docs(work-items): retire T1/T2/T3 triage classification vocabulary

[kyle-sexton]

Fixes #1254

Retires T-tier tokens from the triage skill contract; keeps the multi-surface stub outcome expressed as mechanical-class work.

Related

• Closes work-items(triage): retire the T1/T2/T3 classification vocabulary superseded by the work-class axis #1254

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 31s —— View job

---

Security Review

• Gather context (fetch PR diff, read changed files)
• Understand the request (security review of this PR)
• Review changed files for security issues
• Post findings

Scope reviewed: plugins/work-items/.claude-plugin/plugin.json (version bump), plugins/work-items/CHANGELOG.md (changelog entry), plugins/work-items/skills/triage/SKILL.md (vocabulary/prose edits).

Findings: none.

This PR is a pure documentation/vocabulary change to the triage skill's markdown instructions plus a routine version bump and changelog entry. It:

• Adds no new code paths, scripts, or GitHub Actions workflow logic.
• Does not touch permissions:, triggers (pull_request_target, workflow_run), secrets, or run: blocks.
• Does not introduce any new external-input handling, command construction, path handling, or template interpolation.
• Only reword's existing table rows / prose (T1 multi-surface stub → multi-surface mechanical stub) and adds a short "Classification vocabulary" clarification paragraph — no change in what data flows through the skill or how it's trusted.

No injection surfaces, authorization/access-control changes, credential handling, or supply-chain/CI risk are present in this diff. No further action needed from a security standpoint.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e05a06b67c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 1m 26s —— View job

---

Security Review

• Gather context (fetch PR diff, read changed files)
• Evaluate the Codex finding on work-class: label trust boundary
• Review changed files for additional security issues
• Post findings

Scope reviewed: plugins/work-items/CHANGELOG.md (+7/-0, changelog entry only) and plugins/work-items/skills/triage/SKILL.md (+7/-1: a new "Classification vocabulary" paragraph and a table-row rename from "T1 multi-surface stub" to "multi-surface mechanical stub").

Findings: none introduced by this diff.

On the Codex comment flagging the work-class: label / merge-eligibility trust boundary (SKILL.md:46): I checked whether this PR grants triage any new authority over that label. It does not. The binding rule — "Every mutation that applies the autonomous-eligible role label MUST also apply exactly one work-class: label in the same edit" — already existed on origin/main prior to this PR, unchanged, just shifted from line 151 to line 157 by the diff's insertion above it. This PR's new paragraph at lines 44-47 documents that pre-existing behavior under the retired-vocabulary cleanup — it doesn't newly direct triage to write or trust the label, and the table-row rename at line 145 only swaps the T1 name for the equivalent work-class: mechanical name for the same existing stub-outcome behavior.

So the architectural question Codex raises (triage, as an agent-writable classifier, being the same actor whose label output babysit-loop later trusts for merge-eligibility widening) is a legitimate design question, but it's pre-existing on main and out of scope for a diff-scoped review of this PR — this diff neither introduces nor changes that trust relationship. Worth tracking separately against admission-policy.md's "no repo-local (agent-writable) surface may supply admission input" rule if not already resolved elsewhere, but not a regression from this change.

Beyond that: no new code paths, scripts, or workflow logic; no changes to permissions:, triggers, secrets, or run: blocks; no new external-input handling, command construction, path handling, or template interpolation. CHANGELOG.md is a prose-only addition.

No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.

[claude]

Claude finished @kyle-sexton's task in 1m 18s —— View job

---

Security Review

• Gather context (fetch PR diff, read changed files)
• Evaluate the Codex P1 finding on work-class: label trust boundary
• Review changed files for additional security issues
• Post findings

Scope reviewed: plugins/work-items/CHANGELOG.md (+7/-0, changelog entry only) and plugins/work-items/skills/triage/SKILL.md (+7/-1: new "Classification vocabulary" paragraph at lines 44–47 and a table-row rename at line 145).

