docs: qualify native browser and client currency gates - #790

### Scope

Enforce the owner's 42-day model-currency rule in the existing offline validator, add daily review proposals, and fill the ruled partial inventory. This combined revision closes J826's three P2 findings, keeps J826b's simple background tasks on Haiku's own line, prepares independent model carriers and proposes MinerU's persistent local-source unit.

- Base: `3d7d4a4b2640c8583d8855670111ef5d023d3e03`; no rebase for this revision.
- Head: `de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0`.
- Lane: `lane:foundation`; draft.
- Owned paths: model catalog/schema, existing validator/freshness proposer, currency and MinerU unit templates, focused tests, independent model carriers, current guides, dated decision amendments and new evidence. Shared stack model rows, current catalog citations and registry go in the last commit.
- **Named landing path:** co-op GPT delta read → command center ACK → 5f's queue **after #810 and before #645**. Keep draft until that read and ACK; rebase once on the landing cue.

The inventory declares **21 artifact/model-consumer rows and seven package snapshots**, remains `pending`, and retains **eight unresolved groups**. Passing validation checks declared rows; it does not prove complete inventory or deployed selections.

**FILL item 7 is a prerequisite, not a completed fold.** Independent Nemotron endpoint/prefix carriers are prepared, but fixwave-defects owns the six-field memory-owner amendment to the living install plan/generated installer. It rides #810 after finding-2, per A26/A28/A27b. This lane neither recreates the absent generator nor hand-edits `install.sh`. The ai-memory example requires 2.5.2 prefix support; its stack component remains 2.4.1 under the model-only scope. This PR does not claim all folds 7/8/9 complete.

Bounded item-7 state at landed #723 (`41b65ac6bf574afa247a2542e70340a3cadf38bb`): [install-plan.json:1590-1597](https://github.com/seathatflowsinourveins/native-agent-stack/blob/41b65ac6bf574afa247a2542e70340a3cadf38bb/evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json#L1590-L1597) selects ai-memory 2.5.2, but its [memory command at :1599](https://github.com/seathatflowsinourveins/native-agent-stack/blob/41b65ac6bf574afa247a2542e70340a3cadf38bb/evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json#L1599), [notes at :1644](https://github.com/seathatflowsinourveins/native-agent-stack/blob/41b65ac6bf574afa247a2542e70340a3cadf38bb/evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json#L1644) and [generated install.sh:465](https://github.com/seathatflowsinourveins/native-agent-stack/blob/41b65ac6bf574afa247a2542e70340a3cadf38bb/evidence/artifacts/new-wsl-install-plan-20261002/install.sh#L465) still select local MiniLM. The [stack component at :96](https://github.com/seathatflowsinourveins/native-agent-stack/blob/41b65ac6bf574afa247a2542e70340a3cadf38bb/manifests/stack.json#L96) remains 2.4.1. Fixwave's prerequisite patch owns all six settings: `embedding_provider=openai-compat`, `embedding_base_url=http://127.0.0.1:28231/v1`, `embedding_model=nvidia/Nemotron-3-Embed-8B-BF16`, `embedding_dim=4096`, `embedding_query_prefix="query: "`, and `embedding_document_prefix="passage: "`. This source review does not establish the host's effective configuration.

**MinerU's unit is source-only.** It sets `MINERU_MODEL_SOURCE=local`, supervises the shipped foreground DocLib module and carries `OnFailure=stack-alert@%n.service`. The embedded CPU guard is a **gap dated 2026-10-07**: no documented embedded ingress was found in the inspected installed source/tag. The maintained external wrapper offers a separate supported ingress and lifecycle for the CC to consider. The CC resolves the CPU precondition before activation, verifies managed mode/tier, applies the unit and performs the fresh-shell smoke. No host setting is applied here.

