Журнал изменений

Unreleased

Новое

Added

• **Armenian (`hy`) lands at full coverage — P22/R3 wave 15 of the reopened queue (ADR-073, board umbrella #52); batch C opens.** `web/i18n/_platform.hy.json` (**149 693 B**, sha256 `014920998a4070cf6103d8cf135c28523beb451589bba0d34a55f432d1e88ef0`) covers all **1889** platform keys (all-or-nothing per the ADR-070 errata). The FULL `php scripts/build_i18n.php` regenerates `web/i18n/hy.json` (153 237 B, `c0b9a114d7b5bf9dd9757787f7ba25b22be55e92ffc3849c793c1e2e56efb018`), grows `web/i18n/_active.json` to **57** locales (`0637facee027f7b387f74fd3774d703f40cb006f2a5df6519460425885547954`) and lifts the gate **56/66 → 57/66**; `--check` reports 57/66 in sync. Exactly two pins moved (ADR-071): `.env.example` `SUPPORTED_LOCALES` += `hy` (**57** codes) and `tests/integration/WaitlistTest.php:292` assertSame **56→57**. Translation provenance, stated honestly: the Qwen dev window hit its monthly token limit after `mn`; this wave was finished in the lead window with a machine-translation pass (Google dictionary endpoint, batch 24, placeholder/newline masking) followed by structural QA — exact 1889-key keyset, **45** distinct / **87** placeholders 1:1, `mail.*` newline parity **5/2/2/6**, `links.import_payload_hint` byte-exact vs EN, **38** EN-identical literals (**2.01 %**), Armenian script share **94.79 %**, forbidden-script/Latin-in-word scan 0. No locale-specific marker/presence/required-core claim is made in this bullet; a native review pass is advised before the remaining batches. By ADR-071 the locale is reachable the moment the deploy lands (`POST /lang/hy` → cookie → `<html lang="hy">`). Gates live in this window: `build_i18n --check` **57/66** in sync; lint **467 files / 0 failures** + php85 **468 / 0 hits**; targeted `I18nSync` 5/933, `I18nCatalogContract` 6/109 816, `LocaleActivation` 11/45, `Waitlist` 12/236 (pin 57), `OutputTest` 9/16 — **0 failures**; `gates.sh` FULL deferred to the deploy lane (the Windows lead host cannot run the full suite canonically — Mailer/Coverage tests are host-dependent). Waves 16+ continue one locale per round (queue: ka · mr ne si ta te · km lo my — **9** remain) until 66/66.
• **Mongolian (`mn`) lands at full coverage — P22/R3 wave 14 of the reopened queue (ADR-073, board umbrella #52); batch B (Cyrillic) continues.** `web/i18n/_platform.mn.json` (**148 960 B**, sha256 `3c29cab6e30f9e97371fa4a2e348cea0332465fee42f986feea5f405b95bd6fa`) covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); the FULL `php scripts/build_i18n.php` (never `--locale`) regenerates `web/i18n/mn.json` (148 626 B, `7be652ce9dc2e4114e74969f4ba1f16082a1dacdb0bfe1daac70ee150584f507`), grows `web/i18n/_active.json` to **56** locales (`953c32a0d399855746d0f75c95ba3d3a7650474ad4921f163dfedf8ea44029ba`) and lifts the gate **55/66 → 56/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/mn` → cookie → `<html lang="mn">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `mn` (**56** codes) and `WaitlistTest` locale-count assertSame **55→56** (re-grepped — it stays the only locale pin in `tests/`). **THE `mn` DIFFERENCE: there is no Mongolian-exclusive letter.** The script probe measured that both extra alphabet letters (**ө ү**) already occur in the landed `kk` catalog, so no positive letter floor exists and no letter may be demanded (#195b — a floor on a letter an honest translation need not use forces invented content); the letter rule is FORBIDDEN-side only, with the **18** derived letters owned by `be bg kk mk ru sr uk` measuring **0**, accented variants **0** and exclusive letters **0**. Identity is carried by MORPHOLOGY and LEXICON instead. Register and orthography were fixed BEFORE translating: formal **та** (таны/танд) in all prose, **-на уу** for yes/no requests and **-аарай** for polite imperatives, buttons in the capitalised **-х** dictum (Хадгалах Цуцлах Устгах Нэмэх Илгээх Хайх Батлах Үүсгэх Нээх Хаах Шинэчлэх — the af/sq/bs/lb infinitive-button precedent), the informal 2sg family forbidden and measured **0**; the **35-letter** alphabet (the Russian 33 plus ө ү); guillemets **«…»** (U+00AB/U+00BB) on the ru/uk/be/kk precedent (mk/bg use the low-9/high-6 pair, so U+201E is forbidden here); the **7** mirror characters count-exact against EN (— 102 · – 4 · … 15 · · 6 · × 4 · ≥ 1 · ★ 1), the **11** forbidden typographic characters at **0**, EN apostrophes (9) dropped because Mongolian has none, and U+0022 surviving only inside the byte-exact `links.import_payload_hint` (273 B, 3×U+2026, 16×U+0022). Anti-copy-paste: `mn` has SEVEN landed Cyrillic relatives, so identity was measured FIRST — `en` **2.38 %**, `be` 2.44, `bg` 3.34, `kk` 3.02, `mk` 3.18, `ru` 2.81, `sr` 2.75, `uk` 2.59 — an order of magnitude below the pluricentric `bs`–`hr` 47.17 %, so **no pairwise identity cap is invented** (#144); the defence is four measured guards: **617 whole-word markers over the seven relatives = 0 leaks** (kk 95 · be 94 · uk 93 · ru 88 · bg 84 · sr 82 · mk 81), a **presence floor over a 447-word pool measured at ZERO whole-word hits across all 54 landed catalogs + EN** → **66.17 %** (1250 values) / **303** distinct words against the pinned floors 49.6 / 227, **REQUIRED_CORE 132/132**, and the **EN-identical cap 25 %** against a measured **2.38 %** (45 deliberate literals: utm_*, WebRTC, WebGL, WebAssembly, API, UTC, CTR, ISP, ASN, DNT, GPC, you@example.com, sessionStorage, localStorage, User-Agent, VPN, Favicon, Slug, IP, Heartbeat). Morphology is measured on the finished catalog (19 patterns, evidence the grammar is really there): genitive **-ын/-ийн 706** · dative **-д/-т 687** · dictum **-х 459** · reflexive **-аа 415** · instrumental **-аар 341** · past **-сан 261** · converb **-ж 260** · comitative **-тай 165** · nominalizer **-лт 158** · ablative **-аас 114** · polite **-уу 101** · copula **байна 67** · accusative **-ыг/-ийг 555** · plural **-ууд/-үүд 59** · conditional **-вал 51** · habitual **-даг 44** · agentive **-ч 63** · vowel harmony **ө 1522** · negation **биш 14** — and unlike the `mk` round **no floor was corrected to 0**: all six zero-fire floor-eligible patterns are productive in Mongolian UI prose. Terminology was locked before translating, one term per concept, with all seven collisions resolved (account **бүртгэл** / record **бичлэг** · permission **эрх** / consent **зөвшөөрөл** · alert **сэрэмжлүүлэг** / warning **анхааруулга** · create **үүсгэх** / generate **бий болгох** · delete **устгах** / remove **хасах** · action **үйлдэл** / activity **үйл ажиллагаа** · schedule **хуваарь** / plan **төлөвлөгөө**) and recorded in `_meta.note` (**2 791** chars of Mongolian prose, value-checked per #193 by TWO instruments: every one of the 12 quoted spans exists whole-word in the 1889 values, all 53 named core words are present, and all 28 stated figures match the measurement ±1.1 %). Provenance: 8 fragments f1..f8 (237 + 236×7 = 1889) translated slice-by-slice off the deterministic locale-agnostic plan (`mn_plan.json` sha `3ee50e4e4d7ddee5…` — identical to af/sq/bs/lb/sw/mk BY CONSTRUCTION); the per-fragment validator `validate_mn_frags.py` (37 675 B, `b811c0ae4c99ce44…`) was **self-tested 141 probes / 0 BAD BEFORE first use** (#114; guard power: the live `mk` catalog dropped in as `mn` fails with **1 256** findings), **8/8 `VALIDATE_EXIT=0` read from the file** (#104), and the catalog was assembled by `assemble_mn_full.py` (`0a08bb777dc51ee7…`) with FACT==PLAN per fragment and in total (#103). Structural invariants re-measured, never quoted: `links.import_payload_hint` byte-exact vs EN, `mail.*` newline parity 5/2/2/6, placeholders 45 distinct / 87 occurrences 1:1, 14 verbatim-JSON values not re-encoded. Floors came from RUN A only (#122) and were **PINNED BY INSTRUMENT, not by hand**: `mn_pin_floors.py` parses the archived RUN A output and writes `mn_runB_env.sh` (**25** pins — 75 % of the measurement truncated down, counts ≤3 exact, `MN_CYR_SHARE` 90 and `MN_EN_CAP` 25 keeping the corpus calibration, `MN_EXCLUSIVE_MIN` 0 as the recorded decision, the 8 measurement-only patterns 0 by contract) plus `mn_note_meas.json` (28 figures), with fail-closed preconditions (RUN A must be clean and no floor-eligible or low-fire pattern may measure 0 — otherwise the floor moves TO THE MEASUREMENT with documentation and no content is invented). RUN A (loose inherited floors) and RUN B (pinned) both ran on the same final bytes (sha256 `3c29cab6…`), both exit **0**, and are archived side by side in ONE file with explicit section headers (#195), RUN A written first. Negative controls grew to **15** (`mn_negative_controls.py`, `CONTROLS_EXIT=0`): 7 corrupted catalogs — the `mk` catalog presented as `mn` (**1 264** findings), an EN dump of all 1889 values (**131**), a forbidden U+045E, an informal 2sg pronoun, a falsified note figure (`presence: 35.42`, #193), «…» replaced by U+0022, and the required-core word `түгжих` erased everywhere — plus **7 FLOOR-SENSITIVITY controls** that raise each pin a hair above the RUN A measurement (presence 66.18 · distinct 304 · cyrillic share 97.46 · EN cap 2.38 · plural_uud 60 · negation_bish 15 · note floor 84), so no pin is vacuous. Control reasons are matched against the FULL in-process fail list, because the CLI prints only the first 12 fails per file and a catalog-level fail such as the EN cap is invisible in stdout (PLAYBOOK #199). Gates live in this window (#145, never quoted from a prior locale): targeted 8 classes **88 tests / 109 542 assertions / 0 failures** (I18nCatalogContract 6 / 107 855, I18nSync 5 / 926, Waitlist 12 / 233 with the pin at 56, LocaleActivation 11 / 45, ChangelogFreeze 5 / 16, HttpSmoke 37 / 222, ConfigEnvParity 4 / 179, DocsMirror 8 / 66) · suite FULL foreground outside the 00:00–01:00 UTC blackout (11:41:41Z → 11:47:04Z) **1902 tests / 125 169 assertions / 0 failures**, against a **same-head baseline measured in a detached worktree of `a68bc5ae2` without `mn`** (1902 / 123 167 / 0) → the `mn` surface is **+0 tests / +2 002 assertions**, the same per-locale constant as waves 10–13 (the first baseline attempt on a `git archive` tree is archived as defective: 5 `PromotionServiceTest` tests shell out to git and fail without a real `.git`, PLAYBOOK #199) · lint **467 files / 0 failures** + php85-lint **468 files / 0 hits** · `build_i18n --check` **56/66** in sync · `gates.sh` FULL **ALL-GREEN, exit 0** twice (686 routed endpoints / 0 501-stubs, link audit 145 unique targets / 0 dead, toc 164 entries in sync, changelog-freeze 3 released sections, coverage inventory 143/182 classes). Provenance of the base: the round started on prod head `a68bc5ae2` (store `deploy/result.json` ok:true, `deployed_at 2026-11-04T10:59:12+03:00`, live 55/66 — the store is the authority, #194), fetched from `bundles/repo-a68bc5ae2.bundle` (20 002 853 B, sha256 `102957347eb59942…`) in chunks with local sha == store sha; inside the bundle `refs/heads/master` is stale again and the prod head is reachable only through the `HEAD` ref (PLAYBOOK #196). The landing commit is a direct child of `a68bc5ae2`, deploy stays owner-only, `deploy/request.json` was NOT written and the canon pins (`repo-latest`, INDEX, STEP-STATE, kit) were not moved. Waves 15+ continue one locale per round (queue: hy ka · mr ne si ta te · km lo my — **10** remain) until 66/66, and `bash scripts/backup_i18n.sh mn` files the auto-milestone at 56 locales.
• **Macedonian (`mk`) lands at full coverage — P22/R3 wave 13 of the reopened queue (ADR-073, board umbrella #52); batch B (Cyrillic) opens.** `web/i18n/_platform.mk.json` (149 431 B, sha256 `bbb7f9e1d1e5a03445a6ef82bca8efdda548ce5788c637e65a7d00e4b3956c9f`) covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); the FULL `php scripts/build_i18n.php` (never `--locale`) regenerates `web/i18n/mk.json`, grows `web/i18n/_active.json` to **55** locales (`c2b04aae7af840a538641b7a8f5e7a2a3e097d1cfc6f02a95729500c8cb28052`) and lifts the gate **54/66 → 55/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/mk` → cookie → `<html lang="mk">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `mk` (55 codes) and `WaitlistTest` locale-count assertSame 54→55 (re-grepped — it stays the only locale pin in `tests/`). Register and orthography were fixed BEFORE translating: formal **вие/сте** in all prose with imperative-2sg buttons (Зачувај/Откажи/Избриши/Додај/Испрати/Потврди/Пребарај — the ca/af/sq/bs pattern), the **31-letter** Macedonian Cyrillic alphabet with the grave variants **ѐ/ѝ** allowed (35 accented occurrences measured), and the **22 letters of the landed relatives forbidden** — the bg/ru set (ъ ы э ё) and the uk/be set (і ї є ґ ў) both measure **0**, Latin inside a Cyrillic word measures **0**, and Latin survives only through a 38-item technical allowlist (API, JSON, URL, UTC, webhook, token, utm_*, WebRTC, you@example.com …). The Macedonian-exclusive letters are measured, not assumed: **ѓ 18 · ќ 91 · ѕ 0** (2 of 3 present; the floor is pinned at the measurement). Anti-copy-paste: `mk` has six landed relatives, so identity was measured FIRST — `sr` **18.21 %**, `bg` **10.32 %**, `ru` 5.66 %, `uk` 5.29 %, `kk` 3.55 %, `be` 2.70 %, `en` 2.54 % — an order of magnitude below the pluricentric `bs`–`hr` 47.17 %, so **no pairwise identity cap is invented** (#144); the defence is four measured guards instead: **571 whole-word markers over six relatives = 0 leaks** (be 124 · bg 62 · kk 122 · ru 108 · sr 47 · uk 108, with 20 legitimate Macedonian homographs removed word-by-word and documented), a **presence floor over a 454-word pool measured at ZERO whole-word hits across all 53 landed catalogs + EN** → **35.42 %** (669 values) / **199** distinct words against the pinned floors 26.6 / 149, **REQUIRED_CORE 81/81** (врска, посети, лозинка, поставки, сметка, контролна табла, извештај, зачувај, откажи, избриши, пребарување, известување, тим, сопственик, наплата, фактура …) while live `sr`/`bg`/`ru` each score **0/81**, and the **EN-identical cap 25 %** against a measured **2.54 %** (48 deliberate literals). Morphology is measured on the finished catalog (evidence the grammar is really there): definite articles **-от 287 / -та 371 / -те 392 / -то 145**, nominalizer **-ње 251** (ње 240), future **ќе 91** + `ке` 19, **da-clause 97**, imperative 1237, verb classes -ам 26 / -аш 41 / -а 100, prefixes по- 519 · пре- 165 · при- 144 · из- 143 · од- 120 · раз- 14, proximal ов- 25, agent nouns -ач 17 · -ник 14 · -тел 14, abstract -ост 63, џ 1 · љ 2 — and the 1sg copula `сум` measures **0**, so its floor was CORRECTED 1→0 with the measured reason (the EN base carries exactly one first-person string, `auth.terms_accept`, whose idiomatic Macedonian is a bare verb; the only `сум` phrasing is gendered — `согласен сум`/`согласна сум` — which a UI catalog must avoid) instead of inventing content to satisfy a floor. Terminology was locked before translating, one term per concept, and recorded in `_meta.note` (1 864 chars of Macedonian prose, value-checked per #193: every quoted Cyrillic token exists whole-word in the 1889 values, every metric figure matches the measurement ±1.1 %). Provenance: 8 fragments f1..f8 (237 + 236×7 = 1889) translated slice-by-slice off the deterministic locale-agnostic plan (`mk_plan.json` sha `3ee50e4e4d7ddee5…` — identical to af/sq/bs/lb/sw BY CONSTRUCTION); the per-fragment validator `validate_mk_frags.py` (`1f085340eef82f04…`) was **self-tested 171 probes / 0 BAD BEFORE first use** (#114; guard power: 21 live catalogs dropped in as `mk` — en af sw bg sr ru uk be kk bs lb sq hr de fr zh ja th he ar el — **all fail**), **8/8 `VALIDATE_EXIT=0` read from the file** (#104), and the catalog was assembled by `assemble_mk_full.py` (`31d5d4f4960a1b67…`) with FACT==PLAN per fragment and in total (#103). Structural invariants re-measured, never quoted: `links.import_payload_hint` byte-exact vs EN (273 B, 3 real U+2026, 16 U+0022), `mail.*` newline parity 5/2/2/6, placeholders 45 distinct / 87 occurrences 1:1, 14 verbatim-JSON values not re-encoded, EN typography mirrored count-exact (8 mirror characters) with the 11 forbidden typographic characters at 0. Floors came from RUN A only (#122): RUN A (loose inherited floors) measured the numbers above, RUN B pinned them with ~25 % headroom (counts ≤3 pinned exactly so the ѓ/ќ/љ/џ floors never round to a vacuous 0), both runs exit **0** on the same final bytes and are archived side by side in ONE file with explicit section headers (#195), plus **four negative controls** proving the pins bite (`gje` 14→999, `future_ke` 14→999, presence 26.6→99, exclusive 2→6 — each fails as it must). Gates live in this window (#145, never quoted from a prior locale): targeted 8 classes **88 tests / 107 571 assertions / 0 failures** (I18nCatalogContract 6 / 105 894, I18nSync 5 / 919, Waitlist 12 / 230 with the pin at 55, LocaleActivation 11 / 45, ChangelogFreeze 5 / 16, HttpSmoke 37 / 222, ConfigEnvParity 4 / 179, DocsMirror 8 / 66) · suite FULL foreground outside the 00:00–01:00 UTC blackout (20:22:07Z → 20:27:26Z) **1897 tests / 123 158 assertions / 0 failures** — versus the `sw` baseline 1888 / 121 140 / 0 the delta is **+9 tests / +2 018 assertions**, of which the foreign `OutputTest` class (from the two prod CLI commits) is 9 tests / 16 assertions, i.e. the `mk` surface is **+0 tests / +2 002 assertions**, the same per-locale constant as waves 10–12 · lint **466 files / 0 failures** + php85-lint **467 files / 0 hits** · `build_i18n --check` **55/66** in sync · `gates.sh` FULL **ALL-GREEN, exit 0** twice (686 routed endpoints / 0 501-stubs, link audit 145 unique targets / 0 dead, toc 163 entries in sync, changelog-freeze 3 released sections, coverage inventory 143/182 classes). **Part A — prod moved a THIRD time mid-round, and this time the deployed head does not carry waves 8–12:** while `mk` was being gated the owner deployed `c2428689` (`test(cli): extract the console write surface so both EPIPE branches are testable (board #53)`, author `IYA Ops Agent <ops@iya.local>`, child of `542e0783` `fix(cli): a closed stdout reader is not a failure - but every other write failure still is (board #51, EPIPE)`, both direct children of `3017c060`; `deploy/result.json` ok:true `2026-11-03T23:05:55+03:00`, backup `/root/iya-deploy/store-deploy-20261103-230544`). `merge-base(0086994c, c2428689) = 3017c060`, so the five landed waves are NOT in the deployed tree — `web/i18n/af.json` at prod is byte-identical to the fork, i.e. the live site runs **49/66** until a head carrying both the CLI fixes and the six locales is deployed (reported to the owner; deploy stays owner-only and `deploy/request.json` was NOT written). Source: `bundles/repo-c24286896.bundle` == canon `bundles/repo-latest.bundle`, sha256 `04224bcb4ed5c938…`, 19 384 599 B fetched in 7 chunks with local sha == store; inside the bundle `refs/heads/master` is STALE for the third time (`d928c5f`) and the prod head is reachable only through the bundle's `HEAD` ref (PLAYBOOK #196). Treatment: detached checkout of `c2428689` + `git cherry-pick` of the five landing commits — the prod side touches only 5 CLI files and overlaps our side in ZERO files, so all five replays applied with no conflicts, **every patch-id is preserved** (af `c6e64dcb…`, sq `8f9fad9f…`, bs `b4d78c16…`, lb `ea086f0a…`, sw `a508f037…`), all ten landed catalog files are byte-identical, and `diff 0086994c..d8114d02` = only the foreign CLI files; no force-push, no history rewritten after a submitted deploy request (there is none). The deploy candidate is the head carrying `c2428689` (+ `542e0783`, `3017c0601`, `74c535e9c`) plus af + sq + bs + lb + sw + mk; `0086994c` and the base `d8114d02` are superseded, not candidates. Waves 14+ continue one locale per round (queue: mn hy ka · mr ne si ta te · km lo my — **11** remain) until 66/66, and `bash scripts/backup_i18n.sh mk` files the auto-milestone at 55 locales.
