chore: graduate the friction-log inbox to GitHub Issues (#149–#150)

[topij]

Fifth triage-friction-log sweep overall, dated 2026-07-29, run in LLM-only mode (the engine, #6, is still not vendored).

Two fallback-panel rounds ran on this PR. Round 1 found a HIGH; the fix for it introduced a second HIGH, which round 2 found. Both are corrected and both retractions are left visible. The sweep itself — which bytes moved where — has never been contested by any lens across four isolated reviewers.

Routing

Seven inbox entries in, seven accounted for — one graduated into two new issues, six routed as seven occurrence comments. The nine rows below are proposals, not entries: one entry produced two of them.

proposal	inbox entry it came from	decision	outcome
1	correction-propagation (bullet 1)	approve	#149
2	correction-propagation (bullet 1)	approve	#150
3	verification-outweighs-behaviour (bullet 2)	approve	comment on #120
4	check-heading (bullet 3)	approve	comment on #138
5	check-heading (bullet 3)	approve	comment on #127
6	worktree-ref reproduction (bullet 4)	approve	comment on #75
7	closing keyword in a squash message (bullet 5)	approve	comment on #71
8	CodeRabbit silence (bullet 6)	approve	comment on #45
9	state-path collision (bullet 7)	approve	comment on #113

Both one-into-two counts are deliberate: bullet 1 split into a doctrine checklist (#149) and a guard on the edit tool itself (#150); bullet 3 names two distinct checks, so it produced comments on both #138 and #127.

The HIGH, and the HIGH in its fix

Round 1. The sweep folded an operator remark into an assertion the operator never made, and published it to the tracker.

• The remark: CodeRabbit is currently not available on this repo, it is in use on cs-toolkit, and its absence should not generate friction because the fallback panel exists. All of that stands — the last clause is the operationally important one.
• What was published: "not installed, never exercised here, not an outage — nothing is rate-limited and no credit has run out."
• What the repo shows: Nothing distinguishes a bot that structurally never reviews from one that is merely pending #45's own body records a Pro Plus plan for this repo; CodeRabbit has completed real reviews here and has posted many Review limit reached notices (including on chore: update handoff — CLAUDE.md + init.sh harness and fixes shipped #89 and chore: update handoff — gh-less REST transport merged after the broad attempt was closed #99 on 2026-07-27); its last activity of any kind is 2026-07-28T04:35:09Z on docs: a fix round addresses only what the review found #101.

The inflated version was then used to file a structurally-never-reviews verdict onto #45 — an issue whose entire subject is that a structurally-absent reviewer and a merely-pending one cannot be told apart. It committed that issue's own confusion, on that issue, and violated #140 ("'X is not available here' needs the command that establishes it"), filed by the immediately previous run of this same workflow.

Round 2. The fix over-corrected: it asserted CodeRabbit "has reviewed ~42 PRs", which was really a count of PRs carrying any bot comment — a large share of them quota refusals, not reviews. A lens caught it. Attempting to settle the number made it worse: independent re-derivations of "how many PRs did it actually review" disagreed with each other, because the reviewed / refused / silent distinction is not cleanly recoverable from the comment stream without deciding what counts.

So the number is withdrawn rather than restated a third time. That irreducibility is better evidence for #45 than any count would have been: from outside, a twelve-PR silence is indistinguishable between removal, quota exhaustion, and an infinite queue — and this PR demonstrates it twice, in opposite directions, with full tracker access.

Surfaces enumerated per #149's list, which this PR filed:

#149 surface	status
live log	corrected (both rounds)
archive	deliberately unchanged — verbatim record; correcting it there would destroy the evidence that the entry said what it said
issue bodies the run filed (#149, #150)	claim never appeared there — verified, no action
occurrence comments	#45 rewritten in place, both retractions visible at the top
PR body	this section
commit messages	amended

A lens also noted that #149's own six-surface list omits PR comments — and that a retracted claim was still live on this PR's first comment. That comment now carries a superseded banner. The gap in #149's list is real and stays open on #149.

Count correction in the same pass: "sixth and seventh consecutive" was an undercount. #102, #103, #104, #111 and #148 also carry nothing, making the run twelve — the third consecutive undercount in that series.

