chore(memory): job9 — BDR-060 version floor, BDR-061 path-b, LRN-112 nesting, journal + TODO

.claude/memory/journal.md

@@ -358,3 +358,10 @@ rules:
 - job8 third-party security audit shipped read-only: `.audit/job8-report.md` — magic MCP/plugins/gstack/external skills/trust chain, 9 explorers + verifier batches, 11 CONFIRMED/5 CORRECTED/0 REFUTED. Surfaces C (ui-ux-pro-max) + D (other plugins) finished inline, single-observer, no verifier pass — Fable-5 spend limit hit mid-run.
 - User GO on all 4 items: A allowlist stays empty, ask-gate explicit; B covered by A (no STOP); C reinstall pinned (not remove/keep-broken); D no action. Executor = this session, `chore/job8-hardening`, no finish.
 - job8 EXECUTED: 3 commits. **A**: `settings.json` `permissions.ask` += 4 `mcp__magic__*` tools, isolated from 2 unrelated pre-existing edits (model/skipWorkflowUsageWarning) already sitting uncommitted before this session started — those restored uncommitted after, not part of this branch's history [[BDR-059]]. **B**: confirmed `component_builder` in scope of A's gate, no STOP needed; documented the callback-injection risk in README's MCP section + [[LRN-110]] — third-party package code, not patched. **C**: confirmed referenced files (`references/`, `scripts/`, `templates/`) 100% absent from `~/.agents/skills/darwin-skill/` (only `SKILL.md` present) — root-caused to the `skills` CLI's `skillPath` install field fetching a single file, not the repo tree [[LRN-109]]. Upstream HEAD matched the already-recorded lockfile hash exactly (zero drift). Reinstalled full tree at that pinned SHA, `.git` kept but detached (2nd real SHA-pin after gstack) [[BDR-058]]. Backup of old single-file dir kept. Git-commit whole-`.claude/skills`-tree scope NOT restricted (3rd-party pinned code, patching breaks the pin) — documented as accepted risk instead. 3 Bash permission denials mid-C (rsync x2, cp+rm) before a plain `cp` succeeded — `rm -r*`/`rm -rf*` are hard-denied even for scratch/temp paths, no prompt possible; switched approach rather than retrying identically. **D**: confirmed untouched. `make test` green throughout (incl. a live `path_present(darwin-skill)` fs check). Smoke gate: real `mcp__magic__logo_search` call in-session, user confirmed the ask prompt fired and was manually approved — no auto-exec. [[LRN-111]]. Branch unmerged, human gate. **Not re-verified this cycle** (job8 report's own caveat, carried forward): surfaces C/D (ui-ux-pro-max, other plugins) were single-observer CLEAN findings with no adversarial pass — re-audit next cycle if darwin/magic scope comes up again.
+
+## 2026-07-08
+- job9 sub-agent architecture corrections shipped, `chore/job9-agents`, 10 code commits, `make test` green throughout. Premise correction confirmed: CC **v2.1.203** live, nesting supported (cap 5, `Agent`-in-tools required) — [[LRN-112]], contradicts the operating premise of the whole job1-9 series.
+- **Part 1** (4 commits, `0ede52c`..`5ab6c21`): commit-changer drop unused `Agent`; verifier + security-auditor + plugin-advisor pinned `model: sonnet`. Gate = real dispatch smoke on sonnet: verifier `CONFORME`, security-auditor `BLOCK(2)` (checklist caught planted hardcoded-secret + SQLi that semgrep 1.168.0 missed), plugin-advisor `ACTION REQUIRED` — verdict grammar intact, mode honored, no revert.
+- **Part 2** (`a5a7b54`/`6df42e4`/`c498b93`/`70fb3b4` + hardening `212f9aa`): seo/geo analyzers re-architected to fix-bundle→L1 (validator-analyzer contract), `Agent` dropped from both `tools:`; `/seo` new STEP 1.5 applies at L1 (serial by ownership, dissolves the parallel-edit race), `/geo` → dispatch+apply orchestrator, `/harden` already end-to-end path-b (untouched), `/onboard` audit-only (untouched). [[BDR-060]] version floor + [[BDR-061]] path-b doctrine. 4 real smokes green: analyzer emits bundle + edits nothing (md5 unchanged, no files created); AUTO fix LANDS on disk via L1 hotfixer with no confirmation (the exact previously-broken path — *report but zero fix* → resolved); GATED withheld pre-accord then applied post-accord (new tier, first test); /onboard writes only the report, zero source files.
+- **Part 3** (`87d63bf`/`af9656f`): H2 "Load and follow" idiom → **INLINE-LOAD** verb at code-cleaner + scaffolder (main-loop-BECOMES-agent, `Agent` not involved), drop unused `Agent` from code-cleaner; H1 code-cleaner→refactorer handoff now a named artifact `.claude/audits/CODE-CLEAN-SCOPE.md`. Tight scope per user (2 cited sites, no 40-site rewrite).
+- Branch unmerged, human gate. **Latent (out of scope, flagged not fixed)**: `commit-changer.md:109` commit-message template still carries `Co-Authored-By: Claude <noreply@anthropic.com>` — contradicts the hard no-attribution ban ([[no-commit-attribution]]); needs a separate fix.