ops(0-0-0): batch 1 — 7 files promoted to SAFE_TO_RESET_LFG_SUPERSEDES (37 lines)

docs/0-0-0-readiness/CLASSIFICATION.md

@@ -1,8 +1,8 @@
 ---
 title: AceHack/LFG 0/0/0 Reconciliation — file-level classification
-status: in-progress (calibration batch)
+status: in-progress (batch 1 landed; ~139 lines / 11 files remain unclassified)
 created: 2026-04-28
-last_updated: 2026-04-28
+last_updated: 2026-04-29
 ---
 
 # 0/0/0 Reconciliation — file-level classification
@@ -87,67 +87,48 @@ Files needing classification this doc:     23
 
 **Calibration result: 5 of 5 files ALREADY-COVERED.** Hard-reset suffices for all 5; no forward-sync needed.
 
+### Batch 1 (post-strict-bucket-reframe, 2026-04-29T11:32Z)
+
+Per `docs/active-trajectory.md` strict bucket taxonomy: classification requires named AceHack content + named LFG equivalent + named reason. Each entry below promotes from HEURISTIC_LFG_DOMINATES to SAFE_TO_RESET_LFG_SUPERSEDES.
+
+| File | Diff +/- | Status | Evidence |
+|---|---|---|---|
+| `SECURITY.md` | +4/-8 | **SAFE_TO_RESET_LFG_SUPERSEDES** | AceHack has basic disclosure prose ("open a regular GitHub issue with the security label; no separate disclosure inbox"). LFG has the same content PLUS GitHub private vulnerability reporting link, supported-versions section, security-posture section (trust boundaries / crypto choices / dependency audit / static analysis / formal verification details). LFG is strict superset. |
+| `tools/hygiene/validate-agencysignature-pr-body.sh` | +5/-9 | **SAFE_TO_RESET_LFG_SUPERSEDES** | AceHack has older grep-based refactor + a truncated spec reference ("Section 9.2 (Task: none fallback per )"). LFG has cleaner refactored code with proper Section 9.2 reference ("Task: none fallback") + correct spec-doc lineage. LFG is the bug-fixed form. |
+
+**Batch 1 result: 2 of 2 files SAFE_TO_RESET_LFG_SUPERSEDES.** No forward-sync needed.
+
+### Calibration batch reclassification (older "ALREADY-COVERED" label)
+
+The 5 calibration-batch entries above use the prior taxonomy's "ALREADY-COVERED" label, which under the strict bucket rules (named AceHack content + named LFG equivalent + named reason — see `docs/active-trajectory.md` Hard-reset-safety classification) corresponds to **SAFE_TO_RESET_LFG_SUPERSEDES** (4 entries with semantic supersession evidence) or **ALREADY_RESOLVED** (where AceHack-only content is zero). Re-tabulated for the strict-bucket ledger:
+
+- `feedback_doc_class_mirror_beacon_*.md` (+1) → SAFE_TO_RESET_LFG_SUPERSEDES (LFG cites full rule + lineage)
+- `feedback_codeql_umbrella_*.md` (+12) → SAFE_TO_RESET_LFG_SUPERSEDES (LFG resolved Open question with primary-source detail)
+- `MEMORY.md` (+11) → SAFE_TO_RESET_LFG_SUPERSEDES (LFG has 29 newer entries)
+- `CURRENT-aaron.md` (+2) → SAFE_TO_RESET_LFG_SUPERSEDES (LFG has §§26-30 + threading lineage)
+- `CURRENT-amara.md` (+2) → SAFE_TO_RESET_LFG_SUPERSEDES (LFG has §12 three Amara class-namings)
+
+Total: 28 AceHack-only lines properly accounted for under strict bucket as SAFE_TO_RESET_LFG_SUPERSEDES.
+
 ### Emerging rubric heuristic
 
 The calibration revealed a strong pattern: **when LFG-newer (-) line count >> AceHack-newer (+) line count, the AceHack content is almost always older drafts of content LFG has since advanced**. This pattern matches because most of AceHack's commits this arc were tick-history / memory updates that LFG subsequently superseded with substantively newer versions.
 
