chore(memory): promote strong-fit infrastructure drafts from memory-pipeline for review

[Hareet]

Promotes 49 strong-fit infrastructure drafts from agent-memory/_pending/ into agent-memory/domains/infrastructure/issues/ for squad content review.

Categories: bug (22), feature (14), improvement (13)
Themes: HAProxy/CouchDB deployment & upgrades, Helm/Kubernetes charts, Nouveau sidecar, Docker images, CI/security scanning.

All 49 carry domainFit: strong + a ## Domain Rationale section. (infrastructure is a new domain introduced by #119's schema; 1 weak draft deferred to Stream C.)

• Base: seeding-claude-cli-v2 (feat(#108): seeding pipeline - CLI provider, domain-rationale, infrastructure domain, concurrency #119) — retarget to main after the schema lands.
• validate-schema: passing, 0 failures.
• Review for content (domain fit + distillation accuracy), not code.

[Hareet]

Needs to be rebased with main after #119 is merged

[sugat009]

Heads up, this one currently has merge conflicts with its base and will need a rebase before it can merge.

[sugat009]

Content review. The operational core (Docker/Helm/HAProxy/CouchDB/upgrade tooling) is a strong, principled fit and the prose is faithful (verified 10006, 10267, 10557). Blockers:

• issue (blocking): identity keys record the PR number on 21 of 49 drafts (verified against closingIssuesReferences); plus 10689 and 8693 close no tracked issue, so their issueUrl points at the PR itself.
• issue (blocking): 2 duplicate clusters (4 files): issue 10481 = [10482, 10488] (10488 is a 5.0.x cherry-pick), issue 9992 = [10006, 10267]. Separately, 9960 and 10014 are near-duplicate content (both bump CouchDB to 3.5.0) for different issues.
• issue (content): 10267 misattributes an issue. Its "## Related Issues" describes #9992 as "line wrapping in HAProxy config", but issue #9992 is actually "Remove haproxy-healthcheck service from single-node deployments".
• issue: related_issues: [] empty on every draft; domainFit: strong on every draft. Forced picks: 10689 (net-new admin-tool/ Angular app), 10837/10857 (CI supply-chain + credential-scanner security, all .github/+scripts/ci), 10264 (admin-app UI). Borderline: 10045 (mixed admin UI + upgrade service).
• nitpick: classifier/seed reasoning leaks into ## Domain Rationale on ~9 drafts (10512, 10557, 10758, 9119, 9634, 9700, 9717, 11141, 10264): "per the seeds", "the data-sync carve-out", etc.

Clean bill: no secrets, no PII, schema 100% valid.

[sugat009]

issue: the "## Related Issues" section says #9992: line wrapping in HAProxy config..., but issue #9992 is "Remove haproxy-healthcheck service from single-node CouchDb deployments". The PR closes no tracked issue; this misdescribes the linked issue.

[sugat009]

issue: this is a 5.0.x cherry-pick of #10482 (same helm change) written as a novel fix. It omits the Recreate-strategy change and misstates the template edits as a version-string cascade. Duplicate of 10482.

[sugat009]

issue (domain-fit): net-new admin-tool Angular application (all files under admin-tool/); it closes no issue, so issueUrl points at the PR. Infrastructure is a least-bad bin for an app foundation.

[Hareet]

@sugat009 A few caveats on infrastructure domain, but let's get this thru:

Rebased onto main and addressed the review: identity keys relinked via #129's tool (all 44 mappings re-verified against the cht-core API). Clusters collapsed with source_prs[] — 10481 keeps the 10482 account (Recreate strategy) with 10488 as a backport note; 10267 verified as a genuine #9992 follow-up (base64 no-wrap fix to the config #10006 introduced) and folded into that canonical, fixing the misattributed description. Dropped 10689, 8693, and additionally 8996 (also closes no tracked issue). Suspect 10557 was keyed correctly — its body closes #10610; the title scope #10383 is a different, still-open issue. 9960/10014 verified as distinct same-day CouchDB-3.5.0 work and cross-linked. Forced fits re-annotated domainFit: weak (10837/10857/10264) and classifier phrasing scrubbed from the rationale sections.

[sugat009]

Content re-review (post-rework). Identity/dedup are clean. Remaining:

• nitpick (leakage): 11162, 9953, 8794 Domain Rationale carry classifier scaffolding ("per the CI/Docker pitfall", "Per the classification seeds", "…seed example") — strip; this class of cleanup is tracked by #136/#138.
• (For the record: I initially flagged 8996's removal but withdrew it — the helm-repo migration is superseded, chart is now in-repo at scripts/build/helm, so dropping it is correct.)

Cross-cutting (whole promote batch, not blocking this PR alone): filenames still encode the PR number while frontmatter is issue-keyed, and two draft schemas coexist (machine-distilled vs hand-authored) — worth a cleanup pass. Full detail + re-runnable Verify commands are in my consolidated review notes.

[Hareet]

PR #121 — reply to round 2 + request for re-review

The nitpick is addressed. The three Domain Rationale sections you named (11162 "per the CI/Docker
pitfall", 9953 "Per the classification seeds", 8794 "…seed example") now argue from the code.
verify-drafts reports 0 leakage findings in this domain.

I didn't stop at the review. This domain went through everything the other domains converged on
before merging: the full gate suite on frozen bytes, plus an audit of all 43 drafts against
cht-core (at the anchor, on master, and across the commits between). That audit found a good deal
the review didn't name. The worst of it is in Worst first below, after the gate ledger. The
ledger is what shows whether this round can be trusted.