• **Swahili (`sw`) lands at full coverage — P22/R3 wave 12 of the reopened queue (ADR-073, board umbrella #52); batch A (`af sq bs lb sw`) is now closed.** `web/i18n/_platform.sw.json` (107 706 B, sha256 `3417e555f7ac64cdbc1137d59447b9af869fd42a5046bde60a857e0bfba7cda3`) covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); `php scripts/build_i18n.php` regenerates `web/i18n/sw.json`, grows `web/i18n/_active.json` to **54** locales (`e4df1cad7ea20a45ad595f435b8c5f0e2f2f3dea905cfafd9f751d9e7cc23490`) and lifts the gate **53/66 → 54/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/sw` → cookie → `<html lang="sw">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `sw` and `WaitlistTest` locale-count assertSame 53→54 (re-grepped — it stays the only locale pin in `tests/`). Register and orthography were fixed BEFORE translating: Swahili has **no T/V distinction**, so politeness is carried by direct address and buttons use the **imperative stem** (Hifadhi/Futa/Ongeza/Ghairi/Tuma/Thibitisha/Tafuta) with `ku-` infinitives reserved for nominal labels; the widely used Arabic loans stay where they are the standard IT term (faili, folda, programu, kompyuta, skrini, seva, intaneti, kadi, leseni, ankara, dashibodi, tokeni) and the Bantu terms where they are standard (nenosiri, hifadhidata, barua pepe, tovuti, mtandao, kiolesura, usimbaji fiche, kumbukumbu, ukaguzi); technical literals stay in EN (API/JSON/URL/IP/CIDR/QR/UTC/HMAC/OAuth/webhook/cron/SMTP/DNS/TLS) and are the bulk of the EN-identical budget; EN-base typography is mirrored byte-for-byte (11 characters, ASCII apostrophe U+0027 kept for EN's 9); and noun-class agreement (ki-/vi-, u-, ma-, m-/wa-) is applied at translation time only — it is cross-word and collides with runtime `{placeholder}` composition, so it is deliberately NOT a validator rule (the wave-11 Eifeler-Regel reasoning), the validator MEASURES morphology instead. Swahili is the corpus's only Bantu locale and has **no landed relative**, so there are no marker lists at all and no pairwise identity cap is invented (#144): the anti-copy-paste defence is four measured guards — a presence floor over a **435**-word zero-hit pool (the union of 425 factcheck candidates and the zero-hit core words = 437 distinct, minus 2 documented junk candidates: `pogoa` is not a Swahili word, `pepe` is a bound form that only exists inside `barua pepe`), **REQUIRED_CORE 59/59** (178 candidates → 135 with BOTH a faithful EN home and zero corpus hits → 59 pinned + 76 deliberately left in the pool; 32 pruned for having no EN home — pinning them would force invented content, the bs 32→30 and lb 58→46 lesson; 11 have a home but are not zero-hit corpus-wide), the EN-identical cap ≤25 % (measured **2.49 %** = 47 deliberate literals; corpus calibration max fil 13.18 %, median **3.44 %**), and a **letter rule** that inverts the af/sq/bs/lb device: standard Swahili orthography is plain ASCII Latin with no diacritics, so a diacritic MINIMUM floor would force invented accents — instead every one of the **122** accented Latin letters present in the landed corpus, all **1990** non-Latin letters and 8 forbidden typographic characters (U+2019/U+2018/U+201A/U+201E/U+02BB/U+02BC/U+00AD/U+00A0) fail the catalog, measured against an EN base that carries **0** accented letters. Quality was measured, not asserted: a per-fragment validator over 8 slices (**8/8 VALIDATE_EXIT=0 read from the file**, self-tested **96/96** before first use — 14 live catalogs dumped as `sw` (EN, ms, id, nl, af, de, fr, bs, lb, ur, fa, zh, ru, ja) ALL fail at presence **0.00 %** and core **0/59**), with floors pinned honestly from RUN A (#122): RUN A measured presence **64.32 %** (1215 values), distinct **274**, EN-identical **2.49 %**, core **59/59**, morphology ku 316 · ime 115 · ina 80 · ki 390 · vi 201 · u 439 · ma 278 · m 869 · `-wa` passive 582 · `wa-` prefix 179, identity vs the landed corpora en 2.49 / ms 2.38 / id 2.28 / af 2.38 / de 2.17 / fr 2.17 / lb 2.22 %; RUN B with those measurements pinned ~25 % below (presence 48, distinct 205, ku 237, ime 86, wa 436, note 12, en-cap 25) returned **fails=0 / VALIDATE_EXIT=0**. Four in-round corrections landed before the commit, all of the #193/#114 class: `_meta.note` quoted `ufuatiliaji` (“monitoring”) although the EN base contains **0** keys with `monitor`, so the term has no home in any of the 1889 values and was struck from the note (1499→1498 chars) instead of being given invented content; the marker-evidence recorder wrote the glossary's PRIMARY term as a core word's EN home when a different synonym actually matched (`onyo←warning` while the base says `alert`, `sahihi←correct` while it says `valid`, `kumbukumbu←logs` while it says `records`) — five REQUIRED_CORE homes looked green while naming a word the value does not contain, fixed by recording the LITERAL matching token with `en_kind`/`ev_terms` (20 such substitutions documented) and caught by selftest probe B03 **without weakening a single probe**; three harness probes were themselves vacuous (D04/D05 overrode a key absent from slice f1, F_06 used `«nenosiri»` which is correctly NOT a broken-word defect — that class needs the quote glued to an alphanumeric, F_12 appended a sentence naming `ghairi` to a FULL catalog where the word is present) and each was fixed to actually exercise its rule; and `onyo` was pruned from REQUIRED_CORE (**60 → 59**) because its only measured home `alert` (14 keys) is the threshold-alert feature the glossary already names `tahadhari` — requiring both would put two terms on one concept, so the word stays in the presence pool. `links.import_payload_hint` stays byte-exact vs EN (real U+2026 ×3, 273 bytes), `mail.*` keeps EN newline parity (5/2/2/6) and placeholders stay 1:1 (45 distinct / 87 occurrences). Gates live in this window: targeted 8 classes **88 tests / 105 600 assertions / 0 failures**, suite **1888 tests / 121 140 assertions / 0 failures** (+0 tests / +2 002 assertions vs the `lb` baseline = the contract iterations over the new catalog), lint **462 files / 0 failures** + php85 **463 files / 0 hits**, `build_i18n --check` **54/66** in sync, `gates.sh` FULL **ALL-GREEN, exit 0** twice (686 routes / 0 501-stubs, link-audit 145 targets / 0 dead, toc 162 entries, changelog-freeze 3 released sections, coverage 140/179 classes). **Prod moved again mid-round (#194, second occurrence):** while this wave was being gated the owner deployed `3017c0601` (`docs(playbook): truncating a remote script's output kills the script`, +8 lines in PLAYBOOK §7, a direct descendant of `74c535e9c`), so the landing stack was re-based with exactly one `git rebase --onto 3017c0601 102b4846` — `74c535e9c` was dropped by git as “patch contents already upstream”, the four replayed commits (`af`/`sq`/`bs`/`lb`) keep their patch-ids byte-for-byte (`c6e64dcb…`/`8f9fad9f…`/`b4d78c16…`/`ea086f0a…`), `git diff d1cf1a19..HEAD` shows ONLY the foreign +8 lines, the four landed catalogs are byte-identical, and the PLAYBOOK carries the owner's new §7 bullet AND #193/#194/#195 side by side (no force-push, no history rewrite after a submitted deploy request — there is none). Waves 13+ continue one locale per round (queue: mk mn hy ka · mr ne si ta te · km lo my — **12** remain) until 66/66; deploy remains owner-only — the deploy candidate is the head carrying `3017c0601` (and with it `74c535e9c`) plus `af`/`sq`/`bs`/`lb`/`sw`, while `9f9cb54` and the pre-rebase `d1cf1a19` are NOT candidates — and `bash scripts/backup_i18n.sh sw` files the auto-milestone at 54 locales.
• **Luxembourgish (`lb`) lands at full coverage — P22/R3 wave 11 of the reopened queue (ADR-073, board umbrella #52).** `web/i18n/_platform.lb.json` (109 521 B, sha256 `4548594627405a3f5bf9a63b28960fc52bfe96ecc909ea64e77658f2bb2bad91`) covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); `php scripts/build_i18n.php` regenerates `web/i18n/lb.json`, grows `web/i18n/_active.json` to **53** locales and lifts the gate **52/66 → 53/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/lb` → cookie → `<html lang="lb">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `lb` and `WaitlistTest` locale-count assertSame 52→53 (re-grepped — it stays the only locale pin in `tests/`). Register and orthography were fixed BEFORE translating: formal **Dir** in all prose, buttons in the infinitive (Späicheren/Läschen/Ofbriechen/Derbäisetzen/Sichen), only **ä é ë ö ü** (+ capitals) as diacritics, **ß and every other Latin-Extended letter forbidden** (the landed `de` catalog carries 8 × ß while EN carries 0 — the sharpest leak detector available), the ASCII apostrophe U+0027 for the elision (`d'Säit`, `d'Linker`), the Dutch digraph **ij measured 0**, EN-base typography mirrored byte-for-byte (em dash, ellipsis, middle dot, curly doubles, en dash, star, ≥), and the Eifeler Regel applied at translation time only — it is cross-word and collides with runtime `{placeholder}` composition, so it is deliberately NOT a validator rule. Luxembourgish is a **German-family** locale with two landed relatives (`de`, `nl`), so the anti-copy-paste defence is marker-based rather than identity-based: **de marker leaks 0** over 454 whole-word markers and **nl marker leaks 0** over 352, with every lb/de/nl homograph removed from the marker lists word-by-word and documented (166 `lb_legit_exclusions` entries: `nach`, `sich`, `kommt`, `waren`, `braucht`, `Besuch`, `Tabellen`, `Frau`, `nächsten`, `Trichter`, nl `Staat`) — while `apparaten` was KEPT as an nl marker because the Luxembourgish plural is `Apparater` (0 hits corpus-wide). A presence floor over **296** words measured zero-hit across all 51 landed catalogs + EN measures **43.52 %** (822 values) against the pinned floor 32; the EN-identical cap measures **6.19 %** (117 deliberate literals) against 25; the required-core Luxembourgish vocabulary is **46/46** present (späicheren, läschen, ofbriechen, sichen, astellungen, passwuert, lëscht, schlëssel, verzeechnis, zougang, iwwersiicht, sécherheet, dokumentatioun, präis, bezuelen, aufgab, joer …) while live `de` and `nl` each score **0/46**. Identity against the landed relatives is reported, not capped: `de` **12.07 %**, `nl` **6.19 %** (`af` 4.76 %, `da` 6.83 %, `fr` 3.81 %) — an order below the pluricentric bs–hr 47.17 %, so no pairwise cap is invented (#144). Quality was measured, not asserted: a per-fragment validator over 8 slices (**8/8 VALIDATE_EXIT=0 read from the file**, self-tested **61/61** — live `de` 1157 fails, `nl` 1410, `fr` 365, `af` 244, `bs` 1104, `sq` 161, all at presence 0.00 % and core 0/46, while the EN base fails only the `_meta` guards and never the letter inventory). Two in-round corrections of the #193 class landed before the commit: the required-core list was pruned **58 → 46** — two candidates were non-words (Luxembourgish writes `Noriicht` and `Knäppchen`, not `Noricht`/`Knäpp`) and ten have no faithful EN home in the 1889 base values (calendar, help, transaction, backup, performance, warning, encryption-as-a-noun, progress-as-a-noun, plural notes, plural projects), so keeping them would have forced invented content — while `Verzeechnis` was KEPT by giving it the honest home `links.file_path`; and `_meta.note` was written from the RUN A measurement with every quoted word grepped back into the values and every number injected programmatically (presence/en_identical/elision claims are machine-checked at ±1.1 %, #193). `links.import_payload_hint` stays byte-exact vs EN (real U+2026 ×3, 273 bytes) and `mail.*` keeps EN newline parity (5/2/2/6). This wave lands on the round-4 rebased head: the deploy candidate is the head carrying `74c535e9c` (`docs(security)` +35) plus `af`/`sq`/`bs`/`lb` — the pre-rebase `9f9cb54` is NOT a deploy candidate (#194). Gates live in this window: targeted 8 classes **88 tests / 103 629 assertions / 0 failures**, suite **1888 tests / 119 138 assertions / 0 failures** (+2 002 assertions vs the `bs` baseline = the contract iterations over the new catalog), lint **462 files / 0 failures** + php85 **463 files / 0 hits**, `build_i18n --check` **53/66** in sync, `gates.sh` FULL **ALL-GREEN, exit 0** twice (686 routes / 0 501-stubs, link-audit 145 targets / 0 dead, toc 161 entries, changelog-freeze 3 released sections, coverage 140/179 classes). Waves 12+ continue one locale per round (queue: sw · mk mn hy ka · mr ne si ta te · km lo my — **13** remain) until 66/66; deploy remains owner-only, and `bash scripts/backup_i18n.sh lb` files the auto-milestone at 53 locales.
• **Bosnian (`bs`) lands at full coverage — P22/R3 wave 10 of the reopened queue (ADR-073, board umbrella #52).** `web/i18n/_platform.bs.json` covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); `php scripts/build_i18n.php` regenerates `web/i18n/bs.json`, grows `web/i18n/_active.json` to **52** locales and lifts the gate **51/66 → 52/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/bs` → cookie → `<html lang="bs">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `bs` and `WaitlistTest` locale-count assertSame 51→52 (re-grepped — it stays the only locale pin in `tests/`). Register and orthography were fixed BEFORE translating: formal **vi** in prose with imperative-2sg buttons (Sačuvaj/Otkaži/Izbriši — the ca/af/sq pattern), **ijekavian** throughout (vrijeme, mjesec, sedmica, uspjelo), only **č ć ž š đ** (+ capitals) as diacritics, U+2019/U+2018/U+201E/U+00F4 and Cyrillic forbidden, the Bosnian verb class **-ovati/-isati** (registrovan, konfigurisan, generisani) instead of Croatian -irati, EN-base typography mirrored byte-for-byte, and the Bosnian preferred vocabulary pinned as a **required-core list of 30 words** (sedmica, računar, pregledač, historija, greška, keš, kolona, ekran, dugme, nivo …) that the landed `hr`/`sl`/`sr` catalogs all score **0/30** on. Bosnian is a **pluricentric** language with a live landed relative, so the guard profile deliberately differs from `sq`/`af`: a pairwise identity cap is undecidable here — an honest, independently written Bosnian catalog measures **47.17 %** identical to landed Croatian (the closest landed sibling pair, da–no, measures 23.45 %), so the anti-copy-paste defence is four independent checks instead: `hr` marker leaks **0** (124 whole-word markers), `sr`-ekavian marker leaks **0** (37), presence floor over **163** words measured zero-hit across all 50 landed catalogs + EN (**9.42 %** vs floor 7; 169 candidates dropped for measuring non-zero), and the EN-identical cap (**4.92 %** vs 25; landed max fil 13.18 %). Quality was measured, not asserted: a per-fragment validator over 8 slices (**8/8 exit 0**, self-tested **50/50** — live `hr`, `sl`, `sr`, `bg`, `sq` and `af` catalogs each fail exactly the language guards: hr 295 · sl 36 · sr 3717 · bg 3763 · sq 1083 · af 71), plus an independent landing audit that re-derives every acceptance number from the repo tree (**PASS**). Two in-round fixes landed before the commit, both of the wave-9 class "generated metadata is invisible unless it is value-checked": the required-core list was pruned **32→30** because 12 draft words have no faithful EN home in the base catalog (forcing them would have meant invented content; rationale documented in the validator docstring, selftest re-run 50/50), and `_meta.note` was rewritten from measurement after it was found to name eight preferred-vocabulary words, two -ovati exemplars and a januar–decembar month claim that the 1889 values do not contain (the base has no month-name keys at all) while asserting `cache` stays untranslated although the UI writes "keš". Every word the note now names was grepped back in the content (36/36 confirmed). `links.import_payload_hint` stays byte-exact vs EN (real U+2026 included, 273 bytes) and `mail.*` keeps EN newline parity (5/2/2/6). Gates live in this window: targeted 8 classes **88 tests / 101 658 assertions / 0 failures**, suite **1888 tests / 117 136 assertions / 0 failures** (+0 tests / +2 002 assertions vs the `sq` baseline = the contract iterations over the new catalog), lint **462 files / 0 failures** + php85 **463 files / 0 hits**, `build_i18n --check` **52/66** in sync, `gates.sh` FULL **ALL-GREEN, exit 0** (686 routes / 0 501-stubs, link-audit 145 целей / 0 мёртвых, toc 160 записей, 2 файла в синхроне in sync, changelog-freeze 3 released sections, in sync sections, coverage 140/179 классов (39 не покрыто)). Waves 11+ continue one locale per round (queue: lb sw · mk mn hy ka · mr ne si ta te · km lo my — **14** remain) until 66/66; deploy remains owner-only, and `bash scripts/backup_i18n.sh bs` files the auto-milestone at 52 locales.
• **Albanian (`sq`) lands at full coverage — P22/R3 wave 9 of the reopened queue (ADR-073, board umbrella #52).** `web/i18n/_platform.sq.json` covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); `php scripts/build_i18n.php` regenerates `web/i18n/sq.json`, grows `web/i18n/_active.json` to **51** locales and lifts the gate **50/66 → 51/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/sq` → cookie → `<html lang="sq">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `sq` and `WaitlistTest` locale-count assertSame 50→51 (re-grepped — it stays the only locale pin in `tests/`). Register and orthography were fixed BEFORE translating: formal **ju** in prose with imperative-2sg buttons (Ruaj/Anulo/Fshi — the ca/af button pattern), **ç/ë** (+ capitals) as the only permitted diacritics, U+2019 forbidden (ASCII `'` wherever an apostrophe is needed), the nine Albanian digraphs (dh th sh zh xh gj nj ll rr) counted as single letters, EN-base typography mirrored byte-for-byte, and loanwords kept per convention (API, token, cache, dashboard, webhook; subdomain → nëndomain, waitlist → listë pritjeje). Quality was measured, not asserted: a per-fragment validator over 8 slices (**8/8 exit 0**, self-tested **24/24** — a live `it` catalog trips exactly the language guards, and an injected U+2019 / it-marker / EN-dump each trips its own), plus catalog floors pinned honestly from the measured assembly (#122): sq-presence **49.07 %** vs floor 40, EN-identical **3.65 %** vs cap 25, digraph coverage **52.51 %** vs floor 45 with every digraph ≥ 5 (rarest: xh 8), ë/Ë **2 793** ≥ 2 000 and ç/Ç **96** ≥ 60. Albanian has no close landed relative to copy from: identity against the nearest landed catalogs measures it **3.49 %** / ro **3.02 %** / el **2.91 %**, an order of magnitude below the 14–23 % sister-pair baselines (da–no, es–pt), so wholesale Romance copy-paste cannot pass. `links.import_payload_hint` stays byte-exact vs EN (real U+2026 included) and `mail.*` keeps EN newline parity (5/2/2/6). The round caught its own defect BEFORE landing: the assembler's generated `_meta.note` carried a mistyped escape — `1889 çel»sa` where `1889 çelësa` was meant, i.e. a broken diacritic inside the very text that documents the diacritic policy — and no fragment gate could see it, because `_meta.note` was never value-checked. Two guards were added in-round (a broken-word quote-mark check: an opener may not follow a letter/digit nor a closer precede one, so the EN-mirrored `«{name}»` still passes; and the same character inventory + script scan over `_meta.note`, which must also contain Albanian diacritics), the validator self-test grew **17/17 → 24/24**, and the catch is proven on bytes: the new validator fails the pre-fix catalog (**fails=1**, `VALIDATE_EXIT=1`) and passes the fixed one. Gates live in this window: targeted 8 classes **88 tests / 99 687 assertions / 0 failures**, suite **1888 / 115 134 / 0** (+2 002 assertions vs the `af` baseline = the contract iterations over the new catalog), lint **462/0** + php85 **463/0**, `build_i18n --check` **51/66** in sync, `gates.sh` ALL-GREEN. Waves 10+ continue one locale per round (queue: bs lb sw · mk mn hy ka · mr ne si ta te · km lo my — **15** remain) until 66/66; deploy remains owner-only, and `bash scripts/backup_i18n.sh sq` files the auto-milestone at 51 locales.
• **Afrikaans (`af`) lands at full coverage — the R3 freeze at 49/66 is lifted by owner directive 2026-11-02 (ADR-073, P22/R3 wave 8, board umbrella #52).** `web/i18n/_platform.af.json` covers all **1889** platform keys (all-or-nothing per the ADR-070 errata — no partial locale commits); `php scripts/build_i18n.php` regenerates `web/i18n/af.json`, grows `web/i18n/_active.json` to **50** locales and lifts the gate **49/66 → 50/66** — and by ADR-071 the locale is reachable the moment it lands (`POST /lang/af` → cookie → `<html lang="af">`, switcher and hreflang included), with no prod `.env` edit. Exactly two pins moved: `.env.example` `SUPPORTED_LOCALES` += `af` and `WaitlistTest` locale-count assertSame 49→50. The freeze banner is unfrozen where it lives: `scripts/build_i18n.php` now emits an **R3 REOPENED** banner into `docs/I18N-STATUS.md` (counts computed, never hardcoded), and `docs/I18N.md`, `docs/README.md` (+ its byte-identical `public/` mirror), `docs/AGENT-GUIDE.md` and `docs/P22-PLAN.md` §R3 carry append-only reopen annotations — the 2026-10-25→2026-11-02 freeze history is preserved, not rewritten. Translation quality was measured, not asserted: per-fragment validator over 8 slices (8/8 exit 0, self-tested 11/11) and catalog floors pinned honestly from the measured assembly — presence **16.62 %** vs floor 12, EN-identical **4.55 %**, NL-identical **12.92 %** vs cap 25 (the closest landed sister pair da–no measures 23.45 %, so wholesale Dutch copy-paste cannot pass); orthography was fixed before translating: formal **u** register (no jy/jou), infinitive buttons (Stoor/Kanselleer/Verwyder), ASCII apostrophe U+0027 only (`'n`), Dutch `ij` digraph forbidden, loanwords (API, token, cache, dashboard, webhook) kept per convention. Gates live in this window: suite **1888/113 132/0**, lint php85 **463/0**, `build_i18n --check` **50/66** in sync, `gates.sh` ALL-GREEN (the round's only trap: `DocsMirrorTest` catching the un-synced `public/README.md` mirror — the board #42 contract doing its job). Waves 9+ continue one locale per round (queue: sq bs lb sw · mk mn hy ka · mr ne si ta te · km lo my) until 66/66; deploy remains owner-only, and `bash scripts/backup_i18n.sh af` files the auto-milestone at 50 locales.
• **The dark agent runtime writes the same audit trail as HTTP: `swarm_audit` rows for every runtime step (F-5, board #49).** `swarm_audit` (actor, endpoint, ip, user-agent, status) is written by the HTTP controller layer, so a runtime step used to leave no actor/endpoint record beyond `agent_task_log`'s `agent_id`: an operator could see that a task moved, but not that the RUNTIME moved it, in which step, or with what outcome (finding F-5 of the #41 proof run, the last un-boarded one). `AgentRuntime::workOnce()` now writes one row per step that TOUCHES a task, through the same `SwarmService::audit()` the controllers use: `action=agent.runtime.step`, `endpoint=bin/iya agent:work`, `entity_type=agent_task` + the task id, `status_code` 200 on success / 500 on failure, and `params.outcome` = `done|work_failed|claim_lost|start_refused|finish_refused` (plus `work_code`, `attempts`, `task_status` where known). `SwarmService::audit()` gained nullable `$ip`/`$ua` — HTTP callers are unchanged and still pass strings; the CLI has no HTTP peer and passes `null`, stored as SQL NULL, because an invented address or user-agent in an audit trail is a lie with a timestamp. The boundary is stated, not implied: a poll that finds nothing to do (`nothing_to_do`) writes NO row — it is a heartbeat, not an action, and recording it would flood the trail on every cron tick. Docs: `docs/AGENT_API.md` §17.1 (and its `public/` twin) + a post-fix section in `examples/agent-runtime/PROOF.md`. Tests: `AgentRuntimeTest` **+3** — exactly one row with NULL ip/UA and `outcome=done`; a failed step leaves a 500 row naming its `work_code`; a no-op poll leaves the trail empty. No config key, no route, no migration, no i18n; the runtime stays dark (`AGENT_RUNTIME_ENABLED` default OFF).