-**Heuristic for the remaining 18 files**:
+**Heuristic for the remaining unclassified files** (live count + per-file enumeration in `docs/active-trajectory.md` four-bucket ledger):
 
 - Files where LFG-newer dominates (`-` >> `+`): probable ALREADY-COVERED; spot-check the AceHack `+` content for any unique semantic addition before classifying
 - Files where AceHack-newer dominates or balanced (`+` >= `-`): higher chance of NEEDS-FORWARD-SYNC; full diff inspection required
-- The 1 pure-AceHack-newer file (`tools/hygiene/github-settings.expected.json`): NEEDS-DECISION (could be obsolete settings snapshot or genuine drift)
-
-Files where this heuristic suggests probable ALREADY-COVERED (deferred for spot-check):
-
-```text
-.github/workflows/codeql.yml                 (+18 -156)  ← strong LFG-newer
-memory/project_laptop_only_*                 (+8 -27)    ← strong LFG-newer
-.github/workflows/budget-snapshot-cadence.yml (+38 -75)  ← strong LFG-newer
-.mise.toml                                   (+2 -21)    ← strong LFG-newer
-SECURITY.md                                  (+4 -8)     ← LFG-newer
-tools/setup/common/curl-fetch.sh             (+14 -44)   ← strong LFG-newer
-tools/setup/common/elan.sh                   (+13 -25)   ← strong LFG-newer
-tools/setup/linux.sh                         (+14 -44)   ← strong LFG-newer
-tools/setup/macos.sh                         (+11 -16)   ← LFG-newer
-tools/hygiene/audit-memory-index-duplicates.sh (+8 -7)   ← balanced; spot-check
-tools/hygiene/validate-agencysignature-pr-body.sh (+5 -9)  ← LFG-newer
-.github/workflows/memory-index-duplicate-lint.yml (+8 -5) ← balanced; spot-check
-.github/workflows/resume-diff.yml            (+7 -14)    ← LFG-newer
-.github/codeql/codeql-config.yml             (+17 -12)   ← balanced; spot-check
-src/Core/Shard.fs                            (+9 -12)    ← balanced; spot-check
-docs/hygiene-history/loop-tick-history.md    (+14 -6)    ← AceHack-newer; spot-check
-.github/workflows/gate.yml                   (+179 -110) ← LARGE; full inspection
-tools/hygiene/github-settings.expected.json  (pure-AceHack-newer) ← NEEDS-DECISION
-```
+- A separate "pure-AceHack-newer" class (e.g. `tools/hygiene/github-settings.expected.json`): NEEDS-DECISION (could be obsolete settings snapshot or genuine drift)
 
-Most likely outcome based on the heuristic: 14-16 of the remaining 18 ALREADY-COVERED, 2-4 NEEDS-FORWARD-SYNC or NEEDS-DECISION.
+The heuristic-classification table previously shown here drifted as files were promoted into Batch 1 + later batches. The live source of truth is the `unclassified_lines` composition block in `docs/active-trajectory.md`; classified files appear in the Batch 1 / Batch 2 / ... tables further up in this document. Keeping a separate hand-maintained heuristic list created exactly the contradictory-counts class Codex flagged.
 
 ### Calibration insight for Aaron
 
-The 145-commit / 530-behind state may be much closer to 0/0/0-ready than the raw numbers suggest. The bulk of "AceHack-only work" turns out to be **older drafts of files LFG has since advanced** — not unique work needing forward-sync. If the heuristic holds for the remaining 18 files, hard-reset alone may resolve most of the divergence with at most 2-4 small forward-syncs.
+The pre-Batch-1 state was 145-commit / 530-behind; the calibration insight remains: the bulk of "AceHack-only work" turns out to be **older drafts of files LFG has since advanced** — not unique work needing forward-sync. As batches land, hard-reset becomes incrementally safer with each promoted file.
 
-### Remaining 18 files (deferred to follow-up ticks)
+### Remaining files (live list — see `docs/active-trajectory.md`)
 
-```text
-.github/codeql/codeql-config.yml             (+17 -12)
-.github/workflows/budget-snapshot-cadence.yml (+38 -75)
-.github/workflows/codeql.yml                 (+18 -156)
-.github/workflows/gate.yml                   (+179 -110)  ← largest AceHack-only delta
-.github/workflows/memory-index-duplicate-lint.yml (+8 -5)
-.github/workflows/resume-diff.yml            (+7 -14)
-.mise.toml                                   (+2 -21)
-SECURITY.md                                  (+4 -8)
-docs/hygiene-history/loop-tick-history.md    (+14 -6)
-memory/project_laptop_only_source_integration_scratch_sqlsharp_features_or_designs_high_priority_2026_04_27.md (+8 -27)
-src/Core/Shard.fs                            (+9 -12)
-tools/hygiene/audit-memory-index-duplicates.sh (+8 -7)
-tools/hygiene/github-settings.expected.json  (pure-AceHack-newer; needs decision)
-tools/hygiene/validate-agencysignature-pr-body.sh (+5 -9)
-tools/setup/common/curl-fetch.sh             (+14 -44)
-tools/setup/common/elan.sh                   (+13 -25)
-tools/setup/linux.sh                         (+14 -44)
-tools/setup/macos.sh                         (+11 -16)
-```
+The per-file enumeration of currently-unclassified files lives in the four-bucket ledger of `docs/active-trajectory.md` (composition of `unclassified_lines`). Hand-maintaining a duplicate list here causes drift; consult the trajectory file for the current set.
 
