Slice 8: v1 ships — integration coverage, runbook, spec corrections

- Five new integration test files raise the suite from 75 to 96 green:
  test_hygiene_vertical (7), test_branch_path_routing (4),
  test_metadata_pr_merge (3), test_cache_bootstrap (4), test_e2e_smoke
  (3). The smoke test walks propose → super-draft → edit branch →
  body-edit PR → graduate → active-RFC PR → merge → notification →
  hygiene-sweep deletion end-to-end.
- deploy/RUNBOOK.md replaces the prior DEPLOY.md stub as a real
  runbook: prerequisites, first-time bring-up, day-2 ops (logs, DB
  backup, secret rotation, the §12 hygiene cadence), rollback shape,
  troubleshooting table.
- backend/.env.example grows the SMTP block, HYGIENE_TICK_SECONDS,
  and WEBHOOK_EMAIL_BOUNCE_SECRET with inline commentary.
- README points to RUNBOOK.md; the "what the build lets you do"
  section adds Slices 7 and 8.
- docs/DEV.md gets a Slice 8 — shipped section; the "Next slice"
  footer becomes the v1-complete epitaph.
- SPEC corrections per the §19.3 working agreement: §10.7 names the
  shared §12 sweep; §12 names the bot as actuator and the per-user
  branch_chat_seen preservation contract; §19.1 marks v1 complete
  and records Slice 8; the five §19.2 candidates Slice 8 folded in
  are marked settled with pointers at the resolution.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -5,10 +5,12 @@ materializes the Wiggleverse RFC framework specified in
 [`SPEC.md`](./SPEC.md). The framework's mission lives in
 [`PHILOSOPHY.md`](./PHILOSOPHY.md); the spec is the binding contract;
 this README is how to bring the app up against a local Gitea instance
-and exercise the slice the build session has shipped so far.
+and exercise the surface the build has shipped.
 
-The implementation is in progress. See [`docs/DEV.md`](./docs/DEV.md)
-for the slicing plan and the current state.
+The v1 build is complete. Subsequent sessions pick from §19.2 by user
+choice per §19.3's working agreement. See
+[`docs/DEV.md`](./docs/DEV.md) for the build history and the work mode
+that follows v1.
 
 ## What the app expects to talk to
 
@@ -107,6 +109,8 @@ Optional values, picked up at process start:
 | `EMAIL_ENABLED`            | `1` (default) to dispatch email; `0` to suppress all sends without disabling the inbox. |
 | `EMAIL_BUNDLE_THRESHOLD`   | Held-during-quiet-hours threshold for the "Activity while you were away" bundle (default 5, §15.4). |
 | `DIGEST_TICK_SECONDS`      | Cadence of the §15.5 digest scheduler's loop (default 3600). Tests drive ticks synchronously via `digest.run_tick`. |
+| `HYGIENE_TICK_SECONDS`     | Cadence of the §12 hygiene scheduler's loop (default 3600). Tests drive ticks via `hygiene.run_tick(now=...)`. |
+| `WEBHOOK_EMAIL_BOUNCE_SECRET` | When set, `/api/webhooks/email-bounce` requires the same value in the `X-Webhook-Secret` header. Unset leaves the webhook open for dev — the v1 contract. |
 
 ### 6. Install dependencies
 
@@ -159,9 +163,10 @@ Open `http://localhost:5173`. Sign in with your owner-zero Gitea
 account. The catalog should appear empty; the **+ Propose New RFC**
 button at the bottom opens the propose modal.
 
-## What the build lets you do so far
+## What the build lets you do
 
-Slices 1–6 are shipped. End-to-end paths the app supports today:
+Slices 1–8 are shipped — v1 is complete. End-to-end paths the app
+supports:
 
 - **Propose → idea PR → merge → super-draft** (Slice 1, §9.1–§9.3).
 - **Super-draft body editing** via meta-repo edit branches, with AI
@@ -198,18 +203,33 @@ Slices 1–6 are shipped. End-to-end paths the app supports today:
   quiet hours hold email and digest while letting the inbox row
   still land, and the per-user mute suppresses inbox rows
   produced by a specific actor (Slice 6).
+- **§14 chrome and the settings / admin neighbourhoods** — the
+  landing page with the three-item deck, the `/philosophy` route
+  reading `PHILOSOPHY.md` from disk, the persistent About header
+  link, `/settings/notifications` exposing the five §15-derived
+  sub-sections, and `/admin` as the four-tab home base for role
+  management, write-mute, audit-log, graduation-queue, and the §6.5
+  permission-events read (Slice 7).
+- **§12 branch hygiene + §10.7 post-merge deletion** — the
+  30/90-day timers ride on a scheduler next to the digest, the bot
+  is the only Git writer per §1, and the audit-log rows surface as
+  "the app" actor per §15.9. The §19.2 candidates the hardening
+  pass folded in: cache bootstrap against a meta repo the bot did
+  not author, branch-name path routing via `{branch:path}`, in-app
+  merge for `meta_metadata` PRs, the graduation-rollback branch
+  cleanup, and the email-bounce webhook signing seam (Slice 8).
 
 This exercises the §4 cache (webhook + reconciler), the §6
 permission model in full, the §1 bot wrapper (every Git write goes
 through it, every commit and PR carries the `On-behalf-of:`
-trailer), and the §17 routing-collapse rule that lets active and
-super-draft surfaces share their endpoints.
+trailer), the §17 routing-collapse rule that lets active and
+super-draft surfaces share their endpoints, and three scheduled
+jobs in the same shape (reconciler, digest, hygiene).
 
-Out of scope for the slices shipped so far: landing-page and
-`/philosophy` chrome polish, the notification-settings UI surface,
-and the admin neighbourhood (Slice 7, §14 + §19.2 candidates); the
-§12 30/90 branch-hygiene timers (Slice 8). The full slicing plan
-and the next slice's brief live in [`docs/DEV.md`](./docs/DEV.md).
+Out of scope for v1: every item under §16 ("What is deliberately
+deferred"), and the §19.2 candidates the hardening pass left
+queued. Subsequent sessions pick from §19.2 by user choice per
+§19.3's working agreement.
 
 ## Verifying it worked
 
@@ -263,5 +283,6 @@ has something real to render.
   The spec's decisions answer to it.
 - [`docs/DEV.md`](./docs/DEV.md) — the build's slicing plan, the
   current state, and the next slice's brief.
-- [`deploy/DEPLOY.md`](./deploy/DEPLOY.md) — single-host production
-  deployment behind nginx + Let's Encrypt.
+- [`deploy/RUNBOOK.md`](./deploy/RUNBOOK.md) — single-host production
+  bring-up, day-2 operations (logs, database backup, secret rotation,
+  the §12 hygiene cadence), and rollback shape.