Repository navigation
chore(memory): promote strong-fit tasks-and-targets drafts from memory-pipeline for review - #123
Conversation
…, CLI, and CI workflow (#128) * feat(#108): add pipeline directory scaffolding and types - Create agent-memory/_pending/<domain>/ for all 8 CHT domains - Add empty agent-memory/_skipped.ndjson for filter audit log - Define pipeline types in src/types/pipeline.ts: ScrapedPR, LinkedIssue, ReviewComment, FilterDecision, SkipLogEntry, ScraperError * feat(#108): implement PR scraper using gh CLI Synchronous scraper that collects structured data from medic/cht-core PRs for the memory distillation pipeline. - Fetches PR metadata, diff, review summaries, and linked issues - Uses execFileSync with array args (no shell injection risk) - 50 MB maxBuffer with ENOBUFS → ScraperError - Graceful fallback for org-membership (read:org not required) - Linked issues extracted via regex; GitHub sidebar links documented as a known limitation (requires GraphQL) - PENDING reviews filtered out - 22 unit tests, all coverage thresholds met * feat(#108): extend schema with provenance fields and add validator - Add 10 optional frontmatter fields to schema.json: source_pr, source_sha, distilled_at, reviewed_by, reviewed_at, confidence, entities, concepts, related_issues, stale - All new fields are optional (backward-compatible with existing entries) - Update TEMPLATE.md with commented stubs and field reference table - Add src/scripts/validate-schema.ts (gray-matter + ajv) to validate all agent-memory /**/*.md frontmatter; 30/30 existing entries pass - Add npm run validate-schema script - Fix YAML syntax error in 10729-smsparser-bugs-typos.md (unquoted colon) * fix(#108): extend linked-issue regex to match full GitHub issue URLs Bare keyword regex (e.g. "Fixes #123") missed the URL form used by some cht-core PRs ("Fixes https://github.com/…/issues/123"). Updated pattern captures both forms and deduplicates across them. Added 2 tests: URL extraction and bare+URL dedup. * feat(#108): add filter stage with deterministic rules and LLM triage Three-stage pipeline filter for ScrapedPR objects: - Stage 1: 5 deterministic skip rules (bot, revert, chore/docs/ci/build, lockfile-only, translation-only) - Stage 2: 3 deterministic distill rules (bug+issue+multiservice, feature+issue, shared-libs+multiconsumer) - Stage 3: LLM triage via ChatAnthropic with Zod structured output; graceful fallback to flag-for-human on failure or missing API key Also adds ScrapedPR.author field, FilterResult/FilterOptions types, and _skipped.ndjson audit log (append-only, skip/flag decisions only). DoD items verified: - All 5 skip rules + all 3 distill rules implemented and tested - touchesMultipleServices edge cases covered - LLM failure -> flag-for-human, no throw - skipLlm option bypasses LLM call - 211 tests passing, branches 89.24%, lines 99.29% * feat(#108): add OpenRouter support with Anthropic fallback to filter triage Switch LLM triage from hardcoded ChatAnthropic to a dual-provider setup: - OpenRouter (OPENROUTER_API_KEY) as primary via ChatOpenAI - Anthropic direct (ANTHROPIC_API_KEY) as fallback - Graceful flag-for-human when neither key is set Also extracts DEFAULT_TRIAGE_MODEL constant and caches the triage chain via a module-level singleton (getTriageChain) to avoid re-construction on every PR in a batch run. TRIAGE_MODEL env var overrides the default (anthropic/claude-haiku-4). * fix(#108): correct OpenRouter model ID and add smoke-test script 'anthropic/claude-haiku-4' is not a valid OpenRouter model ID — updated DEFAULT_TRIAGE_MODEL to 'anthropic/claude-haiku-4-5'. Also adds smoke-test.ts for manual end-to-end pipeline validation. * feat(#108): add distiller stage — LLM-powered knowledge draft generator Implements distillPR() which takes a ScrapedPR that passed the filter stage and produces a schema-valid markdown draft in agent-memory/_pending/<domain>/. - Structured LLM output via Zod (domain enum, required fields) with OpenRouter-primary / Anthropic fallback, matching filter.ts pattern - Deterministic markdown assembly in code; AJV validates frontmatter before the file is written - distillFn injection option for tests (no real API calls in test suite) - Graceful degradation: LLM failure → flag-for-human + _skipped.ndjson - 25 tests, 86.31% branch coverage, all thresholds met * refactor(#108): simplify distiller — fix bugs, extract shared constants, async I/O - Fix double-wrapped error prefix in distillPR catch block (was emitting "Distill LLM unavailable: Distill LLM unavailable: ..." on the no-key path) - Replace sync fs.*Sync calls with await fs.promises.* so batch processing does not block the event loop - Fix .slice-before-filter on review comments so non-empty reviews beyond index 2 are not silently dropped - Derive CHT_DOMAINS list in buildPrompt from the constant rather than a separate hardcoded string that could drift - Extract CHT_DOMAINS, DEFAULT_PIPELINE_LOG_PATH, DEFAULT_PIPELINE_OUTPUT_DIR to src/constants/index.ts; both filter.ts and distiller.ts now import them - Switch process.env bracket notation to dot notation in both scripts - Remove redundant `const parsed = matter` alias in distiller.spec.ts * feat(#108): extend smoke-test to run distiller stage end-to-end Adds distillPR call after a distill decision so smoke-test validates the full scrape → filter → distill pipeline in one run. * test: reproduce bug — second call with same draft content rejected as missing frontmatter * fix: replace gray-matter .matter property check with hasFrontmatter() string check gray-matter v4 caches parsed results in matter.cache[input]. When the same content string is parsed a second time the cached object is returned, which may not retain the 'matter' non-enumerable property. Checking the raw string with hasFrontmatter() before calling matter() is deterministic and cache- independent, making all apply-mode tests reliable. * fix: use dot notation for Record<string,unknown> property access * feat(#108): add OpenReviewOptions/ReviewPRResult types and open-review-pr npm script * docs(#108): document OPENROUTER_API_KEY, TRIAGE_MODEL, DISTILL_MODEL in .env.example * chore: update skipped log with smoke-test run entries * refactor(#108): extract shared schema-utils and clean up open-review-pr - Extract buildValidator, normalizeFrontmatter, hasFrontmatter, REPO_ROOT, SCHEMA_PATH into src/scripts/schema-utils.ts; import from both open-review-pr.ts and validate-schema.ts to eliminate duplication - Fix buggy parsed.matter check in validate-schema.ts to use hasFrontmatter() - Hoist buildValidator() call to module scope in open-review-pr.ts so schema is compiled once per process, not on every openReviewPR() invocation - Replace existsSync+readdirSync TOCTOU pattern with single readdirSync+catch - Deduplicate path.basename call in writeSkipEntry - Bound uniqueBranchName loop to 99 iterations with explicit throw on exhaust - Remove phase 1/2/3 what-not-why comments * feat(#108): add run-pipeline CLI, GitHub Actions workflow, and skipped log update - src/scripts/run-pipeline.ts: CLI entry point wiring Scraper → Filter → Distiller for single PR (--pr) or recent window (--since / default 24h) - .github/workflows/run-pipeline.yml: daily cron (06:00 UTC) + manual dispatch that runs the pipeline and commits knowledge drafts back to the branch - package.json: add run-pipeline npm script - agent-memory/_skipped.ndjson: update with latest smoke-test run entries * fix(#108): resolve CI lint failures — promote ajv/gray-matter to deps, fix auto-fixable errors - Move ajv, ajv-formats, gray-matter from devDependencies to dependencies so n/no-unpublished-require passes for src/scripts/ files - Add missing ajv to dependencies (only ajv-formats was listed) - Run eslint --fix to correct dot-notation and indent violations - Remove unused callCount variable in open-review-pr.spec.ts - Remove invalid @typescript-eslint/no-throw-literal eslint-disable comments in scraper.spec.ts (rule was renamed in typescript-eslint v6+) * test(#108): add branch-coverage tests to meet 85% threshold - Add normalizeFrontmatter lastUpdated→last_updated aliasing test (covers schema-utils.ts lines 49-50) - Add non-Error LLM throw test in distillPR (covers distiller.ts line 275 false branch) - Add empty linkedIssues prompt test (issueContext false branch) - Add undefined prBody prompt test (null-coalescing branch) Branch coverage: 83.53% → 85.06% (279/328) * fix(#108): resolve all SonarCloud quality gate failures Cognitive complexity reductions (max 5 per function): - smoke-test: extract processPR helper (complexity 11→1) - run-pipeline: extract processSinglePR + errorMessage (12→3, 8→3) - open-review-pr: extract parseDraft, findValidDrafts, collectValidPlans, buildDryRunResults, promoteDomain, executeApply (26→1) - filter: extract runLlmTriage + use Set for labels (7→2, 6→3) - scraper: extract fetchMetadata, fetchDiff, fetchReviews (13→2) - validate-schema: extract processEntry + logFileResult (8→4, 9→2) Code quality warnings: - Replace child_process with node:child_process in 3 files - Use import matter from 'gray-matter' (remove unnecessary require assertions) - Use String#endsWith for bot check, RegExp#exec for match - Number.parseInt over parseInt throughout - String#replaceAll over regex replace (distiller, open-review-pr) - Flip negated condition in run-pipeline IIFE - String(fm.source_pr) to prevent [object Object] in template - files.toSorted() over files.sort() in validate-schema - Update scraper.spec.ts proxyquire key for node:child_process Coverage: 83.53% → 85.41% (281/329 branches) * fix(#108): resolve remaining 7 SonarCloud issues - smoke-test: extract filterAndDistill helper (processPR complexity 6→3) + prefer node:os import - filter: extract lockfile/translation booleans in checkSkipRules (7→5) + extract isBugWithLinkedIssueAndMultiService/isFeatureWithLinkedIssue/ isSharedLibsWithMultiService helpers for checkDistillRules (7→3) - open-review-pr: pre-compute sourcePrStr as typed string to prevent [object Object] template literal stringification - validate-schema: add localeCompare comparator to toSorted() * fix(#108): extract checkSkipRules helpers to eliminate && complexity (7→5) * fix(#108): resolve S5852 ReDoS in LOCKFILE_PATTERN regex Replace unbounded .* with [^/]* in the lockfile alternation so the wildcard cannot overlap the (?:^|/) anchor. Eliminates super-linear backtracking (50k-char non-match: ~0.07ms) while preserving match behavior across root-level and nested *.lock paths. * fix(#108): use mkdtempSync for smoke-test temp paths Resolves SonarCloud hotspots flagging predictable temp paths in a publicly-writable directory. mkdtempSync creates a per-run dir with a random name and 0700 permissions. * feat(#108): reconcile frontmatter schema with #87 (camelCase) Adopts #87's converged camelCase schema.json and schema-utils.ts verbatim so the two PRs share one frontmatter contract and the 30 committed agent-memory files validate natively (no lastUpdated->last_updated alias). Distiller changes: - emit camelCase frontmatter (lastUpdated, issueNumber, issueUrl) plus the now-required services and techStack fields - derive issueNumber/issueUrl/id from the first linked issue, falling back to the PR number when the PR closes no issue - serialize frontmatter with js-yaml (correct quoting; fixes unquoted title) and AJV-validate every draft before writing — malformed drafts route to _skipped.ndjson as flag-for-human instead of landing in _pending/ Addresses the review's blocking schema-reconciliation item. * chore(#108): reset _skipped.ndjson to empty (drop dev-run log noise) * docs(#108): document OpenRouter provider-agnostic rationale * fix(#108): address review nits in pipeline stages - filter: narrow LOCKFILE_PATTERN to known lockfile names (no longer skips unrelated *.lock files); pattern is now fully literal (no ReDoS surface) - filter: drop redundant inner try/catch in llmTriage; runLlmTriage is the single error boundary (covers default + injected triageFn paths) - scraper: drop unresolvable linked issues instead of returning empty stubs, so a 404'd reference can't flip a filter skip into a distill - scraper: wrap metadata/reviews JSON.parse in ScraperError (carries prNumber) instead of leaking a raw SyntaxError - distiller: slugify falls back to 'untitled' for symbol-only/non-Latin titles - open-review-pr: escape Markdown special chars in draft titles in the PR body - tests: relabel mislabeled single-service filter test; add coverage for all of the above (359 passing) * fix(#108): address secondary review follow-ups 1-3 - scraper: fetch reviews with `--paginate --slurp` and flatten the array-of-pages instead of string-stitching `[...][...]` — no longer corrupts review bodies containing `] [` or breaks on empty pages - open-review-pr: isolate promotion per domain — a domain failure is recorded as a 'failed' ReviewPRResult and the rest still run; clean up the orphan remote branch when PR creation fails after push - filter tests: stub both LLM providers (ChatOpenAI + ChatAnthropic) and clear both API keys per-test, removing cross-spec env leakage; add an explicit OpenRouter primary-path test 363 passing, 86% branch coverage * fix(#108): address secondary review follow-ups 4-7 - run-pipeline: validate --since/--pr as positive integers (error instead of silently processing nothing); guard the CLI IIFE behind require.main so the module is importable, and cover its orchestration functions (now 100%). - scraper: handle reviews from deleted GitHub accounts (user: null) by falling back to the 'ghost' author instead of dereferencing null. - open-review-pr: resolve source_pr 'owner/repo#N' refs to working /pull/N URLs via a new sourcePrUrl helper, instead of a dead repo-home anchor. - package.json: add the smoke-test npm script. Tests: 380 passing; coverage 97.21% stmts / 86.65% branch (>= 95% gate). * fix(#108): reject partially-numeric --since/--pr (roborev MEDIUM) Number.parseInt silently truncated '123abc' -> 123 and '1.5' -> 1, so partially-numeric flag values passed the positive-integer check. Validate the raw string with /^[1-9]\d*$/ before parsing, via a parsePositiveIntArg helper. Adds regression tests for trailing characters and decimals. * fix(#108): reject oversized --since/--pr values (roborev LOW) A digit string large enough to overflow Number.parseInt passed the regex but produced a non-safe-integer (and an invalid lookback date downstream). Parse with Number() and require Number.isSafeInteger. Adds a regression test. * refactor(#108): clear SonarCloud findings on PR #109 new code - run-pipeline: use Number.NaN over NaN (S7773); throw TypeError for the argument-validation guard (S7786). - open-review-pr: use String.raw for the Markdown-escape replacement (S7780); RegExp.exec() over String#match in sourcePrUrl (S6594); reduce cognitive complexity of promoteDomain and executeApply (S3776) by extracting stageDrafts, deleteRemoteBranch, and promoteDomainSafely helpers. Behavior unchanged; 384 passing, coverage 97.2% (>= 95% gate). * fix(#108): restore missing JSDoc opening tag in constants/index.ts A `/**` line was dropped (likely during rebase), leaving the comment body as bare tokens that TypeScript parsed as code — causing 30+ TS errors and the "Build, lint, and test" CI failure.
|
Heads up, this one currently has merge conflicts with its base and will need a rebase before it can merge. |
1979c05 to
6a2742a
Compare
sugat009
left a comment
There was a problem hiding this comment.
Content review. Prose fidelity is high (8772 reproduces the real 283s->63s benchmark exactly). Blockers:
- issue (blocking): identity keys record the PR number on 15 of 35 drafts (verified);
8838closes no tracked issue. - issue (blocking): hallucinated identity on
9232.id/issueNumber/issueUrl= 137, but 137 ismedic/care-teams#137(a cross-repo link in the PR body) mis-stamped as cht-core; cht-core#137 is the unrelated "Restyle data records". PR #9232 actually closes #9231. - issue (blocking): 3 duplicate clusters (8 files): issue 9231 = [9232, 9282, 9317], 9431 = [9486, 9549], 9552 = [9553, 9555, 9569, 9570].
- issue:
related_issues: []empty on every draft;domainFit: strongon every draft. Forced picks:10390/10432(cht-datasource data-layer, tied to tasks only via the target docs),8932(touchestasks.component.tsandcontacts.component.tsequally),10786(telemetry +replications.js/purger.jspipeline). - nitpick: process-narrative leaks into prose on ~11-18 of 35 drafts (named reviewers, "CI green, all 47 checks pass", "the human reverted an AI change").
Clean bill: no secrets, no PII, schema 100% valid.
…ly, tasks-and-targets) Deterministic relink via #129's relink-issues tool: drafts whose identity keys recorded the merge PR now point at the resolved issue. Frontmatter id/issueNumber/issueUrl lines only; bodies untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ets) Per sugat009's review on #123: fix the hallucinated identity on 9232 — its stored key was medic/care-teams#137 mis-stamped as cht-core; the memory is now keyed cht-core-9231 (PR title scope) with the care-teams Related Issues lines dropped. Collapse the 3 clusters to one memory per issue with source_prs[]: 9231 (9232+9282+9317 sequential facets), 9431 (9486 + 4.13.x sibling 9549), and 9552 (9553+9555+9569+9570 — the two distinct sub-fixes attributed separately, backport lines noted). Drop 8838 (closes no tracked issue — skip-and-flag policy). Cross-domain dedup: 9099 (#6543 facet) moves to the authentication canonical; 10432 (#10344) to the contacts corpus's existing memory; 9975 (#9974) to the forms corpus's existing memory — refs recorded there in touch-ups. Forced fits re-annotated weak (10390 datasource, 8932 cross-component, 10786 telemetry pipeline). Process narrative scrubbed from 11 files (named reviewers, CI-status and AI-change chronology). All 35 mappings verified (live cht-core API + the reviewer's own closingIssuesReferences audit for rate-limited cluster members); validate-schema 89/89; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
80e45db to
1818c23
Compare
Companion to the forms (#122) and tasks (#123) seeders' cross-domain dedup — this corpus canonically owns their issues, so the PR provenance is recorded here: the #9835 memory gains the report-side PRs (#10022 ReportQualifier groundwork, #10246 reported_date fix), and the #10344 memory gains #10432 (targets-by-contact-id datasource support). The 10570 draft (#10509, attachments in contact forms) is removed: the forms corpus's curated 10509 memory owns that issue and now records PR #10570. validate-schema 91/91; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ion) Companion to the tasks (#123) seeder's cross-domain dedup: this corpus canonically owns issue #6543 (multi-facility users), so the aggregate- targets facet from that seeder is recorded here — PR #9099 added to source_prs with a one-line account (aggregate targets gated off for multi-facility users). The canonical now carries all three facets: webapp display (#9094), v3 users API + authorization (#9126), and aggregate-targets gating (#9099). validate-schema 98/98; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rts) Companion to the tasks (#123) seeder's cross-domain dedup: this corpus canonically owns issue #9974 (open contact edit form from task), so the duplicate draft dropped there is recorded here — PR #9975 added to source_prs with a one-line account of the shipped mechanism. validate-schema 95/95; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
sugat009
left a comment
There was a problem hiding this comment.