---

Gate ledger (frozen bytes; working tree == the pushed commit)

Tier	Result
validate-schema	64 / 0
verify-drafts, whole corpus (main + this branch, 210 drafts)	0 findings in infrastructure (baseline: 15). The 6 blocking are main's known dedup backlog
verify-drafts on this branch, with git history	0 blocking, 0 warnings, incl. stale-timestamp
verify-drafts --online	0 blocking, 0 warnings, 0 unverified (baseline: 8 blocking, 23 warnings)
ground-claims --added-lines --base c6c9872	395 / 395 grounded over the 905 lines this round added
ground-claims ×3	0 ungrounded, 0 unverifiable, 0 stale on each (811 / 820 / 776 grounded); no degraded drafts
check-coherence ×3	0 contradictions on each, 43 / 43 drafts checked every pass

The baseline at c6c9872 found 19 ungrounded, 9 stale-as-written and 1 unverifiable claims
in 17 drafts. 7 of the 19 were the gate's own path bugs; see The gates had a blind spot
below. Everything else is fixed.

Three runs before the counted one did not converge. They caught seven imprecisions in sentences
this round wrote, across four drafts:

• 9700 named index names that its integration spec builds from a map, then left that map's
  literal unscoped.
• 8978 put the @docker exclusion in the config that only inherits it, and repeated the author's
  loose "api + sentinel".
• 9949 quoted the warning without the $(ulimit) reassignment, then said hosts forbid running
  ulimit when only setting it fails.
• 11141's rationale omitted the dropped await.

All seven were fixed first. None of those runs was degraded. The counted run used a pinned copy
of the CLI and aborts at the first degraded pass.

Worst first

Mechanism inverted or invented. No gate sees this class. All of it came from reading the
issue and the diff:

1. 10512: [chttpd_auth_lockout] mode = warn puts CouchDB's failed-login lockout in log-only
   mode. The draft described a request-rate limiter throttling replication traffic. Its title,
   summary, tags and Design Choices were all built on that.
2. 8942: direction inverted. http-server-close already allowed client-side keep-alive. The
   PR enables keep-alive between HAProxy and CouchDB.
3. 8965: polarity inverted. The fix compares the upgrade doc's target build with
   deployInfo.build. It doesn't normalise version.
4. 10264: the PR stopped the buildVersion filter from appending (~base) and added a Base
   version column. The draft had it the other way round.
5. 11122: api already returned the right version; the test expected the build string. The
   fix is isFeatureReleaseBranch (no doubled prefix) plus the test change.
6. 11162: "renamed the container" is backwards. getContainerName maps any name containing
   nouveau to nouveau; the compose service is unchanged.
7. 8908: the scripts don't URL-encode anything. They pass credentials with curl -u and
   JSON-escape them for _cluster_setup. Only haproxy-healthcheck/check.py percent-encodes.
8. 9119: staging always wrote through database.db. The wrong users-db name broke view
   warming in view-indexer.js (404s in the issue's HAProxy log).
9. 8775: api already read BUILDS_URL (and put it in the CSP). Only admin hard-coded
   BUILDS_DB.
10. 9039: "fail fast" is false. The CouchDB version check runs inside a retry loop that holds
    startup, and its "should throw" test fails on the COUCH_URL check before it reaches the
    version.
11. 10583 was written from the PR description. The logger never read LOG_LEVEL, and the PR
    adds it to the Helm templates rather than correcting them.

The same class, smaller, in 9634, 9953, 11072, 11141, 10045, 9949, 10500, 10014, 9717, 10826,
9074, 10857, 10837 and 8813. Each is in the ledger with its evidence.

Fabricated or unsupported:

• 10557: the loading spinner never shipped. It came from an intermediate iteration discussed
  in review, and a maintainer then declined to add one.
• 8794: "the admin app, /api/v2/monitoring and upgrade tooling" as consumers of the bad
  version had no source. The reported one is a cht-conf upload failure.
• 9288's "test-restart" scenario and 10857's log-scanner.js exist in no ref.

Identity and provenance:

• 9039 was keyed to #9024, which is a French/Swahili translations PR (the PR title has a
  typo). It is re-keyed to issue #9023 and renamed 9039-fix9023-….

• 10557's filename token pointed at #10383, a separate, still-open issue. Its verified key is
  #10610 (the PR body closes it), so it is renamed 10557-feat10610-….

• Four drafts are children of the Nouveau epic (#9542) and said nothing about it:

  • 9717, 9960 and 10181 were squash-merged into 9542_freetext_tco, which reached master as
    #10201 (f1bdfc07c).
  • 9700 was merged into couchdb-nouveau, which went via #9541 (8736d059f) and then #10201.

  Each now carries the Epic-child banner and the refs/pull fetch that makes its source_sha
  resolvable. Merge state was checked via the API (merged: true, base.ref). Where files were
  renamed or superseded, on the branch or after landing, the draft also carries a banner
  scoping those names.

Wrong file, wrong status, drift. The ungrounded claims were:

• literals the code doesn't spell that way (check-coverage for checkCoverage, --offline
  for online-audits: false);
• an image ENV credited to a test override file;
• modified files described as added;
• a deleted Lua script described as modified;
• a deleted spec described as updated.

