fix: ledger merge dedupe + L4 quarterly archive rotation

.claude/skills/run-pr/SKILL.md

@@ -173,6 +173,18 @@ The HEAD must be the full SHA — `pending pushed head` and 8-character abbrevia
 unmatchable, so the next sweep re-reviews the same PR. Per-PR records only — no extra sweep-total
 record — so ledger throttling lookups stay per-branch.
 
+Anti-churn rules for this file:
+
+- After `git merge origin/main`, run `npm run ledger:dedupe` before committing when the
+  ledger changed (belt-and-suspenders if `merge.ledger.driver` was not installed in that
+  checkout).
+- On a later sweep of the same PR, pass `--supersede` so you replace the prior Run PR row
+  instead of stacking another "main sync" twin.
+- Never push a tip whose sole delta is a babysit ledger append — that marks every other
+  open PR behind for no product change. If the PR only needed a clean main sync with no
+  CI/thread fix, record the outcome in the final sweep report and fold the ledger row into
+  the next product commit on that branch, or into a bundled docs/ledger PR.
+
 ## Final report format
 
 - Per PR: number/title/branch; before (failing checks, unresolved threads, behind/conflicting);

.gitattributes

@@ -8,6 +8,7 @@
 *.png binary
 *.webp binary
 
-# Review records are append-only. Concurrent branches should retain both sets
-# of rows instead of stopping on an add/add conflict at the shared table tail.
-docs/branch-review-ledger.md merge=union
+# Review records are append-only. The custom `ledger` driver unions both sides
+# and drops exact duplicate dated rows (stock `union` kept concurrent appends
+# but also reintroduced babysit twins that failed the ledger guard).
+docs/branch-review-ledger.md merge=ledger

AGENTS.md

@@ -121,7 +121,7 @@ Use `docs/codex-review-protocol.md` as the shared review protocol for every repo
 
 Before reviewing a branch or PR:
 
-- Run `npm run ledger:lookup -- <branch-or-ref> --scope "<scope>"`. It resolves the HEAD, matches the abbreviated SHAs older records used, and prints an explicit verdict. Do not read `docs/branch-review-ledger.md` by eye — it is over a thousand rows, and eyeballing it is how repeat reviews slipped through.
+- Run `npm run ledger:lookup -- <branch-or-ref> --scope "<scope>"`. It resolves the HEAD, matches the abbreviated SHAs older records used, and prints an explicit verdict. Do not read `docs/branch-review-ledger.md` by eye — live + archive rows are many, and eyeballing is how repeat reviews slipped through. `ledger:lookup` reads archives under `docs/archive/branch-review-ledger-*.md` too.
 - On `ALREADY REVIEWED`, summarize the prior ledger outcome and skip the repeat review unless the user explicitly requests a fresh pass.
 - On `NOT REVIEWED at this HEAD`, review only the changed scope and append a record after the review.
 
@@ -142,7 +142,9 @@ Review routing:
 - `branch-cleanup`: Use only when the prompt explicitly asks for branch cleanup/hygiene or branch deletion candidates. Apply `docs/branch-cleanup-guide.md` and the review ledger before inspecting branch diffs.
 - `pr-ci-fix`: Confirmation-required for this repo. GitHub/GitLab API calls, PR comments, CI reruns, commits, and pushes require explicit user approval and must respect the upload/handoff rules. Exception: an explicit `Run PR` sweep carries this approval (see "## Run PR shortcut").
 
