mercury-agent 0.24.2 → 0.24.3-beta.1

package/docs/goals/space-links/decisions.md

@@ -441,3 +441,48 @@
   without running a command (guessing), or picking the wrong space. The next
   step is a skill with worked examples.
 - **Used by:** act-as-linked-space, messages-recent-range, link-ask-as-space
+
+## D-018: A link's `note` is the global admin's alone; everything else about an edge stays visible to the spaces it touches
+- **Category:** architecture
+- **Decided:**
+  - `note` is returned only to a global admin: in `list`, `inspect` and the
+    create/update/revoke responses, and inside audit rows' `detail`
+    (`before` / `after`). For anyone else it is `null` on the edge and absent
+    from the audit, whether or not one is set. This holds on every edge, not
+    only on `*` edges, and the holder's admin does not see it either.
+  - Unchanged, and still shown to every admin of a space the edge touches
+    (holder, target, or any space a `*` edge reaches): holder and target,
+    level, `disclosure`, who created or changed it and when, and its audit
+    history.
+- **Alternatives considered:**
+  - The full record for every space an edge touches (as M1.2 first shipped).
+    Rejected: a `*` edge is read by every space's admin, so a note written as
+    an operator's remark ("client X trial ends in Nov") would reach every
+    client at once, and the audit keeps old notes, so it cannot be taken back.
+  - A `*` edge visible to other spaces only as inbound reach, with no record
+    (the spec's most literal reading). Rejected: it also hides `disclosure`,
+    which D-007 addresses to the target side, and the history that makes a
+    link accountable (D-006).
+- **Reasoning:** Each free-text field has one audience, enforced in code rather
+  than by the operator remembering who reads it. `disclosure` is what the
+  target was told, so the target reads it; `note` is the operator's.
+- **Open:** `createdBy` / `updatedBy` / the audit's `actorId` still show the
+  global admin's raw platform id to other spaces' admins. Showing a label
+  instead was offered and not chosen on 2026-10-05.
+- **Revisit if:** a deployment wants notes shared with a target; that text
+  belongs in `disclosure`.
+- **Used by:** mrctl-links-admin-commands, act-as-linked-space
+
+## D-019: An act-as audit row records the space actually acted on, never `*`
+- **Category:** architecture
+- **Decided:**
+  - When M1.3 writes the per-request audit row (D-008) for a request granted by
+    a `*` edge, `target_space_id` is the space the request acted on. `*` stays
+    only on the create/update/revoke rows of the edge itself.
+  - M1.3 carries a test: a request through `mgmt → *` into C is not in B's
+    `mrctl links audit`.
+- **Reasoning:** `GET /api/links/audit` shows a space's admin every row whose
+  target is `*` (the reading that lets every space see a wildcard's lifecycle,
+  D-013). An act-as row stamped `*` would show management's requests into every
+  space, route and body summary included, to every other space's admin.
+- **Used by:** act-as-linked-space

package/docs/goals/space-links/roadmap.md

@@ -24,8 +24,8 @@
 | ID | Story | Slug | Depends on | Status |
 |----|-------|------|------------|--------|
 | M1.1 | Link table (incl. `*` target), levels, direct-edge resolver, audit table | space-link-graph-and-grant-resolver | — | done |
-| M1.2 | `mrctl links list/inspect/create/update/revoke/audit` + `/api/links` routes | mrctl-links-admin-commands | M1.1 | blocked |
-| M1.3 | `mrctl --space <target>`: act-as middleware over the existing routes, audit, on-demand paragraph | act-as-linked-space | M1.1, M1.2 | blocked |
+| M1.2 | `mrctl links list/inspect/create/update/revoke/audit` + `/api/links` routes | mrctl-links-admin-commands | M1.1 | done |
+| M1.3 | `mrctl --space <target>`: act-as middleware over the existing routes, audit, on-demand paragraph | act-as-linked-space | M1.1, M1.2 | launchable |
 | M1.4 | `mrctl messages recent --since 24h`: time-range history read, paged | messages-recent-range | — | backlog |
 
 **Checkpoint:** on the Tagula bot (Hetzner), where the management space and the

package/docs/pending-verification.md

@@ -2284,6 +2284,20 @@ The review of the seven 2026-10-02 fixes landed follow-ups on `dev`. Three baked
 - [ ] MANUAL-VERIFY(2026-10-03): Same image rebuild as above (`container-entry.ts` changed again): `docker run --rm --entrypoint sh <derived mercury-agent-ext tag> -c 'grep -c -F "if (err.kind === \"max-tokens\") kind = \"max-tokens\"" /app/src/agent/container-entry.ts'` prints 1. Then the next length-stopped scheduled run on a multi-leg chain logs `Scheduled task not retried: max-tokens runaway` even though its error text starts `Model chain budget exceeded`. *(Verified 2026-10-03 on the WSL box, dev `7baf73d`, base `mercury-agent:latest` = `09fc7e661586`, derived `mercury-agent-ext:3947692c9434` (built 13:21:31 IDT, 438 s), restart 13:14:10 IDT. Live turns through `/chat` in `main` as `api:verify-20261003`, whose seeded admin row was deleted afterwards: first half verified: the grep prints `1` on `mercury-agent-ext:3947692c9434`. The length-stopped-run half is still open.)*
 - [x] MANUAL-VERIFY(2026-10-03): After the restart, `grep -c -F 'PRICE_ROUTING_PROMPT' ~/whatsapp-bot/.mercury/extensions/web-search/index.ts` prints a non-zero count (a keyless box keeps the Zap price pointer). *(Verified 2026-10-03 on the WSL box, dev `7baf73d`, base `mercury-agent:latest` = `09fc7e661586`, derived `mercury-agent-ext:3947692c9434` (built 13:21:31 IDT, 438 s), restart 13:14:10 IDT. Live turns through `/chat` in `main` as `api:verify-20261003`, whose seeded admin row was deleted afterwards: count `3`.)*
 
+## Plan unattended-1003 / S6
+
+The WhatsApp media download now closes its socket when a bound fires, through a Baileys patch (`patches/`). *(Superseded 2026-10-07: the patch never reached npm-installed hosts, so it was removed and the media `fetch` is now owned by `fetchDecryptedMedia` — `docs/debug/moderate/2026-10-07-baileys-patch-never-reaches-an-npm-installed-host.md`. The greps below for `signal: options.signal` in `node_modules` now print 0 by design.)* Host-only, nothing baked: a **sync** (which runs `bun install` because `package.json` and `bun.lock` changed) **and a restart**. No image rebuild.
