[P1] Make the live DevTools path truthful, bounded, and fail-closed

[Xuepoo]

Priority: P1 | Area: DevTools client/protocol/privacy | Labels: P1,fix,area:devtools | Milestone: v0.1.0 | RFC: OQ-000 (campaign contract decisions) | Task: CTX-0006

Parent issue for the accepted 2026-09-24 DevTools findings.

Scope:

• DEV-001/002/006/007/008/013/021: one live request owner, strict decoding, continuation framing, cancellation, and strict rendering;
• DEV-005/010/011/012/014/017/020: redaction ordering, campaign bounds, trace truthfulness, and session cleanup;
• DEV-015/027: fail-closed CarryCtx import probing;
• DEV-016/019/022/023/024/025/028: identity, endpoint budgets, version/platform, quality, and hygiene.

Evidence: research/review/2026-09-24/09-independent-devtools-docs-verification.md, 10-final-cross-authority.md, and 12-final-cross-client-engine.md.

Acceptance: keep unsupported live operations explicitly unavailable, use hermetic loopback/fake-adapter tests, pass bitty-devtools just gates, and obtain independent review. Server peer/session/authority fixes remain in bitty. No Windows compromise or secret-bearing runtime incident is claimed.

[Xuepoo]

All tracked findings delivered across merged PRs:

• [P1] Redact before truncation and bound campaign data #139 (DEV-005/010/011/012/014/017/020) → PR [CTX-0079] fix(campaign): redact before truncation and bound campaign data #143
• [P1] Make CarryCtx import probing fail closed #140 (DEV-015/027) → PR [CTX-0078] fix(import): fail-closed CarryCtx import probe #142
• [P1/P2] Reconcile DevTools identity, platform, version, and quality contracts #141 (DEV-016/019/022/023/024/025/028) → PR [CTX-0080] feat: reconcile DevTools identity, platform, version, quality contracts #144
• [P1] Establish one strict live request and protocol owner #138 (DEV-001/002/006/007/008/013/021) → PR [CTX-0082] fix(protocol): establish one strict live request and protocol owner (#138) #148

Remaining cross-repository obligation: the core bitty inbound request continuation contract (DEV-007 server half), tracked separately. No live trace/control is advertised.