chore(wolf): sync anatomy/cerebrum/memory/hooks/token-ledger bookkeeping

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg

.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-08-25T04:01:04.056Z
-> Files: 726 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-08-25T04:48:56.612Z
+> Files: 729 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../tmp/
 
@@ -255,7 +255,7 @@
 
 ## .claude/skills/xce-audit-invariants/
 
-- `SKILL.md` — XCE Design-Invariant Audit & Fix — audit documented invariants, fix confirmed violations, prove with build+unit+live HA soak (~2311 tok)
+- `SKILL.md` — XCE Design-Invariant Audit & Fix (~2530 tok)
 
 ## .claude/skills/xce-build/
 
@@ -763,7 +763,7 @@
 - `config-design.md` — Configuration Design: What Belongs in Shared Config (~2053 tok)
 - `error-handling.md` — Error Handling Standards (~1367 tok)
 - `ha-async-io.md` — HA Protocol & Async I/O (~4721 tok)
-- `persistence.md` — WAL & Persistence Durability (~3007 tok)
+- `persistence.md` — WAL & Persistence Durability (~3425 tok)
 - `product.md` — Product Overview (~1509 tok)
 - `roadmap.md` — Roadmap (~15496 tok)
 - `security.md` — Security Standards (~1636 tok)
@@ -1129,7 +1129,8 @@
 
 ## src/scheduler/include/
 
-- `core.h` — if !defined(_CORE_H_) (~8509 tok)
+- `core.h` — if !defined(_CORE_H_) (~8550 tok)
+- `plugin.h` — if !defined(_PLUGIN_H_) (~3583 tok)
 - `repl.h` — if !defined(_REPL_H_); task 12.5 added xce_repl_on_replay_complete()/xce_repl_check_replay_complete() (bug-1594) (~2258 tok)
 - `scheduler.h` — if !defined(_SCHEDULER_H_) (~4072 tok)
 
@@ -1137,10 +1138,12 @@
 
 - `core_clock.c` — include <stdarg.h> (~3441 tok)
 - `core_events.c` — include <errno.h> (~10963 tok)
+- `core_session.c` — include <errno.h> (~4367 tok)
 - `core.c` — include <errno.h> (~4310 tok)
-- `driver.c` — include <errno.h> (~9286 tok)
+- `driver.c` — include <errno.h> (~9443 tok)
 - `handler.c` — include <errno.h> (~6283 tok)
 - `main.c` — build-time-versioning task 3.2 (argp_program_version runtime-composed into static `version_buf[128]`, both mutually-exclusive startup INFO lines read that buffer) PLUS dirty-content-fingerprint task 3.2 (2026-08-21): same split-buffer pattern as controller/main.c -- new static `version_display_buf[128]` via `xce_compose_version_ex()` feeds `argp_program_version`; `version_buf`/startup INFO lines untouched (Req 3.2). Live-verified: `--version` -> `7ebcba6d-cdb7cc7d`, startup log -> `7ebcba6d-dirty` (~5186 tok)
+- `plugin.c` — include <errno.h> (~4344 tok)
 - `recording_session.c` — include <stdint.h> (~2706 tok)
 - `repl_break.c` — include <stdio.h> (~7907 tok)
 - `repl_info.c` — include <stdio.h> (~9489 tok)
@@ -1148,8 +1151,8 @@
 - `repl_params.c` — include <errno.h> (~4299 tok)
 - `repl.c` — include <ctype.h>; task 12.5 added xce_repl_on_replay_complete(), replay_complete guard on step/continue, quote-stripping in repl_split_tokens() (bug-1594/1596) (~6611 tok)
 - `resource.c` — include <errno.h> (~4509 tok)
-- `scheduler.c` — include <errno.h> (~15834 tok)
-- `sim_loop.c` — include <errno.h> (~13725 tok)
+- `scheduler.c` — include <errno.h> (~15839 tok)
+- `sim_loop.c` — include <errno.h> (~13920 tok)
 - `sim_picker.c` — include <errno.h> (~1374 tok)
 - `sim_verify.c` — include <stdio.h> (~4694 tok)
 - `sim.c` — include <errno.h> (~6106 tok)
@@ -1164,13 +1167,13 @@
 