+
+- [x] *(Verified 2026-10-05 on the WSL box, dev `6ddb895`, base `mercury-agent:0.24.2-beta.2` = `63637858e06b`, derived `mercury-agent-ext:b2acae430168` (built 13:36:22 IDT, 482 s), restart 13:28:17 IDT: the sync ran `bun install` and the grep prints `1`.)* MANUAL-VERIFY(2026-10-04): After the sync, `grep -c -F "signal: options.signal" ~/mercury-src/node_modules/@whiskeysockets/baileys/lib/Utils/messages-media.js` prints 1. A 0 means `bun install` did not run or did not apply the patch, and the fix is not deployed even though the code is.
+- [x] *(Verified 2026-10-05 on the WSL box, dev `6ddb895`, base `mercury-agent:0.24.2-beta.2` = `63637858e06b`, derived `mercury-agent-ext:b2acae430168` (built 13:36:22 IDT, 482 s), restart 13:28:17 IDT. Rehearsed, not waited for: the deployed `downloadWhatsAppMedia` from `~/mercury-src`, with production bounds and its patched `node_modules`, against a local raw-TCP server. Open stall: `bound fired while opening` at 30.0 s, `download_failed` to `onSkipped`, server saw the socket close 2 ms later. Body stall after 64 KB: `read bound fired` (idle) at 30.0 s, `download_failed`, socket closed 1 ms later. The live-journal half is still worth a glance the next time a real download stalls.)* MANUAL-VERIFY(2026-10-04): The next time the journal shows `WhatsApp media read bound fired` or `bound fired while opening`, `ss -tnp | grep -c <bun pid>` taken a few seconds later shows no connection to the WhatsApp media host left open for that download, and the user was told the file could not be downloaded.
+- [x] *(Verified 2026-10-05: `docker build -f Dockerfile.host` from `~/mercury-src` at `6ddb895` exited 0, `COPY patches/` ran before `bun install --production`, and the built image's `node_modules/@whiskeysockets/baileys/lib/Utils/messages-media.js` has `signal: options.signal` (1). Throwaway tag removed.)* MANUAL-VERIFY(2026-10-04): If any box builds `Dockerfile.host`, its next build passes the `bun install --production` step (it now copies `patches/` first; without it the install fails with `Couldn't find patch file`).
+
+## baileys-patch-never-reaches-an-npm-installed-host (2026-10-07)
+
+The media download fetches and decrypts itself instead of through a patched Baileys. Host-only: a sync (`bun install`, since `package.json` and `bun.lock` changed) and a restart; no image rebuild.
+
+- [ ] MANUAL-VERIFY(2026-10-07): After deploying, send the bot a photo, a voice note and a PDF in a group it answers in, and confirm it describes each one — real WhatsApp media must decrypt through the new path, which the tests only exercise with media they encrypted themselves.
+
 ## Plan unattended-1003 / S7
 
 `pinchtab_nav` and the session injector now ship as files in the pinchtab extension's `bin/`. They reach the box through the installed snapshot, which is refreshed on restart, and from there into the **derived** image, whose hash includes the bin files. So this is a restart, then wait for the journal's `Built derived agent image` line. No base rebuild.
@@ -2318,3 +2332,25 @@ A refused credential now falls back to the next model leg and still alerts the o
 
 - [x] *(Verified 2026-10-04 in derived `mercury-agent-ext:b2c39b0f2f05`: 1, then 7.)* MANUAL-VERIFY(2026-10-03): After the rebuild and the `Built derived agent image` line, `docker run --rm --entrypoint sh <derived mercury-agent-ext tag> -c 'grep -c -F "refused.push(leg)" /app/src/agent/container-entry.ts; grep -c -F "return \"fallbackable\"" /app/src/agent/pi-failure-class.ts'` prints 1, then a count of at least 7.
 - [x] *(Verified 2026-10-04 on a shadow (live spaces are all pinned, so no live run can reach a second leg): leg 1 `groq` with an invalid `MERCURY_GROQ_API_KEY`, leg 2 Opus, `main` unpinned. The user got an answer, the journal showed `Model provider rejected the run's credential … provider=groq … runOk=true`, and the alert fired, logged as undeliverable because a shadow has no operators. The once-per-cooldown half needs a delivered alert and was not exercised.)* MANUAL-VERIFY(2026-10-03): The next time a leg's credential is refused while a later leg works, the user gets an answer and the journal shows `Model provider rejected the run's credential … runOk=true` followed by one `Credential failure alerted to operators` line. Only one per cooldown, however many messages follow.
+
+## napkin sender name — tagula box on 0.24.2-beta.2 (deployed 2026-10-05 00:41 IDT)
+- [ ] MANUAL-VERIFY(2026-10-05): On the tagula box, after a day with group messages, the newest `<space>/.messages/<date>.jsonl` in the customer's group space has `"author_name"` on most `"role":"user"` lines: `grep -c '"author_name"' <file>` is more than 0, and lines with no name have no `author_name` key at all. Kulmus's `author_name` filter then finds that client's messages (fix `napkin-message-export-drops-the-sender-name`, post-mortem `docs/debug/minor/2026-10-04-napkin-message-export-drops-the-sender-name.md`).
+
+## Plan unattended-1003 / S2
+
+A content-filter block now ends its leg after one attempt instead of being retried `max_retries_per_leg` times. `pi-failure-class.ts` is baked, so this needs **an image rebuild** (`cd ~/mercury-src && bash ./container/build.sh`), then a restart so the derived image follows (`docs/debug/minor/2026-10-04-pi-failure-class-retries-a-content-filter-block.md`).
+
+- [x] *(Verified 2026-10-05 on the WSL box, dev `6ddb895`, base `mercury-agent:0.24.2-beta.2` = `63637858e06b`, derived `mercury-agent-ext:b2acae430168` (built 13:36:22 IDT, 482 s), restart 13:28:17 IDT: prints `1`. Also run inside that image: `classifyAttemptFailure` on a `PiExitFailure` whose classify text is the Anthropic block returns `fallbackable` (the leg loop breaks after one attempt), the same words only in stdout stay `retryable`, a 503 stays `retryable`.)* MANUAL-VERIFY(2026-10-04): After the rebuild and the `Built derived agent image` line, `docker run --rm --entrypoint sh <derived mercury-agent-ext tag> -c 'grep -c -F "content\\s+filtering\\s+policy" /app/src/agent/pi-failure-class.ts'` prints 1.
