docs(devlog): close bug-PR zero-remaining campaign

devlog/_fin/260829_bugpr_zero_remaining/000_plan.md

@@ -0,0 +1,59 @@
+# 260829 — Bug-PR zero-remaining campaign
+
+This unit records a completed campaign. The repository began with sixteen open pull
+requests carrying the `bug` label and ended with none. All changes traveled through pull
+requests targeting `dev`; neither `main` nor `preview` moved as part of this work.
+
+## Terminal outcome
+
+Fifteen bug-fix pull requests landed on `dev`: #2835, #2822, #2821, #2785, #2839,
+#2845, #2843, #2842, #2846, #2849, #2850, #2847, #2844, #2841, and #2848. Five
+campaign-enabling or corrective pull requests also landed: the version-line keystone
+#2836, CI cleanup #2840, the roadmap and review gate #2837, and the independent-review
+follow-ups #2852 and #2851.
+
+Contributor branches that were superseded by current-`dev` landings were closed with
+credit and cross-references: #2799, #2798, #2638, #2828, #2812, #2796, #2797, #2793,
+#2744, #2497, and #2807.
+
+Issues #2717, #2810, #2706, #2718, #2830, and #2221 were closed after their fixes
+reached `dev`. Issue #2713 remains open because #2844 addressed only part of its scope.
+Issue #2833 was closed by its reporter, and #2813 was recorded as unreproducible.
+
+## What changed the campaign
+
+The campaign initially looked like a collection of unrelated red branches. In fact,
+`package.json` on `dev` was behind an already-published preview tag, so
+`tests/release-version-line.test.ts` failed on every descendant commit. Six bug pull
+requests inherited the same failure. Landing #2836 first removed that shared false signal
+and was more valuable than repairing any one branch in isolation.
+
+Approved contributor work was carried forward with `git cherry-pick -x`. Before a
+replacement landed, its author patch was compared with `git patch-id --stable`. This
+preserved authorship and avoided force-pushing fork branches, which would have invalidated
+their enforce-target review-readiness checklists.
+
+Independent adversarial review repeatedly found defects after the work appeared complete.
+It found seven fail-open paths in the review gate, including pagination data combined with
+`jq add` in a way that merged review objects and erased reviewers. It found three more
+cross-account origin sites in the 429 recovery work and found caller credentials sharing
+the operator account's `__main__` health state. It also found a #2830 repair that could not
+execute because it sat behind `orphans.length === 0`, a recovery test that passed on
+unrelated plaintext, and secret bytes written before temporary-file permissions were
+hardened. Each defect was fixed in public history. Mutation checks that restored the bug
+and required the regression test to fail supplied evidence that ordinary green CI did not.
+
+## Open governance gap
+
+Every credential-surface merge in this campaign lacked a formal non-author approval. All
+available repository credentials authenticated as the repository owner, and GitHub rejects
+self-review. Independent findings were posted as pull-request comments and were repaired,
+but comments are not the non-author security approval required by `MAINTAINERS.md`. This is
+an unresolved governance gap, not a completed review requirement.
+
+## Record map
+
+The numbered documents preserve the investigation and lane history. `001` and `002`
+record the audit corrections. `010` records the version-line keystone. `020` through `060`
+record the merge and reimplementation lanes. `070` is the final disposition ledger, and
+`080` records the current-head re-audit of #2638 and #2828.

devlog/_plan/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md → devlog/_fin/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md

@@ -5,6 +5,12 @@ returned `VERDICT: FAIL` with 8 blockers. Each is recorded below with its dispos
 Two were verified independently before acceptance, because a reviewer claim is evidence to
 check, not a verdict to copy.
 
