feat(conversation): CHAT-03 I1, mediated control of a sealed headless Pi (#1507)

Controller, claim store, live-session guard, engine link and seal,
turn tracker, cohort force stop and recovery, client library,
transcript and mediated terminal, with the fake engine and tests.
Fixtures only; no live cutover.

Dewey built it. Darkwing (comment 26690) and Filbert (comment 26694)
approved round 2. Manifest I1-r2-manifest.sha256 (2b48e333, 27 files).
Suites on an export: conversation 152/152, control-board 124, webui 14,
seat 19, chat-00/01/01c checks, and all nine scripts/test-*.sh green.
Follow-ups for I3 are in DEFERRED. Gate E stays with Jason.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/SESSIONS.md

@@ -475,3 +475,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-04T19:56:14Z | Sage (T3 Claude Code, thread 1ef1e4f8) | slice 1 addendum A | Darkwing's addendum (0b36acb0) committed as a record; lead decision 49; PRD draft 0.3; assigned Researcher Vikunja probes P1-P7 on a scratch container and Darkwing the task_snapshots prototype extension
 2026-10-04T19:59:24Z | Sage (T3 Claude Code, thread 1ef1e4f8) | slice 1 prototype v2 | Darkwing's schema-v2, proto-v2 and outputs committed as records after a Sage rerun on Node 26; lead decision 50 accepts the five choices beyond addendum A; Researcher probes P1-P7 still running
 2026-10-04T20:25:29Z | Dewey (T3 Claude Code) | row 5 CHAT-03 I1 round-1 rework | Darkwing B1-B2 and Filbert B1-B6 fixed; conversation 152/152, other suites green; 60 of 61 mutants killed (r2-B5b survives, recorded); manifest 2b48e333; round 2 requested, comment 26689 on #1507 (revs 56-58); nothing committed
+2026-10-04T20:42:10Z | Filbert (claude, T3 9cb9731e) | row 5 CHAT-03 I1 round 2 review (#1507) | approve: B1-B6 fixed (probes rerun, round 1 mutants killed; freeze path read, code waits for frozen 1 before members); follow-ups F1 (enumeration-under-freeze test, C4 and r2-B5b survive), F2 (takeover+Enter in one chunk), F3 (preArgs override reaches Pi unsealed); comment 26694; queue rev 60 committed ddd9cf36 (not pushed); review file agents/filbert/work/chat-03-i1-review-r2-2026-10-04.md sha256 2f88ccd9 (uncommitted)
+2026-10-04T20:47:45Z | Sage (T3 Claude Code, thread 1ef1e4f8) | row 5 CHAT-03 I1 commit | both round 2 approvals (26690, 26694); manifest 2b48e333 checked; all suites green on an export; candidate, packets and Filbert's review record committed; follow-ups in DEFERRED; row 5 to waiting-on-jason for Gate E

docs/plans/DEFERRED.md

@@ -185,6 +185,26 @@ at every gate. Started 2026-09-12 during the control board MVP.
   Slice 1 role tokens stay in the broker (lead decision 47). The workers'
   own exposure needs a separate piece. Filbert, survey section 8.6.
   (2026-10-04)
+- **CHAT-03 I1 round 2 follow-ups, for the I3 brief.** Neither reviewer
+  held any of these as blocking (Darkwing comment 26690, Filbert comment
+  26694 on #1507).
+  - The engine command and `preArgs` sit outside the seal. They're
+    documented as a test hook, but `preArgs` with the default command
+    reaches real Pi unsealed. The I3 entry point must not take them from
+    config. Both reviewers found this.
+  - `engine.env` defaults to `process.env`. I3 builds the engine's
+    environment from an explicit list. Darkwing F3.
+  - `escalating` is set in `controller.mjs` before `after()` runs. If
+    admission or poison throws, the flag stays set, and later force stops
+    are refused as `fenced` until restart. Darkwing F2.
+  - No test proves that the processes are listed only after the cgroup
+    is frozen. The code waits for `frozen 1` in `cgroup.events`, and
+    both Filbert and Dewey confirmed it by reading it. Mutants r2-B5b and
+    C4 survive. Proposed: a test-only hold after `members`, or a FUSE or
+    privileged fixture. Filbert F1.
+  - A takeover followed by Enter in the same chunk leaves the text
+    unsent. Filbert F2.
+  (2026-10-04, #1507)
 
 ## Queue