Other findings acted on

• "Third sweep" → fifth. The archive holds four prior graduation markers.
• "As in the two prior sweeps" → narrowed. Only the 2026-07-28 second sweep substituted for the DM stop; the first is the run triage-friction-log's notify-channel stop has no in-session-operator exception, and bypassing it leaves the approval loop with no artifact #128 was filed against, and the archive records it as having violated the stop. Laundering that into "substituted" is corrected.
• verify.sh is now published in full, as PR chore: graduate the friction-log inbox to GitHub Issues (#138–#143) #144 did with its script.
• The marker's verification section was cut, not corrected again. Three review rounds went to the equivalent section last sweep and two more went to it here, every one finding the prose claiming more than the checks did. The earlier sweeps' own recorded remedy for this loop was deletion; that is what was applied.
• The check headings that over-claim are now named as such instead of being described as narrowed. An earlier version of this PR body claimed checks 4 and 5 had been narrowed to their assertions. They had not — check 5 prints issue titles and never compares them and never fetches labels at all; check 4 is a bullet count with no notion of "swept". A lens also showed checks 1 and 2 share no trust chain (the snapshot's text field is never hashed, so a forged snapshot yields byte-identical output). All three are documented rather than fixed: building a better harness inside a fix round is the mechanism-creep the panel doctrine explicitly warns against, and A graduation record's routing claims are unverified — re-read the tracker after the writes land #138 / Nothing mechanically distinguishes a friction-log sweep from a deletion, and the budget check scores the deletion higher #127 — which ask for exactly that harness — stay open.
• The positional archive check is described as what it does. A lens built an archive that passes it while rendering as nothing; the hidden-bytes attack is actually caught by check 3, which is not one of the two new checks and existed last sweep. The blank-line catch belongs to check 3 too.
• The post-sweep config entry re-derived config/dev-model.yaml's tracker block is unstamped placeholder and names the wrong backend #121 without noticing it, and its rewrite then introduced a larger false claim ("tracker.* and notify.* carry no comment") than the one it corrected. Both are fixed: those keys carry schema hints that say nothing about whether a value is live or placeholder, which is the actual point.
• A fabricated command transcript was removed from this body's evidence block. It showed a grep producing a formatted table row that the command would not emit. The conclusion held; the transcript was not literal, in a PR arguing that specific-looking evidence gets trusted.
• The "fifteen lenses" / "14 of 14" conflict is recorded as an addendum on both the Add a separate, cheaper terminal check for record accuracy instead of carrying prose review through every panel round #120 and Invert fallback-review-panel contract item 7: assume the isolated worktree points at the wrong ref #75 comments, unresolved in either direction.
• The first verification comment now carries a superseded banner: its scan character counts were measured against the pre-amendment surfaces and were never re-run against what shipped.

Filed, not fixed

• When a claim is corrected, enumerate every surface it was published to at that moment #149's surface list omits PR comments and commit-message-adjacent surfaces. Stays on When a claim is corrected, enumerate every surface it was published to at that moment #149.
• Invert fallback-review-panel contract item 7: assume the isolated worktree points at the wrong ref #75's occurrence comment was edited after this session's own launches and does not count them. Every lens launch this session — four, across two rounds — reproduced Invert fallback-review-panel contract item 7: assume the isolated worktree points at the wrong ref #75: each was placed in a worktree at main with an empty diff and fetched the real head itself. No ordinal is claimed, because the running total is one of the numbers the addendum declares approximate.
• archive_plan_sessions must warn on relative cross-references — both inside moved blocks and into them #73's predicted instance was realized by this sweep (the archived sentence now sits inside the file it names) and is recorded nowhere in the routing. Real, low, and untouched.
• When a claim is corrected, enumerate every surface it was published to at that moment #149 and A scripted text replacement that matches nothing must fail, not report success #150 close with an archive pointer that only becomes true when this merges. An earlier version of this body justified leaving it as "house style (the 2026-07-28 sweep did the same)" — that was false; only When a claim is corrected, enumerate every surface it was published to at that moment #149 and A scripted text replacement that matches nothing must fail, not report success #150 carry such a pointer. Left as is on its own merits, with the false justification withdrawn.