Findings: none introduced by this diff.

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md:46): I independently verified this against origin/main. The binding rule this PR's new paragraph documents — "Every mutation that applies the autonomous-eligible role label MUST also apply exactly one work-class: label in the same edit" — already exists verbatim on origin/main at line 151, unchanged by this PR (it only shifts down to line 157 because of the new insertion above it), and already instructs triage to "map C1–C5" to the work-class: labels. I also confirmed the downstream trust dependency Codex describes is real: plugins/source-control/skills/babysit-loop/SKILL.md (rung-partition step) reads an item's work-class: label as the sole admission-authoritative signal for widening merge eligibility, and plugins/autonomy/reference/guardrails/admission-policy.md:88-89 states "No repo-local (agent-writable) surface may supply any admission input — rules, caps, or the work class used for admission." So the architectural tension — triage (an agent-writable classifier) and babysit-loop (the consumer that trusts that same label for merge-eligibility widening) sharing one label axis — is legitimate and worth resolving. But it is pre-existing on main, not introduced or worsened by this diff. This PR's contribution is limited to (a) a new paragraph naming/documenting the already-existing work-class: ↔ C1–C5 mapping under the retired-vocabulary cleanup, and (b) renaming a table row from "T1 multi-surface stub" to the equivalent work-class: mechanical name for the same pre-existing stub-outcome behavior. Neither newly directs triage to write the label, changes who can write it, or alters what babysit-loop trusts.

Beyond that: no new code paths, scripts, or GitHub Actions workflow logic; no changes to permissions:, triggers, secrets, or run: blocks; no new external-input handling, command construction, path handling, or template interpolation. CHANGELOG.md is a prose-only addition.

No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.

Recommendation (non-blocking for this PR): the Codex-flagged trust boundary — an agent-writable work-class: label doubling as babysit-loop's admission-authoritative signal — is worth tracking as a separate issue against admission-policy.md's "no repo-local (agent-writable) surface may supply admission input" rule, since it's an existing architectural question this PR neither created nor is in scope to fix.

[claude]

Claude finished @cursor[bot]'s task in 1m 27s —— View job

---

Security Review

• Gather context (diff at new HEAD bdc8566, changed files)
• Re-check Codex P1 finding (work-class: label trust boundary) at current HEAD
• Review the three new commits added since the last review (version bumps + changelog)
• Post findings

Scope reviewed (diff fa3f120..bdc8566): plugins/work-items/.claude-plugin/plugin.json (version bump 0.35.8 → 0.35.9), plugins/work-items/CHANGELOG.md (changelog entries), plugins/work-items/skills/triage/SKILL.md (+7/-1: new "Classification vocabulary" paragraph and a table-row rename).

Findings: none.

This head adds three commits since the last security pass (ed32727 changelog-parity version bump, 81098a1 a Markdown-lint fix (MD012) in the changelog, bdc8566 version bump to 0.35.9) on top of the vocabulary-retirement commit already reviewed. None of these touch code paths, scripts, workflow logic, permissions, or secrets — plugin.json is a version string and CHANGELOG.md is prose.

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md:44-47): re-verified at the current head — unchanged from the prior assessment. The binding rule that pairs the autonomous-eligible role label with a work-class: label already exists on origin/main (now at SKILL.md:151, shifted by this PR's insertion above it), and the table-row rename at SKILL.md:145 only swaps the retired T1 name for the equivalent work-class: mechanical name for the same pre-existing stub-outcome behavior. This diff neither newly directs triage to write the label nor changes what babysit-loop trusts for merge-eligibility widening — the architectural question Codex raises (an agent-writable classifier feeding an admission-authoritative label, per admission-policy.md:88-89) remains real but pre-existing and out of scope for this PR.

