[unohee]

Summary

Findings from a max-effort review of the unreleased S6 stack. Only defects that needed no design decision are fixed here.

Defects in the stack's own gates

• AGT-4787 (fix(scheduler): idle_fill does not lift a park or backoff on an issue whose input never changed (AGT-4787) #843): the fingerprint recorded at run start included the appended comment history, the one computed at heartbeat did not, so an issue with any comment never matched and the hold never engaged. The digest now cuts at the comment-context heading. The answered-ask_human park that idle fill used to release by accident is now resumed explicitly.
• AGT-4784 (feat(daemon): dispatch only Todo and stop declined issues before the claim (AGT-4784) #846): resolveTaskFileScope dropped every draft that was not a sufficient brief, so a confident human_action_only/decision_pending verdict never reached holdDeclinedBeforeClaim. The verdict is now kept on the task (scope stays unknown). The fail-closed fallback no longer re-admits a held issue.

Fences that did not reach every entry point

• ollama-cloud direct path, tester LLM fallback, documenter, auditor, skill-documenter, openswarm work now receive workerSandbox / forbidPublication.
• AGT-4444 policy now also covers provider switches (/api/provider, saved override on boot, openswarm provider) and fanout candidates, and allowDelegatedAdapters is mapped to the runner.
• config.example.yaml no longer lists cursor in adapterRouting.fallbacks, which the daemon refuses to start with.

exec

• exec answer --text without --correlation is rejected (exit 2) instead of silently dropping the text.
• Redeploy targets the run's project_path, not process.cwd().
• A refused deploy releases the hold it wrote; thrown errors give a message and exit 2 ({error} under --json).
• Duplicate "operator paged" question no longer reported as a second approval.

Other: disk gate also measures the state DB volume; doc/comment corrections; .gitignore gains .env.* and nohup.out.

Behaviour changes to be aware of

Delegated-adapter switches return 403 without allowDelegatedAdapters; a saved override that violates the policy is ignored with a warning on boot; workerSandbox: on on a host with no sandbox now refuses bash in the stages above too; decline-draft issues are held before the claim.

Verification

• npm run ci passes. Full test:coverage on this tree: 7895 passed, 1 failed in src/verify/runner.test.ts (baseStatus: 'infra'). The failing verify test differs run to run (2 different ones on feat(daemon): dispatch only Todo and stop declined issues before the claim (AGT-4784) #846's tree, a third here); each passes alone and this diff touches nothing under src/verify. No timeout was changed.
• Each fix's new test was checked by reverting the change.
• execCommand.test.ts was over the 1500-line cap; the runExecGuarded block moved to execGuarded.test.ts.

Not fixed (design decisions, tracked separately)

Worker loopback reaching the daemon's unauthenticated mutating API; web_fetch egress and pipeline entry points without fences (PR remediation, conflictResolver, /api/exec, openswarm run); disk-gate deadlock with protected RETRY_AT worktrees; credential exposure outside the sandbox; Backlog children of a decomposition never reaching Todo; AF_UNIX blocked under the loopback profile.

The cli.ts wiring of the four exec actions is covered by typecheck only (cli.ts is outside coverage).