Where review stands

CodeRabbit has not registered on this PR, consistent with the twelve-PR run above. The independent pass is the fallback panel per docs/agentic-dev-kit/fallback-review-panel.md: two isolated fresh-context lenses (adversarial, correctness), each in its own worktree, run twice — once against f54dbce, once against c9f9363.

Stopping criterion applied: second class (a record that is read, not a gate, send path, or destructive operation), so the bar is act on every HIGH, and on any regression at any severity. Both HIGHs are corrected. Every regression above is either fixed or explicitly named as documented-not-fixed with the reason.

This is not a "the last round found nothing" stop, and it is not claimed as one. Round 2 found four HIGHs; this round answered them, and a third round would very likely find more — the panel doctrine records exactly this pattern and warns that the termination condition may never arrive. What changed between rounds is that the remaining findings are now about the verification prose describing itself, not about the sweep, so the applied remedy was to delete the self-description rather than extend it. Merging is an operator decision.

Verification

make test — 503 passed. check_doc_budget — docs/kit-friction-log.md 136/150, down from 203. kit_doctor — 26 unchanged, 0 differ. Script and output in the comments below, with their limits stated there.

Issues referenced above are context, not targets — none of them is being retired by this PR.

[topij]

Superseded — read this first (added 2026-07-29 after two panel rounds). Three claims below are withdrawn. (1) "Reproducible from git and gh alone" is false for check 6, whose right-hand side is a local file; it holds for the other five. (2) The scan character counts (25,183 / 1,971 / 5,034) were measured against the pre-amendment diff, commit message and PR body. The surfaces that actually shipped are larger, the PR body was rewritten twice afterwards, and this scan was never re-run against them — a later scan against the shipped surfaces found 0 closing-keyword matches on the commit message, PR body and comments. (3) "#150's exact shape" overstates: #150 is scoped to text replacements, and the incident was an error-swallowing scan. The output block below is retained unedited as the record of what the pre-amendment run reported.

---

Six-check verification — unedited output

Reproducible from git and gh alone. The script is verify.sh, run against the working tree immediately before the commit.

== 1. snapshot digest reproduces from the committed blob ==
  PASS  snapshot == inbox@0b82ff2 (a24d1e32693a3df94f63aa5faa708c00381785c3b96587b7af9fe8fbed12a538)
== 2. archived section, un-demoted, is byte-identical to the snapshot (positional) ==
  PASS  section un-demotes to the snapshot exactly (15839 bytes)
== 3. prior archive body preserved byte-for-byte ==
  PASS  intro + all 935 pre-existing lines unchanged
== 4. zero swept entry bullets remain in the live log ==
  PASS  1 bullet remains — the post-sweep config entry, added this run
== 5. filed issues: exist, OPEN, authored, titled, labelled ==
  PASS  #149 OPEN by topij — When a claim is corrected, enumerate every surface it was published to at that moment
  PASS  #150 OPEN by topij — A scripted text replacement that matches nothing must fail, not report success
== 6. comment CONTENT check (not existence): posted body == sent file ==
  PASS  #120 exactly 1 comment, body sha256 matches sent file
  PASS  #138 exactly 1 comment, body sha256 matches sent file
  PASS  #127 exactly 1 comment, body sha256 matches sent file
  PASS  #75 exactly 1 comment, body sha256 matches sent file
  PASS  #71 exactly 1 comment, body sha256 matches sent file
  PASS  #45 exactly 1 comment, body sha256 matches sent file
  PASS  #113 exactly 1 comment, body sha256 matches sent file

ALL CHECKS PASSED

Two notes on the checks themselves, not the data

Check 3 failed on its first run and the failure was real. The insertion had swallowed the blank line between the archive intro and its first section heading. The old sweep's unanchored substring test would have passed that — the bytes were all present, just badly placed. Fixed in the commit; the output above is the post-fix run.

The closing-keyword scan reported a pass while erroring. The first invocation used a grep -E alternation containing an empty branch; ugrep rejected it with error at position 28, exited non-zero, and the || echo clean branch fired — printing a clean result from a check that never ran. Caught, rewritten in Python, and re-run with per-surface character counts so a silent no-op is visible: 25,183 / 1,971 / 5,034 chars scanned across the added diff lines, commit message and this PR body, 0 matches.

