chore(promote): develop → main — 36 commits (money fail-closed pricing, MCP debit refund, credential-pool + agent-api hardening, #11640 deploy-concurrency fix)

.github/issue-evidence/10200-scripts-delarp-slice/README.md

@@ -0,0 +1,40 @@
+# #10200 scripts de-larp slice — dead per-package script removal
+
+Fresh audit of `scripts/`, `packages/scripts/`, and (uncovered by the inventory
+tool) `packages/*/scripts` + `plugins/*/scripts` for the three de-larp axes.
+
+## Axis results
+
+| Axis | Finding |
+|---|---|
+| **Larp catch-verifiers** (`main().catch(console.error)` → logs but exits 0) | **0 remaining** — all fixed by prior slice #11548. Re-verified on develop tip `bc0dd00640`. |
+| **`\|\| true` in verify paths** | 42 occurrences; every one is legitimate best-effort (`command -v X \|\| true` binary probes, idempotent `sed`/`cp` cleanup, `grep -c` no-match). No swallowed verify assertion found. Deferred (matches #11548's per-callsite-judgement note). |
+| **Trivially-safe dupes** | `check-i18n.mjs` / `check-secret-hygiene.mjs` exist in both `packages/scripts/` and `packages/app-core/scripts/` but have **diverged** (in-repo `../..` root resolution vs fork `process.cwd()` — intentionally separate invocation contexts). NOT safe to dedupe. |
+| **Dead scripts** (0 refs tree-wide: no package.json script, no `.github/workflows`, no import, no README/doc — proven via `git grep -l <basename>` excluding self) | **6 removed** (below). |
+
+## Dead scripts removed (each 0 references, proven via `git grep -l`)
+
+- `plugins/plugin-training/scripts/gepa-view-switching.ts` — completed GEPA/bootstrap-fewshot view-switching experiment one-off. plugin-training `package.json` wires `gepa:view-context` (→ `gepa-view-context.ts`, kept) and `verify:view-switching` (kept) but **not** this file. Same class as the GEPA eval one-offs deleted in #11548.
+- `plugins/plugin-training/scripts/multishot-view-switching.ts` — completed multi-shot-demo finding experiment; not in `package.json`, zero refs.
+- `packages/app/scripts/android-webview-attach-probe.mjs` — one-time "de-risk probe" proving Playwright's Android driver can attach to the Capacitor WebView; the real on-device harness now exists, probe is unreferenced.
+- `packages/benchmarks/social-alpha/trenches-chat-dataset/scripts/monitor_progress.sh` — manual `watch`-loop helper for a price-fetch run; README documents the pipeline as only `build_dataset.ts` + `fetch_price_history.ts`; zero refs.
+- `packages/benchmarks/social-alpha/trenches-chat-dataset/scripts/calculate_success_metrics.ts` — one-time dataset success-metric analysis; not in the README pipeline, not imported by `build_dataset.ts`, zero refs.
+- `packages/benchmarks/social-alpha/trenches-chat-dataset/scripts/calculate_realistic_success_metrics.ts` — iterated near-duplicate of the above ("Updated realistic thresholds"); zero refs.
+
+## Verification
+
+- Per-file reference proof: `git grep -l "<basename>"` returns only the file itself for all 6 (captured pre-deletion).
+- None of the 6 are `*.test.*` / `*.spec.*` — not picked up by any Vitest/Playwright test glob.
+- All 6 are standalone entrypoints with no importers, so deletion cannot affect any package build or typecheck.
+- `plugins/plugin-training` retains its wired harnesses (`gepa-view-context.ts`, `verify-view-switching.ts`, `verify-view-switching.grid.test.ts`, `lifeops-gepa-*`, `trajectory-quality-review.ts`).
+- Trenches README pipeline (`build_dataset.ts`, `fetch_price_history.ts`) untouched.
+
+## Honest scope note
+
+Prior #10200 slices (#10479, #10681, #11548, #11367, …) already exhausted the
+safe dead-script surface in `scripts/` and `packages/scripts/`, fixed all
+silent-`exit 0` catch handlers, and corrected the inventory orphan model. The
+remaining per-package `packages/*/scripts` orphans are overwhelmingly
+manually-run operator/dev/QA/migration tools (the #11367 lesson: hand-run
+entrypoints are false orphans), which this slice deliberately leaves in place.
+The 6 removed here are the airtight completed-throwaway subset.

.github/issue-evidence/10724-local-inference-settings/README.md

@@ -0,0 +1,24 @@
+# Issue #10724 — Local Inference Device Settings
+
+## Scope
+
+Documentation-only slice for the remaining #10724 device-specific recommendation deliverable.
+
+The new `plugins/plugin-local-inference/README.md` section documents the current runtime policy from:
+
+- `plugins/plugin-local-inference/src/services/device-tier.ts`
+- `plugins/plugin-local-inference/src/services/recommendation.ts`
+- `plugins/plugin-local-inference/src/runtime/embedding-presets.ts`
+- `plugins/plugin-local-inference/scripts/local-inference-thresholds.json`
+
+## Validation
+
+- Reviewed the source constants and comments listed above.
+- `git diff --check`
+
+## N/A Evidence
+
+- Tests: N/A — documentation-only, no runtime code changed.
+- Screenshots/video: N/A — no UI changed.
+- Real-LLM trajectories: N/A — no model, prompt, provider, action, or routing behavior changed.
+- Device/battery capture: N/A — this PR documents the current policy; #11352 remains the hardware-gated issue for fresh on-device model/battery baselines.

