,30 @@
+## Launched — 2026-09-29T15:12Z
+Branch: worktree-fix-sensitive-guard-replay-loses-the-dropped-attachment-note
+
+## Report — 2026-09-30T08:10Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner approval to push dev (8161c5f and promotion a7a704a are local only)
+Deploy needs: restart
+Files changed:
+- src/core/runtime.ts
+- tests/sensitive-guard-replay-drop-note.test.ts
+- tests/inventories/guard-axes.ts
+- tests/fixtures/release-gate/regression-map.json
+- docs/debug/minor/2026-09-29-sensitive-guard-replay-loses-the-dropped-attachment-note.md
+Siblings must know:
+- PendingSensitiveEntry gains optional droppedAttachments (DroppedAttachment[]), read by readDroppedAttachments (refuse-whole; reason set derived from the union via Record<DroppedAttachment["reason"], true>)
+- the guard's `turn` argument now requires droppedAttachments; the writer stores it only when non-empty and only if the reader accepts it
+- dropNote in handleRawInput is now built AFTER the guard (replay list + the current message's own)
+- guard-axes L1 attachments cell is `lit`, citing the replay and replay-drop-note tests
+- gate on dev @ 8161c5f: 15/16 links; the one test red is inherited from f83fd59 — moderate/2026-09-29-url-bridges-drop-over-limit-attachments-without-a-note.md has no regression-map row
+--- final report (verbatim) ---
+~~~
+S2 sensitive-guard-replay-loses-the-dropped-attachment-note — fixed, squash-merged to local dev as 8161c5f (not pushed).
+Fix: the blocked turn's dropped-attachment list is stored with the pending entry (validated both ways, refuse-whole) and the replay's note is built after the guard from that list plus the yes's own. Pre-fix rows replay with no note.
+Tests: tests/sensitive-guard-replay-drop-note.test.ts, 15 tests, 4 negative controls red when the fix is removed.
+Gate: 15/16 PASS; test 6179 pass / 1 fail — inherited regression-map gap for the url-bridges post-mortem (f83fd59).
+Post-mortem: docs/debug/minor/2026-09-29-sensitive-guard-replay-loses-the-dropped-attachment-note.md
+Deploy: restart only (runtime.ts is not baked; no version change).
+Push: awaiting owner approval.
+~~~