Not a security finding, flagged for awareness: CHANGELOG.md now has a duplicate ## [0.35.8] heading (added at the top by ed32727, plus the original entry further down) and the "All notable changes..." preamble now sits mid-file rather than at the top. This is a documentation-formatting issue, not a security concern — out of scope for this lane (see /review:code-review for quality findings).

No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.

[github-actions]

Last security-reviewed head: f5dd6194aef7f842ea1394dc314a9b8bc62dfde7. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @cursor[bot]'s task in 1m 55s —— View job

---

Code Review

• Gather context (fetch PR diff, read changed files)
• Check skip gate
• Review changed files for correctness/maintainability
• Post findings

Scope reviewed: plugins/work-items/.claude-plugin/plugin.json (version bump), plugins/work-items/CHANGELOG.md, plugins/work-items/skills/triage/SKILL.md (per this lane's scope, security/trust-boundary findings are left to /review:security-review, which has already covered the work-class: label point on this PR).

Findings: 1 (posted inline)

• plugins/work-items/CHANGELOG.md:4-24 — The changelog now has two ## [0.35.8] headers with different, overlapping content (one ### Fixed, one ### Changed), and the file's intro paragraph ("All notable changes…") got displaced to sit between the two 0.35.8 entries instead of directly under the # Changelog title. The new ## [0.35.9] entry also just restates the 0.35.8 bullet with less detail, so it reads as a redundant near-duplicate rather than a real release note. This traces to the PR's iterative version-bump commits (bump to 0.35.8 for changelog parity → fix MD012 → bump to 0.35.9) not reconciling the earlier entry. Suggested a collapsed single 0.35.9 entry inline.

SKILL.md and plugin.json: no correctness issues found — the new "Classification vocabulary" paragraph and the T1 multi-surface stub → multi-surface mechanical stub table-row rename are consistent with the rest of the document, and the version bump matches the plugin.json convention.
· branch cursor/retire-t-tier-vocabulary-63e1

[github-actions]

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 57s —— View job

---

Security Review

• Gather context (diff at new HEAD a1c01c8, changed files)
• Check skip gate
• Post findings

Skip gate: triggered (condition 3 — this head already has a successful security review that still applies).

Diff since the last security-reviewed head (bdc85664d119d381f04d43d811413825de01a080) to current HEAD a1c01c8bd77766777723c9fa4203e7eb252f856d adds two commits: a merge: forward main into cursor/retire-t-tier-vocabulary-63e1 and the merged-in 7aa3f4c fix(guardrails): word-boundary partial-Edit anchors in stale-path-verify (#2515) — both originating from origin/main, not from this PR's own changes.

Confirmed via git diff origin/main...a1c01c8: this PR's actual diff against origin/main is unchanged from what was already reviewed — still exactly the same 3 files (plugins/work-items/.claude-plugin/plugin.json version bump, plugins/work-items/CHANGELOG.md changelog entry, plugins/work-items/skills/triage/SKILL.md +7/-1 vocabulary-retirement paragraph and table-row rename), +15/-2 total, matching the PR metadata.

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md): already assessed in the prior review at this same content — pre-existing on main, not introduced or changed by this diff. No new information changes that conclusion.

No security-relevant surface was introduced by the commits since the last review. No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 3m 43s —— View job

---

Code Review

• Gather context (diff at HEAD a1c01c8, changed files)
• Check skip gate
• Review changed files for correctness/maintainability
• Re-verify previously flagged CHANGELOG issue at current HEAD
• Post findings

Scope reviewed: plugins/work-items/.claude-plugin/plugin.json (version bump), plugins/work-items/CHANGELOG.md, plugins/work-items/skills/triage/SKILL.md (per this lane's scope — security/trust-boundary findings are left to /review:security-review, which has already covered the work-class: label point on this PR).

Findings: none.

