feat(discord): connector pilot for the Sage seat, reviewed candidate (#1509)

Zero-dependency Discord connector under packages/discord: binding
validation, REST and gateway clients, pi engine adapter, journal with
append-only inbox, outbox, admissions and notices, and a run.lock
ownership record {pid, start, boot} whose identity is checked three ways
and whose cleanup is gated by STOP. CLI check|run|stop|unlock via
scripts/discord.sh; offline suite scripts/test-discord.sh (28 checks,
87 node tests).

Reviewed by rev-code-02 on #1509 over nine rounds; approved exact tree
4e0feb6758c0a7e4a71483912a8e0d3e3ec95aef at comment 26170. Corrections
(1) to (12) recorded in BUILD-LOG. No listener started, no token read,
no Discord write; the live pilot follows this commit per the brief.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

docs/SESSIONS.md

@@ -237,3 +237,12 @@ are never rewritten or removed; corrections are new entries.
 - 2026-09-13 — filbert, native Pi — WEBUI-1507-R1 independent review APPROVED for manifest 509f20e53292d5731c866d84c73cfaf539a89104b38b12a43260075ee7c3cb4d. All 21 hashes verified; separate baseline-plus-candidate copy passed WebUI 6/6 and combined 208/208 including Chromium, 330 contrast samples and five widths. Four fresh screenshots inspected. Verdict: docs/plans/reviews/2026-09-13_webui-verdict.md. No source edits or publication; Gate E remains Jason-owned.
 
 - 2026-09-13 UTC — dewey — #1507 source published ea00ec66, exact remote verified, exact committed-tree tests 208/208 after Filbert APPROVED manifest 509f20e5. Scoped tracking records Gate E ready for Jason Monday; issue open, no deployment or unrelated source edits.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot planning: recovered Sage's private shared-signals records (setup receipts, direction memo, research packet), wrote brief docs/plans/2026-09-13_discord-connector-pilot.md, added QUEUE row 14 briefed/unassigned. No code, no listener, no Discord write, no credential read. Waiting on Jason for D1-D7.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot build (#1509, QUEUE row 14): wrote packages/discord (binding, authorize, gateway, rest, engine-pi, journal, context, connector, cli), scripts/discord.sh, scripts/test-discord.sh (28 checks, 74 node tests), agents/sage/DISCORD-USER.md draft, README, TOOLS.md section; brief section 10 records build choices. Existing suites green (config 24, auth 15, release 14, conductor 17, foundation 43, seat, ledger). Defects found and fixed before commit: two engine attribution bugs (offline tests), ceiling in-flight count (code-review subagent), and rev-code-02's four findings in #1509 comment 26114 (reconcile window refresh, context path escape, ceiling across a crash, pid claim and identity). Filbert deferred (26111). Review requested; no listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round two (#1509, QUEUE row 14): rev-code-02 comment 26121 kept the pid claim open (publication window) and found a memory-only ceiling notice and a duplicate admission across the thread lookup. Fixed all three: `run.lock` directory ownership with a four-process race test, `notices.jsonl` with a same-day restart test, id reservation with a held-lookup test. `scripts/test-discord.sh` 28/28 (80 node tests). Round three posted; files frozen for review. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round three (#1509, QUEUE row 14): rev-code-02 comment 26123 reproduced a three-party stale-reclaim race. Removed automatic reclaim; `run` fails closed on a stale lock and a new `unlock` command clears a verified-dead owner. Stale handoff and changed-under-unlock tests added. `scripts/test-discord.sh` 28/28 (82 node tests). Round four posted; files frozen. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round four (#1509, QUEUE row 14): rev-code-02 comment 26132 showed unlock's restore path can still leave two owners. Replaced it with a `STOP` quiescence gate: unlock writes `STOP` first, claims re-check `STOP` after publishing and release themselves. Four-party schedule test added. `scripts/test-discord.sh` 28/28 (82 node tests). Round five posted; files frozen. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round five (#1509, QUEUE row 14): rev-code-02 comment 26150 accepted the `STOP` gate and found the owner record lacked a boot identity plus a false promise in the unlock text. Owner record now {pid, start, boot}, three-way identity check, unreadable identity refuses everything, unlock text says use `stop`. `scripts/test-discord.sh` 28/28 (83 node tests). Round six posted; files frozen. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round six (#1509, QUEUE row 14): rev-code-02 comment 26158 found that a live pid with a pre-boot-id record was treated as a mismatch, so `unlock` cleared a lock under a running connector, and that an unparseable owner record read as absent. Both now refuse everything until the pid is dead; unreadable records are never removed. Legacy-upgrade test with a live child plus an invalid-record control. `scripts/test-discord.sh` 28/28 (85 node tests). Round seven posted; files frozen. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round seven (#1509, QUEUE row 14): rev-code-02 comment 26165 found that malformed start or boot strings in a parseable record read as a positive mismatch. Identity values now have a checked syntax; a malformed value under a live pid is "unknown" and refuses everything. Six live-child controls plus a syntax table. `scripts/test-discord.sh` 28/28 (87 node tests). Round eight posted; files frozen. No listener, no Discord write, no token read, no push.
+- 2026-09-13 UTC — coordinator (Claude) — Discord connector pilot review round eight (#1509, QUEUE row 14): rev-code-02 comment 26168 found leading-zero and above-2^64 start strings still compared as a mismatch. Start ticks now require the canonical unsigned decimal form /proc prints. Boundary table entries and three more live-child controls. `scripts/test-discord.sh` 28/28 (87 node tests). Round nine posted; files frozen. No listener, no Discord write, no token read, no push.