Review-debt drain

STATE — Review-debt drain

CURRENT STATE ONLY. Rewritten in place at every pass — this is not a log. History belongs in projects/ops/walkaway/REPORT.md and the CHANGELOG. Plan: PLAN.md beside this file. A fresh agent takes over from these two files alone.

Where it stands — measured 2026-08-23T10:28:06Z (pacer cycle 5, re-measured at write time)

🔴 CYCLE 5 EXHAUSTED THE MECHANICAL DRAIN. There is no drainable row left. Measured at write time: open 30 · over-24h 0 · rows carrying a prove field 0. Guard _test-review-debt.mjs = 42 passed, 0 failed, exit 0. The four rows that still had a recorded proof were all closed this pass, so no future cycle can reduce this count by re-running anything — the decision in NEXT ACTION is now the only way the number moves.

What cycle 5 closed, and on what basis:

🔴 ONE OF THAT COLD CHECK'S OWN FAILS WAS FABRICATED, AND THIS IS THE LESSON WORTH CARRYING. z8eqk2 stated "a repository-wide search for CHANGELOG (and CHANGELOG.md) returned zero matches" and concluded the file was absent. Refuted by measurement this pass: ls -la CHANGELOG.md returns a 284,865-byte file at the repo root modified 2026-08-23 05:12, and find . -maxdepth 3 -iname 'CHANGELOG*' returns 20+ hits. The worker searched only projects/ops/walkaway/CHANGELOG.md and reported a repository-wide negative it never ran. A checker's FAIL is a claim like any other — re-open the thing before acting on it.

✅ Its OTHER fail was correct and has been acted on: this file's own "rows open: 31" was stale. Corrected in place.

✅ DEFECT IN THE PACER'S OWN TOOL — FOUND, RECORDED, AND NOW FIXED (cycle 9, 2026-08-23). The history below is kept so nobody re-imposes the old workaround by guess; read to the end of this paragraph before acting on any of it. drive-beat.mjs beat --note "..." is silently ignored: beat reads --dispatch and --items; --note belongs to the sibling kick subcommand, and the shared usage line lists all three together with no hint which is which. The command reports success and updates the heartbeat timestamp while leaving the PREVIOUS cycle's last_dispatch in place — i.e. the cross-cycle handoff baton silently does not move. Cycle 5 hit this and caught it only by re-reading list instead of trusting the echo. Logged mx-38cee1822a; guard proposed ag-9b4d555773. Not patched this pass because drive-beat.mjs is unattended code and needs the triad plus a regression artefact. ✅ FIXED AND VERIFIED 2026-08-23 BY PACER CYCLE 9 — THIS WARNING IS RETIRED. --note NOW WORKS ON beat. Do not go on avoiding it. beat accepts BOTH --items N --dispatch "..." and --note "...", and an unrecognised flag is now REFUSED out loud (drive-beat: 'beat' does not accept --bogusflag (no subcommand accepts it)) instead of silently dropped — the silent-ignore bug class is closed, not just the one instance. Tested on THIS row: a canary note written with --note landed in last_dispatch. Two guards cover it and the overnight suite runner that globs them is confirmed alive (it ran 09:32 and 10:29 today): _test-drive-beat.mjs 14/0 and _test-drive-beat-flags.mjs 8/0. The new guard was negative-controlled — planting the old behaviour in a scratch copy drove it to 1 passed / 7 failed — so it can genuinely fail. Live file sha256 2e136db1de9480bf. 🔴 STILL TRUE AND WORTH KEEPING: re-read list after any write. The echo is not evidence.

Where it stands — measured 2026-08-23T09:59Z (pacer cycle 4, re-measured at write time)

🔴 The number below is the LIVE count at the moment of writing, not this pass's mid-point. An earlier draft of this header said 31 — true mid-pass, stale by the time it was read, and caught by an independent checker. The drive's own contribution this cycle was 36 → 31; two further rows then arrived from other running work.

