55d48d69 -- the optional, UNTRUSTED server section of the SessionStart brief.

.claude/hooks/meridian_guard_brief.* (via meridian.session_brief) asks for this on a loopback URL with a 1.5 s budget and labels it as untrusted board data. It is built from a FIXED set of fields -- project name, north star, sprint headline, pending / in-progress / pending-HITL counts and the top pending item titles -- never from execution_policy, pending_goal, agent instructions, note bodies or document content, and every line that looks like an execution directive is dropped (session_brief.build_server_section). When session_id belongs to this project, the response may add a single item locked by that persisted Meridian session, along with its declared resources, pointers and matching task logs. The host's Claude session id is never accepted here. max_chars is clamped to [100, 4000] rather than rejected so the hook never gets a 422.

Each fact is gathered independently: a failing sub-query just omits that line instead of turning the whole brief into a 500.