chore(issues): reconcile 35 queued ledger requests

.claude/skills/handoff/SKILL.md

@@ -63,6 +63,14 @@ force-push, or discard work.
    `head`, or another command that can mask its status. Confirm the remote tip equals local HEAD
    with `git ls-remote` before reporting success. The pre-push guards run
    (auto-merge sentinel, format, drift) — heed a block rather than overriding blindly.
+
+   **Restarting a branch whose PR already merged:** GitHub deletes the remote branch on merge,
+   so the local `origin/<branch>` ref is stale and `--force-with-lease` fails with `stale info`
+   before it ever reaches the remote. That is not a lease violation to override — run
+   `git remote prune origin` and push normally. There is nothing to force: the branch no longer
+   exists remotely, so the push creates it fresh. Observed 2026-08-14 restarting this branch
+   after PR #1944 merged.
+
 6. **Open a PR** with `gh pr create --base main`, body ending with the Claude Code
    attribution line. Write the body from `.github/pull_request_template.md` in full normal
    prose — exact `## Summary` / `## Verification` / `## Risk and rollout` / (when clinical-risk

.claude/skills/issues/SKILL.md

@@ -118,6 +118,12 @@ report that the Markdown source is current and the visual artifact is stale. Sti
 reconciliation handoff — a stale visual artifact must not invalidate a successful canonical
 transaction.
 
+**This step is unavailable off the operator's Windows machine.** The script and the artifact are
+both absolute Windows paths, so a Linux, container, or cloud session cannot run it and cannot
+verify it — the artifact drifts silently from the moment such a session reconciles. Do not
+improvise a substitute renderer or write the HTML by hand; report the register as stale, name the
+reconciliation commit that made it so, and leave the refresh to the operator.
+
 ## Persist the memory (commit)
 
 When the user explicitly asks for a commit, commit only the newly created request file(s), never

.claude/skills/newtask/SKILL.md

@@ -33,6 +33,14 @@ than opening a second branch. This is one GitHub read (`mcp__github__list_pull_r
 boundary. If GitHub is unreachable, treat it as a warning and continue — an offline session
 must still be able to start work. Recorded as `#292`.
 
+**If the PR-handoff stop hook has already armed in this session, that read is denied** — a
+session that opened its own PR and then picks up another queued item cannot call
+`list_pull_requests` or `gh pr list` at all (see `docs/pr-handoff-stop-cross-agent-gap.md`).
+Do not unlock the hook for this; fall back to `git ls-remote --heads origin`, which needs no
+provider tool and still answers the question, because a session building the same surface
+almost always has a pushed branch named after it. Report which check you used. Observed
+2026-08-14 on PR #1956.
+
 ## Steps
 
 1. **Sync main.** `git fetch --quiet origin main`.

docs/branch-review-records/26cca9a8fb9d8d74d7f1ee7930cfbe94b1ad5125cb1551eb036da361229c79c6.record.md

@@ -0,0 +1 @@
+| 2026-08-14 | PR-1956 | 40be0b6fd37beb39f2cd10599d5455a4ed74ceef | ledger reconciliation review, current-main merge, and duplicate-follow-up queueing | FIXED: merged current main cleanly; preserved canonical-ledger discipline; queued the two confirmed duplicate consolidations with immutable cancellation records for later serial reconciliation. | offline: ledger write-discipline; outstanding-issues; branch-review-ledger; docs links; skills; pr-policy; ci-scope; merge-loss self-test; manual adversarial review |

docs/branch-review-records/f2f43e75cc44bf4d80d3e6bddb9f6844548e9f4d84b79b828a42a53505e3ff5c.record.md

