[abruption]

Problem and resulting change

The operating broker reached its rolling 12-claim limit and correctly refused a new outage despite qualifying for the 600-second confirmed-recovery interval. This PR prepares an explicit 24-claim operating allowance without changing the package default of 3 or the configured 3600/600-second intervals.

Refs #80. This is its narrowly requested cap-change slice; diagnostics, warning notifications and temporary escalation remain open. #79 is a separate received-but-unclaimed event gap.

Implementation

• Add optional --max-claims-per-24h to the reviewed policy deployment helper. Omission preserves the existing value/implicit default; explicit values are strict integers 1..24, and invalid existing settings are rejected before override.
• Accept the exact existing local_coordination constructor argument without altering it, so the helper supports the current server shape and preserves connector extensions.
• Document the operating 12→24 proposal and rollback in EN/KO. The one-key recipe requires current 12/3600/600, identical reviewed core bytes and an already patched integrated server. Generic helper behavior is explicitly distinguished from that recipe.
• Retain protected staging/source pins, locks, fresh healthy/quiescent deployment gates, conservative code/config rollback and the authorization ledger. Success, failure, unknown and unreported grants all remain counted; there is no refund or automatic execution.

Validation and review

Local research suite: 256 tests, OK (one expected macOS skip). Source-manifest and Python static checks passed. Tests exercise 12→24 on the same SQLite ledger, mixed outcome accounting, the 24th/25th boundary and rolling expiry, CLI propagation, budget-only code/config preservation, omitted/default behavior, idempotency and failure rollback.

Independent read-only Claude Code and Codex CLI review used identical frozen inputs in two rounds. Required documentation clarification and recommended fixture/rollback checks were addressed; final review results and CI are added below. These model reviews are source analysis, not live deployment evidence.

Operating boundary

No operating deployment or policy mutation occurred. The default example stays recovery-disabled; package/runtime executable sources and their manifest are unchanged. The root helper still refuses open outages or in-flight delivery, so deployment needs a separate reviewed healthy maintenance point. Raising the cap does not fix the recurring disconnects or guarantee Dots execution. No merge, release or production restart is requested by this PR itself.

Independent review evidence

• Claude Code 2.1.314, requested and response-confirmed claude-opus-5-5; Codex CLI 0.166.0, isolated default model (actual model name was not exposed in the captured protocol output). Both ran non-interactively in parallel with no review tools/commands, and completed successfully in both rounds.
• Frozen shared input SHA-256: first 48ede9afc7efc8b38b09eadf20ad405225ce2216ccfcc129070f1766670c5df0; revised b186aafb1540065d61d10e1cc293321d17271605c6183cf22a72fd5acfc70d5b. All input hashes were rechecked.
• The first review's required recipe clarification and recommended budget-only/rollback/idempotency fixtures were addressed. Both revised reviews reported no required fixes. Their evidence limits (mocked privileged orchestration, no live deployment or new cross-deployer lock proof) remain explicit.
• Final small documentation clarifications and a real isolated load_recovery 24/25 test were subsequently checked by Codex and a read-only final subagent gate. Production helper code is byte-identical to the second reviewed revision. English/Korean command blocks match.

CI result

All push and pull-request checks passed at 69c8571d988a6f3b2578256253ad413c80b94cd8: Python 3.11/3.13 core tests, Research Python 3.12/3.13 (including lifecycle), Python static checks, Shell syntax/ShellCheck and GitGuardian. PR is Ready, mergeable and unmerged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T23:39:14.350304Z	69c8571	PR opened
🔒 Security Review	✅ Completed 2026-10-31T23:40:04.491283Z	69c8571	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Operating rollout verified — 2026-11-01 (KST)

Merged PR #81 (5092c7b161b7a92381dd0a9b42d3eed3acba6013) was applied through the pinned, root-authenticated operating launcher after the owner manually restored the target and fresh external SSH/ping closed the pending incident. The healthy/quiescent deployment gates were retained.

The owner's execution result reported applied=true, total historical claims 45 → 45, subscription records 8 → 8, active subscriptions 1 → 1, mail_extensions_preserved=true and ledger_restored=false. Those preservation counts are the operator's deployment receipt, not a separate full-ledger audit.

Independent post-application checks confirmed:

• Live MCP policy: 24 claims per rolling 24 hours, global interval 3600 seconds, confirmed-new-incident interval 600 seconds.
• Existing rolling usage remains 12 claims; this differs from the 45 all-time records above. No budget reset or refund was performed.
• execution_mode=legacy_start remains unchanged; no local coordination was enabled.
• Fresh external SSH and peer ping are healthy, with no open incident.
• Both broker service/socket are active, and installed recovery core/integrated-server hashes exactly match their pre-application values.

No test claim, replayed callback, injected outage or Dots package/runtime update was performed. This completes only the operating-cap slice of #80; budget diagnostics, early warnings and temporary escalation remain open. #79's acknowledged-but-unclaimed follow-up gap is unchanged.