Previously flagged CHANGELOG issue is now resolved. The last code-review pass on this PR (at head bdc8566) flagged a broken changelog structure — duplicate ## [0.35.8] headers and a displaced preamble. Since then, cursor/retire-t-tier-vocabulary-63e1 merged main forward (commit a1c01c8), which reconciled the version history. At current HEAD, CHANGELOG.md reads cleanly: single # Changelog title + preamble, followed by one well-formed ## [0.35.12] entry documenting the T1/T2/T3 retirement, descending correctly through 0.35.11 → 0.35.7. No duplicates remain.

SKILL.md and plugin.json: re-checked the actual PR-authored content (the "Classification vocabulary" paragraph at SKILL.md:44-48 and the table-row rename at SKILL.md:145):

• The work-class: label set named (read-only/mechanical/scoped/structural/untrusted-provenance) matches the canonical members in reference/work-class-labels.md and their C1–C5 mapping exactly.
• No remaining T1/T2/T3 references anywhere else in the plugin (confirmed via repo-wide search) — the retirement is complete, no dangling references left behind.
• The renamed table row is internally consistent with the rest of the outcome table (column shape, cross-references to the brief-durability rule) and with the mechanical work-class's definition.
• plugin.json's version bump (0.35.12) matches the CHANGELOG's top entry.

No correctness or maintainability issues found in this diff.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 1m 2s —— View job

---

Security Review

• Gather context (diff at new HEAD b69a6d5, changed files)
• Check skip gate (compare against last-reviewed head a1c01c8)
• Post findings

Skip gate: triggered (condition 3 — this head already has a successful security review that still applies).

Diff since the last security-reviewed head (a1c01c8bd77766777723c9fa4203e7eb252f856d) to current HEAD b69a6d5f8ba8451db707aa90e2603fbeaf1eec59 adds one commit: merge: forward main into cursor/retire-t-tier-vocabulary-63e1, pulling in fa762fb fix(hook-utils): write emit_telemetry data to temp file for large payloads (#1595) from origin/main — not from this PR's own changes.

Confirmed via git diff origin/main...b69a6d5 that this PR's actual authored diff against origin/main is unchanged from what was already reviewed: still exactly the same 3 files, +15/-2 total, matching PR metadata:

• plugins/work-items/.claude-plugin/plugin.json — version bump (now 0.35.14, shifted up mechanically because origin/main advanced to 0.35.13 in the interim; not new PR content).
• plugins/work-items/CHANGELOG.md — same T1/T2/T3-retirement changelog entry, now sitting atop the 0.35.13 entry pulled in from main instead of 0.35.12. No content change.
• plugins/work-items/skills/triage/SKILL.md — byte-identical to the previously reviewed content (new "Classification vocabulary" paragraph + the T1 multi-surface stub → multi-surface mechanical stub table-row rename at line 145).

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md lines 44-48): already assessed in prior reviews on this PR — the binding rule pairing the autonomous-eligible role label with a work-class: label pre-exists on origin/main, and this PR only documents/renames pre-existing behavior. It neither newly directs triage to write the label nor changes what babysit-loop trusts for merge-eligibility widening. No new information at this head changes that conclusion; still pre-existing and out of scope for this PR.

No security-relevant surface was introduced by the commit since the last review. No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 1m 28s —— View job

---

Code Review

• Gather context (diff at HEAD b69a6d5, changed files)
• Check skip gate
• Verify PR-authored diff is unchanged since last successful review
• Post findings

Skip gate: triggered (condition 4 — this head already has a successful code review from this lane that still applies).