@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | 93365d6e4e496c233e629d85a572f3feb08513cf | outstanding-issues reconciliation of 35 queued requests (fresh base 0011a058) | PR #1956 — one serial reconciliation transaction from a fresh origin/main base, restarting the branch after its previous PR (#1944) merged as squash 372cb13f. 35 requests applied: 17 done, 7 add, 6 update, 5 cancel; ledger 328 to 334 rows, 115 to 99 open. Machine-generated and machine-verified end to end; no request or canonical row was hand-edited. Includes the five requests PR #1944 left pending: closes #313, carries #211 forward with a re-measured 1,445 errors while keeping its deprioritisation and P3 priority, records #168 and #258 without closing either, and opens #335. One request deliberately not re-filed: cancel a8783c79, whose target 0e47904b was already consumed by the reconcile in PR #1936, making it invalid; nothing lost because the surviving #211 update folds its text forward. Visual HTML register NOT refreshed — its PowerShell refresh script is a Windows path unavailable in this Linux container; Markdown source is current, artifact is stale. | npm run verify:pr-local — 11 gates completed, 0 failed; npm run check:ledger-write-discipline printed "Ledger write discipline passed for 0011a058fd1d..HEAD", independently recomputing the transaction; check:outstanding-issues 334 rows (99 open, 235 archived), unique ids, next-id=337 above the highest, 0 pending requests, 129 applied; the pre-existing check:medication-lexicon-report failure seen on PR #1944 is gone, confirming PR #1941 fixed it at source. Note: run before committing, check:ledger-write-discipline correctly REFUSED to report a verdict and named every uncommitted request file — the guard PR #1944 shipped, working on the first real reconciliation after it landed. |

docs/outstanding-issues-inbox/0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "ef62d13b-6852-4a12-a1d3-4d7e22ec1232",
+    "reason": "The shell expanded code-span markers while creating this request, removing two command names; preserve it for audit and apply the corrected #331 update instead."
+  }
+}

docs/outstanding-issues-inbox/19762e55-fa25-41de-a5a2-7f4932a545fe.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "19762e55-fa25-41de-a5a2-7f4932a545fe",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#324",
+    "detail": "**Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added scripts/audit-merge-loss.mjs through npm run audit:merge-loss and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists.",
+    "source": "session 2026-08-13 blob sweep; PR #1944 audit implementation and tests; PR #1937 inbox-loss case; consolidated by PR #1956 review follow-up"
+  }
+}

docs/outstanding-issues-inbox/2b7856a5-fe32-49b8-9e3c-819d961784c6.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "2b7856a5-fe32-49b8-9e3c-819d961784c6",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#335",
+    "outcome": "Closed 2026-08-15 as duplicate follow-up of #324. The delivered file-level audit, the remaining schedule/owner decision, and the distinct inbox-request-loss scope are all retained in #324; no scheduling or CI policy was changed by this consolidation."
+  }
+}

docs/outstanding-issues-inbox/9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "9b67dd0e-f11e-423e-be63-7e4d91f4dd82",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#335",
+    "outcome": "Closed 2026-08-15 as duplicate follow-up of #324. The delivered file-level audit, the remaining schedule/owner decision, and the distinct inbox-request-loss scope are all retained in #324; no scheduling or CI policy was changed by this consolidation."
+  }
+}

docs/outstanding-issues-inbox/d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "d226dce3-76a2-4ccc-9723-5e7ca03a6c5d",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "4bc449a1-ec81-426d-aadd-8a78abec21cf",
+    "reason": "This aborted command captured audit output inside the immutable detail field; apply the corrected #324 update 19762e55-fa25-41de-a5a2-7f4932a545fe instead."
+  }
+}

docs/outstanding-issues-inbox/d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "d2e60a94-b12a-4502-a8b9-3dc8406cc8c8",
+  "createdOn": "2026-08-14",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "issue",
+    "summary": "The visual ISSUES-LIST.html register cannot be refreshed from any non-Windows session, so it drifts silently as work moves to cloud sessions",
+    "detail": "**Outcome:** either the rendered register is refreshable from any session that can reconcile, or it is retired and the Markdown ledger is the only artifact. **Detail, observed 2026-08-14 during the reconciliation in PR #1956.** `.claude/skills/issues/SKILL.md` refreshes the register by invoking `refresh-issues-list.ps1` under the operator's Windows `.codex\\scripts` directory and writing `ISSUES-LIST.html` into their OneDrive folder — both absolute Windows paths. A Linux, container, or Codex/Claude Cloud session can run `npm run issues:reconcile` perfectly well (it did: 35 requests, write-discipline verified) but cannot run the refresh and cannot even check how stale the artifact is. The skill already handles this correctly for a single run — it says a stale visual artifact must not invalidate a valid canonical transaction, which is the right call — so this is not a correctness bug. The problem is cumulative: every cloud reconciliation widens the gap, and nothing measures it, so a reader opening the HTML has no way to tell whether it is an hour or a month behind. **Why it is P3 and not higher:** `docs/outstanding-issues.md` is the canonical rendered source and is always current; only the convenience artifact drifts. **Next, cheapest first:** decide whether the register is still wanted. If yes, the smallest fix is a stamp rather than a port — have the refresh write the reconciliation commit SHA into the HTML so staleness is visible at a glance, and have reconcile print a reminder naming the commit that needs it. A full cross-platform port (a Node renderer under `scripts/`) is the larger option and probably only worth it if the register is load-bearing for someone. If nobody reads it, retiring it and deleting that skill section is cheaper than either. **Stop:** do not improvise a substitute renderer or hand-write the HTML from a cloud session — an artifact that looks refreshed but was produced by a different generator is worse than one that is visibly stale.",
+    "source": "PR #1956 reconciliation; .claude/skills/issues/SKILL.md refresh section; session 2026-08-14"
+  }
+}

