chore: batch buglog entries for the 2026-08-28 merges

[sakibsadmanshajib]

Summary

This is the batched buglog follow-up for the 21 pull requests merged during the 2026-08-28 session. Its diff is .wolf/buglog.jsonl and nothing else.

Per .claude/rules/openwolf.md, every fixed bug, error, failed test or failed build must be logged, but the line may never be appended on a fix branch: merge=union in .gitattributes resolves concurrent appends locally and is ignored by GitHub's server side merge, so two branches that both appended land in hard conflict there. An unmergeable pull request gets no refs/pull/N/merge, no pull_request run and therefore zero checks, and the required status gate then blocks the merge for a reason the page never states (issue #873). Each fix accordingly carried its entry in its own pull request body, and this pull request copies them onto main in one batch, which the protocol explicitly prefers over one pull request per entry.

Source pull requests

1240, 1251, 1253, 1257, 1268, 1276, 1277, 1278, 1281, 1287, 1292, 1293, 1294, 1296, 1300, 1301, 1303, 1305, 1313, 1335, 1337. All merged.

Every entry came from a "Buglog entry" heading in one of those bodies. Nothing was invented for a pull request that carried none.

What landed

36 entries appended, one JSON object per line, append only. The 196 pre-existing lines are byte identical to origin/main.

Source	Entries
#1240	1
#1251	1
#1253	1
#1257	4
#1268	5
#1276	2
#1277	1 (of 2 in the body)
#1278	0 (merged into #1296)
#1281	2
#1287	2
#1292	3
#1293	1
#1294	3
#1296	1
#1300	1
#1301	1
#1303	1
#1305	3
#1313	1
#1335	1
#1337	1

Note on #1268: its first "Buglog entry" heading says "None yet" in prose and carries no JSON. Its two later headings, from the CI live lane and from the intermittent tool call failure, carry the five entries taken here.

Deduplication

• test: add Anthropic Messages API conformance suite using the real SDK #1278 dropped, folded into fix: make the Anthropic surface conform to the real SDK wire contract (#1274, #1260, #1261, #1259) #1296. Both describe the same defect: omitempty on StreamContentBlock.Text dropped the required "text":"" from every text content_block_start, crashing the real Anthropic SDK's stream accumulator (issue Streaming content_block_start omits text field, crashing the real Anthropic SDK's stream accumulator on every text response #1274). test: add Anthropic Messages API conformance suite using the real SDK #1278 is the conformance suite that found it and shipped it marked xfail; fix: make the Anthropic surface conform to the real SDK wire contract (#1274, #1260, #1261, #1259) #1296 is the fix, and its entry carries the fuller root cause and the actual remedy. One bug, one entry. fix: make the Anthropic surface conform to the real SDK wire contract (#1274, #1260, #1261, #1259) #1296's entry gains a discovered_by field naming test: add Anthropic Messages API conformance suite using the real SDK #1278 so the discovery is not lost.
• feat: add console privacy and data-policy page #1277's first entry dropped. The same body carries a later "Buglog entry (revised)" heading written after the review round found the page's claims did not match what the code enforces. The revised entry is the one taken.
• Checked and kept as distinct: docs: four-layer memory in the session (enforced) and in the product (mapped) #1313 and fix: make the secrets scanner read MultiEdit payloads (issue #1333) #1337 are two different hooks (decision-citation-check.js and secrets-scanner.js) blind to the same MultiEdit payload shape, fixed in two different pull requests, so two entries. fix: log account_not_provisioned at its single choke point #1240 and fix: refuse an API key for a workspace with no billing account (#1330) #1335 are two different account_not_provisioned defects, one an observability gap at the edge boundary and one a console mint that should have refused, so two entries. fix: enforce max_tokens as a billing bound and refuse n other than 1 #1305's three entries are three separate rounds of defects in the same money path change, each with its own root cause.

Corrections against what actually merged

Each entry was checked against the merged tree at origin/main, not against its own claim.

• fix: log account_not_provisioned at its single choke point #1240. The entry said the log line went in at AuthSnapshot.TenantUUID. On main the check is the exported authz.ParseTenantID(TenantLookup) that TenantUUID delegates to, which the images and audio routing adapters (two further silent call sites found in the same review) also call, and key_id is deliberately not logged because CodeQL's clear text logging check flags any field named *Key* (alert Feature: Add OpenRouter AI Provider Integration - Phase 1 Foundation #31). The fix field now says so.
• feat: analytics overview parity (deltas, sparklines, cache split, top keys) #1276, first entry. The entry named app/console/analytics/page.tsx as the home of the five fetch helpers and their Promise.all. On main they live in apps/web-console/lib/analytics/overview-fetch.ts, extracted during review. Path corrected.
• feat: add console privacy and data-policy page #1277. Its error_message was the placeholder n/a. Reconstructed from the pull request's own correction narrative: the page as first written published a blanket no content stored claim false for /v1/batches, /v1/files and /v1/rag, a product wide provider blindness claim disproved by catalogue summaries that name vendors (GET /v1/models leaks provider identity in hive-stt/hive-tts descriptions #1284), a metering claim anchored to the console side UsageEventRow projection rather than the usage_events table, and a 1:1 alias to route claim that is a property of seed data rather than of SelectRoute.

#1303 needed no correction. Its original root cause asserted a live mid stream provider leak on the session chat relay that measurement disproved, and the author had already corrected the body before merge. The corrected version is what was taken, including the sentence recording that the session chat relay did not leak an error frame but silently truncated instead.

Every other entry's central claim was verified present in the merged tree, among them metering.SupportsIncludeUsage, sanitize.VariablePriceFrame in the batch dispatcher, the revoke and regrant in 20260828_01_service_role_public_schema_grant.sql with the anon assertions in ci-throwaway-db.sh, normalizeReasoningUsage now called from normalizeChatCompletion, signup.SyncTenantMembershipRole, TestKeyViewHidesALimitThatIsNotEnforced, TestListEventsLatencyCrossesTheWire, mask-api-keys.mjs and md-table.mjs, StreamContentBlock.Text as *string, redactSnapshot, httpx.ReadBody, sanitize.ReplaceErrorFrame with the default deny tail in provider_blind.go, pinCompletionCeiling and captureInputTokens with applyReasoningHeadroom gone, requireBillingTenant, and hooks.selfcheck.js wired into the Repo policy lints check.

Verification

• node .wolf/hooks/bugstore.selfcheck.js reports bugstore selfcheck OK.
• All 232 lines parse as a single JSON object each.
• Every appended entry carries error_message, root_cause, fix and tags.
• Scanned for credentials: no API key, bearer token, JWT, password, AWS key or Postgres DSN with a password appears in any entry. The hk_ occurrences are prefix descriptions in prose, not keys.
• git diff origin/main...HEAD --name-only prints .wolf/buglog.jsonl and nothing else. No .wolf/ telemetry was staged.

Review

No adversarial review streams were run, deliberately. This change is records only: it adds no code, no test, no configuration and no behavior, and .wolf/buglog.jsonl is on the inert path allowlist in .github/workflows/ci.yml, so the six required checks report green without running their heavy steps. If a check does fail here, that is a real signal about the file rather than about the pipeline.

https://claude.ai/code/session_01WyEwUxZCArdn1ZUDkTvuQ1

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c1df5f9-cc16-499d-ab06-9da82c3ddfc1

📥 Commits

Reviewing files that changed from the base of the PR and between ddef640 and 21560ab.

📒 Files selected for processing (1)

• .wolf/buglog.jsonl

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}