Content re-review (post-rework). Identity/dedup clean (incl. the 9232→issue 9231 cross-repo fix). Remaining:
- issue (accuracy):
9553invents a backport version (inline). - issue (domain):
10390(target-intervals in cht-datasource) is library extension →data-access(inline).10432was relocated to contacts; same treatment applies. - nitpick (leakage):
10324,9650Domain Rationale scaffolding; strip.
Cross-cutting (whole promote batch, not blocking this PR alone): filenames still encode the PR number while frontmatter is issue-keyed, and two draft schemas coexist (machine-distilled vs hand-authored) — worth a cleanup pass. Full detail + re-runnable Verify commands are in my consolidated review notes.
The largest cross-cutting item, moving the cht-datasource library-extension drafts to a first-class
data-accessdomain + a weightedsecondaryDomains[]field, is in the detaileddata-accessproposal comment on #122.
Every factual claim in the twenty-five drafts on this branch was checked against the cht-core commit it was distilled from. 319 claims confirmed; 71 corrections applied. Each correction was re-checked by a second pass instructed to refute it. Two drafts on this branch contradicted each other, and the source settled both: BACKPORT LINE. 9553 said the fix "was backported to the 4.1.x line (PR #9555)" while its sibling 9486 said 4.13.x. The backport commit c8a7f13ad is titled "...for 4.13.x (#9555)" and is an ancestor of origin/4.13.x but not of origin/4.1.x. 9553 corrected; 9486 was already right. TASK ORDERING. 10362 said tasks are "ordered by due date and then priority"; 9980 said priority descending with due date as tie-break. The shared comparator in shared-libs/task-utils runs a priority cascade first and only reaches compareDates() when priorities are invalid or equal, so 9980 is right and 10362 was inverted. Corrected in 10362. 10362 was wrong in three further ways: the notifications are Android device notifications delivered through globalThis.medicmobile_android, not in-app ones, and are inert in a browser; the new service reads no NgRx state, only RulesEngineService.contactsMarkedAsDirty; and the ordering comparator was not new logic but an extraction of an existing private function out of the tasks reducer. Also corrected: 10772 described its e2e spec as added when the commit modified it (only the target config was added), plus prior-state overstatements, A/M status confusions and telemetry key inexactness across the branch. Left unedited deliberately: 10390's cht-datasource module names, which conflict with 10423's but cannot be checked because its own commit is unrecoverable; and 10436's Mocha-harness attribution, for the same reason. Six proposed corrections did not survive re-checking. 108 claims remain unverifiable, chiefly on drafts whose PR numbers appear nowhere in cht-core history. Nothing was edited on the strength of a claim that could not be checked. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every draft in the batch was edited by the relink, dedup and grounding commits without its stamp moving, so all 25 failed the stale-timestamp check. Stamped today rather than with each file's last content-change date: the stamp edit is itself a commit, so a content date fails on the very commit that sets it - the rule learned twice on the configuration and messaging branches. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ks-and-targets) 10324, 10371, 10436 and 10507 all merged into the 10140_previous-month-targets feature branch and reached master only in that epic's squash, #10423 (622c625427). The epic reshaped them on the way: - the e2e directory was renamed analytics/ -> targets/, so the tests/e2e/default/analytics/analytics.wdio-spec.js these drafts name is tests/e2e/default/targets/analytics.wdio-spec.js on master; - webapp/src/ts/libs/config.ts, created by 10507 and renamed by 10436, does not exist on master at all - only .mocharc.js survives of the mocha harness, and the subtitle handling now lives in rules-engine.service.ts; - RulesEngineService.fetchTargets() is spelled as a bare fetchTargets() on the service (rules-engine.service.ts:501) and really did gain the reporting-period argument this draft describes. Every path is accurate for its own PR, which is why grounding at the anchor passed them; they are wrong only as directions for a reader looking at master today. Each now says so, with the landed location where there is one. This is the drift class the probe was built for, arriving in bulk because five drafts share one epic. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…argets) Same class the reviewer identified on #120 and #130: the grounding pass corrected the sections that assert mechanism against code and left summary and Design Choices asserting what it had just disproved. Every pair below was found by check-coherence over two passes and then verified against cht-core; in each case the corrected body was right and the stale side was rewritten to match it. - 10362: summary said the service is 'wired into task state' and Design Choices said it consumes task state, while Code Patterns says it reads no NgRx state - it subscribes to contactsMarkedAsDirty and fetches docs. - 10480: summary said the counter mirrors the unread-count pattern; Code Patterns says the PR generalises that flow (setUnreadCount became setBubbleCounter). Testing credited the rules-engine integration test with 'the count computation'; the engine contributes the showTask predicate (index.js:117) and the count is computed in the webapp. - 9232: summary said the filter appears only for multi-facility users and single-facility users see no change; Solution says there is no facility-count term, so everyone with a facility list gets it. - 9553: summary said the fix reconciles state against the configuration; the body says isStale only checks the blob has targets and aggregate keys and never reads the configured targets. Solution also said turnover re-scopes/resets emissions; Code Patterns says they are preserved. - 9705: Design Choices claimed the fix throws on WRITE errors; the change is to a read catch-all, and the file's one bulkDocs still only console.errors. - 10623: Design Choices said the filters were reused rather than built; overdue-filter and task-type-filter are new components, both on master. - 8932: summary called the flashed text 'empty-state messages'; Root Cause shows they are end-of-list messages gated on has-items being true. - 10371: Design Choices claimed a new reusable telemetry test util; tests/utils/telemetry.js pre-existed and was modified. - 10324: summary said targets analytics had no way to review prior periods; Problem says target-aggregates already had that filter since #9317. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Real defects: - 9553 called target-accuracy.wdio-spec.js an added e2e spec; it was modified. Its migrateStaleState sentence is also attributed to #9553, but the symbol enters in the #9569/#9570 follow-up - it is absent at dc47c51e4 and present on master at target-state.js:124. - 9980 called tasks.spec.ts added; diff-tree says modified. Drift - true at the anchor, gone from master, now time-scoped: - 10362's shared-libs/task-utils/test/order-by-due-date-and-priority.js, removed by #10701. - 9232's analytics-target-aggregates-sidebar-filter component and spec, folded into the shared analytics sidebar filter by the same #10140 epic that reshaped four other drafts in this batch; its modules.module.ts, dissolved by the Angular 19 standalone migration (#9759); and the can_view_old_filter_and_search / can_view_old_action_bar permissions, both retired from master. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
My drift annotation landed on the entities entry rather than the Related Files line - replace(...,1) hits the frontmatter occurrence first - and the colon inside it made YAML parse the item as a map, so validate-schema went 88/1. Reverted to the bare path, annotation moved to Related Files where prose belongs. Same mistake as 10278 on the configuration branch; entities is machine-readable and any downstream consumer matching on paths would miss an annotated one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…nd-targets) Both had resisted an earlier fix because I corrected one statement and left a third one standing - the same one-section-at-a-time failure this whole exercise is about. 9232 made three incompatible claims about what gates the filter UI. The summary said multi-facility users only; I corrected it to 'has a facility list at all', which was also wrong; Code Patterns still said 'only when facility_id resolves to multiple facilities'. What Solution actually documents is canDisplayFilterButton() gating on !isAdmin plus the legacy permissions being absent, with facility count controlling only the radio group inside the sidebar. All four statements now say that. 9553 said the interval-turnover migration fires 'when the persisted reporting interval no longer matches the current CalendarInterval' while Code Patterns says it reuses the shape check rather than comparing intervals. My previous edit fixed the emissions half of that sentence and left the trigger clause. Rewritten: load() runs the shape check on every hydration. Also time-scoped the two legacy permission constants where they are quoted, both retired from master. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…argets) Repeated ground and coherence passes over the same twenty-five drafts, on the standing rule that recurrence proves a finding real while a single appearance proves nothing. Every item below was checked against cht-core or the issue text, not reasoned about. Wrong facts: - 10362 named the comparator `order-by-due-date-and-priority` in two sections. That is its test file; the export is orderByDueDateAndPriority. - 11142 put FreetextFilterComponent in the tasks module. It lives in components/filters/freetext-filter/ and the Tasks page reuses it. - 10436's Testing called two page objects and both e2e helpers new; diff-tree says both page objects were modified and only targets-helper-functions.js was added. - 10623's Code Patterns credited reports and messages with dropping the duplicated lineage filter and omitted tasks.component.ts, which dropped its own removeUserFacility call in the same PR. Summaries left behind by earlier corrections, the class this branch is supposed to be closing: - 9232 called a regression a missing feature. #9231 says multi-facility users could not view aggregate targets at all in 4.9.0. - 10480 said the unread-count flow was generalised to carry the task count. setBubbleCounter still carries only reports and messages; getBubbleCounter spreads those and adds a task count off another slice. - 8772 stated the short-circuit condition and then its inverse in the same parenthetical. Both true, unreadable together, and two passes read it as a contradiction. Tense, where a file did not survive the 10140 epic: - 10507 called libs/config.ts a helper it introduced and updated at once, and gave it a present-tense home the same draft denies. - 10436 named it twice more unscoped. - 10390 had no "paths are as of this PR" banner at all, despite ten of the twenty-one files its PR touched being target-interval.* names that exist nowhere in cht-core. It gets the banner; the vocabulary rewrite belongs to the data-access work. - 10371's Code Patterns implied one component records both open and selection telemetry. analytics-filter.component.ts records only :open. 10480 also now says why a task due today counts: the due date is parsed date-only, so it sits at midnight, and #3943 asks for exactly overdue and due-today. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- 10423's Testing listed eight test files under one "Added". Six were added; the two e2e WDIO specs already existed and were modified. Both ground passes agreed on this one. - 10324's Testing opened the same way and is worse: its PR adds no test file at all. Every spec named was modified, and the sidebar-filter spec was renamed rather than created. - 9553's summary blamed "a CHT upgrade that changes target configuration". Root Cause blames the #9486 persisted-shape change and the code agrees — isStale is `(state) => !state || !state.targets || !state.aggregate`, a shape check that never reads configuration. added-versus-modified is now five of the findings on this branch. It is caught only when extraction samples the sentence, because deciding it means scoping "Added X, Y and Z" across a coordinated list. A regex attempt at that flagged 126 of 164 mentions, including one sentence reading "(modified, not created)", so it was dropped in favour of running more passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
verify-drafts compares lastUpdated against the file mtime; the previous commit landed after the date rolled over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- 10362's Domain Rationale said the implementation "centers on the task pipeline (new task-notifications service, tasks reducer, ...)" while its own Solution says the reducer is not consumed by the service and was only changed to import a comparator. The reducer comes out of the list. Same class as the rest of this branch: an interpretive section left asserting what the grounding pass had already disproved. - 9232 wrote "added new translation keys (api/resources/translations/messages-en.properties)". The keys are new; the file is not, and the parenthetical reads as though it were. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Solution said the migrated emissions are rewrapped "so handleIntervalTurnover can read them against the active interval", while Design Choices said the same function writes the PREVIOUS interval's target doc. Design Choices is right. handleIntervalTurnover returns early when stateCalculatedAt falls inside the current interval, and otherwise aggregates against calendarInterval.getInterval(monthStartDate, stateCalculatedAt) — the interval the stale state belongs to — and stores that as the target doc. Reading against the active interval is the one thing it never does. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ymbols e1d0df4 corrected which interval handleIntervalTurnover reads, and in doing so named calendarInterval.getInterval and stateCalculatedAt — both real at the anchor, both gone from master because #9718 (also in this batch) removed the interval-turnover mechanism entirely. The drift check flagged them in three of the last four passes. One scoping clause covers the sentence and points the reader at the 9718 draft, which documents the removal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Both round-2 items are fixed, and putting this branch through the same verification the configuration and messaging batches got turned up a class none of us had seen — one epic reshaped five of these drafts before it landed. Details below, worst first. Your two items9553's invented backport version — fixed, and every number in the replacement checks out: git -C $CORE log -1 --format='%h %s' c8a7f13
# c8a7f13 fix(#9552): handle rules-engine stale state after upgrade for 4.13.x (#9555)
git -C $CORE branch -r --contains c8a7f13 | grep -E 'origin/[0-9.]+x$' # origin/4.13.x only
curl -s https://api.github.com/repos/medic/cht-core/pulls/9555 | jq -r '.base.ref' # 4.13.xThe draft now also records why there is no 4.1.x backport: that line's tip is 10324 and 9650 Domain Rationale scaffolding — stripped. The thing worth your attention: one epic, five drafts
git -C $CORE ls-tree --name-only -r origin/master shared-libs/cht-datasource/src | grep target
# .../src/local/target.ts .../src/remote/target.ts .../src/target.ts ← no -interval
git -C $CORE log --all --diff-filter=A -- '*target-interval*' | wc -l # 0 — never on any branchThe four that stay here are now time-scoped with their landed locations. 10390 is not — its vocabulary needs a rewrite, not a patch, and I would rather flag that than half-fix it. It does now carry the same "paths are as of this PR" banner as the others, so nobody reads those ten names as directions to master in the meantime. See below. Everything else the pass foundTwelve self-contradictions across nine drafts, the same class you identified on #120: the grounding pass corrected the sections that assert mechanism against code and left Then five more that my own first round of fixes created — correcting one section and leaving a sibling saying the old thing, which is the failure mode this whole exercise is about, committed by the person fixing it. 9232 and 9553 each needed three passes before every section agreed. Then eighteen more across thirteen drafts in a final round of repeated passes, each checked against cht-core rather than reasoned about. Worth naming, because two were mine and several are classes I had not been testing for:
I also swept all three domains mechanically for any path a draft lists that is absent from All 25 timestamps were stale — the relink, dedup and grounding commits never bumped them. 10390 is left for the data-access workYour inline comment asks to move it to
Doing it here would mean three open PRs racing to add the same enum value, and a corpus where one extender moved while the other seven did not. There is now a second reason: 10390's entire file and API vocabulary needs rewriting to the landed Gate
Those are not single-pass numbers. On this exact content the gate ran four Two I also re-ran configuration and messaging under the corrected tooling to be sure none of the five tool fixes weakened an earlier verdict: configuration 99 grounded / 0 ungrounded, messaging 225 grounded / 0 ungrounded (its 27 unverifiable are the five anchorless drafts carved out of #120, unchanged). One of the fixes actually removed a false finding that had appeared on #120's branch — 10230's Four caveats I would rather state than have you find. The first is the one that matters.
|
sugat009
left a comment
There was a problem hiding this comment.
Round 4. The rework resolved the round-3 self-contradiction class and CI is green, so most of this branch is in good shape: 10279 and 10337 came back fully clean, the 9553 fabricated 4.1.x backport is gone, and leakage is stripped from 10324 and 9650.
Requesting changes on five items I verified myself against the PRs' own diffs and cht-core master. Four are blocking-ish and one is a label error an agent would grep for.
On triage, so this is not a wall of noise: I deliberately dropped about six items that were pure archaeology. Claims like which PR first added a symbol, or what a signature looked like at an old commit, are not worth fixing when the draft states today's reality correctly, and recording the old shape would actively mislead an agent trying to call it. Where a draft states a true-on-master fact with a historical verb ("gains X", "at this commit"), the only real fix is the verb, and I have not filed those. What I have filed is limited to: false on current master, semantically inverted, or fabricated.
One pattern worth naming. The two 9553 paragraphs are byte-identical to the pre-rework version, so 19 commits rewrote everything around them and never touched them. The 10436 and 10362 items are the mirror image of round 3: the pass verified that symbols exist but not that the attribution was right. A sweep of every "this PR added X" and "on master Y" sentence against gh pr view --json files and git grep origin/master would close the whole class.
Each was re-derived from the PRs' own diffs and cht-core master before editing,
not taken on the reviewer's word. All five checked out.
9553 - the symptom was inverted. Issue #9552 reports a crash, not wrong numbers:
`Object.keys(state.targets)` in aggregateStoredTargetEmissions throws
`TypeError: Cannot convert undefined or null to object` because a pre-#9486 blob
is a bare targets map. Interval detection was never the defect --
handleIntervalTurnover already did `moment(stateCalculatedAt).isBetween(...)` and
`calendarInterval.getInterval(...)` at fe795fb^, and #9569 added no interval logic
at all (+1 line in rules-state-store.js, +9/-4 in target-state.js, rest tests).
Title, summary, Problem, Root Cause, Solution, Testing and Related Issues now all
tell the crash story; the e2e case is named ('should handle old format of the
rules-state-store') instead of being called a configuration change.