+- [ ] MANUAL-VERIFY(2026-10-04): The next time a provider blocks a reply ("Output blocked by content filtering policy"), that run's trace in `~/whatsapp-bot/.mercury/traces/` has exactly **one** `piSpawnedAtIso` line, not four, and the user still gets the content-filter message, not "try again". *(2026-10-05: still open. One attempt on a shadow (`greece2026`, Opus 5.5) asking for full song lyrics: the model declined by itself, so the provider filter never fired. Not forced further; wait for a real block.)*
+
+## Hebrew host notices — restart-only (host-side `src/core/handler.ts`)
+
+The ⏳ heartbeat now uses the space's `messages.locale`; `main`, `tel-aviv-flat-search` and `@global` are `he` since 2026-09-26.
+
+- [ ] MANUAL-VERIFY(2026-10-05): After the restart, a request in `main` or the flat-search group that runs past 30 s shows `⏳ עובד על זה… (30 שניות)`, not `⏳ Processing… (30s)`; the next restart/failure notice there is Hebrew too (fix `host-notices-are-english-in-hebrew-spaces`).
+
+## space-links D-018 — `note` is global-admin-only (with the M1.2 deploy)
+
+Host-only (`src/core/routes/links.ts`, not baked): it rides whatever restart deploys `mrctl-links-admin-commands`.
+
+- [ ] MANUAL-VERIFY(2026-10-05): On the box that runs M1.2, the global admin creates `mrctl links create <mgmt> '*' --level read --note "probe-note" --disclosure "probe-disclosure"`. Then, in another space, ask that space's admin's bot "who can access this space?": the reply names the management space and the disclosure, and never says "probe-note". The owner's own `mrctl links list` still shows `note: probe-note`. Revoke the probe link afterwards.

package/docs/permissions.md

@@ -54,10 +54,11 @@ Custom roles can be created by assigning permissions to any role name.
 | `permissions.get` | View role permissions |
 | `permissions.set` | Modify role permissions |
 | `spaces.list` | View all spaces |
-| `spaces.rename` | Rename a space and link/unlink conversations |
+| `spaces.rename` | Rename the current space |
 | `spaces.delete` | Delete current space and all related DB data |
 | `model.list` | List the configured model chain (`mrctl model list`, chat `/model list`) |
 | `model.switch` | Pin the space to one model leg (`mrctl model switch`, chat `/model switch`) or clear that pin (`mrctl model reset`, chat `/model reset`) — takes effect on the next agent run. A pinned space has no fallback; reset is refused while the space has an active scheduled task |
+| `links.list` | See the space links touching this space, which spaces reach it and at what level, and their audit (`mrctl links list/inspect/audit`). Admin-only by default: it names every space that reaches this one. Creating, changing or revoking a link (`mrctl links create/update/revoke`) is **not** a permission — those verbs are global-admin-only, and no role grant enables them |
 | `media.receive` | Incoming attachments are saved to `inbox/` and shown to the agent |
 | `media.send` | Outbox files produced on this caller's turn are delivered back to the chat |
 
@@ -137,9 +138,15 @@ mrctl conversations list
 
 # Show only conversations that are not yet linked
 mrctl conversations list --unlinked
+
+# Create a new space (global admin only)
+mrctl spaces create family-chat "Family chat"
+
+# Link a conversation (id from `conversations list`) to a space (global admin only)
+mrctl conversations link 12 family-chat
 ```
 
-Space names are stored in the database and shown in logs/dashboard for easier identification. Conversations remain platform-native and are linked into spaces. Conversation listing uses `spaces.list`; linking and unlinking use `spaces.rename`.
+Space names are stored in the database and shown in logs/dashboard for easier identification. Conversations remain platform-native and are linked into spaces. Conversation listing uses `spaces.list`. Creating a space and linking/unlinking a conversation reach past the caller's own space, so they are not gated by a space permission: they require a **global admin** (`permissions.admins` / `dmAutoSpaceAdminIds`), the same rule as `mrctl links create`. (Chat `/spaces` is narrower: seeded `permissions.admins` only.) With no global admins configured, nobody can do them through the API — use the dashboard.
 
 ## Seeding Admins
 

package/docs/plans/{unattended-1003 → archive/2026-10-05-unattended-1003}/plan.md

@@ -1,7 +1,7 @@
 # Plan: unattended-1003
 
-**Status**: Active
-**Created**: 2026-10-03   **Last updated**: 2026-10-03
+**Status**: Archived
+**Created**: 2026-10-03   **Last updated**: 2026-10-05
 **Landing mode**: pr
 **Max width**: 6
 **Inputs**: six unattended lanes: S1 auth-rejection-never-falls-back-to-the-next-model-leg + pi-failure-class-retries-a-content-filter-block; S2 consent-rows-are-writable-by-space-profile-apply; S3 gemini-leg-refused-no-google-credential-env-var; S4 core-media-url-download-has-no-time-bound + whatsapp-media-read-bound-does-not-close-the-download-socket; S5 pinchtab-session-inject-script-is-refused-401-and-reports-success + pinchtab-session-injector-lib-computes-a-different-etld1; S6 space-link-graph-and-grant-resolver --width 6 (one item per session, so the three paired lanes became file-ordered pairs; IDs below are the plan's, not the lane numbers)

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S1.md

@@ -0,0 +1,43 @@
+## Launched — 2026-10-03T18:06Z
+Branch: worktree-fix-auth-rejection-never-falls-back-to-the-next-model-leg
+
+## Report — 2026-10-03T18:21Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner lands — fix is complete and gated on worktree-fix-auth-rejection-never-falls-back-to-the-next-model-leg (4 wip commits); stopped at the confirm-before-archive prompt per the unattended brief, so no archive move, squash-merge or push
+Deploy needs: rebuild
+Files changed:
+- docs/debug/auth-rejection-never-falls-back-to-the-next-model-leg.md
+- docs/pending-verification.md
+- src/agent/container-entry.ts
+- src/agent/container-runner.ts
+- src/agent/pi-failure-class.ts
+- src/agent/provider-auth-rejection.ts
+- tests/pi-failure-class.test.ts
+- tests/provider-auth-rejection.test.ts
+Siblings must know:
+- S4: src/agent/container-runner.ts is touched in consumeResult only (~3262-3285): the authRejected read moved before the `ok === false` branch and calls parseRefusedLegs instead of parseAuthRejected (import line ~66 changed). Owner approved this in-session. Expect a clean rebase unless S4 edits consumeResult.
