Audit fixes: triggers and scheduler, small utilities, JWT and data checks; add AC_idempotency_release

CLAUDE.md

@@ -95,7 +95,7 @@ The map is only useful while it matches the tree, so **update it in the same cha
 
 ### README stays current and in sync across all three languages
 
-`README.md` (English, the source), `README/README_zh-CN.md`, and `README/README_zh-TW.md` MUST stay current with the code. Any user-facing change (a feature or API surface, an `AC_*` command, a CLI flag, a GUI tab, install / setup, configuration, an env var, a requirement, or a quoted count) updates `README.md` **and both translations in the same commit**, structure and content aligned. Never update one language and leave the others stale. `test/unit_test/headless/test_doc_counts.py` guards the quoted figures across all three (see above), but everything else — new sections, changed commands, reworded setup — is on you: read the diff against all three before committing.
+`README.md` (English, the source), `README/README_zh-CN.md`, and `README/README_zh-TW.md` MUST stay current with the code. Any user-facing change (a feature or API surface, an `AC_*` command, a CLI flag, a GUI tab, install / setup, configuration, an env var, a requirement, or a quoted count) updates `README.md`, **both translations, and the user-facing docs under `docs/` (the Sphinx tree in `docs/source/` and reference docs such as `docs/API_LIFECYCLE.md` and `docs/CAPABILITY_MATRIX.md`), all in the same commit**, structure and content aligned. Each translation must reflect the English README's actual content, not merely share its headings. Never update one language, or `README.md` alone, and leave the other language or the docs stale. `test/unit_test/headless/test_doc_counts.py` guards the quoted figures across all three READMEs (see above), but everything else — new sections, changed commands, reworded setup, the docs — is on you: read the diff against all of them before committing.
 
 ### Outstanding work goes in `Progress.md`
 
@@ -109,7 +109,7 @@ Anything agreed but not done — deferred follow-ups, known gaps, half-delivered
 
 ### Project-specific rules
 
-- **Exception hierarchy is flat by design** — every framework error derives from `AutoControlException` so containment boundaries (executor, background poll loops, request handlers, GUI slots) can catch the family in one `except`. Never add a sibling inheriting `Exception` directly; it silently escapes every boundary. Assertion failures (`AutoControlAssertionException`) must keep propagating through `raise_on_error=False`.
+- **Exception hierarchy is flat by design** — every framework error derives from `AutoControlException` so containment boundaries (executor, background poll loops, request handlers, GUI slots) can catch the family in one `except`. Never add a sibling inheriting `Exception` directly, or only a builtin such as `RuntimeError` / `ValueError`; it silently escapes every boundary. To keep a builtin for existing callers, list both: `class XError(AutoControlException, RuntimeError)`. Assertion failures (`AutoControlAssertionException`) must keep propagating through `raise_on_error=False`.
 - **Fail fast** — raise the specific typed exception at the point of failure; do not swallow errors.
 - **Validate at boundaries** — user input, file content, network data, and JSON action commands. Reject unknown command names; `realpath` and bound user-supplied paths.
 - **Least privilege** — servers bind `127.0.0.1` by default; `0.0.0.0` needs an explicit, documented opt-in.
@@ -172,6 +172,8 @@ Workspace rule shared by every repository under `D:\Codes` (full text: `D:\Codes
 - **Commit at every stage.** A stage is the smallest piece of work that leaves the repository consistent and passes this project's checks (definition of done, tests, lint): one finished `Progress.md` item, or one self-contained step of a larger one. Commit it before starting the next stage, before switching to another repository, and before the session ends. Do not leave work uncommitted across sessions; if a stage cannot be finished, commit the consistent part and record the rest in `Progress.md`.
   - Stage only the files that stage touched (`git add <path>`, never `git add -A`), follow this file's commit-message rules, and never add AI attribution.
   - Committing is not pushing: push or open a PR only as this project's branch flow says or when asked.
+  - **Commit and push frequently.** After each big feature — a self-contained stage that passes this project's checks — commit and push to the remote; do not pile up a large batch of work before committing or pushing. Smaller batches collide less with other sessions, let CI catch problems earlier, and are easier to revert. Follow this project's normal branch flow (usually `dev`).
+  - **SonarCloud / Codacy findings.** When a PR or commit fails a SonarCloud or Codacy check, look the findings up through their APIs instead of guessing. The keys are in environment variables: `SonarCloudToken` (SonarCloud, e.g. `curl -s -u "$SonarCloudToken:" "https://sonarcloud.io/api/issues/search?componentKeys=<key>&pullRequest=<n>&resolved=false"`) and `CODACY_PROJECT_TOKEN` (a Codacy project token, valid only for its own project: any other repository answers "Bad credentials", so for a public repository query `https://app.codacy.com/api/v3/analysis/organizations/gh/<org>/repositories/<repo>/pull-requests/<n>/issues?status=new` without a key). **Never reveal a key or any personal credential while doing so**: refer to the variables by name only, never echo or print their values, and never put them in files, commit messages, PR or issue text, logs, or any output that leaves the machine.
 - **`Progress.md`** (repository root, tracked) holds outstanding work only: no finished items, no history, no rules.
 - **`docs/updates/`** records finished work: one batch file per month (`YYYY-MM.md`), one entry per piece of work headed `## U-YYYYMMDD-NN · date · title · #tags`, and an index with query commands in `docs/updates/README.md`. When a `Progress.md` item is done, delete it and add a `#done` entry plus its index row in the same commit.
 - **`architecture.md`** (repository root) is the short architecture overview: layers, entry points, main flows, extension points, cross-project boundaries. Update it in the same commit whenever a change alters any of those. `architecture_explore.md` stays the detailed per-module map under its own rule in this file.