Drift is annotated wherever master moved on (for example #11134 disabled 10857's scanner steps,
and #11390 re-added the actions: write that 10837 removed). stale: true is now set on 18
drafts: the 4 epic children plus 14 with drift annotations.

Linkage and classification:

• Linkage: related_issues went from 6 to 18 drafts populated (6 → 30 entries). PRs cited as
  issues are now labelled "PR #N", and every gloss quotes the real title (7 were mismatched at
  baseline).
• Categories: changed on nine drafts, each to its issue's Type label. 8775, 8813, 8918 and
  9466 → bug; 9039, 9700, 9717, 10750 and 11072 → improvement. Where no label supports a change,
  the reviewed value stands.
• domainFit: unchanged. 10264, 10837 and 10857 stay weak as you judged them.

The gates had a blind spot. Path extraction only knew the application directories. So
couchdb/, couchdb-nouveau/, haproxy/, haproxy-healthcheck/, nginx/, patches/,
release-notes/ and .github/ paths were never checked: 79 draft/path pairs in this domain
alone. The extractor also started paths mid-path (mock-config/… became config/…) and cut
.yml.template to .yml. Both caused the baseline's 7 false positives. All three are fixed
on memory/draft-verification with specs.

A regression pass over my own changes. The gates prove what the drafts now say. They can't
see what a rewrite removed or quietly made wrong. So every sentence this round changed went to six
independent reviewers who hadn't written the changes. That was 548 of the 894 you reviewed; the
other 346 are untouched. They were told to prove the old text right before accepting any
correction.

• 0 regressions.
• 1 loss, put back: 8908's point that api still fails to start with such a password, and
  that the PR merged with that limitation acknowledged.
• Four over-stated sentences my rewrite introduced, corrected:
  • 10837: "both composite actions" should be the two deploy ones.
  • 10701 (two): cht-form already inherited Karma thresholds; the nyc configs also set
    cwd/include.
  • 11072: "same number of days" should be the same connected_user_interval setting.
• Three precision notes, applied:
  • 8978: four tests/helm templates were moved into scripts/build/helm, not deleted.
  • 9634: the view indexer runs on installs too, not only upgrades.
  • 10758: names the existing cookie spec that covers the Secure flag.

Disclosed, not fixed

• Manual-validation sentences stay out: the author's load test on 8942, a reviewer's large-dataset
  upgrade on 9960, a reviewer's production-cluster run on 9466, and the author's demo-cht upgrade
  on 10482. That follows the rule the landed
  domains use ("verified with a manual quick test" and "Reviewer verified…" are process
  narrative).
• services on the CI-only drafts (10837, 10857, 8918) still lists the application services
  whose images or pipelines they gate. I left it as reviewed.
• 9717's category follows the current Type: Improvement label. The issue read Type: Feature
  until 2025-09-23.
• The drafts don't all agree on listing their own issue under Related Issues. That is harmless to
  the tooling (related_issues never holds the draft's own issue) and I left it.
• Your cross-cutting notes on filenames still encoding the PR number and on the two coexisting
  draft schemas: agreed, and left to the batch-wide cleanup. 10557 and 9039 were renamed only
  because their issue token was wrong.

[Hareet]

PR #121: one more commit since my Oct 2 comment (27ab97a)

Since I asked for re-review on Oct 2, I've pushed one more commit, 27ab97a.

Your round-3 review of #131 (5415306093) found problems our gates can't see. So before you reached this PR, I ran your method here: every sentence of all 43 drafts against the PR diff, the code at the anchor, and master, using the finding classes from that review. It found 1 wrong mechanism and 21 inaccurate or incomplete facts, plus mechanical nits. All of them are fixed in 27ab97a (26 drafts). Each fix was then checked by a reviewer who didn't write it.

Worst first: 9717 (wrong mechanism, the same class as 8738 on #131). The draft said the PR makes the setup view-indexer "warm" Nouveau indexes. In fact CouchDB builds Nouveau indexes whenever a design doc is created or updated. The PR's _nouveau query makes the upgrade wait until the staged design docs' indexes are built before staged and live are swapped. The PR author says exactly this in the review thread on view-indexer.js (2025-04-17). The title, summary, tags, concepts and four sections are corrected, along with the same framing in 9700's #9691 gloss.

Facts corrected

Draft	Was	Now
8794	tag builds always produced an invalid version	only final-release tags did; 4.5.0-beta.1.<build> is valid semver
10264	release rows stopped showing the suffix	they never showed it (version === base_version at release tags)
10045	2 of the k8s upgrade service's gaps	all 4 from #9954, plus its two recorded failures
9970	the API logs "match the naming convention" when nothing matches	it logs and throws only when nothing at all updated; here cht-core.yml matched, so the upgrade counted as successful and couchdb.yml was skipped silently
8908	banner omitted the master Makefile/compose changes	#9963 also dropped the sut service and the backtick/quote characters from the test password
10857	scanner covers api and sentinel logs	it reads all the container logs the harness saves (CouchDB included)
9074	"no log-collection helper"	troubleshooting/view-logs existed (one deployment's first pod)
10758	Related Files listed api/src/services/cookie.js	not in the 7-file change set; #10815 is now linked
10583	#10758 described only by its Helm changes	it also added ENV NODE_ENV=production to both Dockerfiles; #10815 is now linked