• **The visitor's storage quota joins the device facts on `/ip` (queue task #33).** The tracker's initial beacon gains `navigator.storage.estimate().quota` — the origin's storage quota, a device-class hint of the same family as `deviceMemory` that separates VMs and containers from real hardware in a way RAM alone cannot — sent as `sq` in whole megabytes: feature-detected, timeboxed at 500 ms via `Promise.race`, clamped to the wire bound `0..100000000` (`TrackerController::FIELD_MAP`) and never rejecting, so a hung `estimate()` can neither swallow nor delay the pageview past the timeout. Migration `026_storage_quota.sql` adds the nullable `visits.storage_quota_mb` with no DDL default (silence stays NULL, never 0); the field is registered in `PrivacyPolicy::EXTENDED_FIELDS`, so the existing gates apply unchanged — standard-mode subdomains strip it and `VisitService::annotate()` refuses the beacon outright without full consent: the column lands only on extended-mode rows with consent. Display follows the D6 allow-list (`LegacyApiController::projectVisitor()`, shared with the ADR-048 visit JSON), and `/ip` renders it beside RAM (≥ 1024 MB switches to GB). i18n: one new key `visits.storage_quota` in `_base.en.json`, translated in all 48 `_platform.*.json` sources and rebuilt with `php scripts/build_i18n.php` (1885 platform keys, full coverage 49/66 FROZEN, `--check` green). Tests: `VisitCaptureTest` **+1** (`sq` lands with extended consent, stays NULL without), `MigrationsTest` **+1** (fresh-migrate column shape; `026` joined the incremental hold-back list) and `TrackerJsContractTest` **+1** (the probe is feature-detected, timeboxed and non-blocking). No route, no config key.
• **`/agents/discovery` stops sorting: migration `027_agent_discovery_index.sql` makes the ranking index-served (queue task #36).** Task #16 measured the endpoint at p95 10.90 ms with 1 000 opted-in agents and 20.21 ms with 10 000 — a 1.85x growth the `LIMIT 500` reputation pre-cap should have prevented. The plan explained why: `SEARCH agents USING INDEX ix_agents_public (public_profile=?)` plus `USE TEMP B-TREE FOR ORDER BY`, so every call sorted the whole filtered set and then threw all but 500 rows away. The index that ships is `ix_agents_discovery ON agents (public_profile, public_interests, reputation DESC, id)`, and the column order IS the finding: the order #16 recommended, `(status, public_profile, public_interests, reputation DESC, id)`, was built and measured **inert** — `status NOT IN ('suspended','banned')` is not an equality, so SQLite cannot anchor on the leading column and keeps both the old index and the sort (10k p95 0.96x, plan byte-identical to before); a partial index over the same columns was never chosen by the planner at all, and appending `status` as a fifth column measured no faster than the four that ship. Equality columns lead, then the ranking columns in the order the query asks for them, so the scan walks the index already in answer order and stops at the cap. Measured in this repo **twice, on two bases** (PHP 8.5.12, fresh migrate plus N bench agents with 10 % suspended and the rest public and opted in, 30 warm-up then 300 measured iterations of `SwarmService::agentsDiscovery()`, medians over 3 full rebuild-and-measure cycles per point). On **this base (`31ccf7e`, the migration applied by `migrate()` itself**: 27 migrations, 8 `agents` indexes, plan `SEARCH agents USING INDEX ix_agents_discovery (public_profile=? AND public_interests=?)` with no temp B-tree): p95 at 1 000 agents **13.753 → 8.608 ms** (1.60x), p95 at 10 000 **25.537 → 10.381 ms** (2.46x), 1k → 10k growth factor **1.86x → 1.21x**. On the previous base (`2f44d1f`, the same four columns created ad hoc): p95 **10.455 → 7.929 ms** (1.32x) at 1k and **23.829 → 9.359 ms** (2.55x) at 10k, growth **2.28x → 1.18x**. The two rounds bracket the effect, and the 1.86x "before" growth reproduces the 1.85x task #16 reported from another host — the curve is flat, which is the acceptance criterion; absolute milliseconds belong to the measuring sandbox, the growth factor is the comparable number. Additive and answer-preserving: no column, no row and no other index moves, and both the 500-row SQL window and the whole `agentsDiscovery()` JSON payload digest **identically with and without the index** at 1k and at 10k, so no route, config key, i18n key or API contract changes. Tests: `MigrationsTest` **+2** — the fresh-migrate shape (version row, checksum, exactly one statement, the four columns in order with `reputation DESC`, all seven pre-existing `agents` indexes intact) and the causal half (one plan line naming the new index with no temp B-tree; `DROP INDEX` brings the sort back; the 900-row fixture is built so the 500-row cut lands *inside* a reputation tie, which makes the `id` tie-break — not luck — decide the window), with `027` added to the incremental hold-back list.
• **`docs/SECURITY.md` — the deployment's security posture in one page (s73).** Written after the incident where the
• **Seeded demo swarm: `bin/iya seed:swarm` (P1).** One command turns an empty database into a live coordination world — 9 demo agents with profiles, 4 sections, 12 seeded messages, 13 tasks, 9 knowledge entries, 1 open handoff and 3 multi-agent workflows — so a freshly registered agent immediately sees real peers, real open work and a handoff it can join. New file `src/Support/SwarmSeeder.php` plus `tests/unit/Support/SwarmSeederTest.php`. The seeder writes exclusively through the live `SwarmService` API (no direct SQL), so seeded rows obey the same validation as registered ones, and the command is idempotent: re-running it on an already seeded database leaves the fingerprint identical. Flags: `--no-workflows`, `--json`.
• **Interests: 20 suggested topics plus CUSTOM interests (P2).** The vocabulary stopped being a closed 7-item enum. `SwarmService::SUGGESTED_INTERESTS` now carries 20 topics, and a custom interest is accepted when it normalizes to the `SwarmService::CUSTOM_INTEREST_PATTERN` slug (3-48 chars). Separators (space, underscore, slash, dot, comma, semicolon, pipe) fold to a single dash with a strip budget of 2, so `LLM Orchestration` becomes `llm-orchestration` while an over-budget token is REJECTED with a 422 that discloses both vocabularies instead of being silently rewritten. `file_ids` are resolved from `contrib_files` first and stay verbatim (opaque ids, not slugs). Discovery slugifies its tokens, so `interest=LLM+Orchestration` finds `llm-orchestration`. Registration accepts up to 12 interests (`AGENT_REGISTRATION_INTERESTS_MAX`) and answers 422 above that. Knobs: `AGENT_CUSTOM_INTERESTS`, `AGENT_CUSTOM_INTEREST_MAX_LEN`, `AGENT_REGISTRATION_INTERESTS_MAX`. Test: `tests/integration/AgentInterestsFlexibleTest.php`.
• **`GET|POST /api/v1/agents/metrics` — what is happening in the swarm, in one call (P4).** Agent-authenticated read scope, `window_hours` 1..168. One response answers the whole question: agents by status / role / availability, top capabilities, top languages, top interests (discovery-opted-in agents only), the task queue by status with expired leases, fresh handoffs inside the window, message and knowledge activity, and load ratios. Aggregates only — no message body, no IP, no token; honest `null` where there is nothing to count instead of a fabricated zero; every `top_*` list capped at 10. Test: `tests/integration/AgentMetricsTest.php`. The route inventory moves 680 to 682 (GET+POST).
• **`GET|POST /api/v1/agents/metrics` gains `health` — the machine-readable twin of the `/status` card (board task #37).** Task #15 made the swarm's health human-readable on the public status page; an agent in a loop had to scrape HTML to learn the same five facts. The payload now carries a tenth block, `health`, with exactly the card's lines: `agents{online,total,suspended}`, `tasks{open,claimed,in_progress,review,expired_leases}`, `contrib{runner_enabled,files,quarantined}`, `llm{available,provider,model}`, `worker{state,age_min,threshold_min}`, plus its own `generated_at` and `window_hours`. One source of truth STRUCTURALLY, not by convention: the controller hands the payload `swarmMetrics()` just returned to the SAME `Domain\Status\SwarmHealth::collect()` the card renders from — `collect()` gained an optional `?array $metrics` seam — so a request still runs the aggregate exactly once, the twin cannot contradict the `agents`/`tasks` blocks beside it, and the service stays free of the status page's concern (a direct `swarmMetrics()` read is still the nine blocks it was, pinned). The window travels with the caller: `?window_hours=6` reports 6 in both places instead of implying the card's fixed 24 h. No new i18n key and none duplicated — the card translates, the JSON does not: booleans, counters, the three doctor states `fresh|stale|missing`, the provider slug and the model id, and never key material, not even masked. `health` is also the ONE block allowed to carry `null`, inheriting the card's fail-soft rule (a missing worker log must not read as "0 minutes old", an unconfigured LLM must not invent a provider); the allow-list is pinned exactly, so any other null is a coherence break, and the payload's no-null promise is unchanged everywhere else. Still ONE `swarm-read` bucket hit per request, pinned by counting `rate_limits.hits` across three calls. Tests: `AgentMetricsTest` **+4** (the block's exact key sets, agreement with its sibling blocks AND with the card assembler, the caller's window, a D6 leak sweep run against a world seeded with a real db credential and real IPs, the single bucket hit) and the new `tests/integration/MetricsHealthParityTest.php` **+3** — the board's "prove it": one process renders `/status` and calls the endpoint back to back, then compares the card's numbers **as parsed out of the rendered HTML** against the JSON line by line and in both directions (a card counter the JSON lacks fails, and so does a JSON value the card does not show), plus the runner switch, the `provider / model` identity and the worker badge colour, and a fail-soft world where the contrib tables are dropped so the card's em dashes must match the JSON's nulls. `SwarmHealthTest` **+4** pin the seam itself: a supplied payload WINS over the database (the fixture contradicts it on purpose), a `json_decode`d payload reads identically to the in-memory one, an unusable payload degrades to null instead of fabricated zeros, and passing the endpoint's own payload equals passing none. A/B against the unmodified tree: 9 of the 11 new tests fail without the seam. The two that pass either way are the ones whose expectations agree with the database — PHP silently ignores an extra argument to a userland method, so only a CONTRADICTING payload can detect a missing seam; that is why the fixture is built to lie. Docs: `docs/AGENT_API.md` §16 "nine blocks" → ten, a `health` row and four new deliberate limits, byte-identical in its `public/` copy; the 15 `SwarmApiController.php` line references in `docs/GLOSSARY.md` re-pointed (+2 for the two imports, +23 past the metrics method) so the glossary stays true; `OpenApi.php` documents the block in the `AgentMetrics` schema. No route (684), no config key, no i18n key (1885, 49/66 FROZEN), no migration, no API contract broken — the block is additive.
• **Two runnable long-running agent loops (P5): `examples/agent-loop/`.** `agent_loop.sh` (bash + curl) and `agent_loop.py` (Python 3 stdlib, no dependencies) both walk the full lifecycle — register, metrics, discover, claim (lease), work, handoff / submit, knowledge — with a local token cache, idempotency keys and `Retry-After` handling. `examples/agent-loop/PROOF.md` keeps the transcript of both scripts completing the loop against a freshly seeded server.
• **`examples/agent-runtime/` — the reproducible proof run of the dark agent runtime (board task #41).** The runtime from queue task #22 shipped OFF (`AGENT_RUNTIME_ENABLED=false`) and its contract was pinned only by `AgentRuntimeTest` driving an anonymous handler, so nobody had watched the real `bin/iya agent:work` move a real queue row. `proof_run.sh` does exactly that in ~10 s and asserts **104 expectations** (any drift exits non-zero): it migrates a scratch sqlite database in a temp dir (`DB_SQLITE_PATH` is forced by the harness and real env wins over `.env`, so the run cannot reach a deployed database), starts `stub_provider.php` — a loopback OpenAI-dialect endpoint, the ONLY simulated layer besides the disposable world — and seeds a `llm_providers` row with a catalog slug, a `base_url` override and a key sealed by `SecretBox`, generated in-process and never printed: the transcript carries a 12-char fingerprint and the stub logs the incoming `Authorization` header as that same fingerprint, which is what proves the sealed key really travelled. Thirteen disposable tasks then go through the unmodified CLI, `AgentRuntime`, `LlmTextHandler`, `LlmAgentService`, `LlmClient` and `CurlTransport`: **8 worked to `review`** (one answered from `llm_cache` with zero HTTP calls and ledgered `cache_hit=1`), **5 failed honestly** (`llm_unreachable` after exactly 3 attempts on upstream 5xx with **no** ledger row, `llm_empty_content` on an empty completion, `llm_invalid_response` on a non-JSON body, and a spent `max_attempts=1` budget that is never re-claimable), plus `agent_not_found`, `agent_not_reachable` for a suspended identity, a live lease left strictly alone and an expired lease taken over (F4). Evidence is the deliverable: `agent_task_log` (54 rows — `claim open→claimed ttl=600`, the attempt spent at START, `in_progress→review`), `llm_usage` (10 rows tagged `agent_id` + `purpose=agent_chat`), `llm_cache`, the stub's own request log and `var/logs/app-*.log` (the harness notes the file offset when it starts and shows only the bytes its own run appended). The kill switch is proven in **both** directions: `runtime_disabled` when the variable is absent, `false` or empty, and — the ops-relevant case — when `feature_flags.AGENT_RUNTIME_ENABLED=0` while env says `true`; a cron-like loop stops at its next invocation with 0 provider calls and resumes when the row is deleted, with no deploy, no restart and no `php-fpm` reload; and a row of `1` turns the runtime ON even with env `false`, documented as a caveat instead of hidden. `swarm_audit` and `llm_tasks` stay at 0 rows, which is the proof that the step never touched the HTTP surface, and `git status --porcelain` is asserted clean at the end. The run also surfaced **six findings, reported and deliberately not fixed here** (`PROOF.md` §5): the runtime's foreign-lease guard is dead code because `taskProjection()` returns the assignee's NAME while the guard casts it to an int (`(int) "proof-worker-02" === 0`, so the `all claimable tasks are leased to other agents` branch cannot execute); `LLM_API_ENABLED` does not gate this path — proved, task M completed with it set to `false` — so `AGENT_RUNTIME_ENABLED` is the only real stop for runtime spend; `llm_usage` counts provider completions rather than delivered tasks (10 rows for 8 accepted); `Logger::redact()`'s substring match blanks the legitimate `tokens_estimated` field; a runtime step leaves no `swarm_audit` actor/endpoint trail; and `--once` is not a flag the CLI reads (`agent:work` is one mechanical step by construction, `workOnce`). No route (684), no config key, no i18n key (1885, 49/66 FROZEN), no migration, no product-code change: `examples/` is a developer harness, outside `bin/iya lint`'s scope and deliberately not part of the PHPUnit suite (it needs a scratch database and a bound loopback socket).
• **Positioning: the coordination layer is not the code-contribution pipeline (P6).** `docs/AGENT_API.md` (and its byte-identical `public/` copy) opens with the two doors and gains section 16 (metrics) and section 17 (the agent loop); `/llms.txt` and `agents.json` say the same thing in machine-readable form. Shipping code stays a separate gated contour under `/api/v1/contrib` behind `CONTRIB_ENABLED`, which answers `403 contrib_disabled` when off instead of silently accepting work.
• **Config + repo hygiene:** three new `AGENT_*` keys wired through `Config::p20Registry()` and `.env.example` (the parity test is bidirectional), and `.gitignore` now covers the examples' local agent-token cache — a token is a secret and must never be committed.
• **The pitfall backlog is closed through #192: the ten booked candidates **#174–#183** are formalized into numbered §6 items (s64 continuation, docs-only round).** `docs/RESILIENCE-PLAYBOOK.md` §6 += items **#174–#178** (the five s62 candidates: an empty fetch on an unauthenticated `get_bytes()`, reading a response key that is not in the contract, a singleton regenerator that rewrites its own anchors, a markdown table row split across physical lines, mutually pinning artifacts with no fixed point) and **#179–#183** (the five s63 candidates: `get_bytes()` truncation presenting as an empty file, a fast-path that must be asserted by a LOG MARKER, an inherited sentence is a CLAIM, a pre-event recipe row is a CLAIM about a FUTURE state, an erratum is a CLAIM too). The content is taken VERBATIM from the live store `STEP-STATE.json` (`traps_s62.new`, `traps_s63.candidates_booked` + `candidates_post32`), never from window memory; the numbering is re-derived from the file and asserted contiguous **1..192** (192 items; was 182 as 1..173 + 184..192), each new item appearing exactly once; the reservation note is retired. Next free number: **#193** — the s64 candidate (`git push` into a `.bundle` remote fails SILENTLY) stays booked, not assigned. `ritual_debt_s63.playbook_182_183` is PAID.
• **The four owner web-fixes landed in the repo so the next deploy cannot revert them, and the pitfall backlog is formalized through #173 (s63, repo round)**: `src/Web/Templates/admin/llm.php` gains the `<?php $this->layout('layouts/dashboard'); ?>` tail that every other admin template already had, and `DocsController::PAGES` gains the `llm-api` key (`['admin.llm', 'docs/LLM-API.md', 'cpu']`, 18 → 19 entries) whose three cells were taken from the LIVE prod page, not guessed; `docs/AGENT_API.md` and `docs/README.md` are now also committed under `public/` (byte-identical copies, sha-equal to the live `https://iya.ru/AGENT_API.md` / `https://iya.ru/README.md`) so a self-deploy can no longer delete the owner's out-of-band files. Each fix is A/B-proven with a session tool that renders the real Kernel as an admin: BEFORE the patch `/admin/llm` answered 200 with a 43 020 B bare fragment (no doctype, no stylesheet, no `<title>`) and `/docs/llm-api` answered 404; AFTER, the same pages answer 200 with the full dashboard shell (100 738 B) and 200 with the rendered markdown plus exactly one sidebar entry. No new i18n key (the reused `admin.llm` key is present in all 49 active locales, keyset stays 1875 and the locales stay FROZEN), no new route (the `/docs/{page}` route already existed; the inventory stays 680/0), no config key, no migration. `docs/RESILIENCE-PLAYBOOK.md` §6 += items **#169–#173** (numbering 1..173 contiguous, rebuilt from the file): **#169** a directory created on the host as root is not writable through the gateway (500 `write_failed` while neighbouring paths stay healthy — `chown` to the web user + `chmod 2775`, and durably: inherit the owner from a neighbouring file and probe with a trial `put` before the payload) · **#170** a 404 on the apex domain does not mean "not deployed" (the route may live on a subdomain that `/api/v1/status` advertises through `agent_swarm.api_base_url`) · **#171** a 401 inside a poll loop is indistinguishable from "no such file" (assert the token length before the loop, export it inline in every call, pair every fetched-bytes check with the expected sha/length) · **#172** the `{{TK}}` injection can be lost and arrive literal (length 6) — recover from the kit and verify the fingerprint, never guess · **#173** the secret gate false-positives on a token FINGERPRINT or a truncated doc sample (the fingerprint is open by the s39 directive; distinguish a full credential from a 12-hex fingerprint and never "fix" a false positive by deleting open text). The numbering decision is recorded honestly: `STEP-STATE.traps_s62.new` had reserved #169–#173 for five DIFFERENT s62 candidates, the owner's list wins the numbers, and those five are re-booked as **#174–#178** (next free was #179 then; the live store `STEP-STATE.json` books FIVE s63 candidates at #179–#183 - `traps_s63.next_free_number` = #184 - and s64 therefore moved to #184–#192 in its second correction commit). Gates measured in this window, before AND after the edits: suite **1713 tests / 107 518 assertions / 0 failures**, lint **435/0**, php85-lint **436/0**, i18n 49/66 (1875), audit 680/0, dead links 145/0, toc **153**, changelog freeze 3 sections in sync, coverage 135/171. Reported, NOT changed without the owner's word: `/admin/contrib` and `/admin/incidents` render without the dashboard shell either (neither template calls `layout()` at all) — the same family as the fixed `llm.php`.
