live gate: default-on queue-gated task/add (<95), fail-closed, cap 3/cycle, banned+dedupe, kill switch (54 tests)

reports/live-gate-summary.md

@@ -0,0 +1,27 @@
+# Queue-gated live submit
+
+Victor-approved live defaults on. ALLOW_LIVE_SUBMIT=0 stops submission;
+STRATEGY_ID remains mandatory. LIVE_CONFIRM is accepted but optional.
+
+Each add requires a fresh authenticated onlyMine task/page snapshot, complete
+through data.total (maximum 20 pages). All nonterminal records count;
+queue >= LIVE_QUEUE_THRESHOLD (default 95) stops the cycle. Authentication,
+transport, HTTP, platform, JSON and pagination errors fail closed. Environment
+queue hints can only add blockers.
+
+Cycles prioritize Section A verified_reuse, other A, then B; reject banned
+families, unmapped GPUs and placeholders; use build-config with recorded sample
+fallback; reserve model identity in memory and LIVE_STATE_FILE before calling
+TaskAddClient. Remote task identities also block duplicates. Default cap is 3
+attempts per cycle. Failed calls retain their reservations to prevent retries.
+The state file defaults to /tmp/live-submitted.json; preserve or mount it for
+restart durability beyond ephemeral container storage.
+
+Server runs a daemon worker every 600 seconds (minimum 60), using the shutdown
+Event for interruptible waits. Missing credentials hold instead of crashing.
+Docker FROM is unchanged; templates are copied for runtime fallback.
+
+Validation: make test passes 54 tests, including mocked platform calls and local
+SIGTERM integration. Sandbox initially denied local sockets; the suite passed
+with local socket permission. No real ModelHub calls, token writes, commits,
+tags or pushes were performed.