Built-in agent checks kept the config stored at first registration, so check.pending never received decision.list / subscription.list added in AG-3 and the patrol could not read pending items (REAL-2 scenario g). Track config_customized (migration 0045); sync replaces config with the code default unless the user PATCHed it. Needs image rebuild. Co-Authored-By: Claude Opus 5.5 <[email protected]>