That second one is #150's exact shape (a scripted check that no-ops and reports success) occurring inside the step that guards against #71 — in the same run that filed #150. Recorded here rather than quietly fixed.

[topij]

verify.sh — the six-check script, published in full

Previously described but not shown, which a panel lens correctly called a regression against PR #144 (whose body embedded its script inline). Here it is, verbatim, along with a fresh run against the corrected head.

Read check 6's limits first. Its right-hand side is a local file — the body this run sent. That makes it the one check here a third party cannot reproduce from git and gh alone, by construction. Last sweep's weaker author-and-timestamp check was fully reproducible; this was a knowing trade and the marker now says so instead of claiming six-of-six reproducibility.

Three comments were edited after the panel round (#45 rewritten with a visible retraction; #120 and #75 given a counts addendum). Check 6's expected bodies were rebased onto the corrected text, so the run below attests to what those comments say now, not to what was first posted. Saying so, rather than presenting an unqualified green, is the point.

Script

set -uo pipefail
S=/private/tmp/claude-502/-Users-topi-Coding-agentic-dev-kit/d56d9a6b-ad5b-4cd9-987a-01b8ab237272/scratchpad/triage
R=topij/agentic-dev-kit; fail=0
ok(){ echo "  PASS  $1"; }; bad(){ echo "  FAIL  $1"; fail=1; }

echo "== 1. snapshot digest reproduces from the committed blob =="
a=$(python3 -c "import json;print(json.load(open('state/triage/frozen-inbox_2026-07-29.json'))['sha256'])")
b=$(git show 0b82ff2:docs/kit-friction-log.md | python3 -c "
import sys,hashlib
L=sys.stdin.read().split('\n'); i=next(k for k,l in enumerate(L) if l.startswith('## '))
print(hashlib.sha256('\n'.join(L[i:]).encode()).hexdigest())")
[ "$a" = "$b" ] && ok "snapshot == inbox@0b82ff2 ($a)" || bad "digest mismatch: $a vs $b"

echo "== 2. archived section, un-demoted, is byte-identical to the snapshot (positional) =="
python3 - <<'PY'
import json,re,pathlib,sys
snap=json.loads(pathlib.Path("state/triage/frozen-inbox_2026-07-29.json").read_text())["inbox_text"]
L=pathlib.Path("docs/kit-friction-log-archive.md").read_text().split("\n")
s=next(k for k,l in enumerate(L) if l.startswith("## Graduated 2026-07-29"))
e=next(k for k in range(s+1,len(L)) if L[k].startswith("## "))
body=L[s:e]
h=next(k for k,l in enumerate(body) if l.startswith("### 2026-07-28 (second sweep)"))
sect="\n".join(body[h:]).strip("\n")
un="\n".join(re.sub(r"^#(#{1,6}\s)",r"\1",l) for l in sect.split("\n"))
print(("  PASS  section un-demotes to the snapshot exactly (%d bytes)"%len(un.encode())) if un==snap.strip("\n")
      else "  FAIL  un-demoted section differs from snapshot"); sys.exit(0 if un==snap.strip("\n") else 1)
PY
[ $? -eq 0 ] || fail=1

echo "== 3. prior archive body preserved byte-for-byte =="
python3 - <<'PY'
import pathlib,sys
old=pathlib.Path("/private/tmp/claude-502/-Users-topi-Coding-agentic-dev-kit/d56d9a6b-ad5b-4cd9-987a-01b8ab237272/scratchpad/triage/archive-before.md").read_text()
new=pathlib.Path("docs/kit-friction-log-archive.md").read_text()
oL=old.split("\n"); nL=new.split("\n")
j=next(k for k,l in enumerate(oL) if l.startswith("## "))
tail_old="\n".join(oL[j:]); 
i=nL.index("## Graduated 2026-07-28 (second sweep) — GitHub Issues (#138–#143)")
tail_new="\n".join(nL[i:])
same = tail_new==tail_old and "\n".join(oL[:j])=="\n".join(nL[:j])
print(("  PASS  intro + all %d pre-existing lines unchanged"%len(oL[j:])) if same else "  FAIL  prior archive body altered")
sys.exit(0 if same else 1)
PY
[ $? -eq 0 ] || fail=1

