Harden cleanup and reduce internal RAM use. Phase 8C nearly validated

and somewhat stable.

docs/agent/code-map.md

@@ -30,7 +30,7 @@ This is a semantic map, not a complete file inventory. Start here, then read the
 - Normal data caller: `session_broker`; USB, WebSocket, role-`user` SSH, console, and local UI also call serial lifecycle/configuration APIs as appropriate
 - Dependencies: ESP-IDF UART driver, `board_pins.h`, NVS
 - Ownership: the cooperative owner arbitrates active diagnostics (`PHASE0`) against the service (`SERVICE`); boot-time static-safe GPIO initialization and service-owned static-mode restoration are explicit exceptions. Unsafe cleanup marks `FAULT` until reboot.
-- Lifecycle: stop/reconfiguration discards serial-service RX/TX and task-local pending bytes, but leaves broker clients, writer ownership, events, and already-fanned output intact.
+- Lifecycle: stop/reconfiguration discards serial-service RX/TX and task-local pending bytes, but leaves broker clients, writer ownership, events, and already-fanned output intact. The 16 KiB RX and 8 KiB TX payloads prefer PSRAM; their FreeRTOS controls and UART driver storage remain internal.
 
 ## Session broker
 
@@ -91,7 +91,7 @@ This is a semantic map, not a complete file inventory. Start here, then read the
 - Interfaces: init/migration/recovery, authenticate, principal-currentness, account/password/role/key mutations, snapshots
 - Called by: web and SSH authentication/currentness checks and console administration
 - Dependencies: NVS, secure random, mbedTLS cryptography; after a committed command-layer mutation, best-effort web/SSH revocation calls supplement authoritative transport currentness checks
-- Ownership: database mutex protects live records; password authentication runs PBKDF2 outside it and revalidates afterward, while mutation locking must be checked per operation.
+- Ownership: database mutex protects the internal live record and PSRAM-preferred transactional candidate; password authentication runs PBKDF2 outside the mutex and revalidates afterward, while mutation locking must be checked per operation.
 - Authorization: UART0 exclusively owns initial administrator bootstrap and unavailable-database recovery; current admins may use admin SSH for other commands unless handler policy denies them. HTTPS currently treats both roles alike.
 - Constraint: final administrator cannot be deleted or demoted; transport principals must be rechecked after mutations.