### CI repair at this head

The previous head `5a6842f1` failed the hosted 11,544-test suite (nine failures, one error). This revision repairs all four dependency groups: retain the complete historical 1B model/evidence record with retired-on-2604 scope and its current locator; restore the portable Claude endpoint defaults while retaining 8B/4096; disclose the post-release MCP change on three setup pages; and move the SDK disposition citation to its actual assertion line.

The setup-page changes regenerate both handbook outputs with the repository's existing builder. The original October 1 receipt stays byte-identical. A new dated [handbook projection](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/handbook-projection.json) binds the current bytes; the publication test changes only its receipt locator and keeps every exact assertion. No parity, release-marker, pin-source or citation oracle is relaxed.

All 23 targeted failure/negative-control tests and 95 handbook/stack/pin tests pass (exit 0). Validation passes before and after the final shared-metadata/registry commit (exit 0, 10,404 file hashes). The [CI repair receipt](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/ci826-repair.json) retains the hosted failure and local failed attempts. The new head's hosted CI and synthetic-merge execution are separate, still unverified observations. One same-branch push; no rebase, host apply or #790 change.

## SOTA sources

- CI dependency sources: `native-agent-stack@5a6842f`: `adoption/hosts/example.json`, `tools/adoption/install_claude_profile.py:350-378`, `tests/test_install_claude_profile.py:1509-1530`, `tests/test_adoption_docs_consistency.py:499-538`, `tests/test_new_wsl_handbook.py:1672-1689`, and `tests/test_upstream_surface_watch.py:2054-2060`; original 1B fields at `native-agent-stack@3d7d4a4:manifests/stack.json:2098-2109`. The new dated decision amendment records the exact source contracts and preserves historical acceptance.

