[nplez1]

Closes the four plan items that were still open after #187, plus the four review NITs #187 listed instead of fixing, and gives the nightly a Linux red set so one upstream race cannot mute it.

22 commits, 87 files against nplez1/main; the last two make a known Linux red stop failing the nightly, and are described under "Nightly".

What each item was, and what it now is

§6.5 AI Vault — the fork owns its schema. The fork had added 8 columns and an FTS table to upstream's sessions table, and both sides bumped the same version integer (fork 6→9, upstream 6→8), so a sync forced a merged value of 10 — the same shape that had already hit the parse cache. SESSION_SEARCH_SCHEMA_VERSION is upstream's 8 again; the fork's list state lives in session_list_facts / session_metadata_fts under meta.session_list_schema_version, and triggers on sessions keep them in step, which is what removed the fork hunks from upstream's writer, purge and delete: session-search-retrieval.ts, session-search-retention-delete.ts and ai-vault-host-leg-cache-retention.test.ts are byte-identical to upstream again. What remains in upstream's files is 3 lines, 2 lines, and 5 hunks for two features that are not the sync delta. A v10 database is migrated, not dropped — upstream deletes a file whose version it does not know, so the migration runs before its opener; remove it and the test fails because the file is deleted instead.

§5.9 sync tooling — the proof rule, committed. The 10-25 sync resolved 133 hunks by hand under "upstream never touched this region" with a throwaway script. Now: five proof tiers read from each side's TypeScript syntax tree (never a regex), an --apply-proven that writes only fully proven files and stages nothing, a rename forecast that names the fork references a merge will break before it runs, and a fork-symbol survival check shaped to feed expected-deletions.json. 43 node --test cases; every guard broken outside git's view, all 32 breaks failing a test. Measured: 245 of 421 hunks proven on HEAD vs upstream/main, 159 of 267 files fully proven.

§6.4 Claude spend cap — upstream's, not the fork's. Taken byte-for-byte in all three of upstream's files (verified by git hash-object against cffb527b82, not by eye). The fork's own Claude half is retired; the Codex spend_control half stays and its 23 cases pass unchanged. Two things this fixed rather than traded: the fork read a 0–1 fraction 0.0958 as 0.0958% instead of 9.58%, and it drew a monthly bar from a bare percentage with no cap.

§6.6 renderer — 157 lines out of upstream's stylesheets. main.css and rich-markdown-editor.css are byte-identical to the merge base; the .orca-pr-comment-* block moved to a colocated stylesheet imported by PRCommentThreadCard.tsx, the composer rules to comment-composer.css (it is also rendered by Jira, and is the only caller passing compact/disabled). No moved selector ties on specificity with a remaining rule, and the block stays unlayered, so load order cannot change the result. Five transient fields moved into store/slices/fork-ui.ts; Content.tsx fell from 384 changed lines to 63.

Also here

• The nightly now has a Linux red set, and it fails closed. The Mac allowlist does not transfer to ubuntu-24.04-arm. local/nightly-linux-known-red.json holds the one entry that fails there reproducibly — an upstream daemon disconnectOnly race, every file in its stack upstream-owned with zero fork hunks — and check-nightly-linux-parity.mjs --failures fails on any red no entry accounts for. An entry without evidence is a hard error, not a warning. It cross-checks what each report declares rather than only what it contains: fewer reports than --expect-reports fails (a shard that died uploads nothing), a report declaring more failing tests than could be attributed fails, and a shard red with no failing test at all fails. A file-level error in a file whose listed test also failed is its own red, never absorbed by the entry, and a sibling test whose title merely contains the entry's name does not match it. Suite-level failures that carry no failing test — Vitest worker teardown — are printed as a note and never enforced, or the verdict would be permanently red on noise.

Verified both ways on real artifacts: exit 0 on the current run (1 known, 0 unexpected), exit 1 on the earlier one naming the three branch-gap reds the #187 merge has since fixed, and exit 1 when one shard report is withheld.

• Two pre-existing tooling defects fixed, both found while building §5.9: deletedForkModules read an acknowledged key that 6357e7baa9 had replaced, so it reported FAILED on every run; and its staleness question now asks whether an asserted deletion is present again rather than whether this one sync deleted it (which read all 22 settled entries as stale every time).
• The four chore(fork): retire divergence, make the nightly and gate verdicts honest #187 NITs. Two fixed (the EPIPE guard now has a direct regression test, verified failing without the guard; the Copilot hasData duplication is documented as a deliberate cycle-avoidance). One deliberately not fixed: restoring the /2 margin in the event-loop test means re-adding an unverifiable margin to a gate-blocking test for a flake that appeared once in 137,834 tests. One was already fixed in the chore(fork): retire divergence, make the nightly and gate verdicts honest #187 review round.