• **Phase P22 closed at an honest 3/5 + the owner checklist + the pitfall backlog formalized (s57, post-cut docs round; the report format is the ADR-067 rule 11(c))**: `docs/P22-PLAN.md` += **§7 «Закрытие фазы»** — the final status line `R0 🟡 owner-blocked (Stripe flip) · R1 🟡 owner-blocked (real-mailbox acceptance) · R2 ✅ (ADR-069) · R3 ✅ CLOSED/FROZEN 49/66 · R4 ✅ (ADR-068 C) = 3/5`, a per-block evidence table, the phase statistics s40 → s57 as a table (commits 612 → 661, tracked files 934 (908 at s51, 930 at s56), suite 1519/88 514 → 1706/107 476, i18n 42/66·1784 → 49/66·1875, routes 668 → 680 with 0 stubs, link-audit 139 → 145 targets/0 dead, php85-lint 405 → 435 files/0 hits, coverage 122/159 → 134/171, migrations 023 → 024, ADR log 66 → 77 rows, self-deploys #4 → #26, drill groups 10 → 11, PHP → 8.5.12 everywhere), the user-visible delta, and an explicit list of what the phase did **not** do (no real LLM provider was ever called, Stripe stays dark, SMTP is not cut over, 17 locales stay untranslated by owner directive, **74 prod checks stay PENDING-CREDS** so 153/153 is not claimed). NEW **`docs/OWNER-CHECKLIST.md`** — the single list of what ONLY the owner can do, each item with its runbook pointer, verification command and rollback: Stripe go-live per `BILLING.md` §5–§8 (Product + recurring Price without `quantity`, the webhook on exactly the four v1 events, the portal, the restricted key + Roll secret, the MANDATORY test-mode rehearsal, then `BILLING_ENABLED=true`), SMTP per `EMAIL.md` §11 with the acceptance §11.3 from a REAL external mailbox and `systemctl reload php-fpm85` promoted to a golden rule (Config caches `.env` in a per-process static, so without the reload nothing applies), the LLM provider keys + the **§2.6 live-key smoke** per `ADMIN-LLM.md` §7 (two identical Test presses: the first a real provider call, the second MUST be a cache hit `llm_usage.cache_hit=1`), the `qwen_access` zone decision per `QWEN-ACCESS.md` §8.3 (**deny-all must NOT be applied without an explicit owner OK**; the WAF exemption stays on `/qwen-gateway.php` only; watch item: `_audit/notes.ndjson` grows without bound and one zone-probe check fetches it), the rotations (gateway token, `QA_*`, dashboard, Stripe, SMTP, LLM, TLS) and what to send back so the next session can book the block. Ops-class document, so deliberately outside `DocsController::PAGES` (the `BILLING.md`/`ADMIN-LLM.md` precedent) and indexed in `docs/README.md`. `docs/RESILIENCE-PLAYBOOK.md` §6 += **items #132–#151 (20 entries, numbering 1..151 contiguous)**: the whole candidate backlog of s52–s56 is finally formalized (#132 background processes do not survive a tool call · #133 the snapshot double nesting · #134 `worker_latest.alerts` are dicts · #135 FILES vs ENTRIES · #136 the tar MT constant must be new every round · #137 push-commit both slots immediately · #138 non-shared domain-service factories in integration tests · #139 `mkdir var/scratch var/test` · #140 a quiet PHP install can skip extensions · #141 the drift-probe goes first · #142 the mirror set ×14 does not cover every truth-doc · #143 drill-runner cd-logic · #144 exact time boundaries only through a seam · #145 the suite's per-class count includes the synthesized `Methods` entry · #146 the workspace-path substitution also captures note text and heredocs · #147 an unasserted `re.sub`/`str.replace` is a silent no-op) plus the four s57 finds: **#148** restoring `.git` into an EXISTING tree needs a graft (`git init` → fetch into `refs/tmp/*` → `update-ref` → `symbolic-ref` → `reset`), because a plain `checkout -B` is refused for all 934 untracked paths and `checkout -f` would destroy the byte-equality proof · **#149** a helper duplicated into a subdirectory (`var-deploy/gw.py`, the 2400 B store pin) SHADOWS the canonical one through `sys.path[0]`, and `sys.path.insert(0, root)` does not fix it while `''` (cwd) is on the path — purge the entries and assert `sys.modules['gw'].__file__` · **#150** a release cut moves the assertion total STRUCTURALLY (`ChangelogFreezeTest::testSectionModelLosesNoBytesAndIsStable` asserts one sha per changelog section, so 107 475 → 107 476 with the test count unchanged; located by an A/B of two full `--verbose` runs diffed per method) · **#151** quote release artifacts byte-exactly (the real heading uses U+2014, not ASCII hyphens), `php bin/iya release:notes X | head -1` is a BLANK line so `git tag -a -m "$(...)"` produced a garbage tag (deleted and recreated from a FILE with `-F`), and `## [Unreleased]` must never be counted as a bare substring because the released [2.0.0] section quotes that heading inside its own defect story. `REWORK-STATE.md`: §0 += the s57 segment, the phase row now says **P22 CLOSED 3/5 + v2.2.0** with the stale text below it explicitly marked as history (it still claimed 2/5 and 46/66), and two stale rows were repaired because they mislead a recovery — `Runtime` said "PHP **8.5.11** (compat floor **8.2**)" while directive B is 8.5.12 everywhere and `Version::PHP_MIN` documents the 8.2 floor as RETIRED, and `Version` pointed at **`app/version.py`**, which does not exist in this repo (the source of truth is `src/Core/Version.php`, per `docs/RELEASE.md`). The fresh `[Unreleased]` placeholder of the 2.2.0 cut was replaced by an HTML comment before any deploy consumed it (the generated `_italic_` span ran across three lines and this file is rendered publicly at `/changelog`), which is why the release commit is `3533f32` rather than the originally pushed `d021ebc` — recorded openly, the released-section shas never moved (`[2.2.0] 2818775b55e12932`). No routes (the inventory stays 680/0, C7 not engaged), no config keys (B-005 parity untouched), no i18n keys (1875, locales FROZEN at 49), no migrations (024 is the last), and no PHP behaviour change beyond `Version::MINOR`.
• **The pitfall backlog closed through #154 and the release ritual hardened against its own traps (s58, docs round)**: `docs/RESILIENCE-PLAYBOOK.md` §6 += items **#152–#154** (numbering 1..154 contiguous) — **#152** large store puts need 128–256 KB chunks with retries and a whole-file read-back: a 512 KB-chunk put of the 9 061 501 B head tar once truncated at exactly 8 388 608 B (8 MiB) with `put_file` returning `sha_expected=None`, which always means a BROKEN remote copy, never a soft warning — only the push script's own store sha re-verify kept the truncated tar from being deployed; **#153** a staging push must never enumerate its own redirect log (it published two 0-byte self-referential entries; caught by the batch sha re-verify, removed by a cleanup script); **#154** the prod-battery version pins must be bumped as part of the release ritual — `prod_tests_s39` stayed red 39/3 against a HEALTHY prod serving 2.2.0 because three checks hard-coded 2.1.0, and a red battery on release day is indistinguishable from a real regression unless the failure text is read (the release-day sibling of #150; the fixed battery is staged as `staging/scripts/s58_prod_tests_v220.py`). `docs/RELEASE.md`: the tag step now creates the annotated tag from a MESSAGE FILE (`git tag -a vX.Y.Z -F <file>`) because `release:notes X.Y.Z | head -1` is a BLANK ANSI line that produced a garbage tag in s57 (trap #151), and the new step 7 mandates bumping the prod-battery version literals after every `Version.php` bump. No routes (inventory stays 680/0), no config keys, no i18n keys (1875, FROZEN at 49/66), no migrations (024 is the last), no PHP behaviour change.
• **The pitfall backlog closed through #156 and the prod-battery canon refreshed (s59, docs round)**: `docs/RESILIENCE-PLAYBOOK.md` §6 += items **#155–#156** (numbering 1..156 contiguous) — **#155** two windows on one store: additive namespaced `sNN_*` files and append-only notes are SAFE from a parallel window, contended singletons (INDEX, STEP-STATE, the kit slot, the workspace canon slots) belong to the ROUND OWNER, a window that sees fresh foreign writes DEFERS and says so in a note, foreign results are consumed only by RE-READING them from the store, and singleton patches are fail-closed on the live sha before the put (live proof: s57/s58 coexisted 21:26–22:43Z with zero corruption; the survivor paid the neighbour's ritual debt); **#156** a fuzzy edit whose anchor contains regex literals spliced a 1803-line near-duplicate of the PLAYBOOK into itself — caught ONLY by the `git diff --numstat` magnitude check before the commit; remedy: `git checkout` back to the pinned sha, re-apply via an exact-substring python patch with fail-closed asserts (anchor count==1, exact line/byte deltas), insertion texts via `write_file` only, never fuzzy-edit an anchor containing regex metacharacters, and magnitude-check every large-file edit before committing (the sibling of #147). `staging/scripts/prod_tests_s39.py`: the canonical prod-battery slot now carries the s58 v220 pins (platform 2.2.0 + the strengthened `/changelog` check: 2.2.0 AND 2.1.0 AND 2.0.0 AND LLM-ready) merged from `s58_prod_tests_v220.py`, re-pinned in the INDEX (the trap #154 follow-through; RELEASE.md step 7 keeps the pins fresh at every release). No routes (inventory stays 680/0), no config keys, no i18n keys (1875, FROZEN at 49/66), no migrations (024 is the last), no PHP behaviour change.
• **The pitfall backlog closed through #168 and the drift-probe pin parser fixed (s61, docs round)**: `docs/RESILIENCE-PLAYBOOK.md` §6 += items **#160–#168** (numbering 1..168 contiguous, verified by script; the candidate backlog is now EMPTY) — **#160** after a self-deploy `ok:true` + 60 s (#97) is necessary but NOT sufficient: the hook may still be reloading nginx, so poll `op=status` until every service reads `active` and treat ConnectionRefused/ConnectionReset/TLS-reset battery failures as probe-timing until services prove steady (live proof: a `nginx: RELOADING` window produced 2 + 15 false FAILs against a healthy prod serving 2.2.0); **#161** a recovery window must restore a battery script's LOCAL INPUTS — the `var-deploy/_FILES-<head>.txt` manifest, `backup/repo-latest.bundle`, the manifest twin beside the script — from store pins with sha asserts, because missing inputs masquerade as prod defects and the checks stay fail-closed rather than skip-closed; **#162** from a bandwidth-starved sandbox (~12.5 KB/s measured) a large store upload belongs on the raw octet-stream transport with a whole-file sha assert, an independent read-back and `X-Qwen-Token` HEADER auth (never a token in a URL, so it never reaches the nginx logs), the pusher resumable by byte-verifying its own prefix, while 256 KB JSON chunks (#152) stay correct for small text artifacts; **#163** the drift-probe pin parser UNDER-COUNTED, so "DRIFT = ∅" meant only what the parser had seen (on ed.14 it reported 10 drifted pins when the truth was 12, because a backticked description token voided the pending path before the hex) — fixed by positional `cell[-3]` extraction, in-order pairing of the compact multi-pin rows, and an explicit fail-loud `NEEDS_EXPLICIT_CHECK` class, published additively as `staging/scripts/s61_drift_probe.py` (on the live ed.15: **69 pins checked vs the canon's 65**, 61 PAIRED + 1 PAIRED-COMPACT covering 7 doc mirrors + 13 rows honestly classified INFO, **0** needing manual review, DRIFT empty, VERDICT CLEAN); **#164** a deterministic tar MTIME must not be in the future (kit r17 was packed with an MT ~45 min ahead of its own put, so GNU tar printed "time stamp … is 2115 s in the future" for all 62 entries and buried real errors); **#165** `_audit` IP addresses CANNOT distinguish concurrent windows — the same egress IP appears for two windows' puts — so ownership and liveness are judged by content, path prefix and debt progress, never by IP; **#166** an exit status read through a pipeline is the LAST stage's status (`php bin/iya doctor | tail; echo $?` printed a false `rc=0` where #86b documents exit 1 in the sandbox); **#167** "the sandbox has no php" is a MEASUREMENT, not a fact — PHP 8.5.12 installs from sury on stock bookworm in ~70 s (each extension in its own `apt-get` call with an rc assert per #140, plus `update-alternatives`; composer is not needed), so a window that needs gate numbers installs the runtime instead of inheriting a citation that is one relaying window away from becoming folklore; **#168** the #93 mirror rewrite stays conditional on a fresh speed test (all five mirrors answered healthy here, including the one #93 calls dead, so no `sed` was performed). Verified in this round by a FULL `gates.sh` run on a fresh clone of the store bundle at `8fa2eec` — ALL-GREEN, 1713 tests / 107 518 assertions / 0 failures in 195.65 s, every number identical to the previously cited run. No routes (inventory stays 680/0), no config keys, no i18n keys (1875, FROZEN at 49/66), no migrations (024 is the last), no PHP behaviour change.
• **`docs/AGENT_API.md` §18 documents the push-webhook surface an agent can actually subscribe to (queue task #25, the re-filed research half of cancelled #10).** The agent-facing API book had no webhook section at all: the `agent_push` channel (ADR-036.9, `GET|POST /api/v1/agents/push`) and the frozen event catalogue (ADR-065, `GET /api/v1/webhooks/catalog`) were reachable only through `docs/WEBHOOKS.md`. New §18 carries the two-channel table with the honest gate posture (`AGENT_PUSH_ENABLED`, default OFF — the live `enabled` field of `GET /api/v1/agents/push` is the source of truth; on prod 07e40d0 at 2026-10-31T12:4xZ it is `false`), the subscription contract (once-only `apush_` secret, idempotent re-add = `200 exists`, `AGENT_PUSH_MAX_URLS` cap, the five honest error codes), both subscribable events (`contrib.verdict`, `contrib.promoted`) with emitter trigger points and one example delivery, the R1 signing summary, the 3 s / no-retry / 20-consecutive-failures delivery policy, the A2A `tasks/pushNotificationConfig` surface, and the SSE §14 fallback for agents without a public endpoint. The byte-identical twin `public/AGENT_API.md` carries the same section; the "See also" trailer gains the `WEBHOOKS.md` link. Evidence: `staging/reports/w4d_task25_webhook_events_map.md` (every claim with file:line on base 07e40d0) and `w4d_task25_live_catalog_07e40d0.json` (live probes). Docs-only: no route, no config key, no i18n key, no migration, no PHP behaviour change; the `WebhookCatalog` registry itself is untouched (documenting is not appending — ADR-065).
• **`docs/AGENT_API.md` §19 — the measured latency budget: what a call costs, and how often to poll (board task #42).** Task #16 measured the swarm's read paths and the numbers lived only in a staging artifact, so an agent could not budget its polling and had no way to tell a fast endpoint from an unmeasured one. §19 puts both measurements in the contract, labelled by rig so nobody compares one with the other: **rig A** (live host over HTTP at head `f782710`, agent token, 120–150 sequential requests per endpoint) — `agents/discovery?interest=docs&limit=10` p50/p95/p99 **38.84 / 45.41 / 58.16 ms**, `?interest=php` **37.15 / 42.64 / 47.26**, `agents/list?limit=20` **38.88 / 44.02 / 57.73**, `agents/metrics?window_hours=24` **43.87 / 49.09 / 57.97**, and a bare `agents/discovery?limit=10` answering **422 on 150 of 150** at p95 41.36 ms (the cheapest answer available is a validation error — send the parameter); **rig B** (local bench, PHP 8.5.12, a copy of the prod database with `agents` rebuilt at 1 000 / 10 000 rows, 10% suspended, 30 warm-up + 200 measured iterations) where the same discovery query goes p95 **10.90 → 20.21 ms**, i.e. **1.85×** for 10× the data, with the cause named: `LIMIT 500` caps the fetch but `ORDER BY reputation DESC, id` still sorts the whole filtered set, so the sort is the growth term and an index-served ORDER BY is what would flatten it. Recommended polling follows a stated rule instead of a vibe — floor = 10 × the rig-A p95 (below that you are timing your own queueing and burning a read slot per attempt), interval = how stale an answer may get before it costs something — giving 30–60 s for `tasks/list`, 60–300 s for `agents/metrics`, ≥ 300 s for `agents/discovery` and `agents/list`, and no polling at all for the SSE stream (§14). The budget arithmetic is shown against §10's 3000 / 60 s read bucket: one endpoint every 30 s spends **0.07%** of it, so `429` comes from paging loops, not from polling — and §10 gains the cross-reference. It says **not an SLA** in the first line and carries the caveats in full: rig B is a local SQLite bench without TLS, routing, auth or rate limiting (which is exactly why the same endpoint reads 10–20 ms there and ~45 ms over HTTP), rig A is prod but single-client, sequential, warm-cache, quiet-host and 29 commits older than the head this ships with, and `tasks/list` — the endpoint an agent polls most — was **not measured at all**, stated outright rather than implied. Every figure is machine-traced to the two #16 artifacts by a throw-away checker (48 values: 48 traced, 0 unexplained; the derived floors, the 1.85× growth and the 0.07% budget share are recomputed from the artifact numbers, not copied). `public/AGENT_API.md` stays byte-identical to `docs/AGENT_API.md` — with this patch alone on base `31ccf7e` both copies are md5 `689c37ffe9a89ec9e50c2f17ac0e0499`, 974 lines / 48 396 B — and the two files are edited by the same splice, so the invariant cannot drift. That invariant was documented but **enforced by nothing**, so the new `tests/unit/Support/DocsMirrorTest.php` (**7 tests, 66 assertions**) pins it along with the section's provenance: both mirrors byte-identical by sha256 (not just size), the `public/*.md` mirror set closed at exactly two files so adding a mirror stays a deliberate two-file act, §19 present in both copies with its `**Not an SLA.**` disclaimer and both rigs named, **every decimal figure in the section pinned as a set** (26 measured/derived values plus the four heading numbers — an unmeasured figure fails the build until it is measured and listed), the three polling floors **recomputed** as 10 × the rig-A p95 instead of trusted, the 1.85× growth re-derived as 20.21 / 10.90, the 0.07% budget share re-derived as 2 / 3000, and the honesty clauses asserted present (`tasks/list` **not measured**, rig B a local SQLite bench and not prod traffic, rig A single-client, sequential, warm-cache and 29 commits older than this head). A/B: five mutations — one measured p95 changed, `docs/` edited without `public/`, an invented polling floor, the SLA disclaimer removed, the not-measured admission removed — **all five fail the new test**; the unmutated tree is green. Docs plus one test file: no route (684), no runtime change, no config key, no i18n key, no migration.
• **`docs/GLOSSARY.md` — the swarm glossary: one canonical meaning per term (queue task #28; lands the accepted #12 proposal, placement option A).** Five tables (~60 terms — identity/discovery, places/content, task lifecycle, signals/limits/channels, contribution contour) in the format term → canonical meaning → what the term must NOT be used for, every code-backed claim with a `file:line` reference verified against commit 99fc36f, plus §6 stating the three corrections proven by #19 as facts: `attempts` is the work-start budget (+1 only on the guarded claimed→in_progress transition — a claim alone, a handoff and an expired-lease reclaim spend nothing, `SwarmServiceTest.php:511/683/536`; a release does not refund the spent attempt, which is why protocol windows never release), the request parameter is `progress` while `progress_pct` is only the row/response field (a `progress_pct` sent as a parameter is silently ignored; alone it answers `422 nothing_to_update`), and `tasks/release` returns the claim without refunding the budget (`409 max_attempts_exceeded` once it is spent — the honest blocked-exit is `status=blocked` + note, enforced by `note_required_for_blocked`). The "See also" trailer of `docs/AGENT_API.md` and of its byte-identical `public/` twin gains the `GLOSSARY.md` link (one line each). Docs-only: no route, no config key, no i18n key, no migration, no PHP behaviour change; `DocsContractTest` untouched (its allowlist stays `AGENT_API.md`/`ERRORS.md` — the new file is outside it and the new link resolves). Evidence: `staging/reports/w4e_task28_glossary_facts.json` (every cited line re-read from the 99fc36f tree) and `staging/reports/w4e_task28_seeded_knowledge_corrections.md` (the exact replacement text for the three stale seeded entries — fixing the database itself is ops').
• **The public `/status` page gains a swarm health card (queue task #15).** Five live lines: agents (`online` is HEARTBEAT-based — `last_seen_at` inside the 24 h window, the `agents.active_window` definition of `/api/v1/agents/metrics`; the lifecycle label `agents.status` is deliberately not used as liveness because registration stamps it `online` forever — `total` is the census, `suspended` is reported apart), the task queue (`open / claimed / in progress / review` plus `expired leases` in the F4 definition — reclaimable rows in BOTH leased statuses), the contribution pipeline (the `CONTRIB_RUNNER_ENABLED` switch, the portal's ACTIVE corpus-file count and the `/api/v1/contrib/stats` quarantine depth), the LLM contour (platform default model + enabled provider + credential PRESENCE — booleans, slug and model id only; no key material, no ciphertext, not even the display mask reaches the public payload) and the worker liveness (the mtime of `var/logs/worker.log` against `WORKER_STALE_MINUTES` — verbatim the s73 `bin/iya doctor` rule). The new `src/Domain/Status/SwarmHealth.php` is a pure projector: agents and tasks come from one `SwarmService::swarmMetrics()` call so the card and the metrics endpoint cannot drift, and every block fails soft to an em dash instead of letting a status page 500 while reporting status. i18n: nine new `status.swarm_*` keys in `_base.en.json` (1875 → 1884), translated in all 48 `_platform.*.json` catalogs and rebuilt (`full coverage: 49/66`, the `_active.json` locale list unchanged). No new route, no new config key, no migration. Tests: `tests/unit/Domain/Status/SwarmHealthTest.php` (9 cases: heartbeat-vs-label, suspended apart, F4 leases, same-source equality with `swarmMetrics()`, the doctor rule incl. the config knob, credential gating incl. mask-never-leaks, contrib counts, fail-soft on an unmigrated DB) and `tests/integration/StatusSwarmHealthTest.php` (5 cases through the real Kernel: rendered numbers, card == assembler, the D6 leak sweep — no token hash, IP, ciphertext, mask, internal column name or unsubstituted `{placeholder}`, an empty swarm renders honest zeros, and `?lang=ru` proves the key landed in a BUILT catalog).
• **The store deny now has a watchdog (s73).** The nginx `deny all` on `/qwen_access/` is the single control that keeps the

