docs(waterland-studio): claude-bot read grant wired, and an upstream store-growth finding

Operator granted claude-bot read on vh/waterland; verified scoped correctly
(admin false, push false, pull true). Token is on irv-ml1 at
/root/.config/waterland-studio/git-credentials, 0600 root-owned, wired as a
REPO-SCOPED credential helper rather than a global one, and .git/config holds
no token so the remote stays clean in any diff or backup. The vh site-admin
token was used only for the initial clone and the grant itself and was never
written to disk on that host.

update.sh now runs end to end: fetch, rebuild, recreate, health. Verified the
kernel-cache volume survives a recreate (warm 256^2+anim render 6.6s straight
after) and the job store survives with all 16 directories intact.

Records an upstream finding surfaced by that check: JobStore._jobs is
memory-only and nothing scans the data dir at startup, so after a restart the
API lists only new jobs while old ones persist on disk — cosmetic — but the
RETAIN=40 eviction only sees in-memory jobs, so restart-orphaned directories
are never reclaimed. The handover's ~500 MB bound holds per process lifetime,
not across restarts. Reported to waterland-dev; upstream's call to fix.

stacks/waterland-studio/README.md

@@ -100,16 +100,48 @@ service merely looks slow.
 - Internal render timeout is 480 s, which is why the healthcheck interval is
   loose — an aggressive probe would measure queue depth rather than liveness.
 
-## ⚠️ `update.sh` needs a credential this host does not have
+## Source credential — `claude-bot`, read-only
 
-The repo is not anonymously readable — an unauthenticated clone 403s. The
-initial checkout was made with the operator's `vh` site-admin token passed
-inline and **not persisted**: the on-disk remote is the plain URL and
-`.git/config` holds no token (verified). Consequently `git fetch` in
-`update.sh` will fail until the host has a credential of its own.
+The repo is not anonymously readable (an unauthenticated clone 403s), so the
+host needs a credential to fetch. Operator granted **`claude-bot` read on
+`vh/waterland`** on 2026-08-19; verified scoped correctly:
 
-`claude-bot` 404s on `vh/waterland`, so it currently lacks read access. The
-right fix is a read-only deploy token for this host, or granting `claude-bot`
-read on the repo — **not** writing the site-admin token to disk on a GPU box.
-Raised with waterland-dev; until then, re-run the authenticated clone by hand
-to update.
+```
+admin: False | push: False | pull: True
+```
+
+The token lives on irv-ml1 at `/root/.config/waterland-studio/git-credentials`,
+mode `0600`, root-owned, and is wired as a **repo-scoped** credential helper —
+not a global one:
+
+```bash
+git -C /opt/waterland-studio/src config credential.helper \
+    'store --file=/root/.config/waterland-studio/git-credentials'
+```
+
+`.git/config` itself holds no token (verified), so the remote URL stays clean
+in any diff, log or backup of the checkout.
+
+The operator's `vh` site-admin token was used **only** for the initial clone
+and the grant itself, passed inline and never written to disk on this host.
+Do not reintroduce it: a site-admin credential on a GPU box is a blast radius
+nobody needs for a read-only fetch.
+
+## ⚠️ Upstream finding: the on-disk job store grows without bound
+
+The job index is **memory-only** — `JobStore._jobs` is a plain dict, and
+nothing scans `WATERLAND_STUDIO_DATA` at startup. Two consequences:
+
+1. After any restart the UI and `/api/jobs` list only jobs created *since*
+   that restart, even though every earlier job's files are still on the volume.
+   This is cosmetic and not data loss — verified at cutover: the API reported
+   1 job while the volume held all 16 directories (60.6 MB).
+2. More importantly, the `RETAIN = 40` self-eviction only ever sees in-memory
+   jobs, so directories orphaned by a restart are **never** reclaimed. The
+   handover's "bounded around 500 MB" holds within a single process lifetime;
+   across restarts the store grows monotonically at ~12 MB per animated job.
+
+Growth is slow, so this is not urgent, but it is unbounded and the volume will
+need occasional pruning until upstream rehydrates the index (or sweeps orphans)
+at startup. Reported to waterland-dev — it is their call, not a thing to patch
+from the infrastructure side.