From 68fdbd86511f066ff3141257803b96ef087730f7 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 12:29:06 +0000 Subject: [PATCH 1/2] issues: close #140 as a duplicate of #133, resolved by #1444 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #140 was opened mid-session for the union-driver damage before I noticed #133 had already recorded the same finding, earlier and with the same conclusion. Two open rows described one condition, and PR #1444 has since removed that condition: `merge=union` is gone from `.gitattributes`, `check:outstanding-issues` now requires an unspecified `merge` attribute, and regression tests cover `union`, `-merge` and an unparsed reading. Moved to the archive table rather than deleted, pointing readers at #133 — whose still-open half is the real conflict-frequency cause: fixed-width column padding makes any one-row edit re-pad every row, so git sees the whole table as one hunk. The surviving evidence (four merges on PR #1430 each reporting success while duplicating the entire open-items table) lives there too. Verified: check:outstanding-issues 138 rows, 66 open / 72 archived (was 67/71 — moved, not copied), unique ids, next-id=141, no merge driver; docs:check-links 1361 references resolve; prettier clean. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ --- docs/outstanding-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 77275d7ec2..d1d75b7751 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -164,7 +164,6 @@ removed after current-main verification; it is not missing recommended work. | #137 | P3 | rec | Advisory UI spends ~3 min per UI PR on five mockup tests | **Outcome:** the advisory lane costs what its signal is worth. **Detail:** `ui-advisory` runs on every UI PR (3m14 measured 2026-07-30) to cover `@quarantine` plus `@mockup` journeys — but `tests/flake-ledger.json` is empty and there are **zero** `@quarantine` tests in the suite, so it executes 5 `@mockup` tests. It is `continue-on-error` and outside `pr-required`, so it can also rot unnoticed. **Next:** gate it on mockup-file scope, or accept the cost as the price of keeping the lane warm for future quarantines. Either is defensible; the current state is just unmeasured. | `.github/workflows/ci.yml` `ui-advisory`; `tests/flake-ledger.json`; session 2026-07-30 | 2026-07-30 | | #138 | P3 | task | CI Triage ships inert pending a repo variable | **Outcome:** a PR red that is really a main-side regression is labelled as such instead of costing an author a debugging session. **Detail:** `.github/workflows/ci-triage.yml` is complete and self-tested (`check:ci-triage` runs in `verify:cheap` and `static-pr`) but every run short-circuits on `vars.CI_TRIAGE_ENABLED == 'true'`, which is unset. Its purpose is the failure mode this doc records repeatedly: CI merges the PR branch with current `main`, so a main regression surfaces on every open PR. **Next:** operator sets the repository variable, then confirm one triage comment posts. Reads job metadata from a trusted default-branch checkout only; never runs PR code. | `.github/workflows/ci-triage.yml`; session 2026-07-30 | 2026-07-30 | | #139 | P3 | rec | `changes` job computes outputs nothing consumes, and over-triggers coverage | **Outcome:** the change-scope contract says what it means. **Detail:** `changes` exports `source_changed`, `workflow_changed`, `changed_files` and `rag_eval_changed` and **no job reads any of them** — only `rag_eval_changed` is documented as intentionally advisory (`ci-change-scope.mjs`); the other three read as live wiring. Separately `coverage_changed` is derived as _any non-doc file_, so a workflow-only edit runs the ~4 min coverage job. **Next:** delete or document the dead outputs; decide whether coverage should narrow. Low value alone — bundle with the next `ci.yml` change rather than minting a PR. | `.github/workflows/ci.yml`; `scripts/ci-change-scope.mjs`; session 2026-07-30 | 2026-07-30 | -| #140 | P2 | issue | `merge=union` on the issues ledger duplicates the whole table instead of merging it | **Outcome:** a concurrent edit to `docs/outstanding-issues.md` merges, conflicts honestly, or is deduped — but never silently doubles the file. **Evidence 2026-07-30 (PR #1430):** `.gitattributes:19` sets `docs/outstanding-issues.md merge=union`. That is git's **built-in** union driver, which concatenates both sides of every conflicting hunk with **no dedupe** — unlike `docs/branch-review-ledger.md merge=ledger`, whose `scripts/merge-branch-review-ledger.mjs` does dedupe exact rows. The open-items table is not append-only: rows get rewritten, reordered and archived. So when this branch had edited `#127` while `main` rewrote and reordered overlapping rows, `git merge origin/main` reported success and produced **every row twice** — `#059 appears 2 times (lines 101, 166)` and so on for the entire