package/docs/plans/archive/2026-10-02-sensitive-bugs-0922/sessions/S3.md

@@ -0,0 +1,39 @@
+## Launched — 2026-09-30T08:46Z
+Branch: worktree-fix-sensitive-gate-is-checked-before-the-space-queue
+
+## Report — 2026-09-30T09:06Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner approval to push dev (85e408b promotion and c7760d8 fix are local only)
+Deploy needs: restart
+Files changed:
+- docs/bugs/sensitive-gate-that-appears-while-a-turn-waits-is-never-confirmed.md
+- docs/debug/moderate/2026-09-30-sensitive-gate-is-checked-before-the-space-queue.md
+- docs/debug/sensitive-gate-is-checked-before-the-space-queue.md
+- docs/pending-verification.md
+- src/core/runtime.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/inventories/guard-axes.ts
+- tests/inventory-guard-axes.test.ts
+- tests/sensitive-guard-audience.test.ts
+- tests/sensitive-guard-replay-drop-note.test.ts
+- tests/sensitive-guard-replay.test.ts
+Siblings must know:
+- executePrompt(spaceId, prompt, source, callerId, admission, attachments?, …): new REQUIRED 5th arg `admission: SensitiveAdmission` ({kind:"policy"} | {kind:"consent", consentKey, admittedAt}); any positional executePrompt mock must add an `_admission` param (replay + drop-note mocks already do)
+- executePrompt now returns ContainerResult | SensitiveDequeueDenial ({sensitiveDenied: string}); narrow with isSensitiveDequeueDenial()
+- the dequeue hook is recheckSensitiveAtDequeue(spaceId, callerId, admission), first statement of executePrompt's queue.enqueue callback: this is where the deferred `sensitive-opt-out-should-deny-not-block` idea hooks the policy half at use time
+- S4 (scheduled-run-skipped-by-sensitive-deny-has-no-reader): there are now TWO scheduler skip sites, both logger.warn only: the pre-queue gate ("Scheduled task skipped: sensitive connections are not enabled…") and the dequeue skip ("Scheduled task skipped at dequeue: …"); both return undefined. Give both the same reader.
+- guard-axes: check-use is lit on L1/L3 (audience suite), shared on L2; the anti-vacuity pin in tests/inventory-guard-axes.test.ts now pins B3's L3 skip-visibility cell, so S4 must move it again when B3 closes
+- new open bug filed: docs/bugs/sensitive-gate-that-appears-while-a-turn-waits-is-never-confirmed.md (minor; an ungated admission whose gate appears in the queue is never asked for consent)
+--- final report (verbatim) ---
+~~~
+S3 sensitive-gate-is-checked-before-the-space-queue: fixed, squash-merged to local dev as c7760d8 (not pushed; promotion 85e408b also local).
+Fix: the guard and the scheduler pass what admitted the turn (policy, or consent key + admittedAt) to executePrompt as a literal. recheckSensitiveAtDequeue re-asks policy (and consent, for consent admissions) as the first step of the queue callback. Interactive turns get the existing disabled/cancelled text; scheduled runs are skipped like the pre-queue gate; nothing re-warns.
+Tests: 8 new in tests/sensitive-guard-audience.test.ts (queue held by a blocker). Removing the re-check turns 5 red; reading the TTL at Date.now turns the age-out test red.
+Scope growth: replay and drop-note test mocks gained an _admission param (replay.test.ts was Do-not-touch; owner approved in-session). guard-axes inventory and its test updated.
+Gate: bun run check 16/16 links, 6210 pass / 0 fail.
+Post-mortem: docs/debug/moderate/2026-09-30-sensitive-gate-is-checked-before-the-space-queue.md
+Residual filed: docs/bugs/sensitive-gate-that-appears-while-a-turn-waits-is-never-confirmed.md
+Deploy: restart only (release-gate §1 class code; no baked file, no version change).
+Push: awaiting owner approval.
+~~~

package/docs/plans/archive/2026-10-02-sensitive-bugs-0922/sessions/S4.md

@@ -0,0 +1,38 @@
+## Launched — 2026-09-30T14:29Z
+Branch: worktree-fix-scheduled-run-skipped-by-sensitive-deny-has-no-reader
+
+## Report — 2026-10-01T14:00Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner approval to push dev (40c4d2e promotion and 8d7b6d3 fix are local only)
+Deploy needs: restart
+Files changed:
+- docs/debug/minor/2026-09-30-scheduled-run-skipped-by-sensitive-deny-has-no-reader.md
+- docs/debug/scheduled-run-skipped-by-sensitive-deny-has-no-reader.md
+- docs/pending-verification.md
+- src/core/operator-alerts.ts
+- src/core/runtime.ts
+- src/core/system-messages.ts
+- tests/connection-health.test.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/inventories/guard-axes.ts
+- tests/inventory-guard-axes.test.ts
+- tests/operator-alerts.test.ts
+- tests/pi-auth.test.ts
+- tests/scheduler-missed-runs.test.ts
+- tests/sensitive-guard-audience.test.ts
+Siblings must know:
+- CredentialAlertSink has a new required method taskBlocked(alert: TaskBlockedAlert); every fake sink must add it (pi-auth, connection-health, scheduler-missed-runs, sensitive-guard-audience already do)
+- the audience suite's createRuntime now sets taskNotifyOnFailure: true and afterEach unregisters the alert sink; captureBlockedAlerts() records taskBlocked and throws on taskFailed
+- guard-axes: L3 skip-visibility is now lit (audience + operator-alerts suites); the anti-vacuity pin moved to B4's relink cells on L1 and L3. S5 must move it again when B4 closes
+- residual (recorded in the post-mortem, not filed): one notice per skip with no cooldown, so a short-cron task in a blocked group DMs the operator every run
+--- final report (verbatim) ---
+~~~
+S4 scheduled-run-skipped-by-sensitive-deny-has-no-reader: fixed, squash-merged to local dev as 8d7b6d3 (not pushed; promotion 40c4d2e also local).
+Fix: new operator-alert kind taskBlocked (src/core/operator-alerts.ts, message alert_task_blocked_sensitive in en/he: "skipped, not failed"). runtime.announceTaskBlocked(task, stage) is called from both scheduler skip sites, the pre-queue gate and the dequeue re-check. They are mutually exclusive, so one skip gives one notice, ▶ included. Honours scheduling.notify_on_failure. Goes to operators only, never the space.
+Tests: audience suite has gate/dequeue exactly-one, plus enabled, unchanged-queue and notify-off negative controls; operator-alerts has the text and the alerts-off case. Deleting either call site turns its test red.
+Gate: bun run check 16/16 links, 6274 pass / 0 fail.
+Post-mortem: docs/debug/minor/2026-09-30-scheduled-run-skipped-by-sensitive-deny-has-no-reader.md
+Deploy: restart only (release-gate §1 class code; no baked file, no version change).
+Push: awaiting owner approval.
+~~~