+- S2: the auth arm of classifyPiFailure now returns "fallbackable" (only cursor is failFast). failFastError is gone, replaced by refusedLeg + chainFailure(…, refused). After a refused first leg, the run's user-facing error is now the LAST leg's error (e.g. 529 overloaded), not the 401. This matters for user-error-messages.ts.
+- result.json `authRejected` is now an array of {provider, model, error}, written on successful runs too. Deploy the image rebuild and the host restart in the same gap.
+--- final report (verbatim) ---
+~~~
+S1 — auth-rejection-never-falls-back-to-the-next-model-leg: fixed on branch, not landed.
+
+Fix: a provider-refused credential is now `fallbackable`. runModelChain records each refused leg with
+its own error and moves to the next leg without retrying it. The list rides every end of the chain
+(success, budget exhausted, fail-fast, last-leg failure) as result.json `authRejected: [{provider, model, error}]`.
+The host's consumeResult alerts every refused leg before branching on ok, so a run that a later leg
+served still pages the operator once per cooldown. parseRefusedLegs accepts only chain legs, once,
+whose error passes isPiAuthFailure (the review fork's forged-entry finding), and still reads an older
+image's single-object form.
+
+Gate: ~/check-mercury.sh check <worktree> — all 16 links pass, 6522 pass / 0 fail.
+Negative tests: removing refused.push, gating the host alert on ok===false, or removing the
+isPiAuthFailure clause each turns its tests red.
+Scope: container-runner.ts (S4's surface) was touched with owner approval (AskUserQuestion, this session).
+Post-mortem: docs/debug/auth-rejection-never-falls-back-to-the-next-model-leg.md (filled, not yet
+moved to docs/debug/moderate/; Step 13 archive is behind the confirm prompt).
+Pending verification: docs/pending-verification.md "## Plan unattended-1003 / S1" (2 lines).
+Claim pushed: 6ec6e92 on origin/dev (docs-only promotion, via a scratch worktree).
+Deploy: image rebuild + restart in the same gap.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S2.md

@@ -0,0 +1,54 @@
+## Launched — 2026-10-04T10:09Z
+Branch: worktree-fix-pi-failure-class-retries-a-content-filter-block
+
+## Report — 2026-10-04T10:19Z
+Outcome: blocked
+Delivered: —
+Blocked-on: f-bug-fix Step 12 confirm-completion prompt — owner lands (archive, rebase, squash-merge)
+Deploy needs: rebuild
+Files changed:
+- docs/debug/pi-failure-class-retries-a-content-filter-block.md
+- docs/pending-verification.md
+- src/agent/pi-failure-class.ts
+- src/agent/user-error-messages.ts
+- tests/pi-failure-class.test.ts
+Siblings must know:
+- isContentFilterError now lives in src/agent/pi-failure-class.ts (baked); user-error-messages.ts re-exports it, so existing imports still work.
+- isPiAuthFailure now returns false for content-filter text, so refusedLeg never reports a block that quotes 401/403 as a refused credential.
+--- final report (verbatim) ---
+~~~
+S2 pi-failure-class-retries-a-content-filter-block: stopped at Step 12 (the confirm-completion prompt), per the brief. Nothing pushed except the docs-only claim (95a5cd1).
+
+Branch: worktree-fix-pi-failure-class-retries-a-content-filter-block (worktree .claude/worktrees/fix-pi-failure-class-retries-a-content-filter-block), 3 commits on origin/dev 95a5cd1:
+  62f3289 wip: content-filter block is fallbackable, one matcher in the baked classifier
+  0cb5bee wip: format
+  27d654d docs: post-mortem and verification lines for content-filter retry fix
+
+Evidence: trace mercury-1790674324824-46 shows 4 pi spawns in one container. Each sends one request to anthropic/claude-opus-5-5, each is blocked ("Output blocked by content filtering policy"), and each exits 0. That is 1 attempt + max_retries_per_leg: 3. The "10-12 times" in the report was grep hits (3 per attempt). Traces -47/-61/-62 are no longer on the box, so they are unconfirmed.
+
+Fix: the content-filter matcher moved into the baked pi-failure-class.ts, and user-error-messages.ts re-exports it (one statement). classifyPiFailure: content filter -> fallbackable, checked first. isPiAuthFailure: false for a block. No Dockerfile change, because the file is already COPY'd and has no imports.
+
+Gate: ~/check-mercury.sh check <worktree>: all 16 links passed, 6655 pass / 0 fail. Negative-tested: removing the arm turns 4 tests red, removing the auth guard turns 1 red. Session code review found no issues.
+
+Still to do (owner): f-bug-fix Steps 13-16 (archive to docs/debug/minor/2026-10-04-…, rebase, squash-merge into dev, clean up), then rebuild the image.
+~~~
+
+## Report — 2026-10-04T11:16Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: rebuild
+Files changed:
+- docs/debug/minor/2026-10-04-pi-failure-class-retries-a-content-filter-block.md
+- docs/debug/pi-failure-class-retries-a-content-filter-block.md
+- docs/pending-verification.md
+- src/agent/pi-failure-class.ts
+- src/agent/user-error-messages.ts
+- tests/pi-failure-class.test.ts
+Siblings must know:
+- isContentFilterError now lives in src/agent/pi-failure-class.ts (baked); user-error-messages.ts re-exports it.
+- isPiAuthFailure returns false for content-filter text.
+--- final report (verbatim) ---
+~~~
+Owner approved archive + squash-merge (2026-10-04). Post-mortem archived to docs/debug/minor/2026-10-04-pi-failure-class-retries-a-content-filter-block.md, branch rebased onto origin/dev 45ea243 (no semantic overlap), squash-merged into local dev as 80eb998. Worktree and branch removed. NOT pushed: local dev is 1 ahead of origin/dev. Deploy needs an image rebuild.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S3.md

@@ -0,0 +1,38 @@
+## Launched — 2026-10-03T18:20Z
+Branch: worktree-fix-consent-rows-are-writable-by-space-profile-apply
+
+## Report — 2026-10-03T18:28Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner landing — /f-bug-fix Step 12 confirm (branch worktree-fix-consent-rows-are-writable-by-space-profile-apply @ 4b8f6c6, gate green, not squash-merged)
+Deploy needs: restart
+Files changed:
+- docs/bugs/runtime-owned-config-keys-have-no-guard-at-the-store.md
+- docs/debug/consent-rows-are-writable-by-space-profile-apply.md
+- docs/pending-verification.md
+- src/core/routes/config-builtin.ts
+- src/extensions/reserved.ts
+- src/profile/space-profile.ts
+- tests/extension-loader.test.ts
+- tests/space-profile.test.ts
+Siblings must know:
+- S9 (owns src/storage/db.ts): filed docs/bugs/runtime-owned-config-keys-have-no-guard-at-the-store.md. It proposes refusing isRuntimeOwnedConfigKey in Db.setSpaceConfig. Not in S9's scope; just don't be surprised by it.
