Audit of 3560327

docs/operations.md

@@ -8,8 +8,6 @@ State lives in the directory given by `byre serve --data`, by default `~/Library
 
 Migrations are the files in `internal/store/migrations/` (`NNN-name.sql`), plus Go data migrations in `goMigrations`. The number only orders; a migration is identified by its name. A migration's SQL is fixed once applied anywhere: write it out in full rather than sharing Go constants that later change. byre is deployed from task branches that each add their own migrations, so after a merge a migration can land before others the database has already applied, and it still runs. Give a new migration a name no other branch will use, and make any data migration safe to run twice. `sqlite3 byre.db 'SELECT * FROM migrations'` lists what has been applied.
 
-`agent.tool_result` content dominates the event log's size, and the app loads every active task's whole history at startup. `sqlite3 byre.db "SELECT kind, count(*), sum(length(payload)) FROM events GROUP BY kind ORDER BY 3 DESC"` shows the split.
-
 ## Worktrees
 
 byre runs nothing in a new worktree. Installing dependencies or copying untracked files such as `.env` is the project's own instruction in its AGENTS.md, carried out by the agent with its own tools.
@@ -82,13 +80,12 @@ A model's name picks its vendor: `gpt-*` runs on Codex, `gemini-*` on Antigravit
 
 - A turn whose final message asks the human something in prose is bounced once, telling the agent to use `ask_human`. For Claude the bounce is a Stop hook that blocks the stop; Claude Code reports the block as a "Stop hook error" notification, which is expected. An agent told explicitly to ask in plain text will refuse the bounce.
 - A turn's final message is its summary. There is no report tool: models write a closing recap whatever they are told, so byre uses it rather than asking for a second one.
-- Reviews ride along for the human to look at; nothing waits for one. Every review covers the whole task against the default branch, so a newer one makes older ones moot.
+- A review covers the whole task against the default branch, so a newer one makes older ones moot. Findings reach the task's agent together, once the whole review workflow finishes; an individual reviewer finishing is not a completed review.
 - An audit checks only the newest commit of the default branch, one at a time per project, so it doesn't run on every revision but the newest one is always audited eventually. byre never fetches for an audit, so a commit pushed outside byre is audited only once a byre merge has fetched it.
 - A workflow definition is never changed once written: a save writes a new one, so freezing a workflow for a run is keeping the definition's id.
 - The lead's `show` is refused for a few seconds after the human moves the pane, and only a refusal arranges the "hold is over" signal, so the lead's prompt tells it to call `show` at once whenever it wants to show something, never holding back in expectation of a refusal.
 - A team task that comes up with some members failing to start isn't repaired; discard it and create it again.
 - There is no closed-task list in the UI; the human asks the lead.
-- A project's `TODO.md` is read from its default branch, so it shows what has been merged, not uncommitted edits in the checkout.
 - Nothing sets an inbox item's `superseded` state; it stays in the spec because old items hold it.
 
 ## git