package/docs/plans/archive/2026-10-02-sensitive-bugs-0922/sessions/S5.md

@@ -0,0 +1,37 @@
+## Launched — 2026-10-02T18:28Z
+Branch: worktree-fix-sensitive-guard-axis-coverage-gaps
+
+## Report — 2026-10-02T18:47Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/debug/minor/2026-10-02-sensitive-guard-axis-coverage-gaps.md
+- docs/debug/sensitive-guard-axis-coverage-gaps.md
+- src/core/runtime.ts
+- tests/inventories/guard-axes.ts
+- tests/inventory-guard-axes.test.ts
+- tests/sensitive-guard-audience.test.ts
+- tests/sensitive-guard-scope.test.ts
+Siblings must know:
+- tests/inventories/guard-axes.ts has no `none` cell left; a new guard gap needs a filed bug and a `none` cell citing it
+--- final report (verbatim) ---
+~~~
+Fixed: sensitive-guard-axis-coverage-gaps (minor; tests and comments only).
+Squashed into LOCAL dev as 8475267. NOT pushed, by owner instruction ("archive
+and squash-merge locally"). Lands when dev is pushed.
+
+- relink x L1 / L3, /chat route x L2 (caller, conversation, origin), principal x L3:
+  each a test with a negative control, each mutation-tested red.
+- cell 3 (manual trigger x L3) was already closed on dev; no duplicate added.
+- tests/inventories/guard-axes.ts: six B4 cells rewritten to `lit` with tests;
+  the closure pin replaced by a closed-cells pin.
+- src/core/runtime.ts: four comments name the console's
+  PUT /api/console/spaces/:id/config as the out-of-band writer (comment-only diff).
+- Post-mortem: docs/debug/minor/2026-10-02-sensitive-guard-axis-coverage-gaps.md
+- Gate: bun run check, 16/16 links, 6393 pass / 0 fail.
+- Claim commit 74041b8 (docs-only) was pushed to origin/dev from a scratch
+  worktree under the claim-push exception.
+- Deploy: none (no behaviour change; nothing baked).
+~~~