+- `security` is now a reserved extension name (src/extensions/reserved.ts).
+--- final report (verbatim) ---
+~~~
+S3: consent-rows-are-writable-by-space-profile-apply (bug, moderate). Stopped at /f-bug-fix Step 12 (confirm before archive and merge), per the brief.
+
+Fix (branch worktree-fix-consent-rows-are-writable-by-space-profile-apply, 3 wip commits on origin/dev 7197d5f):
+- src/profile/space-profile.ts: assertProfileWritableConfigKey refuses isRuntimeOwnedConfigKey keys with a ProfileError, at extension_config parse time and again at the top of applyProfile before any write.
+- src/extensions/reserved.ts: `security` reserved.
+- src/core/routes/config-builtin.ts: docstring corrected.
+- tests: space-profile.test.ts "runtime-owned config keys" (both consent keys, at load and at apply), extension-loader.test.ts (`security` refused). Each guard negative-tested by deleting it: 2/2/1 failures.
+- Residual filed: docs/bugs/runtime-owned-config-keys-have-no-guard-at-the-store.md (store-level guard; db.ts was S9's this round).
+- Post-mortem filled in docs/debug/consent-rows-are-writable-by-space-profile-apply.md. Not yet moved to docs/debug/moderate/ (Step 13 runs after the confirm).
+- pending-verification: 2 lines under "## Plan unattended-1003 / S3".
+
+Gate: ~/check-mercury.sh check: all 16 links passed (6518+ tests, 0 fail). Session code review: no issues.
+Claim push: 7197d5f to origin/dev (docs only, cherry-picked onto a fresh base).
+Deploy: restart. reserved.ts is COPY'd into the image but nothing there imports it (the image contract checks existence only), so a rebuild is not needed for the fix.
+Overlap preflight: exit 0, no PLAN-PASSED lines.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S4.md

@@ -0,0 +1,46 @@
+## Launched — 2026-10-03T18:10Z
+Branch: worktree-fix-gemini-leg-refused-no-google-credential-env-var
+
+## Report — 2026-10-03T18:22Z
+Outcome: blocked
+Delivered: —
+Blocked-on: f-bug-fix Step 12 confirm-completion — owner lands (archive + squash-merge into dev), per the unattended brief
+Deploy needs: restart
+Files changed:
+- docs/bugs/model-provider-passthrough-list-misses-pi-api-key-providers.md
+- docs/bugs/pi-auth-test-catalog-mock-restore-reinstalls-the-stub.md
+- docs/debug/gemini-leg-refused-no-google-credential-env-var.md
+- docs/pending-updates/gemini-leg-refused-no-google-credential-env-var.md
+- docs/pending-verification.md
+- src/agent/container-runner.ts
+- src/preflight/checks/credential.ts
+- src/storage/pi-auth.ts
+- tests/container-runner-chain-credential-guard.test.ts
+- tests/container-runner-chain-credentials.test.ts
+- tests/pi-auth-provider-env-vars.test.ts
+- tests/pi-auth.test.ts
+- tests/preflight-credential.test.ts
+Siblings must know:
+- S1 (provider-auth-rejection.ts, not edited here): `providerCredentialEnvVar` now maps every single-variable pi provider (`google` → `GEMINI_API_KEY`, `openai` → `OPENAI_API_KEY`, …), so `credentialVarsFor` returns a var for API-key providers where it used to return []. Recovery text via `envSource` follows automatically.
+- New export `providerOAuthHandoffEnvVar(provider)` in src/storage/pi-auth.ts: auth.json OAuth is handed over only for anthropic and github-copilot. Use it, not `providerCredentialEnvVar`, for "should I refresh auth.json for this provider".
+- src/preflight/checks/credential.ts was edited (outside predicted surfaces, owned by no session): the auth.json branch now uses the hand-off predicate.
+--- final report (verbatim) ---
+~~~
+S4 / gemini-leg-refused-no-google-credential-env-var: fixed on branch worktree-fix-gemini-leg-refused-no-google-credential-env-var (5 local commits on origin/dev f37097e). Stopped at /f-bug-fix Step 12, before archive and squash-merge, as the unattended brief requires.
+
+Root cause: `PROVIDER_CREDENTIAL_ENV_VAR` (src/storage/pi-auth.ts) listed only anthropic and github-copilot, but the host-side fail-fast gate reads it as "which variable keys this leg". So every API-key leg (google, openai, groq, …) was refused, while the key was already reaching the container as GEMINI_API_KEY through the passthrough.
+
+Fix:
+- The map now lists every builtin pi provider that reads exactly one env var. Bedrock, vertex, cloudflare and openai-codex are left out on purpose.
+- New `providerOAuthHandoffEnvVar` keeps the auth.json OAuth hand-off to anthropic and copilot, in both injection and preflight. Without it, a kimi-coding OAuth entry would have paged the operator on every spawn; the session review caught this.
+- tests/pi-auth-provider-env-vars.test.ts pins the map against the installed pi-ai's own resolvers in both directions.
+- Gemini guard tests cover the real passthrough, a missing key, an empty key and a pinned leg.
+- Every new test was negative-tested and goes red.
+
+Gate: ~/check-mercury.sh check → all 16 links passed.
+QA: repro path refused → now served when MERCURY_GEMINI_API_KEY is set (pass); absent or empty key still refused, naming MERCURY_GEMINI_API_KEY (pass); checklist all ticked (pass).
+Claim push: f37097e on origin/dev (two retries, lost races to S7 and S9 claims).
+Deploy: host-only (neither file is a Dockerfile COPY line, no version bump) → restart in a gap.
+Pending verification: one real Gemini turn on pi 0.87.1 / @google/genai 2.21, under "Plan unattended-1003 / S4".