-When a branch or PR review completes, record it with `npm run ledger:append -- --ref <x> --head <full-40-char-sha> --scope <s> --outcome <o> --checks <c>`. Never hand-write the markdown row: hand-written rows produced the mojibake, wrong-width, and duplicate records that the 2026-07-28 hygiene pass had to repair, and `see PR head` or abbreviated HEADs make a record unmatchable so the review runs again. The ledger is append-only: never edit or delete an existing record; append a correction or superseding record (`--supersede`) instead. Its `merge=union` attribute preserves concurrent appends, and `npm run check:branch-review-ledger` blocks conflict markers, duplicate records, mojibake, wrong-width or heading-style records, unresolvable HEADs, or loss of that merge protection.
+When a branch or PR review completes, record it with `npm run ledger:append -- --ref <x> --head <full-40-char-sha> --scope <s> --outcome <o> --checks <c>`. Never hand-write the markdown row: hand-written rows produced the mojibake, wrong-width, and duplicate records that the 2026-07-28 hygiene pass had to repair, and `see PR head` or abbreviated HEADs make a record unmatchable so the review runs again. The ledger is append-only: never edit or delete an existing record; append a correction or superseding record (`--supersede`) instead. Its `merge=ledger` driver preserves concurrent appends and drops exact duplicate rows; after a main sync without that driver installed, run `npm run ledger:dedupe`. `npm run check:branch-review-ledger` blocks conflict markers, duplicate records, mojibake, wrong-width or heading-style records, unresolvable HEADs, or loss of that merge protection.
+
+Babysit / Run PR ledger policy: do not push a tip whose sole delta is a babysit ledger append (that marks every other open PR behind). One Run PR row per PR per sweep; on a later sweep of the same PR, pass `--supersede` rather than stacking another "main sync" row. After `git merge origin/main`, run `npm run ledger:dedupe` before committing when the ledger changed.
 
 <!-- END:codex-review-throttling -->
 
@@ -476,8 +478,9 @@ Durable mitigations in this repo:
   `do not merge` title.
 - Prefer fewer long-lived open PRs; land or close queue items rather than
   repeatedly re-merging `main` by hand.
-- `docs/branch-review-ledger.md` stays append-only with the `union` merge driver;
-  do not rewrite existing rows during syncs.
+- `docs/branch-review-ledger.md` stays append-only with the `ledger` merge driver
+  (union + exact-row dedupe); do not rewrite existing rows during syncs. If a
+  sync still surfaces exact twins, run `npm run ledger:dedupe` only.
 
 When diagnosing "merge conflicts on every PR", first compare `behind_by` and
 `git merge-tree --write-tree origin/main <tip>`. If the tree merge is clean,
@@ -514,7 +517,7 @@ Hard guardrails (never, even during a sweep):
 
 Procedure: in Claude Code sessions, invoke the `run-pr` skill (`.claude/skills/run-pr/SKILL.md`) — it is the canonical detailed procedure. In sessions without GitHub MCP write tooling, degrade to read-only diagnosis and a per-PR report; do not attempt pushes or thread resolution through other means.
 
-Record one `docs/branch-review-ledger.md` row per PR touched, and end with the per-PR before/after summary defined in the skill.
+Record one `docs/branch-review-ledger.md` row per PR touched (use `--supersede` on later sweeps of the same PR; never a ledger-only tip), run `npm run ledger:dedupe` after merging main when the ledger changed, and end with the per-PR before/after summary defined in the skill.
 
 <!-- END:run-pr-shortcut -->
 

docs/README.md

@@ -69,7 +69,7 @@ npm run docs:check-links
 - [codex-review-protocol.md](codex-review-protocol.md) — shared review protocol for all review skills
 - [codex-prompt-playbook.md](codex-prompt-playbook.md) — copy/paste prompts for common repo work
 - [branch-cleanup-guide.md](branch-cleanup-guide.md) — branch hygiene workflow
-- [branch-review-ledger.md](branch-review-ledger.md) — reviewed branch/SHA ledger; read it with `npm run ledger:lookup`, write it with `npm run ledger:append` (never by hand)
+- [branch-review-ledger.md](branch-review-ledger.md) — reviewed branch/SHA ledger; read with `npm run ledger:lookup` (live + archives), write with `npm run ledger:append`, `npm run ledger:dedupe` after sync twins, `npm run ledger:rotate` for quarterly archive
 
 ## Plans and workstreams (living)