Rationales. Where the draft stated a reason or a "rather than X" that no record contains, it now gives the record's reason, or the review-thread decision it had left out:

• 9891, 10826, 9700, 11141, 9960, 11072
• 8918, twice (why linux/arm64/v8; why regctl)
• 8775, now scoped "at this PR", because #10557 later removed close(); stale: true

Mechanical:

• rename notes (10006)
• "(added)" labels (10557, 11072, 8813, 8908)
• PR #N for two bare PR citations
• deleted paths dropped from entities (four drafts; Related Files still lists them as deleted)
• related_issues links, each mirrored on the other draft

Not changed in this commit. The audit also turned up smaller items that I left out to keep the diff reviewable: invented "rather than X" clauses in about a dozen other Design Choices, some omitted review-thread details, incomplete lists, and optional master-drift notes. Happy to do them here if you'd like them in this PR.

Gates at 27ab97a (frozen bytes, identical to the pushed tree)

Tier	Result
validate-schema	107 / 0
verify-drafts, whole corpus (current main + this branch, 210)	0 findings in infrastructure
verify-drafts, with git history	0 findings in infrastructure
verify-drafts --online	0 blocking, 0 unverified
ground-claims --added-lines (base 8fbd8a5)	41 / 41 grounded
ground-claims ×3 (26 touched drafts)	0 ungrounded / 0 unverifiable / 0 stale each pass
check-coherence ×3	0 contradictions each pass

Merge with main (ee82a46) is clean. The Oct 2 comment's ledger covers 8fbd8a5; this table covers 27ab97a.

[sugat009]

I checked all 43 drafts at 27ab97a against each source PR, the code at its anchor and master. A trial merge with main is clean: validate-schema passes 210 and 1,171 tests pass.

I request changes. Five items are blocking:

• 8918:73 and 9717:81: sentences that 27ab97a added state a wrong cause and a wrong mechanism.
• 10701:58, 10837:80 and 11162:60: a wrong property name, a wrong zizmor mechanism and a wrong cause.

The other 47 inline items are non-blocking. Eleven restore dropped verification evidence, as with 10994 on #131. Landed drafts on main keep such checks (for example forms-and-reports 9434), so your Oct 2 rule does not match main.

Please also fix your deferred items in this PR: an invented "rather than X" clause is a wrong fact. The two policy items from #131 apply here too.

Nits (113 lines, not blocking)