+Filed: docs/bugs/pi-auth-test-catalog-mock-restore-reinstalls-the-stub.md, docs/bugs/model-provider-passthrough-list-misses-pi-api-key-providers.md.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S5.md

@@ -0,0 +1,32 @@
+## Launched — 2026-10-03T18:10Z
+Branch: worktree-fix-core-media-url-download-has-no-time-bound
+
+## Report — 2026-10-03T18:29Z
+Outcome: blocked
+Delivered: —
+Blocked-on: f-bug-fix Step 12 confirm-before-archive — owner lands (brief: stop after local commits + gate)
+Deploy needs: restart
+Files changed:
+- docs/debug/core-media-url-download-has-no-time-bound.md
+- docs/ideas/url-download-drops-not-reported-to-agent.md
+- docs/pending-updates/core-media-url-download-has-no-time-bound.md
+- docs/pending-verification.md
+- src/adapters/whatsapp-media.ts
+- src/core/media.ts
+- tests/media.test.ts
+Siblings must know:
+- `MediaReadBounds` and `MEDIA_READ_BOUNDS` (idle 30 s, total 10 min) moved from `src/adapters/whatsapp-media.ts` to `src/core/media.ts`; whatsapp-media.ts imports them from there and no longer exports them. S6 (whatsapp read bound) should change bound values only in core/media.ts.
+--- final report (verbatim) ---
+~~~
+S5 core-media-url-download-has-no-time-bound: fix complete on worktree-fix-core-media-url-download-has-no-time-bound (4 wip commits on origin/dev bb81c78), stopped at f-bug-fix Step 12 (confirm before archive) per the brief.
+
+- Claim pushed: bb81c78 docs: promote core-media-url-download-has-no-time-bound to in-progress (cherry-picked onto origin/dev; local dev also carries ec9f61a).
+- src/core/media.ts: MediaReadBounds / MEDIA_READ_BOUNDS moved here (one statement for both readers). The `within()` helper owns a ref'd timer and awaits the race. readBodyCapped bounds every read by min(idle, time left of total); when a bound fires it logs a warning, cancels the reader and throws UrlMediaTimeoutError. The fetch open is raced under the idle bound with an AbortController. A fired bound aborts the controller and reports onSkipped download_failed.
+- src/adapters/whatsapp-media.ts: imports the bounds; no behaviour change.
+- tests/media.test.ts: 6 tests (idle, total trickle, open, server stall after one chunk, invalid bounds refused, values pinned). Each of the idle, open and total bounds was negative-tested: with the bound disabled, its test went red at the test's own timeout.
+- Session code review: no bugs; 3 hardening suggestions applied (trickle deflake, 4 s margins, abort the socket on read timeout).
+- Gate: ~/check-mercury.sh check: 16/16 links, 6518 pass / 0 fail.
+- Docs: the post-mortem is filled in docs/debug/core-media-url-download-has-no-time-bound.md (still In-Progress; Step 13 moves it to docs/debug/minor/2026-10-03-…). The residual is noted in docs/ideas/url-download-drops-not-reported-to-agent.md. docs/pending-updates/core-media-url-download-has-no-time-bound.md was added, and one MANUAL-VERIFY line was appended under "## Plan unattended-1003 / S5".
+
+Next: owner resumes /f-bug-fix core-media-url-download-has-no-time-bound at Step 12 (confirm) → Step 13 archive → 14 rebase → 15 squash-merge + push.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S6.md

@@ -0,0 +1,64 @@
+## Launched — 2026-10-04T10:12Z
+Branch: worktree-fix-whatsapp-media-read-bound-does-not-close-the-download-socket
+
+## Report — 2026-10-04T10:29Z
+Outcome: blocked
+Delivered: —
+Blocked-on: f-bug-fix Step 12 confirm-before-archive — owner lands (branch worktree-fix-whatsapp-media-read-bound-does-not-close-the-download-socket @ b87f233, gate green, not squash-merged)
+Deploy needs: sync (runs bun install: package.json + bun.lock changed, applies patches/) + restart; no image rebuild
+Files changed:
+- Dockerfile.host
+- bun.lock
+- docs/debug/minor/2026-10-02-whatsapp-media-read-hangs-when-the-body-errors-mid-download.md
+- docs/debug/moderate/2026-10-02-whatsapp-media-download-buffers-before-size-check-without-file-length.md
+- docs/debug/whatsapp-media-read-bound-does-not-close-the-download-socket.md
+- docs/pending-verification.md
+- package.json
+- patches/@whiskeysockets%2Fbaileys@7.0.0-rc14.patch
+- src/adapters/whatsapp-media.ts
+- tests/whatsapp-ingest-gates.test.ts
+- tests/whatsapp-media-socket-close.test.ts
+Siblings must know:
+- First `patches/` entry in the repo (Baileys 7.0.0-rc14, `patchedDependencies`). Every `bun install` from a copied package.json now needs `patches/` beside it, or it fails with "Couldn't find patch file" (Dockerfile.host fixed here).
+- After this lands on dev, every check mirror that borrows ~/mercury-src/node_modules fails 6 tests in tests/whatsapp-media-socket-close.test.ts until the box syncs (bun install). The first test names the cause. Workaround: a real `bun install --frozen-lockfile` in that mirror.
+- tests/whatsapp-ingest-gates.test.ts leaked its Baileys stub into every later suite (`{ ...realBaileys }` over a live namespace); fixed with a REAL_BAILEYS copy taken at import.
+- `MediaDownloadOptions.download` now receives a third argument, `MediaDownloadContext` (signal, reuploadRequest).
+- When archiving, add the post-mortem to tests/fixtures/release-gate/regression-map.json (category code), or the release-gate map test goes red.
+--- final report (verbatim) ---
+~~~
+S6 whatsapp-media-read-bound-does-not-close-the-download-socket — fixed on branch, gate green, stopped at the Step 12 confirm (owner lands).
+
+Root cause, measured on Bun 1.3.14: destroying the Readable.fromWeb body (which our unpipe chain already did) releases the reader but leaves the socket draining. The server was still writing 18.5 MB later. An AbortSignal on fetch closes it within 1 ms, and Baileys' getHttpStream passed fetch no signal.
+
+Fix 1: the first patches/ entry (bun patch, Baileys 7.0.0-rc14) threads options.signal into getHttpStream's fetch. downloadBytes aborts one AbortController on every exit. Tests run Baileys' real downloadMediaMessage against a local server and read the close on the server's side: idle, cap, total and open bounds, plus a clean encrypted body. Negative-tested: the 4 close tests go red with the abort removed, and red with the patch line removed.
+Fix 2: the re-upload gets its own bound, WHATSAPP_REUPLOAD_BOUND_MS = 2 min (rationale in code), and the open bound is re-armed around it. Finding: on Baileys rc14 the re-upload is unreachable. It triggers on error.status, while its Boom error carries output.statusCode, so a 410 never asks the phone (measured: 0 calls). A test pins that, so a Baileys bump that makes the path live goes red.