Local origin/main is a shallow/promisor ref in this checkout (only 1 commit deep) so git diff origin/main...HEAD isn't usable directly. Instead I diffed the merge commit's own parents: b69a6d5's second parent (fa762fb) is exactly the main tip that was merged forward, and git diff a1c01c8..b69a6d5 (the last code-reviewed head → current head) for this PR's three files shows:

• plugins/work-items/skills/triage/SKILL.md — no diff. The PR-authored "Classification vocabulary" paragraph and the T1 multi-surface stub → multi-surface mechanical stub table-row rename are unchanged from the version already reviewed with no findings.
• plugins/work-items/.claude-plugin/plugin.json — version bump 0.35.12 → 0.35.14, and plugins/work-items/CHANGELOG.md gained two additional entries (0.35.13, re-numbered 0.35.12). Both changes originate from origin/main commits merged forward (9133850 lease-TTL feature + its follow-up fix), not from this PR's own authorship.

Re-checked the current changelog structure at HEAD: single # Changelog title + preamble, followed by one well-formed ## [0.35.14] entry documenting the T1/T2/T3 retirement, descending correctly through 0.35.13 → 0.35.11. plugin.json's version (0.35.14) matches the top entry. No duplication or displaced preamble (the issue flagged and previously resolved on this PR has not regressed).

Findings: none. This PR's actual authored content is unchanged since the last code-review pass, which found no correctness or maintainability issues. The work-class: label trust-boundary question (Codex P1) remains in the security lane's scope and was already assessed there as pre-existing on main, not introduced by this PR.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 1m 0s —— View job

---

Security Review

• Gather context (diff at new HEAD 3e4eb98, changed files)
• Check skip gate (compare against last-reviewed head b69a6d5)
• Post findings

Skip gate: triggered (condition 3 — this head already has a successful security review that still applies).

Diff since the last security-reviewed head (b69a6d5f8ba8451db707aa90e2603fbeaf1eec59) to current HEAD 3e4eb984046bd8079def8bc804aef3ebe0de96a0 adds one commit: merge: forward main after #2467 #2487, pulling in 4e61b9b fix(work-items): reconcile role_labels docs and resolve all three roles at the seam (#2487) from origin/main — not from this PR's own changes.

Confirmed via git diff origin/main...HEAD that this PR's actual authored diff against origin/main is unchanged from what was already reviewed: still exactly the same 2 files, byte-identical content, +14/-1 total:

• plugins/work-items/CHANGELOG.md — same T1/T2/T3-retirement changelog entry (now ## [0.35.15], sitting atop the 0.35.14 entry merged in from main). No content change; structure is clean (single title + preamble, no duplicate headers — the earlier flagged formatting issue remains resolved).
• plugins/work-items/skills/triage/SKILL.md — byte-identical to the previously reviewed content (the "Classification vocabulary" paragraph + the T1 multi-surface stub → multi-surface mechanical stub table-row rename at line 145).
• plugins/work-items/.claude-plugin/plugin.json — no longer part of the PR-authored diff at all; origin/main has itself advanced to the same version (0.35.14), so the prior version-bump line dropped out of the comparison.

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md lines 44-48): already assessed across every prior review pass on this PR — the binding rule pairing the autonomous-eligible role label with a work-class: label pre-exists on origin/main, and this PR only documents/renames pre-existing behavior. It neither newly directs triage to write the label nor changes what babysit-loop trusts for merge-eligibility widening. No new information at this head changes that conclusion; still pre-existing and out of scope for this PR.

No security-relevant surface was introduced by the commit since the last review. No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 2m 25s —— View job

---

Code Review

• Gather context (fetch PR diff, read changed files)
• Check skip gate
• Review changed files for correctness/maintainability
• Post findings

Scope reviewed: diff at HEAD 3e4eb98 vs. origin/main — plugins/work-items/CHANGELOG.md (+7/-0) and plugins/work-items/skills/triage/SKILL.md (+7/-1), per this lane's scope (security/trust-boundary findings are left to /review:security-review, which has already covered the work-class: label point on this PR).

