fix: C3 re-bucket follow-up, 9 FleetReview rows (t_7da6cadf)

[ang-fleet-workers]

Kanban t_7da6cadf (child of t_e038f946; the hermes-agent rows not in #1389).

Fixed. Each row has a test that fails on fork/main d9a5c53 and passes on head:

row	fix	test
#942 conversation_loop:9091 + tui_gateway/server:10143	confabNoticeFromRow now mirrors Python notice_from_display_row: a system row may carry a tool-call notice (kind tool_call_as_text / tool_call_unparseable, scope visible). Desktop hydration renders it with a per-kind label. A scaffold catch on a system row is still refused	vitest apps/desktop/src/lib/confab-notice-hydration.test.ts (3 new cases). Not runnable on the Studio: its node_modules lacks @rolldown/plugin-babel. A node type-strip check of the shared module showed the system+tool row null on base and a notice on head
#970 cold models.dev path	get_label and determine_api_mode take allow_network. switch_model passes probe_catalog through	tests/gateway/test_no_network_cold_models_dev.py. With the real fetch_models_dev on an empty cache, base made 2 foreground fetches with network allowed (get_label, determine_api_mode)
#976 hygiene agent	_build_hyg_agent and the hygiene get_session use the _hyg_old_sid snapshot	AST pin
#1043 post-turn clear	The runner snapshots last_resume_marked_at at run start. clear_resume_pending(key, marked_at=...) keeps a mark written after that snapshot. Legacy callers (no kwarg) behave as before	SessionStore unit
#1095 early-imported bundled profile	register_provider records its calling module. _import_plugin_dir replays that module's registrations when the module is already in sys.modules	providers unit
#1198 cooling_providers	Only auth-stage refusals cool a provider. Stage-less legacy events count as auth	in-memory sqlite
#1254 process_env_files:121	The overlay's pre-apply values go into HERMES_PROCESS_ENV_OVERLAY. A child agent process seeds _OVERLAY from it, and strip_overlay drops the marker	env unit
#1032 cron auto-model	A new _revalidate_resolved_provider re-runs _validate_cron_base_url when store resolution (auto sentinel, alias, legacy heal) changed the provider. It runs in create_job and update_job and raises ValueError, the same pattern as reasoning_effort	unit + call-site count

Not fixed, these need a decision (details on card t_7da6cadf):

• fix(lcm): session reads hide superseded replay copies (t_9cdad21b) #1053 lcm get_range visible-only in the session-end prefix compare. The store documents "every per-session read must carry this predicate" (store.py:95-101). Hidden rows are replay copies at the tail. Including them would break the compare in the other direction, so the owner has to say which view the prefix compare should use.
• fix(interrupt): don't send the interrupt-close row to providers that own their transcript (t_f40dc54a) #1101 conversation_loop:2900 interrupt-close omission. The card itself flags this as a tradeoff with t_f40dc54a.

Local narrow runs, via test-gate, one file group per run:

• the new tests + test_process_env_files + test_entry_point_discovery: 19 passed
• test_boot_resume_attempt_cap + test_boot_resume_cap_keeps_recovery_context + test_cronjob_tools: 160 passed
• test_cron_store_no_auto_sentinel + test_scheduler_provider: 40 passed
• test_no_network_reachable_from_loop + test_determine_api_mode_hostname + test_xai_provider_labels: 17 passed

Breadth is CI's.

Collisions: gateway/run.py is a hotspot (dispatcher warned about t_2fc8913a and t_a00223ec). My hunks are small: the hygiene block, the run-start snapshot, and the gate signature. process_env_files.py is also touched by #1389, in different functions.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: ADVISORY (FleetReview not green for 99cc8fc): fleetreview-advisory-20260927-standing.md · why: t_7da6cadf: C3 re-bucket follow-up: 23 confirmed-TRUE rows not fixed in t_e038f946 (hermes-a; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head fbd3ea91c781 · duration 19m 50s
Profile: light (merit: default light: lines 494<800, files 15<1000000, hunks 43<1000000, no hot path) · policy: changed-lines>400
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), F → gpt-6-sol (openai), G → gpt-6-sol (openai)

PARTIAL — ensemble escalated: family floor: too few distinct model families completed

This review did not reach a trusted verdict, so it is not a gate pass and the findings below may be incomplete. They are posted so they can be read rather than lost in a terminal record.

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

Reviewed with 1 of 2 model families — xai unavailable.

profile: light (rule: default light: lines 494<800, files 15<1000000, hunks 43<1000000, no hot path) · round 0 · members: B-assert-ctx, B-state, F, G · families: openai

Confidence: 1/5

Findings

• P1 apps/shared/src/confab-notice.ts:151 — Wrong notice · agreed: B-assert-ctx,F,G (openai)
• P1 hermes_cli/process_env_files.py:151 — Secret Exposure · agreed: B-assert-ctx,B-state,F,G (openai)
• P1 gateway/run.py:14633 — Replay counter · agreed: B-assert-ctx,B-state,F,G (openai)
• P1 hermes_cli/process_env_files.py:55 — Changed environment · agreed: B-assert-ctx,B-state (openai)
• P1 tests/gateway/test_no_network_cold_models_dev.py:47 — Cold-cache test bypasses the provider-resolution network fetch · agreed: F,G (openai)
• P1 hermes_cli/providers.py:1036 — Keep provider resolution offline when catalog probing is disabled · agreed: G (openai)

---

FleetReview provenance · models: B=gpt-6-sol, D=grok-4.6, F=gpt-6-sol · cost: $6.54 · duration: 19m 48s · rounds: 2 · files examined: 15

[ang-prism]

FleetReview

FleetReview's daily member-call budget is spent (60/600 for 2026-09-28 UTC); review skipped.

---

FleetReview · reviewKind: skipped-budget