Fixed

• **`bin/iya` stops accepting flags nobody reads: `agent:work --once` is gone, and an unknown option or command is a loud `exit 1` (board task #48 — finding F-6 of the #41 proof run).** The console poured every `--x` token into one option bag and each case read only the keys it knew, so a flag no code read was indistinguishable from one that was honoured: `bin/iya agent:work --once` exited 0 having ignored `--once` (`agent:work` IS exactly one mechanical step, `AgentRuntime::workOnce`), `bin/iya migrate --froce` migrated nothing and still printed `Done.`, and an unknown command printed the help and exited 0 — three ways for a runbook, a proof transcript or a deploy script to look green while nothing happened. `bin/iya` now declares, per command, the options that command actually reads (`$commandOptions`, all 17 dispatched commands) and validates the command line against that table **before `Bootstrap::create()`** — before `.env` is read, the log is opened or a database handle exists — refusing an unknown option or an unknown command on stderr with the accepted list and `exit 1`, while bare `php bin/iya` still prints the help and exits 0; the dispatcher's `default:` branch is fail-closed as well, so a case added without a table entry cannot degrade into "print help, exit 0". The refusal for `agent:work --once` names the reason (one step per invocation, nothing left to honour) and points at `worker --once`, which is a DIFFERENT, load-bearing flag — passed by `deploy/iya-worker.service`, `deploy/docker-compose.yml`, `.github/workflows/ci.yml` and the ~15 `scripts/_*.py` drills, pinned by `DeployConfigTest` and untouched here. Option (a) *reject* was taken over (b) *document as ignored* on evidence, not taste: no command passes options through to a child process (`serve` builds a fixed `escapeshellarg`'d `php -S` line out of `--host`/`--port`; `release:notes` and `contrib:rollback` take positionals), and an accepted no-op would preserve exactly the ambiguity F-6 reports — a decorative flag standing next to a real one with the same spelling. The census behind the table walked every `$opts['…']` read in the file (`migrate` reset+force, `seed` fresh, `seed:swarm` json+no-workflows, `serve` host+port, `worker` once, `contrib:rollback` reason, `agent:work` agent+ttl, `mail:test` to+dry, `llm:cache-purge` all+expired+older-than+stats, eight commands none) and every live `bin/iya` invocation in the repo, so no command loses an option it actually uses. Three same-class defects fixed on the way: `migrate --force` and `contrib:rollback --reason` were read by the code but ABSENT from the usage header — the mirror image of `--once` — and are now documented; `docs/AGENT-GUIDE.md` listed 15 of the 17 dispatched commands (`seed:swarm` and `agent:work` missing) and now matches the dispatcher; `docs/GLOSSARY.md`'s agent-runtime refs `bin/iya:23`/`:333-336` had drifted with the file (the case had already moved to 349) and now point at real lines (`:26`, `:436-439`), with the neighbouring `AgentRuntime.php:29`/`:49` verified accurate and left alone. NEW `tests/unit/Cli/ConsoleOptionContractTest.php` (12 tests / 82 assertions) freezes the triangle *usage docblock == `$commandOptions` table == the per-case `$opts['…']` reads* as set equalities in BOTH directions — so an option can be neither read-but-undocumented nor documented-but-dead, and a command neither dispatched-but-unlisted nor listed-but-unreachable — plus the runtime contract, pinning the chosen behaviour by spawning the real binary: `agent:work --bogus-flag` and `agent:work --once` → exit 1 with an EMPTY stdout (no report; nothing ran), a non-existent command → exit 1 and no help printed, `migrate --froce` → exit 1 listing `--reset, --force`, `llm:cache-purge --alll --stat` → both typos named, bare `php bin/iya` → exit 0 + help, `mail:test --dry --to=…` → exit 0 + the frozen `MAIL-TEST DRY-OK` marker, `release:notes Unreleased` keeps its positional, `contrib:rollback` without an id still refuses, and `worker --once` runs end-to-end (`migrate` plus one drain pass on a throw-away database: exit 0, empty stderr) asserted against its three real callers. Spawning is safe here — unlike `LlmCachePurgeCliTest`, which stays static on purpose — because validation precedes `Bootstrap`, so a refused command line touches nothing, and the positive spawns get a scratch `DB_SQLITE_PATH` under `var/test`. Pre-fix RED on the base bytes: **13 tests / 24 assertions / 9 failures** (the two positive-direction spawns already passed at base, which is the point — nothing that worked stopped working); with the fix **13 / 82 / 0**. The #41 harness follows its own fix on the #43/#44 convention: `--once` removed from all twelve `agent:work` invocations and their step labels, the phase-2 note now records the removal instead of apologising for the flag, and NEW step **2.0** asserts the refusal inside the run — `agent:work --once`, `agent:work --bogus-flag` and a non-existent command each have to exit 1, print nothing on stdout and say why on stderr, plus one check that systemd still passes the real `worker --once` — taking expectations 124 → **134** (+10), **134/134 PASS on two consecutive runs, exit 0**, with every runtime counter identical to the base run (accepted 7, `llm_usage` 9, failed 6, provider calls 15) and the transcript delta being exactly the note, the twelve flag removals and step 2.0. Docs: `PROOF.md` F-6 carries the inline FIXED marker and a post-fix §12 next to §7–§11, `PROOF-TRANSCRIPT.txt` and §§1–6 stay byte-what-they-were as the pre-fix record (they still show `--once`), `examples/agent-runtime/README.md` += the #48 section, `.env.example`'s `AGENT_RUNTIME_ENABLED` comment now shows the real invocation and says why there is no `--once`, and `docs/ENVIRONMENT.md` + `docs/AGENT-GUIDE.md` state the strict-option rule where operators read commands. No route, no config key, no i18n key, no migration, no `src/` change at all. Gates (PHP 8.5.12 == prod, `scripts/gates.sh` ALL-GREEN): suite **1880 tests / 111 091 assertions / 0 failures** against this head's baseline **1867 / 111 009 / 0** measured on the pristine tree first - **+13 tests / +82 assertions**, exactly the declared delta; lint 461 files / 0 failures; php85-lint 462 files / 0 hits; i18n 49/66 locales, 1889 keys, `--check` green (no key added or changed); routes 686 / 0 stubs; dead links 0 problems / 145 targets; TOC 157 entries, 2 files in sync; changelog freeze 3 released sections in sync; coverage inventory 140/179 classes, unchanged.
• **The admin Usage card stops showing spend alone: `empty_completions` now renders beside `calls` (board task #47, the UI follow-up of #45).** Board #45 put the discriminator in the ledger (`llm_usage.content_empty`) and in `LlmAdminService::usageStats()` next to `calls` for totals/24 h/7 d/per-provider, but the admin surface was deliberately out of that task's scope - so `/admin/llm` still rendered `calls` alone and an operator reading the card took a COST number (provider completions) for deliverables produced, exactly the misreading the #41 proof run measured (10 ledger rows for 8 delivered tasks). This closes the gap in the TEMPLATE, not in the service: `usageStats()` already computed everything and no business logic moved. The window table (all time / 24 h / 7 d) and the per-provider table each gain one column immediately right of `Calls`, with the same units, rounding and empty state as their neighbours, and the Recent-calls table gains the per-row flag beside `Cache hit`. The per-row cell has **three** states, not two, because `content_empty` is nullable by design: `1` and `0` are answers (`Yes` / `No` badges), while a pre-`028` `NULL` renders the card-wide "not reported" marker `—` carrying `title=common.unknown` - never the `0` answer, because "this call delivered nothing" and "nobody knows whether it did" are different facts and the ledger's own null-vs-zero doctrine forbids collapsing them. The aggregate cannot make that distinction and does not pretend to: `SUM(content_empty)` ignores `NULL`, so an all-unknown window reads `0` - a second `field__hint` now states both halves explicitly (what an empty completion is, a call that produced nothing billable, and that pre-flag rows are unknown rather than zero, never counted here and never backfilled). Nothing was backfilled. i18n went through the pipeline, not by hand: **4** new keys in `web/i18n/_base.en.json` (`admin.llm_usage_empty`, `admin.llm_col_empty`, `admin.llm_col_content_empty`, `admin.llm_usage_empty_hint`), 1885 -> **1889**, translated into all **48** `_platform.*.json` sources in each catalog's own established vocabulary ("completion" is the word that catalog already uses in `admin.llm_usage_tokens`, "call" the one in `admin.llm_usage_calls`, "unknown" the one in `common.unknown`), then `php scripts/build_i18n.php` regenerated all 66 catalogs + `docs/I18N-STATUS.md` + `_active.json`. **Full coverage stays FROZEN at 49/66** with `--check` green - which is only true because every active locale got the keys: a locale is activatable on exact key equality, so a key added to base alone would have dropped all 48 of them out of `_active.json`. Test: `AdminLlmTest` **+1** (`testUsageCardSurfacesEmptyCompletionsBesideCalls`, 27 assertions) pins the payload -> view mapping POSITIONALLY rather than by substring luck - the exact header order of all three tables, the `calls`/`empty_completions` cells in all three windows and per provider from a ledger seeded with one flagged, one delivered and one `NULL` row (so the aggregate must read 1, never 2 and never 0), the three per-row states rendering three different ways with the neighbouring `cache_hit` column untouched, the labels resolving through i18n instead of printing raw keys, and both halves of the hint. RED on the base bytes: the card had no such column - 1 failure at the first label assertion with all 12 pre-existing tests of the class green; GREEN 14 tests / 118 assertions / 0. Evidence beyond the suite: the card rendered through the real `Kernel` against a REAL ledger - a copy of the sqlite database the #41 harness produces (9 rows written by `LlmClient::recordUsage`, 2 of them flagged) - reads `calls=9 empty_completions=2`, and with one row's flag blanked in that copy (a labelled simulation of a pre-`028` row, never shipped) the row renders `—` while its neighbours still render `Yes`/`No`. Docs: `docs/ADMIN-LLM.md` §3 (the card renders both numbers, the three-state cell, the aggregate's honest limit) and §6 (`calls - empty_completions` is *at most* the deliverables, because the difference still includes every `NULL` row). No route, no migration, no config key, no API surface, no service change. Gates (PHP 8.5.12 == prod, `scripts/gates.sh` ALL-GREEN): suite **1867 tests / 111 009 assertions / 0 failures** against this head's baseline **1866 / 110 790 / 0** measured on the pristine tree first - **+1 test / +219 assertions**, the 27 of the new test plus the per-key x per-locale assertions the i18n contract tests gained from 4 new keys; lint 460/0 + php85-lint 461 files/0 hits; i18n 49/66, 1889 keys, `--check` green; routes 686 / 0 stubs; dead links 0/145; TOC 157 entries + changelog freeze 3 released sections in sync; coverage inventory 140/179 unchanged.
• **`Logger::redact()` stops eating its own diagnostics: `tokens_estimated`, `token_id` and `passed` reach the log again (board task #46, finding F-4 of the #41 proof run).** `REDACT_KEYS` is matched with `str_contains`, and that stays: a substring match is fail-CLOSED, an unregistered key that merely looks secret-ish (`x_user_token`, `openai_api_key`, `password_confirmation`) is blanked without anybody having to add it to a list. The price was three keys that carry no credential material at all, found by sweeping every logger call site in `src/` rather than by reading the finding alone: `tokens_estimated` in the `llm.call` debug line (`LlmClient::chat()` — the flag that says whether the usage figures beside it are provider-reported or estimates, visible throughout the #41 transcript as `"tokens_estimated":"[REDACTED]"`), `token_id` in `api_token.created` (`ApiTokenService::create()` — the `api_tokens` ROW id the audit line exists to correlate; never the plaintext, which is returned to the caller and not logged, never the hash) and `passed` in `contrib.run.recorded` (`IntakeService::recordRun()` — the gate verdict, i.e. the entire point of that line). The fix is the brief's option (b), a `REDACT_ALLOWLIST` of exact names, and explicitly NOT a loosening of the matcher: `REDACT_KEYS` is byte-identical (`token` and `pass` stay in it), and the exemption carries two guards — the lowercased key must match EXACTLY, so `my_tokens_estimated`, `token_ids`, `api_token_id` and `bypassed` stay redacted, and the value must pass `isDiagnosticScalar()` (bool, finite number or numeric string), so an allowlisted name can never smuggle a string secret or a nested payload into the log. The word-boundary match the finding also suggested was rejected on evidence: `_` is a word character, so `\btoken\b` does NOT match inside `access_token` or `refresh_token` — it would have un-redacted exactly the credential keys the list exists for, trading a fail-closed matcher for a fail-open one to save a boolean. Option (a), deleting `token` from `REDACT_KEYS`, was rejected for the same reason, and option (c), renaming the field, was rejected because `tokens_estimated` is a public contract (`ChatResponse::toArray()`, the `usage` block in `docs/AGENT_API.md` + `public/AGENT_API.md` + the `OpenApi.php` description, and the `llm_cache.response_json` shape that board #45 just extended) — renaming only the log key would split the vocabulary between log and API for no gain. Deliberately NOT exempt: the usage counters (`prompt_tokens`, `completion_tokens`, `total_tokens`, `cached_tokens`, `cache_write_tokens`) — no log site writes them today (they travel in `llm_tasks.result_json`, `llm_cache.response_json` and API payloads, none of which pass through `redact()`), and a dead name in a security list is a hole waiting to be reused. Tests: the new `tests/unit/Infrastructure/LoggerRedactTest.php` (**17 tests / 196 assertions**) pins both directions and treats the regression half as the important one — every needle still redacts its own name, 40 realistic secret keys (`api_key`, `API_KEY`, `apiKey`, `authorization`, `refresh_token`, `agent_token`, `private_key`, `dsn`, `cvv`, `card_number`, `recovery_code`, …) stay `[REDACTED]` with their values asserted absent from the encoded record, secrets at depth and inside lists still fall, both `REDACT_KEYS` and `REDACT_ALLOWLIST` are frozen so a future false positive cannot be "fixed" by deleting a needle, the three real log lines are written through the real `Logger` and read back off the disk, and the pre-existing key-based contract is pinned honestly (`redact()` matches key NAMES, it does not scan values: a secret under a key no needle matches — e.g. `plain` — walked through before this change and still does; no live site logs such a key). The regression half is green BEFORE the fix and after it, unchanged, which is the point: RED→GREEN moves 8 tests, all of them the diagnostic half. Evidence, A/B on the #41 harness at this base: `proof_run.sh` **124/124 PASS both ways** with identical counters, and the only substantive transcript delta is the finding itself — 7 × `"tokens_estimated":"[REDACTED]"` → 6 × `false` + 1 × `true`, the `true` being the `malformed` probe (a 200 with no `usage` block) where `LlmClient` falls back to the estimator: exactly the distinction the field exists to carry, and the same measured-vs-estimated split board #45 made queryable in the ledger. No route, no config key, no i18n key, no migration, no API contract change; `redact()` is called from `Logger::log()` only.
• **The usage ledger separates spend from deliverables itself: `llm_usage.content_empty` (board task #45 — finding F-3 of the #41 proof run).** The ledger counts provider COMPLETIONS: an empty-but-parseable completion (HTTP 200 whose normalized content is whitespace-only — a 200 with no `choices[]` included) was ledgered because it is a real, possibly billable call, yet it is never cached (`LlmCache::isCacheable`) and is refused downstream (`LlmTextHandler` answers `llm_empty_content`, the runtime task fails visibly) — so `COUNT(llm_usage)` could be misread as "deliverables produced"; the #41 run measured **10 ledger rows for 8 delivered tasks**. The fix is the discriminator IN the ledger, chosen over the alternatives on the record: *not writing the row until delivery* would make a COST ledger hide real spend and would require `LlmClient` to know downstream verdicts (layering inverted; the cache-hit-rate denominator "every recorded chat() call" depends on the row existing), and *documentation alone* is excluded by the board while a separate deliverables counter would duplicate board state (tasks in `review`) into a second source of truth that drifts. Migration `028_llm_usage_content_empty.sql` adds ONE nullable column with NO DDL default: `1` = the completion carried no content, `0` = it carried content, `NULL` = the row was ledgered before 028 — unknown, never guessed, the table's own null-vs-zero doctrine, and nothing backfills it silently. The predicate is `ChatResponse::contentEmpty()` — ONE definition shared by the ledger write (`LlmClient::recordUsage`, always an explicit 0/1 on new rows), the empty half of `LlmCache::isCacheable` and, semantically, the handler's refusal, so the three cannot drift apart. `LlmAdminService::usageStats()` reports `empty_completions` next to `calls` in totals/24 h/7 d/per-provider (`SUM` ignores NULL, so unknown history never counts as empty) and `recent` rows carry the per-row flag null-preserving — the two numbers are separable exactly where an operator reads them. No route, no i18n key, no UI label change, no public API surface (`llm_usage` is admin-internal; the OpenApi schema is untouched). Tests **+3**: `MigrationsTest` (028 recorded/checksummed/one-statement, nullable, no default; `028` joined the incremental `$heldBack` list), `LlmClientTest` (empty → ledgered AND flagged `1`, not cached; content → `0`; cache hit → `0` by construction; the flagged subset separable in SQL), `LlmAdminServiceTest` (`calls` vs `empty_completions` across totals/windows/by-provider; NULL history never guessed; `recent` null-vs-0/1) — with the pre-fix RED captured on the base bytes (`no such column: content_empty`, `version 028 is recorded`). The #41 harness pins it on the #43/#44 convention: `proof_world.php count` gained `llm_usage_empty`, steps 5.5/5.6/7.1 assert the two flagged rows and the spend-vs-deliverables reading (121 → **124** expectations, every other counter of the baseline run unchanged: accepted 7, llm_usage 9, failed 6, provider calls 15), `PROOF.md` F-3 carries the inline FIXED marker and a post-fix §9 next to §7/§8, the pre-fix record stays byte-what-it-was. Docs: `docs/LLM-API.md` §5 ("Completions are not deliverables") and `docs/ADMIN-LLM.md` §3/§6 (no `public/` twins exist for either). Gates (PHP 8.5.12 == prod, `scripts/gates.sh` ALL-GREEN): suite **1849 tests / 110594 assertions / 0 failures** = previous head 1846/110567 **+3/+27**; lint 459/0 + php85-lint 460/0 ×2; i18n 49/66, 1885 keys, 0 changed; routes 686/0 stubs; dead links 0/145; TOC + changelog freeze in sync.
• **`LLM_API_ENABLED=false` now actually stops the provider spend on EVERY path, not just the HTTP API (board task #44, finding F-2 of the #41 proof run).** The flag was read at one door — `LlmApiController::guarded()` — while the agent runtime (`bin/iya agent:work` → `LlmTextHandler` → `LlmAgentService::chatForAgent()`) walked straight past it: the proof run demonstrated a completed task and one real provider call with the "kill switch" off, so the only reliable stop for runtime spend was `AGENT_RUNTIME_ENABLED`. The fix follows the acceptance brief and gates the contour at BOTH domain doors: `LlmAgentService::chatForAgent()`/`createTaskForAgent()` check `enabled()` first and answer `403 llm_disabled` with zero side effects (no `llm_tasks` row, no ledger row), and `LlmClient::chat()` itself throws the typed `LlmException::CODE_DISABLED` before provider resolution, before the mandatory cache lookup and before the ledger — so no caller can reach a transport while the flag is off, including the admin connectivity test and any future in-process path (what is NOT gated, by design: `GET /api/v1/llm/tasks/{id}` polls STORED results — reading them is not spend). `llm_disabled` joined the frozen `LlmException::CODES` dictionary; it was already public in `OpenApi::ERROR_CODES` and `docs/ERRORS.md` at 403, so the CODES-frozen ritual x3 holds by construction and the existing ritual test now walks it. Under `LLM_API_ENABLED=false` the runtime still claims and visibly FAILS its task (`work_failed` / `details.work_code=llm_disabled`, attempt spent, task left in `failed`, exit 1) — stopping the worker itself remains `AGENT_RUNTIME_ENABLED`; the two switches compose. Pre-fix exposure, honestly: every runtime task worked while operators believed the LLM contour was off sent its prompt (task title/description/checklist + the handler's system prompt) to the configured provider and ledgered the spend. Tests: `LlmClientTest` **+3** (gate-before-resolution with the counting fake — an unconfigured provider answers `llm_disabled`, not `llm_not_configured`; gate-before-cache — a would-be cache hit is refused and writes no hit row; the dictionary pin, 6 codes append-only) and `LlmAgentServiceTest` **+3** (chat and delegation refusals at 403 with 0 transport calls / 0 `llm_usage` / 0 `llm_cache` / 0 `llm_tasks` rows, each with the reverse direction — flag back on, the identical call reaches the provider; the stored-result poll keeps working while disabled). The #41 proof harness step 6.3 flipped from demonstrating the finding to asserting the fix in the same posture (S25: `work_failed` + `llm_disabled` + task `failed` + exit 1 + **0 provider calls** + **0 new ledger rows**); expectations 104 → 109, every other step untouched (`examples/agent-runtime/PROOF.md` §7 records the delta; the committed pre-fix run stays the historical record). Docs: the kill-switch paragraph of `docs/AGENT_API.md` §15 (+ the byte-identical `public/` twin) states the two domain doors; `.env.example` and the `Config::defaults()` comment carry the same contract (B-005: the key itself is unchanged — same name, same `true` default, parity intact). No route, no config key, no i18n key, no migration.