10436 - the harness attribution was backwards. This PR *removed* the mocha pieces
#10507 had added: config.spec.ts +0/-103, tsconfig.mocha.json +0/-9, .mocharc.js
+0/-2, libs/config.ts +0/-26, all deletions. webapp/tsconfig.spec.json is the
webapp-root karma tsconfig, is on master, and only gained sinon-chai types here.
`getValueFromFunction` was deleted outright (zero-hit on master), not folded --
its role is now getReportingMonth in rules-engine.service.ts, which this PR added.
10362 - `orderByDueDateAndPriority` is not a task-utils export on master.
task-utils exports only setTaskState; the comparator is at reducers/tasks.ts:15
and the service imports it from @mm-reducers/tasks. #10701 moved it back, its
description saying task-utils is for report SMS tasks, not rules-engine tasks.
The draft now records the round trip and names master's location.
10324 - the radio labels are both wrong and the contrast is imaginary. Both
filters render `targets.this_month.subtitle` / `targets.last_month.subtitle` =
"This month" / "Last month"; "Previous month" is zero-hit in messages-en and is
only the ReportingPeriod.PREVIOUS enum value.
10371 - the telemetry segment is `:reporting-period`, matching
collectFilterSelectionTelemetry('reporting-period') and the key its own Solution
already quoted.
Two more on these same drafts, from sweeping the class rather than the instance.
10371 carried the identical epic-rename misattribution filed only against 10324:
the e2e analytics/ -> targets/ rename was #10480 (bed454652) on master, not the
#10423 squash. And 10324 credited itself with the sidebar's `telemetryKey` input,
which it never touches -- #10371 added it; 10324 added userFacilities and
showFacilityFilter.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ded it 10436's correction leaves 10507 as the only other draft describing webapp/src/ts/libs/config.ts, and it attributed the file's disappearance to "the epic" generically. It was #10436 specifically, later in the same epic, which also removed the two mocha pieces 10507 lists in Related Files. Naming the deleting PR makes the pair agree and gives a reader one hop to the whole story. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Re-running the full gate over the reworked branch surfaced these on drafts the round-4 review did not name. Each adjudicated against cht-core before rewriting. 9486 - three passes, because the first two fixes were themselves wrong. The summary said targets were computed "only ... when visiting specific pages", which its own Root Cause contradicts with two 120s ensure-freshness debounces (`ENSURE_FRESHNESS_SECS = 120` at dc3ef42ab^, used twice). Correcting that to "a 120s debounce" then contradicted the same line's "two separate" -- and correcting *that* left Problem claiming nothing ran on incoming changes while Root Cause said the hook called updateEmissionsFor per change. At dc3ef42ab^ that function only does `rulesStateStore.markDirty(contactIds)`: it invalidates, it does not recompute. Problem now says exactly that. 9705 - the Problem opened by locating the swallowed error on the write, while the summary, the next sentence, Root Cause, Solution and Design Choices all locate it on the read that precedes the write. The read is right; the opener is now neutral about which call failed. 10390 - Domain Rationale said "all changed files are shared-libs/cht-datasource plus one API controller", but the PR also changes api/src/routing.js, adds integration tests under the top-level tests/integration/ tree, and touches .mocharc.js and package.json. Reworded to state the scope without under-counting. 8932 - the title called the flashed strings "empty states" while Root Cause shows both are gated on the has-items flag being true (`hasTasks`, `hasContacts`), which makes them end-of-list messages, the opposite of an empty state. Title and the two tags follow. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Round 5 re-review request:All five items are fixed. Each was re-derived from the PRs' own diffs and cht-core Then I did the sweep you asked for in the review body — "every 'this PR added X' Your five10436, the mocha harness (blocking). You were right that the PR removed all of The replacement says where subtitle derivation actually lives, which is your 9553, the symptom and mechanism (blocking ×2). Both were inverted, and both git -C $CORE show 'dc47c51^:shared-libs/rules-engine/src/target-state.js' | grep -n 'Object.keys(state.targets)'
# 43, 67, 227 — a pre-#9486 bare map has no .targets, so Function.keys throws
git -C $CORE show fe795fb --stat | tail -6
# +1 rules-state-store.js, +13/-6 target-state.js, rest tests — no interval logic
git -C $CORE show 'fe795fb^:shared-libs/rules-engine/src/provider-wireup.js' | sed -n '313,332p'
# handleIntervalTurnover, isBetween(currentInterval...), getInterval(...) all already thereSo the turnover facet is the same shape bug: 10362, the comparator (blocking). Confirmed on master — 10324, the radio labels (blocking). Confirmed: both filters use 10371, the telemetry segment. The sweep, and what it caughtYour closing note was the useful part of the review, so I mechanised both halves Path half ( Attribution half ( On the fixed corpus the file-level screen returns 64 candidates and the symbol-level It did find one real instance of your class, on a draft you had already reviewed: 10324 credited itself with the sidebar's # 10324's additions to the component: userFacilities, showFacilityFilter — no telemetryKey
# 10371's additions: @Input() telemetryKey: string = 'target_aggregates';Fixed, and it now points at #10371. Worth flagging one thing the sweep surfaced that I deliberately did not Five more the gate found on drafts you did not name9486 took three passes because my first two fixes were each wrong in a new way 9705 — the Problem opened by putting the swallowed error on the write while 10390 — Domain Rationale said "all changed files are shared-libs/cht-datasource 8932 — the title called the flashed strings "empty states" while Root Cause 10371 — after the segment fix, the Solution read as though everything new was 10390 still stays putUnchanged from last round and for the same reasons: the taxonomy change is your own Gate
The sequence matters more than the totals. Across the round the gate ran 14 Two gate findings were the gate misreading itself, and they are worth naming The first changed the prose anyway. A pass flagged The second I left alone: one pass in fourteen flagged Two |
sugat009
left a comment
There was a problem hiding this comment.
Approving. All five items from review 4845979803 are fixed, and I re-verified each against the PRs' own diffs and cht-core master rather than taking the commit message's word for it.
- 9553 now tells the crash story throughout (title, summary, Problem, Root Cause, Related Issues):
TypeError: Cannot convert undefined or null to objectatObject.keysinaggregateStoredTargetEmissions, with the 4.12 to 4.13.x report. The turnover paragraph correctly states that detection pre-existed (handleIntervalTurnover'sisBetweenandcalendarInterval.getIntervalwere both present before #9569) and that #9569 added no interval logic, and it adds that #9718 has since removed the mechanism entirely. - 10436 states the deletions with exact counts and puts
webapp/tsconfig.spec.jsoncorrectly on master. - 10362, 10324, 10371 all corrected; 10324 now documents explicitly that "Previous month" is only the
ReportingPeriod.PREVIOUSenum value and never a UI string, which is the distinction that made the original wrong.
Two of these went past what I filed, which I want to credit specifically. On 10436 I could only establish that getValueFromFunction was zero-hit on master; you found the actual successor, and it checks out: getReportingMonth is at rules-engine.service.ts:588 on master and PR 10436's own diff adds it. On 10362 you recorded the full round trip (added to the reducer by #9980, moved to task-utils here, reversed by #10701) rather than just correcting master's location.
The self-found fixes in 58a6ca9 and 4ec1d12 are real precision gains rather than churn, and I found no new error introduced by them. The standout is 9486: the old summary said targets were only computed on page visits, and the correction that there were already two once-per-session 120s ensure-freshness debounces verifies exactly at the anchor's parent. ENSURE_FRESHNESS_SECS = 120, one debounce calling fetchTaskDocsForAllContacts() and one calling fetchTargets(), each armed once inside the isEnabled block and never re-armed. That is a claim I never flagged, caught by your own gate.
Also worth noting the method: re-deriving each item from primary sources instead of trusting the review is the right instinct, and it is what caught my own overreach earlier in this batch.
Pre-merge checks: CI green on all four at 58a6ca9, diff confined to agent-memory/, and schema.json is byte-identical to main now that #120 and #130 have merged, so it carries no duplicate change.
One open thread I am deliberately not blocking on. The 10390 domain question (cht-datasource work belonging in data-access) was parked on 2026-07-21 pending the domain existing. #152 now adds data-access and secondaryDomains, so that is answerable whenever you want to sequence it, and this PR's reword of 10390's rationale (naming the controller, the routing.js registration and the test wiring) makes the file set read as even more clearly library-centric. Happy for that to be a follow-up rather than a change here.
Resolving my stale threads on this PR since the underlying items are all addressed.
… we broke
The important one first.
**10071: an earlier commit on this branch replaced true claims with false ones.**
The sweep concluded that `createReport` was fabricated and that
`src/qualifier.ts` "was never part of this work", both checked against the
epic squash — because at that moment the child PR's own merge commit was not
in the clone. It is now, and it says the opposite:
git diff-tree --no-commit-id --name-status -r -M cab214534 d40e65bae7
# M shared-libs/cht-datasource/src/local/report.ts
# M shared-libs/cht-datasource/src/qualifier.ts
# M shared-libs/cht-datasource/test/local/report.spec.ts
# M shared-libs/cht-datasource/test/local/person.spec.ts
git show d40e65bae7:shared-libs/cht-datasource/src/local/report.ts | sed -n '81p'
# export const createReport = ({
`createReport` is real at this PR, taking a `ReportQualifier` and rejecting
`_rev`; the qualifier.ts change is one line, exporting `ReportQualifier` so
the adapter can name it. The #10083 squash then renamed the operation to
`Report.v1.create`, moved it into a `v1` namespace and replaced the qualifier
with `Input.v1.ReportInput` from a new `src/input.ts` — none of which is in
this PR's diff.
So the original draft was right and we corrected it into being wrong. The
draft now records both views and says which is which, the way the 10140 epic
children on #123 do. The flat statement "there is no `createReport` symbol
anywhere in cht-core's production code" is gone; it was false.
This is the exact laundering this exercise exists to prevent, and it happened
here because an anchor moved between passes: the clone acquired the child
commit mid-run, so passes before and after disagree about which tree to judge.
Worth knowing that an unresolvable anchor is not a stable property of a clone.
Also:
8336 cited ngo-create.xlsx as a regenerated fixture; it is `A`, the one
file the PR adds. Cites two genuinely regenerated fixtures instead.
8740 a second `relevant.js` in Design Choices, sibling of the one already
reworded — the same third-party path in the same draft, missed first
time because only one occurrence was quoted.
10756 said the widget parses `cht:unique_tel`. It parses the rendered
`data-cht-unique_tel`; `cht:unique_tel` is what pyxform emits into the
XForm instance.
9340 "behavior is selected from appearance … rather than the field type"
was too absolute. `_init` reads
`$wrapper.attr('data-cht-unique_tel') === 'true' || deprecated.isDeprecated($wrapper)`,
so the legacy shape still turns dup-checking on through the second
branch — which is why the draft can say legacy behaviour is preserved
without contradicting itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ontacts)
Every item was checked against the PR's own diff and cht-core master before
being changed, not taken on the review's word. All four held up.
**9281 -- the getAll AsyncGenerator was inverted.** The draft said the generator
yields pages and showed a nested loop. It yields individual docs:
git -C $CORE show refs/verify/pr9281:shared-libs/cht-datasource/src/libs/data-context.ts
# getDocumentStream ... : AsyncGenerator<T, void>
# for (const doc of docs.data) { yield doc; }
git -C $CORE show refs/verify/pr9281:.../test/libs/data-context.spec.ts
# 131: it('yields document one by one'
Rewritten to the flat `for await (const person of Person.v1.getAll(ctx)(q))`
shape. Two facts found while verifying and now recorded: the PR squash-merged
into the `9193-api-endpoints-for-getting-contacts-by-type` feature branch
(`bf8a77da`, not an ancestor of master) and reached master only via #9311
(`34dd0303c`); and the helper was renamed before landing -- at #9311's squash it
is already `getPagedGenerator` in `libs/core.ts`, with `getDocumentStream` absent
and the signature already `AsyncGenerator<Person, null>`. Time-scoped, not
silently corrected to master's shape. The same PR also swapped getPage's numeric
`skip` for a string `cursor` and moved it ahead of `limit`
(`- return fn(personType, limit, skip)` / `+ return fn(personType, cursor, limit)`).
**10043 / 10057 / 9266 / 9281 / 9835 -- data-access, deferred with disclosure.**
The reviewer's own "extend vs use" rule is satisfied: all four anchor PRs touch
`shared-libs/cht-datasource` and nothing else (`git diff-tree --name-only` per
squash). Deferred per the reviewer's own sequencing on #122 -- "one coordinated
schema/taxonomy PR ... Not blocking any single PR" -- and the #123 precedent.
`data-access` is not a valid `domain` today (`agent-memory/schema.json` CHTDomain
enum holds 9 values, none of them it) and PR #152 adds it, open and unmerged, so
re-keying here would race #152 for the same enum value. Each of the five now says
so in its own text rather than leaving the reader to infer it.
**9007 -- Domain Rationale leakage stripped.** "Per the infrastructure pitfall"
is classifier scaffolding; replaced with the substantive reason. While verifying,
the vague `page_size` prose was pinned to the real constant:
`- private readonly PAGE_SIZE = 50;` / `+ private readonly PAGE_SIZE = 25;`.
Also dropped "verified with a manual quick test" -- PR #9007's body has an
entirely unchecked review checklist and says nothing about manual testing.
