From 01e8bb3dd2500b5fe3a5027636418f305fda3cd9 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:40:57 +0800 Subject: [PATCH 1/2] issues: record fresh #133 evidence and the un-pad fix's Prettier prerequisite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #133 tracks ledger conflict frequency after `merge=union` was removed. Two things learned today that the row did not yet capture. Removal did not reduce the pain. PR #1451 conflicted on `docs/outstanding-issues.md`; its session resolved the conflict by renumbering a colliding row, and `git merge-tree` showed the branch conflicting again minutes later, because four further `main` commits each touched the table. Both sides had concurrently allocated `#141` from the same marker, so a duplicate id reached a pushed tip and failed `check:outstanding-issues` there independently of the conflict — the read-modify-write allocation race this row already predicts, observed rather than theorised. The row's proposed fix ("stop padding this table") also has an unstated prerequisite: Prettier enforces padded markdown tables under `docs/`. Verified by checking byte-identical ragged content in a Prettier-ignored path (passes) and under `docs/` (fails), so the first result alone would have been a false green. Un-padding therefore needs `docs/outstanding-issues.md` added to `.prettierignore`, exactly as its sibling `docs/branch-review-ledger.md` already is at line 23. Evidence only — no behaviour change, and deliberately not the un-pad itself: that rewrites every open row and would conflict with every in-flight ledger edit, so it wants a quiet queue. Co-Authored-By: Claude Opus 5 --- docs/outstanding-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index f767c07180..be0690df0f 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -155,7 +155,7 @@ removed after current-main verification; it is not missing recommended work. | #130 | P2 | issue | PR #1396 merged shared phone-chrome behaviour without its own declared physical-device gate | **Outcome:** a shared-chrome PR does not merge with a self-declared merge prerequisite left undone, or the ledger records that it did. **Detail:** PR #1396 ("overlay the phone header so hiding it never moves content") repeatedly stated in its own body and PR comments that `docs/phone-chrome-physical-acceptance.md` "genuinely applies before merge" because local Chromium cannot certify Safari chrome-minimisation or cold-launch PWA paint (invariant 23) — restated at least three times across the review thread, including after the final `a638b66e`/`f7347144` fix. It merged at 06:49:55 anyway. Checked 2026-07-30: `docs/phone-chrome-physical-acceptance.md` on `main` is still the blank checklist template — every "Result / evidence" cell is empty, no PR comment attaches a filled-in copy or device evidence, and no existing ledger row (`#120`, `#122`) covers this gap. Related but distinct: one Codex thread on this PR also names a still-missing guard — a pre-paint/cold-load hydration test comparing content position before and after hydration, which the author explicitly said they would "rather file it than ship a test that looks like it covers the window and does not" — and that filing never happened either. **Next:** run the physical-device matrix in `docs/phone-chrome-physical-acceptance.md` against `main`'s current tip on a real iPhone (Safari tab + cold-launch PWA, light/dark, portrait/landscape) and commit the filled-in evidence; separately, add the pre-paint/cold-load Playwright pattern this PR's own review identified as missing. **Stop:** do not treat this PR's extensive Codex/CI remediation (13 findings fixed, 9 threads resolved) as a substitute for the physical-device proof — headless Chromium was explicitly stated as unable to certify the two things this checklist exists for. **Design constraints recorded 2026-07-30, so the guard is not re-derived from scratch:** the value under test is the pre-paint reserve seed `calc(max(0.5rem, var(--safe-area-top)) + var(--shell-header-h))` in `globals.css`, refined by `useLayoutEffect` in `use-phone-overlay-chrome-reserve.ts`. The window that needs covering is _before_ hydration, so the test must sample content top on the cold load and again after hydration and compare them; a single post-hydration read passes on the broken shape and is the "looks like coverage" outcome this item exists to avoid. The `max()` is the part that actually breaks: seeding the bare inset under-reserves by `max(0, 0.5rem − inset)`, which is **zero on a notched iPhone and 8px on any phone reporting no top inset** — Android, and Playwright's default emulation — so the assertion must run on a zero-inset profile or it cannot fail. Prove it against the broken shape before trusting it (re-seed with the bare inset and confirm the test goes red), per the lesson