…ed (PR #3692) (#3693)

Highest-value-per-effort substrate of session — mechanizes the bug class
that shipped twice this session (5-`..` paths resolving to docs/ instead of
repo root). 255-line audit walks 833 shards, found 17 pre-existing
findings as detect-only baseline. Followup: cleanup PR + enforce gate
following same 4-step pattern as §33 migration xrefs (PR #3513 → #3529 →
#3548 → #3552 → enforce).

GraphQL still 0/5000 (resets 02:55:28Z); REST sufficient for PR creation.
Auto-merge arming on #3690 + #3692 deferred to post-reset tick.

Co-authored-by: Claude <noreply@anthropic.com>

…cleanup (#3697)

GraphQL reset at 02:55:28Z. Arm wave on 4 queued PRs (3690/3692/3693/3695):
- #3693 was already MERGED at 02:55:44Z by AceHack (16s after reset)
- #3690 + #3692 + #3695 armed (auto-merge squash)

8 unresolved threads investigated:
- #3690 (1 thread): table-pipe complaint = Copilot false positive (verified
  by awk; lines 18/37/65 all use single |). Resolved no-op.
- #3692 (4 threads): ALL real — sonarjs disable comment, main+import.meta.main
  guard, generic URI scheme regex (ftp/file/tel/data), --files validation.
  Fixed via commit d299c7d. Resolved.
- #3695 (3 threads): 2 real prose errors in 0252Z shard (wrong rule citation;
  wrong TTL math), 1 stale link (0249Z.md now on main via merged #3693).
  Fixed via commit e0828b5. Resolved.

3 PRs queued + armed + thread-clean: #3690 #3692 #3695. Awaiting CI.

Discipline reinforced: verify-before-fixing applies to Copilot reviewer
output too. Direct line-level inspection (awk) beats taking review at face
value.

Co-authored-by: Claude <noreply@anthropic.com>

…3691)

* shard(tick): 2026-05-16T02:45Z — GraphQL exhaust on --all-open poll

- Bg-worker session opened, refreshed worldview (45 PRs), then
  poll-pr-gate-batch.ts --all-open hit graphql 0/5000 across 44 errors
- Documented exact failure mode warned by refresh-world-model-poll-pr-gate.md
  cost-awareness section (1.4 --all-open polls per agent-hour with 4 agents
  sharing Aaron's token)
- Bounded named-dependency wait: graphql resets 02:55:28Z (~10 min)
- N=1 brief-ack with concrete substrate output; counter resets per
  holding-without-named-dependency clause
- Lior-gemini active (ps -A); honored no-new-worktree safe-window check
- Otto-owned PRs #3677, #3690, #3649 surveyed via REST (GraphQL-free) for
  next-tick targeted poll plan

Composes with: refresh-world-model-poll-pr-gate.md,
holding-without-named-dependency-is-standing-by-failure.md,
codeql-no-source-on-docs-only-pr-is-broken-commit-canary.md

* fix(shard): explain 45→44 PR-count delta in 0245Z tick (Copilot #3691)

The 02:39Z refresh saw 45 open PRs; the 02:41Z `--all-open` batch
internally re-queried `gh pr list --state open` and got 44.
The delta is cascade-window drift (one PR closed in the 2-minute
interval), not a filter — clarify on the bullet so the record is
internally consistent.

Resolves Copilot thread on docs/hygiene-history/ticks/2026/05/16/0245Z.md L16.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

The sweep description on L58 duplicated "main" ("on origin/main main").
Tightening to "on \`origin/main\`" preserves the intent (sweep target =
the main branch) and clarifies it's a ref-name, not free text.

The other two Copilot threads on this PR are addressed in the reply:
- L44 MD038 alarm is a false positive (the literal `` `git ` `` instances
  live inside ` ```text ` fenced blocks; MD038 only fires on inline code
  spans; markdownlint exits 0 locally).
- L33 cross-reference to 0240Z.md is no longer stale — PR #3690 has
  merged and the file is present on main.

Co-Authored-By: Claude <noreply@anthropic.com>

…+ sweep (#3707)

* shard(tick): 2026-05-16T03:22Z — PR #3690 markdownlint MD038 unblock + sweep

PR #3690 had been "armed, awaiting CI" since tick 6 (~70 min ago) — turned
out to be a REQUIRED check FAILURE on lint (markdownlint), not "still
running". MD038/no-space-in-code triggered on `git ` (trailing space inside
backticks) at 0240Z.md:20.

Fixup 81b2f1a: rewrite "prepend `git ` to" → "prepend the `git` prefix to".
Same semantic, no trailing space in code span. markdownlint-cli2 local
exit 0.

Sweep of all 2026-05-16 shards on main: 0 other MD038 violations.

Lesson: required-check failures are a distinct merge-block class from
unresolved-threads + non-required-check warnings. poll-pr-gate.ts's
nextAction field disambiguates. PR #3701 also merged 03:16:50Z (carry-over).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(pr-3707): MD038 self-bite — pre-commit check caught what shipped

Same MD038 class I described in this very shard. Line 44 used a literal
backtick-git-space-backtick to illustrate the bug pattern, which IS the
bug. Inside fenced code blocks (lines 41, 51) the pattern is safe.

Rewrite line 44 to describe the pattern in prose without using the literal
trailing-space-in-backticks form. markdownlint-cli2 → exit 0.

