docs+agents: reconcile with the 2026-09 release and modernize the agent surface

[verlyn13]

Two related workstreams: reconcile the documentation with the completed 2026-09 production release, then tighten the agent-client configuration that the reconciliation exposed as drifting.

Part 1 — documentation reconciliation

Every document still described the release as pending.

• docs/status.md — actions 3, 5, 6 and 7 closed; action 8 rewritten to the remaining legacy-Worker boundary with the gamelobby-first sequence and the required dashboard route read; new actions 16 (Cloudflare token scope) and 17 (expiring Supabase CLI credential); readback rows replaced rather than appended. 73/80 lines.
• docs/cloudflare.md — Pages removed as an origin and as a rollback path. The completed five-step cutover runbook is gone; the platform constraints that stay true were kept. "Live checks still needed" narrowed to the one genuinely unknown surface: zone-level Worker routes, which the scoped credential cannot read (HTTP 403).
• docs/roadmap.md — section 1 reordered around unfinished work; the Pages/OpenTofu field-boundary bullet retargeted at surfaces that still exist.
• AGENTS.md, project.yaml, organization-alignment.md, architecture/README.md, two ws proxies — phase, cutover and Worker-classification statements aligned; the is_game_participant RLS-recursion invariant recorded; two file headers no longer claim a Pages frontend.

Two durable facts were recorded that existed nowhere in the repository: the legacy aliases redirect from jefahnierocks.com, a second zone, and the RLS invariant.

Four drafted statements were corrected before landing: an invented precise timestamp (now date-only, the precision the evidence supports); a claim the full post-deploy smoke was green (only routing, headers and the lobby REST path were evidenced — the browser-side items are now listed as still owed); a retained "the Worker had likely never persisted a game" contradicting the one completed game; and a live-state claim placed in the file that forbids them.

Part 2 — agent-client configuration

Boundaries encoded rather than described. .claude/settings.json now denies mcp__supabase__execute_sql and mcp__supabase__apply_migration; deny outranks allow from any settings file, so the prohibition survives a local override. .codex/rules/dicee.rules no longer auto-allows linked-project Supabase writes — read-only inspection stays allow, while db push/pull/dump/reset, migration repair/up/apply, link, login, secrets, functions deploy/delete, gen types, pnpm db:types and op read/op item are prompt. Destructive Git stays forbidden. op item was added because it reaches the same credential as op read.

Drift detection. New pnpm agent:doctor (scripts/agent-doctor.mjs), dependency-free and in the house style. Committed checks run in CI; local checks run only when the file or client exists, so an absent ignored file can never fail CI. This closes the blind spot that let .claude/settings.local.json set enableAllProjectMcpServers: true and pre-allow mutating Supabase MCP tools while lint:docs stayed green — check-docs.mjs fixes its file set to git ls-files and hardcodes the shared settings path.

Completions rather than transitional states. Infisical is out: launcher, metadata names, credential checks, wrapper tests and command-policy rules deleted. Tracked references drop from 15 files to 8, each a deliberate guard or a retirement note, and a new retired-token entry keeps the remainder visible and shrinking. check-1password-setup.sh previously failed closed on six retired Infisical fields before reaching the Cloudflare check; it no longer does, and display-only identifiers no longer gate the credential report. The dead Cloudflare Pages permission and policy entries are gone.

Consistency. Every client now launches the AKG MCP server through mise, so it runs on the pinned Bun rather than whatever is first on that client's PATH. agent-clients.md records supported minimums (VS Code 1.137, Claude Code 2.1.272 stable, Codex 0.154.0) instead of pinning patch releases, corrects the Codex rules description, and adds model selection as guidance only — no model or maxEffortLevel in repository config.

Validation

pnpm lint exit 0 across all eight lanes, agent-doctor 0 errors, 40 doctor fixtures pass, check-docs 0 findings across 647 files, git diff --check clean. Pre-push validate-ci green on both pushes.

Risks and what is not included

• No infrastructure was touched, and nothing here authorizes any. Live claims trace to operator readbacks and are written as names, counts and HTTP status only.
• Status decision and action numbers are cited elsewhere, so none were renumbered.
• .vscode/settings.json carries an unrelated local modification, deliberately excluded.
• Four retired untracked surfaces (.windsurf/, .codex/workflows/, .claude/AGENT-CONFIGURATION-SUMMARY.md, .codex/rules/core-guardrails.md) are triaged DELETE OUTRIGHT with nothing to fold in, but remain on disk — removing never-tracked files is irreversible and was left to the owner.
• Git identity routing for this workspace is a workstation concern and is deliberately not solved here. agent:doctor warns about it.
• supabase db reset --local now prompts: a prefix rule cannot distinguish --local from --linked at that token position, and a destructive reset defaults to the safer decision. Documented as known friction.