.github/issue-evidence/10725-cloud-visual-audit/README.md

@@ -0,0 +1,76 @@
+# 10725 — Cloud-surface visual audit (#11342)
+
+Hand-reviewed visual audit of every cloud route registered by
+`packages/ui/src/cloud/register-all.ts` (the app-hosted Eliza Cloud
+surfaces), at desktop (1440×900) and mobile (390×844), against the #10725
+brand rules: orange accent only, NO blue anywhere, orange-resting →
+darker-orange hover (never orange→black/white), no layout breaks, no
+empty/broken panes.
+
+Produced by the `audit:cloud` harness added for #11342 (the `audit:app`
+equivalent for the CloudRouterShell route space, which `audit:app` never
+enters):
+
+```bash
+bun run --cwd packages/app audit:cloud
+```
+
+The walk writes `packages/app/aesthetic-audit-output-cloud/` (gitignored);
+the reviewed screenshots + hand-filled `manual-review/<slug>.md` verdicts are
+committed here. `report.json` carries the machine findings (blue-color scan,
+orange-hover scan, console errors, paint/quality analysis) per page ×
+viewport; `contact-sheet.html` is the grid index.
+
+Harness notes:
+
+- The renderer is built with `VITE_PLAYWRIGHT_TEST_AUTH=true` (the
+  `audit:cloud` script sets it), so `StewardAuthProvider` renders the local
+  test-auth shell and authed pages authenticate from a seeded persisted
+  Steward token — the same pattern as `cloud-console-routes.spec.ts`.
+- Cloud APIs are stubbed with shape-accurate fixtures (traced from each
+  domain's data hooks; see the rule table in
+  `packages/app/test/ui-smoke/cloud-surfaces-aesthetic-audit.spec.ts`) so
+  pages render real zero/populated states. Unstubbed calls fall through to
+  the deterministic 501 stub backend and the page's designed failure state is
+  audited instead.
+- `app-auth/authorize` cannot mount its Steward runtime under the test-auth
+  build (`useAuth()` outside the provider) — recorded as a harness
+  limitation, not a product break (production mounts the runtime; #9881).
+
+## Verdict summary
+
+42 pages x 2 viewports, final walk 85/85 green. Hand verdicts (desktop +
+mobile agree on every page; details + per-page notes in `manual-review/`):
+
+- **good - 25 pages:** my-agents, billing-success, settings-connections
+  (blue fixed in this PR), payment-request, payment-success (redirector),
+  payment-app-charge (stub-shape fixed), approve, sensitive-request,
+  public-character-chat, invite-accept, accept-invitation, login,
+  auth-success, auth-error, auth-cli-login, auth-callback-email, terms,
+  privacy, bsc, apps, apps-detail, approvals, admin, admin-redemptions,
+  admin-rpc-status, mcps.
+- **needs-work - 16 pages:** agents, agents-detail, account, security,
+  security-permissions, analytics, billing, invoice-detail, organization,
+  join, ballot, api-explorer, monetization, earnings, affiliates.
+  **One systemic root cause:** the cloud dashboard was ported from the
+  dark-only cloud-frontend and carries ~895 hardcoded `text-white*` usages
+  across 93 files under `packages/ui/src/cloud/`, while the app-hosted
+  shell renders the light theme (body launch-bg `#ef5a1f`, tokenized cream
+  `BrandCard`), so headings/copy land white-on-cream. Concrete citation:
+  `instances/components/eliza-agent-pricing-banner.tsx:58`. The fix is a
+  theme-token sweep (parent #10725 scope), not a per-page patch.
+- **needs-eyeball - 1 page:** app-auth-authorize - with the test-auth
+  build the Steward runtime never mounts so `useAuth()` throws into the
+  error boundary; production mounts the runtime (#9881). Needs a
+  runtime-backed capture.
+
+Fixed in this PR (verified by the run-3 machine scan + screenshots):
+
+- `dashboard/settings/connections` carried the audit's ONLY blue (Discord
+  `#5865F2`, Telegram `#0088cc` on icons/chips/links/buttons) -> neutral +
+  accent tokens; zero blue across all 84 findings in run 3.
+- `dashboard/analytics` hung on its skeleton behind a context-only auth
+  gate -> now uses the shared persisted-token gate (`cloud/lib/auth-query`).
+- `payment/app-charge/:appId/:chargeId` crash (RangeError: Invalid time
+  value) exposed by a minimal stub - stub now real-shaped; page-side
+  formatDate robustness noted for #10725.