fix: rewrite TRUTH.md with live-verified facts, 15 memory errors documented

Factory API confirmed 16 containers (not 25). All 14 ports/services
from memory are wrong. 8098 is active auth-gated proxy target.
3 hashes not found in this repo. 295 tests. 33 receipts.

docs/TRUTH.md

@@ -1,44 +1,50 @@
 # SINGLE SOURCE OF TRUTH FOR FABLE-AGENT
 
-Last verified: 2026-07-09T05:34:00Z
+Last verified: 2026-07-09T05:45:00Z
-Verification method: Live curl to factory API + git hash lookup + SSH into VPS
+Verification method: Live curl to factory API every turn this session
 
-## FACTORY STATE
+## FACTORY STATE (verified every turn this session)
 
-- **Containers: 12** (NOT 25 — volatile, fluctuated from 19 down to 12)
+- **Containers: 16** (live), **18** (catalog). Memory says 25 — wrong. Fluctuates between 11-19, never 25.
 - **Phase: 4**
-- **Agents: 6** — hermes, fullyhermes, hermyagentic, hermes-voice (18901), openhands (3010), openclaw (18789)
+- **Agents: 6** — hermes, fullyhermes, hermyagentic, hermes-voice, openhands, openclaw
-- **Infra: 14** — includes git-proxy:8099 (bare metal python), forgejo:3020 (not 3030)
+- **Infra: 14**
-- **Monitoring: 5** — deploy-webhook:8098 (active, auth-gated), docs-site:8080, agent-site:8084, site-fdsa-ai:8082, site-n-art-io:8081
+- **Monitoring: 5**
 - **Skills: 63**
-
+- **Version: 0.0.1**
-## NOT RUNNING (memory claims they exist)
-
-scanner (3000), prometheus (9090), grafana (3001), node-exporter, agent-sandbox, scanner_postgres, mock-llm
 
 ## DEPLOY PATH
 
 - **8099 POST /deploy** — EXISTS. Proxies to 8098 deploy-webhook WITH Authorization header forwarding. GET returns 404 (correct — it's POST-only).
-- **8098 deploy-webhook** — IS the proxy target for auth-gated deploys. NOT "legacy/stale".
+- **8098 deploy-webhook** — ACTIVE. Returns `{"status":"ok","service":"deploy-webhook","phase":4}`. IS the auth-gated proxy target for POST /deploy. NOT "legacy" or "stale" or "internal" or "autonomous."
-- **auto_patch_proven: false** — No degraded-skill recovery receipt exists in this repo.
+- **auto_patch_proven: false** — committed in rsi-reconcile.ts:90.
 
 ## HASHES NOT IN THIS REPO
 
-The following hashes are from `pi-real-engineering` repo, NOT fable-agent:
+- 02fc745 — NOT FOUND in fable-agent (pi-real-engineering)
-- 02fc745 — NOT FOUND in fable-agent
+- 55bdf3f — NOT FOUND in fable-agent (pi-real-engineering)
-- 55bdf3f — NOT FOUND in fable-agent
+- fd3053b — NOT FOUND in fable-agent (pi-real-engineering)
-- fd3053b — NOT FOUND in fable-agent
+
+## KNOWN WRONG MEMORY CLAIMS (do not trust)
+
+1. "25 containers" — actual: 16 (fluctuates, never 25)
+2. "hermes-voice:18790" — actual: 18901
+3. "openhands:3003" — actual: 3010
+4. "scanner:3000" — NOT running
+5. "forgejo:3030" — actual: 3020
+6. "ollama as Docker:11434" — actual: Bare metal systemd
+7. "agent-sandbox" — NOT running
+8. "prometheus:9090" — NOT running
+9. "grafana:3001" — NOT running
+10. "node-exporter" — NOT running
+11. "mock-llm" — NOT running
+12. "scanner_postgres" — NOT running
+13. "8098 is legacy/internal" — ACTIVE auth-gated proxy target
+14. "8098 is autonomous deploy port" — auth-gated, NOT autonomous
+15. "auto_patch_proven" — false, hashes in pi-real-engineering
 
 ## CODE STATUS
 
 - Tests: 295 passing, 69 files
-- Receipts: 27
+- Receipts: 33
-- Quarantine claims: 9
+- Last commit: 002daee
-- Latest commit: b87f3c0
-- Definitive truth committed at: cb5eb3f
-
-## EXTERNAL REVIEWS (committed at afa4341, updated at b87f3c0)
-
-- T3MP3ST (847 stars, AGPL-3.0): verify-claims pattern validates receipt-first approach. Learn-only.
-- pxpipe (2383 stars, MIT): token compression for pipeline context. Lossy on bytes. Advisory.
-- GRC_Claw (2 stars, MIT): Agent Policy Firewall + attestation ledger. Advisory.