+Also: Dockerfile.host copies patches/ before bun install (it would have failed); the ingest-gates test's leaky Baileys mock restore is fixed; corrections are appended to both 2026-10-02 post-mortems; 3 MANUAL-VERIFY lines are under "Plan unattended-1003 / S6"; the post-mortem is written in docs/debug/ (not archived).
+Gate: ~/check-mercury.sh check on the worktree — all 16 links passed, 6661 pass / 0 fail (the mirror has its own patched node_modules).
+Not done (owner): Step 13 archive (minor/2026-10-04-…) plus a regression-map entry, the squash-merge, and the push. Local dev carries a duplicate of the pushed promotion commit (f204433 = 1333321); the next pull --rebase drops it.
+~~~
+
+## Report — 2026-10-04T11:05Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner push — squash-merged into local dev as e3681f7 (archive + regression-map entry included), not pushed
+Deploy needs: sync (runs bun install: package.json + bun.lock changed, applies patches/) + restart; no image rebuild
+Files changed:
+- Dockerfile.host
+- bun.lock
+- docs/debug/minor/2026-10-02-whatsapp-media-read-hangs-when-the-body-errors-mid-download.md
+- docs/debug/minor/2026-10-04-whatsapp-media-read-bound-does-not-close-the-download-socket.md
+- docs/debug/moderate/2026-10-02-whatsapp-media-download-buffers-before-size-check-without-file-length.md
+- docs/pending-verification.md
+- package.json
+- patches/@whiskeysockets%2Fbaileys@7.0.0-rc14.patch
+- src/adapters/whatsapp-media.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/whatsapp-ingest-gates.test.ts
+- tests/whatsapp-media-socket-close.test.ts
+Siblings must know:
+- Local dev is red on one test that is not S6's: S2's post-mortem minor/2026-10-04-pi-failure-class-retries-a-content-filter-block.md (80eb998) has no regression-map.json entry.
+- After the push, check mirrors borrowing ~/mercury-src/node_modules fail the socket-close tests until the box syncs (bun install).
+--- final report (verbatim) ---
+~~~
+Owner approved archive + squash-merge. Archived to docs/debug/minor/2026-10-04-whatsapp-media-read-bound-does-not-close-the-download-socket.md with a regression-map entry, rebased cleanly onto local dev (which carries S2's 80eb998), and squash-merged as e3681f7 (13 files). The worktree and branch were removed. Gate on the rebased tree: 6668 pass / 1 fail, the one failure being S2's post-mortem missing from regression-map.json. Not pushed.
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S7.md

@@ -0,0 +1,78 @@
+## Launched — 2026-10-03T18:10Z
+Branch: worktree-fix-pinchtab-session-inject-script-is-refused-401-and-reports-success
+
+## Report — 2026-10-03T18:20Z
+Outcome: blocked
+Delivered: —
+Blocked-on: owner landing — /f-bug-fix Step 12 confirm (branch worktree-fix-pinchtab-session-inject-script-is-refused-401-and-reports-success @ 284b3ba, gate green, not squash-merged)
+Deploy needs: restart (the derived image rebuilds on the first run, because its hash includes the new bins); no base rebuild
+Files changed:
+- docs/bugs/pinchtab-cookies-and-evaluate-endpoints-are-off-so-sessions-cannot-inject.md
+- docs/debug/pinchtab-session-inject-script-is-refused-401-and-reports-success.md
+- docs/pending-verification.md
+- examples/extensions/pinchtab/bin/pinchtab_nav
+- examples/extensions/pinchtab/bin/pinchtab_session_inject.cjs
+- examples/extensions/pinchtab/index.ts
+- tests/pinchtab-prompt.test.ts
+Siblings must know:
+- S8: the live eTLD+1 lookup moved out of the index.ts template literal into examples/extensions/pinchtab/bin/pinchtab_session_inject.cjs, as `siteKey(hostname)` (exported when required). The prompt no longer carries any JSSCRIPT heredoc. Compare lib/session-injector.ts against that function.
+- New bug filed: docs/bugs/pinchtab-cookies-and-evaluate-endpoints-are-off-so-sessions-cannot-inject.md. pinchtab 0.13 answers /cookies and /evaluate with 403 by default, so injection still cannot succeed until the owner decides.
+--- final report (verbatim) ---
+~~~
+S7 — pinchtab-session-inject-script-is-refused-401-and-reports-success: fixed on the worktree branch, gate green, stopped for the owner to land.
+
+Branch worktree-fix-pinchtab-session-inject-script-is-refused-401-and-reports-success (4 commits on top of claim 15508c4, which is pushed to origin/dev):
+- examples/extensions/pinchtab/bin/pinchtab_session_inject.cjs (new):
+  - token: Bearer server.token, or PINCHTAB_TOKEN;
+  - sends X-Agent-Id: $PINCHTAB_AGENT_ID;
+  - checks every response status; 90 s ref'd bound;
+  - exits 0 injected / 3 no session / otherwise failed.
+- examples/extensions/pinchtab/bin/pinchtab_nav (new): falls back to `pinchtab nav` on failure and says so on stderr.
+- examples/extensions/pinchtab/index.ts: both ship as mercury.cli bins next to pinchtab_ensure; the prompt no longer defines a function or a heredoc.
+- tests/pinchtab-prompt.test.ts:
+  - a fake 401-ing bridge exercises the real injector, plus stubbed pinchtab_nav paths;
+  - every guard was negative-tested.
+- docs/bugs/pinchtab-cookies-and-evaluate-endpoints-are-off-so-sessions-cannot-inject.md (new, owner decision).
+- docs/pending-verification.md: two lines under "## Plan unattended-1003 / S7".
+- Post-mortem filled in docs/debug/pinchtab-session-inject-script-is-refused-401-and-reports-success.md. Not yet moved to moderate/: that is the archive step, after the owner confirms.
+
+Gate: ~/check-mercury.sh check <worktree> → all 16 links passed, 6526 pass / 0 fail.
+
+Measured in throwaway mercury-agent-ext:3947692c9434 containers (pinchtab 0.13.2, node 22):
+- The bearer token and X-Agent-Id work.
+- With the shipped config, /cookies answers 403 cookies_disabled. The injector now fails loudly and pinchtab_nav falls back with a notice.
+- With allowCookies and allowEvaluate on, the cookie and localStorage land in the run's own tab.
