feat: unverified ceiling, ledger retention, dead surface purge (0.0.46)

[okisdev]

summary

• the judgment posture write window gets a ceiling. 0.0.45 removed the deny and left a counter with no terminal condition, and the first real session under it ran a migration to 150 unverified main loop writes across 31 escalating advisories with zero dispatches, while guard audit dispatches went 116 on 07-29, 50 on the release day, then zero the day after. FUSION_INLINE_UNVERIFIED_CEILING (eight budgets, forty writes, zero to switch off) denies past that point, the last two advisories name the number so the stop is never a surprise, and the denial names both moves that reopen the window so the demand predicate matches the acceptance predicate. forty sits in a measured gap: across 31 sessions the depth distribution is p50 7, p75 10, p90 30, then 60, 80 and 154, with the 40 to 49 band empty
• the worker ledger stops growing forever. FUSION_WORKER_RETENTION_DAYS (ninety by default) expires terminal records and their sidecars on the next task creation and never touches a live transport. the point is not disk (12MB) but that a retention horizon lets a compatibility shim for a retired record shape expire on a schedule instead of having to be argued away
• the worker circuit breaker is fixed, not deleted. its record filter matched only fusion:fast-worker, so fusion:claude-worker and fusion:trivial-worker silently lost breaker coverage when that lane retired in 0.0.43; it now advises per live lane. the remaining fast-worker paths (hook matchers, execution and brief agent sets) are gone, while the AGENT_TYPES alias stays because 207 live ledger records still carry it
• dead surface: 63 exports that nothing imports are unexported, and five environment knobs that were declared, defaulted and never used are removed. FUSION_WORKER_WALL_CLOCK_MS, FUSION_WORKER_STALL_MS, FUSION_SETTLE_DEMAND_STALE_MS and FUSION_BREAKER_LOOKBACK_HOURS were on the same candidate list and stay, because each is the only seam that makes a long threshold reachable in a test
• the peer contract is re-verified rather than renumbered: grok's required headless flag surface still holds at 0.2.117 (--no-auto-update and --no-wait-for-background are accepted but absent from --help), so verified-versions.json and the README move while every statement about 0.2.112 behavior stays as written

breaking changes

• FUSION_WORKER_BRIEF_MAX_BYTES, FUSION_WORKER_MAX_TURNS, FUSION_WORKER_MAX_OUTPUT_TOKENS, FUSION_WORKER_MAX_UNCACHED_TOKENS and FUSION_WORKER_DEBUG_COLLECTION_RESPONSE no longer do anything. the brief envelope's sizing field is the supported control for turn and token budgets
• judgment posture can now deny a main loop write, which it never did in 0.0.45. a window already past forty unverified writes when this lands will deny until a verification passes or a package is dispatched
• grok-composer-2.5-fast is out of the shipped model table; an installed model-routing.json still holding it needs fusion-config.mjs remove grok-composer-2.5-fast

test plan

already verified

• npm test -> 1067 tests, 1066 pass, 0 fail, 1 skip
• grok --no-auto-update --no-wait-for-background --help accepted on grok 0.2.117, confirming the preflight flag surface still holds
• retention never removes a live transport, verified by a test that keeps a pending_async record older than the cutoff

reviewer should verify

• in a live session past forty unverified main loop writes, the deny arrives and a passing verification command reopens the window
• /fusion:stats renders Unverified ceiling stops in the coercion ledger

notes

• the retention sweep removes nothing on first run here: the oldest live ledger record is fifteen days old against a ninety day horizon