chore: snapshot main sync

openspec/changes/boocontrol-ssh-verbmode/design.md

@@ -47,6 +47,12 @@ Reuses jobType `action` from the existing `ControlJobFrame` (no contracts change
 - `applyRemoteConfig` `mode` defaults to `shell` -> existing call sites + tests unchanged.
 - No `control_job` schema change; the web `useControlStream` already accepts `jobType: 'action'`.
 
+## Implementation notes (sam-desktop host findings, 2026-06-13)
+
+- **Windows wrapper must target PowerShell 5.1.** sam-desktop's default `powershell` is Windows PowerShell 5.1, which lacks the `??` null-coalescing operator. `boocontrol-edit.ps1` was changed to an explicit `if ($null -eq $cmd)` guard. Verb chain verified live: `read` returns the real config, `whoami` -> denied, `pull ../x` -> bad repo id.
+- **This host's `sshd_config` has no `Match Group administrators` block**, so sshd uses the per-user `~/.ssh/authorized_keys` for the admin user `samki` (NOT `administrators_authorized_keys`, which is silently ignored). The forced-command key must go in `C:\Users\samki\.ssh\authorized_keys`. (Stock Windows OpenSSH ships the admin-match block; this install's is stripped.)
+- **No `Subsystem sftp`** in this host's `sshd_config`, so `scp`/`sftp` fail ("subsystem request failed"). Deploy the wrapper via `powershell -EncodedCommand` (base64 UTF-16LE) over the exec channel, or add `Subsystem sftp sftp-server.exe` + restart sshd. The go-live runbook uses the encoded-command method.
+
 ## Validation lenses folded in
 
 - **V1 (adversarial):** wrapper `backup` must return the path the wrapper chose, not a client-computed one (clock skew between control host and GPU host) -> wrapper `backup` reads stdout.

openspec/changes/fleet-coordination-lease/proposal.md

@@ -90,3 +90,27 @@ BooControl's scheduler *requires* and the other three writers *honor*.
   P3 seam contract (`acquireHostAccess`).
 - `apps/control/src/services/host-access.ts` — the seam to swap.
 - `apps/control/src/schema.sql` — where `control_host_leases` lands.
+
+
+## Recommended resolutions (draft)
+
+These are draft recommendations for operator ratification before this change is
+promoted to READY.
+
+- **Exclusive vs shared semantics for interactive traffic:** Use exclusive
+  leases only for bench/eval holders in v1; BooChat, BooCoder, and Arena should
+  read-before-dispatch and avoid writing shared leases. Rationale: this keeps
+  interactive latency and availability close to current behavior while still
+  giving scheduled control work a clear isolation signal.
+- **Honor enforcement granularity:** Use a per-request honor check in v1, not a
+  per-session hold. Rationale: it is the smallest cross-service contract and
+  keeps long-lived chats from pinning a host across unrelated turns; document
+  the residual boundary race.
+- **Heartbeat interval and lease TTL:** Use a 60s TTL with a 20s heartbeat, with
+  expired rows reclaimed during acquire plus an opportunistic sweep. Rationale:
+  this bounds crash recovery to about one minute while keeping write traffic low.
+- **DB-unreachable failure mode:** Fail open for interactive honorers, but fail
+  closed for BooControl work that requires acquiring an exclusive lease.
+  Rationale: chat availability should not depend on the advisory lease table,
+  while unattended bench/eval work should not claim reproducible isolation when
+  the lease cannot be acquired.