Record Phase 8D baseline and browser contract

docs/agent/current-state.md

@@ -44,14 +44,16 @@ These observations should be checked when touching the relevant area; they are n
 - Confirm task-local Newlib standard-stream behavior if ESP-IDF/Newlib configuration changes; admin SSH command output relies on dispatcher-task stream redirection.
 - If HTTPD concurrency configuration changes, add locking around the boot-local Basic-authentication cache.
 
-## Active task — Phase 8D replanning
+## Active task — Phase 8D.0 baseline and browser contract
 
-- **Objective:** Split Phase 8D into independently reviewable, session-sized implementation and validation chunks; documentation only.
+- **Objective:** Documentation and measurement only, following `docs/phase8d_plan.md`; no authentication implementation or continuation to 8D.1.
 - **Context:** The user reports that the earlier experimental implementation was moved to a separate branch and `devel` rolled back after repeated agent interruptions, a roughly +10k/-1k-line diff, broken browser login, and severe memory pressure. These symptoms have not been independently diagnosed. Do not import that branch wholesale.
-- **Changes completed:** Added `docs/phase8d_plan.md` with chunks 8D.0–8D.22, M1/M2 target-validation pauses, per-chunk scope/stop rules, incremental and cumulative resource gates, and next-request templates. Linked the execution plan from the roadmap and staged the existing administration acceptance matrix. Firmware, generated assets, and durable implementation architecture are unchanged.
-- **Validation:** Documentation links and diff consistency are checked for this planning change; no firmware build, browser test, or target memory measurement is claimed. All new implementation chunks remain planned.
-- **Next:** 8D.0 only: verify the rolled-back baseline, record actual build/runtime memory and supported concurrency, and define the minimal browser-authentication contract and measured budgets. Missing target evidence stays pending; do not proceed to an all-in-one implementation.
-- **Risks / things to remember:** Historical linked RAM/flash values below are not a fresh runtime baseline. Cookie sessions, tickets, serial sockets, admin sockets, HTTPS requests, and SSH sessions have separate capacity costs. Reserve time for validation and handoff in every implementation request; stop/split instead of accumulating an unvalidated diff.
+- **Changes completed:** Added `docs/phase8d_baseline.md`: exact baseline revision/configuration hashes, build results, source-derived resource/socket inventory, minimal M1 routes/session/CSRF/origin/lifecycle/error contract, pending budget table and exact target checklist. Linked progress from the execution plan. Firmware, generated assets, and durable implementation architecture are unchanged.
+- **Baseline:** Clean `devel` at `af89dd1bd96cdd97d8d57eee7a29f68e3874506b`, PlatformIO espressif32 6.12.0 / IDF 5.5.0, N16R8 release. `pio run` passed in 36.08 seconds: 94,532 B linked RAM and 1,599,973 B flash (historical RAM unchanged, flash +208 B, cause not diagnosed). `pio device list` returned no ports. No agent upload or target/browser test was performed. The user subsequently supplied a runtime heap baseline; stack measurements remain pending.
+- **User-provided runtime memory baseline (2026-09-05):** Administrative SSH transcript with one browser serial writer (broker 8), one public-key user SSH observer (broker 9), and one public-key admin SSH session; web 1/2, SSH 2/2, zero tickets, no USB broker client listed. Heap bytes in free/minimum-free/largest-block order: internal 8-bit **39,668 / 13,876 / 18,432**; internal DMA **31,912 / 6,120 / 18,432**; PSRAM **8,138,380 / 8,107,324 / 7,995,392**. Accepted as the runtime baseline, not reserve floors or full-workload validation. Flashed revision, baud, duration, traffic and stack margins were not supplied. See `docs/phase8d_baseline.md` for provenance and remaining checks.
+- **Planned contract decisions:** Four one-hour absolute sessions without idle/sliding renewal, four 120-second pre-login CSRF challenges, four 30-second serial tickets, no live-record eviction and no Basic compatibility after cutover. Strict same-origin mutation/upgrade checks, session-specific logout versus account-wide revocation, bounded global login throttle. These are functional choices, not measured memory budgets or implemented behavior.
+- **Next:** Finish 8D.0 target checklist and measured reserve/incremental budgets in the baseline record. Five routine cycles per role, 15-minute 115200-baud concurrent soak and separate five-minute 460800-baud stress are specified but not executed. Do not start 8D.1 with the runtime gate pending without an explicit user decision; M1/M2 target pauses remain.
+- **Risks / things to remember:** Six HTTPD client slots include WebSockets; HTTPD infrastructure plus HTTPS and SSH can consume twelve of sixteen descriptors before other services/transients. Existing LRU purge is enabled and must not evict retained serial to admit M2 admin sockets. Nine current route slots have no spare capacity; the proposed M1 contract adds five. Cookie sessions, tickets, sockets and request scratch are separate costs. Only SSH exposes stack margin today. Numeric runtime floors and per-chunk/cumulative budgets remain pending, not guessed.
 
 ## Previous task — mDNS (target checks still pending)