recorded on `#120`. **Environment blocker:** this cannot be verified in a remote container. The Chromium build mismatch in `#121` means browser tests never launch, and the documented symlink bridge writes under `/opt/pw-browsers`, which the session sandbox refuses — so this needs a local session, or an operator-granted exception, before any claim that the guard works. | PR #1396 (merged 2026-07-30); session 2026-07-30 PR babysit | 2026-07-30 | | #131 | P2 | issue | `@codex fix` produces commits that never reach the repository | **Outcome:** a finding routed to Codex is either fixed on the branch or visibly not fixed. **Detail:** on 2026-07-30 PR #1400, eleven `@codex fix` dispatches produced at least eleven commits — `f632ba2`, `bb27822`, `1ab2c40`, `749a183`, `08a6b7a`, `ed6be22`, `6e07327`, `9353757`, `c2e56d0` and others — every one reported as committed on a branch named `work` with "stacked pull request metadata" created. **None is fetchable:** `git cat-file -e` fails locally and `git fetch origin ` fails for each, and no PR carries them. The same single finding was rewritten four separate times under different SHAs, none landing. Its reports also show it could not execute tests (`node_modules` absent, Node 20 vs the required 24), so the claims were unverified as well as unlanded. The danger is that it reads as success: threads get authoritative-looking "Summary / Testing" replies while the branch is unchanged. **Next:** decide whether the Codex connector is expected to push to the PR branch and, if so, why it is writing to a detached `work` branch instead; until then treat `@codex fix` as advisory only and land fixes another way. **Stop:** never resolve a review thread on the strength of a Codex report — verify against the actual ref content first, per AGENTS.md. | PR #1400; session 2026-07-30 | 2026-07-30 | | #132 | P3 | issue | Both client-side push guards are inert for agent pushes | **Outcome:** the format and auto-merge guards protect every push, or their blind spot is explicit. **Detail:** `scripts/guard-push.mjs` printed `auto-merge: gh not available — auto-merge check skipped (fail-open)` for pushes from a remote agent environment, so the auto-merge race sentinel never evaluated; and `core.hooksPath` is set only by a local `npm install`, so an agent pushing from its own checkout bypasses `.githooks/pre-push` entirely. Both guards therefore protect exactly the environment least likely to break the rule, which is why the AGENTS.md format-before-push instruction is still load-bearing even though the tooling now exists. Observed directly on PR #1400: a push landed while auto-merge was armed with nothing to stop it. **Next:** provide `gh` (or a token-based equivalent) in agent environments so the sentinel can evaluate. **Do not move the format check into `pull_request_target`** — that context carries secrets and a write token, and a format check must execute PR-head code including this repo's now-loadable dynamic `prettier.config.*`, which is the classic privileged-context vector; `.github/workflows/pr-policy.yml` deliberately checks out only `github.workflow_sha` for exactly this reason. Formatting is already enforced server-side by `Static PR checks` running `format:check` on ordinary `pull_request` CI, so the guard's only unique value is failing fast before the push — nothing to duplicate. The auto-merge sentinel reads PR metadata only and could safely live in `pull_request_target` if it is ever worth moving. | PR #1400; session 2026-07-30 | 2026-07-30 | -| #133 | P3 | rec | Ledger conflicts on nearly every `main` advance (union driver removed) | **Outcome:** two agents editing different rows of this ledger do not silently corrupt it. **Driver half RESOLVED 2026-07-30:** `merge=union` is removed from `.gitattributes` and `check:outstanding-issues` now requires that **no** driver is set, so a reappearance is a red gate (proved by reintroducing it: `must have NO merge driver (found merge=union)`). This row already recorded union as worse — "two sides each bumping the marker produce two `next-id` lines, corrupting the file silently where a conflict would fail loudly" — but the attribute stayed in place and the gate _mandated_ it, so the repo's own tested conclusion was contradicted by its own config. PR #1430 confirmed the cost at scale: four merges in one session, each reporting success while duplicating the **entire** open-items table (`#059 appears 2 times (lines 101, 166)` and so on), every one needing a manual rebuild from `origin/main`. Union also makes `git merge-tree` report a clean tree, so the pre-merge conflict check cannot warn. Unlike `docs/branch-review-ledger.md`, this file allocates IDs by read-modify-write, so concurrent appends need manual renumbering whatever the driver does — union bought