Session close 2026-08-04 to 2026-08-07: save, carry, needs-Pip, discard, lessons, mistakes -- and main has not been CI-verified for 19 hours

[PipFoweraker]

Stateful exit for the session running 2026-08-04 to 2026-08-07. Filed rather than messaged so it is greppable later, matching the shape of #59.

Verified at close, 2026-08-07 17:2x AEST

main clean and exactly level with origin/main. All gating checks pass locally: invariants, workflow de-arm, evidence, transcoding, dump-space tests, migration tests, detector tests, and all four --check projections byte-identical. 39 open issues, and zero were closed this window -- the last closure repo-wide was #45 on 2026-08-02.

One thing does not check out, and it is the important line in this section. Data Integrity has not run on main since 2026-08-06 01:00Z. Both merges from this morning, 1c8678c and 1ac7169, have no CI run at all. Every gate passes when run by hand, so there is no evidence of breakage -- what is broken is the assumption that something is watching. Cause not established; the plausible one is that the token used to merge does not trigger workflows. Do not treat main as CI-verified until this is answered.

---

SAVE -- landed, durable, needs nothing

Three lessons installed as mechanisms rather than sentences (#67): citations dereferenced, the taxonomy published, and all_events.json given a producer after seven months without one. Writing that producer immediately found corruption on the public site, which is the argument for producers in one line.

The maturity ladder (#66), built rather than adopted, per the ruling in #62. It reports rather than gates, deliberately: a collection legitimately sits at wood while it is being built.

A transcoding gate (#69, open) for the species that every existing check was blind to -- the ASCII gate saw \uXXXX escapes, the control scan saw codepoints above 32, the count invariants saw the right number of records. It is a separate implementation from the producer's repair on purpose: sharing the function would have made a defect in it invisible to both sides.

322 review verdicts across three passes, and a negative result on the selector that was worth more than the verdicts.

CARRY -- open, owned, no action from this seat

pdoom-data#69 awaiting merge. pdoom1-website#282 and pdoom1#1163, both filed today: the two mojibake titles are still live in the site's served copy and the game's snapshot, because both are frozen hand-carried copies that do not regenerate. coordination#32 provenance, return date 2026-08-13, blocking party pdoom1. coordination#35 carries this seat's ranked asks.

NEEDS PIP

1. pdoom1#1102 bit 2, the taxonomy scope. Two seats are stopped, not slowed. This seat ranks it above all of its own asks.
2. Merge Gate the transcoding species that every existing check was blind to (#68) #69.
3. Canonical producer: does project_timeline_events.py retire clean_events.py? Its --check passes and stays unwired until this is answered.
4. R5: a letter from R5 options: six candidate headline metrics, measured -- and 28 of 1,194 events validate against event_v1 #64. Called for Monday by this seat at 16:12 rather than started inside the quiet window.

DISCARD -- deliberately not doing

#65 as an argument. It is now a decision with numbers under it and does not need another round of prose. 1,166 records fail for exactly two reasons; every failing record fails both, so fixing one moves the passing count by zero.

The ASCII backlog, unchanged: clearing it arms documentation-publish.

Chasing every coordination commit. The watch armed this afternoon is noisy toward other seats' work; most of it is not this repo's.

LESSONS -- learned this window, not known at the start

A gate at the source does not protect a surface that holds a copy. #69 scans this repo's data/ tree and cannot see either downstream copy by construction. That is why yesterday's repair did not propagate, and it generalises: every frozen hand-carried copy in the estate is outside every gate that guards its origin.

A checker can invent failures in the data it was written to protect. The first draft of check_transcoding.py used str.splitlines(), which also breaks on U+2028 and U+0085 -- both present inside string values in this corpus -- and reported 12 fragmented records as findings.

Consoles corrupt evidence in both directions, and the direction is not predictable. The same Windows console re-mangling produced a false NEGATIVE on a genuinely corrupt title in the morning and a false POSITIVE on a clean issue title in the evening. Fetch bytes and print ascii(); never read non-ASCII evidence through a shell pipe.

Measurement collapses arguments faster than argument does. #65 looked like a corpus-quality problem for a week. Measured, it is two schema decisions and a producer bug.

MISTAKES -- mine, recorded because the pattern matters more than the instance

Printed a browser error page to Pip's tray. Coordination's renderer computes its PDF path as html_path.with_suffix('.pdf'), so passing --out x.pdf makes the DELETE-FIRST guard unlink its own input; Edge then renders ERR_FILE_NOT_FOUND, exits 0, and both of the tool's deliberate liar-checks pass. I did not verify the output before sending it.

Asked for a ruling that had already been made. I put arrow policy to Pip at 14:31 when #67 had settled it in merged code at 08:16. I was reading my issue list instead of the code.

Nearly filed a bug on my own corruption. See the console lesson above. The agent's independent implementation and mine disagreed; I assumed the agent was right, and the correct answer was that both readings were artifacts.

Sat on the unblocked half of #68. Its detector needed no ruling and I waited on rulings anyway.