**9915 -- the dropped attribution, justified rather than restored.** Round 2
reworded "Reviewer verified the correct workflow (xlsx edit -> xml regeneration)
was followed" to drop "Reviewer". Restoring it would re-assert something the diff
contradicts: of PR #9924's 29 changed `.xml` files only 17 have a same-named
`.xlsx` beside them; the other 12 are the place create/edit forms, expanded from
4 shared `PLACE_TYPE-*.xlsx` templates and edited directly. The section now
states what is checkable from the diff. Counts corrected against the real file
list (50 files, all M -- 29 xml / 21 xlsx; default/app 10->11, covid-19/contact
6->8).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ntacts) Closes the loose end from #123's review, which said `10432` "was relocated to contacts". It is here -- as `10344-targets-by-contact-id-cht-datasource.md`, keyed by the issue (#10344) rather than the PR (#10432), which is why looking for a `10432-*` file finds nothing. Nothing was dropped. What it needed was scoping, because PR #10432 never merged: git -C $CORE merge-base --is-ancestor refs/verify/pr10432 origin/master; echo $? # 1 git -C $CORE grep -c byContactUuids origin/master # no output git -C $CORE grep -lc byContactUuids refs/verify/pr10432 # 12 files The draft asserted all of it as shipped behaviour. It now opens with a banner saying otherwise and carries `stale: true`. Two claims in the first draft of that banner were wrong and are fixed here: - It said no commit in cht-core history references the PR. One does -- `db9694ef0 feat(#10344): support targets by contact id in cht-datasource (#10432)` -- it is simply not reachable from master. Stated that way now. - It listed `bindGenerator()` among symbols existing "only on that open PR's branch". `bindGenerator` is on master in six files, added by epic #10423 (`622c62542`); #10432 introduces its own independently, the epic not being an ancestor of the PR. Master's `target-aggregates.service.ts:35` binds `Target.v1.getAll`, not the `TargetInterval.v1.getAll` this draft names. So the summary's flat "None of this API exists on master" was also too strong. Code Patterns and Design Choices credited this proposal with `bindGenerator`; both now point at #10423. The contact-UUID filtering vocabulary really is PR-only, and the epic really does lack it (`git grep -c byContactUuids 622c62542` -> 0), so the rest of the banner stands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rounds 3-5 on #123 found more defects outside the reviewer's list than in it, so all 37 drafts were swept for the same classes. Every finding below was settled against the anchor PR's own diff or `origin/master`, never reasoned about. `9264`, `9390` and `10713` came back clean and are untouched. Worst first. **9230 -- the whole draft was polarity-inverted.** It said leftover action-bar logic *prevented* editing a home place and the fix *restored* it. The real bug is the opposite: the Edit button was wrongly *enabled*. git -C $CORE show 9f900220 -- .../contacts-content.component.ts # - canEdit: ... this.userSettings?.facility_id !== this.selectedContact?.doc?._id, # + canEdit: ... !this.userSettings?.facility_id?.includes(...doc?._id), # issue #9229: "Old action bar should PREVENT users with multiple facilities # assigned from editing the homeplace" Once `facility_id` became an array, `['x'] !== 'x'` is always true, so `canEdit` was always true. Title, summary, Problem, Root Cause, Solution, Design Choices, Domain Rationale and the `tags` all carried the inversion; all were rewritten together. Also time-scoped: the action bar and this `canEdit` block were removed from master by #9361, so `stale: true`. **8684 -- describes a feature that is not on master at all.** `stale: false` was the most damaging assertion in the corpus. git -C $CORE merge-base --is-ancestor 59a1dbd2 origin/master; echo $? # 1 git -C $CORE branch -a --contains 59a1dbd2 # 4.4.1-FR-barcode, 4-4-cares, ... for s in search_by_barcode BarcodeDetector can_use_barcode_scanner; do git -C $CORE grep -l $s origin/master | wc -l; done # 0 0 0 PR #8684 merged into the `4.4.1-FR-barcode` release branch and issue #6669 is still open. Now `stale: true` with the landing recorded. Two more: it credited itself with `browser-detector.service.ts` (`M` here; added by #7568 in 2022, this PR adds one method), and misquoted the telemetry literal -- `barcode_no_detected` where the code says `barcode_not_detected`. **8984 -- the 50-report cap was described backwards.** The draft said the summary saw "only the first 50 reports". `search.js` slices the *tail* of the date-sorted rows, so it keeps the 50 most **recent** and drops the oldest -- which is why issue #8815 is titled "Only **last** 50 reports for contact are provided" and reproduces by submitting 50 reports *after* the pregnancy. Corrected in all four places, plus `search.service.ts` annotated as not modified by this PR and the separate `DISPLAY_LIMIT = 50` display cap disclosed. **9601 and 9625 -- prose transcribed from a PR description, not its merged code.** `9601` named `is_canonical`, a `duplicate_info` section and `context.duplicate_check`; none exists at the merge commit or on master (the real shapes are an `[duplicate-contacts]` content-projection slot and a top-level `duplicate_check`). `9625` claimed freetext search for person and place; the PR adds `getUuidsPage`/ `getUuids` to contact and report only, and creates two controllers rather than adding endpoints to four. Both were independently flagged by `ground-claims`. **Attribution corrected on 9295, 9368, 9090, 9177, 10141.** Five drafts credited themselves with files or symbols another PR introduced -- #9295 called five files new that #9090 created and are `M` in its own diff; #9368 claimed `/api/v1/person` when its only added route is `/api/v1/place` and person was already in its parent tree; #9090 tagged four files it created as #9176's; #9177 put `getByUuid` in `place.ts` when it lives in `index.ts`; #10141 claimed a public export that #10157 added. Non-existent namespace members (`Person.v1.getPageByType`, `Place.v1.getByType`, `Person.V1`) corrected to the real exports, with the `getDatasource()` facade names distinguished from them. **Drift disclosed, not silently corrected, on 8684, 9230, 9426, 10777, 10804.** Each edit was followed by a re-read of the whole draft; that pass caught a further nine sibling contradictions the individual findings had not named -- `9230`'s Domain Rationale, `8995`'s YAML title, `9295`'s Design Choices and Testing, `9368`'s Related Issues and Domain Rationale, `9090`'s Related Issues, `9625`'s summary and Domain Rationale, `10141`'s `concepts` -- which is the failure mode this exercise is about. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…heckers memory-draft-verification.md says what each checker decides. It does not say how to run a round, and four rounds across #120/#122/#123/#132 kept re-learning the same operational lessons — three of which cost this session hours: --dir scoped to one domain hides cross-domain duplicates. #122 carried a draft duplicating a landed contacts draft's identity for three rounds because every run was scoped to its own domain. no --changed-only on the semantic tiers. Both support it. Without it a pass costs ~27 minutes over 40 drafts instead of ~3 for the six actually edited. anonymous gh. 60 requests/hour, exhausted by one domain, reported as `unverified` counts that read like content defects. It also records the two things that make a round converge rather than merely end: three consecutive clean passes per tier on frozen committed bytes (with the g17-g19 case that proves why one clean pass is not evidence), and the four-step claim protocol — quote, anchor, master, AND the commits in between. Step four is the one that gets skipped, and skipping it produced both of the self-inflicted defects in #122's round 3. Plus the measured base rate nobody wants to write down: 3 of 7 round-3 items on #122 were introduced by the round-2 remediation, so "read the siblings of any section you fix" is a rule, not advice. Also lists the recurring probe artifacts (counterfactuals, placeholder literals, package specifiers, XLSForm columns, dotted prose forms, epic-branch symbols) so they are recognised rather than "fixed" by weakening a true sentence, and adds the three new cross-field checks to the reference table. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds `data-access` as a tenth CHTDomain so cht-datasource library work has a principled home instead of being scattered across product domains, and adds an optional `secondaryDomains: CHTDomain[]` so a memory can declare the product areas it also serves without a second co-equal primary. Enabling change only: no memories are moved or re-keyed here, so it can land independently of the in-flight content PRs (#122/#123/#132) and conflicts with none of them. Adding a value to the taxonomy touches more than schema.json — the enum is mirrored by CHT_DOMAINS and locked to it by taxonomy-schema-sync.spec.ts, and four `Record<CHTDomain, ...>` maps are exhaustive: - agent-memory/schema.json enum + secondaryDomains (uniqueItems, minItems 1, optional) - src/constants/index.ts CHT_DOMAINS, the single TS source of truth - src/utils/domain-inference.ts DOMAIN_DESCRIPTIONS - src/agents/documentation-search-agent.ts domainKeywords + mock findings - test/utils/ticket-validator.spec.ts expected domain-list error string ticket-parser.ts had a hardcoded domain list in its error message that had already drifted (it never gained `infrastructure`); it now derives from VALID_DOMAINS so it cannot drift again. agent-memory/README.md was likewise still documenting 8 domains — corrected to 10, restoring the missing `infrastructure` row alongside the new one. secondaryDomains is deliberately inert for now: retrieval selects candidates by primary-domain directory, so nothing reads it until candidate selection does. That is called out in the field description and left to the #151 Phase C union-selection work (which sits on the loader that #135 fixes) rather than bundled here. Known gap, non-blocking: code-context-agent.mock-data.ts types its map as Record<CHTDomain, MockCodeContextData> but builds it via a JSON.parse cast, so it silently lacks both `infrastructure` and `data-access`. Reads are guarded by `|| EMPTY_MOCK_CODE_CONTEXT_DATA`, so mock mode degrades rather than crashes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(#151): add data-access domain and secondaryDomains field Adds `data-access` as a tenth CHTDomain so cht-datasource library work has a principled home instead of being scattered across product domains, and adds an optional `secondaryDomains: CHTDomain[]` so a memory can declare the product areas it also serves without a second co-equal primary. Enabling change only: no memories are moved or re-keyed here, so it can land independently of the in-flight content PRs (#122/#123/#132) and conflicts with none of them. Adding a value to the taxonomy touches more than schema.json — the enum is mirrored by CHT_DOMAINS and locked to it by taxonomy-schema-sync.spec.ts, and four `Record<CHTDomain, ...>` maps are exhaustive: - agent-memory/schema.json enum + secondaryDomains (uniqueItems, minItems 1, optional) - src/constants/index.ts CHT_DOMAINS, the single TS source of truth - src/utils/domain-inference.ts DOMAIN_DESCRIPTIONS - src/agents/documentation-search-agent.ts domainKeywords + mock findings - test/utils/ticket-validator.spec.ts expected domain-list error string ticket-parser.ts had a hardcoded domain list in its error message that had already drifted (it never gained `infrastructure`); it now derives from VALID_DOMAINS so it cannot drift again. agent-memory/README.md was likewise still documenting 8 domains — corrected to 10, restoring the missing `infrastructure` row alongside the new one. secondaryDomains is deliberately inert for now: retrieval selects candidates by primary-domain directory, so nothing reads it until candidate selection does. That is called out in the field description and left to the #151 Phase C union-selection work (which sits on the loader that #135 fixes) rather than bundled here. Known gap, non-blocking: code-context-agent.mock-data.ts types its map as Record<CHTDomain, MockCodeContextData> but builds it via a JSON.parse cast, so it silently lacks both `infrastructure` and `data-access`. Reads are guarded by `|| EMPTY_MOCK_CODE_CONTEXT_DATA`, so mock mode degrades rather than crashes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#151): route data-access through the distiller prompt and close the 8-domain doc drift Review round 2 on PR #152 (sugat009). Both blocking items and every foldable non-blocker, as one delta commit so the round is diffable before squash. Blocking: - domain-to-components.json now carries all 10 domain keys: the missing `infrastructure` entry is added with the suggested empty skeleton, so gatherDomainContext stops returning null for infrastructure tickets. `last_updated` restamped. - The data-access routing rule now reaches the distiller, not just ticket inference: DOMAIN_EXAMPLES gains entry 9 (extending cht-datasource itself — entity modules, qualifiers, local/remote implementations, backing controllers/routes — is data-access, while code that merely consumes the library stays in its own functional domain), DOMAIN_PITFALLS pitfall 6 gains the explicit carve-out, and domain-inference.spec.ts locks both with a scoping block mirroring the ed07177 infrastructure precedent. Doc drift (items 1-3, 5) — every surface that still described an 8-domain world now lists 10: TEMPLATE.md's frontmatter roster line plus a secondaryDomains row in its Field Reference table, docs/ticket-format.md's domain table, tickets/README.md's numbered list, and the prompt-roster spec assertion now loops over CHT_DOMAINS instead of spot-checking one domain. ticket-validator.spec.ts likewise derives its expected error from CHT_DOMAINS instead of hand-rolling the roster. Item 4: MockCodeContextDataset.domains is now Partial<Record<CHTDomain, ...>>, making the JSON.parse cast honest about the two missing keys; the only read site already falls back to EMPTY_MOCK_CODE_CONTEXT_DATA. secondaryDomains hardening: took the suggested description text ("to be human-set... annotations pending") with one added clause, and implemented the self-reference check now rather than as a fast-follow — crossFieldErrors() in schema-utils.ts (a pure helper, since validate-schema.ts executes main() on import), wired into validateFile, specced in test/scripts/schema-utils.spec.ts, and verified live: a draft listing its own primary as a secondary fails with field="secondaryDomains" must not include the primary domain. Also dropped the dead 'cht-datasource' keyword from the domainKeywords row (substring 'datasource' always matches first). Deferred, deliberately: deriving extractTopics' vocabulary from domainKeywords (follow-up refactor), and TEMPLATE.md Example 3 — it describes #9838 as a consumption sweep, which under the new pitfall stays in the consumer domain, so it re-keys in #151 Phase C with repo evidence rather than here on faith. Gates: npx tsc --noEmit clean; npm run validate-schema 64 passed / 0 failed; npx mocha 1005 passing (+4: two crossFieldErrors cases, two scoping locks); eslint clean on all touched files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Update agent-memory/TEMPLATE.md Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com>
…y-pipeline for review (#122) * chore(memory): promote strong-fit forms-and-reports drafts for review * fix(#135): relink id/issueNumber/issueUrl to real issues (metadata-only, forms-and-reports) Deterministic relink via #129's relink-issues tool: drafts whose identity keys recorded the merge PR now point at the resolved issue. Frontmatter id/issueNumber/issueUrl lines only; bodies untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#135): collapse duplicate clusters + review fixes (forms-and-reports) Per sugat009's review on #122: collapse all 6 flagged clusters plus the 6 old-vs-new collisions the relink surfaced (12 total) to one memory per issue with source_prs[] — backport sets 8745/9429/9604, layered features 10040/10041, and folds into the curated issue-keyed memories for 10133, 8225, 8306->8308, 8806, 9227, 9301. The 10922/11116 attachment-routing near-dup collapses to the child issue #10904 with the epic #10700 noted in prose. 16 files removed. Cross-domain: the #9835 pair (10022, 10246) moves to the contacts canonical that owns the issue; the misdomained smsparser draft (10730) drops in favor of messaging's #10729 memory; the curated 10443/10509 memories absorb the infra (#10445) and contacts (#10570) branch PRs. 8740 keeps issue #7462 (title names it; the closed Enketo-uplift issue matches the work) rather than dropping as no-issue. Category fixes per issue labels: 9414 and 9840 -> improvement. Forced domain fits re-annotated weak (9512, 9513, 11023, 9641); 9592 stays strong. Reviewer/process narrative and classifier phrasing scrubbed. All 47 mappings verified against the live cht-core API (0 mismatches); validate-schema 95/95; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#135): record tasks seeder PR on the #9974 memory (forms-and-reports) Companion to the tasks (#123) seeder's cross-domain dedup: this corpus canonically owns issue #9974 (open contact edit form from task), so the duplicate draft dropped there is recorded here — PR #9975 added to source_prs with a one-line account of the shipped mechanism. validate-schema 95/95; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#122): the four review items, each re-derived before editing 9227 — the reviewer is right and the case is stronger than the comment. `cht:luhn-check` is absent from every ref, not just master: git log --all -S'cht:luhn-check' --oneline # empty git log --all -S'cht:validate-luhn' --format='%h' # 3c2b140a3, one commit git tag --contains 3c2b140a3 | sort -V | head -1 # 4.10.0 Renamed throughout. Reading the source turned up two the review did not cover: Testing claimed an empty-string edge case that none of the sixteen tests under describe('#validate-luhn()') exercises, and the usage example dropped the real optional expLength argument. Both corrected, and the draft now notes that the same commit registered cht:strip-whitespace, which is why spaced input passes. 9592 — kept at domainFit: strong, against the review. The premise is that it is the same class as 9512/9513. 9512 is a canDeactivate guard across eight *.routes.ts; 9513 is a localStorage date check in training-cards.service.ts; neither touches form-engine code. 9592 adds training-cards-form.component.ts, which builds an EnketoFormContext, calls XmlFormsService.get() and FormService, and implements renderForm() and saveForm(), plus three real XForm fixtures. Grading it weak would make the corpus less consistent, not more. The rationale now cites the component so a reader can check the call instead of trusting the grade. 11165 — stripped the scaffolding ("so no pitfall redirects apply"). Swept the corpus for the same shape; it was the only one. The "least-bad home" sentences in 9512, 9641 and 11023 are ordinary rationale prose and stay. 9512 — its Domain Rationale said the guard is wired across "seven" feature modules, which is the phrasing from the round-1 review comment, whose own parenthetical lists six. It is eight, and the draft's own Solution enumerates all eight, so the draft contradicted itself: git diff-tree --no-commit-id --name-status -r -M 49dcd919a | grep -c routes.ts # 8 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the claims the grounding and coherence gates flagged Every one re-derived from cht-core before editing, because three of the gate's own findings turned out to be wrong (see the next commit's note and the tooling branch). Fabricated symbols, with the real name established from the tree: 8806 ValidationResult / validation_result.js — the PR DELETES that file (D in its own diff) and ADDS validation_utils.js; ValidationResult appears nowhere. isSubmittedInWindow is fictional too; the real validators are exists, unique, uniqueWithin, validPhone, uniquePhone, isISOWeek, isAfter, isBefore. Its Solution also still described the architecture the PR removed, contradicting Design Choices. 10071 createReport / 10180 updateReport — the API is Report.v1.create and Report.v1.update inside a namespace; createReport survives only as a test stub name. 10180 also listed test/input.spec.ts, added on no ref. 8759 contact_by_parent — the view is contacts_by_parent. The draft copied the typo from issue #8074, which is worth knowing about issue bodies. 9301 user.summary — the binding is userSummary, and it gates form visibility, not data entry. 9340 "appearance: number tel" — it is "numbers tel"; numbers is what makes the field render as input[type=tel]. 10784 quoted new CustomEvent('before-save', …) as the fix. That string is in no commit; the PR imports enketo-core's factory and calls events.BeforeSave(). 10922 findBinaryNodeByFilename — real name findFileNodeByFilename, and it matches [type=file]: Enketo's Nodeset.setVal rewrites file-widget nodes from binary to file on upload. 10922 also asserted, in present tense with stale: false, a mechanism on no branch reachable from master: for s in 0df57c664 cc34e08664 e88c88361; do git merge-base --is-ancestor $s origin/master && echo YES || echo NO; done # NO NO NO It now opens with a banner naming the three feature branches and is stale: true. Its Related Issues also claimed #10904 was closed by this PR; the issue is still open, which is consistent. added-vs-modified: 10064 called three test files added — all three are M and the PR's only added file is shared-libs/lineage/src/index.d.ts. 8759, 8806 and 8826 each described a modified test file as added. 9608's mechanism was inverted: the pre-fix validators were too strict (parseInt(value,10) === value against SMS-parsed strings, so integer always returned false) and the fix RELAXES five predicates to == with an explicit eslint-disable. Its backport sentence is left byte-identical — it is true. 9974 described the issue's proposal rather than the shipped code: modifyContent is a partner-authored task-config callback, only content.edit_id is set, and the routing is in tasks-content.component.ts::performAction. 10071/10180 are epic children of #10083 and now carry a Provenance section. Their source_sha values are restored, not "corrected": both are exactly what GitHub reports as the PR's merge_commit_sha, and are missing from a clone only because the epic squashed them away. 8740 was keyed to #7462 ("Make code for Enketo forms reusable outside cht-core"), a different ticket; the epic's ticket is #7599. Re-keyed and renamed so the filename token stops contradicting the frontmatter. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): defects in the siblings the review list never reached Sweep of all 41 drafts against cht-core and the linked issue bodies. Thirty- five carried at least one defect; the review list covered four of them. Inverted mechanism — the draft describes the wrong fix: 10304 said the deselect handler was corrected. deselectAllReports() is not in the diff. areAllReportsSelected() compared the selection against reportsList — the RENDERED page — so with more selected than rendered the checkbox drew unchecked and the template's ternary re-ran select-all. That is why #9739's repro says "at least 50 reports". Five sections were wrong. 