🔴 DO NOT READ AN OPEN COUNT OUT OF THIS FILE. Run the command — the count moves while you read.

node -e "import('./projects/ops/skippy-jobs/lib/outside-review-ledger.mjs').then(m=>{const o=m.openDebt({olderThanHours:0});const n=Date.now();console.log('open',o.length,'over24h',o.filter(r=>n-Date.parse(r.at)>864e5).length)})"
node projects/ops/skippy-jobs/_test-review-debt.mjs

Why this file no longer states a live count, and it is not fussiness. Three separate numbers were written into this header during a single pass — 31, then 33, then 34 — and each was true when written and stale within minutes. Other sessions open rows on this machine continuously, and draining the ledger itself opens rows, because dispatching a checker is dispatched work. A static file cannot hold a moving number honestly. An independent checker caught the 31; the 33 went stale before the correction was saved.

What IS stable and safe to read here: at 09:56:43Z the guard returned 42 passed, 0 failed, exit 0, and 0 rows were over 24 hours. Cycle 3's one-off 37 passed / 5 failed did not reproduce in four re-runs. This drive's own contribution this cycle was five rows discharged; the total moved 36 → 31 by its own work and then rose again from other traffic.

🔴 THE DEADLINE IS REAL AND IT IS TODAY: the oldest open row crosses 24h at 2026-08-23T15:54:14Z. From that moment the guard goes red and — on the evidence below — can never go green again without a decision, because these rows have nothing left to review.

What cycle 4 did

Drained everything that was drainable, then removed one row that should never have been debt:

🔴 Every one of those proofs was negative-controlled before it was accepted, because a proof that cannot fail is decoration. For the two route- rows a wrong-expectation variant of the same shape (js/panel.js?v=99 instead of v=12) exited 1. For the two cheap- rows a missing-file variant exited 1. Both shapes can fail; both passed on the real subject.

test-roundtrip-001 was never real work — measured, not inferred

It is line 1 of the production ledger: {"runId":"test-roundtrip-001","tool":"test-worker","vendor":"qwen","files":2,"task":"sample build task"}. No file, no proof, no dispatcher. It is the synthetic seed row written when the ledger was created, and it was the row that would have tripped the 24h guard first.

Searches that could have matched and did not — the terms come from the row's own field values, not from the vocabulary of the fix:

• command grep -rn "test-roundtrip" projects/ .claude/ — every hit is an unrelated Skippy School KV date string in functions/api/skippy-results.js, plus one line of REBUILD-RECORD.md that merely lists this row. No code emits this runId into the review ledger.
• command grep -c '"tool":"test-worker"' projects/ops/skippy-jobs/lib/outside-review-ledger.jsonl → 1. One row, ever. This is a one-off seed, not an ongoing leak, so no code fix is owed.

🔴 CYCLE 4's FINDING — this is the one that changes the decision

The 31 remaining rows carry no file and no task. Not "a truncated proof" — nothing to review at all.

Measured this pass over the live ledger:

• rows open: 31 — 🔴 STALE FIGURE, CORRECTED BY PACER CYCLE 5 (2026-08-23T10:26Z). 31 was true mid-pass on cycle 4 only. The ledger held 33 at that cycle’s own final measurement, 34 when cycle 5 opened, and 30 after cycle 5 drained the four rows that carried a runnable proof. 🔴 THE STANDING COUNT NEVER COMES FROM THIS FILE — it comes from the command: node -e "import('./projects/ops/skippy-jobs/lib/outside-review-ledger.mjs').then(m=>console.log(m.openDebt({olderThanHours:0}).length))". An independent DeepSeek cold check flagged this exact line as a FAIL and it was right.
• carrying a file / dir / target field: 0
• carrying any non-empty task text: 8 (so 23 have an empty task string)
• carrying a prove field: 1 — cheap-1787473654437-03lxw3 alone, and its proof points at .tmp-rowcheck/CHECK.md, which was cleaned up. Re-run this pass: literal EXIT_A=1. It is category D — a recorded proof that is not a re-runnable one — so it is open debt that no amount of shell access can discharge.
• still-open legacy-route-build-* rows: 15 (section B's table below lists 21; six of those were closed by earlier cycles and the table has not been re-cut)

Those 15 legacy rows are the worst case: task is "", idDerived is true, and there is no file field. The only pointer to what any of them touched is the 286-character truncated proof prefix recovered from route-build.log, listed in section B below.

