feat: integrate reviewed proxy page and managed model keys

Source-candidate: poe d9a564e6d20f5f0fd75ce45b12cbbf8bb4c9d568\nSource-candidate: magica38ba5762b06716db1dee00d0afec162656488f5c\nValidated321whole-file phase plus whole bus1349/model-proxy100/webui490; final gate tooling checks pending, not landed.

docs/plans/2026-10-24_model-proxy-rows.md

@@ -216,7 +216,10 @@ delists the agent, and no session starts on a key the proxy refuses.
      how the code relies on that.
 6. **Preflight (D17).** Before each launch in proxy mode, the bus sends one `GET /v1/models` with the agent's
    key. A 401 refuses `proxy-key-refused`, and a connection failure refuses `proxy-down`. A session with no
-   output for `proxy.firstOutputSeconds` (default 120) is stopped and logged as `proxy-stall`.
+   output during the one initial `proxy.firstOutputSeconds` budget (default 120), armed by successful
+   first actual adapter-child spawn, is stopped and logged as `proxy-stall`. Idle before then is
+   unarmed; later turns do not reset or extend it; first output cancels. Invalid first-turn metadata
+   uses the same existing stop and value-free receipt once, unless output already cancelled it.
 7. If P1 found that a client key can be limited to some models, narrow each agent's key to its role's
    models. If it can't, say so in BUILD.md. The bundle's model choice stays the guard.
 

docs/plans/2026-10-24_stack-model-proxy.md

@@ -249,8 +249,13 @@ D17. **Key and proxy preflight.** Before a launch in proxy mode, the bus makes o
 `GET /v1/models`. The build row confirms on the stand-in that this is answered locally with no upstream call. A
 401 refuses the launch with `proxy-key-refused`. A connection failure refuses with `proxy-down`. Neither starts a
 session, so a revoked key never reaches Claude Code's silent retry. A key that is revoked mid-session is
-revoked by the stack, which stops that session first (D14). A session with no output for
-`proxy.firstOutputSeconds` (default 120) is stopped and logged as `proxy-stall`.
+revoked by the stack, which stops that session first (D14). Idle before the first actual adapter turn
+is unarmed. The successful adapter-child spawn arms one initial `proxy.firstOutputSeconds` budget
+(default 120) per proxy run; later turns never reset or extend it and first output cancels it. A turn
+still silent when that budget expires is stopped through the existing trusted path and logged as
+`proxy-stall`. Invalid first-turn metadata also uses that same stop and value-free receipt once,
+unless first output already cancelled the watcher. The internal timestamp protocol uses the current
+Linux host/runner shared monotonic clock; a confined timestamp-bound check is required verification.
 
 ## 7. Usage and limits
 

docs/plans/DEFERRED.md

@@ -820,3 +820,11 @@ refresh. The proxy kept serving with its fallback version. Evidence: origin/feth
 cutover, find a config switch that turns these off and set it in P1's initial config with a test, or
 decide on purpose to allow or block that egress and record it in P7's receipt. Tracked as Vikunja 633
 (umbrella 237).
+
+## Row 331: human-only per-agent model rotation override — P7
+
+Sage ruling sage-4388 (2026-10-24) limits P2 to the 30-day model-key rotation default,
+with no setter and no `proxy.rotate --agent --rotate-by` verb. A human-only
+per-agent rotation override is bound to P7, with Jason's cutover/settings review.
+It must preserve D20/Q222: no agent or tester can change the period. Row 331 ships
+only the default and the approved proxy.json grace/first-output settings.