+This document preserves the first audit round as historical evidence. Later rounds found
+additional defects in the executable review gate and repaired them in #2837. The campaign
+still closed with an open governance gap: credential-surface merges had independent review
+comments, but no formal non-author approval, because every available credential resolved to
+the repository owner and GitHub refused self-review.
+
 ## B1 (Critical) — inventory was stale: 16 bug PRs, not 14. ACCEPTED
 
 Live query returns 16: the 14 triaged, plus **#2744** (missed) and **#2836** (the keystone

devlog/_plan/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md → devlog/_fin/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md

@@ -4,6 +4,11 @@ Round 3 returned `VERDICT: FAIL` with one Critical blocker, and it was a genuine
 code I had just written and called a gate. Recording it plainly, because a gate that is
 trusted without being attacked is decoration.
 
+This was not the last correction. A later adversarial pass found seven reachable fail-open
+paths in the gate, including pagination results combined with `jq add` so review objects
+were merged and reviewers disappeared. Those defects were fixed publicly in #2837 and
+covered by mutation checks that made the tests fail when the faulty logic was restored.
+
 ## The blocker (accepted in full)
 
 `scripts/ci/assert-mergeable-review.sh` v1 selected **any historical** `APPROVED` review at
@@ -79,8 +84,10 @@ PRs are back to the state their approvals describe. The lesson is now an orderin
 dependent rebase is pushed only after its base commit is an ancestor of `dev`. Verifying a
 rebase locally in a scratch worktree is free; publishing it early is not.
 
-## Residual, stated rather than closed
+## Governance result at campaign close
 
-GitHub cannot mark an approval as specifically a *security* review. For security-boundary
-PRs the reviewer's own words are read to confirm the approval addressed that surface. The
-script cannot make that judgment and does not pretend to.
+GitHub cannot mark an approval as specifically a security review, and the campaign had a
+more basic identity problem: every available credential authenticated as the repository
+owner, so GitHub rejected formal self-review. Findings were posted as comments and fixed,
+but credential-surface merges still lacked the required non-author approval. The review
+gate work improved enforcement without closing that governance gap.

devlog/_fin/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md

@@ -0,0 +1,20 @@
+# wp8 — Version-line keystone
+
+This phase completed in #2836 and ran first because it repaired the shared base rather
+than any individual bug branch.
+
+At campaign start, `dev` still declared version 2.35.0 while the published preview line
+had reached `v2.36.0-preview.20260829`. The invariant in
+`tests/release-version-line.test.ts` therefore failed on every descendant commit. Six
+otherwise unrelated bug pull requests inherited that red result, making their own changes
+look suspect.
+
+#2836 advanced the `dev` version line to 2.36.0. That value followed repository precedent:
+after a published preview, `dev` carries the next stable version rather than duplicating
+the preview identifier. The change touched only the version field and did not promote
+`preview` or `main` or alter release automation.
+
+The focused version-line test passed after the change, and the inherited failures cleared
+on the downstream pull requests. The practical lesson is to test a repeated failure
+against the common base before repairing each branch independently. One stale line in the
+base had more leverage than any individual merge.

devlog/_fin/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md

@@ -0,0 +1,18 @@
+# wp2 — Contributor patch preservation
+
+This lane completed through #2839, which landed the credited patches from contributor pull
+requests #2799 and #2798. Both contributor pull requests were then closed as landed with
+cross-references.
+
+The campaign did not force-push the contributor fork branches. A force-push would have
+reset the enforce-target four-box readiness checklist and detached the existing review
+evidence from the branch state. Instead, the approved commits were applied to a
+maintainer-owned current-`dev` branch with `git cherry-pick -x`.
+
+Before landing, the original and carried-forward patches were compared with
+`git patch-id --stable`; authorship and patch intent were preserved. Focused tests covered
+the catalog verbosity behavior from #2799 and the destination-policy behavior from #2798.
+
+#2798 touched a credential destination boundary. Its findings were addressed, but it is
+part of the campaign-wide governance gap recorded in `070_wp7_closeout.md`: no available
+credential could provide a formal non-author approval.

