Review

High

• [x] AUTO-FIX: F01 Required rollout proof is absent (docs/dogfood-reports/installable-patrol-modules.md:11): the committed report has no seven-day live window, 0/0 comparable decisions, no cutover or rollback drill, and no hosted exact-head/merge-ready proof required by R15. <!-- triage: plan R15 and U9-U10 make rollout proof a required gate -->
• [x] AUTO-FIX: F02 Production shadow paths compare each module decision to itself (lib/hive/modules/adapters/patrol.rb:129): neither adapter consumes an immutable legacy-mutator capture, so the required independent parity evidence can never become comparable. <!-- triage: plan U9 requires one immutable production snapshot and independent shadow evaluation -->
• [x] AUTO-FIX: F03 shadow_mode=false bypasses the evidence-gated ownership epoch (lib/hive/modules/migration/patrols.rb:45): without migration state the legacy path remains authorized while the module path becomes a mutator, permitting duplicate external effects. <!-- triage: plan F5 and U9 require one durable mutator ownership epoch -->
• [x] AUTO-FIX: F04 Cutover races precomputed legacy reservations (lib/hive/daemon/patrol_scheduler.rb:69): ownership is checked while enumerating candidates but not atomically at reserve/spawn, so stale ordinary or Architecture Patrol work can launch after module ownership takes over. <!-- triage: plan F4 and U9 require fencing new legacy reservations -->
• [x] AUTO-FIX: F05 Cutover accepts stale parity reports (lib/hive/modules/migration/patrols.rb:149): it trusts the saved eligible flag and rechecks only configuration digests, allowing later mismatches or duplicate-effect evidence to be ignored. <!-- triage: plan R15 requires current zero-difference evidence at cutover -->
• [x] AUTO-FIX: F06 Partial two-module rollback cannot resume (lib/hive/modules/migration/patrols.rb:297): if the first restore succeeds and the second fails, retry rejects the already-restored module's old active CAS and leaves both patrols fenced. <!-- triage: plan F5 and U9 require resumable rollback to legacy ownership -->
• [x] AUTO-FIX: F07 Packaged workflow hook targets always fail in production (lib/hive/modules/target_executor.rb:39): the default workflow runner unconditionally raises module-pinned workflow task admission is unavailable, leaving a plan-required target kind unimplemented. <!-- triage: plan target assumptions and U4 require packaged workflow admission -->
• [x] AUTO-FIX: F08 Legacy patrol aliases bypass module admission and ownership (lib/hive/commands/patrol.rb:48, lib/hive/commands/refactor_patrol.rb:123): both commands still invoke their legacy engines directly instead of forwarding through module-hook admission after cutover. <!-- triage: plan R13 and U7-U8 require forwarding aliases -->
• [x] AUTO-FIX: F09 First-party module decisions read live legacy configuration outside the reviewed snapshot (lib/hive/modules/adapters/patrol.rb:96, lib/hive/modules/adapters/architecture_patrol.rb:130): config edits can change behavior without changing the module digest, receipt, or status projection. <!-- triage: plan R4 and R10 bind execution to immutable reviewed configuration -->
• [x] AUTO-FIX: F10 First-party grants are only adapter preflights (lib/hive/modules/adapters/patrol.rb:78): unrestricted legacy engines still run configured commands and side-effect gateways without enforcing the immutable grant snapshot at each sink. <!-- triage: plan R5 and U7-U8 require sink-level capability enforcement -->
• [x] AUTO-FIX: F11 Module command targets inherit ungranted secrets and network authority (lib/hive/modules/target_executor.rb:19): Process.spawn receives the ambient environment and no network confinement, bypassing the separately reviewed secret and host grants. <!-- triage: plan R5 requires separate secret and network authority enforcement -->
• [x] AUTO-FIX: F12 The private module-hook worker lacks authenticated attempt context (bin/hive:48): __module-hook runs even without HIVE_ATTEMPT_INTERNAL, allowing a persisted run snapshot to be replayed outside durable supervisor admission. <!-- triage: plan R10 and U4 require durable authenticated attempt admission -->
• [x] AUTO-FIX: F13 Disable and uninstall race durable hook admission (lib/hive/modules/dispatcher.rb:46): lifecycle mutation and dispatch use unrelated locks, so a stale enabled context can create an attempt after the disabling mutation has returned. <!-- triage: plan R7 and R10 require atomic lifecycle and admission fencing -->
