chore(loop): record what A1 structurally cannot validate

[Alex1990]

Documentation only — no behaviour change. Records a decision and repairs a checklist that had become misleading.

The decision (yours, 2026-09-11)

Accept the metrics write path as unverified during A1; validate it as the first item after the L2 switchover.

Why it cannot be validated now: A1 produces no loop PR, so the metrics decision never fires and handleMetrics never runs. All 3 existing acceptance rows are A0-era (manual-local ×2, workflow-backfill).

The residual risk is smaller than it looks but not zero:

piece	covered?
markTaskTerminal (merged → accepted, closed-unmerged → rejected)	D30, unit-tested 7 cases + verified live
taskId|event|pr dedup key	D30, tested
the no-write half (non-loop PR writes no row)	D33, verified live ×2
the write half (planActions executing labels/comments)	never executed in any host

Validating that last row needs LOOP_GH_TOKEN plus execute_writes=true — i.e. leaving the report boundary, which is exactly what the observation week exists to avoid. So it becomes the first thing L2 proves.

What else the audit turned up

The A1 checklist mixed two very different things under one - [ ]: items that are merely unsampled (make the event happen and you earn the box) and items that are structurally unreachable (no amount of time helps). A clean week would have been readable as "everything verified". New section separates them:

Capability	Why it cannot run
metrics write path	needs a loop PR; A1 produces none
pr-review route	needs a loop PR too — this one was not obvious: #39/#40/#41 were loop-related but not loop-produced (head chore/loop-*, not loop/<n>-*), so loopTaskOf returned null and they routed to triage. Easy to misread as coverage.
External-PR read-only analysis	D28 — no secrets, so not even a read-only analysis reaches the LLM
Label/comment effects	report boundary never writes
execute_writes rehearsal	LOOP_GH_TOKEN unset, so auto cannot write even if requested
R2 bucket versioning	R2 offers no object versioning; accepted deviation from 05 §8

Also corrected:

• Engine stability said "2 successful runs so far" — it is 18. But the inverse gap is the real finding: every run so far exited 0, so the failure-classification table (retry vs inbox) has never met a real failure.
• Route coverage now cites the runs that did happen (issues.opened → r-20260911-121440-v8u6; sweep → r-20260911-080231-zja0) and drops the stale A0-host sweep reference.
• D33 now records both live instances (chore(loop): terminalise the task of a non-loop PR when it closes #40, chore(loop): correct the D33 note (dependabot PRs never reach triage) #41) rather than one.

The line worth keeping

A clean observation week proves the loop is safe, not that it is complete. The write half of the host is the part that has never met production.

That is what the L2 decision should be made against — not a row of green checkmarks.

[github-actions]

Coverage

Metric	%	Covered / Total
Lines	90.19%	1003/1112
Statements	89.06%	1083/1216
Functions	91.03%	193/212
Branches	76.43%	519/679