docs(agent-sudo): lock D-CB5-D-CB9, add the P3-WIRING agent prompt, record P3 state

- agent_sudo_design_decisions.md: D-CB5 (3 tier-3 fails / 15min sliding / per-host),
  D-CB6 (append-only breaker log, state always replayed — tamper-EVIDENT beats
  tamper-PROOF when the daemon is root), D-CB7 (Set B host_override in code),
  D-CB8 (which tier-4 sources latch), D-CB9 (trip escalation). Each with rationale,
  rejected alternatives, and accepted costs.
- agent_prompts.md: add the P3-WIRING prompt. Flags a real NAME COLLISION — the
  existing "P3" section is the OLD P3 (Vault AppRole + Timeshift + evaluator, done
  as #142); P3 was redefined after D-CB1-D-CB9 were locked. Running the old one
  would redo finished work. Today's inline agent prompts were never persisted, which
  is why this one is.
- context.md: P3 code complete but UNDEPLOYED — the server-01 tier-0 breaker.log hole
  is open in production until DEPLOY_RUNBOOK.md runs. Two verified deploy blockers
  (Dockerfile never COPYs circuit_breaker.py/security/; compose has no
  /var/lib/agent-sudo mount => breaker resettable by docker restart, the exact D-CB6
  bypass). Both were invisible to an 85/85-green suite.
- context.md: MEMORY_DIR answered — do NOT repoint embed_memory_dir.py; its
  claude_memories table has no reader. Recall corpus now includes design docs;
  context.md stays excluded until #192 prunes it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent-builder/.claude/context.md

@@ -32,13 +32,32 @@ a **dead** root token as live, into every session, for 3 days. Prune = **#192**;
 - **Vault: production = primary `192.168.1.88:8200`.** server-01 is only a CLIENT of it. The sandbox
   Vault on server-01 is `:8201`. **Port 8200=prod / 8201=sandbox is the fastest tell** — never infer
   "server-01 is involved, therefore sandbox Vault." That inversion caused a real near-miss.
-- **Design decisions D1–D10 + D-CB1–D-CB4 are LOCKED.** The design record outranks any task title —
-  read `agent_builder/agent_sudo_design_decisions.md` before re-litigating.
+- **Design decisions D1–D10 + D-CB1–D-CB9 are LOCKED.** The design record outranks any task title —
+  read `agent_builder/agent_sudo_design_decisions.md` before re-litigating. **D-CB5–D-CB9 were added
+  2026-07-15** (sliding per-host trip window; append-only replayed breaker log; Set B host_override;
+  which tier-4 sources latch; trip escalation).
 
-**Next session (Wed 2026-07-15), in order:** **#174** (rotate the exposed root-equivalent token AND
-narrow `claude-policy` — rotation alone re-arms the hole) → **#149** (wire tier-2/3 + circuit-breaker,
-with **#173** fail-open/fail-closed folded in) → **#128** secrets-proxy (remove the ntfy approval
-gate) → **#147/#146** (CA P2–P5 + primary cutover 8084→8082).
+**⚠️ P3 CODE IS COMPLETE BUT NOT DEPLOYED — BOTH HOSTS STILL RUN THE OLD `sudo_rules.py`.**
+`app.py` + `circuit_breaker.py` + Set B override are written and green (**85 tests OK**, mutants
+caught) but **UNDEPLOYED**, so **the server-01 tier-0 `breaker.log` hole is OPEN IN PRODUCTION**
+until `DEPLOY_RUNBOOK.md` runs. Two **verified** deploy blockers gate it (row **187**):
+`Dockerfile` never COPYs `circuit_breaker.py`/`security/` (image would crash on boot), and
+`docker-compose.yml` has no `/var/lib/agent-sudo` mount (breaker resettable by `docker restart` —
+the exact D-CB6 bypass). **Both were invisible to a 85/85-green suite.**
+
+**Deploying is TIER-4 HUMAN-ONLY by design** (D-CB7 Set B): restarting `agent-sudo-daemon` is
+refused in code, because the unit env holds `SUDO_MD_VERIFY_ENFORCE` — self-restart IS the
+gate-disarm primitive. An agent physically may not deploy this. That is the constraint model
+working, not a gap.
+
+**Recall corpus (2026-07-15):** `semantic_recall.py` now indexes design docs too (`DOC_ROOTS`), so
+D-CB5–D-CB9 are searchable. `context.md` is **deliberately excluded** until **#192** prunes it.
+**MEMORY_DIR: do NOT repoint `embed_memory_dir.py`** — its Postgres `claude_memories` table has
+**no reader** (verified). See row **188**.
+
+**Next session, in order:** **#187** (Phase 0 blockers → `DEPLOY_RUNBOOK.md` phases 1–3; user runs
+the tier-4 steps) → **#173** fail-open/fail-closed → **#128** secrets-proxy → **#147/#146** (CA
+P2–P5 + primary cutover 8084→8082). **#205** (Vault+Bitwarden security design) is THU-first.
 
 **Then:** Thu 07-16 qui/qbit memory leak (#176) + media_pipeline (#177) · Fri 07-17 clear the runway
 (#178) · **Mon 07-20 resume business development (#179) — digital businesses deployed by Fri 07-24.**