docs: the user split as it is, and the GPL statement only where it is true

Both merged branches left statements that no longer matched the product:

- README.md: the architecture diagram names dotagentd as the computer
  daemon's user. The list of what is not protected now says what is still
  true after the split: it rests on the guest operating system (a kernel
  flaw or an unknown way to root ends it), the daemon holds CAP_SETUID,
  CAP_SETGID and CAP_KILL and one root command (its one door, the token
  port, is closed to dot), and nothing limits the disk, memory or
  processor time of the model's commands inside their VM. The statement
  that dot could replace the computer daemon on its port was already
  removed by the split and stays removed.
- docs/architecture.md 4.1: after the merge the section describes three
  users; its closing paragraph "What stays" is now the list above with the
  reasons and the section that covers each. The older statements that dot
  can read the Dot token and stop dot-agentd are gone with the old unit
  text (the security split wins).
- "Nothing under the GPL is installed by default" was written for the npm
  install and read as a statement about the product. It is now stated for
  the default npm install (README license section, architecture 9.8 and
  11.3, THIRD_PARTY_NOTICES.md, the tests.yml comment and two test
  headers), and architecture 11.3 and the README say the VM image carries
  the Ubuntu guest operating system and the apt packages of the golden
  image, mostly GPL and LGPL software under its own licenses, downloaded on
  the machine that builds the image and not published here.

Comment and prose changes only; no test removed, no floor changed.

.github/workflows/tests.yml

@@ -100,8 +100,8 @@ jobs:
         if: always()
         run: node .github/scripts/test-guard.mjs vitest-report.json --suite postgres
 
-  # The WhatsApp client (Baileys) is an opt-in install: it depends on libsignal, which is GPL-3.0, and nothing GPL is
-  # installed by default. The jobs above never install it. This one does, with the command a person runs
+  # The WhatsApp client (Baileys) is an opt-in install: it depends on libsignal, which is GPL-3.0, and the default
+  # npm install holds nothing GPL. The jobs above never install it. This one does, with the command a person runs
   # (npm run whatsapp:install), to prove the adapter against the real library: the types (the real module has the
   # shape the adapter writes down) and the tests that need it, on PGlite and on PostgreSQL.
   whatsapp-client:

README.md

@@ -421,6 +421,18 @@ What it does not protect against, by design or not yet:
 - The model's commands run as `dot`, which can read an identity's proxy,
   password included, from the open browser's environment and from the browser
   server's own session file.
+- The split between the three users is the guest operating system's. A flaw in
+  the guest's kernel, or a way to become root that this repository does not
+  know of, would end it. The VM is what stands between the Dot and your PC
+  then, with the reach into your PC's loopback listed below.
+- The computer daemon holds three capabilities (`CAP_SETUID`, `CAP_SETGID` and
+  `CAP_KILL`, to run the model's work as `dot`) and may run one command as
+  root, the power-off. A flaw in the daemon would be worth more than one in an
+  ordinary program. Its one door, a TCP port inside the guest, needs the Dot's
+  token, which `dot` cannot read.
+- Nothing limits how much disk, memory or processor time the model's commands
+  use of their own VM, so a runaway command can starve the Dot's own daemons
+  until the VM is stopped or restarted.
 - When typing in the browser is set to `ask`, the approval shows the text being
   typed, password or not.
 - Each Dot can reach services on your PC's loopback through `10.0.2.2`.
@@ -543,7 +555,7 @@ flowchart LR
     DB[("PostgreSQL<br/>embedded PGlite by default")]
   end
   subgraph VM["One QEMU VM per Dot"]
-    AGD["dot-agentd<br/>the computer daemon, user dot"]
+    AGD["dot-agentd<br/>the computer daemon, user dotagentd"]
     ENG["Engine, a nanobot fork<br/>user dotengine, key in memory"]
     DESK["Xvfb and XFCE desktop"]
     BR["invisible-playwright-mcp<br/>one per open identity"]
@@ -802,8 +814,12 @@ listed in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)), and invisible_dots
 does not redistribute it. Whoever copies a golden image to another machine takes
 on those licenses
 ([architecture: licensing](docs/architecture.md#113-licensing)). Nothing under
-the GPL is installed by default; the WhatsApp client, which brings a GPL-3.0
-dependency, is an opt-in install.
+the GPL is installed by the default `npm install`; the WhatsApp client, which
+brings a GPL-3.0 dependency, is an opt-in install. The Dot's computer is
+another matter: the VM image holds the Ubuntu guest operating system and the
+packages the golden image installs on it (the Linux kernel, Xvfb, XFCE and the
+rest), which are mostly GPL and LGPL software under their own licenses and are
+downloaded from their publishers on your machine, as described above.
 
 invisible_dots is an independent project, not affiliated with OpenRouter,
 Telegram, WhatsApp or Meta.

THIRD_PARTY_NOTICES.md

@@ -12,7 +12,10 @@ TypeScript engine, and the web client's files that derive from other projects
 has a section below) come with the notices below. The golden image that
 `invisible-dots image build` makes on a host also holds data that is not part
 of this repository, the GeoIP database: its credits are in the section "GeoIP
-data in the golden image". Nothing under the GPL is installed by default; the
+data in the golden image". The default `npm install` holds nothing under the GPL
+(the golden image's guest operating system is Ubuntu, which carries GPL software
+under its own licenses, downloaded from Ubuntu's archive by whoever builds the
+image: docs/architecture.md section 11.3); the
 one GPL-3.0 dependency, `libsignal` of the optional WhatsApp client, is left out
 of the default install and is described in the section "The opt-in WhatsApp
 client and `libsignal` (GPL-3.0)".
@@ -545,7 +548,7 @@ SOFTWARE.
 