🔴 This kills the obvious rescue plan, so it is written down rather than left to be rediscovered. The natural idea — "forget the lost proof, just cold-read the file the run touched and judge it against the task" — cannot be executed from the ledger, because the ledger row records neither the file nor the task. The file name survives only in section B's recovered log line, and the intent survives nowhere. A reviewer cannot grade work when the record does not say what the work was.

NEXT ACTION — one decision, and it is not the pacer's to make

The three honest options, unchanged from cycle 3 and now backed by the field-level measurement above:

1. Close all 31 with the basis recorded verbatim as "pre-fix row: the ledger records no file, no task and no proof, so there is nothing to review" — same shape as the test-roundtrip-001 close above, which is the precedent. Fast, honest, and the record survives in each --by string.
2. Add an explicit pre-fix exemption to the guard so it stops counting rows written before the proof-recording fix. This is a change to something unattended, so it needs the triad and a regression artefact before it ships.
3. Let the guard go red at 15:54Z and treat that as a true signal.

🔴 Option 3 has a cost the first two do not: a guard that is permanently red is indistinguishable from no guard at all. That is the argument against simply waiting.

This is a judgment call about what the guard is FOR, so it belongs to Nick or to the drive's owner. It is recorded here — a passive file he opens when he chooses — and is deliberately NOT pushed to any surface.

✅ CYCLE 4's RECORDS — COLD-CHECKED, INDEPENDENT (DeepSeek, 2026-08-23T09:56Z)

An outside agent that did not write any of this re-checked four claims straight against the raw ledger file, quoting whole lines verbatim rather than summarising them. 4/4 PASS:

• Exactly five closes carry pacer-cycle-4, all verdict pass — all five quoted with their runIds and timestamps (ledger lines 177–181).
• Ledger line 1 is test-roundtrip-001 / tool:"test-worker" / task:"sample build task" — quoted whole.
• cheap-1787473654437-03lxw3 has an open event and no close — quoted; still correctly open.
• test-roundtrip-001 has exactly two lines, one open and one close — both quoted.

🔴 Two rows this cycle may NOT close, and the reason is structural, not an oversight:

• cheap-1787478992360-ho6mmb — opened by this cycle's own cold-check dispatch. The pacer dispatched it, and a reviewer may never be its own dispatcher, so the NEXT cycle closes it.
• route-1787478828275-ufn626 — opened at 09:53:48Z by a different, concurrent session on this machine, not by this drive. Draining the ledger while other work is running means the count is a moving target; that is normal, not a leak.

Final measurement of this pass, 2026-08-23T09:56:43Z: 33 open, 0 over 24 hours, guard 42 passed, 0 failed. Open reached 31 mid-pass and rose to 33 as two new rows arrived from elsewhere — the drive's own contribution this cycle was 36 → 31.

What the verdict lane actually found — the 8 genuine defects

None of these are "the check failed, therefore broken". Each was opened and diagnosed:

• 4 rows: the work was genuinely undone or superseded. Family-app cache-buster and panel-filtering changes from v335 were reverted at v336–v338 by later, stricter fixes. The requirement still holds under the new code; that run's implementation does not.
• 3 rows: the check was a one-time canary that can never pass twice. A marker string was inserted to prove a drift detector worked, then removed — so re-running it can never find it again. In each case the PAIRED real check passes. These are stale checks, not broken work.
• 1 row: a check that could not fail. Running a tool with no arguments prints a usage banner and exercises nothing. Its recorded exit code was also wrong.

🔴 One row exposed a defect in CYCLE 1's own evidence: the re-run worker recorded EXIT 0 for a row whose own pasted output showed two FAILs. The verifier re-ran it independently, got exit 1, and opened the file to confirm. Caught downstream, as it should be — but it is the reason a worker's summary is never relayed without the raw data beside it.