 ## What this document is NOT
 
@@ -156,8 +137,10 @@ tools/setup/macos.sh                         (+11 -16)
 - **NOT a commit-level audit.** Tree-level diff is the ground truth for 0/0/0
   topology. Per-commit narrative is preserved in git history but not
   re-walked here unless a file requires it.
-- **NOT a single-tick deliverable.** The calibration batch is this tick;
-  remaining 18 files are follow-up tick work.
+- **NOT a single-tick deliverable.** Classification proceeds in
+  small batches (Batch 1, Batch 2, …) per tick; remaining files are
+  follow-up tick work and the live count is in
+  `docs/active-trajectory.md`.
 
 ## Composes with
 
@@ -174,7 +157,7 @@ tools/setup/macos.sh                         (+11 -16)
 
 ## Pickup notes for future-Otto
 
-When resuming classification on the deferred 18 files:
+When resuming classification on the remaining unclassified files (live list in `docs/active-trajectory.md`):
 
 1. Read this file first; verify the rubric still applies.
 2. For each file:
@@ -185,5 +168,6 @@ When resuming classification on the deferred 18 files:
    - Apply the rubric; record evidence
 3. Do not classify in batch without evidence per file.
 4. Surface NEEDS-HUMAN-REVIEW cases to Aaron in the tick close.
-5. Once all 23 files classified, pivot to the action phase (forward-sync
-   the NEEDS-FORWARD-SYNC subset, then hard-reset).
+5. Once `unclassified_lines = 0` in the trajectory ledger, pivot to the
+   action phase (forward-sync the NEEDS-FORWARD-SYNC subset, then
+   hard-reset).

docs/AGENT-BEST-PRACTICES.md

@@ -307,6 +307,15 @@ BP drift.
   - `docs/pr-preservation/**` — PR conversation archive
   - `docs/hygiene-history/**` — tick-history + drain-logs
   - `docs/WINS.md` — historical wins log
+  - `docs/active-trajectory.md` — load-state file +
+    cumulative trajectory log (per maintainer
+    2026-04-29T10:30Z: "active-trajectory.md should
+    count as history I think and keep maintainer names
+    like backlog"); names + filenames-with-names
+    (e.g. `CURRENT-aaron.md`) are first-class here
+    because the file's job is to preserve who-said-
+    what + per-file named evidence for the 0/0/0
+    reconciliation record
   - commit messages, PR titles + bodies — git-native
     history (record-of-truth, not factory-doc surfaces)
 

docs/active-trajectory.md

@@ -136,13 +136,35 @@ For the text-file ledger, the conceptual computation is straightforward: `git di
 
 Verified 2026-04-29T10:43Z: the 5 binary-classified files in the current diff have status `D` (LFG-only), so `binary_acehack_only_files = 0` and `binary_modified_or_renamed_files = 0` in this specific round.
 