package/docs/plans/general-0928/briefs/S1.md

@@ -0,0 +1,66 @@
+# Brief S1 — video understanding — a global extension that watches and listens
+
+**Plan**: docs/plans/general-0928/plan.md   **Session**: S1   **Round**: 0   **Kind**: plan
+**Item slug**: video-understanding-extension
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work general-0928 S1
+
+## Run
+
+/f-feature-planning video-understanding-extension
+
+## Scope notes
+
+Plan the Goal + Architecture into `docs/backlog/video-understanding-extension.md` under **Q2**, and settle every open question in the idea with the owner (hook vs skill, where the frame leg runs, the free-tier warning, the quoted-video cap, the `voice-transcribe` factoring, who owns `yt-dlp`, on-demand `mrctl media fetch`, video listings).
+
+**Q2 shapes the architecture — three legs, one result:**
+- **Default leg (always available, no key):** ffmpeg samples frames (contact sheets with burned-in timestamps) and they go to the space's **configured model leg**. If that is a host-side or nested call it must follow CLAUDE.md's pi-spawn rule (own the whole system prompt, the space's own leg, a row in `tests/inventories/pi-spawns.ts`) and the single-thread rule (a bound and a log line). Subscription OAuth only — never an Anthropic API key (owner rule).
+- **Optional video leg:** a **global** key for a native-video model (Gemini). Configured → it runs too.
+- **Optional audio leg:** a **global** STT key (reuse `voice-transcribe`'s providers, do not fork them).
+- **Consolidation:** when more than one leg ran, one `[Video]` block merges them; each leg that failed or was not configured is named, so "I could not process the video" is a real sentence. Decide whether the legs run in parallel and how the merge is done (host-side text merge vs one consolidating model call).
+
+It is a **general** extension (every space), not a flat-search feature. The flat profile's "you cannot watch videos" paragraph is revised as part of it, but the flat space is on hold, so that edit is low-priority. Accept S2's `is_video` + stream URL as an input (merge-after S2).
+
+## Owned surfaces (predicted)
+
+- none yet — this session writes `docs/backlog/video-understanding-extension.md` (promoted from `docs/ideas/video-understanding-extension.md`); its Architecture is what `--rebuild` will measure.
+
+## Do not touch
+
+- the other four ideas of this plan and their backlog docs (owned by their own planning sessions this plan)
+- `src/`, `tests/`, `examples/` — a planning session writes no code
+- Not ours: see plan.md "Not ours" (nothing intersects). Re-check with `/f-ops-plan next general-0928`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: land only after S2 is landed. Check with `/f-ops-plan next general-0928` before approving the doc.
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q2: default = frames to the space's configured model; optional global video/audio keys add legs, consolidated into one result (owner, 2026-09-28).
+
+## Ledger rules
+
+> Kind `plan`: you share the primary checkout with sibling planning sessions — touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine; run no git write command at all (`add`, `commit`, `stash`, `checkout`, `pull`) — `next` hands the owner one commit line for Round 0.
+
+- `docs/pending-verification.md`: a planning session adds no lines.
+- Any goal's `decisions.md`: never edit; put decisions in your item's own doc.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas, and `docs/profile-guide.md` / `docs/behavior-layers.md` / `docs/skills-guide.md` if the design adds a skill or a profile rule. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step — `/f-ops-plan work` backfills `docs/plans/general-0928/sessions/S1.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`): `delivered` once the backlog doc predicts surfaces, else `blocked` with the open question.

package/docs/plans/general-0928/briefs/S2.md

@@ -0,0 +1,64 @@
+# Brief S2 — marketplace / social listing reader
+
+**Plan**: docs/plans/general-0928/plan.md   **Session**: S2   **Round**: 0   **Kind**: plan
+**Item slug**: marketplace-listing-reader
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work general-0928 S2
+
+## Run
+
+/f-feature-planning marketplace-listing-reader
+
+## Scope notes
+
+Plan **first** in this plan — S1, S4 and S5 build against the contract you write. Goal + Architecture into `docs/backlog/marketplace-listing-reader.md`, under **Q1**.
+
+**Q1 shapes the architecture:** the default path reads **public** data only (Facebook `og:*` + JSON-LD via the crawler UA, yad2 page JSON, a generic OpenGraph / JSON-LD / schema.org fallback) and must be decent on its own — the fix for `docs/bugs/facebook-listing-read-drops-data-the-page-already-carries.md` (a price in `og:description` reported as "no price"; a video listing read as "ILS"). Leave a **named seam** where an optional per-space logged-in session (S5) plugs in later to fill gated fields (more photos, phone behind a click); `missing[]` must say "behind login" for exactly those fields, so the upgrade is visible.
+
+**Scope the owner asked about, 2026-09-28:** "improvement in interaction with Facebook and social media in general". Decide with the owner whether the capability is a *listing* reader or a general **social-link reader** (a Facebook post / group post / page, an Instagram or X link: author, text, time, media, `is_video`) with a listing as one record type. The feed-watch social-sources goal (`docs/goals/feed-watch-social-sources/`, incl. `blocked-sources-research.md`) is prior art for what each platform serves without a login — read it; do not re-probe what it already measured.
+
+Return `is_video` + the stream URL for S1. Record the contract precisely — three sibling planning sessions read it.
+
+## Owned surfaces (predicted)
+
+- none yet — this session writes `docs/backlog/marketplace-listing-reader.md` (promoted from `docs/ideas/marketplace-listing-reader.md`); its Architecture is what `--rebuild` will measure.
+
+## Do not touch
+
+- the other four ideas of this plan and their backlog docs (owned by their own planning sessions this plan)
+- `src/`, `tests/`, `examples/` — a planning session writes no code
+- Not ours: see plan.md "Not ours" (nothing intersects). Re-check with `/f-ops-plan next general-0928`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- Q1: public-data default that is decent alone; optional per-space login upgrades it (owner, 2026-09-28).
+
+## Ledger rules
+
+> Kind `plan`: you share the primary checkout with sibling planning sessions — touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine; run no git write command at all (`add`, `commit`, `stash`, `checkout`, `pull`) — `next` hands the owner one commit line for Round 0.
+
+- `docs/pending-verification.md`: a planning session adds no lines.
+- Any goal's `decisions.md`: never edit; put decisions in your item's own doc.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas, and `docs/profile-guide.md` / `docs/behavior-layers.md` / `docs/skills-guide.md` if the design adds a skill or a profile rule. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step — `/f-ops-plan work` backfills `docs/plans/general-0928/sessions/S2.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`): `delivered` once the backlog doc predicts surfaces, else `blocked` with the open question.