• [x] AUTO-FIX: F14 Successful activation commits a live rollback journal (lib/hive/module_package/managed_store.rb:66): the Git callback snapshots activation.json and the barrier before transaction.commit! removes them, so rematerialized committed state treats success as interrupted and rolls it back. <!-- triage: plan R6 and U2 require committed activation reconciliation to be idempotent -->
• [x] AUTO-FIX: F15 Generation pruning precedes the fallible state commit (lib/hive/module_package/managed_store.rb:65): a failed third-generation commit restores pointers whose old previous executable was already irreversibly deleted. <!-- triage: plan R6 requires durable pointer commit before bounded generation cleanup -->
• [x] AUTO-FIX: F16 Configuration-only updates lose the immediate rollback target (lib/hive/module_package/managed_store.rb:348): previous changes only with source_commit, so a same-source configuration update drops and cleans up the configuration it must be able to restore. <!-- triage: plan R6 defines active and previous configuration rollback -->
• [x] AUTO-FIX: F17 Reinstall replays events from the uninstall interval (lib/hive/module_package/managed_store.rb:354): reinstall preserves the uninstall-time high-water mark even though tombstones were not drained, making later interval events newly admissible. <!-- triage: plan R7 and AE6 require reinstall and re-enable no-replay watermarks -->
• [x] AUTO-FIX: F18 New or changed hooks replay pre-update events (lib/hive/module_package/managed_store.rb:367): updates retain the original install watermark, give new hooks nil cursors, and retain stale cursors across binding-digest changes. <!-- triage: plan U4 requires new or changed bindings to start at current high-water -->
• [x] AUTO-FIX: F19 Legacy project identities change after module evidence can be written (lib/hive/config.rb:1202, lib/hive/config.rb:1763): normal reads synthesize one UUID while daemon backfill persists another, stranding pre-daemon events and setup outboxes behind project-identity checks. <!-- triage: plan R9 requires one stable immutable project identity -->
• [x] AUTO-FIX: F20 Repeating an archive no-op conflicts with its durable event (lib/hive/commands/stage_action.rb:105): the same idempotency key is republished with a fresh occurred_at, which EventLedger treats as a conflicting payload instead of an idempotent duplicate. <!-- triage: plan R9 requires immutable equivalent redelivery under one idempotency key -->
• [x] AUTO-FIX: F21 Evidence-closure terminal transitions omit task.completed (lib/hive/commands/stage_action.rb:195): every successful close_with_receipt path returns without publishing the named event required to trigger Patrol. <!-- triage: plan R9 and R11 require task.completed after every durable terminal transition -->
• [x] AUTO-FIX: F22 Detached launch handoff failure loses the trigger without bounded retry (lib/hive/modules/dispatcher.rb:176): launch_handoff_failed becomes a failed concurrency skip, advances the cursor, and is excluded from daemon retry reconciliation. <!-- triage: plan R8 and U4 require bounded retry without losing the occurrence -->
• [x] AUTO-FIX: F23 Legacy Honeycomb module install accepts omitted exact grants (lib/hive/commands/module/lifecycle.rb:161): noninteractive install can bind an empty grant set into a valid receipt and activate without proving it covers manifest permissions or confirming each atom. <!-- triage: plan R4-R5 require every noninteractive choice and grant explicitly -->
• [x] AUTO-FIX: F24 Module E2E scenarios bypass the production lifecycle and worker (test/e2e/lib/module_scenario_support.rb:37): they call ManagedStore directly and use a recording launcher, never exercising catalog consent, CLI/Web apply, __module-hook, first-party adapters, retries, or terminal receipts. <!-- triage: plan U10 and AE1-AE8 require production-path scenario coverage -->
• [x] AUTO-FIX: F25 Migration fencing is invisible to status and doctor (lib/hive/modules/doctor.rb:17): corrupt migration state can stop both patrol paths while the shared operational surfaces still report the installed modules active and healthy. <!-- triage: plan R14 requires status and doctor to explain migration blockers -->

Medium

• [x] AUTO-FIX: F26 Event draining reparses the full decision history for every event/module/hook tuple (lib/hive/modules/daemon_runtime.rb:69): retained event and decision history makes each daemon tick grow nonlinearly and eventually delays autonomous dispatch. <!-- triage: reviewer identifies a clear incremental-indexing performance fix -->

Nit