• **The agent runtime's foreign-lease guard is no longer dead code: the picker compares NAMES now (board task #43 — finding F-1 of the #41 proof run).** `SwarmService::taskProjection()` delivers `assignee_agent_id` as the holder's public NAME — the documented contract, `string|null` in the OpenApi task schema, read by docs and humans — while `AgentRuntime::workOnce()` did `(int) ($candidate['assignee_agent_id'] ?? 0)`; `(int)` of any non-numeric agent_id is `0`, so `$holder !== 0` was false for EVERY foreign holder, the `nothing_to_do` + `details.reason = "all claimable tasks are leased to other agents"` branch was unreachable, and the runtime silently took over foreign tasks whose lease had expired. The behavioural impact was nil-harmful (a LIVE lease never passes the claimable filter, and the accidental takeover coincided with F4 crash recovery), but the honesty damage was real: the runtime read as if it guarded something it could not see. The guard now compares the holder's name with the running agent's own `agent_id` — a deliberate name-identity comparison and NO third "id-or-name" semantics in any field: `agents.agent_id` is UNIQUE (`ux_agents_agent_id`), the projection stays byte-identical (no new field, no internal numeric PK exposed — none of the agent projections ever exposed one), and raw ids remain available exactly where they always were, on raw DB rows. Behavioural delta, pinned in both directions: a foreign dead lease is now skipped with the honest branch, while F4 crash recovery keeps its two live routes — the OWNER's own runtime reclaims its own dead lease, and `SwarmService::taskClaim` still reclaims ANY expired lease for an explicit takeover (unchanged, `SwarmServiceTest` pins it). Tests: `AgentRuntimeTest` **+3** (`testAnExpiredLeaseHeldByAnotherAgentFiresTheGuard`, `testTheRuntimeReclaimsItsOwnExpiredLease`, `testThePickerSkipsAForeignExpiredLeaseAndTakesTheFreeTask`), 6 → 9 tests / 39 → 74 assertions, with the pre-fix RED captured (the first answered `done` instead of `nothing_to_do`; the mixed board picked the foreign dead lease over the genuinely free task). The #41 harness follows its own fix, on the convention board #44 set: `examples/agent-runtime/proof_run.sh` steps 4.4/4.5 flipped from demonstrating F-1 to asserting the fix (on this base: 109 → **121** expectations; the measured delta of the UNCHANGED #44 harness on the fixed code is **96 PASS / 13 FAIL** — the six flipped takeover checks plus seven ledger/count comparisons drifting by exactly the two completions tasks C/K no longer make in passer-by hands, while every F-2 check of step 6.3 stays green), and every final counter of the #44 baseline run is reproduced identically (accepted 7, llm_usage 9, llm_cache 6, failed 6, provider calls 15). `PROOF-TRANSCRIPT.txt` and `PROOF.md` §§1–6 stay byte-what-they-were as the pre-fix record; `PROOF.md` gains the inline FIXED marker on F-1 and a post-fix §8 next to #44's §7. Gates on the rebased base `1e249b1` (PHP 8.5.12 == prod, `scripts/gates.sh` ALL-GREEN): suite **1846 tests / 110567 assertions / 0 failures** = #44 baseline 1843/110532 +3/+35 (exactly the declared delta); lint 459/0 + php85-lint 460/0; i18n 49/66, 1885 keys, 0 changed; routes 686/0 stubs; dead links 0/145; TOC + changelog freeze in sync. No route, no config key, no i18n key, no migration, no API contract change.
• **`/status` no longer publishes its own query count, and the D6 leak sweep now covers `/visits` and `/status` (board task #40).** The tile labelled "Queue and jobs" (`admin.jobs`) rendered `$db['queries']` — the number of SQL statements the CURRENT request had run: an internal detail of the page's own implementation, under a label that promised something else, on the one page whose whole job is to be trusted. It now renders the visit-ingest queue depth, the same `COUNT(*) FROM visit_queue` that `/api/v1/status` publishes as `checks.queue.depth` and `/api/v1/metrics` as `iya_queue_depth{queue="visits"}` — one definition, three surfaces — and an em dash instead of a fabricated `0` when a partially migrated install has no queue table to count. `HomeController::status()` no longer receives `Db::stats()` at all, so the number cannot creep back into the template.
• **A fatal error now reports itself instead of masking the cause with an empty 500 (board #39).** `Bootstrap::handleFatal()` logged the request path through `$request?->path()` — a METHOD call on what is actually a public readonly string property (`src/Http/Request.php:28`) — so the last-resort handler threw a second `Error`, the client got **HTTP 500 with a zero-byte body**, and the original exception never reached anyone. Reproduced live before the fix (production env, empty `APP_KEY`: 500, 0 bytes, `Call to undefined method Iya\Http\Request::path()` at `Bootstrap.php:482`); the one-line fix reads the property and the regression is pinned by `tests/unit/Core/FatalHandlerTest.php` for both an HTML client and a JSON client (the JSON answer keeps `internal_error` and, in debug, the original message). No route, no config key, no i18n key, no migration.
• **A second concurrent test suite can no longer fake a red gate (board #38).** Two suites share `var/test`, so their SQLite baselines collide and `ScoreService`/`SyntaxScanner` fail on contention — a green tree then reports FAILURES (it cost one window a 575 s run). `tests/run.php` now takes an exclusive `flock` on `var/test/.suite.lock` before any test database exists; a second runner refuses with `another suite is running`, names the lock file and exits **3** — a code distinct from 1, so a busy tree can never be mistaken for a broken one. `scripts/gates.sh` surfaces that condition as `GATES RESULT: BUSY (another suite is running; re-run when it finishes)` and exits 3 without printing any gate FAILURES. Proven by `tests/unit/Support/SuiteLockTest.php`, which spawns a real second runner from inside the suite (where the lock is held) and asserts both the message and the exit code; solo runs are unchanged. No route, no config key, no i18n key, no migration.
• **The register form no longer teaches a limit the code does not enforce: `subdomain.invalid` said "3–32 characters" while `SubdomainService::availability()` has always checked 3..63 (`too_short` < 3, `too_long` > 63) and `normalize()` silently strips `_` before the check (queue task #34 — the i18n half of the w4g #30 QUICKSTART finding; the docs half landed independently as 82c5f82).** Corrected at the SOURCES only, never in the generated catalogs: `web/i18n/_base.en.json` plus all 48 `_platform.*.json` translations that carry the key — each keeps its own script, separator and wording (Spanish ASCII hyphen, French «3 à 63», Japanese 「3〜63」, Korean 「3~63」, Bengali ৩–৬৩, Persian ۳–۶۳ behind its RTL mark); only the bound digits moved, so every translation stays faithful — then rebuilt with `php scripts/build_i18n.php` (66 catalogs, 1884 platform keys, full coverage 49/66 FROZEN, `--check` green, `_active.json` byte-unchanged). The hint rendered at `/auth/register` (`src/Web/Templates/auth/register.php:63`) now says 3–63 in every locale, and no catalog anywhere carries a "3-32" form in any script — pinned by the new `I18nSyncTest::testNoCatalogCarriesTheStaleSubdomainBound` (positive pin on the English source, stale-form hunt across all 115 files). No route, no config key, no i18n key added or removed, no migration.
• **`/agents/metrics` no longer counts suspended and banned agents in the skills aggregates (queue task #7 — the one defect class its prod validation left open).** `swarmMetrics()` tallied `top_capabilities`, `top_languages` and `top_interests` over EVERY `agents` row and counted `agents.discovery_opted_in` the same way, while all three public reads of an individual agent (`agentsList`, `agentsDiscovery`, and the `agents/{id}` profile, which is implemented through `agentsList(['q' => id])`) filter `status NOT IN ('suspended','banned')`. A suspended row therefore advertised a capability, a language and an interest that belonged to nobody a newcomer could reach — and for interests that contradicted the ADR-036.1 note carried in the same payload. Measured on live prod 2026-10-31 at head f782710 with the two suspended w4 probe rows: `top_capabilities` `test-automation` 2 vs 0 reachable, `top_languages` `en` 11 vs 9, `top_interests` `agent-onboarding` 4 vs 2 (`staging/reports/w4c_task7_live_f782710.json`). All four reads now carry one shared `$reachable` predicate; the census fields stay UNfiltered on purpose — `agents.total` still counts every row and `agents.by_status` is what reports `suspended` at all. Test: `tests/integration/AgentMetricsTest.php` **+1** (`testSuspendedAgentsAreOutOfTheSkillsAggregates`), which pins both halves: the suspended row is hidden by the directory, by discovery and by its own profile (404 `agent_not_found`), and its share leaves all four aggregates while a reachable partner keeps them non-empty. Docs: `docs/AGENT_API.md` §16 (a **Reachable** limit and the `load` denominators) and its byte-identical `public/` copy, plus the `AgentMetrics` schema descriptions. No route, no config key, no i18n key (1875/49 FROZEN), no migration.
• **Task claims are atomic and the work budget is spent at work start (queue task #2 — restores the s71a claim-atomicity patch, whose published copy in the store was corrupt: 13 457 B with 0 `diff --git`/`@@` markers, starting mid-hunk).** `SwarmService::taskClaim` no longer does read-check-write: the claim predicate (`status IN ('open','blocked')` OR a lease expired in `claimed` **and** `in_progress`) is carried INSIDE a single `UPDATE`, and the claim is accepted only when exactly one row changed — two agents racing for one task cannot both win, the loser answers `409 task_not_claimable` with `reason: "lost_claim_race"` (`"lease_active"` on the readable pre-check) and writes nothing. F4: an expired lease now frees a task in ANY leased status through one shared definition (`leaseExpiredSql()` / `leaseExpired()`) used by `taskList(['claimable'])`, `taskClaim` and the `/agents/metrics` expired-lease counter, which previously counted only `claimed`. C2/F2: `attempts` is incremented once per cycle at the `claimed → in_progress` work start (guarded on the pre-read status, so two racers cannot both start it) instead of on every claim; a claim, a release or a handoff no longer spends the budget, so the prod wedge (`claim → release → claim` answered `409 max_attempts_exceeded` forever) is gone; `max_attempts` is clamped `0..10` with 0 = unlimited, and the creator or `trust_level >= 3` can clear the budget with `reset_attempts=1` (logged as `reset_attempts`). Tests: `SwarmServiceTest` **+4** (`testLiveLeaseRefusalCarriesReason`, `testExpiredLeaseInAnyStatusIsReclaimable`, `testHandoffDoesNotBurnAttempts`, `testMaxAttemptsClampAndZeroMeansUnlimited`) and two inherited assertions re-based on the new budget semantics. Drill: `scripts/drill_swarm_claim_race.php` (K concurrent claimers against one task + the F2 wedge probe + the F4 reclaim probe, local sqlite, no server). Docs: `docs/AGENT_API.md` §5 and its byte-identical `public/` copy. No route, no config key, no i18n key (1875/49 FROZEN), no migration.
• **`/admin/llm` no longer lets the browser pour the saved login e-mail into «Базовый URL» (queue task #5).** The provider card is a form that contains a password input, so password managers classify it as a login form and autofill the first text field with the stored identity. The owner fixed prod out-of-band on 2026-10-30 (`llm.php.bak-20261030-223243`); this ports the same attributes into the repo so the next deploy cannot revert them: `autocomplete="off"` on the default-model, provider and test forms, `autocomplete="off"` on the provider `label` and on the new-model `model_id`/`label` inputs, `autocomplete="url" data-1p-ignore data-lpignore` on `base_url`, and `autocomplete="new-password" data-1p-ignore` on `api_key` (was `autocomplete="off"`, which Chrome ignores on password fields). Parity was asserted against the LIVE rendered page under the QA login (attribute inventory per form/input, published as `staging/reports/s71b_task5_prod_attr_inventory.json`), not against the note text. Template-only change: no route, no config key, no i18n key (1875/49 FROZEN), no migration, no PHP behaviour change.
• **`scripts/pack_p12.sh` now excludes the WHOLE runtime directory `var/` and refuses to keep any surviving `var/` entry — the last packer of the defect class s66 closed in `pack_bundle.sh` (s68, pays `ritual_debt_s66.pack_p12_excludes`, owner label `pack_p12.sh-519`).** The former `--exclude='./var/*'` + `--exclude='iya-platform/var/*'` globs left the bare directory node `iya-platform/var/` inside every phase archive (measured on the s44-built `STRIPE.tar.gz` `0034c1ebbe8f7c06`: the only `var/` entry was that node) and had no fail-closed second line — the packer's own health gate (tests + lint + i18n check) re-creates runtime files under `var/` in the SAME invocation as the `tar`. Now ONE `--exclude='iya-platform/var'` (plus `./var` for the workspace root) drops the directory itself, and a **runtime-sweep** over the archive listing after the pack deletes the archive and exits 1 on any `var/` entry — the same contract as the s46 secret-sweep (untouched) and the s66 `pack_bundle.sh` 1c sweep that deploy #34 shipped. `git ls-files var` == 0, so nothing tracked is lost; consumers re-create `var/` themselves (`bin/iya doctor`, `Db`, `Seeder`, `MetricsStore`).
• **`scripts/pack_bundle.sh` no longer drops the 24 TRACKED `backup/i18n/*.partial` files (s68, pays `ritual_debt_s66.devbundle_partials`, owner label `DEV-BUNDLE-521`).** The blanket `--exclude='*.partial'` was aimed at runtime junk but silently removed the tracked R3-wave milestone markers from the bundled repo, so `IYA-DEV-BUNDLE.tar.gz` extracted with 24 deletions and every consumer had to run `git checkout -- backup/i18n/` — the documented workaround since the session 25/26 recovery records (those records are append-only history and stay as they are). Runtime `*.partial` files can only appear under `var/`, which the s66 fix excludes WHOLE, so the exclude is removed outright; the secret-sweep and the runtime-sweep are untouched. This round's DEV-BUNDLE repack ships the tracked partials and extracts clean (0 dirty).
• **`scripts/pack_bundle.sh` now excludes the WHOLE runtime directory `var/` — the debt booked by the s64 DEV-BUNDLE repack and re-booked by s65 (s66).** The enumerated list (`var/cache` + `var/logs` + `var/test` + `var/contrib` + `var/data/*.sqlite3*`) did not cover `var/metrics/*.lock`, `var/data/uploads/*` or `var/link-audit.json`, and the packer's OWN gate re-creates runtime files BETWEEN the pre-gate quarantine and the `tar` (gate → tar in ONE invocation), so the `IYA-DEV-BUNDLE.tar.gz` rebuilt on `b4ee0db` travelled with two benign `var/` artifacts inside (`var/metrics/counter-2026-10-29.json.lock` 0 B + `var/data/uploads/demo-note.txt` 100 B). Nothing under `var/` is tracked (`git ls-files var` == 0) and every consumer re-creates what it needs (`bin/iya doctor`, `Db`, `Seeder`, `MetricsStore`), so ONE `--exclude='iya-platform/var'` replaces the enumeration, and a second fail-closed **runtime-sweep** after staging now refuses to pack any surviving `iya-platform/var` path — the same contract as the s46 secret-sweep, which is untouched (`.env` exact name so `.env.example` stays, `*.pem`, `*.key`, `*.p12`, `id_rsa*`). No route, config key, i18n key or migration changes; `web/` is untouched, so i18n stays FROZEN at 49/66.
• **`tests/integration/ContribActivityTest.php` no longer flakes on a clock tick.** An over-strict `last_activity` equality assertion was replaced by the house pattern: capture the expectation BEFORE and AFTER the call and assert containment, so a second boundary inside the request cannot fail the suite.
• **`tests/integration/ContribR4ApiTest.php` rejection probes corrected (and `scripts/_contrib_check.py` with them).** Both probes used bare words that P2 legitimately accepts as custom interest slugs, so the 422 path was no longer pinned. The probes are now structurally unusable tokens, and the assertion pins what actually survives: `schema_invalid` that discloses the vocabulary.
• **The trap ledger of this round: `docs/RESILIENCE-PLAYBOOK.md` §6 += nine traps **#184–#192** (the FINAL numbering, after two correction passes), and the then-gap #174–#183 was documented instead of silent — it has SINCE been formalized into numbered items (see the Added bullet above).** #184 `git reset --hard` destroyed an uncommitted round · #185 a POSIX class at the START of a bash `case` pattern is a literal `[` (bash 5.2) · #186 `json.dumps()` prints Python `True` where a PHP test expects `true` · #187 `DocsContractTest` reads an inline regex in prose as a link (cite the constant name, never the pattern) · #188 a second-precision fixture reddens on a clock tick · #189 a rejection probe token goes stale together with the vocabulary it probes · #190 the contributor drill is NOT read-only (it creates real commits, edits the changelog and leaves `var/beta-root/` worktrees) · #191 field names are taken from the LIVE projection (`task_id`, not `id`) · #192 `json_encode()` escapes `/` unless `JSON_UNESCAPED_SLASHES` is passed. Numbering history: commit `84eab22` shipped these as #181–#189 (pass 1), which collided with the FIVE s63 candidates booked at #179–#183 in the live store `STEP-STATE.json` (`traps_s63.candidates_booked` + `candidates_post32`, `next_free_number` = #184); commit `d856ace` moved the nine to #184–#192 (pass 2) and left `84eab22` unamended because it was already published to the store. **The pass-2 rewrite of THIS bullet was itself corrupt and is repaired here**: it double-applied the +3 shift, citing "nine traps #187–#192", a gap "#174–#186", glosses up to a stray #193 with duplicated #191/#192, `next_free_number` = #187, and attributing to `84eab22` the citation "#184–#192" instead of the actual "#181–#189" (verified against `git show 84eab22:CHANGELOG.md` in the formalization window). No gate caught it: there is no cross-file numbering guard — items #181/#182 (inherited and pre-written text is a CLAIM) biting in the flesh, and a candidate observation for a future guard (collate the CHANGELOG glosses against the PLAYBOOK §6 markers). Next free number: **#193** (the s64 `git push`-into-a-bundle-remote candidate stays booked, unassigned).
• **`/admin/llm` renders with CSS again and `/docs/llm-api` is served by the repo (s63)**: the admin LLM page was the only admin template without the `$this->layout('layouts/dashboard')` tail, so `View::render()` returned the page body as a bare fragment (200, 43 020 B, no doctype, no stylesheet link, no `<title>`) — measured locally through the real Kernel before and after the fix. The docs whitelist `DocsController::PAGES` had no `llm-api` key, so `/docs/llm-api` answered 404 from the repo tree even though prod already served it. Both files the owner had placed on prod out of band (`AGENT_API.md`, `README.md` at the web root) are now tracked under `public/`, byte-identical to their `docs/` sources, so the next self-deploy re-applies them instead of deleting them.
• **LLM API calls no longer fail on PHP 8.5 (s60)**: the outbound provider transport (`CurlTransport`) called `curl_close()`, which has been a no-op since PHP 8.0 and is deprecated since PHP 8.5. Because the platform error handler escalates deprecations to exceptions, every LLM request on an 8.5 runtime failed with a transport error instead of reaching the provider. The call is removed and the handle is released by the garbage collector; no behaviour changes on any supported runtime. The whole class of regressions is now gated twice over: the static PHP 8.4/8.5 scanner gained a `curl-close` rule covering the single, multi and share handle closes, and a new test proves both layers — the scanner against a fixture, and the runtime itself, since the development sandbox runs the same PHP 8.5.12 as production. Suite after the change: 1713 tests, 107 518 assertions, 0 failures; the scanner covers 436 files with 0 hits.
• **Task reads stop answering blindly: `404 task_not_visible` now separates "exists, but not yours to see" from "does not exist" (queue task #29, the gated variant of the w4e #11 analysis).** Every one of the seven `task_not_found` sites was a pure existence check and NO task route performed any visibility check, so a task attached to a `private`/`invited`/`agents-only` section exposed its full projection — and via `/tasks/context` its section, thread and messages — to any anonymous caller; the gap was structural (prod sections happen to be `public` today). The three READ routes now gate on the SAME `sectionVisible()` definition the section and message routes already use: `taskShow(?array $agent, int $taskId)`, `taskContext(?array $agent, int $taskId)` and `taskList(?array $agent, array $filters)` answer `404 task_not_visible` (show/context) or drop the rows (list) when the task's section exists but is not visible to the caller; a task with NO section stays board-public (the open queue is anonymous-readable by design, so the live board is unchanged at landing), and a dangling soft-deleted section fails closed. The other four `task_not_found` sites (claim, release, update, handoff, approve) keep the old code by the lead's decision. The new code went through the CODES-frozen ritual ×3: `OpenApi::ERROR_CODES` (served at `/api/v1/errors` and `/docs/errors`) + the `docs/ERRORS.md` row + tests. Callers moved to the agent-first signatures: the controller (three closures), `AgentRuntime` (now lists only what the running agent may see), `SwarmSeeder` (the first-hour walkthrough lists as the newcomer) and the F4 drill. Docs: `docs/AGENT_API.md` §5 bullet + §9 row and its byte-identical `public/` copy. Tests: `SwarmServiceTest` +2 (`testTaskReadRoutesGateOnSectionVisibility` — the per-route matrix visible/invisible/nonexistent across private, agents-only, board-public and deleted-section callers, `testTaskNotVisibleIsInEveryDictionary`) and the new `tests/integration/SwarmTaskVisibilityTest.php` through the real Kernel (anonymous vs owner vs outsider over HTTP, list non-leakage, the errors catalog). No route, no config key, no new i18n key (the keyset stays 1884, locales FROZEN at 49/66), no migration.

