docs: converge #687 rate-limit reader authority

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Protected #687 normalizes reader acquisition on the distributed `/exchange` private Durable Object rate-limit transport. If an already locked/non-stream-readable 256-byte internal request makes `request.body.getReader()` throw synchronously, it returns the established `400 malformed_json` contract before storage authority; a locked 4,096-byte decision response fails closed with the stable `rate-limit Durable Object decision body could not be read` diagnostic. Existing fixed retained buffers, byte ceilings, best-effort cancellation, reader-lock release after successful acquisition, fatal UTF-8·duplicate-key·JSON admission, and bucket/identity/Durable Object authority remain unchanged. Provider/model routing, destination/outbound policy, credential authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; this protected source is not an immutable release or deployed recovery/p95/heap evidence. PR #687.
 - Protected #685 normalizes reader acquisition on Noema's OIDC replay guard bounded transport. If an already locked/non-stream-readable 4,096-byte decision response makes `response.body.getReader()` throw synchronously, the reader now fails closed with the stable `OIDC replay guard decision body could not be read` diagnostic; a locked 512-byte internal claim request returns the established `400 malformed_json` contract before Durable Object storage authority. Existing fixed retained buffers, byte ceilings, best-effort cancellation, reader-lock release after successful acquisition, fatal UTF-8·duplicate-key·JSON admission, and replay/storage authority remain unchanged. OIDC/GitHub identity, provider/model routing, destination/outbound policy, credential, quarantine/security, release/deployment, and foreign-domain authority remain with their existing owners; this protected source is not an immutable release or deployed recovery/p95/heap evidence. PR #685.
 - Protected #683 normalizes reader acquisition on the 1 MiB bounded Cloudflare production control-plane deploy/status/recovery response transport. If a locked Cloudflare control-plane response body makes `body.getReader()` throw synchronously, the reader now fails closed with the stable `${operation} response body is not stream-readable` diagnostic instead of leaking the raw stream exception; the existing fixed retained buffer, byte ceiling, timeout, cancellation-liveness, reader-lock, fatal UTF-8/JSON and provider-error semantics remain unchanged. This repair does not transfer Cloudflare/provider authority, destination/outbound policy, credential authority, quarantine/security authority, release/deployment authority or foreign domain truth into Noema, and protected source is not an immutable release, controlled production recovery rehearsal or deployed p95/heap evidence. PR #683.
 - Protected #681 keeps the authenticated Distroless Debian 13 CodeGraph sandbox and existing Trivy MEDIUM/HIGH/CRITICAL fail-closed scan while repairing the reviewed glibc substrate at `2.41-12+deb13u4`. The shared preparation contract uses authenticated Debian snapshot `20260711T202405Z`, admits only the exact Debian 12 and Debian 13 automatic archive primary keys needed for that signed historical transition, verifies `InRelease`→`Packages.xz`→exact package digests, and accepts the derived local immutable image ID only after the same Trivy gate. This reviewer-isolation integration does not transfer quarantine/security verdict, provider/model routing, outbound authority, release/deployment authority, or foreign domain truth into Noema, and the ephemeral CI image is not an immutable release. PR #681.