The rows still open — the 31 pre-fix rows below, plus 4 others

🔴 SUPERSEDED BY CYCLE 4 — re-measured 2026-08-23T09:53:07Z: 31 open, of which 30 carry no proof at all and 1 (cheap-1787473654437-03lxw3) carries an unrunnable one. The four rows cycle 3 called drainable were drained this pass. The tables below have NOT been re-cut and still list rows that are now closed: treat them as the historical evidence of what each row's proof looked like, never as the current open list. The current open list comes from the command, not from this file.

B · Proof UNRECOVERABLE — cut off by the send log's own 300-character cap (21)

_Direct evidence of truncation, not an inference: all 21 are exactly 286 characters long (300 minus the 14-character proof passed: prefix) and every one of them ends part-way through a word or a quoted string. The command cannot be re-run because the end of it no longer exists anywhere._

C · ~~Proof UNRECOVERABLE — no proof line was ever written~~ 🔴 DISPROVED 2026-08-23 — ALL TEN WERE RECOVERABLE AND ALL TEN WERE GRADED

🔴 DO NOT ACT ON THIS SECTION. Its heading and its search note below are WRONG and were disproved on 2026-08-23. They are kept, unedited, because this section personally misled a later pacer cycle into accusing another agent of fabricating nine review verdicts — an accusation that was written into the changelog, this drive's report, the heartbeat and a board card before it was retracted (mx-883c7fa08f). A stale section is not harmless; this one manufactured a false accusation.

What was actually true: the search below looked in projects/ops/route-build.log ONLY. A second log exists and nobody had searched it — projects/ops/skippy-jobs/lib/cheap-build-sends.log (1,521,165 bytes, confirmed on disk 2026-08-23), which records the task, the taskKey and the files touched for every cheap dispatch, and matched all ten rows by timestamp within ~200ms of their ledger open.

Outcome: all nine remaining rows were graded on 2026-08-23 at 14:06:33Z — seven held up, two failed. The two failures are real and independently re-verified: the runs' own logs claim they wrote projects/ops/.cheap-task-final-verdict.txt and projects/ops/_pass12b-insert.mjs, and neither file exists on disk. Those two run ids are exactly the two closed defects.

The lesson this section earns: "cause found in the source, not guessed" below is the sentence that made it feel settled. The cause was found in ONE source. Naming a mechanism for an absence makes the absence feel proven, and it is the most convincing way to be wrong — a mechanism explains why you found nothing; it never proves there was nothing to find. A negative needs every store that could hold it enumerated, not one store plus a plausible reason.

<details><summary>The original section, kept verbatim and retired — read as history, never as current state</summary>

(retired) Proof UNRECOVERABLE — no proof line was ever written (10)

_Search made: every line of projects/ops/route-build.log carrying the string proof passed: (162 lines) was matched against each open row by timestamp, widening the window to 1s, 5s, 30s and 120s — the match count stopped moving at 1 second and these rows never matched at any width. Cause found in the source, not guessed: cheap-task.mjs writes an open row via openRow() but never records the proof command anywhere, so for these there is nothing to find._

</details>

Standing rules for whoever picks this up

• Closes go ONLY through node projects/ops/skippy-jobs/lib/record-review.mjs --run <id> --verdict <pass|defects> --by "<reviewer, not the dispatcher>" — a direct append to the JSONL is a contract breach (PLAN.md §3).
• Reviewer ≠ dispatcher; record-review refuses the match in code when the open row records a dispatcher.
• A defects verdict routes the defect to the file's owner — never fix the artifact in this lane (anti-scope).
• An unrunnable proof is a FINDING with the exact search named, never a pass.
• Every cycle: beat the heartbeat, rewrite this file, append the REPORT.md block.
• 🔴 cheap-task.mjs --dir MUST BE A REPO-RELATIVE PATH INSIDE THE REPO. It is compared as a literal string prefix against path.relative(REPO, abs) (cheap-task.mjs:813-816, fence at :869), so an absolute path — especially a /private/tmp scratchpad — can never match. It fails SILENTLY in the worst way: the vendor does the work, every write_file is refused, it burns its whole 24-step budget retrying path spellings, reverts, and exits 0 — so it reads as a slow or empty vendor, not a dispatch error. Two consecutive cold checks were lost to this on 2026-08-23 (mx-a3af21586e). Use something like --dir ".tmp-rowcheck".
• 🔴 openDebt compares age STRICTLY greater than its threshold, so {olderThanHours: 0} silently excludes any row written in the same millisecond as the call. Irrelevant for real rows, fatal in a test — pin now ahead if you assert on it.

