docs(deferred): 6b closes the leaked fake pi and concurrent hang entries; wedge-restart and startup-source follow-ups

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/DEFERRED.md

@@ -26,22 +26,7 @@ at every gate. Started 2026-09-12 during the control board MVP.
   ruled that #1512 integrates on the serial evidence; it landed in af4203ca.
   Record: `agents/darkwing/work/relaunch-activity/rerun-2026-09-26.md`.
 
-- **Discord engine: leaked fake pi on a failed test, and a timeout gap in
-  `busy`.** (a) `engine.test.mjs:100` reads the fake's `commands.jsonl` 20 ms
-  after the second prompt and gets ENOENT under load. The test stops the engine
-  outside `finally`, so the fake pi child outlives it and the test file never
-  exits. Six other tests in the file also stop outside `finally`. This is one
-  confirmed cause of the concurrent hangs in the entry below. (b) In
-  `engine-pi.mjs`, `busy` is `state.busy || pending.some((t) => !t.done)`. If a
-  turn times out before its `agent_start` is read, the turn is marked done while
-  `state.busy` is still false. The next prompt then goes straight to pi, which
-  refuses it ("agent is streaming"). It fails closed, and production timeouts
-  are long enough to make it rare. Seen twice in two default-concurrency runs,
-  and once in three on clean HEAD. Fix in source and tests only; the live
-  connector does not restart for this without Jason's word. Rocko reviews.
-  (2026-09-26, #1509, Darkwing)
 
-- **Combined concurrent test hangs need isolation.** Row18 R1 frozen six-package runs timed out at 120s/60s, with logs in `/tmp/discord-board-r1-KbMrGQWF/TESTS-first-timeout.txt` and `TESTS-second-timeout.txt`. Serialized R3 independently passes 322/322. Cause and default-concurrency stability remain unverified; investigate separately without changing connector behavior or calling interrupted runs green. (2026-09-14, #1509)
 
 - **Registration has no "set by" field.** `mosaic seat task` records the
   task and `updatedAt` but not who set it, so a human session and the
@@ -114,6 +99,22 @@ at every gate. Started 2026-09-12 during the control board MVP.
   No tools/tmux change until that piece. Found by Dewey in the CHAT-02 brief
   evidence. (2026-09-26, #1507)
 
+- **Discord wedge restarts have no cumulative stop.** Since 6b R2, a wedged
+  pi ends the connector with exit 1, and the unit restarts it. With
+  turnTimeoutSeconds 600, one cycle takes at least 645 s, longer than the
+  600 s StartLimit window. So a pi that wedges on every prompt restarts once
+  per prompt and never hits the limit. It only happens when someone sends a
+  message, and that person gets an error reply. Sage accepted it for now. The
+  fix is a separate policy (a wedge count kept across restarts). (2026-09-26,
+  #1509, Rocko 6b R2 review)
+- **Connector does not journal the source it started from.** The unit runs
+  from the live checkout, so an automatic restart loads whatever Discord
+  source is in the tree, even uncommitted source. Rocko recommends a startup
+  journal line with HEAD, the dirty state of `packages/discord` and a digest
+  of the runtime files. Until then the rule is that unreviewed Discord source
+  stays uncommitted in the tree only as long as a review needs it.
+  (2026-09-26, #1509)
+
 ## Queue
 
 Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
@@ -125,3 +126,6 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
 - Sage launcher hook uncommitted (2026-09-12): closed by the agents/sage launch files commit, Dewey review R1 revise, R2 approve (`agents/dewey/work/sage-launch-review-2026-09-26.md`), launcher test now covers sage.
 - Ledger counts T3 agent messages as human (2026-09-26, #1506): fixed in ef0020ad (Darkwing 6a, Filbert reviewed). `messageKind` now counts a T3 header as agent and the control-board sender as board. It changes no current count, because no source the ledger reads has a T3 header yet. That waits for the T3 thread source (Gate F).
 - Control board checked the bind address but not Host or Origin (2026-09-26, #1507, found by Dewey): closed by the board guard commit. `foreignRequest` refuses a non-loopback Host, a wrong port, userinfo or a path in Host, and any foreign Origin on every route. Dewey authored it, and Rocko approved it (`agents/rocko/work/board-guard-review-2026-09-26.md`, 5a12f08e). Rocko's one low finding: URL normalization accepts a root slash, empty userinfo and an empty query in Host, so the notes' wording overstates what the raw-syntax check refuses. No bypass was found.
+- Discord engine: leaked fake pi and the timeout gap in `busy` (2026-09-26, #1509): fixed in 3edb15eb (Darkwing 6b R2, Rocko approved, review ed5510a0). Tests stop the engine in `finally`. A turn pi never started now stops pi with exit 1 instead of guessing, and the unit restarts it. Known limit: see the open entry on wedge restarts.
+- Combined concurrent test hangs (2026-09-14, #1509): closed on evidence from 3edb15eb. At default concurrency the union passed 406/406 three times on the R2 snapshot and 408/408 on the commit's index, where clean HEAD had hung four runs out of four. The inherited-intermittency entry from 2026-09-15 stays open until a later run shows it is the same cause.
+