devlog/_fin/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md

@@ -0,0 +1,13 @@
+# wp3 — Stale and inherited-red branches
+
+This lane completed with #2822, #2821, and #2785 merged to `dev`.
+
+At triage, each branch looked blocked or unstable, but the relevant red checks were either
+the inherited release-version failure or stale-base noise. After #2836 repaired the shared
+base, the branch-specific focused checks and exact-head CI could be read as evidence about
+the actual patch.
+
+Patch identity and changed-file scope were checked during the base movement. No unrelated
+behavior was folded into these merges. This lane confirmed the keystone diagnosis: once
+the common version-line defect was gone, the three independent fixes could be evaluated
+and landed on their own merits.

devlog/_fin/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md

@@ -0,0 +1,17 @@
+# wp4 — OAuth 429 rotation closeout
+
+The stale #2807 branch was replaced by #2841, which landed the OAuth-origin rebind on
+current `dev`; #2807 was closed as landed with a cross-reference. Independent review then
+found three additional cross-account origin sites and found that caller credentials could
+share the operator account's `__main__` health state. An invalid caller token could
+therefore mark the operator's own account as needing reauthentication.
+
+Those defects were repaired and regression-tested before closeout. The tests were checked
+for anti-vacuity by restoring the faulty behavior and confirming that the focused
+regression turned red. The separate #2852 follow-up belongs to the shadow-call lane and is
+recorded in `060_wp6_lane_e_prless_bug_issues.md`.
+
+This was a credential surface. The technical findings were posted publicly as review
+comments and fixed, but the merge did not receive a formal non-author approval because all
+available credentials authenticated as the repository owner. That remains a governance
+gap rather than a satisfied review gate.

devlog/_fin/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md

@@ -0,0 +1,26 @@
+# wp5 — Current-`dev` reimplementations
+
+This lane replaced stale, overbroad, or partially correct branches with narrow changes on
+current `dev`.
+
+#2842 carried the valid part of #2812 and closed #2810 without broadening the fake-IP
+classification. #2843 replaced #2796 and closed #2717 with consistent AgentRouter identity
+handling. #2844 replaced #2797 and made the doctor `env_key` check safe, but issue #2713
+remains open because that change covered only part of the issue's requested behavior.
+#2835 landed its focused Kiro behavior without carrying the earlier host-identifying
+measurement note.
+
+#2847 replaced the overbroad #2793 branch with the narrow #2718 keyring fix. #2848 replaced
+the very stale #2497 branch with a current-`dev` repair for #2221. #2850 replaced #2744's
+combo-recovery work without its unrelated version hunk, and #2851 repaired defects found by
+the independent follow-up.
+
+The combo-recovery review found two important verification failures. One test passed when
+unrelated plaintext was present, so it did not prove that the intended recovery path ran.
+The implementation also wrote secret bytes before hardening the temporary file's
+permissions. Both were fixed, and mutation runs demonstrated that the focused tests failed
+when each defect was restored.
+
+Contributor pull requests #2812, #2796, #2797, #2793, #2744, and #2497 were closed only
+after their replacements landed, with credit and cross-references. Credential-related
+members share the unresolved formal-review gap described in `070_wp7_closeout.md`.

devlog/_fin/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md

@@ -0,0 +1,12 @@
+# wp6 — Bug issues without a landing pull request at triage
+
+This lane ended with one landed repair, one reporter closure, and one unreproducible report.
+
+Issue #2706 was fixed by #2849. Independent review found a remaining defect in the
+accumulated path, and #2852 supplied the follow-up before closeout. Issue #2833 was closed
+by its reporter rather than claimed as a campaign fix. Issue #2813 could not be reproduced
+and was recorded as unreproducible rather than closed as fixed.
+
+Other triage candidates remained outside this campaign when they could not be triggered and
+observed in the available environment or overlapped work that required a different scope.
+The campaign did not convert lack of reproduction into a success claim.