10949 said the validator strips XML comments so comments mentioning <!DOCTYPE are not flagged, and listed "no false positives" as tested. There is no comment stripping, and the PR's own test asserts such forms are REJECTED. Four sections were wrong; the check is deliberately comment-blind and now says so. 9641 described a per-form try/catch that skips the broken form. There is no loop: updateAll() moved into its own try/catch that logs instead of process.exit(1), and still aborts at the first bad form. The draft now records that limitation, which is the useful part. 8656 inverted the symptom entirely — this is "xpath extensions tests fail in my timezone", fixed by pinning Date.prototype.getTimezoneOffset in a beforeEach, not a runtime inconsistency between extensions. Retitled and renamed, and category chore -> improvement (chore is not in the schema enum). 9414 said the listener "never fired"; the issue reports a stale-by-one read in enketo-core's CI only. The macro-task fix is in the karma spec, not the e2e spec. 11165 described a guard that blocks conversion. The widget cannot gate the library: it lets the conversion happen, clears the output, and re-asserts on the next tick to beat the library's own blur handler. Attribution to files the PR never touched: 10133 put the _all_docs-with-attachments call in generate-xform.js; it is forms.js. 10509 said it reused the enketo service's extraction logic. That service is not in the PR and the originals are private, so the logic was re-implemented — which is why #11256 later merged the paths. 9840 credited enketo.service.ts / form.service.ts with extension-lib injection; it goes through the cht-form stub datasource. Those files changed because EnketoFormContext became an interface. 9755 claimed a freetext-index fallback "for search strings containing whitespace", in six sections. No such fallback exists; the keyed-vs- range split lives in cht-datasource and keys on a colon. 8336 pointed at webapp/src/js/enketo/widgets.js, which #10269 does not touch and which has nothing to do with xforms-value-changed — that is enketo.service.ts:327 and the transformer XSL. Also given a source_prs entry: it had no PR reference in frontmatter at all, which is why its anchor would not resolve, even though its prose names #10269 and its "78 files" claim is exactly right. 10814 called extensionLib a method on XmlFormsContextUtilsService; the PR removed every public method in favour of an async get() factory. stale-as-written: the drift epic here is cccce201e refactor(#10700): re-write Enketo form save workflow (#11256), which deleted contact-save.service.ts and enketo-translation.service.ts. 10509, 10784 and 10922 are time-scoped against it rather than silently corrected to master's shape. Nothing in this batch records that rewrite, because the #10700-keyed draft was the one dropped in the round-1 dedup. 10937 category improvement -> feature: issue #9339 is Type: Feature and the commit is feat(#9339). 10290, 10756 and 8949 were checked and left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the residue a second gate pass and the online audit turned up Repeated passes over the corrected drafts, which is the point of the count. verify-drafts --online, 3 blocking + 1 weak cross-reference, all introduced by this round's own edits: 10071/10180 cited #10083 in Related Issues glossed as "the epic PR whose squash carries this work" — true of the PR, but it is a PR cited as an issue and the gloss shares nothing with its title. Now labelled PR #10083 and glossed with its real subject. 10071 cited #10038 as "the broader report-creation feature". #10038 is "To have API that can create places" — the PLACE half of the same datasource work, not the report half. Re-glossed. 8740 glossed #7674 as "Enable excludeNonRelevant in the Enketo config". That is the fix; the issue is "Answers to non-relevant questions in forms are not immediately cleared with new Enekto". ground-claims, second pass. The one that matters: 10509 the previous commit justified the duplicated extraction by pointing at enketo.service.ts's private processFormAttachments / buildBinaryAttachmentData. Those did not exist at this PR's anchor: git log --all -S'processFormAttachments' --format='%h %ci' # ec882d703 2026-07-17 ← five months AFTER d09d656cb8 At the anchor the logic was inline in xmlToDocs with no callable helper, which is the real reason the contact path re-implemented it. An anachronism introduced while fixing something else — exactly the failure this exercise is about, committed by the person fixing it. 8806 put pupil's validator map in pupil.js; it is validator_functions.js, looked up by validator.js. 8759 "added/updated" for a file that is only modified — the hedge read as "added" to the probe, and to a reader. 10756 dropped "Full Enketo regression suite … passed 103/103" — a run-log artefact naming a path (tests/karma/js/enketo) that does not exist. Un-greppable literals rewritten so they can be checked rather than trusted: 10443 "training:admin:1234" was an instantiation; the code has the template literal training:${USERNAME}:1234. 9513 "training-cards-last-viewed-date-<username>" likewise; the constant is STORAGE_KEY_LAST_VIEWED_DATE, suffixed by getLocalStorageKey(). 8336 config/*/forms/ and tests/**/forms/ are globs, not paths; replaced with the real trees. 9340 instance::cht:unique_tel stays — it is an XLSForm column header and real — but the draft now also names the greppable artefacts it becomes (cht:unique_tel in the instance, data-cht-unique_tel on the question) and says why the header itself cannot be found in the tree. 10071/10180 unbackticked merge_commit_sha, a GitHub API field the probe was reading as a cht-core symbol. lastUpdated on 10290, 10756 and 8949 set to their real last-edit date rather than today: their content was not changed this round, and the stale-timestamp warning was inherited from an earlier one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): six contradictions the second coherence pass sampled Each side settled against cht-core rather than reasoned about. One of these (9340) was found by the FIRST coherence pass and I failed to hand that report to the sweep, so it survived a whole round — worth recording as a process miss rather than quietly fixing. 9340 Domain Rationale said "the contact duplicate-check is a secondary capability of the widget, not the subject of the change", while the summary says the PR makes the dup-check opt-in. The dup-check IS the subject. Rewritten. 10842 summary and Problem both said arrays were "always inserted into repeat groups". Pre-fix, an array aimed at an ordinary field was refused: git show 018037e56^:webapp/src/js/enketo/widgets/android-app-launcher.js # if (Array.isArray(value)) { console.debug(… "value is an array"); return; } Nothing was written at all. Repeat insertion was only ever available through the android-app-value-list appearance. 9301 Code Patterns said the summary is "loaded once per form session"; Design Choices said the cache avoids recomputing it every time a form opens. The cache is a CacheService entry invalidated by ContactChangeFilterService.isRelevantChange — it outlives a session entirely. Code Patterns was the stale side. 10133 Problem called the update-path read "the same" read as the startup one while Root Cause calls them two separate reads in two files. Both are true of different things; disambiguated. 8308 Design Choices "added draw and file-upload integration tests" vs Testing "E2E test for photo upload forms (updated)". Both correct — different files (the integration specs are A, the e2e spec is M) — so this is a checker false positive. Rewritten anyway to name the files: if a checker misreads a sentence, a reader will too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): two contradictions my own previous two commits introduced Both are the same failure mode: correcting one section and leaving its sibling asserting what was just disproved. Worth naming rather than folding into an earlier commit, because the count of rounds is the honest signal here. 10071 I re-glossed #10038 in Related Issues as the place-creation sibling (it is "To have API that can create places") but left Design Choices calling it "the broader create-report feature this work feeds into". The report half is #10040, which is this draft's own issue. 10509 I rewrote Code Patterns to say the extraction was inline in xmlToDocs with no callable helper — and left Root Cause still saying it "lived in private methods there". The private methods arrived with #11256, five months later. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): what the fourth ground pass found, three of them mine 8336 My own previous commit replaced two glob patterns with a list of config trees — and invented two of them. #10269 touches config/default/forms (22 files), config/demo/forms (21) and config/covid-19/forms (10). There is no config/default-bs or config/standard in its diff: git diff-tree --no-commit-id --name-only -r 5fcfbcbafb \ | cut -d/ -f1-3 | sort | uniq -c | sort -rn Replacing an ungreppable glob with a wrong path list is a worse failure than the glob was. Now states counts and names real files, so the claim is checkable instead of merely well-formed. 9227 My rewritten Testing section quoted describe('#validate-luhn()'), a literal that `git grep -w` can never match. Points at the greppable cht:validate-luhn instead — the same blind spot the docs already record for placeholder literals, walked into while fixing something else. 9340 My note about the XLSForm column header attributed cht:unique_tel to phone-widget.js. It is not there: cht:unique_tel appears in the generated XForm instance, and what the widget reads is the data-cht-unique_tel attribute (phone-widget.js:61). Both now named in the right place, which is the whole point of the sentence. 8759 "The original `with-same-parent` naming was ambiguous" — that name is in no commit on any ref; it existed only in review discussion. Recording a dead name as though it shipped misleads a reader, so the rationale now argues from what the filter does rather than from a name that never existed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the fifth pass — two stragglers and a third round on 10509 10071 Design Choices justified the local work as "parity with the remote context", while the draft's own Problem says the remote side had no create implementation either. Both halves were added by the same epic, so this is one side of a paired addition, not a catch-up. 10509 Third round on the same sentence. I corrected Root Cause, then Code Patterns, and Design Choices still said the enketo service's version was "private to that service" — the framing that was wrong in the first place, since there was no method there at all until #11256. Recording the round count rather than smoothing it over: this is the draft that shows why one clean pass proves nothing. 8740 "enketo-core's `relevant.js`" reads as a repo path and is reported ungrounded on every pass, because it is a third-party file. Says "enketo-core's own relevance module" instead, and points at webapp/patches/enketo-core+7.2.5.patch — a real path in this repo — for where CHT actually overrides it. The claim is unchanged; it is now checkable. 8336's remaining finding needed no draft change: "create" inside the fixture name ngo-create.xlsx was being read as a create verb. Fixed in the tooling instead (memory/draft-verification d62a907) with regression tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the sixth and seventh passes — including one correct claim we broke The important one first. **10071: an earlier commit on this branch replaced true claims with false ones.** The sweep concluded that `createReport` was fabricated and that `src/qualifier.ts` "was never part of this work", both checked against the epic squash — because at that moment the child PR's own merge commit was not in the clone. It is now, and it says the opposite: git diff-tree --no-commit-id --name-status -r -M cab214534 d40e65bae7 # M shared-libs/cht-datasource/src/local/report.ts # M shared-libs/cht-datasource/src/qualifier.ts # M shared-libs/cht-datasource/test/local/report.spec.ts # M shared-libs/cht-datasource/test/local/person.spec.ts git show d40e65bae7:shared-libs/cht-datasource/src/local/report.ts | sed -n '81p' # export const createReport = ({ `createReport` is real at this PR, taking a `ReportQualifier` and rejecting `_rev`; the qualifier.ts change is one line, exporting `ReportQualifier` so the adapter can name it. The #10083 squash then renamed the operation to `Report.v1.create`, moved it into a `v1` namespace and replaced the qualifier with `Input.v1.ReportInput` from a new `src/input.ts` — none of which is in this PR's diff. So the original draft was right and we corrected it into being wrong. The draft now records both views and says which is which, the way the 10140 epic children on #123 do. The flat statement "there is no `createReport` symbol anywhere in cht-core's production code" is gone; it was false. This is the exact laundering this exercise exists to prevent, and it happened here because an anchor moved between passes: the clone acquired the child commit mid-run, so passes before and after disagree about which tree to judge. Worth knowing that an unresolvable anchor is not a stable property of a clone. Also: 8336 cited ngo-create.xlsx as a regenerated fixture; it is `A`, the one file the PR adds. Cites two genuinely regenerated fixtures instead. 8740 a second `relevant.js` in Design Choices, sibling of the one already reworded — the same third-party path in the same draft, missed first time because only one occurrence was quoted. 10756 said the widget parses `cht:unique_tel`. It parses the rendered `data-cht-unique_tel`; `cht:unique_tel` is what pyxform emits into the XForm instance. 9340 "behavior is selected from appearance … rather than the field type" was too absolute. `_init` reads `$wrapper.attr('data-cht-unique_tel') === 'true' || deprecated.isDeprecated($wrapper)`, so the legacy shape still turns dup-checking on through the second branch — which is why the draft can say legacy behaviour is preserved without contradicting itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the eighth round — seven findings across six passes Three ground passes and three coherence passes on frozen bytes turned up seven things, so this is not yet the clean run. Three of the seven are collisions between my own earlier fixes. Ground: 10071 `entities` still listed shared-libs/cht-datasource/src/input.ts. That file is the epic's, not this PR's — the PR changed four files and input.ts is not among them. Dropped; the Related Files section already explains that input.ts arrived with the squash. 8740 a THIRD `relevant.js` in the same draft, this one in Solution. Two earlier rounds each fixed one occurrence and left the others, because only the quoted sentence was looked at. 8746 `form.properties.json` is a filename pattern, not a path — nothing is called that. Names the real fixture, tests/e2e/default/tasks/forms/home-visit.properties.json. 9641 `form:broken` never appears in the source; the test builds ``form:${formName}`` with formName = 'broken'. Quotes the template. Coherence — all three of these are mine: 9340 I added a Code Patterns note that the legacy `type: tel` shape keeps always-on dup-checking through `deprecated.isDeprecated`, and left Domain Rationale saying the dup-check is simply "opt-in after it". Flagged in all three coherence passes. Domain Rationale now states both paths. 9227 I added "the same commit also registered `cht:strip-whitespace`" to Solution, and left Design Choices justifying the file placement "since it is a single function". 10922 Design Choices says routing is by XML position "rather than flat filename-to-doc matching", while the known-limitation sentence describes a filename lookup misrouting files. Both are true of different steps: the ancestor walk picks the owner doc, but findFileNodeByFilename picks the node the walk starts from. Said so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): two contradictions the twelfth coherence pass sampled Ground has now been clean three passes running; coherence had one pass in three that was not, which is the whole argument for the pass count. 10071 Problem said "person and place already had a full create path". Person did, on the epic branch — at this PR's parent cab214534 there is Person.v1.createPerson, api/src/controllers/person.js's createPerson, and postResource('api/v1/person') in remote/person.ts. Place had none, which is why #10038 is still open as the sibling half. Half the sentence was right, which is what made it survive eleven passes. 8826 Root Cause's "no mechanism to carry a per-field duration through form generation" sat beside its own note that the old note-based timer read a duration off the note's value, and beside Design Choices calling the new column a mirror of that prior capability. Internally consistent if read carefully, and read as a contradiction by the checker — the same call as 8308 last round: if a checker misreads a sentence, a person will too. Scoped the "no mechanism" to form generation and said plainly that durations were already configurable the one way that needed no generation support. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): round ten, and the timestamp bump, in one commit Ground was clean three passes running (g11-g13, 0 ungrounded each); the next three found four more. That is the sampling, not a regression — same drafts, different claims drawn each time. 10071 my own sentence from the last commit quoted `postResource('api/v1/person')`. The real call takes the context first — postResource(remoteContext, 'api/v1/person') — so the literal matches nothing. Names the symbol and the route instead of inventing a call form. Third time a fix of mine has introduced an ungreppable literal. 10071 Design Choices said #10099 "reused the existing person/place create architecture" while Problem now says place had none. Person's was standing on the epic branch; place's was not. Flagged by two of three coherence passes. 8225 three enketo-core module paths (src/js/relevant.js, src/js/form.js) read as repo paths. Says "enketo-core's relevance module" and "form module", keeping webapp/patches/enketo-core+7.2.5.patch — a real path here — as the anchor a reader can actually open. 10917 "renaming the widget from HiddenFieldList/hidden-field-list.js to HiddenGroup/hidden-group.js". hidden-field-list.js is in no commit on any ref: the PR adds hidden-group.js outright, and the narrower name existed only in the review iterations. Recording a name that never landed sends a reader looking for a file that was never there. 10133 summary said "a single _all_docs call" while Root Cause says two separate reads in two files. Names both paths. Two findings deliberately NOT acted on, because the drafts are right: 10922 "PR #11116 … updated downstream contact rendering — contact-save.service.ts, format-data-record.service.ts, contact-photo.component.ts, contacts-content.component.ts". The probe judged that at #10922's anchor, where none of those files exist. But the sentence credits #11116 explicitly, and e88c88361 touches all four (contact-photo.component.ts among the files it adds). The enumerate-claims layer already declines to infer a status when another PR is credited; the path probe does not yet apply the same rule. 8806 a contradiction reported with the literal title "placeholder" and two unrelated quotes — the checker emitted a finding with no rationale. lastUpdated set to 2026-08-10 across all 41, folded in here rather than left for a follow-up: a metadata-only commit would reset the convergence streak for no content reason, which is how the last round lost its clean ground passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the three findings that outlived the last commit Passes g17-g19 and c17-c19 all ran after 1c7b4d2, so their findings were about committed bytes and nobody acted on them. g19 and c19 came back clean and the run stopped there, but c17, c18 and g18 had each surfaced something on that same content first. Clean-at-the-end is not the same as converged. 10922 the epic-work sentence named `contact-photo.component.ts` as a bare filename. PR #11116 really does add it, at webapp/src/ts/components/contact-photo/contact-photo.component.ts, which the Related Files list already gives in full — but the bare name resolves nowhere at this draft's anchor, so a reader greps and finds nothing. The sentence now describes the component and leaves the path to the list that already scopes it to #11116. 10922 Design Choices asserted the ancestor walk "ensures attachments land on the structurally-correct owner" and then, in the same paragraph, gave the limitation that defeats exactly that: the walk starts from a node found by filename, so two same-named files start from the same node and land on the same sub-doc. Scoped the guarantee to the caveat it already states. 8656 Root Cause claimed the `asMoment()` fallthrough "re-parsed the raw input instead of returning the rMoment it had already built, so the two paths could disagree", while Problem said no deployed behaviour was wrong. The source settles it for Problem: the branch is `return moment(r)` with `const rMoment = moment(r)` in scope and `r` never reassigned between them. Same parse, same string, twice — redundant, not divergent. Reworded Root Cause and the Solution's description of the tidy-up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): record the deferred data-access decision in the drafts it concerns The review asked for `10064`/`10071`/`10180` to move to a `data-access` primary domain with `secondaryDomains: [forms-and-reports]`. The decision to defer that — taken on the reviewer's own recommendation to ship the enum value and the new field as one coordinated taxonomy change rather than through a content PR — lived only in the review thread, so a reader of the corpus saw three cht-datasource extenders keyed `forms-and-reports` with nothing explaining why. Each of the three now records it in Domain Rationale: the files are entirely shared-libs/cht-datasource, that makes them library extension rather than consumption, the re-key was requested, and it is deliberately not made here. `10071` had no Domain Rationale section at all — the one draft the reviewer's domain comment was actually filed against, and the section where the answer belongs. It has one now. It is the only machine-distilled draft missing it; the other ten without the section are the hand-authored files, which is the two-schemas item already flagged as not blocking. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): six more, and one of them was mine from the commit before Three ground and three coherence passes over the frozen bytes of 789f817. Four of the six are the corpus; two are probe artifacts fixed by making the draft more precise rather than by arguing with the gate. 10064 MY error, flagged by all three coherence passes. The Domain Rationale I added in 789f817 said the files are "entirely shared-libs/cht-datasource". The diff also carries api/src/controllers/report.js, shared-libs/lineage/src/index.d.ts, two webapp files and integration tests — which its own Solution section already spelled out. Reworded, and it now notes that the review's "touches only cht-datasource" premise is weaker for this draft than for 10071/10180. 