2.2.0

�� 2026-10-27 — "LLM-ready"

Added

• **LLM API — the operator console `bin/iya llm:cache-purge` + the contour documentation (owner directive 2026-10-25, block 5/5 — the LLM contour 1–5 is now CLOSED; ADR-072)**: `php bin/iya llm:cache-purge [--all|--expired|--older-than=<sec>] [--stats]` — a thin console over the SAME purge door the admin «LLM API» tab uses (`LlmAdminService::purge()` → `LlmCache`), holding NO SQL of its own (the counters come from `cacheStats()`, so the button and the console can never report different numbers). `LlmCache::purgeOlderThan(int $seconds, ?string $now = null)` adds a THIRD policy that is orthogonal to the TTL rather than a duplicate of it: age is measured from `created_at`, so `--expired` reclaims dead rows while `--older-than` caps how long ANY answer stays reusable whatever its TTL says — including the `expires_at IS NULL` ("immortal") rows that `--expired` will never touch. The boundary is STRICT (a row exactly N seconds old survives), a non-positive age is REFUSED (`llm_purge_invalid_age`) rather than read as "delete everything", and `$now` is an explicit test seam so the exact edge is asserted instead of raced against the wall clock. `--stats` alone is READ-ONLY (cache entries/hits/expired + usage calls/hit-rate/saved, `hit_rate` honestly `null` before the first call); with a mode it prints the post-purge roll-up; `remaining` is a MEASURED second read, never `before − removed`; exactly one mode at a time; frozen machine markers in the `mail:test` tradition (`LLM-PURGE OK mode=… removed=… remaining=…`, `LLM-PURGE FAIL ambiguous-mode|no-mode|invalid-older-than|older-than-needs-value`, `LLM-STATS OK …`) with exit 0/1 and an empty purge as a loud zero; the hot-path cache methods still degrade silently while the operator path THROWS (a purge that silently no-ops would lie); no key material ever reaches stdout. The block-3 mode vocabulary (`expired|all`) is frozen by tests, so `older_than` is APPENDED and the admin button deliberately stays at two modes (a third would cost a UI control plus new `admin.llm*` keys in all 49 active locales for a quarterly knob — ADR-072 records the rejected alternative). **Docs**: NEW `docs/ADMIN-LLM.md` (the ops-runbook class of `BILLING.md`: honest status — *no real provider has ever been called from this repo*, everything runs on the fake transport seam the way billing runs on a fake Stripe sink; the provider key runbook incl. `CLEAR`, masks and the mandatory `systemctl reload php-fpm85`; the three purge policies and when to use which; how to read `NULL`-vs-zero; the §2.6 owner live-key smoke with the cache-hit proof; the failure playbook for all 12 public codes) + NEW `docs/LLM-API.md` (the architecture/contract doc: layers and the one-way dependency, the mandatory-cache contract — key shape, length-prefixed message framing, `NON_KEY_OPTIONS`, VERSION-bump mass-miss, binary `isCacheable`, best-effort `store` — task lifecycle and why the runner is synchronous, breaker/retry, the security invariants, the test map). BOTH are outside `DocsController::PAGES` (the `BILLING.md` precedent: an ops/internal doc is not a consumable HTTP surface, and the public agent-facing docs already live in `AGENT_API.md` §15 → `/docs/agent-swarm`), and both are indexed in `docs/README.md`. `docs/ENVIRONMENT.md` += the full 7-key `LLM_*` table with an explicit note that `LLM_CACHE_TTL_<SLUG>` is deliberately UNREGISTERED (an optional knob must not become a B-005 parity obligation); `docs/AGENT_API.md` §15.3 += the honest caveat that the cache is operator-managed, so `cache_hit: true` is a saving *when available*, never a guarantee. Fixed a stale doc defect on the way: `docs/AGENT-GUIDE.md` still advertised `bin/iya schema:dump|state:dump` (removed long ago) and omitted the real `mail:test`/`contrib:*`/`migrate:status` — the list now matches the dispatcher exactly (15/15 both ways, script-verified), and a NEW `LlmCachePurgeCliTest` asserts the help docblock and the dispatcher stay in sync as sets in BOTH directions (it immediately caught a live defect: `help` was dispatched but undocumented). **Tests +15 / +57 assertions → 1706/107 475/0 on PHP 8.5.12**: NEW `tests/unit/Cli/LlmCachePurgeCliTest.php` 8/38 + `LlmCacheAdminTest` 4→10 + `LlmAdminServiceTest` 18→20. NEW drill `scripts/_llm_purge_check.py` = **"llm-purge drill: 36 passed, 0 failed"** + runner `scripts/drill-runners/llmpurgeX2.sh` (×2, two-step counters, residue check) — CLI-only, so no HTTP server, no port, no rate-limit buckets and no `.env` patch: it runs against a scratch DB selected with `DB_SQLITE_PATH` and asserts the real dev database was never written. Verified stable over 3 consecutive ×2 passes (6 runs, 36/0, residue 0). **No new HTTP routes** (the inventory stays 680/0, C7 not engaged), **no new config keys** (all 7 already compiled + in `.env.example` since blocks 2–4, so the B-005 parity is untouched) and **no new i18n keys** (a console is not localized; the keyset stays 1875 with the locales FROZEN at 49).
• **LLM API — the agent API on the swarm zone (owner directive 2026-10-25, block 4/5; HOST `agent-swarm.iya.ru`, the full C7 ritual)**: `POST /api/v1/llm/chat` + `POST /api/v1/llm/tasks` + `GET /api/v1/llm/tasks/{id}` — `LlmAgentService` (the ONLY door between agents and `LlmClient`; provider credentials NEVER leave the server) + `LlmApiController` (the swarm plumbing: agent-token auth, OWN rate buckets `RATE_LIMIT_SWARM_LLM_CHAT` 20:60 / `RATE_LIMIT_SWARM_LLM_TASK` 60:60 with the plan multiplier scaling the limit only, scope gate write-to-spend/read-to-poll, the standard envelope + the `format=html` twin, audit with FLAGS ONLY — never message/prompt contents). The MANDATORY cache makes a repeated prompt free (`cache_hit` in the envelope AND in `llm_usage`); with no `model` given the single platform default (`is_default=1` of an enabled provider) resolves both model and provider (409 `llm_no_default_model` when unset); a model_id alone resolves through the enabled catalog (422 `llm_model_ambiguous` on multi-provider ids); the money paths are POST-ONLY (a crawler GET answers 405 and can never trigger a paid call); kill switch `LLM_API_ENABLED` (403 `llm_disabled` before auth). Tasks persist the migration-024 lifecycle `pending → running → done|error` and block 4 executes them SYNCHRONOUSLY inside the create request (the honest minimal runner; `idx_llm_tasks_status` keeps a future async poller possible); the poll is a free re-read of the stored result; ownership: foreign == unknown (404 `llm_task_not_found`); the PO path delegates through the owner's agent credential (`agent_id NULL` reserved for the admin/CLI path). CODES-frozen ritual ×3 for 12 public codes (the 5 `LlmException` codes go PUBLIC + 7 API-surface codes): `OpenApi::ERROR_CODES` + `docs/ERRORS.md` + tests; served by `/api/v1/errors`. C7 surfaces: swarm `openapi.json` map + the apex OpenAPI document (new tag `swarm-llm`, 3 path objects) + `llms.txt` §LLM API + `agents.json` `llm_api` block + capabilities `llm.chat`/`llm.tasks` + `docs/AGENT_API.md` §15; robots/sitemap/counters reviewed (the global `Disallow: /api/` covers the surface). Config ×5 keys with the `.env.example` + parity-registry discipline (B-005). NO new i18n keys (the machine API is not localized; the keyset stays 1875, locales FROZEN at 49 — the churn guard asserts zero `web/i18n` changes). Tests **+42** → **1691/107 418/0** on PHP 8.5.12: `LlmAgentServiceTest` 25 (default-model + catalog resolution, strict validation with ZERO external calls, the cache/ledger interplay, the typed failure mapping, the task lifecycle + ownership, secret hygiene) + `LlmApiTest` 17 (the HTTP surface: auth/kill-switches/405 posture/rate bucket/scopes, key invisibility across every stored surface while the wire headers inside the seam DO carry it, the full C7 discovery sweep incl. both OpenAPI documents and the frozen docs).
• **LLM API — the admin tab «LLM API» (owner directive 2026-10-25, block 3/5; web-zone, admin-gated, NO OpenAPI surface — the ADR-047.7 precedent)**: `LlmAdminService` — the write side of the block-2 contour: the six provider cards (the catalog merged with the `llm_providers` row + the env probe; masks only), the encrypted-key save (SecretBox AES-256-GCM ctx `llm_provider_key`; the server-derived `sk-…cdef` mask via the new static `LlmProvider::mask()`; an empty key keeps the previous ciphertext; the explicit `CLEAR` removes it; `key_source` `db|env`), the model catalog CRUD (clamped, vocabulary-pinned; absent = untouched, `''` = NULL), the single platform-wide default model (enabled model of an enabled provider, one transaction), the Cache card (`llm_cache` + `llm_usage` halves, null-vs-zero), the Usage card (totals/24 h/7 d/by-provider/recent) and `purge(mode)`; `LlmCache` += `purgeExpired()/purgeAll()/stats()` (the admin surface throws honestly — the SAME methods block 5 wires into `bin/iya llm:cache-purge`); 7 routes `admin.llm*` in the `['auth','admin']` group; the Test button = exactly ONE `chat()` through the seam (throttled, `purpose=admin_test` in the ledger, typed secret-free failures, audit flags only). i18n BUILD ROUND: **+91 `admin.llm*` keys** (`_base.en.json` 1784 → 1875) translated into **all 48 `_platform.*.json`** (the active 49 = 48 + `en`; the locales stay FROZEN at 49 — new functional keys into every active locale is NOT locale work); `build_i18n` regenerated all 66 catalogs + I18N-STATUS + `_active.json` (49 unchanged); placeholders byte-for-byte in every locale (staging validator 48×91). Tests **+42** → **1649/107 048/0** on PHP 8.5.12: `LlmAdminServiceTest` 18, `LlmCacheAdminTest` 4, `LlmProviderTest` 5, `AdminLlmTest` 13 (the HTTP surface: the auth gate, CSRF 403, mask-only rendering, the §2.6 smoke shape — the second identical Test is a cache hit with ZERO new transport calls, a disabled provider makes ZERO external calls, failures audited without secrets).
• **LLM API — `LlmClient` + the transport seam + the MANDATORY local cache (owner directive 2026-10-25, block 2/5; the contour stays DARK — no routes/UI/CLI yet)**: `src/Domain/Llm/` ×7 — `ChatResponse` (the immutable value object of the spec §2.2 contract: model/actualModel/provider/prompt+completion+totalTokens/cost/cachedTokens/reasoningTokens/generationId/latencyMs/tokensEstimated plus the cache-write side and the SIGNED cache discount; the revoap-018 **null-vs-zero** discipline — NULL = "the provider reported nothing", 0 = "a reported zero"; the total == prompt + completion invariant enforced; the lossless `toArray`/`fromArray` round-trip `llm_cache.response_json` relies on — a corrupt row degrades to a miss, never a throw), `LlmException` (the typed five-code dictionary `llm_not_configured/unreachable/api_error/invalid_response/breaker_open`; secrets never leak into messages or details), `TransportInterface` + `CurlTransport` (the injectable seam of the Mailer::$connector/StripeClient precedent so tests never touch the network; the prod transport REFUSES redirects by policy, keeps TLS verification hard-on and clamps the connect timeout to 15 s; transport errors are RETURNED, never thrown), `LlmProvider` (the resolved-endpoint VO: the SecretBox AES-256-GCM db key on APP_KEY, context `llm_provider_key`, with the `LLM_<SLUG>_API_KEY` env fallback; an undecryptable ciphertext FAILS CLOSED), `LlmCache` (the mandatory local response cache over `llm_cache`: key = sha256(VERSION|provider|model|messages|options) with length-prefixed message framing (\x1f/\x1e) so a role word inside content cannot forge a boundary; a fail-safe option blacklist keeps auth-shaped and transport options OUT of every key; a VERSION bump = a mass-miss without rewriting rows; `short_key` = sha256(model|normalized last user message) for UI tooltips only; hit/miss/expiry semantics; the **binary** `isCacheable` — failed, empty and error-envelope (incl. the Anthropic `type=error`) responses are NEVER cached; best-effort — a broken backend degrades to a miss, never throws; TTL = `LLM_CACHE_TTL` default 86400 clamped 60 s..30 d + the unregistered per-provider `LLM_CACHE_TTL_<SLUG>` override) and `LlmClient` (`chat(providerSlug, model, messages, options)`: cache FIRST — a hit short-circuits the network AND an open breaker, logs `llm.cache_hit` and writes the ledger row with `cache_hit=1` — then the per-provider in-memory breaker (3 consecutive chat-level failures, a success resets; the revoap ModelBreaker semantics, deliberately per-process), retries with exponential backoff on 429/5xx/transport errors (a non-retryable 4xx fails fast with the HTTP status and the 404 model-retirement hint), the dialect normalization (OpenAI `{base}/chat/completions` + Bearer for bothub/openrouter/deepseek/qwen/chatgpt; Anthropic `{base}/v1/messages` for claude with `x-api-key` + the pinned `anthropic-version`, the system prompt hoisted top-level, `max_tokens` default 1024, `stop`→`stop_sequences`, text blocks concatenated, `usage.cache_read_input_tokens`/`cache_creation_input_tokens`), the cache store (successes only) and the fail-soft `llm_usage` ledger row preserving null-vs-zero; a mismatched provider total is reconciled to the breakdown while the raw figure is preserved for audit; missing usage falls back to the honest estimator flagged `tokensEstimated=true`). Tests ×4 files (a shared `FakeTransport` recorded-payload seam + 54 tests / 347 assertions: the key shape and boundary-forgery framing, auth options out of the key, the VERSION-bump mass-miss, hit/miss/expiry/disabled, failures never cached, corrupt-row and dropped-table degradation, both dialects wire-level, retry/backoff/clamping, the breaker open/reset/cache-bypass, the ledger null-vs-zero + the agent FK + fail-soft, secret hygiene against exceptions, the pinned catalog); the control suite is **1607 tests / 102 090 assertions / 0 failures** on PHP 8.5.12 (+57/+233 = exactly the new surface) + gates ALL-GREEN. NO new config keys (timeouts/retries are constants + per-call options; `LLM_CACHE_*` landed in block 1). Blocks 3–5 follow: the admin «LLM API» tab (+ the i18n keys INTO the active 49), the swarm-zone agent API (`/api/v1/llm/chat`, `/api/v1/llm/tasks`), the purge CLI + stats + docs + ADR-072.
• **LLM API foundation — migration `024_llm_api.sql` (owner directive 2026-10-25, block 1/5; the contour is DARK — no routes/client/UI yet)**: five idempotent tables per the store spec `reference/llm-api/README-IYA-LLM-API.md` (reference implementation revoap.com, contracts read before the schema; NO secrets copied): `llm_providers` (slug UNIQUE; `api_key_enc` stores ONLY AES-256-GCM ciphertext on APP_KEY — plaintext keys never touch the DB/logs/cache/store; server-derived `key_mask`; `key_source` db|env|config provenance CHECK), `llm_models` (UNIQUE(provider_id, model_id), cascade), `llm_cache` (the MANDATORY local response cache: key PK = sha256(VERSION|provider|model|messages|options) — API keys/auth are never part of the key or value; `short_key` for UI tooltips only; `hits`/`last_hit_at`; `expires_at` + the purge index), `llm_tasks` (PO/dev-agent delegation: status CHECK pending/running/done/error; nullable agent FK ON DELETE SET NULL; `cache_hit`; the poller index) and `llm_usage` (the per-call ledger mirroring the revoap 018 accounting: `cache_read_tokens`/`cache_write_tokens`/`cache_discount` NULLABLE where NULL means "not reported" — never confused with a reported zero; the discount is SIGNED). New config keys `LLM_CACHE_ENABLED=true` + `LLM_CACHE_TTL=86400` (compiled defaults + `.env.example` + the parity registry, B-005). `MigrationsTest` owns the 024=llm contract and a fresh-migrate test asserting the tables, the three indexes, the live null-vs-zero rule and both CHECK vocabularies; the control suite is **1550 tests / 101 857 assertions / 0 failures** (+1/+50 = exactly the new surface). Blocks 2–5 follow: LlmClient + transport seam + the cache, the admin «LLM API» tab, the swarm-zone agent API (`/api/v1/llm/chat`, `/api/v1/llm/tasks`), the purge CLI + stats + docs + ADR-072.
• **i18n: complete Catalan (`ca`) locale — 1784/1784 keys, LATIN with ela geminada and the formal «vós» register (P22/R3 wave-7, s50 staged a+b + s51 landed)**: `web/i18n/_platform.ca.json` (101 599 B, sha256 `3c9009a6…`, LTR, native «Català» == the builder table `scripts/build_i18n.php:73`) + regenerated `ca.json` and all 66 locale catalogs; coverage gate **48/66 → 49/66**; `_active.json` 49 locales (`b8fd589d83635dbc`; ADR-071 — live by construction, the switcher offers 49 live + 17 «coming soon»); `.env.example` `SUPPORTED_LOCALES` += `ca` (49 codes; the parity gate `LocaleActivationTest` green); WaitlistTest locale pin 48→49 (still the ONLY locale pin — re-grepped `tests/` per trap #100). Register/orthography, every threshold FACT-CHECKED live by `ca_factcheck.py` before any translation (output archived): formal vós (-eu/-iu imperatives Escriviu/Confirmeu/Deseu; infinitive buttons — the es/fr catalog pattern), elision apostrophe = ASCII U+0027 ALWAYS (l'/d'/s' — the fr convention, measured 246 vs 16 stray U+2019), U+2018/U+2019 forbidden; ela geminada = the SEQUENCE l+U+00B7+l (×36; a lone U+00B7 is the EN-base bullet separator and stays untouched); ca legitimately uses BOTH ò AND ó (acció) — only á is foreign; the forbidden foreign set is ZERO (ñ/á/¿/¡, the fr circumflex set + æ/œ/ÿ, the pt nasals ã/õ); catalog diacritics à 171 / è 43 / ò 32 / ï 32 / ç 153. Anti-copypaste asserted against BOTH close sisters (the measured Romance identity matrix: es-fr 3.5%, the closest landed pair es-pt 15.3%): **es 90.53% / fr 94.96% differ** (floors 60/65 ≈ 2× the closest-pair identity ceiling) with 56 es + 48 fr whole-word markers asserted ABSENT (ca-legitimate words excluded BY MEASUREMENT: compte/visites fr-side — ca «compte» = account, «visites» = the ca plural; buscar/guardar/factura/idioma/informe/entrada/nombre/cuota/analítica es-side); 17 ca-marker floors PRESENT (enllaç 61, correu 47, dades 35, pàgina 32, contrasenya 31, sessió 30, estadístiques 29, propietari 21, adreça 17, límit 17, equip 15, configuració 10, gratuït 9, sol·licitud 5, informació 5, cancel·lar 4, paraula 1 — all 27 candidates measured 0 in the five landed Romance catalogs, so every hit is genuine); EN-identical 4.15% (cap 25; calibration es 4.0 / fr 6.6); ca-presence 460/904 = 50.88% (floor 40; DISTINCTIVE-only function list — shared Romance words de/la/el/que/no measured 50–65% es cross-hits and were removed; final list cross-checks es 0.0% / fr 0.0% / pt 0.6% / it 7.6%); formal-register vostre/vós ×75; `mail.*` newline parity 8/8; the verbatim JSON example payload `links.import_payload_hint` byte-exact including the real U+2026; U+2013 (subdomain.invalid), U+2605 and curly doubles (views) preserved. Pipeline: 13 fragments written ASCII-first with @@EMD@@/@@ELL@@/@@GE@@ tokens (`ca_fixchars.py` chr()-substitution, `ca_normalize.py` NFC + U+2019→U+0027 + l.l→l·l, audited no-op on the live uz catalog), each validated with `VALIDATE_EXIT=0` READ FROM THE FILE (#104) and pushed to `staging/i18n-wave/` BEFORE landing (a `87d6d5db` + b `c1081450` in s50; c `7f81f0e2`, d `bd65f56e`, e `d38f5e3e`, f `9a002b04`, g `5bcaae60`, h `83d22dcd`, i `4a3e2fe9`, j `e405b240`, k `311791f8`, l `48cf6986`, m `07aa5719` in s51), then #103 FACT==PLAN assembly (`assemble_ca_full.py`; catalog floors derived HONESTLY from the measured assembly via `ca_measure_full.py`) → ONE all-or-nothing landing commit `08ad8ac` (71 files, +3 577/−1 784; the 66-catalog generated_at churn INCLUDED per the uz landing `c05baeb` precedent — a build_i18n round legitimately moves all 66). Validator `validate_ca_frags.py` `9467bc04…` SELF-TESTED 6/6 before first use (#114: a live es catalog fails exactly the language guards; injected ñ/es-word/U+2019 each trip their own guard; 78 orthographically-legal es values trip anti-copypaste precisely). Live: Contract 83/89 597 · Sync 6/186 · Waitlist 12/212 · LocaleActivation 11/45 · ChangelogFreeze 5/15 · HttpSmoke 37/222 · ConfigEnvParity 4/150 + Precedence 6/6 · control suite **1549 tests / 101 807 assertions / 0 failures** (168 s foreground; +1 881 assertions = the ca catalog-contract iterations, the same delta pattern as the six previous waves).
• **i18n activation gate — a complete catalog is live by construction (ADR-071, s49; closes defect s48-01 permanently)**: the six P22/R3 wave locales (`id ur ms az kk uz` = 10 704 keys) were landed, built, deployed and byte-verified on prod yet unreachable at runtime, because the ONLY source of "this locale is live" was the hand-maintained `SUPPORTED_LOCALES` .env line (42 legacy codes) while the switcher was built from the catalogs and honestly offered «Oʻzbekcha» — so `POST /lang/uz` answered 303 and changed NOTHING (no cookie, `<html lang="en">` stayed, no error, no toast). Every gate was green: each asserted its own surface (coverage, keys, deployed bytes) and none asserted REACHABILITY. New single source of truth `(SUPPORTED_LOCALES ∪ web/i18n/_active.json) − DISABLED_LOCALES` in `Iya\Core\ActiveLocales`, read by ALL FOUR consumers that used to read the env list alone: `LocaleResolver::supports()`, `HostResolver` (language subdomains — `uz.iya.ru` now works with no env edit), `View::languages()` (the switcher AND the `hreflang` alternates) and `AccountController::updatePreferences()` (which had the same env-only gate, so a user could not even SAVE `uz`). `scripts/build_i18n.php` now emits `web/i18n/_active.json` (the sorted list of locales whose catalog covers every `_base.en.json` key; exact key equality, not the rounded percentage) and `--check` byte-compares it, so a stale artifact reddens the i18n gate; the artifact is deterministic (no timestamp) and `docs/I18N-STATUS.md` gains a generated "Activation (ADR-071)" section. The switcher offers the live set as switchable and renders the 18 not-yet-complete catalogs as disabled "coming soon" entries (`aria-disabled`, no form → a dead click is impossible), reusing the existing `alerts.kind_soon` key because a new `_base.en.json` key would invalidate the completeness of all 48 landed catalogs. `SUPPORTED_LOCALES` stays the owner override in both directions and new `DISABLED_LOCALES` (default `''`; B-005: defaults + `.env.example`) force-disables a complete locale without a redeploy; `.env.example` gains the six codes so a rebuilt environment is correct by construction. Fail-closed throughout: a missing/corrupt artifact yields an empty complete-set (env list alone), never "every catalog found", and only bare lowercase `[a-z]{2,3}` codes are accepted from it. Gates: new `LocaleActivationTest` (11 tests / 45 assertions, written as relationships not literals — the artifact equals an INDEPENDENT recomputation from disk, every complete catalog is live even though the suite boots a 9-code env list i.e. the defect reproduced under test, resolver agrees with `ActiveLocales`, `.env.example` parity both ways, disable wins over a complete catalog, env force-enables an incomplete one, `en` survives an empty list and an explicit disable, six corrupt/hostile artifact bodies fail closed, the live set is duplicate-free/lowercase/stable) + `HttpSmokeTest` +2 methods (the switcher offers EXACTLY the live set; not-live catalogs are never form targets; every `hreflang` alternate is live; each of the six wave locales renders its own `<html lang>` and `home.hero_title`) + `build_i18n --check` byte-compare + the live prod battery `s49_live_prod_check.py` (34 checks, the polarity-flipped successor of `s48_live_prod_check.py` which asserted the defect ON PURPOSE so this round could not forget to flip it). Verified: control suite **1544 tests / 99 911 assertions / 0 failures** (228 s foreground, +13/+78 = exactly the new gate surface), targeted LocaleActivation 11/45 · HttpSmoke 37/222 · I18nCatalogContract 6/86 809 · I18nSync 4/71 · Waitlist 12/209 · ConfigEnvParity 4/150 · Config 34/305, `gates.sh --quick` ALL-GREEN with lint 409/0 (+2), php85-lint 410/0 (+2), i18n 48/66 (1784), audit 668/0, dead-link 0 (139), coverage 124/160. The 66 generated catalogs are deliberately NOT in the commit: rebuilding them moved only `_meta.generated_at`, and an assert in `s49_push_commit.py` now fails if any `web/i18n/<ll>.json` churns. The owner applied the immediate one-line env fix on prod at 12:36 MSK (`SUPPORTED_LOCALES` += `,id,ur,ms,az,kk,uz` + `systemctl reload php-fpm85`, mandatory because `Config` caches `.env` per process; backup `/root/iya-deploy/env-before-locale-20261025-122952`) and the agent re-verified it independently over HTTPS with a fresh cookie jar per locale — all six switch, controls `de`/`en` hold, `ca`/`hy`/`ta` stay fail-closed.
• **CHANGELOG hygiene — released sections are byte-frozen (defect s49-03, s49)**: the two s48 bullets (the `uz` locale and PLAYBOOK `#112–#120`) had been filed under the ALREADY RELEASED `## [2.0.0] — 2026-10-17` section instead of `## [Unreleased]`, i.e. work landed on 2026-10-25 was recorded as shipped eight days earlier. Moved back verbatim (reverse-chronological order preserved) and guarded by a new `ChangelogFreezeTest`: `docs/CHANGELOG-FROZEN.json` records the sha256 of every released section, the test recomputes and compares, asserts `[Unreleased]` is first, and asserts the manifest covers every released section — so touching history requires a deliberate regeneration (`php scripts/build_changelog_freeze.php`).
• **i18n: complete Uzbek (`uz`) locale — 1784/1784 keys, LATIN with the U+02BB/U+02BC orthography (P22/R3 wave-6, s47 staged + s48 landed)**: `web/i18n/_platform.uz.json` (101 244 B, sha256 `dd9cc370…`, LTR, native «Oʻzbekcha» == the builder table `scripts/build_i18n.php:68`, formal «siz» register) + regenerated `uz.json` and all 66 locale catalogs; coverage gate **47/66 → 48/66**; WaitlistTest locale pin 47→48 (still the ONLY locale pin — re-grepped `tests/` per trap #100). Orthography contract pinned by `uz_orthography_selftest.py` 30/30: `o'`/`g'` → U+02BB always EXCEPT the `ko'`/`so'n`/`no'` families → U+02BC (`koʼrsatish`, `soʼng`, `noʼn`; but `soʻrov`, `soʻz` keep U+02BB), word-initial `qo'`/`bo'` → U+02BB, every other apostrophe → U+02BC (`maʼlumot`, `aʼzo`, `sanʼat`); catalog facts oʻ=502 / gʻ=40 (floors 60/8), ASCII apostrophes 0, typographic single quotes 0, foreign Turkic diacritics 0, CJK/cyrillic/devanagari/arabic/mixed 0. Anti-copypaste asserted against BOTH close relatives (measured closest landed pair is az–tr 7.3%): **tr 96.5% / az 94.0% differ** (floor 40) with 32 tr + 14 az markers asserted ABSENT and shared loanwords (parol, server) excluded from the marker class; uz markers PRESENT (havola ×48, xabar ×42, hisob ×36, kirish ×16, sozlama ×14, foydalanuvchi ×11); EN-identical 4.2% (cap 25%); uz-presence 434/711 = 61.0% (floor 40%, U+02BB-aware tokenizer + the conjunction class included from the start); `mail.*` newline parity 8/8; the verbatim JSON example payload `links.import_payload_hint` is byte-exact including the real U+2026. Pipeline: 13 fragments written ASCII-first, normalised by `uz_normalize.py` (+ the new `uz_fixchars.py` for U+2026/U+2014/U+2265), each validated with an explicit `VALIDATE_EXIT=0` read from a file and pushed to `staging/i18n-wave/` before landing, then #103 FACT==PLAN assembly (letters a..m AND the per-group key counts) → a single all-or-nothing landing commit. Live: I18nCatalogContract 6/6 (86 809) · I18nSync 4/4 (71) · Waitlist 12/12 (209) · control suite **1531/99833/0** (+1881 assertions = the uz catalog-contract iterations, the same delta pattern as id/ur/ms/az/kk).
• **RESILIENCE-PLAYBOOK §6 += traps #112–#120 (the deferred s47 debt, closed in s48)**: #112 drill runners must live at `REPO/scripts/drill-runners/` (`cd $(dirname $0)/../..` = TWO levels; the directory is untracked in git by design) · #113 `write_file` does not reliably deliver RARE non-ASCII (two U+02BB came out as the truncated escape `\u02bl` = a hard SyntaxError) → write ASCII, build rare characters with `chr()`, verify byte-count + `ast.parse` immediately · #114 every NEW validator/guard must be self-tested on a LIVE landed catalog AND on deliberately corrupted data (this is what found all four uz guard defects) · #115 a zero-width ALTERNATION `(?<![W])|(?![W])` is true everywhere, so a "word boundary" degenerates → conjunction + `finditer` · #116 the gateway `note` limit is **8192 BYTES** (not characters) → keep the full round-end text as a `staging/reports/` artifact and post a condensed pair · #117 a session snapshot only proves state up to its own timestamp (the s47 snapshot carried NO uz artifacts) and an oss kit DIRECTORY can lag its own tar → re-pull everything staged later from `staging/` and verify the kit by sha · #118 an absolute workspace path inside a patch-script STRING can come back as the literal `"$ARENA_WORKSPACE"` → patch scripts are files (never heredocs), tool strings stay ASCII and path-free, `ast.parse` after every patch · #119 `gwh.put_file(remote, local)` expects a PATH, not content (`put_text` is the content variant) · #120 `assemble_uz_full.py` globs `uz_frag_*.json`, so `.raw.json` siblings break the #103 letter check → keep raw inputs in `i18n-wave/raw/` instead of loosening the assert.
• **i18n: complete Kazakh (`kk`) locale — 1784/1784 keys, CYRILLIC (P22/R3 wave-5, s46)**: `web/i18n/_platform.kk.json` (LTR, native «Қазақша», formal «сіз» register) + regenerated `kk.json` and all 66 locale catalogs; coverage gate **46/66 → 47/66**; WaitlistTest locale pin 46→47 (the only pin). Flipped validator profile: Cyrillic presence ≥85% of values (fact 97.5%; 12 latin-only = brands/tech terms), CJK/devanagari/arabic/mixed-script = 0, ur-style lowercase-latin sandwich guard = 0; anti-copypaste vs `_platform.ru.json` 94.5% differ (floor 40%) with 22 Russian marker stems fact-checked against the live ru catalog and asserted ABSENT (shared loanwords пароль/статус/адрес deliberately not markers); Kazakh markers PRESENT (сілтеме ×48, кіру ×63, пароль ×27, баптау ×11, хәбарландыру ×12); EN-identical 2.5% (cap 25%); kk-presence (own function-word list) 56.9% (floor 40%). Pipeline: 13 fragments (write_file only) → per-fragment validation + store step-backup → #103 FACT==PLAN assembly → single all-or-nothing landing commit. Live: I18nCatalogContract 6/6 (84 962) · I18nSync 4/4 · Waitlist 12/12 (206) · control suite 1531/97952/0.
• **Gateway v1.1.1 — dash sign-out is POST-only with a stateless hourly CSRF token (owner decision s46)**: `op=dash_logout` GET → 405 + `Allow: POST`; POST without a valid `dash_csrf` → 403; both audited (`dash_logout_method_reject` / `dash_logout_csrf_reject`). CSRF = `HMAC-SHA256("qwen-dash-csrf-v1|YYYYMMDDHH", token|md5)` — same secret material and current+previous-hour rotation window as the session cookie, zero server state. The dashboard renders Sign out as a POST form with a hidden input (was a prefetchable GET link — trap #111). Drill 110 → **112 checks ×2** (L23 re-purposed, L27/L28 new); version pins updated in the same commit (drill A2/H3/J1/L3/L26, prod batteries). Docs: QWEN-ACCESS §4.1/§9.1/§10.
• **Bundle scripts exclude secrets (owner decision s46)**: `pack_bundle.sh` (DEV-BUNDLE) AND `pack_p12.sh` (phase archives — STRIPE et al.) now exclude `iya-platform/.env` (exact; tracked `.env.example` stays) plus defensive `*.pem/*.key/*.p12/id_rsa*`, each with a fail-closed secret-sweep (any hit → FATAL, no archive). The store DEV-BUNDLE and the oss STRIPE archive were REPACKED at the kk content boundary with this fix (verified: 0 `.env` entries in both; DEV-BUNDLE `84b3e5f4…` at head `8bfc6e5`, STRIPE `1871384f…` at `8bfc6e5`; loose manifests ×2 + `.sha256` sidecars ×3 refreshed with live gate numbers).
• **Gateway v1.1.0 — context-economy ops + owner ops dashboard + hourly
• **LINK-404-AUDIT tooling + fail-closed link gate — owner directive s42(a)
• **DOCS-FRESHNESS pass — owner directive s42(b) executed (s44)**: mechanical
• **Complete Azerbaijani (`az`) locale — P22/R3 wave-4 landed (s43,
• **Complete Malay (`ms`) locale — P22/R3 wave-3 landed (s42,
• **Complete Urdu (`ur`) locale — P22/R3 wave-2 landed (s41,
• **Complete Indonesian (`id`) locale — P22/R3 wave-1 landed (s40,
• **/pricing integrity fix — the Team stub card is gone (ADR-068 p.5,
• **P22/R2 CLOSED — per-plan visits retention in the purge worker (ADR-069,
• **P22/R4 CLOSED — custom-domains feasibility spike → ADR-068 «option C:
• **P22 APPROVED + R1 (agent part) — production mail cutover runbook
• **prod-wishlist (г) — `qwen_access/` store-zone exposure probe + owner
• **prod-wishlist (а) — MCP CSRF posture documented + frozen (s38-D)**:
• **prod-wishlist (в) — QWEN-ACCESS prod-token & semi-public-store docs