 - `meson.build` — Declares vtask_entry (~18646 tok)
 - `scratch_gen_resource_replay.c` (~2735 tok)
-- `test_admin_request.c` — Declares level (~12706 tok)
+- `test_admin_request.c` — Declares level (~12713 tok)
 - `test_clock.c` — Declares uint64_t (~5450 tok)
 - `test_core_events.c` — Declares and; real dup_val() reimpl added for link (bug-1585) (~7880 tok)
 - `test_core_isolation.c` — Declares char (~4069 tok)
-- `test_driver_decision_cb.c` — Declares is (~3675 tok)
+- `test_driver_decision_cb.c` — Declares is (~3683 tok)
 - `test_driver_session_ordering.c` — Declares started (~8520 tok)
-- `test_driver_translate.c` — Declares field (~9507 tok)
+- `test_driver_translate.c` — Declares field (~9514 tok)
 - `test_handlers.c` — define UNIT_TEST 1 (~2728 tok)
 - `test_no_bare_printf.c` — Declares char (~1702 tok)
 - `test_record_lifecycle.c` — Declares char (~12710 tok)
@@ -1180,7 +1183,7 @@
 - `test_repl_snapshot_params.c` — Declares char (~8179 tok)
 - `test_resource_accounting.c` — Req 1.4 proof: sched_charge_account/sched_uncharge_account/sched_commit_job_alloc (resource.c) give identical resInUse/sharedInUse whether core comes from xce_scheduler_t or xce_sched_sim_driver_t; white-box core.c+resource.c (~3200 tok)
 - `test_resource_accounting.c` — Declares char (~4292 tok)
-- `test_resval_ownership.c` — Declares instead (~5471 tok)
+- `test_resval_ownership.c` — Declares instead (~5478 tok)
 - `test_scheduler_dispatch_commit.c` — scheduler-dispatch-commit task 2.1 (Req 1.1-1.3): sched_commit_decision()'s DISPATCH branch sets job->state=JOB_STAT_RUN alongside allocs/accounts; whole-scheduler_srcs link, no sched_init()/xcecli_* wrap needed. Extended task 5.1 (Req 1.1-1.3,2.1,2.3, bug-1624 e2e regression): added test_dispatch_commit_survives_several_rounds_before_confirmation (GAP_ROUNDS=5 round-boundary loop, asserts resInUse restored every round) and test_dispatch_commit_multi_round_gap_matches_same_round_confirmation (explicit value comparison via run_dispatch_then_n_rounds(1) vs (GAP_ROUNDS) helper, not just a hardcoded-constant check); RED-verified by temporarily reverting scheduler.c's job->state=JOB_STAT_RUN line (4/5 tests failed as expected), restored clean (~5000 tok)
 - `test_sim_alt_events.c` — Declares char (~4966 tok)
 - `test_sim_contention_parity.c` — Declares calls (~14346 tok)
@@ -1194,7 +1197,7 @@
 - `test_sim_record_output.c` — Declares char (~5888 tok)
 - `test_sim_resource_contention.c` — scheduler-sim-decision-parity task 1.2 (Req 2.1/2.2): resource-contention replay fixture (worker w/ 10.0-unit capacity, 3 jobs wanting 8/5/2 -- job B genuinely denied by real sched_check_host_satisfy()/sched_charge_account()); proves fixture shape + dual-use (real normal-mode recording, also replayable via sim driver); white-box core.c+driver.c+resource.c+full sim/repl/recording stack (~9218 tok)
 - `test_sim_round_boundary_reconciliation.c` — scheduler-sim-decision-parity task 3 (Req 1.3/1.4, 2.1/2.2): end-to-end proof that reconciliation is wired before sched_account_jobs()/xce_core_signal_go() -- job A already RUN with no live decision (JOB_STATE_CHANGE event + matching recorded DISPATCH, hand-crafted `.replay`) gets its resInUse charged (via REAL make_job_account()/sched_charge_account(), including lazy resname->residx resolution through a pre-registered makeResource()) before sched_check_host_satisfy() correctly denies/grants hypothetical capacity; real (non-stub) sched_account_jobs() reimpl, unlike every sibling sim_loop.c-including test file (~7700 tok)
-- `test_sim_session_ordering.c` — scheduler-sim-decision-parity task 2.1 (Req 1.3/1.4, 5.1, 5.3): sim-mode counterpart to test_driver_session_ordering.c; spy sched_account_jobs() proves sched_sim_driver_run() now calls it once per replayed round with core->session_active==1 (0 calls pre-fix = bug-1613, RED; 2 calls GREEN); records 2 real normal-mode rounds then replays via real unmodified sim driver; white-box core.c+driver.c+full sim/repl/recording stack (~6004 tok)
+- `test_sim_session_ordering.c` (~7772 tok)
 - `test_sim_snapshot_reconcile_gap.c` — scheduler-sim-decision-parity task 4.2 (Req 4.1/4.2 regression, the genuinely-new check (c)): a replay starting from a SNAPSHOT that already has a job (901) in RUN state with no in-window recorded decision anywhere -- pushes a QUEUE_UPDATE+JOBS_PUSH(job.state=JOB_STAT_RUN, no allocs) directly onto a throwaway xce_scheduler_t's core via real xce_core_push_events() BEFORE sched_record_start() snapshots it, so the written `.replay`'s initial SnapshotEntry carries the RUN job with job->accounts==NULL from byte one; asserts rc==0 (no crash), job->accounts/allocs stay NULL after replay (unavailable, not fabricated), job->state stays RUN, and a second ordinary job (902) is still decided normally -- proves builtin_fcfs's JOB_IS_PEND(job->state) guard in on_job_push also keeps this job out of live-picker candidacy, so reconciliation's "not found" branch (task 2.2) is the only path that ever touches it; white-box core.c+full sim/repl/recording stack, same set as test_sim_verify.c (~6117 tok)
 - `test_sim_startup.c` — Declares char (~5535 tok)
 - `test_sim_verify.c` — Declares mismatch; task 3 (Req 5.2) adds append_job_state_change_event()/append_replay_session_with_dispatch_and_pend() + test_verify_with_already_resolved_job_reports_no_mismatch(): --sim-verify against a recording with an already-resolved job reports zero mismatches now that reconciliation compacts decoded_session before the verify drain loop; task 4.2 (Req 5.1/5.2, check (b) extension) adds append_replay_session_with_two_dispatches_and_pend()/append_replay_session_with_two_pends() + test_verify_with_multiple_already_resolved_jobs_across_rounds_reports_no_mismatch(): TWO already-resolved jobs (A/C) in one round with a still-genuinely-PEND job's (B) own recorded PEND sandwiched BETWEEN the two DISPATCH entries (exercises non-adjacent memmove compaction, unlike task 3's single-leading-entry case), followed by an ordinary round 2 -- caught a real test-authoring gap live: builtin_fcfs's pendJobs discipline re-offers a still-PEND job EVERY subsequent round (not just its arrival round), so round 2's recorded fixture had to include B's recurring PEND too, not just the fresh job D's (~13500 tok)