9608 Root Cause said the integer predicate "returned false for every input" while Design Choices said loosening `===` to `==` "preserves behaviour for callers already passing numbers". Both cannot hold. The source settles it against Root Cause: `integer: (allValues, value) => parseInt(value, 10) === value`, so a numeric 5 was already true and only SMS-parsed strings failed. Scoped the claim and stated why numeric callers are unaffected. 10842 The summary conditioned the join on "the target field is not a repeat" while the Solution says no repeat detection exists — the join fires on any all-primitive array, and repeats are unaffected only because their helpers pass one element at a time. Summary now describes the trigger the code actually uses. 9641 `--skip-validate` is a cht-conf flag, probed against cht-core where it can never appear. It is real (cht-conf src/cli/usage.js:71); the draft now says whose flag it is. 10071 "a postResource call ... in `src/remote/person.ts`" is true at the parent commit cab214534:14, but the partial path resolves nowhere. Full path. 10917 "The widget is registered in webapp/src/js/enketo/widgets.js" is true — widgets.js:34 is `require( './widgets/hidden-group' )`. The probe looked for the `HiddenGroup` symbol, which is not how registration works here. The draft now says so, which is the more useful sentence anyway. Not fixed: 10784 quotes `import events from 'enketo-core/src/js/event'`, a real line at enketo.service.ts:6. It is a package specifier, not a repo path, and the probe cannot tell the difference. Left as written and disclosed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): two summaries that under-described their own Root Cause Both from the second convergence set; ground came back clean three passes running (g23-g25, 0 ungrounded each) and `verify-drafts --online` cleared all 41 with 0 unverified, so these two are what is left. 10784 The summary blamed the `end`-timestamp bug on the jQuery trigger not reaching a native listener, while Root Cause names two defects and the event name is the first of them. The diff bears that out — `$('form.or').trigger('beforesave')` became `form.view.html.dispatchEvent(events.BeforeSave())`, changing both the dispatch mechanism and the event identity. Summary now carries both. 10917 Testing said "Added Karma unit tests (…hidden-group.spec.ts)" and then "Neither the spec nor the fixtures were newly created here". Both are true of different files and the second reads as denying the first. `git show --name-status 23225a57d7`: the Karma spec is `A`, the e2e spec and both db-object fixtures are `M`. Says which is which now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the place-create claim I left behind, and an empty related_issues 10071 Code Patterns said the report create chain mirrored "the existing person.ts and place.ts implementations" while Problem says place had no create path yet and that #10099 added it. Person's was standing at the parent commit cab214534; place's was not. Corrected to name person only and point at Problem. This one is mine twice over: the same contradiction was flagged by the first convergence set, I fixed the postResource path on this draft in the same round, and left this line untouched. A finding read is not a finding fixed. 10922 Frontmatter carried `related_issues: []` while the Related Issues section lists three. Populated with the two that are genuinely related — the #10700 epic and the #10903 sibling — leaving out #10904, which is the draft's own issue. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): read versus written, and a switch that does not exist Three from the fourth convergence set. Ground is clean six passes running (g23-g28) and the online audit cleared all 41; coherence is the only channel still finding anything. 10133 Two, both in the same draft. The summary blamed the timeouts on both reads. Root Cause is more precise and correct: the `_all_docs` batch read is the one that hangs (apache/couchdb#2210), while the per-doc `get` on the update path was expensive, not hanging. Summary now says which is which. The Solution said the attachments "read and saved" are the XForm XML "plus `model.xml` and `form.html`", which contradicts Design Choices skipping everything non-XML. Reading the code settles it: `getFormDocs` fetches only the attachment named by `getXFormAttachmentName`, and `model.xml` / `form.html` are outputs generate-xform.js writes back (:243, :247). Read and written are now separate claims. 9340 Design Choices said validation and the duplicate check "can be enabled independently". The PR's own fixture shows otherwise: the new field is `type: string` with `appearance="numbers tel"`, which always validates format, and only the uniqueness lookup is opt-in via `cht:unique_tel="true"`. There is no switch for the format half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): 8225 justified a CHT-specific patch as a general one Design Choices said the fix belonged in enketo-core "since the behavior was incorrect regardless of CHT-specific logic", while Solution says the patch special-cases the `inputs` group. Both cannot be the reason. The patch settles it. webapp/patches/enketo-core+7.2.5.patch carries the comment `// CHT-CORE PATCH` / `/inputs is ALWAYS relevant #4875` and matches `/^\/[^/]+\/inputs$/` — a hard-coded CHT form convention, not upstream-correct behaviour. The real reason to patch enketo-core is that relevance is evaluated there, so it is the only layer where the branch can be kept enabled; and being CHT-specific is exactly why it sits in webapp/patches instead of going upstream. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): round-3 review — seven items, two of them mine Every item verified with the reviewer's protocol before editing, which is the protocol I had not been using: quote at head, check at the draft's anchor, check on master, AND walk the commits that touched the region in between. The last step is what my gate never did, and it is how two of these got in. 10133 MINE, from 04c3958. "Only one attachment is read" and "`model.xml` and `form.html` are not read at all" are both false. PR #10248's own diff ADDS three named reads in `updateAttachments` (generate-xform.js) — getXFormAttachmentName(doc), 'form.html', 'model.xml' — in one Promise.all feeding addGeneratedAttachments. I had checked getFormDocs in forms.js, found its single named read, and generalised to the whole PR without opening the other file the same PR changed. Reframed as what it is: named reads replacing bulk reads. Code Patterns and Design Choices carried the same wrong claim and are corrected with it. 10071 MINE, from a9f5dcf. Fixing one contradiction I asserted another: place.ts's create path was NOT "added alongside this work by the same #10099". It was already standing — #10065 (local, 169a02355, 2025-06-25) and #10089 (API, 98a687a80, 2025-06-26), with #10094 moving the surface to `Input`, all before #10099 landed 2025-07-03. Line 59's "Place had none yet" is true at this draft's anchor cab214534, so only its parenthetical needed the fix. 8656 Sign error. `getTimezoneOffset = () => -240` emulates UTC+4, not UTC-4 — the distilled commit's own spec proves the convention (`-60` asserts '+01:00'). Scope was over-strong too: the suite was timezone-dependent, failing in some zones (NZ +12, per #8556) and passing in others including UTC in CI, not "passing only at UTC-4". Also narrowed "every to-bikram-sambat case" to the conversion cases; the 11 invalid-input cases assert an empty string and are timezone-independent. 9755 From b82840f. The ':' separator does not route between Nouveau and the offline path. `useNouveauIndexes` picks Nouveau when the _design/medic-offline-freetext ddoc is absent; ':' (isKeyedFreetextQualifier) only selects keyed vs prefix-range within a path. At this anchor Nouveau was not in the path at all — it arrived later in f1bdfc07c (PR #10201). 10922 Both PRs ARE merged, into epic branches: #10922 into 10700-photo-capture-in-sub-contacts-and-reports on 2026-05-19 (squash cc34e08664, which is that branch's head), #11116 into 5.1.2-FR-attachments-for-subcontacts on 2026-05-29 (squash e88c88361). The banner said unmerged, called 0df57c664 a branch head when it is an interior commit of 10700-photo-capture, and claimed the work lives on all three branches when neither sha is in the 5.1.2 one. Frontmatter summary and the "unmerged epic branch work" concept follow. 8740 The squash's only test change is +2/-2 adding 'deprecatedID' to two excludingEvery() lists — edit-metadata fallout of the v7 uplift, not relevance/widget coverage. #8740's own Escape-workaround removals cancelled out inside the epic branch and are absent from the squash. 8759 Removed. It duplicated the identity of a landed contacts draft: both carry issueNumber 8074, and agent-memory/domains/contacts/issues/8074-... has owned that key on main since #79. Same change, identical 7-file Related Files set. Its unique content — the concrete spec paths in Testing and the descendant-of-current-contact naming rationale — is recorded in the PR reply for whoever folds it into the contacts canonical; it is not re-keyed to 8759, which is a PR, not an issue. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): name the attribute that greps, not only the column that does not 8826 described the passthrough only as `instance::cht:duration`. That is the XLSForm column header, which lives inside the .xlsx workbook and appears nowhere in the tree — a ground pass reported it as a non-existent symbol, and a reader grepping for it finds nothing. The rendered XForm attribute is `cht:duration`, present in five files on master. Both forms are now named, with which is which. Same shape as the `--skip-validate` fix earlier in this branch: the claim was true, just stated in the one notation that cannot be checked or found. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): pin the enketo-core event name to a version a reader can check Self-audit of the sentences this branch added, using the protocol the round-3 review used rather than the one I had been using. Four assertions in my own new prose had not been independently settled; three checked out against source (10071 and 10180 really are 4/4 and 2/2 files under shared-libs/cht-datasource; 8740's squash test diff really is +2/-2 adding 'deprecatedID', with the Escape workaround absent at 314e79061a^; issue #8556 really does report NZ +12). The fourth could not be settled from this checkout at all: "enketo-core's event.js defines the event as `before-save`" was carried on the reviewer's word because enketo-core is not installed here. It is true — webapp/package.json pins ^7.2.5, and 7.2.5's event.js has `BeforeSave()` return `new CustomEvent('before-save', { bubbles: true })` — so the sentence now names the version, which turns a claim a reader has to trust into one they can look up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): say what the web component actually wires, and unknot a sentence 9301 "Replicate the same enketo wiring in cht-form's app.component.ts" invited a ground pass to bind `user-contact-summary` to that file, where it does not appear. The wiring is real but spelled differently there — a `contactSummary` input and an `instance[id="contact-summary"]` lookup — while the `user-contact-summary` instance id lives webapp-side in form.service.ts and xml-forms.service.ts. Naming both halves is more useful than "the same wiring" and stops the mis-binding. 10784 Punctuation only: the version evidence added in ec3adbf turned a two-defect sentence into nested em-dashes. Split. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the selector still needs two classes, and Nouveau is master's story 10917 Solution and Design Choices said the matcher was broadened so "any top-level group with the `hidden` appearance" is skipped, while Testing said the spec asserts a match only when both markers are present. Testing was right: the shipped selector is `.or-group-data.or-appearance-hidden` (hidden-group.js:16 at the anchor), and the Karma spec asserts a group carrying only one of the two classes does not match. What review dropped was the `field-list` requirement, not the second class. Corrected in all three sections, including the Solution opening that had the same imprecision and would otherwise have surfaced a pass later. 9755 My own sentence from 57e7c3a read as though this PR routed through Nouveau: "It uses Nouveau when running server side ..." followed immediately by "At this draft's anchor Nouveau was not in this path at all". Both true — the first describes master, the second the anchor — but nothing said so until the second half. Scoped the first to master. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): three the confirm set found, all "true but unfindable" None of these was a wrong claim; each named something in a form no probe and no reader can resolve, which is the same defect from a usability standpoint. 8806 Root Cause named the pre-fix container as `validation.extra_validations`. The map is real — validation.js:157 at this PR's parent — but the source spells it `extra_validations`, and this PR removes it, so the dotted form greps to nothing at either commit. Names the real key, the file and line, and says it is the pre-fix state. 10922 Design Choices credited #11116 with the repeat/cleared/orphaned handling while Testing placed the same fixtures with #10922's enketo.service work. Both diffs contain all four fixture files; #10922 is where they land with the code they exercise. Names the files and notes #11116 carries an equivalent copy on its own branch. 10180 `Input.v1.UpdateReportInput` is real on master (src/input.ts:36) and absent at this draft's source_sha, because the epic squash introduced input.ts. The Provenance section says so draft-wide; the sentence now says it too, which is what stops a pass rediscovering it every few runs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): backfill related_issues from the cross-links already in the prose The new `related-issues-desync` check fired on ten drafts here: each names issues under `## Related Issues` that the machine-readable field omits. #135 de-duplicates on the field, not the prose, so those cross-links were invisible to it. All eleven referenced numbers were confirmed to be issues rather than PRs via `gh api repos/medic/cht-core/issues/<n> --jq .pull_request` before being added — adding a PR number to that field is the identity defect this corpus spent three review rounds removing. Five drafts had `related_issues: []`; five hand-authored ones had no key at all and gained one. Warnings on this PR: 13 -> 3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): stamp every draft this branch touched with today `stale-timestamp` fires when lastUpdated predates the file's own last commit, and committing yesterday's stamp today creates exactly that. Bumped across the drafts this branch has changed rather than only the ones edited in the last commit, so the field means "last reviewed" consistently instead of tracking whichever round happened to touch a file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the web component never gets the user summary Mine, from 7eb5727. Fixing the mis-binding on that draft I wrote a Code Patterns line saying `user-contact-summary` is webapp-side only — correct — and left the Solution still claiming the wiring was "mirrored in the standalone cht-form web component". Coherence pass 61 put the two side by side. The Code Patterns half is the right one. `user-contact-summary` is zero-hit in app.component.ts at the anchor and on master; what this PR gave the web component is an explicit id on the instance it already had: - this.formContext.contactSummary = value ? { context: value } : undefined; + this.formContext.contactSummary = value ? { id: 'contact-summary', context: value } : undefined; Both sections now say that, including the "so embedded forms behave identically" clause, which asserted a parity that does not exist — an embedded form cannot read the user summary at all. Fourth defect this branch has had from a fix of my own, and the second on this one draft. The sibling was found by re-reading the section next to the one I edited, which is the habit the runbook now prescribes for exactly this reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): name the file that holds showConfirmExit Not a wrong claim: the draft said the guard "flips a `showConfirmExit` flag ... in global state", and it does. But "global state" is spelled three ways in the same paragraph — actions/global.ts, reducers/global.ts, selectors/index.ts, all genuinely touched by this PR — so a ground pass bound the symbol to the actions file, where it does not appear. At the anchor it lives in reducers/global.ts, alongside the guard provider, the modal component and the selectors spec. Naming the reducer is both more useful to a reader and the thing that stops this recurring: it is the same "true but unfindable" shape as the `extra_validations` and `cht:duration` fixes earlier on this branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): do not assert a fact about a commit this draft says is unreachable Mine, from 5f8b6fc. Scoping `Input.v1.UpdateReportInput` I wrote that it is "absent at this draft's own `source_sha`" — a claim about the tree at `70b7be0b4`, which the Provenance section three paragraphs earlier says is absent from a clone because the epic squashed it away. I could not have checked it, and a reader cannot either. Coherence pass 69 put the two sentences side by side. Replaced with what is actually checkable without that commit: the type is `src/input.ts:36` on master, and `input.ts` is not among the two files #10180 itself changed — verifiable from the PR's file list, which the API serves whether or not the merge commit survives. gh api repos/medic/cht-core/pulls/10180/files --jq '.[].filename' # shared-libs/cht-datasource/src/local/report.ts # shared-libs/cht-datasource/test/local/report.spec.ts Fifth defect on this branch introduced by a fix of mine, and the second where the fix asserted something unverifiable rather than something false. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#122): the sha we called unreachable answers a one-line probe Round-4 review proved 70b7be0b4 is checkable after all — the 9835 epic branch is deleted upstream (ls-remote refs/heads/9835* is empty), but the commit stays reachable through refs/pull/10083/head. 6e43e88 removed a true anchor claim on the false premise that it could not be tested; this restores it with what the anchor actually holds: the update validates the older ReportInput via validateReportUpdatePayload, and the Input.v1.UpdateReportInput name only enters input.ts with the epic's #10522 refactor a89955a9f. The reviewer's suggested text is amended, not applied verbatim: it cites origin/9835-… as the reachable ref, which only resolves in a clone with a stale unpruned copy of the deleted branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#122): the NgRx files were modified, not created — say so The new --added-lines delta gate flagged this on its first live run: "New global NgRx state (actions/global.ts, ...)" enumerates as a file-touched added claim, and PR #9512's diff shows M for all three files (only training-card.guard.provider.ts is A). The state slice is new; the files are not. Two rewordings failed the same gate before this one passed: "modified rather than created by this PR" still carries a create-verb near the paths, and "New global NgRx state, carried in the existing ..." lets the adjective "new" reach the path list. The committed sentence puts a clause break between "New" and the paths and states location with "lives in". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#122): apply the five verified round-4 suggestions verbatim Each was re-derived against cht-core before acceptance: 9301's selector lives only in form.service.ts:105 and app.component.ts tags-and-renders (:82, :217, zero FormService imports); 10917's edit was a substitution (hidden-field-list.js's two-class selector -> hidden-group.js, spec asserts single-class non-match at :34-35/:40-41); 8826's third notation is stamped by getChtAttributeEntries (:128-131); 10133's named reads go through formsService.getAttachment (:258-260, Promise.all :257-261) with the raw call only in forms.js:31-33; 10784's ^7.2.5 is a floor pinned in practice by webapp/patches/enketo-core+7.2.5.patch, event.js:185-186 in 7.2.5. Applied byte-exact from the review API, verified with a round-trip comparison after writing. The sixth suggestion (10180) was amended in a389ae0 rather than applied: its mechanism cites a branch deleted upstream. Co-authored-by: sugat009 <sugat009@users.noreply.github.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#122): time-scope two names the current tree no longer has The dense delta grounding (all three Opus passes, identically) surfaced two stale-as-written names the sampled corpus passes never reached: 10784's prepareForSave hook, removed by the #10700 save-workflow rewrite (cccce201e, 1 file before -> 0 after), and 9512's app.module.ts, deleted by the Angular 19 standalone-components migration (a1730c4b1, #9784). Both were true at their anchors; both now say so. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#122): the anchor's update path is untyped — ReportInput is create-only Round-5 review caught a clause a389ae0 introduced: at 70b7be0b4 the update takes Record<string, unknown> narrowed by isDoc (:137-138), and ReportInput (:24) is used only on the create path (:95, :107) — verified at those exact lines before applying. Also the 10784 nitpick: a patch-package file records the version it was made for; what pins 7.2.5 is webapp/package-lock.json. Both suggestions applied byte-exact from the review API. Co-authored-by: sugat009 <sugat009@users.noreply.github.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Update agent-memory/domains/forms-and-reports/issues/10180-feat10041-add-local-implementation-for-report-update.md Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com> * Update agent-memory/domains/forms-and-reports/issues/10784-fix8974-correctly-populate-end-field-in-forms.md Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: sugat009 <sugat009@users.noreply.github.com>
* chore(memory): promote strong-fit contacts drafts for review
* fix(#135): relink id/issueNumber/issueUrl to real issues (metadata-only, contacts)
Deterministic relink via #129's relink-issues tool: drafts whose identity
keys recorded the merge PR now point at the resolved issue. Frontmatter
id/issueNumber/issueUrl lines only; bodies untouched. 31 files relinked,
1 flagged (9311 — resolved in the follow-up review commit).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(#135): collapse duplicate clusters + review fixes (contacts)
Per sugat009's review on #132: collapse 10 duplicate clusters (10036,
10038, 10037, 8985, 9065, 9241, 9835, 9264, 9426, 9601) to one memory
per issue, folding each PR's distinct content into the canonical with a
source_prs[] provenance array (schema.json gains the optional source_prs
definition, byte-identical to PR #138's). 15 collapsed files removed.