- `huggingface/[email protected]` / `bd4a76030582d118e28dc9ad6c7a5911ea76176b`: [native models-info CLI](https://github.com/huggingface/huggingface_hub/blob/bd4a76030582d118e28dc9ad6c7a5911ea76176b/src/huggingface_hub/cli/models.py#L223-L237), [moving main revision](https://github.com/huggingface/huggingface_hub/blob/bd4a76030582d118e28dc9ad6c7a5911ea76176b/src/huggingface_hub/constants.py#L60), [metadata semantics](https://github.com/huggingface/huggingface_hub/blob/bd4a76030582d118e28dc9ad6c7a5911ea76176b/src/huggingface_hub/hf_api.py#L799-L819), [implicit-token early return](https://github.com/huggingface/huggingface_hub/blob/bd4a76030582d118e28dc9ad6c7a5911ea76176b/src/huggingface_hub/utils/_headers.py#L147-L151). Installed native 2.1.1 is reused. P2a keeps exact Hub origins independent of package age.
- [GitHub latest-release API](https://docs.github.com/en/rest/releases/releases#get-the-latest-release) and [PyPI JSON API](https://docs.pypi.org/api/json/#get-a-project), read 2026-10-07, supply primary metadata; changes become review requests.
- [Python 3.13 URL parsing](https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urlsplit) documents lazy port errors and control/space stripping. The check rejects raw whitespace/C0/C1 controls before parsing and evaluates `parts.port` (P2c). [JSON Schema object semantics](https://json-schema.org/understanding-json-schema/reference/object#additionalproperties) supplies `additionalProperties: false` on complete object definitions, mirrored by validator allowed-key checks (P2b); partial conditional schemas are not incorrectly closed.
- [Filled primary provenance](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/fill-source-review.json) preserves packet SHA-256 `44679fd1d26dfec36b3b57cdbde2df4290d1b068118562cb8811bf3eb7cd6941`, per-row vendor/artifact/package sources and corrections. Unknown identities remain pending. Haiku's public date is from [Anthropic's October 15, 2025 announcement](https://www.anthropic.com/news/claude-haiku-4-5); the exact ID is checked against [the current Haiku specification](https://platform.claude.com/docs/en/models/haiku-4-5/overview), read 2026-10-07. Its snapshot suffix is not its public launch date. A Haiku 5.x ID overturns this dated exception.
- `akitaonrails/[email protected]` / `7580b74d0fb9d14a6d949dc92f5ea8bb7feb3c83`: [prefix configuration](https://github.com/akitaonrails/ai-memory/blob/7580b74d0fb9d14a6d949dc92f5ea8bb7feb3c83/crates/ai-memory-cli/src/config.rs#L454-L502) and [factory wiring](https://github.com/akitaonrails/ai-memory/blob/7580b74d0fb9d14a6d949dc92f5ea8bb7feb3c83/crates/ai-memory-llm/src/factory.rs#L262-L269). Other independent carrier sources and exact pins remain in the [fill amendment](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/docs/decisions/2026-10-07-model-currency-enforcement.md#amendment-2026-10-07-ruled-partial-fill-and-current-carriers). Installer/component alignment stays owner-routed.
- `opendatalab/[email protected]` / `c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93`: [documented server command](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/README.md#L462-L484), [native foreground-module launch](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/cli/commands/server.py#L242-L248), [module entry](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/doclib/app.py#L443-L449), [environment override](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/config.py#L156-L176), and [managed-parser inheritance](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/doclib/background/parse_server_health.py#L205-L221). [Embedded kwargs](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/model/vlm/runtime.py#L175-L180) differ from the [external wrapper's environment ingress](https://github.com/opendatalab/MinerU/blob/c221cc41bc911ad0df3eaeda97acf6a1bfe9bf93/mineru/kit/vlm_server/llama_cpp_server.py#L263-L273); installed `mineru_llama_cpp/engine.py:46-52,107-108` defaults to 99 GPU layers. This is repository systemd integration, not an upstream systemd recipe.
- `systemd/[email protected]` / `b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a`: [currency command-failure prefix](https://github.com/systemd/systemd/blob/b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a/man/systemd.service.xml#L1443). MinerU follows [systemd@v260 service semantics](https://github.com/systemd/systemd/blob/v260/man/systemd.service.xml#L158), [failure/start limits](https://github.com/systemd/systemd/blob/v260/man/systemd.unit.xml) and [control-group stop semantics](https://github.com/systemd/systemd/blob/v260/man/systemd.kill.xml#L56), checked against the installed 259 manual. Alerting covers DocLib/unit failure, not a parser failure that leaves DocLib alive.
- `native-agent-stack@3d7d4a4`: `scripts/freshness_propose.py:861,942`, `scripts/validate.py:144,484`, `adoption/templates/systemd/stack-currency.service:16-26`, `docs/acceptance-evidence-policy.md:24-38`, `docs/lanes.md:94-115`. The owner-defined 42/7-day policy and package join are the deterministic gap. No upstream is rebuilt and no validator executable is added.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| UTC clock, 42/43-day and 7/8-day boundaries, package join, J826 P2 positive/negative controls | `synthetic`, `local_integration` | 113 combined policy/proposal/existing-validator tests, exit 0; [new J826 checks](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/j826-checks.json). |
| Primary filled dates/revisions, retained exceptions and unresolved roles | `source_review` | `fill-source-review.json` records the earlier 20-row partial fill; `j826-checks.json` adds the source-reviewed Haiku ruling and current 21-row state. Seven packages and eight unresolved groups remain; no inference or live-selection claim. |
| Legacy currency proposer/timer compatibility | `local_integration` | Earlier 91 checks, exit 0, in `checks.json`. |
| Handbook/stack/pin carriers and SDK controls | `synthetic`, `local_integration` | Earlier 95 handbook/stack/pin checks and 27 SDK tests, exit 0, in `fill-checks.json`; the recorded 516-test carrier check also exited 0. |
| MinerU source/failure/lifecycle template | `synthetic`, `local_integration` | Eight focused tests and unit syntax verification, exit 0, in `fill-checks.json`; no host application. |
| Repaired architecture, portable parity, release disclosures and citation controls | `synthetic`, `local_integration` | 23 targeted tests plus 95 handbook/stack/pin tests, exit 0; `ci826-repair.json` and dated `handbook-projection.json`. |
| Publication consistency after the registry-last commit | `structural_validation` | `exit 0; 69 components, four profiles, 223 receipts, 10,404 file hashes; structural integrity/scope only`. |

