fix(audit): repair the merge-loss reconciliation exemption and classify how each loss happened (#324)

docs/branch-review-records/23787765990717e03f13cc7032add47d5a8e7d5b869c94ad78c36a062211e4e5.record.md

@@ -0,0 +1 @@
+| 2026-08-17 | 2014 | 1c88ada9c023918764dcf2a01914829e3b93e902 | PR #2014 review-and-fix | High-confidence defects fixed; review threads resolved | audit-merge-loss --self-test + --since; prettier check; npm run check:branch-review-ledger; npm run check-outstanding-issues; required CI SUCCESS |

docs/branch-review-records/4405a36b7fedb006b4f8a9947a9e66aec8589e5a59de4871bbab616ad8a91c5c.record.md

@@ -0,0 +1 @@
+| 2026-08-17 | PR (branch claude/p1-ledger-324-318-316-xag5sy, #324 follow-up) | 91d3ccfcef79f02c140141eb560f941626039443 | scripts/audit-merge-loss.mjs + tests/merge-loss-audit.test.ts + one #324 inbox request (1d35d652); advisory only, no CI wiring, no schedule, exit code behaviour unchanged | Authored handoff, owner-approved scope (tab fix + mechanism classifier only). Fixed a defect that had disabled the reconciliation exemption since it was written: treeEntryReader split ls-tree on a literal backslash-t instead of a tab, keeping the path on the entry, so the cross-path inbox-to-applied comparison could never match. 14-day window before/after: 51 findings / 255 flagged files / filesExempted 0 -> 11 findings / 66 flagged / 189 exempted. Escaped originally because all tests injected entryAt directly; closed by extracting parseTreeEntry and testing it against real ls-tree output. Added classifyRemoval, which blames the oldest commit whose tree entry already matches the pre-landing entry and reports merge-resolution vs deliberate-commit vs unknown, sorting merge-resolution first. Over the window 14 of 66 flagged files were merge-resolution (13 from acf78bf) and all 52 others had explanatory single-parent subjects. Re-verified three genuine unrepaired losses against current main: #1800 (wiring and all three tests gone), #1804 (also-matches back in forms, guards reverted, apparently untracked), #1796 (Node 26 allowance gone, apparently untracked). The (a) schedule, (b) triage-owner and (c) one-tool-vs-two decisions remain OPEN and were deliberately not implemented; nothing was made blocking and no finding is auto-closed. | verify:pr-local executable scope, 9 checks completed, failed: (none) - lint, typecheck, full unit suite, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report. Focused tests/merge-loss-audit.test.ts 29 passed (was 16). Mutation-verified three ways: backslash-t reintroduction fails 3 tests + self-test; newest-first walk fails the blame-the-oldest test; unknown-as-deliberate fails 2 tests. verify:ui NOT run - Playwright chromium-1194 vs pinned 1234 (#255/#312) fails closed in this container; no browser coverage claimed and none needed for a non-UI script. |

docs/outstanding-issues-inbox/1d35d652-d833-4934-890c-84b6837581cd.json

@@ -0,0 +1,10 @@
+{
+ "version": 2,
+ "id": "1d35d652-d833-4934-890c-84b6837581cd",
+ "createdOn": "2026-08-17",
+ "action": "update",
+ "payload": {
+ "id": "#324",
+ "detail": "**Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added scripts/audit-merge-loss.mjs through npm run audit:merge-loss and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists. SIGNAL-TO-NOISE CHARACTERISED AND TWO FIXES LANDED 2026-08-15 (owner-approved in session; still advisory, still unscheduled, still not blocking). (1) DEFECT FOUND AND FIXED: treeEntryReader split ls-tree output on the literal two-character sequence backslash-t rather than a tab, so the tree entry kept the filename. Same-path comparisons were unaffected, which is why the tool still found real losses, but isReconciliationMove compares an inbox path against its applied/ path, so the exemption could never match. Measured at 8069188 over 14 days: 51 findings / 255 flagged files / filesExempted 0, versus 11 findings / 66 flagged files / 189 exempted after a one-character fix - the exemption the script's own docstring says exists to stop inbox noise burying the genuine #1803 signal had been dead since it was written. Root cause of the escape: every test injected entryAt directly, so bare entries compared equal whether or not the path was stripped. Closed permanently by extracting parseTreeEntry as an exported pure function and testing it against real ls-tree output; mutation-verified (reintroducing backslash-t fails 3 tests plus the self-test). (2) MECHANISM CLASSIFIER ADDED: classifyRemoval walks the commits touching each flagged file between the landing and the ref, oldest first, takes the first whose tree entry already equals the pre-landing entry, and reports whether that commit was a merge (accidental) or single-parent (usually deliberate, and its subject says why). This is what makes the report triageable: over the window, 14 of 66 flagged files were merge-resolution removals with 13 from the single documented bad merge acf78bf, while all 52 others had explanatory single-parent subjects such as 'Re-land the --shadow-tight retirement', 'rework the viewer for phone and PWA reading' and 'ci: speed iteration without weakening gates'. Merge-resolution findings now sort first; unknown is reported rather than guessed. Mutation-verified in three directions (tab bug, newest-first walk, unknown-as-deliberate). GENUINE STILL-UNREPAIRED LOSSES, re-verified against main after it advanced past 8069188: #1800 fuzzy catalogue wiring is absent from therapies.ts, specifiers.ts and factsheets-data.ts AND all three of its tests carry zero fuzzy assertions so nothing can go red (tracked by #330); #1804's removal of UniversalSearchAlsoMatches from forms mode is reverted so the component is back at forms-search-results-page.tsx lines 44 and 894 with its guard assertions reverted, APPARENTLY UNTRACKED; #1796's ALLOWED_NODE_MAJOR_VERSIONS [24, 26] allowance is gone so worker/validate-runtime.ts still hard-codes nodeMajor() !== 24, APPARENTLY UNTRACKED; #1803 and #1807 lost design-system doc status rows while their code landed, so docs and code disagree. NEXT - the three decisions this row exists for are still open and are deliberately NOT implemented: (a) schedule, recommended weekly on a 14-day window rather than post-merge, because a post-merge trigger fires roughly 380 times per 14 days here and at merge time the loss has not happened yet; (b) triage owner, recommended routing to a pinned issue reusing the live-drift routing already covered by tests/live-drift-workflow.test.ts, with one named human, and not a required check; (c) recommended ONE tool with a --mode flag rather than a second detector, since the inbox case shares the window, landing enumeration and tree-entry comparison and differs only in paths and exemptions. Also recommended: the phantom-SHA class (a ledger record asserting a fix at 720e7027, an object that does not exist) is a DIFFERENT family - a ledger assertion with no landed content, checkable with git cat-file -e - and should get its own row rather than being folded into this tool. Stop unchanged: do not make either detector blocking or auto-close findings until the ownership decision exists."
+ }
+}