docs(ws2): rewrite WS2 as time grounding, add sliced execution plan

[roiguri]

Re-measured WS2 against production and re-read the reference implementation instead of recalling it. Splits the result into a reasoning doc (the roadmap) and an execution doc (four verifiable slices).

What changed in the reasoning

The premise no longer holds. WS2 rested on "64% of heartbeat turns cross a minute boundary mid-turn". Re-measured over 7 days of prod: median heartbeat turn is 12.6s, mean 13.7s, zero turns ≥60s. Crossings are ~23%. That caps the clock's cache cost at ~5% of input ≈ $1/mo.

So WS2's justification moves to correctness. build_system_prompt runs inside _llm_node, so the clock is rebuilt on every LLM call — within one turn, call 1 reads 06:14 and call 4 reads 06:15. The model's "now" moves mid-reasoning, on turns that may be computing a reminder's fire_at. Nothing logs or tests it.

The cost case belongs to a different item. _add_and_trim is the reducer on messages, so it fires on every state update, not once per turn. Both threads sit at MAX_MESSAGES and a tick adds ~11.5 messages, so the window head slides several times inside a turn — the only window where caching can pay. Trim hysteresis is worth ~$6.65/mo of a $22.87/mo bill; the clock is ~$1/mo.

The reference implementation has moved on. OpenClaw at HEAD aa743c9f no longer matches the "timezone only, no clock" position this doc recorded (that was a Jul 13 snapshot). It now carries a day-resolution date plus a session_status pointer, stamps each message at the LLM boundary from that message's own timestamp, and appends Current time:/Reference UTC: to cron bodies from the tick's start time.

New: timezone & day-edge verification (§2.4)

Tested rather than reasoned, against the live gate:

• Midnight always exists at both 2026 Israel transitions (they happen at 02:00), so every day-boundary computation — _today_israel_start_utc, daily-log filenames, the chat/notification slice filters — is safe.
• Windows shift by exactly one UTC tick across DST, measured for all four windowed tasks.
• A 24h task locked on the last in-window tick loses exactly one occurrence at spring-forward, then self-heals. Simulated over every possible lock position through both transitions using the real any_due/stamp path.
• morning-readiness-check is on the safe side of both transitions — stamped at 06:00Z, in-window in both offsets. Its heartbeat-assert §2b ticks left: 0 flag is a dropped-tick fragility, not an imminent DST loss. Left as-is by owner decision.
• %Z is unsafe for stamps — Python yields IST for Israel winter, colliding with India Standard Time.

Execution plan

WS2_TIME_GROUNDING_PLAN.md — four independently revertable commits:

	Slice	Nature
S1	Per-turn stamp in ask_jarvis	additive — clock stays, verifies in isolation
S2	Envelope Current time → Current date	removal
S3	llm_calls.jsonl per-call telemetry	read-only, independent
S4	Trim hysteresis	gated on S3's reading

S3 exists because per-turn telemetry can't attribute a miss to a call, and two outcomes need different responses — if the head hash is stable and cache_read is still flat, that's Gemini's cache and S4 should not be built at all.

Also

Records that this reverts a deliberate decision: ARCHITECTURE_PLAN.md dropped main.py's time_ctx prepending as problem #4 ("jammed into the user message"), on structural-tidiness grounds — no correctness or caching consideration at the time.

Docs only; no code changes.

https://claude.ai/code/session_01TcKHUrthfLzuzdFDBm5N1s