[lidge-jun]

Closes #301, closes #297, closes #296, closes #294. Also removes the dead preview branch from CI.

preview cleanup. The preview branch no longer exists. It is dropped from the CI and WSL push filters, the closed-PR branch cleanup's protected list (and its tests), and the README CI table. main stays: codex plugin marketplace add without --ref installs the default branch, so main is the release channel.

#301 tests badge. inventory.mjs --check --tests N now accepts --tests-mode exact|floor, defaulting to exact. PR/dev CI uses floor. A badge that lags behind newly added tests prints ::notice with the exact inventory.mjs --write --tests N command and passes. Only a badge that claims more tests than ran fails. Before, every PR that added tests failed CI until a badge-bump commit, and parallel PRs conflicted on that line. The release gate (release-gate.ts) still compares exactly. check() gains an additive notices field. A trailing --tests-mode with no value, an unknown mode, or a mode without --tests exits 1.

#297 byte budgets. l1-injections (V2 skill affordance) and worktree-guard (rename guidance) measured prompt text that embeds an absolute path, so the tests failed on machines with long checkout or temp paths (worktree-guard failed on every run on this mac). Both now replace the root with a placeholder before measuring. New cases use short and long synthetic roots. Prose growth is still caught (a reviewer check showed 180→540 B and 154→514 B both fail).

#296 Node 22 cancellations. This is a Node-version effect: it does not come from tests interacting in a single process. On Node 22.22.0, media-handler, rate-limit and mcp tests await promises kept alive only by unref()'d timers (stream-download.ts, rate-limit.ts, mcp.ts). Node 22's runner sees an empty event loop and cancels the test plus the rest of its file. Node 24/26 keep waiting, which is why hosted CI was green. Those six tests now hold one referenced interval for their own lifetime and carry a 10 s timeout, so the hold cannot hide a hang. Production unref() calls are intentional and unchanged. Before: the three files on Node 22.22.0 gave 34 tests, 8 cancelled. After: 34 passed, 0 cancelled.

#294 Audit guidance (docs only, agreed scope). phase-audit.md adds three rules. AUDIT-REAUDIT-SCOPE-01: a re-audit checks blocker closure and amendment regressions; new Low/Medium findings become residuals; a new High/Critical is still folded or rebutted. REBUTTAL-BASIS-01: High/Critical rebuttals name a command or path:line when one exists. AUDIT-REVIEWER-ROLE-01: small reviewers do fact checks; prefer the strongest reviewer for substantial design. Same-reviewer reuse stays the default. loop-engineering.md and structure/20 point at them. Not adopted from the issue: reviewer-tier rule, fresh-reviewer rotation, rebuttal-outcome ledger, gate/attest changes. Fresh-reviewer rotation is what produced endless nit rounds in practice.

Validation

• Full suite, Node 22.22.0 (direct executable) at 72bd28c: tests 3879, pass 3873, fail 0, cancelled 0, skipped 6.
• Full suite, Node 26.12.1 (cxc receipt test -- npm test) at the head: tests 3879, pass 3873, fail 0, cancelled 0, skipped 6 (8b1c7ed).
• inventory.mjs --check and gate.mjs exit 0. Release-gate tests 38/38.
• Plan, architect consultation and two audit rounds: devlog/_plan/261027_issue_sweep/.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T12:58:53.823718Z	8b1c7ed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.