Changed

• **i18n scope: R3 CLOSED — languages FROZEN at 49/66 by owner directive (2026-10-25, s52)**: the seven P22/R3 waves (`id ur ms az kk uz ca` = 12 488 platform strings) plus the 42 legacy locales are the LIVE set (`web/i18n/_active.json` = 49, ADR-071); the remaining 17 catalogs are out of scope / future work by the same directive — no new locale waves. `scripts/build_i18n.php` now computes the freeze banner into the generated `docs/I18N-STATUS.md` header (the count is derived from the report, never hardcoded, so the banner cannot go stale); `docs/P22-PLAN.md` books R3 as FROZEN-49 with the revised DoD (**49/66**, owner decision — the original 66/66 target is superseded) and the s52 execution record; `docs/I18N.md` and `docs/README.md` carry the freeze status. The i18n gate target stays **49/66** (full coverage = the active set); all 66 catalogs keep generating (that is not locale work). **P22 = 3/5** (R2/R3/R4 closed; R0/R1 are owner-blocked).
• **PHP 8.5.12 everywhere (owner directive 2026-10-25, s52)**: the project no longer carries an 8.2 identity — `Iya\Core\Version::PHP_MIN` raised `8.2` -> `8.5`, `bin/iya doctor` checks `PHP >= 8.5`, and the labels in `docs/ENVIRONMENT.md`, `AGENTS.md`, `docs/DEPLOYMENT.md`, `docs/AGENT-GUIDE.md` and the `Dockerfile` now say **8.5.12** (prod `/opt/php85`, CI, Docker and the agent sandbox via `packages.sury.org` — the ondrej PPA is Ubuntu-only, sury is the same maintainer's Debian repo). `scripts/setup-env.sh` installs `php8.5-*` from sury and, if sury is unreachable, falls back to the distro PHP with an HONEST "sandbox floor <ver>, target 8.5.12" warning — the project is never labelled 8.2 again. The ADR-063 note is rewritten: sandbox == prod == 8.5.12, and `scripts/_php85_lint.php` stays as the defense-in-depth static gate.
• **P22/R3 RESCOPED before starting (ADR-070, s39-F)**: live measurement
• **QWEN-ACCESS §8.1 owner-directive amendment (s38-C)**: the prod gateway

Fixed

• **Suite failures on PHP 8.5.12 (defect s52-01, s52)**: `ReflectionMethod::setAccessible()` is deprecated since PHP 8.5 (it has been a no-op since 8.1) and `tests/run.php` escalates deprecations to `ErrorException` — 7 failures across 6 files (`AgentSseTest`, `McpCsrfPostureTest`, `ConfigEnvParityTest` ×2, `MailerTest`, `GeoIpTest` ×2; suite 1549/101 672/7 on 8.5.12 vs the 1549/101 807/0 control on 8.2.35). The 7 no-op calls are removed and `_php85_lint.php` gains the append-only rule `reflection-set-accessible` so the pattern is statically gated; the suite on 8.5.12 is back to **1549 tests / 101 807 assertions / 0 failures**. The prod surface was never affected (153/153 + the 43-check activation battery live on prod's 8.5.12).

2.1.0

�� 2026-10-23 — "Billing-ready"

Fixed

• **B-008** (`Db::update`, latent since P3): a null WHERE value compiled to

Added

• Notifications pipeline (P10a): stdlib `Mailer` (log/sendmail/SMTP with
• Event webhooks (P10b): `WebhookService` (docs/API.md catalogue, static SSRF
• Threshold alerts (P10c): `AlertService` — traffic spike/drop vs the 24 h
• Link comments (P10d): one-level threading with flatten, resolve/reopen,
• Teams (P10e): auto-provisioned owner team, role ladder
• Abuse reporting & spam intake (P8.6, ADR-013): outbound AbuseIPDB reports for
• Spam intake `POST /api/v1/intel/spam-report` (shared secret via
• Admin → Settings card "Abuse reporting & spam intake": report_attacks /
• `docs/ABUSE-REPORTING.md` (operator guide: endpoint contract, curl/rspamd
• Visit capture pipeline (P5 core): `VisitService::capture()` on the response
• `ThreatDetection`: the legacy 54 KB `HackDetectionService` reorganised into a
• Consent-gated JS tracker (`tracker.js`) + `/tracker/collect` (pixel & beacon)
• First-party identifier cookies (`iya_consent`, `iya_vid`, `iya_sid`),
• Anonymous privacy mode keeps honest aggregate counters in `rollups` while

Added (P17/P18)

• **P17/C5 — reviewer contour: pairwise tasks, strict CSV, reputation** (plan
• **P17/C4 — deterministic ScoreEngine + production baselines + score feed**
• **P17/C3 — isolated runner L1 + test execution** (plan §8, ADR-025):
• **P17/C2 — candidate intake + L0 static gates** (plan §5.3/§8.3, ADR-024):
• **P17/C1 — contribution allowlist, source sanitizer, challenge issuance**
• **P17/C0 — contribution pipeline contracts & skeleton** (ADR-019/021):
• **P18/S4 — subdomain trio, P18 CLOSED**: `subdomainAppearance` (title/
• **P18/S3 — API tokens, data export, account deletion + the test suite**:
• **P18/S2 — security layer**: `security` hub page (password form, 2FA
• **P18/S1 — profile/preferences/privacy**: `updateProfile` (service
• **P18/S0 — `/dashboard/settings` restored** (ADR-020): 21 canonical settings
• P18 planning & loss inventory (ADR-020): `docs/SETTINGS-PLAN.md` — rebuild of
• P14 security/load pass: **ip_blocks edge enforcement** (`IpBlockGuard` in
• P14(b) N+1 sweep: `SwarmService::agentName()` memoised + `primeAgentNames()`
• P15 beta loop: `scripts/_beta_journey.py` — 13-check golden-path E2E
• P16 release engineering: runtime `Dockerfile` (php8.2-cli-alpine,
• P16 deferred P10 emitters shipped: **`link.target_down`** (`TargetChecker`

I18n

• Locales completed this cycle: he (RTL), fa (RTL), hi, bn (🏁 milestone 40),

Changed

• `ip_internal` no longer requires consent when observed server-side (trusted
• Maintenance worker enriches queued visits with real GeoIP/UA/threat

2.0.0

�� 2026-10-17 — "Swarm"

Added

• Personal subdomains (`organization.iya.ru`) with nested link paths
• Visit analytics with 127 captured fields per visit, rollup tables, realtime
• Agent swarm: GET-first API with 60+ endpoints — registration, profiles,
• Machine discovery: `/llms.txt`, `/agents.json`, `/api/v1/openapi.json`
• Identity: registration, login, email verification, password reset, TOTP
• Teams with owner/admin/editor/viewer roles, invitations and shared statistics
• Privacy: four collection modes (minimal, standard, extended, anonymous),
• Security: Argon2id hashing, CSRF, rate limiting per IP/token/endpoint,
• Platform: 77-table schema with checksummed migrations for SQLite and MySQL,
• Design system: tokens, shadcn-style components, utilities, RTL support,
• i18n: 66 locale catalogs generated from the original 43-language service
• Tooling: dependency-free test runner, `bin/iya` console (doctor, migrate,

Changed

• **The visitor IP is now the external, publicly routable address.** The
• A LAN address observed for the same client is kept in a **separate**
• Visits are stored as one row per visit instead of one row per IP; the old
• Removed every third-party dependency from the page: no cdnjs Font Awesome,
• Public statistics became owner-controlled: the visit list, IPs, internal
• Legacy compatibility kept: `/1.2.3.4/`, `/123/`, `<ip>.iya.ru`,

Fixed

• `info.php` (a public `phpinfo()`) removed; `display_errors` is off in
• `ip-info-widget.php` (dead WordPress code) removed
• RFC1918 prefixes are no longer reported as "VPN likely"
• Route patterns with quantified constraints (`{ip:\d{1,3}\.…}`) compile
• `X-Frame-Options`, CSP `frame-ancestors` and `Referrer-Policy` are set on
• Language catalogs no longer emit a UTF-8 BOM into the response

Security

• Passwords: Argon2id (64 MiB, t=4) with a transparent rehash path
• Tokens: only SHA-256 hashes stored; agent tokens are long-lived, rotatable
• Cookies: `Secure`, `HttpOnly`, `SameSite=Lax`, host-scoped
• Sessions: database-backed, regenerated on privilege change, garbage
• Outbound requests: SSRF guard validates scheme, host, port and *every*
• Threat detection retained and reorganised from the legacy

Removed

• Yandex.Metrika counter and informer image
• cdnjs Font Awesome stylesheet (replaced by inline SVG icons)
• `info.php`, `ip-info-widget.php`, `elements.html`, `generic.html`
• The `UNIQUE(ip)` constraint on the visitor table