### Local commands run

Checks use owned durable scratch and `nice -n 19 ionice -c3`.

```text
python3 -B -m unittest tests.test_model_currency tests.test_model_currency_propose tests.test_validate
exit 0: 113 tests after J826 fixes.
python3 -B -m unittest tests.test_new_wsl_handbook tests.test_stack_lifecycle tests.test_foundation_stack_pins
exit 0: earlier 95 tests.
uv run --no-project --with claude-agent-sdk==0.2.162 python3 -B -m unittest discover -s examples/claude-runtime-sdk/tests
exit 0: 27 tests.
uv run --no-project --with claude-agent-sdk==0.2.162 python3 -B examples/claude-runtime-sdk/tests/check_controls.py --disarm-route
exit 1: deliberate negative; unchanged normal control exit 0.
python3 -B -m unittest tests.test_mineru_user_unit
exit 0: 8 tests.
systemd-analyze --user verify adoption/templates/systemd/mineru.service
exit 0: syntax only; no unit loaded or started.
nice -n 19 ionice -c3 python3 -B scripts/validate.py
exit 0; 69 components, four profiles, 223 receipts, 10,404 file hashes; structural integrity/scope only
```

The **two-day advance refresh is included**, beginning on landscape-check day five. The collector appends private review JSON/Markdown rather than publishing a GitHub PR, renewing dates or switching models. Hub SHA differences are revision candidates, not proof of new weights. Unsupported vendor-page adapters request source review. The initial pending/empty offline dry run returned `complete_inventory`, zero source checks and no writes; it remains a dated scaffold observation.

Retained failed attempts remain in the original receipts: the initial legacy check's old owned-file hash failure, the fixture's missing overturn field and the scratch-classification correction. Historical observations and decided text are preserved; new checks and dated amendments extend them.

### Decision record

[Dated decision and amendments](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/docs/decisions/2026-10-07-model-currency-enforcement.md) records alternatives, sources, overturn triggers, partial fill and J826/J826b. [Current guide](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/docs/model-currency.md) carries the pending item-7 prerequisite. [MinerU recipe](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/recipes/mineru-local-service.md) carries CC activation and the dated embedded-guard gap.

Receipts: [initial checks](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/checks.json), [fill checks](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/fill-checks.json), and [new J826 checks](https://github.com/seathatflowsinourveins/native-agent-stack/blob/de7a7f2b6b6d7eac4241701b5c06a63b3265cbe0/evidence/artifacts/model-currency-enforcement-20261007/j826-checks.json). Raw logs stay private.

### Host evidence

No new host receipt/status is promoted. No weights, inference, package bump, live model switch, timer/service installation or client-configuration change was run for this revision. CC MinerU application and fresh-shell acceptance remain pending; A23's one-page parse remains a separate dated observation. Complete inventory, unsupported adapters, native timer execution and whole-unit timeout recovery remain unqualified. Item 7's owner-routed prerequisite is not counted as a completed fold.

### Checklist

- [x] Draft, exactly `lane:foundation`, named read/ACK/queue path.
- [x] No new validator executable, rebuilt upstream, workflow or paid surface.
- [x] No credentials inspected, logged or committed; Hub implicit auth disabled.
- [x] Peer-owned paths/heads and queued branches preserved.
- [x] Historical results/decided text preserved; dated amendments and new receipts used.
- [x] Targeted controls pass; partial inventory and pending owner/CC apply gates explicit.
- [x] Final stack/registry commit is last; validation passed before and after it (exit 0).