 ## The opt-in WhatsApp client and `libsignal` (GPL-3.0)
 
-Nothing under the GPL is installed by default. The WhatsApp adapter
+The default `npm install` holds nothing under the GPL. The WhatsApp adapter
 (`packages/channels/src/whatsapp-baileys/`) uses Baileys (MIT), a client of the
 WhatsApp Web protocol, which depends on the npm package `libsignal`, under the
 GNU General Public License, version 3, and so does not fit this repository's MIT

docs/architecture.md

@@ -522,9 +522,25 @@ tries both as the model does. The model can connect to TCP port 1024 inside its
 computer too, and gets `401` without the token. A process of `dot` could listen
 on port 1024 only while dot-agentd is not running, and the host does not send
 the token or the key to a listener that cannot answer the proof of section 5.1.
-What stays: the daemon's three capabilities make a flaw in dot-agentd worth
-more than a flaw in an ordinary program; it is a small program and its one door,
-the TCP port, needs the token.
+What this does not protect, stated as it is:
+
+- The split is the guest operating system's. A flaw in the guest's kernel, or a
+  way to become root that is not known here, would let a process of `dot` read
+  what the other two users hold. The VM is the outer wall then, and what it lets
+  the guest reach is section 3.6's.
+- The daemon's three capabilities make a flaw in dot-agentd worth more than a
+  flaw in an ordinary program: `CAP_SETUID` lets it become any user, root
+  included, and it is the one user with a sudo rule (the power-off). It is a
+  small program and its one door, the TCP port, needs the token, which `dot`
+  cannot read; the model can reach the port and gets `401`.
+- `dot` owns the desktop, the browser and `/home/dot`, and reads the proxy of an
+  identity whose browser is open (section 6). That is the model's computer, not
+  a leak out of it.
+- Nothing limits how much disk, memory or processor time `dot`'s processes use
+  of the VM's (no cgroup limit, no quota), so a runaway command can starve the
+  daemons of the same VM until the host stops or restarts it. The control plane
+  records a VM that stops without being asked as STOPPED and starts it again
+  when the Dot has work (section 9.5).
 
 There is no long-running browser service. The engine's `BrowserManager`
 starts one `invisible-playwright-mcp` process per launched browser identity
@@ -2510,7 +2526,7 @@ Cloud API (a business account and a public webhook) is a later adapter on the sa
 hub.
 
 - **Licenses and the opt-in install.** Baileys is MIT, but it depends on
-  `libsignal`, which is GPL-3.0, and nothing GPL is installed by default. No
+  `libsignal`, which is GPL-3.0, and the default `npm install` holds nothing GPL. No
   workspace declares Baileys (not as a regular, dev, optional or peer dependency),
   so the root `package-lock.json` holds none of it and `npm ci` installs no GPL
   package (`tests/repo/default-install-licenses.test.ts` scans the lock file's
@@ -2785,6 +2801,13 @@ lines are `guest/image-builder/src/geoip-notices.ts`, which each golden manifest
 records as `notices` together with `notices_statement`, and
 `THIRD_PARTY_NOTICES.md` repeats; a test keeps the three equal.
 
-Nothing under the GPL is installed by default (section 9.8, WhatsApp). The few LGPL packages
-of the lock file are the prebuilt image libraries (`@img/sharp-*`) that Next.js may
-install; the notices name them.
+The default `npm install` holds nothing under the GPL (section 9.8, WhatsApp); that is a
+statement about the npm lock file and no more. The few LGPL packages of the lock file
+are the prebuilt image libraries (`@img/sharp-*`) that Next.js may install; the notices
+name them. The VM image is a different thing: it carries the Ubuntu guest operating
+system and the apt packages the golden image installs on it (`apt_packages` of
+`guest/image-builder/pins.json`: Xvfb, XFCE and their libraries, over the Linux kernel,
+bash and the rest of Ubuntu's base), most of it GPL or LGPL software under its own
+licenses and source offers, downloaded from Ubuntu's archive on the machine that builds
+the image and published by no one here. Whoever copies a golden image to another
+machine takes those licenses with it (the paragraph above).

tests/repo/default-install-licenses.test.ts

@@ -1,5 +1,5 @@
 /**
- * Nothing under the GPL is installed by default. `npm ci` installs what package-lock.json says, so the lock is
+ * The default npm install holds nothing under the GPL. `npm ci` installs what package-lock.json says, so the lock is
  * scanned: no package of it may need a GPL or AGPL license (the WhatsApp client's dependency libsignal is GPL-3.0 and
  * lives in its own opt-in folder, optional/whatsapp), and a package whose license the lock does not state is not
  * allowed to hide one. LGPL is not GPL; the few LGPL packages that remain (the image library Next.js may install, as

tests/repo/whatsapp-optin.test.ts

@@ -1,6 +1,6 @@
 /**
  * WhatsApp is an opt-in adapter over an unofficial client, and the client is an opt-in install: Baileys depends on
- * libsignal, which is GPL-3.0, and nothing GPL is installed by default. These checks keep what makes that true: the
+ * libsignal, which is GPL-3.0, and the default npm install holds nothing GPL. These checks keep what makes that true: the
  * client is declared by no workspace and is in no default lock; it lives in its own folder with its own lock file, at
  * one exact version, every package with its integrity hash; one documented command installs it; and the one glue
  * file that loads it does so by path, when a connection opens, so neither the bundle nor a server that never links