Lesson: pre-commit MD038 self-check would have caught this before push.
Adding to the discipline list.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(shard): typo "main main" → "`origin/main`" in 0322Z (Copilot #3707)

The sweep description on L58 duplicated "main" ("on origin/main main").
Tightening to "on \`origin/main\`" preserves the intent (sweep target =
the main branch) and clarifies it's a ref-name, not free text.

The other two Copilot threads on this PR are addressed in the reply:
- L44 MD038 alarm is a false positive (the literal `` `git ` `` instances
  live inside ` ```text ` fenced blocks; MD038 only fires on inline code
  spans; markdownlint exits 0 locally).
- L33 cross-reference to 0240Z.md is no longer stale — PR #3690 has
  merged and the file is present on main.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

… review)

- Merged origin/main: adds 0322Z.md to tree so parent-tick link
  resolves at review time (was P0 copilot + P2 codex finding;
  link target existed on main but not on the PR branch)
- "landed" → "opened (armed for auto-merge)" for #3708, since
  the lifecycle table marks it as armed not merged (copilot)
- Table-syntax finding (||) is a false positive — table uses
  single | (line 18: `| ~~#3690~~ ...`)

… gate (PR #3708) (#3709)

* shard(tick): 2026-05-16T03:28Z — audit-script lifecycle CLOSED via CI gate (PR #3708)

3 PRs landed during tick 13 cycle (#3699 baseline mechanism, #3703 0316Z
shard, #3690 finally after MD038 fix). The audit-script lifecycle is now
structurally complete: discovery → narrow-fix → scanner → quality × 3 →
baseline → CI enforce gate. PR #3708 ships the gate.

Same §33-audit lifecycle pattern (PR #3513 → #3552 → enforce), compressed
across 14 ticks of one session.

Local gate-invocation verify on main + new files: 842 shards, 10
grandfathered, 0 NEW, exit 0. The earlier transient 0249Z.md:4 → 0240Z.md
finding self-resolved when PR #3690 merged.

TodoWrite adopted this tick for the 4-step gate-wire (wire → verify → PR →
shard). Aligned naturally with per-tick discipline.

Co-Authored-By: Claude <noreply@anthropic.com>

* shard(tick): 0328Z — fix parent-tick link + status-term drift (PR #3709 review)

- Merged origin/main: adds 0322Z.md to tree so parent-tick link
  resolves at review time (was P0 copilot + P2 codex finding;
  link target existed on main but not on the PR branch)
- "landed" → "opened (armed for auto-merge)" for #3708, since
  the lifecycle table marks it as armed not merged (copilot)
- Table-syntax finding (||) is a false positive — table uses
  single | (line 18: `| ~~#3690~~ ...`)

---------

Co-authored-by: Claude <noreply@anthropic.com>

…stale/FP) (#3715)

PR #3707 + #3708 merged. 6 new Copilot threads investigated:
- PR #3710 (AUDIT-LIFECYCLE.md): 2 real — name attribution (Codex/Riven →
  role-refs) + §33 PR-attribution factual error (PR #3552 baseline cleanup
  + PR #3555 CI enforce, not both #3552). Fixup cd7ba81.
- PR #3709 (0328Z shard): 4 threads — 2 stale (0322Z merged via #3707),
  1 minor prose-drift, 1 false-positive (4th time on table-pipes). All
  resolved no-op.

The Copilot table-pipe || hallucination is now a 4-time pattern (#3685,
#3690, #3699-era, #3709) — verify-first-resolve-no-op discipline.

Co-authored-by: Claude <noreply@anthropic.com>

…ify-before-fix discipline (#3721)

* rule(verify-reviewer-findings): extend blocked-green-ci rule with verify-before-fix discipline

Extends `.claude/rules/blocked-green-ci-investigate-threads.md` with a
composes-with section on verifying reviewer findings before applying
fixes. Captures empirical evidence from the 2026-05-16 autonomous
session:

1. Verification anchors: direct line-level awk inspection; gh api +
   git log for cross-reference claims; local lint/build re-run.

2. Suspect-by-default Copilot finding classes: table double-pipe (||)
   hallucination — 4 confirmed FPs in one session (PR #3685, #3690,
   #3699-era, #3709), all verified by direct awk as single-| rows.

3. Stale-but-fresh-looking findings: parent-tick links to shard files
   in sibling PRs (true at filing-time, self-healed by review-time);
   "X-status vs Y-status inconsistency" prose observations (accurate
   at write-time but underlying state moved). Resolve no-op.

Threshold for adding a Copilot finding to the suspect-by-default list:
two-or-more across distinct PRs.

Markdownlint clean on the rule file. (The new check-shard-before-push.ts
helper flagged 3 false-positive MD032s on bullet-continuation lines —
filing as next-tick fix for the helper itself.)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(pr-3721): 2 Copilot findings — runnable awk + git log commands

P0 (line 35): awk one-liner used `<N>` as a literal placeholder; if copied
verbatim, awk treats `N` as uninitialized (defaults to 0) and prints
nothing. Show `-v N=22` (literal value substitution) + explain the gotcha.

P1 (line 38): `git log <PR-cited-PR>` doesn't work — git log expects
refs/commits/paths, not PR numbers. Replace with three concrete runnable
forms:
  - gh api repos/<owner>/<repo>/pulls/<N> → metadata
  - gh pr view <N> --json commits,mergeCommit → commits via API
  - git log --grep '#<N>' → local-repo merge-commit by PR-number

Both fixes preserve the intent (verification anchors) while making the
commands directly runnable.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>