• 8794:53 On master, api/src/services/deploy-info.js also exports store (PR #9312, 5152cc5e5), which writes deploy-info.json; only its get delegates to serverInfo.getDeployInfo().
• 8794:55 The banner scopes the helper move but not the test move: on master the version-selection tests are in shared-libs/server-info/test/index.spec.js.
• 8794:63 The clause from 27ab97a is a fragment: "for a final-release tag that lands after the patch segment" has no main verb. The build number is what lands there.
• 8794:75 Circular: the staging ddoc name stays because of "staging ddoc naming". Per the PR body, the staging ddoc version (for branches, historically the branch name) has several uses.
• 8794:91 At this PR, tests/integration/api/routing.spec.js picks the field by the BRANCH env var, not by build type; CI sets BRANCH for every build, tag builds included.
• 8813:66 The code span await asyncio.start_server( copies part of a source line and ends with a dangling (. Line 70 already writes asyncio.start_server.
• 8813:74 Round 3 dropped why the default is WARNING: the PR first used INFO and changed it after a reviewer called it log noise (ce83eaed98).
• 8813:88 Related Files omits five files the PR added under haproxy-healthcheck/: test/__init__.py (named in Testing), README.md, .tool-versions, .gitignore and .dockerignore.
• 8813:95 On master the 127.0.0.1:5985:5984 mock CouchDB port is gone (PR #8870, b7d005219), and no note says so.
• 8908:57 The banner still omits three master changes: PR #9963 removed the test_couchdb_build stage from couchdb/Dockerfile, PR #9151 moved api/src/environment.js, and PR #10006 removed the shellcheck line.
• 8908:100 Testing omits that the old setup() in tests.bats exported admin/password credentials; removing that override lets the cases use the special-character password.
• 8918:65 "at this PR" does not say how master differs. On master, versions.INFRASTRUCTURE also lists couchdb-nouveau, added by PR #10201.
• 8918:69 The code branches on INTERNAL_CONTRIBUTOR, not on push credentials. Line 73 states the right gate.
• 8965:48 The sentence omits the final || ddoc.version fallback (api/src/services/deploy-info.js line 10); that fallback is why only tagged releases broke.
• 8978:88 Related Files omits the root package.json; this PR modified it to add the four k3d scripts that lines 76 and 108 name.
• 8978:92 Related Files omits tests/helm/templates/couchdb-servers-configmap.yaml; this PR added it and PR #10051 deleted it.
• 8978:101 Related Files omits 11 modified test files, among them .mocharc-base.js, couch_chttpd.spec.js, keep-alive.spec.js and nginx.spec.js, which the prose names. All are still on master.
• 8978:104 This PR added the @docker tag section to tests/AUTOMATE_TEST_GUIDE.md; PR #9270 later made the file a deprecated stub. The draft says neither.
• 8978:112 The draft does not say how #8909 ended. It was closed on 2025-05-12 with both suite families kept, because the team was considering a move away from recommending Kubernetes.
• 9039:60 The scoping note covers only the loop, but PR #9073 (42a4b28a9) moved check itself to index.js; checks.js on master no longer defines it.
• 9039:73 The paragraph names the test unsupported version should throw, which PR #9073 deleted; on master the 3.2.0 assertion is in throws on invalid version (optional note).
• 9039:77 The squash commit (1bfc16c07) and PR #9039's title read fix(#9024), but #9024 is an unrelated translations PR; record the mismatch as 10557 does.
• 9039:83 The second sentence restates the domain classifier's rubric (src/utils/domain-inference.ts:109), not an argument from the change; five other drafts here also use "operational lifecycle".
• 9074:60 related_issues omits cht-core-10486, the sibling draft whose PR #10500 deleted all that PR #9074 added. The draft names #10500 16 times. Mirror the link in the 10500 draft.
• 9074:92 The bin list omits the eighth entry, upload, which also points at ./cht-deploy.
• 9074:96 package.json is the only Related Files bullet with no status label. The PR added the unit-cht-deploy script and its call in ci-compile; 1c3277c4e removed both on master.
• 9074:97 "present at this PR's anchor" is true, but the PR rewrote this file from a bash wrapper into the Node.js entry point (GitHub status: modified).
• 9074:122 Round 3 dropped a true fact from round 2: a reviewer confirmed on 2024-04-30 that the PR fixed #9076. The PR's helm.test.js also asserts --create-namespace.
• 9119:41 related_issues is empty, but #9123 and #9146 are real issues about this bug. Other drafts list issues that have no draft (9634 lists cht-core-9617).
• 9119:76 Missing #9123 (CI only upgraded to the build, never from it; closed by PR #9215) and #9146 (the follow-up investigation). Both cross-reference #9117.
• 9119:82 View warming is not upgrade-only: at api startup, check-install.js also stages and warms views when installed ddocs are invalid. Round 3 noted this in 9634.
• 9288:51 HAProxy did not forward requests to the stale IP: its log in #9284 shows <NOSRV>,503, so no server was assigned and HAProxy answered 503 itself.
• 9288:79 listenForApi has drifted. On master it gives up after 3 minutes and repeats /api/info after the first success. The restart case also waits 1 second first (PR #10632).
• 9288:85 Related Issues omits #9997 and #10565, two flaky-test issues filed against the restart case that this PR added.
• 9466:57 The master template sets this subPath only when dataPathOnDiskForCouchDB is set, and the clustered template replaces a %d in it with the node number.
• 9466:65 Overstated: describe-deployment already printed each mount's subPath and PVC claim; the gap was following the PVC to its PV and reporting JSON.
• 9466:91 medic/helm-charts#24 is a PR cited bare; your convention labels it "PR medic/helm-charts#24" (as 10837 does for PR medic/cht-docs#2185).
• 9466:92 medic/cht-docs#1502 is a PR cited bare; your convention labels it "PR medic/cht-docs#1502" (as 10837 does for PR medic/cht-docs#2185).
• 9634:81 The #9284 bullet that 27ab97a added has no closing full stop. The bullets on lines 79 and 80 end with one.
• 9717:32 observability is left over from round 2's removed progress claim; this PR adds no monitoring. Delete the whole line, not only its text.
• 9717:65 The clause that 27ab97a added gives the build on a design doc change as Nouveau only; CouchDB does the same for views. Skip this if line 81 changes.
• 9717:69 On master, PR #11141 (047f5c562) removed the compact() call from cleanup, and no drift note says so.
• 9876:10 "was logging request bodies only partially" reads as every body; small bodies were logged whole. The limit was in what HAProxy could log.
• 9876:50 "inherently incomplete" overstates the limits; short single-chunk bodies were logged whole (pre-PR test at 5e70f64a83^).
• 9876:58 The spec checks only the POST /_session log line for the string password (the field name), not for password values.
• 9876:62 The pattern should also remove the converter's lua-load-per-thread line in global, as the PR did; otherwise HAProxy loads a missing file.
• 9891:56 "whenever process.env.TAG is unset" is narrower than the guard if (!process.env.TAG). CI branch builds set TAG to '' (build.yml line 16), which is also falsy.
• 9949:50 I found no source for "locked-down or restricted environments". #9923 reproduces the error on an ordinary EC2 t2.micro with Docker. Its linked forum thread is about Fedora.
• 9949:77 "per pod under K3D" cannot occur in this teardown. The upgrade suite runs on Docker Compose only, so saveLogs writes one docker logs file per registered container name.
• 9953:49 The banner omits where the tests went: PR #9909 moved should clear cache when requested to server-info, and on master the finalize test asserts on serverInfo.getDeployInfo.
• 9953:83 Overstated: the assertion covers only the GET polls to the mocked messages API in one test, not the broadcast POSTs (27e7c08d1).
• 9953:87 The issue blames outdated deploy info cached after the upgrade; without "outdated", the gloss blames caching itself.
• 9960:52 "Its own PR number" is ambiguous after "That branch" (PR #10201, whose number is on master). Name PR #9960. 9700, 9717 and 10181 use the same wording.
• 9960:56 stale-as-written is a tool label, not a cht-core term; I raised it as a policy item in my PR #131 review.
• 9960:69 Missing article: "a maintenance need".
• 9970:61 New instances already started correctly before this PR, because both helper functions used couchdb.yml. The fix only makes the payload's cht-couchdb.yml match the file on disk.