devlog/_fin/260829_bugpr_zero_remaining/070_wp7_closeout.md

@@ -0,0 +1,58 @@
+# wp7 — Terminal closeout
+
+The campaign reached its terminal criterion: the open pull-request query for the `bug`
+label returned an empty array after starting at sixteen.
+
+## Landed work
+
+The bug-fix train on `dev` consists of #2835, #2822, #2821, #2785, #2839
+(the credited cherry-picks from #2799 and #2798), #2845 (the credited #2638
+cherry-picks), #2843 (the #2717 AgentRouter repair), #2842 (the #2810 fake-IP repair),
+#2846 (the credited #2828 cherry-picks plus the #2830 repair), #2849 (the #2706 shadow
+call repair), #2850 (the #2744 combo-recovery replacement), #2847 (the #2718 keyring
+repair), #2844 (the doctor `env_key` repair), #2841 (the #2807 OAuth-origin rebind), and
+#2848 (the #2221 native-main refresh repair).
+
+The campaign also merged #2836 to repair the inherited version-line failure, #2840 to
+clean up the CI namespace, #2837 for the roadmap and executable review gate, #2852 as the
+independent follow-up to #2849, and #2851 as the independent security follow-up to #2850.
+
+## Contributor pull-request dispositions
+
+Pull requests #2799, #2798, #2638, #2828, #2812, #2796, #2797, #2793, #2744, #2497,
+and #2807 were closed as landed through the replacement pull requests above. Their close
+comments credited the original authors and linked the current-`dev` landing.
+
+The use of `git cherry-pick -x` and `git patch-id --stable` mattered here. It allowed
+approved contributor patches to land with authorship intact, while leaving contributor
+fork heads alone and avoiding enforce-target checklist resets caused by force-pushes.
+
+## Issue dispositions
+
+Issues #2717, #2810, #2706, #2718, #2830, and #2221 were closed with references to the
+merged fixes. Issue #2713 remains open because the doctor change in #2844 covered only
+part of the requested behavior. Issue #2833 was closed by its reporter. Issue #2813 was
+unreproducible and was not closed as fixed.
+
+## Verification lessons
+
+The version-line keystone demonstrated that a shared base failure can make unrelated
+branches look defective. Repairing that base first removed inherited red from six pull
+requests and made later branch evidence meaningful.
+
+Green CI was repeatedly insufficient as a completion claim. Independent review found
+seven fail-open paths in the review gate, three omitted cross-account origin sites in the
+429 repair, caller credentials contaminating the operator's `__main__` health state, a
+#2830 branch that never executed, a recovery test satisfied by unrelated plaintext, and a
+temporary-file permission ordering flaw. All were fixed before closeout. The strongest
+tests were anti-vacuity mutations: reintroduce the defect and confirm that the focused test
+turns red.
+
+## Governance gap
+
+Credential-surface changes did not receive a formal non-author approval. Every credential
+available in the campaign environment authenticated as the repository owner, and GitHub
+does not permit self-review. Independent findings were left as comments and addressed by
+follow-up commits and pull requests, but that does not satisfy the formal review rule in
+`MAINTAINERS.md`. Future campaigns need a genuinely separate reviewer identity or another
+enforceable governance mechanism.

devlog/_fin/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md

@@ -0,0 +1,19 @@
+# wp9 — Current-head re-audit of #2638 and #2828
+
+This lane completed with both contributor branches preserved through credited
+current-`dev` replacements.
+
+#2845 landed the relevant #2638 commits after current-head review and patch-equivalence
+checks. #2846 landed the relevant #2828 commits and added the #2830 repair. The original
+pull requests were closed as landed with cross-references rather than being judged from
+reviews attached to superseded heads.
+
+Independent review of #2846 found that the first #2830 repair never executed because it
+was placed behind `orphans.length === 0`. The branch condition was corrected, and an
+anti-vacuity mutation restored the unreachable arrangement to prove the regression test
+would fail.
+
+This lane reinforced two campaign rules. Review evidence belongs to the exact head it
+examined, and green tests are not enough when the test can pass without activating the
+changed branch. Credential-surface findings were fixed and posted as comments, while the
+lack of a formal non-author approval remains recorded as an open governance gap.