Two additions, both opt-in and inert until you set their env var, plus the honesty repairs found by reading the code and the output rather than the tests. The tool estate grows 900 to 904. A default install's served surface does not change: the four new tools are opt-in, and autoscope prunes them when their env var is unset.

Local knowledge, so the model stops guessing

Two seams that let the server answer from something it already holds instead of a fresh round trip.

• Tier-1 estate memory (PROXIMO_MEMORY=1). proximo_recall returns an age-stamped local map of the estate; proximo_baseline returns per-guest cpu/mem distribution rollups derived from rrddata, stored-first. Both are derived, local, and never a health verdict.
• The wiki seam reader (PROXIMO_WIKI=1). proximo_wiki does BM25 search and proximo_wiki_read reads one section, over a local docs index. No documentation content ships: you build the index, and the contract is published in docs/SETUP.md so any builder that writes the pinned schema qualifies. Retrieved text is classified ADVERSARIAL, because a solved forum thread can carry "now run pve_delete_guest" as easily as a fix.
• Said plainly, because it is the honest limit: an unfed memory map used to answer total: 0 beside a note explaining that zero was not a claim about the estate. A 4B local model answered "0" anyway, three runs of three at temperature 0, without ever calling the tool the note named. Removing the number left a hole and the model filled the hole with zero. So these tools now refuse rather than return anything answer-shaped. The 4B still sometimes emits "0". We stopped supplying the lie. We cannot stop a downstream model inventing one, and this is not a fix for that.

Write authority you can toggle, and that cannot outlive its session

• proximo arm / proximo disarm swap the token the server reads: read-only by default, a pre-minted write token while armed. It performs the swap and discloses whether the arm is a REAL boundary or merely ADVISORY, because whether an arm restrains anyone is a file-ownership question, not a code one. It grants no capability the caller lacked — what is new is the disclosure.
• proximo reap restores read-only for sessions that ended while armed. The kernel is the liveness oracle: a serving process holds a shared flock for its whole life, and reap tries an exclusive non-blocking lock, which can only succeed once every holder is gone. That survives SIGKILL where a heuristic would not.
• New env: PROXIMO_ARM_SOURCE, PROXIMO_READONLY_SOURCE, PROXIMO_SESSION_DIR, PROXIMO_SESSION_KEY, PROXIMO_REAP_GRACE.

Fixed

Autoscope could serve a near-empty server. Two autoscope implementations, only one of which learned that memory and wiki are not data planes. With PROXIMO_MEMORY=1 and no detectable data plane the served registry narrowed from 904 tools to 5, announced on stderr only, which MCP clients do not surface. There is now one guard, shared.

Plus: disarm could report success while installing write authority; the boundary check judged permission bits and ignored ownership (permission bits do not bound the owner); a refusal claimed live write authority that did not exist; four wiki refusals named a tool that does not ship; a garbled PROXIMO_ARM_TTL contradicted its own enforcement.

From the independent pre-release review

A second lens over the whole release. The local tools demanded PVE configuration they never use — proximo_recall, proximo_wiki and proximo_wiki_read operate on local SQLite but each opened with a PVE-strict service call, so a PBS-only box was served the tools and then refused with an env error naming a subsystem the operator never configured. The seam tests mocked that call, which is exactly why they missed it. audit_verify had the same defect — the PROVE pillar's own verification tool crashed on a box with no PVE config, though the ledger it verifies is local. Also: proximo_baseline's stored path demanded configuration it promised not to need, arm --json dropped dir_owner_uid, and doctor's scoping text kept a stale guard.

From a hostile first-contact pass

Six adopter personas ran the product cold on the smallest footprints — zero config, PBS-only, a small model's doorway — and tried to make it embarrass us.

• proximo doctor --product {pve,pbs,pmg,pdm}. The doctor was hardcoded to PVE, so the setup guide's own "verify your boundary" step dead-ended a PBS-only operator. pmg now dispatches to its own doctor; pbs/pdm have no doctor tool yet and say exactly that, pointing at proximo mint --product <plane>.
• A connection failure names what to check. DNS failure, refused connection and timeout used to reach the caller as a raw OS errno through the first tools the README recommends, while doctor degraded gracefully on the identical fault. Both now share one seam.
• Refusals that name their remedy. The four fingerprint refusals now name that plane's env var and the expected digest shape; both allowlist denials name their variable; the memory and wiki readers no longer leak a bare sqlite error on a directory path; config reports every missing environment variable at once.
• The tool search speaks the operator's nouns. proximo_find_tools returned nothing for "delete vm" because the catalog says guest — a small model could miss the most destructive tool in the surface. And ct_exec/ct_psql lost their MUTATION marker to summary truncation, the one line that model reads.
• Counted numbers say which configuration they describe. "Serves 900" matched no real install; measured live it is 310 for a single-plane default and 896 with all four data planes and exec off, against 904 registered. Every token figure the docs print is now checked against live measurement in CI.

Upgrading

Nothing changes for a default install: both new seams are inert until PROXIMO_MEMORY=1 or PROXIMO_WIKI=1 is set, and the arm/disarm rail is opt-in configuration. Full detail in CHANGELOG.md.