Room roster reads survive a supervised restart. A /room/* click landing in the grain-restart window (or on a starved runner) could answer 502 even though the same read succeeds milliseconds later — the cause of the intermittent TestRoomAcquireCrashRecoverOverHTTP CI failure. The read is now retried inside a bounded budget, and the grain error is logged instead of swallowed, so a future 502 names its route and cause.
Security
Go 1.27.1 → 1.27.2 and x/net v0.59.0 → v0.60.0, closing the GO-2026-6603–6617 stdlib family (net/http, http2, net/textproto, crypto/tls, os, html/template) that blocking pre-push govulncheck reported. Docker base image, both CI toolchain installs, the gogogo-mcp module and the coding-standards skill pin move with it; govulncheck is clean again.