• 🔴 THE RE-RUN LANE NEEDS A SHELL, AND NEITHER ROUTE THE RULES OFFER HAS ONE. cheap-task.mjs gives its vendor only list_files/read_file/search/write_file (cheap-task.mjs:719-725) — an outside vendor cannot execute a proof command at all. Dispatching the Anthropic exerciser agent instead is refused by the work-type gate as unclear. Until that is resolved, the overseer runs the proofs in its own shell and records every command and literal exit code, which is what cycle 3 did. Do not read PLAN.md §3's "DeepSeek V4" executor as achievable.
• 🔴 A RECORDED PROOF IS NOT AUTOMATICALLY A RE-RUNNABLE ONE (category D). Six of cycle 3's twelve proofs pointed at another session's /private/tmp/.../scratchpad/*.sh; they happened to still exist and passed. One pointed at .tmp-rowcheck/CHECK.md, which had been cleaned up, and is now permanently unprovable. A proof whose subject is scratch dies with the scratch.

⚡ KICK — 2026-08-23T09:5xZ (pacer cycle 4): drive session dead (session_id null) and stalled after three prior kicks, so the pacer ran one bounded pass from PLAN.md + STATE.md. Drained all 4 drainable rows (all pass, each negative-controlled), disposed of the synthetic seed row, and measured the field-level finding above. Open went 36 → 31. Guard re-run green (42/0). One decision left, recorded in NEXT ACTION, not pushed anywhere.

⚡ KICK — 2026-08-23T09:53:50.994Z: session dead (session_id null) + stalled after three prior kicks — pacer cycle 4 ran one bounded pass from PLAN.md + STATE.md: drained 4, disposed of the synthetic seed row, open 36->31, guard green 42/0, field-level finding recorded

🔴 STALLED — 2026-08-23T10:17:54.611Z: heartbeat last touched 2026-08-23T09:57:15.600Z (~21 min ago) while status=active. Detected by drive-beat.mjs check; the pacer (full-speed-swarm-drive) kicks stalled drives — see its Step 0.5.

⚡ KICK — 2026-08-23T10:18:31.355Z: session dead (session_id null) + stalled after four prior kicks — pacer cycle 5 running one bounded pass from PLAN.md + STATE.md

🔴 STALLED — 2026-08-23T11:22:29.705Z: heartbeat last touched 2026-08-23T10:59:31.976Z (~23 min ago) while status=active. Detected by drive-beat.mjs check; the pacer (full-speed-swarm-drive) kicks stalled drives — see its Step 0.5.

⚡ KICK — 2026-08-23T11:23:10.249Z: session dead (session_id null) + stalled after five prior kicks — pacer cycle 8 ran one bounded pass: measured open debt 33 (up from 30, three rows opened by this cycle's own outside runs and not closeable by their dispatcher), heartbeat refreshed, no rows drained, nothing pushed to Nick

🔴 STALLED — 2026-08-23T12:12:04.764Z: heartbeat last touched 2026-08-23T11:51:36.598Z (~20 min ago) while status=active. Detected by drive-beat.mjs check; the pacer (full-speed-swarm-drive) kicks stalled drives — see its Step 0.5.

⚡ KICK — 2026-08-23T12:17:49.383Z: Pacer cycle 10 takeover: session dead, stalled after 6 kicks. Ran one bounded pass. MEASURED open debt = 35, not the 34 in cycle 9's beat (openDebt({olderThanHours:-1})). 🔴 THE FINDING THIS CYCLE: openDebt's DEFAULT is olderThanHours=24, and at that threshold it returns 0 — the oldest unclosed row is 2026-08-22T15:54:14Z, ~20.4h old at 12:15Z. So the 24h review-debt alarm has NOT fired yet and is silent for a reason that is not health: 30 rows cross 24h at ~15:54Z TODAY. Cycles 4-9 all worked t