• 10006:52 stale should be true: the server.spec.js delay that line 92 names changed on master (PR #10566 and PR #10632).
• 10006:92 On master the delay comes before listenForApi(): PR #10566 removed the added line and PR #10632 re-added it ahead of the call.
• 10014:44 PR #11162 wrote lowercase as; the uppercase AS came from PR #11139 (fd7ab0310). The 11162 draft (line 64) quotes the lowercase form.
• 10045:62 The controller does not pass the flag; its template admin/src/templates/upgrade.html passes can-upgrade="canUpgrade" on all four <release> elements.
• 10045:70 The gate is UI only: api never checks canUpgrade for upgrade or complete requests, and the Retry button is not gated.
• 10045:93 The gloss that 27ab97a added drops "clear": #9954 says the service "does not have a clear upgrade path", and line 54 keeps the qualifier.
• 10181:90 tests/utils/index.js is the only PR file here with no status label; the PR modified it.
• 10264:10 base_version is the full package.json version (for example 5.0.0 or 4.22.0), not only the major version.
• 10264:58 On master, PR #10557 put an icon and "No indexing." text in that column. The bm, hi and id locales got empty labels. Only feature-release rows with a differing base_version lost the suffix.
• 10264:66 Design Choices omits why the suffix was removed: a reviewer called the duplication a UX step backwards, and the e2e selector dropped (. Round 3 also dropped the issue's proposed database name, builds_5.
• 10264:74 Related Files lists only messages-en.properties; the PR modified all nine locale files.
• 10482:73 The parenthetical misses k3s-k3d: there the deleted Deployment mounted a hostPath volume. The sidecar always mounts the claim, so on k3s-k3d the PR changed where Nouveau data lives.
• 10500:46 related_issues is empty, but the cht-core-8551 and cht-core-9468 drafts document the deleted code and cite PR #10500.
• 10500:60 The list reads as complete but omits 4 of the 20 deleted files: package.json, package-lock.json, README.md and .gitignore.
• 10500:73 scripts/deploy/src/config.js holds the chart defaults that Problem and Root Cause rely on. This PR deleted it, but Related Files does not list it.
• 10512:40 Line 45 names couchdb:3.5.0; master uses couchdb:3.5.2 (PR #11162). Lockout defaults are unchanged, but 10014 and 9960 set stale: true for this drift.
• 10512:53 The draft does not say that CHT's api keeps its own failed-login rate limiter (api/src/services/rate-limit.js), unchanged by this PR. The rate-limiter tag can mislead agents.
• 10557:64 Overstated: compareLocalToRemote counts the view index only when views changed, and Nouveau disk sizes only when indexes changed.
• 10557:66 Omits that potentiallyIncompatible in admin/src/js/controllers/upgrade.js now parses base_version before version, which changes which releases get the warning.
• 10557:70 Commit 27ab97a points 8775 to PR #10557 (c4fa13bd3) for the buildsDb change (one reused instance, no close() calls), but this draft never mentions it.
• 10557:74 "Never blocks" overreaches. A failed compare does not stop the upgrade, but Stage and Install wait for the compare POST. The reviewer reported a window where the buttons do nothing.
• 10557:91 Related Files lists only messages-en.properties; the PR also modified the ar, es, fr, ne, pt and sw files, which the Solution names.
• 10583:66 PR #10376 already had the sentinel path fix (eb162af831) when it closed. So the sentinel claim is relative to the original contributor's commits, not to PR #10376.
• 10583:74 The sentence that 27ab97a added gives a hedged reviewer concern as the reason to keep the override file. The author's actual reply was a cost argument ("just for testing").
• 10583:96 The gloss still says the containers "never set" NODE_ENV, then says PR #10758 set it. On master both Dockerfiles have ENV NODE_ENV=production; scope "never" to this PR.
• 10701:66 Number agreement: the plural "Shared libs' test scripts" takes the singular "its". Each script runs its own package's test/ directory.
• 10701:70 Same wrong name as line 58: scheduled-tasks stands for the report property scheduled_tasks.
• 10701:88 Besides the eight moved tests, the PR added two new cases to the orderByDueDateAndPriority describe block.
• 10750:47 The attribution is right, but CouchDB 3.5.0's config.erl merges a repeated section in one file. A short note stops agents taking the premise as fact.
• 10750:59 set_nouveau_url (PR #11126) has no section-scoped existence check; it deletes every url = line and inserts after the header, like the log-level block.
• 10750:63 Round 3 no longer says that review replaced the first awk parser. The hazard was sed backslash escaping, not shell or regex. Design Choices omits why the PR uses cp and rm: to keep inodes for single-file bind mounts.
• 10750:71 make test passes no --build, so a local rerun after editing docker-entrypoint.sh tests the old image. CI starts clean and is unaffected.
• 10758:40 entities omits scripts/build/helm/tests/integration-k3d-values.yaml.template, one of the seven changed files. Solution and Related Files name it.
• 10758:69 Code Patterns offers the per-service node_env read as a pattern. The anchor's unguarded form crashed renders (#10815), and PR #10826 rewrote it on master.
• 10758:87 Round 3 dropped the check that the PR body reports: cookie.spec.js ran with 18/18 passing. One clause would keep it.
• 10758:93 In the #10815 bullet that 27ab97a added, the api half is no regression: 5.1 already failed without api: (.Values.api.port). The reported error was on .Values.sentinel.node_env only.
• 10826:71 Optional: the sentence that 27ab97a added omits that the PR author proposed dig, and that the maintainer who agreed later approved the default-dict form.
• 10826:83 Round 3 dropped round 2's statement that all 13 cases pass (PR body). The Validate Helm Templates check passed on the PR head. Only the count remains.
• 10826:95 "canonically infrastructure, not configuration" restates the domain classifier's rule (src/utils/domain-inference.ts:138), not an argument from the change.
• 10837:70 softprops/action-gh-release@v2 became a gh release upload step, not a SHA pin. regctl-installer has no tag comment. The github-actions Dependabot entry took the /admin cooldown (code-scanning alert 291).
• 10857:55 Commit 9af78c7a1 (PR #11121) also added one test to the spec. Master has 16 it( call sites; Testing (line 89) says 15 without scoping.
• 10857:59 In the sentence that 27ab97a rewrote, tests/logs/*.log also holds browser.console.log from WebdriverIO runs. scan-logs.sh scans that file too.
• 10857:63 The logs were archived only when a job failed: each Archive Results step for tests/logs has if: ${{ failure() }}.
• 10857:75 Design Choices omits the review decision to keep CouchDB at debug and strip its OS Process dumps. The #6571 quote is not verbatim ("unexpected errors to be thrown").
• 11072:84 The test for the -1 fallback at line 59 is not named: v2 handles errors gracefully now expects replication_failure to equal { count: -1 }.
• 11072:88 The direct follow-up #11146 is not linked; its PR #11209 reads the logs/replication_failures view that this PR added. related_issues would then list cht-core-11146.
• 11122:59 FEATURE_RELEASE_BRANCH_PATTERN matches only X.Y.Z-FR-<name>, not any version-prefixed branch. 5.1.2-beta still gets the package.json version prepended.
• 11141:10 Cleanup compacted only the five databases in DATABASES, not every database. Root Cause (line 54) scopes this correctly.
• 11141:50 The issue says compaction had run for an hour; the upgrade was already finalized, so "an hour into an upgrade" misleads.
• 11141:87 finalize and abort call cleanup() themselves; nothing runs it after they return.
• 11162:56 The list omits the fourth 3.5.2 item that #11080 names: design docs fetched once per cleanup request.
• 11162:64 Optional: since PR #11139, master reads FROM couchdb:3.5.2 AS base_couchdb_build (uppercase AS), so a case-sensitive search for this literal fails.
• 11162:68 True only for Docker runs. Under k3d, saveLogs ignores SERVICES and saves logs for every pod from kubectl get pods.
• 11162:96 tests/utils/index.js and replication-failure-log.spec.js are test harness and CI work, not work on shipped images.
• 11202:51 Node's fix adds a new guard 'data' listener (freeSocketDataGuard) to free-pool sockets; it does not keep an existing one. 0a22d40180 is the 22.x commit, and 24.17.0 has its own.
• 11202:67 The file is new in this PR; label it (added) as other drafts in this domain do.
• 11202:71 Round 3 replaced the round 2 result with a statement that CI exercises the code. The PR's integration and e2e CI suites passed with the patch.