table. `npm run check:outstanding-issues` caught it, which is the gate working; but the driver converted a resolvable conflict into a guaranteed guard failure needing a manual rebuild of the file from `origin/main` plus the one changed row. Union also makes `git merge-tree` report a clean tree, so the pre-merge conflict check cannot warn about it. **Next:** either give this file a dedupe driver like the branch-review ledger's, or drop `merge=union` and let it conflict honestly — the guard already blocks duplicates either way. **Stop:** do not resolve a duplicated table by deleting rows by eye; rebuild from `origin/main` and re-apply only the rows the branch actually changed. | `.gitattributes:19`; `scripts/check-outstanding-issues.mjs`; `scripts/merge-branch-review-ledger.mjs`; PR #1430 | 2026-07-30 | ## Resolved / archive @@ -243,3 +242,4 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th | #049 | issue | Process diagnostic exposed a Cursor worker API key | The exact worker was stopped, the key was revoked server-side, both local encrypted worker-secret records were removed, and authorized repository/backup scans found no plaintext copy. Follow-up guardrails now prevent repository process inventory from serializing command lines and redact heavyweight-lock command text before persistence or errors. | 2026-07-23 | | #050 | issue | Next.js 16.2.10 remained in a high-severity security range | Upgraded `next` and `@next/env` to 16.2.11, regenerated the npm lockfile, confirmed the production dependency audit is clean, and passed focused framework checks, `verify:cheap`, and the full Chromium UI gate. | 2026-07-23 | | #116 | issue | Missing CI signal on conflicted PRs | RESOLVED 2026-07-30: `.github/workflows/pr-mergeability.yml` checks trusted `pull_request_target` events and refreshes unchanged heads after protected-base pushes. A conflicted PR gets a red `PR mergeability` check naming the conflict instead of an empty CI list. The base-push job alone has scoped `checks: write`; neither path checks out PR code or updates branches. Classifier: `scripts/pr-mergeability.mjs`; contract: `npm run check:pr-mergeability`. Behind-but-clean remains `sync:pr-branches`. | 2026-07-30 | +| #140 | issue | Union-driver table duplication — duplicate of #133 | CLOSED 2026-07-30 as a duplicate, superseded by `#133` and resolved by PR #1444. This row was opened mid-session for the union-driver damage before its author noticed `#133` had already recorded the same finding — and recorded it _earlier_, with the same conclusion ("**Do not** apply a `merge=union` driver — tested 2026-07-30 and it is worse"). Keeping both would have left two open rows describing one condition, and that condition no longer exists: PR #1444 removed `merge=union` from `.gitattributes`, inverted `check:outstanding-issues` to require an unspecified `merge` attribute, and added regression tests covering `union`, `-merge` and an unparsed reading. The surviving evidence — four merges on PR #1430 each reporting success while duplicating the entire open-items table — lives in `#133`, whose still-open half is the real conflict-frequency cause: fixed-width column padding makes any one-row edit re-pad every row, so git sees the whole table as one hunk. Read `#133`, not this. | 2026-07-30 | From 128d72f5dec3d024b4ceefca53a08f37fc2f90ee Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Thu, 30 Jul 2026 20:59:38 +0800 Subject: [PATCH 2/2] docs: record duplicate issue review --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 987581a151..eb0d69902d 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -173,3 +173,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie | 2026-07-30 | claude/ci-testing-review-2l8klp | 2e2160bc8b9d2d824209c217c67cb9cac1be3a8d | open PR changed-scope review | APPROVE: three-way UI sharding, critical-first gating, measured drag travel, and gate-manifest updates preserve required-check aggregation and deterministic Playwright settings. | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; ledger guards PASS; exact-head sharded Production UI required | | 2026-07-30 | PR #1430 | a9ae22ac4915e86d51ee05787059382a39bd8ba8 | phone chrome diagnostics and merge repair | fixed and ready for CI | issues guard; ledger guard; 37 focused tests; phone-chrome dry-run | | 2026-07-30 | PR-1440 | f7260cc6a0da87cb4df1ac95ef962967e667c3f0 | PR #1440 issue #102 ordering correction | accurately restores the two canary-gated retrieval ordering constraints; no findings | outstanding-issues and ledger guards pass; documentation-only diff | +| 2026-07-30 | PR-1445 | 07933e08cff6c7d81345e02c03727032ccf522b6 | PR #1445 close duplicate issue | correctly archives duplicate #140 while preserving #133 as the surviving open conflict-frequency record; no findings | outstanding-issues and docs-link guards pass; docs-only diff |