Findings: 1 (posted inline)

• plugins/work-items/CHANGELOG.md:6 — The CHANGELOG's top entry is now ## [0.35.15] (this PR's own T1/T2/T3-retirement entry), but plugins/work-items/.claude-plugin/plugin.json:4 still declares "version": "0.35.14". This is a new regression since the last review at head b69a6d5, where plugin.json's version was confirmed to match the top entry. It was introduced by the intervening merge-forward commit 3e4eb98, which resolved a conflict by renumbering this PR's entry from [0.35.14] to [0.35.15] (to make room for an incoming [0.35.14] entry from main, fix(work-items): reconcile role_labels docs and resolve all three roles at the seam #2487) without bumping plugin.json alongside it. Fix: bump plugin.json's version to 0.35.15.

SKILL.md: byte-identical to the version reviewed at head b69a6d5 (no changes since) — no correctness issues, as previously found. The work-class: label trust-boundary question (Codex P1) remains in the security lane's scope and was already assessed there as pre-existing on main, not introduced by this PR.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 1m 11s —— View job

---

Security Review

• Gather context (diff at HEAD f5dd619, changed files)
• Invoke /review:security-review procedure for this PR
• Post findings

Scope reviewed (git diff origin/main...HEAD):

• plugins/work-items/.claude-plugin/plugin.json — version bump 0.35.14 → 0.35.15.
• plugins/work-items/CHANGELOG.md — single, well-formed ## [0.35.15] entry; no duplicate headers or displaced preamble.
• plugins/work-items/skills/triage/SKILL.md — new "Classification vocabulary" paragraph + table-row rename (line 148: T1 multi-surface stub → multi-surface mechanical stub).

Findings: none. The PR-authored diff is byte-identical to the content already assessed across this PR's prior review passes (multiple merge-forwards of main in between changed nothing in the authored content itself). Re-confirmed independently this pass:

• No new code paths, scripts, or GitHub Actions workflow logic. No changes to permissions:, triggers, secrets, or run: blocks.
• No new external-input handling, command construction, path handling, or template interpolation. CHANGELOG.md/plugin.json edits are prose/version-string only.
• Repo-wide search confirms no dangling T1/T2/T3 references remain outside the retirement note itself and the changelog history — the vocabulary retirement is complete and internally consistent.

On the Codex P1 finding (work-class: label / merge-eligibility trust boundary, SKILL.md:44-50): unchanged conclusion from every prior pass on this PR. The binding rule that pairs the autonomous-eligible role label with a work-class: label already exists on origin/main (now at SKILL.md:157), unchanged by this PR aside from position shift. The new paragraph documents that pre-existing C1-C5 ↔ work-class: mapping, and the table-row rename swaps the retired T1 name for the equivalent work-class: mechanical name for the same pre-existing stub-outcome behavior. This diff neither newly directs triage to write the label nor changes what babysit-loop trusts for merge-eligibility widening.

The underlying architectural question — an agent-writable classifier (triage) sharing a label axis that babysit-loop treats as admission-authoritative, per admission-policy.md:88-89's "no repo-local (agent-writable) surface may supply admission input" rule — remains real but is pre-existing on main, not introduced or worsened by this PR, and out of scope for a diff-scoped review here. Worth tracking as a separate issue if not already resolved elsewhere.

No injection surfaces, authorization/access-control regressions, credential handling, or supply-chain/CI risk in this diff.
· branch cursor/retire-t-tier-vocabulary-63e1

[claude]

Claude finished @cursor[bot]'s task in 32s —— View job

---

Code Review

• Gather context (PR metadata, state)
• Check skip gate
• Post findings

Skip gate: triggered (condition 1 — PR is closed / not open).

This PR (#2464) is already merged. Per /review:code-review's skip gate, review stops here for closed/non-open PRs — no further findings are posted.

For reference, this PR was already reviewed extensively pre-merge by this lane (most recently at head b69a6d5, skip-gate condition 4, no findings) and by /review:security-review (most recently at head 3e4eb98, no findings; the Codex P1 finding on the work-class: label trust boundary was assessed as pre-existing on main and out of scope for this diff — worth tracking separately if not already).