Record the fix pass and the run 2 preconditions

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

BURNIN.md

@@ -10,7 +10,7 @@ implementation work.
 
 ## Burn-in build identity
 
-`6f9300b549362c4c5788f8845b56aaff9672d993`
+`77a2b323fabcf080d7542061ae2d7b3c34eef5b7`
 
 Both halves must report exactly this revision before a task is created. Neither
 needs a credential now: the coordinator prints it in `docker logs orchestra-api`
@@ -411,3 +411,78 @@ decisions       none
   source for every task, so the three queued `correx` tasks have their external
   ids looked up in `kami/test-e2e`. A source should only reconcile the tasks
   that came from it. Likely why those three never lease.
+
+## Fix pass before run 2, 2026-08-26 23:50
+
+Burn-in identity is now `77a2b32`. The coordinator is deployed at it. The worker
+is staged at it, sha256 `2a850f2d1102d390...`, still needing root to install.
+
+### Closed
+
+- **F7, security.** `authz.RequireCredentials` refuses startup when a
+  full-control surface has no token, rather than logging it.
+  `ORCHESTRA_TUI_TOKEN` is set in the coordinator `.env`. Verified live: an
+  unauthenticated `POST` on the TUI surface now returns 401. Web is exempt
+  because `Sessions` makes its login mandatory. `ORCHESTRA_MCP_TOKEN`,
+  `ORCHESTRA_MAVEN_TOKEN` and `ORCHESTRA_AGENT_TOKEN` remain unset, so those
+  surfaces are still unauthenticated for reads and for their three request
+  endpoints. Bounded by capability, worth closing, not startup-fatal.
+- **F5, lifecycle.** Every eligibility gate now records a `router.Rejection`,
+  exposed at `GET /v1/router/health` and reset per pass. No gate was weakened.
+  The live output immediately explained the three stuck `correx` tasks:
+  `worker has not declared project correx`. A queued task in retry backoff was
+  skipped before the candidate loop and recorded nothing at all, which is the
+  shape that hid the original case; it now reports
+  `retry backoff until <time>`.
+- **F8, correctness.** Reconciliation is bound to `task.Source`, the
+  `provider:project` identity the ingest stamped. A source that cannot prove it
+  owns the task is skipped, and a task with no matching source reconciles to
+  nothing and still launches. The integration fixture had encoded the bug: it
+  ingested from `jsonl` and reconciled from `gitea`.
+- **F11, outage.** The API entered a restart loop exiting with `invalid event:
+  until_ns required`. `ValidateEvent` compared `until_ns` against `time.Now()`
+  for `TaskLeased` and `TaskLeaseRenewed`, so a lease event that was valid when
+  written failed validation once it expired. `store.Open` replays the tail after
+  the snapshot and `log.Fatal`s on the first invalid event, so the coordinator
+  refused its own history. Validation of a durable event is now
+  time-independent. Latent since the field existed: it needed a renewal in the
+  post-snapshot tail plus a restart after that renewal expired.
+
+### Also found
+
+- **F9, lifecycle.** An operator cannot release a leased task through
+  `POST /v1/tasks/<id>/release` without knowing its `harness_id` and
+  `lease_epoch`, because `Store.Append` fences lifecycle events on a leased
+  task and the endpoint passes the request body through unchanged. Correct that
+  only the owner releases, but there is no operator escape hatch.
+- **F10, hygiene.** A coordinator-side release under a live worker leaves the
+  worker renewing a lease it no longer holds. Combined with F11 that produced a
+  per-second invalid-event log line.
+
+### Shared checkout
+
+Another session is working on the auth and frontend layers in this same
+checkout. Two consequences, both handled: `deploy/build.sh` and the container
+image now build in a detached worktree of the revision they stamp, so no
+uncommitted work is compiled into a stamped binary and no in-progress edit
+blocks a deploy. Commits from this session name their paths rather than using
+`git add -A`. The first commit, `7f12c7f`, predates that discipline and swept in
+whatever was uncommitted at the time, including `web/src` and `internal/authn`.
+
+### Run 1 is closed as a diagnostic
+
+Task `06G3YR34117MAYT6KEAC9RJHD0` was released with reason `abandoned diagnostic
+run`, supplying the lease fence by hand per F9. It sits at `attempt: 3` and the
+router will fail it on its next pass. It is not a conformance run: it needed
+three manual leases and its authority was built before the issue-body fix.
+
+### Run 2 preconditions
+
+```
+worker installed at 77a2b32 and restarted
+coordinator at 77a2b32                     done
+F7 closed                                  done
+F5 exposed                                 done
+F8 fixed                                   done
+fresh issue, no manual leasing
+```