Review

High

• [x] AUTO-FIX: Enforce the archive read-only boundary in every task mutation controller (web/app/controllers/tasks/base_controller.rb:26): source=archive resolves an archived task, but approval, rejection, run, recovery, answer, and intervention endpoints still mutate it. <!-- triage: plan explicitly makes archive tasks read-only -->
• [x] AUTO-FIX: Reject or path-scrub absolute host paths across every agent-controlled context-receipt string (lib/hive/context_provenance/context_receipt.rb:87): labels, queries, rationale, repository/wiki strings, and diagnostics can promote <local-path> verbatim, leak host paths, and violate SafeString in workspace JSON. <!-- triage: required safe-string boundary has a clear validation fix -->
• [x] AUTO-FIX: Require the durable session-start append to succeed before provider execution (lib/hive/stages/base.rb:910): AgentObservation#start! converts activity failures to false, and both launch paths ignore the result and run the provider without the required start record. <!-- triage: durable-before-provider ordering is explicit -->
• [x] AUTO-FIX: Reconcile failed terminal session appends (lib/hive/agent_observation.rb:84): a successful start followed by a swallowed finish! write failure leaves a completed provider run projected as live indefinitely. <!-- triage: append reconciliation is plan-mandated -->
• [x] AUTO-FIX: Classify Claude's actual timeout result shape as timed out (lib/hive/agent_observation.rb:191): ClaudeLauncher returns status: :timeout, but the observer recognizes only timed_out: true and records the session as succeeded and completed. <!-- triage: provider result mapping has one correct outcome -->
• [x] AUTO-FIX: Reconcile activity after an immutable context receipt is persisted (lib/hive/context_provenance.rb:90): promotion writes the final receipt and deletes the candidate before a swallowed activity failure, while retries return already_promoted without restoring the missing audit event. <!-- triage: append-gap reconciliation is explicitly required -->
• [x] AUTO-FIX: Preserve pageable material history before applying the raw JSONL row cap (lib/hive/task_workspace/jsonl_reader.rb:93): 2,000 newer noise rows can evict every older material event, after which the timeline emits no cursor to reach them. <!-- triage: lossless material pagination is required -->
• [x] AUTO-FIX: Use one lossless coordinate system for timeline pagination (lib/hive/task_workspace/timeline.rb:130): the cursor advances each source to its physical window start after returning only 200 occurrence-sorted items, permanently skipping unread and late-ingested material records. <!-- triage: cursor contract forbids skipped material records -->
• [x] AUTO-FIX: Make task-projection checkpoints projection-plus-suffix bounded (lib/hive/task_projection/store.rb:225): each workspace read hashes and replays the complete journal prefix, and large prefixes turn the checkpoint oversized instead of satisfying the required bounded-suffix contract. <!-- triage: bounded-suffix checkpoint design is settled -->
• [x] AUTO-FIX: Index numeric dependency targets and check the shared deadline while building edges (lib/hive/task_workspace/dependency_component.rb:153): numeric depends_on values scan all nodes per edge outside deadline checks, making the documented 10,000-entry traversal quadratic. <!-- triage: clear bounded-performance correction -->
• [x] AUTO-FIX: Enforce the dependency component's single elapsed-time budget across per-node Git reads (lib/hive/task_workspace/dependency_component.rb:53): up to 100 selected nodes each receive an independent 10-second publication projection after the graph's two-second deadline. <!-- triage: plan defines one shared two-second deadline -->
• [x] AUTO-FIX: Observe the current base ref independently before classifying stack divergence (lib/hive/task_workspace/builder.rb:302): the builder feeds the historical pointer base_oid back as observed_base_oid, so expected and observed values appear aligned by construction. <!-- triage: historical-current separation is explicit -->
• [x] AUTO-FIX: Record backward stage moves as rejection_recorded (lib/hive/commands/approve.rb:139): Web rejection uses approval_recorded and approval wording for every direction, so the unified audit timeline mislabels a rejection as an approval. <!-- triage: event vocabulary determines the correct classification -->
• [x] AUTO-FIX: Apply operation-reconciliation caps after selecting nonterminal receipts (lib/hive/task_activity.rb:232): the first 100 sorted files are chosen before completed receipts are skipped, so old terminal receipts can permanently starve a later pending mutation. <!-- triage: clear cap-ordering starvation bug -->
• [x] AUTO-FIX: Normalize or reject every event-stream field against TimelineRecord before emission (lib/hive/task_workspace/timeline.rb:226): arbitrary hashes, arrays, and oversized strings are copied into typed fields and can make authenticated hive-task-workspace.v1 JSON fail its own schema. <!-- triage: registered schema requires normalized bounded fields -->
• [x] AUTO-FIX: Put question, recovery, and diagnostic state into the shared normalized snapshot (web/app/controllers/tasks_controller.rb:3): HTML still renders those operator facts directly from @task and @questions, so the plan-required HTML/JSON parity and single-read-model contract are incomplete. <!-- triage: single shared read model is a settled requirement -->
• [x] AUTO-FIX: Include attempt and resource panel integrity in decision and action safety (lib/hive/task_workspace/builder.rb:106): a current top-level projection can enable controls and return wait from agent_running even when current-attempt or resource evidence is missing, partial, or conflicting. <!-- triage: decision precedence fails closed on degraded evidence -->
• [x] AUTO-FIX: Keep local publication facts morph-owned or explicitly refreshable (web/app/views/tasks/show.html.erb:63): the permanent publication frame freezes branch, head, push, and dirty state across status updates even though those cheap local observations are required to stay current. <!-- triage: live local-fact refresh is explicitly required -->
• [x] AUTO-FIX: Publish immutable context receipts with atomic no-replace semantics (lib/hive/context_provenance.rb:263): concurrent writers can both pass the existence check and the later rename can overwrite the first historical receipt. <!-- triage: immutability requires a standard no-replace write -->
• [x] AUTO-FIX: Add the mandated 400% reflow and exact caret-preservation browser assertions (web/test/system/task_workspace_test.rb:15): the suite resizes to 320 CSS pixels without applying 400% zoom and verifies continued typing rather than the preserved selection range required by AE8/R10. <!-- triage: acceptance contract specifies exact missing assertions -->

Medium

• [x] AUTO-FIX: Include untracked files in local working-tree state (lib/hive/task_workspace/publication.rb:169): --untracked-files=no reports an untracked-only checkout as clean and understates unpublished local changes. <!-- triage: publication truth clearly includes all local changes -->
• [x] AUTO-FIX: Let an explicit publication refresh repair a malformed cache entry (lib/hive/task_workspace/publication_cache.rb:93): cache parsing fails before the transport call and returns without replacing or quarantining the corrupt file, wedging refresh permanently. <!-- triage: explicit refresh has a clear cache-repair path -->
• [x] AUTO-FIX: Preserve timeline drill-down in a separate stable frame with a return path (web/app/views/tasks/_timeline.html.erb:15): older/raw links replace the current timeline, provide no way back, and the next status morph discards the operator's inspection state. <!-- triage: AE8 requires inspection state preservation -->
• [x] AUTO-FIX: Cancel pending scroll-restoration animation frames on disconnect (web/app/javascript/controllers/task_workspace_controller.js:80): a queued callback can run after navigation and apply the departed task's scroll position to the next page. <!-- triage: standard lifecycle cleanup has one safe fix -->
• [x] AUTO-FIX: Associate raw noise members while grouping instead of rescanning all groups (lib/hive/task_workspace/timeline.rb:418): groups.find inside items.each makes bounded raw-group expansion quadratic for many distinct noise groups. <!-- triage: clear linear-time grouping improvement -->

Nit