-Current ledger (computed 2026-04-29T10:25Z):
+Current ledger (computed 2026-04-29T11:32Z):
 
 ```text
 potential_loss_lines  = 273    all AceHack-only +lines (would be erased on hard-reset)
-classified_safe_lines = 97     semantic evidence in BUCKET 2 (SAFE_TO_RESET_LFG_SUPERSEDES)
+classified_safe_lines = 134    semantic evidence in BUCKET 2 (SAFE_TO_RESET_LFG_SUPERSEDES)
 unsafe_lines          = 0      no NEEDS_FORWARD_SYNC or NEEDS_HUMAN_DECISION
-unclassified_lines    = 176    HEURISTIC_LFG_DOMINATES — pending per-file semantic inspection
+unclassified_lines    = 139    HEURISTIC_LFG_DOMINATES — pending per-file semantic inspection
+```
+
+Composition of `classified_safe_lines = 134`:
+
+- 9 infra files (97 lines): see "9 infra files" table above. SAFE_TO_RESET_LFG_SUPERSEDES with named per-file evidence.
+- 5 calibration-batch files (28 lines, 2026-04-28): MEMORY.md (11) + codeql_umbrella (12) + doc_class_mirror_beacon (1) + CURRENT-aaron (2) + CURRENT-amara (2). Originally labeled "ALREADY-COVERED" in older taxonomy; under strict bucket each has named evidence in `docs/0-0-0-readiness/CLASSIFICATION.md` → SAFE_TO_RESET_LFG_SUPERSEDES.
+- Batch 1 (9 lines, 2026-04-29T11:32Z): SECURITY.md (4) + validate-agencysignature-pr-body.sh (5). See `docs/0-0-0-readiness/CLASSIFICATION.md` Batch 1 table for named evidence per file.
+
+Composition of `unclassified_lines = 139` (11 files):
+
+```text
+38  .github/workflows/budget-snapshot-cadence.yml
+16  tools/hygiene/fix-markdown-md032-md026.py
+14  tools/setup/common/curl-fetch.sh
+12  docs/hygiene-history/loop-tick-history.md
+11  tools/setup/macos.sh
+ 9  src/Core/Shard.fs
+ 9  docs/AUTONOMOUS-LOOP.md
+ 8  tools/hygiene/audit-memory-index-duplicates.sh
+ 8  memory/project_laptop_only_source_integration_scratch_sqlsharp_features_or_designs_high_priority_2026_04_27.md
+ 8  .github/workflows/memory-index-duplicate-lint.yml
+ 6  .github/codeql/codeql-config.yml
 ```
 
 ### Hard-reset signoff gate (strict)
@@ -167,7 +189,7 @@ Per multi-AI review 2026-04-29T10:35Z: dry-run push shape verification is added
 
 Lease rejection on the real push is NOT a retry condition. It means the remote moved between observation and push — restart the safety gate from the top (re-fetch, recompute content-drift ledger, re-classify if anything moved).
 
-**Currently NOT signoff-eligible**: 176 unclassified lines remain (18 files in HEURISTIC_LFG_DOMINATES).
+**Currently NOT signoff-eligible**: see the live ledger above (`unclassified_lines`, `HEURISTIC_LFG_DOMINATES` row count). The four-bucket ledger is the single source of truth for classification progress; downstream prose paragraphs are no longer hand-maintained synonyms of the ledger.
 
 ### 9 infra files (verified 2026-04-29T09:50Z against current git state, NOT against the 16h-old plan)
 
@@ -359,7 +381,7 @@ A peer-call to Grok this session reported the inverse claim ("AceHack has the se
 
 ## Next action
 
-**Hard-reset is NOT YET signoff-eligible.** The strict gate above requires `unclassified_lines = 0`, and the current ledger says `unclassified_lines = 176` (18 files in HEURISTIC_LFG_DOMINATES). The next agent-owned work is per-file semantic inspection of those 18 files to either promote each to SAFE_TO_RESET_LFG_SUPERSEDES (with named evidence) or downgrade to NEEDS_FORWARD_SYNC.
+**Hard-reset is NOT YET signoff-eligible.** The strict gate above requires `unclassified_lines = 0`. The live four-bucket ledger above is the source of truth for the current count; the remaining files are listed in the `unclassified_lines` composition block. The next agent-owned work is per-file semantic inspection of each remaining file to either promote each to SAFE_TO_RESET_LFG_SUPERSEDES (with named evidence) or downgrade to NEEDS_FORWARD_SYNC.
 
 ### Deferred follow-ups (NOT blocking 0/0/0 progress, captured for visibility)
 
@@ -373,7 +395,7 @@ Per multi-AI review 2026-04-29T10:50Z packet:
 State summary:
 
 - 9 infra files: SAFE_TO_RESET_LFG_SUPERSEDES (6 files, 97 lines, named evidence) or ALREADY_RESOLVED (3 files, 0 lines, identical content).
-- 18 files in HEURISTIC_LFG_DOMINATES (176 lines, line-ratio dominance only — NOT proof per the strict bucket rule).
+- HEURISTIC_LFG_DOMINATES files remain (line-ratio dominance only — NOT proof per the strict bucket rule). Live count + per-file enumeration in the four-bucket ledger above.
 - Branch / worktree / stash preflight: hard-reset of `acehack/main` does not modify these refs.
 - Pack corruption found in local clone, **fresh clone passes fsck clean → corruption is local-only, remote intact**.
 - Local clone frozen as forensic evidence. All future destructive work happens from `/tmp/zeta-clean-2026-04-29/lfg`.