Suspect 9311 verified against cht-core: its PR body explicitly closes
issue #9241 ("Create API endpoint for getting people"), so the stored
key was correct; folded into the 9295 canonical as a second source PR.
Cross-domain dedup: issue #6543 is canonically authentication (multi-
facility user permissions), so 9094 (webapp display facet) is removed
here and will be folded into the authentication memory on #131.
Also: scrubbed classifier/reviewer process narrative from prose,
backfilled related_issues for the 9193/9237-9242 datasource family,
fixed the #9241 title drift. All 43 PR-to-issue mappings verified
against the live cht-core API (0 mismatches); validate-schema 92/92.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(#135): record cross-domain PR provenance + scrub narrative (contacts)
Companion to the authentication seeder (#131) cross-domain dedup: the
auth branch drops its drafts for issues this corpus canonically owns,
so their PR provenance is recorded here — #10222 (permission checks)
on the #9835 memory, #9205 (offline-user endpoint gating) on the #9065
memory, and #9204 (admin-app facility_id backward compat) on the #9203
memory.
Also: scrub remaining reviewer/process narrative and classifier seed
references from 19 files (content unchanged, attribution and review
chronology removed), and quote the #9065 memory's source_prs entries
for YAML consistency. validate-schema 92/92; no duplicate issueNumbers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(#135): cross-seeder dedup follow-through (contacts)
Companion to the forms (#122) and tasks (#123) seeders' cross-domain
dedup — this corpus canonically owns their issues, so the PR provenance
is recorded here: the #9835 memory gains the report-side PRs (#10022
ReportQualifier groundwork, #10246 reported_date fix), and the #10344
memory gains #10432 (targets-by-contact-id datasource support).
The 10570 draft (#10509, attachments in contact forms) is removed: the
forms corpus's curated 10509 memory owns that issue and now records
PR #10570.
validate-schema 91/91; no duplicate issueNumbers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(#135): review 4745315385 items, each re-derived before editing (contacts)
Every item was checked against the PR's own diff and cht-core master before
being changed, not taken on the review's word. All four held up.
**9281 -- the getAll AsyncGenerator was inverted.** The draft said the generator
yields pages and showed a nested loop. It yields individual docs:
git -C $CORE show refs/verify/pr9281:shared-libs/cht-datasource/src/libs/data-context.ts
# getDocumentStream ... : AsyncGenerator<T, void>
# for (const doc of docs.data) { yield doc; }
git -C $CORE show refs/verify/pr9281:.../test/libs/data-context.spec.ts
# 131: it('yields document one by one'
Rewritten to the flat `for await (const person of Person.v1.getAll(ctx)(q))`
shape. Two facts found while verifying and now recorded: the PR squash-merged
into the `9193-api-endpoints-for-getting-contacts-by-type` feature branch
(`bf8a77da`, not an ancestor of master) and reached master only via #9311
(`34dd0303c`); and the helper was renamed before landing -- at #9311's squash it
is already `getPagedGenerator` in `libs/core.ts`, with `getDocumentStream` absent
and the signature already `AsyncGenerator<Person, null>`. Time-scoped, not
silently corrected to master's shape. The same PR also swapped getPage's numeric
`skip` for a string `cursor` and moved it ahead of `limit`
(`- return fn(personType, limit, skip)` / `+ return fn(personType, cursor, limit)`).
**10043 / 10057 / 9266 / 9281 / 9835 -- data-access, deferred with disclosure.**
The reviewer's own "extend vs use" rule is satisfied: all four anchor PRs touch
`shared-libs/cht-datasource` and nothing else (`git diff-tree --name-only` per
squash). Deferred per the reviewer's own sequencing on #122 -- "one coordinated
schema/taxonomy PR ... Not blocking any single PR" -- and the #123 precedent.
`data-access` is not a valid `domain` today (`agent-memory/schema.json` CHTDomain
enum holds 9 values, none of them it) and PR #152 adds it, open and unmerged, so
re-keying here would race #152 for the same enum value. Each of the five now says
so in its own text rather than leaving the reader to infer it.
**9007 -- Domain Rationale leakage stripped.** "Per the infrastructure pitfall"
is classifier scaffolding; replaced with the substantive reason. While verifying,
the vague `page_size` prose was pinned to the real constant:
`- private readonly PAGE_SIZE = 50;` / `+ private readonly PAGE_SIZE = 25;`.
Also dropped "verified with a manual quick test" -- PR #9007's body has an
entirely unchecked review checklist and says nothing about manual testing.
**9915 -- the dropped attribution, justified rather than restored.** Round 2
reworded "Reviewer verified the correct workflow (xlsx edit -> xml regeneration)
was followed" to drop "Reviewer". Restoring it would re-assert something the diff
contradicts: of PR #9924's 29 changed `.xml` files only 17 have a same-named
`.xlsx` beside them; the other 12 are the place create/edit forms, expanded from
4 shared `PLACE_TYPE-*.xlsx` templates and edited directly. The section now
states what is checkable from the diff. Counts corrected against the real file
list (50 files, all M -- 29 xml / 21 xlsx; default/app 10->11, covid-19/contact
6->8).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): scope 10344 to the open proposal it actually describes (contacts)
Closes the loose end from #123's review, which said `10432` "was relocated to
contacts". It is here -- as `10344-targets-by-contact-id-cht-datasource.md`,
keyed by the issue (#10344) rather than the PR (#10432), which is why looking for
a `10432-*` file finds nothing. Nothing was dropped.
What it needed was scoping, because PR #10432 never merged:
git -C $CORE merge-base --is-ancestor refs/verify/pr10432 origin/master; echo $? # 1
git -C $CORE grep -c byContactUuids origin/master # no output
git -C $CORE grep -lc byContactUuids refs/verify/pr10432 # 12 files
The draft asserted all of it as shipped behaviour. It now opens with a banner
saying otherwise and carries `stale: true`.
Two claims in the first draft of that banner were wrong and are fixed here:
- It said no commit in cht-core history references the PR. One does --
`db9694ef0 feat(#10344): support targets by contact id in cht-datasource
(#10432)` -- it is simply not reachable from master. Stated that way now.
- It listed `bindGenerator()` among symbols existing "only on that open PR's
branch". `bindGenerator` is on master in six files, added by epic #10423
(`622c62542`); #10432 introduces its own independently, the epic not being an
ancestor of the PR. Master's `target-aggregates.service.ts:35` binds
`Target.v1.getAll`, not the `TargetInterval.v1.getAll` this draft names. So the
summary's flat "None of this API exists on master" was also too strong.
Code Patterns and Design Choices credited this proposal with `bindGenerator`;
both now point at #10423. The contact-UUID filtering vocabulary really is
PR-only, and the epic really does lack it (`git grep -c byContactUuids 622c62542`
-> 0), so the rest of the banner stands.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): sweep the 23 drafts the review did not name (contacts)
Rounds 3-5 on #123 found more defects outside the reviewer's list than in it, so
all 37 drafts were swept for the same classes. Every finding below was settled
against the anchor PR's own diff or `origin/master`, never reasoned about.
`9264`, `9390` and `10713` came back clean and are untouched.
Worst first.
**9230 -- the whole draft was polarity-inverted.** It said leftover action-bar
logic *prevented* editing a home place and the fix *restored* it. The real bug is
the opposite: the Edit button was wrongly *enabled*.
git -C $CORE show 9f900220 -- .../contacts-content.component.ts
# - canEdit: ... this.userSettings?.facility_id !== this.selectedContact?.doc?._id,
# + canEdit: ... !this.userSettings?.facility_id?.includes(...doc?._id),
# issue #9229: "Old action bar should PREVENT users with multiple facilities
# assigned from editing the homeplace"
Once `facility_id` became an array, `['x'] !== 'x'` is always true, so `canEdit`
was always true. Title, summary, Problem, Root Cause, Solution, Design Choices,
Domain Rationale and the `tags` all carried the inversion; all were rewritten
together. Also time-scoped: the action bar and this `canEdit` block were removed
from master by #9361, so `stale: true`.
**8684 -- describes a feature that is not on master at all.** `stale: false` was
the most damaging assertion in the corpus.
git -C $CORE merge-base --is-ancestor 59a1dbd2 origin/master; echo $? # 1
git -C $CORE branch -a --contains 59a1dbd2 # 4.4.1-FR-barcode, 4-4-cares, ...
for s in search_by_barcode BarcodeDetector can_use_barcode_scanner; do
git -C $CORE grep -l $s origin/master | wc -l; done # 0 0 0
PR #8684 merged into the `4.4.1-FR-barcode` release branch and issue #6669 is
still open. Now `stale: true` with the landing recorded. Two more: it credited
itself with `browser-detector.service.ts` (`M` here; added by #7568 in 2022, this
PR adds one method), and misquoted the telemetry literal --
`barcode_no_detected` where the code says `barcode_not_detected`.
**8984 -- the 50-report cap was described backwards.** The draft said the summary
saw "only the first 50 reports". `search.js` slices the *tail* of the date-sorted
rows, so it keeps the 50 most **recent** and drops the oldest -- which is why
issue #8815 is titled "Only **last** 50 reports for contact are provided" and
reproduces by submitting 50 reports *after* the pregnancy. Corrected in all four
places, plus `search.service.ts` annotated as not modified by this PR and the
separate `DISPLAY_LIMIT = 50` display cap disclosed.
**9601 and 9625 -- prose transcribed from a PR description, not its merged code.**
`9601` named `is_canonical`, a `duplicate_info` section and `context.duplicate_check`;
none exists at the merge commit or on master (the real shapes are an
`[duplicate-contacts]` content-projection slot and a top-level `duplicate_check`).
`9625` claimed freetext search for person and place; the PR adds `getUuidsPage`/
`getUuids` to contact and report only, and creates two controllers rather than
adding endpoints to four. Both were independently flagged by `ground-claims`.
**Attribution corrected on 9295, 9368, 9090, 9177, 10141.** Five drafts credited
themselves with files or symbols another PR introduced -- #9295 called five files
new that #9090 created and are `M` in its own diff; #9368 claimed `/api/v1/person`
when its only added route is `/api/v1/place` and person was already in its parent
tree; #9090 tagged four files it created as #9176's; #9177 put `getByUuid` in
`place.ts` when it lives in `index.ts`; #10141 claimed a public export that
#10157 added. Non-existent namespace members (`Person.v1.getPageByType`,
`Place.v1.getByType`, `Person.V1`) corrected to the real exports, with the
`getDatasource()` facade names distinguished from them.
**Drift disclosed, not silently corrected, on 8684, 9230, 9426, 10777, 10804.**
Each edit was followed by a re-read of the whole draft; that pass caught a
further nine sibling contradictions the individual findings had not named --
`9230`'s Domain Rationale, `8995`'s YAML title, `9295`'s Design Choices and
Testing, `9368`'s Related Issues and Domain Rationale, `9090`'s Related Issues,
`9625`'s summary and Domain Rationale, `10141`'s `concepts` -- which is the
failure mode this exercise is about.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): three landed contacts drafts, outside this PR's diff (contacts)
`8034`, `8074` and `10074` sit in `domains/contacts/issues/` but are already on
`main` and untouched by PR #132 -- `git diff --name-status main...HEAD` covers 34
drafts and none of these three. They are separated here so the promotion diff
stays exactly what it was, and so a reviewer can drop this commit without
disturbing the rest.
They were swept because they are part of the corpus an agent retrieves, and a
defect there is a defect regardless of which PR introduced it.
**10074 -- every path it points at was deleted from master.** Both migration
scripts and their specs went in #10187 (`chore(#9639): remove old migrations
[5.0]`, 2025-08-27), a month after #10085 merged, and the draft's own
`lastUpdated: 2026-03-16` postdates the deletion with no scoping anywhere:
git -C $CORE ls-tree origin/master api/src/migrations/ | grep -i person # nothing
git -C $CORE log --diff-filter=D --format='%h %s' origin/master \
-- api/src/migrations/extract-person-contacts.js # 2d44b01e chore(#9639) ... (#10187)
Time-scoped to #10085 rather than rewritten to master's shape; the body still
records what that PR did. Also fixed an inversion: `data-context.js` was said to
"provide" `getLocalDataContext`, which it consumes from `@medic/cht-datasource`
and re-exports the bound result of.
**8034 -- "most permissive setting wins across roles" contradicted its own Design
Choices.** `getDepth()` overwrites `replicatePrimaryContacts` when a role has a
*greater* depth and only ORs it on a tie, so a deeper role with the flag off beats
a shallower role with it on. The PR's own test name says so: "should return most
permissive report depth and replicatePrimaryContacts associated with highest
depth". Also corrected the `do...while` rationale -- the loop exists because a
primary contact is only admissible once its place is in `subjectIds`, not because
of primary-contact chains -- and disclosed that these three services moved under
`api/src/services/replication/` in #10823.
**8074 -- Solution item 5 contradicted item 4.** With parent + type and no
freetext, `generate-search-requests.js` returns a single request with the type
folded into the compound key; there is nothing to intersect. Intersection only
happens when freetext is also present.
**8034 also duplicates a landed data-sync draft, and the gate as documented
cannot see it** -- see the `duplicate-issue` note in the PR reply. Not fixed
here: collapsing two landed drafts across domains is a corpus decision, not a
contacts one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): Related Issues refs, glosses and timestamps (contacts)
Found by `verify-drafts --online`, which reached 3 blocking + 8 warnings once it
could run. Round 1's defect was exactly this family -- a PR cited where an issue
belongs -- so these are worth closing rather than waving through.
**Three glosses that described the wrong thing (blocking).** Each was checked
against the real title and body before rewriting:
- `10057` called PR #10056 "companion PR adding the missing test coverage for
qualifier.ts". It is "feat(#10036): implement `createPerson` for local", whose
body reads "add support for creating Person Doc in Pouch". Nothing to do with
qualifier tests.
- `9177` called #8889 "Original proposal for these get-by-uuid endpoints". #8889
is "Provide API access for online users", still open, and is the broad umbrella
these endpoints serve rather than a proposal for them specifically.
- `9390`'s gloss for #9311 was substantively CORRECT -- #9311 is the epic squash
that landed get-persons-by-type and carried #9295's `req.query.personType`, and
issue #9389's own body links to it saying just that. The checker compares a
gloss against the PR *title*, so an accurate functional description trips it.
Rewritten to quote the real subject as well as the relevance, which keeps the
substance and gives the check something to match. Recording it here because the
finding was a false positive on the gloss rule, not a defect.
**Seven PRs cited as issues.** `10057#10056`, `9177#9090`, `9177#9176`,
`9390#9311`, `9835#10083/#10081/#10043` now read "PR #N". Two of them were also
the useless gloss "Related code change"; both now say what the PR contributed.
`9601`'s weak gloss for #6363 now quotes the issue's real title.
**Nine stale timestamps.** The eight drafts edited in this batch move to
2026-08-11. `10713` is NOT bumped to today -- it is clean and I never edited it;
its `lastUpdated` was simply never bumped by the commit that last changed it, so
it moves to that commit's date (`f20b746`, 2026-07-16) rather than claiming an
edit that did not happen.
`validate-schema` 91/0 after.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): my own gloss tripped the rule it was meant to satisfy (contacts)
Two leftovers from the previous commit, both created by that commit.
**`9177`'s replacement gloss for PR #9176 was itself flagged.** I had rewritten
the useless "Related code change" to "created `src/place.ts` with the
`Place`/`PlaceWithLineage` interfaces this PR adds operations to". That is true --
`git show 282faee^:.../src/place.ts` holds the two interfaces and no `export
const` -- but it describes a side effect of #9176 rather than its subject, which
is "add api support for getting a person with lineage by uuid". Same shape as the
`9390` false positive I wrote up last commit: an accurate functional gloss that
shares no vocabulary with the title. Now quotes the real subject and keeps the
relevance, which is what a reader needs anyway.
**`10713`'s timestamp cannot be set backwards.** Last commit moved its
`lastUpdated` to 2026-07-16 -- the date its content actually last changed --
rather than claiming an edit that never happened. But `stale-timestamp` compares
against git's last-edit date, and writing the field IS an edit, so the warning
came straight back pointing at 2026-08-11. Reverting would not help either: the
revert is also an edit. Set to 2026-08-11, which is now simply true of the file.