nothing. `AGENTS.md`, `docs/process-hardening.md`, `.claude/skills/issues/SKILL.md` and `docs/scripts-index.md` are updated to match. **Still open — the conflict frequency itself:** the table is padded to fixed column widths, so one row's edit re-pads every open row and git sees the whole table as one changed hunk; on 2026-07-30 it conflicted twice within an hour on PR #1400, and each conflict silently stopped **all** CI on that PR (`#116`). **Next:** stop padding this table (Prettier still renders it readably, and one-row edits become one-line diffs), or split the open items into per-row files. **Stop:** do not reintroduce a merge driver here; if concurrent-append pain returns, write a dedupe driver like `merge=ledger`'s rather than stock union. | `.gitattributes`; `scripts/check-outstanding-issues.mjs`; PR #1400; PR #1430 | 2026-07-30 | +| #133 | P3 | rec | Ledger conflicts on nearly every `main` advance (union driver removed) | **Outcome:** two agents editing different rows of this ledger do not silently corrupt it. **Driver half RESOLVED 2026-07-30:** `merge=union` is removed from `.gitattributes` and `check:outstanding-issues` now requires that **no** driver is set, so a reappearance is a red gate (proved by reintroducing it: `must have NO merge driver (found merge=union)`). This row already recorded union as worse — "two sides each bumping the marker produce two `next-id` lines, corrupting the file silently where a conflict would fail loudly" — but the attribute stayed in place and the gate _mandated_ it, so the repo's own tested conclusion was contradicted by its own config. PR #1430 confirmed the cost at scale: four merges in one session, each reporting success while duplicating the **entire** open-items table (`#059 appears 2 times (lines 101, 166)` and so on), every one needing a manual rebuild from `origin/main`. Union also makes `git merge-tree` report a clean tree, so the pre-merge conflict check cannot warn. Unlike `docs/branch-review-ledger.md`, this file allocates IDs by read-modify-write, so concurrent appends need manual renumbering whatever the driver does — union bought nothing. `AGENTS.md`, `docs/process-hardening.md`, `.claude/skills/issues/SKILL.md` and `docs/scripts-index.md` are updated to match. **Still open — the conflict frequency itself:** the table is padded to fixed column widths, so one row's edit re-pads every open row and git sees the whole table as one changed hunk; on 2026-07-30 it conflicted twice within an hour on PR #1400, and each conflict silently stopped **all** CI on that PR (`#116`). **Next:** stop padding this table (Prettier still renders it readably, and one-row edits become one-line diffs), or split the open items into per-row files. **Re-confirmed 2026-07-30 (PR #1451):** removal did not reduce the pain — that PR conflicted on this file, its session resolved it (renumbering a colliding row), and `git merge-tree` showed it conflicting again within minutes, because four further `main` commits (#1455, #1446, #1445, and the X3 coverage record) each touched the table. Both sides had also allocated `#141` concurrently, so a duplicate id reached a pushed tip and failed `check:outstanding-issues` there (`#141 appears 2 times`) independently of the conflict — the read-modify-write allocation race this row already predicts. **Prerequisite for the un-pad fix:** Prettier enforces padded markdown tables under `docs/`, verified by checking identical ragged content in an ignored path (passes) and under `docs/` (fails) — so un-padding also needs `docs/outstanding-issues.md` added to `.prettierignore`, precisely as its sibling `docs/branch-review-ledger.md` already is at `.prettierignore:23`. Do that in one commit while the ledger queue is quiet: the un-pad rewrites every open row and will conflict with any in-flight ledger edit. **Stop:** do not reintroduce a merge driver here; if concurrent-append pain returns, write a dedupe driver like `merge=ledger`'s rather than stock union. | `.gitattributes`; `scripts/check-outstanding-issues.mjs`; PR #1400; PR #1430 | 2026-07-30 | | #134 | P2 | issue | Ledger union-merge driver is absent wherever `npm install` was skipped | **Outcome:** the ledger's union-merge protection is present wherever a merge happens, or its absence is loud. **Detail:** `.gitattributes` declares `docs/branch-review-ledger.md merge=ledger`, but the driver itself lives in git _config_, installed by `postinstall` -> `scripts/install-git-hooks.mjs`. A container that skips `npm install` (this repo's remote agent sessions do — the session hook reports "node_modules matches the lockfile, skipping install") therefore has the attribute without the driver, and git silently falls back to an ordinary merge. On 2026-07-30 a `git merge origin/main` on PR #1424 produced **conflict markers inside the append-only ledger** at