[sugat009]

suggestion (non-blocking): Round 3 dropped the only verification evidence for this change. On 2025-11-26 the PR author wrote on PR #10482: "I've already verified this with upgrading https://demo-cht.dev.medicmobile.org". Round 2 kept this as "the 5.x upgrade path that originally surfaced the issue". src/scripts/distiller.ts defines testing as "how the change was tested", and this upgrade is the only test. You removed reviewer process narrative from the contacts drafts, but this is the PR author's own check. I raised the same point on draft 10994 in #131. The suggestion adds the upgrade check as one sentence.

Suggested change

	No test files changed; all seven files in this PR are Helm templates under scripts/build/helm/templates/.
	No test files changed; all seven files in this PR are Helm templates under scripts/build/helm/templates/. When asking for review, the PR author reported having already verified the fix by upgrading https://demo-cht.dev.medicmobile.org.

[sugat009]

suggestion (non-blocking): Round 3 dropped the only verification evidence for this config-only change. Your reply discloses manual-validation drops for 8942, 9960, 9466 and 10482 only, not 10512. The approving review on PR #10512 (2025-12-03) records a manual test with images built from the branch. After 10 failed logins as medic there was no Unexpected error, the correct password still worked, and Fauxton showed chttpd_auth_lockout as warn. This is the same point as 10994 on #131. The suggestion adds these results. It leaves out round 2's claim that Docker 27 hit medic/cht-upgrade-service#50; that issue is about Docker 29 and later.

Suggested change

	Config-only change; the PR adds no automated tests.
	Config-only change; the PR adds no automated tests. A reviewer tested it manually with images built from the branch (`npm ci; npm run build-dev; npm run local-images`): after 10 failed logins as `medic`, the login page showed no `Unexpected error`, the correct password still worked, and Fauxton showed `chttpd_auth_lockout` as `warn`.

[sugat009]

suggestion (non-blocking): PR #10826 (f5332b358) changed two paths that the draft names: scripts/build/helm/templates/api/deployment.yaml and scripts/build/helm/templates/sentinel/deployment.yaml. It rewrote the node_env reads that this PR added, to fix the render crash in #10815. The flag still says stale: false. The 10583 draft has stale: true for drift from the same commit. The suggestion sets the flag.