package/docs/plans/general-0928/briefs/S3.md

@@ -0,0 +1,58 @@
+# Brief S3 — WhatsApp outbound queue survives a restart
+
+**Plan**: docs/plans/general-0928/plan.md   **Session**: S3   **Round**: 0   **Kind**: plan
+**Item slug**: whatsapp-outbound-queue-survives-restart
+
+> The only file this session reads from the plan. Self-contained: it never points at a sibling's brief. The `**Item slug**:` line is the key the execution commands grep for to detect that a brief is active — keep it exactly in that shape.
+
+## Launch
+
+/f-ops-plan work general-0928 S3
+
+## Run
+
+/f-feature-planning whatsapp-outbound-queue-survives-restart
+
+## Scope notes
+
+Goal + Architecture into `docs/backlog/whatsapp-outbound-queue-survives-restart.md`. The named residual of `orphaned-run-recovery` (archived 2026-09-25): a send queued while the socket is down returns a synthetic `queued-…` id, the journal row closes, and a restart loses the text. Settle the idea's open question (a typed "queued, not delivered" return vs the id's shape) and apply CLAUDE.md's gotcha "a flag sampled before an `await` is a guard, not a handler" and "any early return between an irreversible step and its persist loses whatever that step consumed". Independent of S1/S2/S4/S5 — no edges.
+
+## Owned surfaces (predicted)
+
+- none yet — this session writes `docs/backlog/whatsapp-outbound-queue-survives-restart.md` (promoted from `docs/ideas/whatsapp-outbound-queue-survives-restart.md`); its Architecture is what `--rebuild` will measure.
+
+## Do not touch
+
+- the other four ideas of this plan and their backlog docs (owned by their own planning sessions this plan)
+- `src/`, `tests/`, `examples/` — a planning session writes no code
+- Not ours: see plan.md "Not ours" (nothing intersects). Re-check with `/f-ops-plan next general-0928`.
+
+## Edges
+
+- start-after: none   (satisfied — `next` launched you)
+- merge-after: none
+
+## Overlap verdicts
+
+none
+
+> The command's preflight overlap check treats a hit whose branch AND every shared file match a verdict line as answered (c), prints one `PLAN-PASSED(overlap): …` line, and carries it into the final report. Any other hit prompts as usual. The merge-time check is never waived.
+
+## Decisions answered
+
+- none
+
+## Ledger rules
+
+> Kind `plan`: you share the primary checkout with sibling planning sessions — touch only your item's doc and the idea it promotes; `/f-feature-planning`'s ROADMAP row is fine; run no git write command at all (`add`, `commit`, `stash`, `checkout`, `pull`) — `next` hands the owner one commit line for Round 0.
+
+- `docs/pending-verification.md`: a planning session adds no lines.
+- Any goal's `decisions.md`: never edit; put decisions in your item's own doc.
+
+## Environment
+
+- Read `CLAUDE.md` → Gotchas, and `docs/profile-guide.md` / `docs/behavior-layers.md` / `docs/skills-guide.md` if the design adds a skill or a profile rule. Nothing from them is copied here.
+
+## Report
+
+`/f-feature-planning` has no report step — `/f-ops-plan work` backfills `docs/plans/general-0928/sessions/S3.md` (path resolved through `.claude/scripts/resolve-docs-root.sh docs/plans/probe.md`): `delivered` once the backlog doc predicts surfaces, else `blocked` with the open question.