🔵 CORRECTION FROM THE PACER — 2026-08-23T12:4xZ, cycle 11. Cycle 10's heartbeat says "openDebt() is called by NOTHING in production… so the '24h unreviewed' alarm this drive is premised on does not exist as running code." That half is WRONG and I am correcting it before a later cycle builds a second alarm on the strength of it. The alarm is wired and runs unattended: _test-review-debt.mjs:1030 calls openDebt against the REAL ledger path inside checkProductionDebt(), and jobs/test-suite-runner.mjs globs _test-*.mjs in that directory nightly and runs every match. Run live by me, not remembered: node projects/ops/skippy-jobs/_test-review-debt.mjs → ✓ Production ledger checked: no unreviewed work older than 24h · 42 passed, 0 failed · exit 0. The mistake is understandable — "it's a test file, so it isn't production" — but in this workspace the nightly _test- glob IS the unattended-guard mechanism, which is exactly what the house rule "ship it with a guard… the nightly runner already globs it" means. ✅ Cycle 10's OTHER finding in the same sentence is CORRECT and survives: the default threshold is 24h, it returns 0 there, and ~30 rows cross 24h at ~15:54Z today. So the alarm is silent for a correct reason, not a broken one. Two claims were bundled; only the first is wrong — do not discard both. Full working in REBUILD-RECORD.md under the same timestamp. Heartbeat deliberately NOT beaten by me: this drive is not stalled right now, and beating it would hide that its session is dead.

🔵 CORRECTION FROM THE PACER — 2026-08-23, cycle 12. The cycle-11 correction above (line ~197) is RIGHT that the alarm is wired and runs unattended, and WRONG about which job runs it. It says "jobs/test-suite-runner.mjs globs _test-*.mjs in that directory nightly and runs every match" — true before the sweep was split into shards, false for THIS file since. Re-derived at write time, not remembered: shardIdOf('_test-review-debt.mjs') = 2 and shardById(2).job = test-suite-runner-b (lib/suite-shards.mjs), and runner.mjs:637 schedules test-suite-runner-b at hours [5] minute 10. So the watcher is jobs/test-suite-runner-b.mjs at 05:10, not the 04:10 test-suite-runner run. ✅ Everything else in that correction survives untouched — the alarm exists, it is unattended, it is silent for a correct reason. Only the job name and the hour were wrong. 🔴 THIS WAS THE THIRD COPY OF THE SAME WRONG SENTENCE: the other two were at REBUILD-RECORD.md (~line 5120) and in CHANGELOG.md ("every night at 4:10am"), both corrected the same day. A fresh read-only checker found this one after the first two were fixed — which is the lesson worth keeping: correcting a claim in the place you noticed it does not correct the copies, and a search written from the defect's own words is what finds them.

🔴 STALLED — 2026-08-23T13:57:39.882Z: heartbeat last touched 2026-08-23T13:36:27.088Z (~21 min ago) while status=active. Detected by drive-beat.mjs check; the pacer (full-speed-swarm-drive) kicks stalled drives — see its Step 0.5.

⚡ KICK — 2026-08-23T13:58:00.091Z: Pacer detected the stall at 13:57Z, at the very END of its own cycle — heartbeat 13:36Z, session_id null (dead). NO bounded pass was run by this cycle and its heartbeat was deliberately NOT beaten, so the stall stays visible rather than being masked by a pacer that did no work. Its two open items are unchanged from cycle 12's note: (a) mistake row mx-571b03a14a needs a supersede pointer to mx-7a7bed08f2, which needs a small change to log.py since no supported supersede operation exists; (b) the

⚡ KICK — 2026-08-23T14:11:28.668Z: Pacer cycle 14 takeover: session dead (session_id null), stalled after 8 kicks. Ran one bounded pass. MEASURED at write time: open(all)=0, open(>24h)=0. 🔴 BUT ZERO IS NOT A CLEAN FINISH AND MUST NOT BE READ AS ONE. I closed exactly ONE row myself (route-1787493379294-dm0yvy, pass) after re-running its own proof AND negative-controlling it (mutated input made the proof exit 1, so its exit 0 is a real signal). The other nine rows that made up the remaining debt were closed at 2026-08-23T14:06:33Z