three lines; `git merge` itself did not name the file, so only `npm run check:branch-review-ledger` caught it. Committing that would have corrupted the file the guard exists to protect. **Next:** make the absence loud — have `check:branch-review-ledger` (already in `verify:cheap` and `static-pr`) fail when `.gitattributes` declares `merge=ledger` but `git config merge.ledger.driver` is unset, so the environment is caught before a merge rather than after. `npm run hooks:install` is the one-line fix once detected. **Stop:** never trust a `merge=union`-style attribute to be active just because `.gitattributes` declares it; the driver is per-checkout config. | PR #1424; session 2026-07-30 | 2026-07-30 | | #144 | P2 | issue | `check:docs-index` has no repo-root directory coverage | **Outcome:** a new top-level directory cannot stay absent from the orientation maps. **Detail:** `scripts/check-codebase-index-coverage.mjs` exists precisely to catch "a module that never gets added to the map, silently staling it", but its granularity is route groups, `src/lib` module dirs and schema tables — it never looks at repo-root directories. That blind spot is how root `data/` stayed undocumented in both `CLAUDE.md` and `docs/codebase-index.md` while seven `src/lib` modules loaded it at runtime (differentials, forms, medications, services, specifiers), and how it stayed easy to confuse with the unrelated `src/data/`. PR #1436 documented `data/`, `mockups/`, `plugins/`, `eslint-rules/`, `.agents/`, `.claude/` and `.githooks/` by hand, so the maps are correct today with nothing stopping the next one from drifting. **Next:** extend the checker with a repo-root pass plus an allowlist for directories that are deliberately unmapped (build output, `.git`, vendored dirs). Kept out of #1436 deliberately — widening a blocking gate that runs in `verify:cheap` and `static-pr` deserves its own PR and its own red-then-green proof. | PR #1436; `scripts/check-codebase-index-coverage.mjs:1-17`; session 2026-07-30 | 2026-07-30 | | #142 | P3 | task | Four loose dated docs need source and migration edits before they can be filed | **Outcome:** every dated point-in-time doc lives in `docs/audit/` or `docs/archive/` as `docs/README.md` requires, not loose at the `docs/` top level. **Detail:** PR #1436 filed the five that were docs-only moves. These four are referenced from outside `docs/`, so relocating them means editing source, tests and migration SQL comments — a different risk class than a docs tidy, and not worth bundling into one: `capacity-review.md` (`scripts/soak-test.ts`), `tenancy-defense-in-depth-review.md` (`src/lib/owner-scope.ts`, `tests/owner-scope-guard.test.ts`, two migrations, `SECURITY.md`, `.claude/agents/clinical-governance-reviewer.md`), `operator-apply-july8-batch.md` (three migrations plus `supabase/schema.sql`), `scale-readiness-review.md` (one migration). Also note `forward-codify-retrieval-rpcs-workorder.md` is indexed as a completed workorder but live is still ahead of the repo on those RPCs, so archiving it would misrepresent open operator work. **Next:** treat as low priority — the docs are correctly indexed and reachable where they are; only file them if a pass is already editing those migrations. Editing applied migration SQL is subject to `npm run check:migration-role`'s immutability pin. | PR #1436; session 2026-07-30 | 2026-07-30 | From 405f75843edab2850af78750c844bc5c22ebd9d5 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 31 Jul 2026 01:25:32 +0800 Subject: [PATCH 2/2] docs: record PR 1465 review --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 213f93f589..160c8bb428 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -243,3 +243,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie | 2026-07-30 | PR-1473 | a2b2820c13a47425cfc0ea751e57ee35e9bd1105 | PR #1473 full diff vs origin/main | PASS after review repair: governance refusal and error-state contracts are consistent | outstanding-issues guard passed; docs links 1412 passed; docs index passed; Prettier passed; git diff --check | | 2026-07-30 | pr/1483 | a84fa60eebdbe7a00193c268b401f7abd3cc554e | docs: reopen issue 105 after withdrawn verification | approved after PR 1473 sync; issue 105 remains correctly open | issue/ledger; docs inventory/links/scripts; Prettier; diff-check | | 2026-07-30 | pr/1476 | 0fd5a3cdba612d30cfd75ea997177f6e29c34bd3 | docs: record ESLint 10 ecosystem blocker | approved after PR 1483 sync; ESLint blocker and issue 105 correction preserved | issue/ledger; docs inventory/links/scripts; Prettier; diff-check | +| 2026-07-30 | pr/1465 | 4e34d97bb9eb5122b9d8f8e54c42793c727f5085 | issues: record fresh #133 evidence | approved; duplicate-ID race and Prettier prerequisite accurately recorded | issue/ledger; docs inventory/links; Prettier; diff-check |