+
+Deploy: restart. The derived image rebuilds on its first run; verify in the installed snapshot ~/whatsapp-bot/.mercury/extensions/pinchtab/bin/ and in the derived image's /usr/local/bin.
+No push, no PR, no merge (unattended rules). docs/pending-updates/ does not exist on dev and /f-bug-fix has no step that writes it, so nothing was written there.
+~~~
+
+## Report — 2026-10-03T22:23Z
+Outcome: delivered
+Delivered: pushed-unverified
+Blocked-on: —
+Deploy needs: restart (derived image rebuilds on first run); needs a push of local dev first
+Files changed:
+- docs/bugs/pinchtab-cookies-and-evaluate-endpoints-are-off-so-sessions-cannot-inject.md
+- docs/debug/moderate/2026-10-04-pinchtab-session-inject-script-is-refused-401-and-reports-success.md
+- docs/debug/pinchtab-session-inject-script-is-refused-401-and-reports-success.md
+- docs/pending-verification.md
+- examples/extensions/pinchtab/bin/pinchtab_nav
+- examples/extensions/pinchtab/bin/pinchtab_session_inject.cjs
+- examples/extensions/pinchtab/index.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/pinchtab-prompt.test.ts
+Siblings must know:
+- siteKey() now lives in examples/extensions/pinchtab/bin/pinchtab_session_inject.cjs (S8 compares against it)
+- local dev was rebased onto origin/dev (duplicate claim commits dropped); 685f109 is local only
+--- final report (verbatim) ---
+~~~
+Landed locally on dev as 685f109 (squash), owner-instructed ("review and land the fix locally yourself"). NOT pushed.
+Review: no functional findings; post-rebase gate caught two real defects, fixed on the branch:
+the two new bins were committed 100644 (now 100755), and the post-mortem lacked a
+release-gate regression-map row (added, category code). Gate after: 16/16 links, 6527 pass / 0 fail.
+Post-mortem: docs/debug/moderate/2026-10-04-pinchtab-session-inject-script-is-refused-401-and-reports-success.md
+Local dev reconciled first: rebased onto origin/dev, five patch-identical claim commits dropped,
+3488286 kept as 5819124. Worktree and branch removed.
+Open: docs/bugs/pinchtab-cookies-and-evaluate-endpoints-are-off-so-sessions-cannot-inject.md (owner decision).
+~~~

package/docs/plans/archive/2026-10-05-unattended-1003/sessions/S8.md

@@ -0,0 +1,55 @@
+## Launched — 2026-10-04T10:12Z
+Branch: worktree-fix-pinchtab-session-injector-lib-computes-a-different-etld1
+
+## Report — 2026-10-04T10:20Z
+Outcome: blocked
+Delivered: —
+Blocked-on: confirm-completion prompt (f-bug-fix Step 12) — owner archives and lands
+Deploy needs: none
+Files changed:
+- docs/debug/pinchtab-session-injector-lib-computes-a-different-etld1.md
+- docs/pending-updates/pinchtab-session-injector-lib-computes-a-different-etld1.md
+- examples/extensions/pinchtab/lib/session-injector.ts
+- tests/pinchtab-prompt.test.ts
+Siblings must know:
+- examples/extensions/pinchtab/lib/ no longer exists; bin/pinchtab_session_inject.cjs siteKey() is the only lookup key, and tests/pinchtab-prompt.test.ts fails if a second .slice(-2|-3) definition appears anywhere under examples/extensions/pinchtab/
+--- final report (verbatim) ---
+~~~
+S8: pinchtab-session-injector-lib-computes-a-different-etld1. Fixed locally, not landed.
+
+Branch: worktree-fix-pinchtab-session-injector-lib-computes-a-different-etld1
+Worktree: .claude/worktrees/fix-pinchtab-session-injector-lib-computes-a-different-etld1
+Three wip commits on top of origin/dev 45ea243 (the promotion, claim-pushed).
+
+Fix: deleted examples/extensions/pinchtab/lib/session-injector.ts. Nothing imported it, and its extractDomain gave co.uk for www.example.co.uk. bin/pinchtab_session_inject.cjs siteKey() (S7's) is now the only lookup-key definition. The existing test already pins www.example.co.uk -> example.co.uk. A new test in tests/pinchtab-prompt.test.ts asserts the .cjs is the only file under the extension with a .slice(-2|-3) cut: red before the deletion, naming exactly that file, green after.
+Post-mortem filled in docs/debug/pinchtab-session-injector-lib-computes-a-different-etld1.md (not yet archived to minor/). pending-updates file written.
+Gate: ~/check-mercury.sh check on the worktree, all 16 links passed, 6650 pass / 0 fail.
+Session code review: no issues (two non-blocking notes: the test comment cites the minor/2026-10-04-… archive path, so archive today or fix the comment; the guard is a ratchet for the .slice style only).
+Overlap: preflight clean (exit 0); no PLAN-PASSED lines.
+Deploy: none (unreferenced file deleted; installed snapshots drop it on the next restart).
+
+Stopped at f-bug-fix Step 12 (confirm before archive/merge), as the brief requires.
+~~~
+
+## Report — 2026-10-05T09:29Z
+Outcome: delivered
+Delivered: —
+Blocked-on: —
+Deploy needs: none
+Files changed:
+- docs/debug/minor/2026-10-05-pinchtab-session-injector-lib-computes-a-different-etld1.md
+- docs/pending-updates/pinchtab-session-injector-lib-computes-a-different-etld1.md
+- examples/extensions/pinchtab/lib/session-injector.ts
+- tests/fixtures/release-gate/regression-map.json
+- tests/pinchtab-prompt.test.ts
+Siblings must know:
+- examples/extensions/pinchtab/lib/ no longer exists; bin/pinchtab_session_inject.cjs siteKey() is the only lookup key
+--- final report (verbatim) ---
+~~~
+S8 archived and squash-merged into LOCAL dev as 82b7f09 (owner: "archive and merge locally"). Not pushed.
+Post-mortem: docs/debug/minor/2026-10-05-pinchtab-session-injector-lib-computes-a-different-etld1.md
+Rebased onto local dev (which carries S2/S6 landings unpushed and has diverged from origin/dev by 7 napkin commits); not onto origin/dev.
+Added the release-gate regression-map row the archived post-mortem requires.
+Gate on the rebased tree: all 16 links passed, 6671 pass / 0 fail — after replacing the check mirror's borrowed node_modules with a real patched install (Baileys patch gotcha).
+Worktree and branch removed.
+~~~