Suggested change

	stale: false
	stale: true

[sugat009]

suggestion (non-blocking): The stale note does not cover release-helm-charts.yml. PR #11310 (b265f47e1) and PR #11432 (b2df584ac) rewrote that workflow. On master it has no top-level contents: write, and its one checkout does not set persist-credentials: false. Line 70 says that both are present. The workflow now triggers on workflow_run, and the cache-poisoning comment in .github/zizmor.yml was rewritten. The suggestion adds these changes to the note.

Suggested change

> **Changed on master after landing (`stale-as-written`):** `.github/workflows/stale-prs.yml` requests `actions: write` again (restored by PR #11390 to allow cache updates), the pinned SHAs have since been bumped (e.g. `actions/checkout` to v6.0.2), and `.github/zizmor.yml` has gained further entries, including an `unpinned-uses` policy that allows a ref pin for `medic/cht-core/.github/actions/andrabot`.

> **Changed on master after landing (`stale-as-written`):** `.github/workflows/stale-prs.yml` requests `actions: write` again (restored by PR #11390 to allow cache updates), the pinned SHAs have since been bumped (e.g. `actions/checkout` to v6.0.2), and `.github/zizmor.yml` has gained further entries, including an `unpinned-uses` policy that allows a ref pin for `medic/cht-core/.github/actions/andrabot`. PR #11310 and PR #11432 rewrote `.github/workflows/release-helm-charts.yml`: it now runs on `workflow_run` when a `Build and test` run completes (its `branches` filter is `'[0-9]+.[0-9]+.[0-9]+'`), proceeds only if that run succeeded and was push-triggered, and publishes the committed `scripts/build/helm-releases` directory to GitHub Pages; its two jobs declare `contents: read`, `pages: write` and `id-token: write` in place of the top-level `contents: write`; its checkout no longer sets `persist-credentials: false`; the `actions/setup-node` step with the inline `cache-poisoning` ignore and the `gh release upload` step are gone; and the `cache-poisoning` comment in `.github/zizmor.yml` now rests on the new trigger.

[sugat009]

suggestion (non-blocking): Round 3 removed the only verification evidence. The test plan in the PR description reports a local zizmor --offline .github/workflows/ run, a YAML syntax check and a check for unpinned action references. Round 2 (c6c9872) stated these checks. At 58547e47, all 68 external action references in the workflow YAML under .github/ are pinned to a SHA. But the zizmor run on master at the merge commit still reported 27 results. This is the same point as 10994 on #131. The suggestion restores the test plan as the PR description's claim and adds the merge-commit result. It leaves out the "12 files" and "19 SHAs" counts, which do not match the final diff.

Suggested change

No tests were added; the diff is CI configuration only (12 modified files under `.github/` plus the added `.github/workflows/zizmor.yml` and `.github/zizmor.yml`). The new zizmor workflow re-checks the workflows on every PR, on push to master, and weekly.

No tests were added; the diff is CI configuration only (12 modified files under `.github/` plus the added `.github/workflows/zizmor.yml` and `.github/zizmor.yml`). The new zizmor workflow re-checks the workflows on every PR, on push to master, and weekly. The PR description's test plan reports local checks: a `zizmor --offline .github/workflows/` run with all findings remediated or documented in `.github/zizmor.yml`, a YAML syntax check, and a check that no unpinned external action reference remained. At this PR every external action reference in the YAML under `.github/` is pinned to a 40-character SHA, but the zizmor run on master at the merge commit still reported 27 findings: 18 `secrets-outside-env` (16 in `.github/workflows/build.yml`, 2 in `.github/workflows/scalability.yml`), 8 `ref-version-mismatch` (6 in `.github/workflows/build.yml`, 2 in `.github/workflows/codeql.yml`) and 1 `dependabot-cooldown` (in `.github/dependabot.yml`).

[Hareet]

Thanks. All 52 inline suggestions are in:

• applied verbatim. lastUpdated is bumped on the 28 drafts they touched; nothing else changed.

One gate pass on those 28 drafts is clean: schema, whole corpus, --online, and coherence with 0 contradictions. The only probe hits are literals that live outside cht-core: CouchDB's req_timedout, Python's safe='/', and the contacts_by_depth view directory.

On the rest of the review:

• Deferred "rather than X" clauses. Agreed, they're wrong facts. Fifteen remain: 9119, 9960, 10006 (two), 10045, 8965, 11202, 10512, 9466, 8942, 8978 (two), 10701, 11072 and 9953. I'll delete each one, and add a replacement reason only where the record supplies it.
• Nits whose note gives the exact text, path or id. I'll apply these as written: status labels, the missing full stop and article, the PR medic/…#N prefixes, the Related Files and entities paths, the related_issues ids (with their mirrors), stale: true on 10006, and 9717's observability line.
• Manual verification evidence. Understood that main keeps it. I've dropped that rule for future rounds.
• Nits that need new sentences (drift notes, mechanism precision, omitted review decisions; most of the 113). Our own rewrites are where the errors come from: both of this round's blocking items were sentences 27ab97a added. Would you mark the ones you want in this PR as suggestion blocks, as you did for the inline items? Or should I write them here for you to review? Suggestion blocks are less likely to need another round.
• The two policy items from chore(memory): promote strong-fit authentication drafts from memory-pipeline for review #131 (stale-as-written as a banner label, and stale vs confidence). I'll apply whatever you decide there to this PR.

I'll push the deletions and the exact-text nits as one commit, then re-request review.