The nightly stopped mailing an alarm for a failure it already owned

The 07:19 email was test / tests node 24 4/5 failing on daemon-pty-adapter-history-recovery.test.ts
-- the upstream disconnect race that local/nightly-linux-known-red.json already records with its
evidence. The shard job reds on Vitest's exit code, and the fork's own
local/check-unit-shard-verdict.mjs is what turns that into a failed job, so every recurrence of a
triaged failure emailed an alarm.

The shard verdict now reads the Linux manifest: a failing test that matches an entry is a tolerated
warning and the shard passes, and a failing test that matches nothing still fails, by name. Four things
cannot be absorbed -- a file-level error (including one beside an absorbed row), a report declaring more
failures than it lists, an unhandled error that is not the tolerated teardown race, and a shard that
failed with nothing to explain it. entryFileMatches/entryMatchesFailure are shared with the
cross-shard checker so the two readers of the same artifacts cannot drift apart.

Verified on real artifacts, not only fixtures: the 07:19 run's shard 4 exits 0 with the race named and
tolerated, while run 40485647652's shards 1, 2, 3 and 5 still exit 1, each naming its own reds.

Both gates were run on e477d24a90, the revision the numbers above describe. The only commit after it
adds a paragraph to LOCAL-PATCHES.md, which open-pr.mjs keys gate 1 to the exact SHA and therefore
cannot certify — re-running a 41-minute suite to re-derive the same answer for a markdown line is the
cost this fork's gate policy exists to avoid. Nothing the suite reads changed after e477d24a90.

Verification

Check	Result
pnpm tc	clean — node, cli, web, at e477d24a90
pnpm run check:code-quality:changed	passed, 0 findings across 65 changed files
lint gate	PASS @e477d24a90 — 39 green, 0 failing, 0 known red, 0 new; 102 s
unit gate	PASS @e477d24a90 — 137,850 passed; 17 failed, all 17 in unit-known-red.json; 0 unexpected; 0 flaky re-run; 2,468 s
targeted tests	72 sync-tooling, 27 Linux-parity, 23 shard-verdict, 62 ai-vault-search files, 12 ai-vault ipc, 12 renderer store/jira, 23 vm-recipe, 23 codex spend-control, 22 claude spend-cap
nightly, on this branch	green, 5/5 shards (run 40540799557 @ e2f7f28789, the first Linux run of wave 2). The later commits touch local/sync/**, local/lib/** and one INSERT OR IGNORE, none of which the nightly exercises, so its result still applies
nightly, on main	4 of 5 shards green after #187 merged (was 1 of 5); the remaining red is the upstream daemon race now recorded in the Linux red set

Reviewed by Opus 5.5, high: R1 (1 BLOCKER + 6 SHOULD-FIX fixed), R2 delta (1 BLOCKER + 1 SHOULD-FIX fixed and reproduced before and after), R3 on the CI-verdict commits (1 BLOCKER + 1 SHOULD-FIX fixed, each pinned by a test that dies when reverted); no further round run.

The review was three slices in one round: sync tooling, the AI Vault schema, and renderer/usage/CI. The
Vault slice came back approved with MINORs only; the other two found the BLOCKERs. R1's BLOCKER was a
hunk-edge check that looked only at tokens, so a block comment opened in one hunk and closed in the next
read as "upstream unchanged" and --apply-proven would have written a resolution that dropped upstream's
change. R2 then found that fix had recorded only leading comments — a comment starting on the same line
as the previous token is that token's trailing comment, which TypeScript's leading-comment API never
returns — so the same failure survived in a form the new fixtures happened not to take. Both are now
reproduced as refusal cases, and the JSX fix that over-refused every .tsx hunk was caught in the same
round.

A third round was not run: our rule asks for the user's approval before looping, and a direct
reproduction of each failure is stronger evidence than another opinion. Every fix is pinned by a fixture
proven to fail when the fix is reverted — five mutations for the prover alone, one of them re-run here by
hand to confirm the fixtures are live.

Not done here, on purpose

§6.3 (four upstream-worthy fixes) stays off the table per the product owner. The plan's §5.2 remainder (31 splits that carry fork code) and §6.7 (branch retirement) were closed earlier: §6.7 in this branch, 28 branches archived with pushed tags before deletion.