docs/outstanding-issues-inbox/ddef5391-d476-417f-b0c8-662e44c54f8b.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "ddef5391-d476-417f-b0c8-662e44c54f8b",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "9b67dd0e-f11e-423e-be63-7e4d91f4dd82",
+    "reason": "This duplicate #335 closure was created by the aborted command; apply the identical intended closure 2b7856a5-fe32-49b8-9e3c-819d961784c6 instead."
+  }
+}

docs/outstanding-issues-inbox/ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "ef62d13b-6852-4a12-a1d3-4d7e22ec1232",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#331",
+    "detail": "**Outcome:** one authoritative owner for the medication-report staleness problem, including its missing CI coverage. **Evidence:** on 2026-08-14,  reported the review document stale on three independently authored branches (#1947, #1949, #1950) although the document, lexicon sources, medication snapshot, and interaction index were untouched. The symptom must therefore be investigated against a clean current main rather than fixed opportunistically in unrelated work. **Scope:** this row also carries the CI evidence formerly duplicated in #333: the check is reached only at the end of  and no workflow invokes it, so CI can stay green while a local PR preflight fails. **Next:** inspect the generator and its staleness comparison against current main; if the report is genuinely stale, regenerate it in a dedicated clinical-document change, otherwise fix the comparison. In the same decision, either make the validated check part of the appropriate CI contract or move it out of the local preflight so its enforcement matches its ownership. **Stop:** do not delete or weaken the check merely to green an unrelated preflight, and do not regenerate a clinical-facing artifact without checking whether the diff changes clinical content.",
+    "source": "PR #1947, PR #1949 and PR #1950 clean-branch reproductions; PR #1942 preflight; session 2026-08-14; consolidated by PR #1956 review follow-up"
+  }
+}

docs/outstanding-issues-inbox/f3b63187-c295-4f6a-8ecd-602f348835c4.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "f3b63187-c295-4f6a-8ecd-602f348835c4",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#333",
+    "outcome": "Closed 2026-08-15 as a duplicate of #331. Its clean-main and missing-CI evidence is preserved in #331, which is now the single owner of both the staleness diagnosis and the CI/local-preflight enforcement decision; no medication report was regenerated or clinical content changed."
+  }
+}

docs/outstanding-issues-inbox/fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "fbfe982f-cd2f-49c9-a94e-908a99efa6b8",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#331",
+    "detail": "**Outcome:** one authoritative owner for the medication-report staleness problem, including its missing CI coverage. **Evidence:** on 2026-08-14, check:medication-lexicon-report reported the review document stale on three independently authored branches (#1947, #1949, #1950) although the document, lexicon sources, medication snapshot, and interaction index were untouched. The symptom must therefore be investigated against a clean current main rather than fixed opportunistically in unrelated work. **Scope:** this row also carries the CI evidence formerly duplicated in #333: the check is reached only at the end of verify:pr-local and no workflow invokes it, so CI can stay green while a local PR preflight fails. **Next:** inspect the generator and its staleness comparison against current main; if the report is genuinely stale, regenerate it in a dedicated clinical-document change, otherwise fix the comparison. In the same decision, either make the validated check part of the appropriate CI contract or move it out of the local preflight so its enforcement matches its ownership. **Stop:** do not delete or weaken the check merely to green an unrelated preflight, and do not regenerate a clinical-facing artifact without checking whether the diff changes clinical content.",
+    "source": "PR #1947, PR #1949 and PR #1950 clean-branch reproductions; PR #1942 preflight; session 2026-08-14; consolidated by PR #1956 review follow-up"
+  }
+}