Merge remote-tracking branch 'origin/master' into v2.3

AGENTS.md

@@ -59,6 +59,11 @@ These come from defects found in review; the evidence is in `docs/implementer-lo
   experiment as a `_test.go` file inside the repository (delete it before committing), or reason
   it out. Two sessions have ended with a plan and no tool call right after a refusal; that
   leaves the owner with no commit and no `stopped` row, the worst outcome.
+- Never change when production code releases, flushes or records something just to make a
+  given test's timing pass. If a given test seems to check a value before the code could
+  settle it (a deferred release, a row written after the answer), that is the owner's test
+  bug: stop and report it. (v2.3 task 02 released every slot at the first flushed byte to
+  satisfy such a test, and the limiter silently stopped limiting streams.)
 
 ## The gate
 
@@ -71,6 +76,10 @@ touched before the gate. `go test ./internal/<pkg>/` runs one package.
 - Work on the branch the task names. One task is one commit.
 - Stage only the paths the task lists: `git add <path> ...`. Never `git add -A` or `git add .`.
 - Never push, amend, rebase, reset, or switch to another branch.
+- A commit message with more than one line goes in `.state/commit-msg.txt` (inside the
+  repository and ignored by git; `/tmp` is refused) and is committed with
+  `git commit -F .state/commit-msg.txt`. An apostrophe inside a single-quoted `-m '…'` breaks
+  the shell command.
 - Commit message: the subject line the task gives, a blank line, then this trailer:
   `Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)`