echo "== 4. zero swept entry bullets remain in the live log =="
n=$(grep -c '^- \*\*' docs/kit-friction-log.md || true)
[ "$n" = "1" ] && ok "1 bullet remains — the post-sweep config entry, added this run" || bad "expected 1 bullet, found $n"

echo "== 5. filed issues: exist, OPEN, authored, titled, labelled =="
me=$(gh api user -q .login)
for n in 149 150; do
  read -r st au <<<"$(gh issue view $n --repo $R --json state,author -q '"\(.state) \(.author.login)"')"
  t=$(gh issue view $n --repo $R --json title -q .title)
  [ "$st" = OPEN ] && [ "$au" = "$me" ] && ok "#$n OPEN by $au — $t" || bad "#$n state=$st author=$au"
done

echo "== 6. comment CONTENT check (not existence): posted body == sent file =="
for pair in 120:c120 138:c138 127:c127 75:c75 71:c71 45:c45 113:c113; do
  n=${pair%%:*}; f=${pair##*:}
  cnt=$(gh api repos/$R/issues/$n/comments --paginate -q "[.[]|select(.user.login==\"$me\")|select(.created_at>\"2026-07-29T00:00:00Z\")]|length")
  got=$(gh api repos/$R/issues/$n/comments --paginate -q "[.[]|select(.user.login==\"$me\")|select(.created_at>\"2026-07-29T00:00:00Z\")][0].body" \
        | python3 -c "import sys,hashlib;print(hashlib.sha256(sys.stdin.read().rstrip('\n').replace('\r\n','\n').encode()).hexdigest())")
  want=$(python3 -c "import sys,hashlib,pathlib;print(hashlib.sha256(pathlib.Path('$S/$f.md').read_text().rstrip('\n').encode()).hexdigest())")
  if [ "$cnt" = "1" ] && [ "$got" = "$want" ]; then ok "#$n exactly 1 comment, body sha256 matches sent file"
  else bad "#$n count=$cnt digest sent=$want posted=$got"; fi
done

echo; [ $fail -eq 0 ] && echo "ALL CHECKS PASSED" || echo "SOME CHECKS FAILED"; exit $fail

$S is a scratch directory holding the comment bodies that were sent and a pre-change copy of the archive. archive-before.md is reproducible as git show 0b82ff2:docs/kit-friction-log-archive.md; the c*.md files are not, which is finding 2 above restated.

Run against the corrected head

== 1. snapshot digest reproduces from the committed blob ==
  PASS  snapshot == inbox@0b82ff2 (a24d1e32693a3df94f63aa5faa708c00381785c3b96587b7af9fe8fbed12a538)
== 2. archived section, un-demoted, is byte-identical to the snapshot (positional) ==
  PASS  section un-demotes to the snapshot exactly (15839 bytes)
== 3. prior archive body preserved byte-for-byte ==
  PASS  intro + all 935 pre-existing lines unchanged
== 4. zero swept entry bullets remain in the live log ==
  PASS  1 bullet remains — the post-sweep config entry, added this run
== 5. filed issues: exist, OPEN, authored, titled, labelled ==
  PASS  #149 OPEN by topij — When a claim is corrected, enumerate every surface it was published to at that moment
  PASS  #150 OPEN by topij — A scripted text replacement that matches nothing must fail, not report success
== 6. comment CONTENT check (not existence): posted body == sent file ==
  PASS  #120 exactly 1 comment, body sha256 matches sent file
  PASS  #138 exactly 1 comment, body sha256 matches sent file
  PASS  #127 exactly 1 comment, body sha256 matches sent file
  PASS  #75 exactly 1 comment, body sha256 matches sent file
  PASS  #71 exactly 1 comment, body sha256 matches sent file
  PASS  #45 exactly 1 comment, body sha256 matches sent file
  PASS  #113 exactly 1 comment, body sha256 matches sent file

ALL CHECKS PASSED