Its prose is untouched; only the stale metadata moved.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): what the first gate pass on frozen bytes found (contacts)
`ground-claims` pass 1 over the committed corpus reported 2 ungrounded and
`check-coherence` pass 1 reported 5 contradictions. Adjudicated one at a time;
three were real, two were tooling defects (fixed on memory/draft-verification,
not papered over here), and one was a genuine ambiguity worth removing anyway.
**Real: `10897` contradicted itself three ways, all created by the earlier fix
to its Problem section.** Correcting Problem to match issue #10878's actual
report -- manual, unhurried navigation during a slow index -- left three
statements asserting the opposite:
- the `title` still said "when rapidly switching pages"; it now says "when
navigating away ... before it finishes loading", which is what the report
describes;
- Related Issues asserted "Switching pages too quickly" in the draft's own
voice. That IS #10878's real title (confirmed against the API), so it is now
quoted as the issue's title with the report's own contents beside it;
- Design Choices claimed no restructuring of the subscription lifecycle while
Solution said the callbacks were extracted into two new methods. Both are
true of different things -- the callbacks moved, the subscribe/teardown did
not -- and the sentence now says so.
**Real: `8034`'s "any matching role" was ambiguous** between "any role at all"
and "any role tied at the highest depth". Only the second is true. Reworded to
say so outright, which also removes the clash the checker flagged against Code
Patterns.
**Real: `9394` quoted an ungreppable call chain.** The prose wrote
`targetAggregateService.getCurrentTargetDoc()`; the source splits the receiver
and the method across two lines, so no literal search can ever find it. Now
names the method and its service separately -- `getCurrentTargetDoc()` on
`TargetAggregatesService` -- which is both greppable and easier to read.
**Tooling, not content: `9281`.** `getPagedGenerator` came back ungrounded
because the probe checked the anchor, where it genuinely does not exist; the
sentence is about master, where it is at `libs/core.ts:227`. The forward-scope
rescue keys on "on master" appearing in the quote, and the quote is line-bounded
-- the marker had wrapped onto the previous line. Rewrapped so each
master-scoped sentence carries its own marker. The claim never changed.
**Tooling, not content: `10804`.** The checker filed a pair and cleared it in
the same breath -- "a minor framing difference rather than a factual conflict".
Nothing edited here; the withdrawal screen was widened instead.
`validate-schema` 91/0; `verify-drafts` offline 0 blocking.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): round 2 of the gate — 10 drafts, and 3 of the defects were mine
Three `ground-claims` and three `check-coherence` passes over the frozen corpus,
all 37 drafts, no truncation. Not clean: 3-4 ungrounded and 5-7 contradictions
per pass, and the pass-to-pass variation is the argument for the count -- the
`8984` naming clash appeared in two of three, `9090`'s in one of three.
Recurring in all three coherence passes, and all three are defects the earlier
"fix" commits introduced:
**`9281` (3/3).** My Solution addition -- "replaced getPage's numeric `skip`
with a string `cursor`" -- contradicted the summary and Problem, which both
still said the pre-PR API was cursor-paginated with callers managing cursors.
The Solution is the correct side:
git -C $CORE show bf8a77da -- .../src/person.ts | grep -E '^[-+].*(skip|cursor)'
# - const assertSkip = (skip: unknown) => { + const assertCursor = ...
# - return fn(personType, limit, skip); + return fn(personType, cursor, limit);
Before this PR there was no cursor to manage. Summary and Problem now say `skip`.
**`9915` (3/3).** Code Patterns still carried the bald rule "Always edit `.xlsx`
source files first, then regenerate XML via `cht-conf`" while Solution and
Design Choices -- which I had rewritten -- say 12 of the 29 XMLs were edited
directly. Both now describe the two paths.
**`10057` (2/3).** Last commit corrected the Related Issues gloss for PR #10056
to "implements `createPerson` for the local data context" and left Testing still
calling it the PR that supplied qualifier.ts coverage. Testing now agrees.
Also real, from the same rounds:
- **`8984`** named the display cap `DISPLAY_LIMIT` in Solution and
`DOCS_DISPLAY_LIMIT` in Testing. Master has `DISPLAY_LIMIT`
(`contacts-content.component.ts:86`); `ground-claims` flagged the other as a
fabricated symbol in the same round.
- **`9203`** Related Issues said "None directly referenced" while Problem cites
#9128 as the change that introduced the array shape. Now listed -- and as
`PR #9128`, because labelling it plainly `#9128` promptly earned a
`related-ref-is-pr` warning. Fourth time a fix here has generated the next
finding.
- **`9394`** named `CHTDatasourceAPI` three times. No such symbol exists at the
anchor or on master; the class is `CHTDatasourceService`. Reworded to describe
the surface it builds for config scripts.
- **`9295`** Testing said "Extensive tests added" and named two spec files. Every
test file in that PR is `M`, none `A` -- the added-vs-modified class, caught by
the deterministic status inference on a draft it had already passed once.
- **`8995`** wrote `_ids`; the code is `_map(reports, '_id')`.
- **`9601`** put `mat-expansion-panel` in the component's `.ts`; it is in the
`.html` (4 hits).
- **`9090`** wrote `Qualifier.byUuid` as living in `qualifier.ts`. `byUuid` is
there; the qualified form only appears at call sites. Reworded so the file
claim is about the symbol it actually contains.
`validate-schema` 91/0. `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): round 3 — three findings, one of them yesterday's fix
Three ground and three coherence passes on `73502eb`, all 37 drafts. Findings
dropped from 3-4 ungrounded / 5-7 contradictions to **1 / 2**, and all three
distinct findings are closed here.
**`9090` — `Qualifier` is not in `qualifier.ts` (ungrounded in 3 of 3).** Last
round's reword still paired the bare token with that file. The file genuinely
never contains it:
git -C $CORE grep -cFw Qualifier 59b42e2fa -- .../src/qualifier.ts # 0
git -C $CORE grep -c Qualifier 59b42e2fa -- .../src/qualifier.ts # 5
# the 5 are UuidQualifier / isUuidQualifier — substrings, not the name
git -C $CORE grep -n 'as Qualifier' 59b42e2fa -- .../src/index.ts
# index.ts:39: export * as Qualifier from './qualifier';
The namespace is created at the re-export, not in the module. Now says so, which
puts `byUuid` in `qualifier.ts` and `Qualifier` in `index.ts` — where each
actually is.
**`9203` — the #9128 gloss I added last commit was backwards (2 of 2).** I wrote
that PR #9128 created "the older-database shape this fix tolerates". It created
the *new* array shape; the legacy `string` is what pre-#9128 databases still
hold, which is the whole point of the fix:
git -C $CORE log -1 --format='%h %s' c7fbcb1b8
# feat(#9116): update user place field in admin to allow setting multiple places (#9128)
Corrected. That is the fifth time in this batch a fix has produced the next
finding, and the third where the checker caught me rather than the pipeline.
**The data-access banners contradicted the Domain Rationale (1 pass each on
`10043` and `9281`).** The banner said the anchor PR extends the library "rather
than a contacts feature" while Domain Rationale argues contacts is the most
specific fit. Both are true of different taxonomies, and neither said so. All
five banners now state it explicitly: primary would be `data-access` with
`contacts` secondary under the proposed scheme, and `contacts` remains the
closest of the nine that exist today. No claim changed; the frame was missing.
`validate-schema` 91/0. `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): 9090's summary named the imperative surface as both (contacts)
Round 4: ground came back **0 ungrounded in three consecutive passes**;
coherence was 0 / 1 / 0, and the one finding is real.
The summary said the library exposes "person.getByUuid through both imperative
and declarative APIs". `getByUuid` is only the imperative facade; the declarative
export is `get`:
git -C $CORE show 59b42e2fa:.../src/person.ts | grep -n 'export const'
# 32: export const get = (context: DataContext) => {
git -C $CORE grep -n getByUuid 59b42e2fa -- shared-libs/cht-datasource/src
# index.ts:59: getByUuid: (uuid) => ctx.bind(Person.v1.get)(Qualifier.byUuid(uuid)),
The Solution and Code Patterns already said this; the summary was the stale side.
It now names both spellings so neither section can be read as the other's
contradiction.
Appearing in one pass of three is what the pass count is for: the same draft's
`Qualifier` claim showed in three of three last round, this one in one of three.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): two "only X existed" claims that undercounted (contacts)
Round 6. Ground stayed at 0 ungrounded across three passes; coherence found two
more, one in two passes of three and one in one of three.
**`9177` (2/3).** The summary said "only get-person existed from #9065" while
Problem said "only get-person/get-person-with-lineage existed". Problem is
right — both were on the tree this PR built from:
git -C $CORE show 282faee19^:shared-libs/cht-datasource/src/person.ts | grep -n 'export const'
# 53: export const get = getPerson(...)
# 61: export const getWithLineage = getPerson(...)
**`9835` (1/3).** Root Cause called PR #10083 "the prior attempt" that "had
duplicated validation logic", while Solution credits the same PR with
introducing `input.ts` and parameter-validators for *centralized* validation.
Solution is right; #10083 added the file:
git -C $CORE diff-tree --no-commit-id --name-status -r f382785be | grep input.ts
# A shared-libs/cht-datasource/src/input.ts
#10083 is the initial implementation this draft describes, not something it
superseded. Root Cause now describes the pre-datasource state — validation
repeated at each call site — without attributing it to the PR that fixed it.
Both are the same shape: a section that enumerates a prior state with "only",
and gets the enumeration wrong. Neither was reachable from the anchor diff alone;
both needed two sections read against each other.
`validate-schema` 91/0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): "only X existed" keeps being the wrong enumeration (contacts)
Round 7. Ground 0 / 0 / **2** — the streak broke on the third pass after nine
consecutive clean ones, which is the whole case for not stopping at one.
**`9177`, and this one is mine.** Last round I rewrote the summary to name the
prior state as "get-person and get-person-with-lineage". Those are prose, not
identifiers:
for s in get-person get-person-with-lineage; do
git -C $CORE grep -lFw "$s" origin/master | wc -l; done # 0, 0
git -C $CORE grep -n 'export const get\b' origin/master -- .../src/person.ts
# 61: export const get = ... 69: export const getWithLineage = ...
Both sections now name `Person.v1.get` and `Person.v1.getWithLineage`, which are
real, greppable, and more use to a reader than a hyphenated paraphrase. Fixing
the count last round introduced a fabricated-symbol pair this round.
**`8074` (coherence, 1/3).** Problem said the widget "only supported searching
contacts by document type, not by parent"; Root Cause said filters were built
"from only contact types and freetext". Root Cause is right — contact freetext
search predates this PR:
git -C $CORE show 454788537^:shared-libs/search/src/generate-search-requests.js | grep -n freetext
# 202: const freetextRequests = freetextRequest(filters, 'medic-client/contacts_by_freetext');
That is the third draft in two rounds whose defect is an "only ..." enumeration
of a prior state that omits something — `9177`, `9835`, now `8074`. Worth naming
as a class: the sentence is written to motivate the change, so whatever the
change did not touch tends to get dropped from the list.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): 9394's summary credited the stub with the implementation (contacts)
Round 8: ground **0 / 0 / 0**; coherence 1 / 0 / 0, and the one finding is again
a sentence I wrote.
My round-2 rewrite of the summary said the `analytics.getTargetDocs()` entry is
"built by `CHTDatasourceService`". The Solution I wrote in the same commit says
that service only declares an empty-array stub and `contact-summary.service.ts`
supplies the working function. The Solution is right:
git -C $CORE show bbe5dedd5 -- webapp/src/ts/services/cht-datasource.service.ts
# + analytics: {
# + getTargetDocs: () => ([]),
git -C $CORE show bbe5dedd5 -- webapp/src/ts/services/contact-summary.service.ts
# + chtScriptApi.v1.analytics.getTargetDocs = () => targetDocs;
The summary now names both halves — declared as a stub by one service,
overwritten by the other before the generator runs — so neither section reads as
the other's contradiction. Correcting a draft's mechanism in one section and
leaving the summary asserting the tidier version of it is the single most
frequent way I have broken these drafts.
`validate-schema` 91/0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): an invented receiver, and two accurate examples that read as one wrong one
Round 9: ground 0 / 1 / 0, coherence 0 / 0 / 1.
**`8995` — `contactViewModelGenerator` is not a thing.** The prose named a
receiver that exists nowhere; `addHeading` is a private method invoked as
`this.addHeading(...)`:
git -C $CORE grep -nFw contactViewModelGenerator 0ba3adb75 # 0 hits
git -C $CORE grep -n 'class ContactViewModelGeneratorService\|addHeading(' 0ba3adb75 \
-- webapp/src/ts/services/contact-view-model-generator.service.ts
# 37: export class ContactViewModelGeneratorService {
# 289: private async addHeading(reports, forms) {
# 329: .then(reports => this.addHeading(reports, forms))
Same shape as `9394`'s `targetAggregateService.getCurrentTargetDoc` and `9177`'s
`get-person`: prose invents a qualified name for something real. Now names the
method and the class it belongs to, both greppable.
**`9264` — nothing was wrong, and it still needed the edit.** Problem cites the
reported symptom (`contact_detail:clinic:load`) and Solution illustrates the
new-style branch with `"hospital"`. Both are accurate — the karma spec really
does exercise `hospital` — but a reader meeting two different types for one fix
has to work out that they are the same code path. Stated outright instead. This
is the "correct-but-unreadable" case: the checker misread it, so a person would.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): `parents` is contact-type config, not a datasource symbol (contacts)
Round 10: **coherence 0 / 0 / 0** — the first three-pass clean sweep of that
tier. Ground 1 / 0 / 0.
`10057` said the create path validates the parent "against the allowed `parents`
configured for the new contact's contact_type ... centralized in `src/input.ts`",
which pairs the token with a file that never contains it — at any anchor:
git -C $CORE ls-tree e0ecefed49 -- shared-libs/cht-datasource/src/input.ts
# (empty — the file does not exist at this draft's own anchor)
git -C $CORE grep -cFw parents 95153376d -- shared-libs/cht-datasource/src/input.ts
# 0 — nor at #10124's, which is the PR that adds the file
git -C $CORE grep -n parents e0ecefed49 -- shared-libs/contact-types-utils/src/index.js
# 38,46,54 — type.parents, where the allow-list actually lives
The behaviour described is real and does live in `input.ts` at #10124; only the
`parents` allow-list is elsewhere — it is a contact-type config array in app
settings, reached through `contact-types-utils`. The sentence now separates the
two, and states outright that `input.ts` postdates this draft's anchor.
Worth noting for the write-up: this is a claim the sibling-anchor fix could not
rescue, because the token is absent from the named file at every anchor in the
cluster. The fix addresses "wrong commit"; this was "wrong file".
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): my "clarification" put the reported case in the wrong branch
Round 11: ground **0 / 0 / 0**; coherence 1 / 0 / 1, both on `9264`, both caused
by the edit I made to it last round.
`9264` was flagged in round 9 as correct-but-unreadable: Problem cited the
reported `clinic` symptom, Solution illustrated the new-style branch with
`hospital`, and the checker read the two types as disagreeing. I rewrote the
prose rather than leave a sentence a checker misreads — and attached the `clinic`
case to the **new-style** branch. It belongs to the legacy one:
git -C $CORE grep -n -A4 'getTypeId = ' origin/master -- shared-libs/contact-types-utils/src/index.js
# 24: return doc.type === 'contact' ? doc.contact_type : doc.type;
A legacy `clinic` doc has `type: 'clinic'`, so `type !== 'contact'` and the
function returns `doc.type`. That is also exactly what the draft's own Root Cause
says — `clinic` is one of the legacy hardcoded types with `contact_type`
undefined, which is *why* the old code fell back to the literal `"contact"`.
Attaching it to the new-style branch contradicted the mechanism the draft
correctly explains two paragraphs earlier.
The `clinic` example now sits on the legacy branch and `hospital` on the
new-style one, each labelled with what it is.
This is the sharpest lesson of the run and belongs in the write-up: the draft was
**not wrong** when I touched it, only hard to read. Rewriting unreadable-but-true
prose is not a free action — I made it false, and it took two more passes to find
out. "If a checker misreads it, a person will too" is good advice; it does not
license editing without re-deriving the mechanism first.
`validate-schema` 91/0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): 8034 described two views as if they were one decision (contacts)
Round 12: ground **0 / 0 / 0**; coherence 1 / 0 / 0.
Solution said the PR adds "a new `contacts_by_primary_contact` view"; Design
Choices said the value-shape change was taken "rather than adding a separate
view, to avoid maintaining two views for the same data". Both are true, of
different views, which is exactly why they read as a contradiction:
git -C $CORE diff-tree --no-commit-id --name-status -r 80760a6d2 | grep views
# M ddocs/medic-db/medic/views/contacts_by_depth/map.js
# A ddocs/medic-db/medic/views/contacts_by_primary_contact/map.js
git -C $CORE show 80760a6d2 -- .../contacts_by_depth/map.js
# - var value = doc.patient_id || doc.place_id;
# + var value = { shortcode: ..., primary_contact: ... }
The rejected alternative was a *second depth-keyed view* carrying the same rows;
`contacts_by_primary_contact` answers the reverse question and had nothing to
fold into. Design Choices now says which alternative was rejected and why the
new view is not an instance of it.
Unlike `9264` last round, I re-derived the mechanism from the diff before
touching the prose. That is the step I skipped there, and skipping it is how a
readability edit turned a true draft false.
`validate-schema` 91/0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): round-3 review — 8684's universal, and 10344's merge state
Two of sugat009's five items. The other three (10057, 9835, 9266) are on drafts
getting a full body audit first, so they are fixed in one pass rather than
patched twice.
**`8684` (blocking) — an unquantified universal I wrote and never checked.** The
sentence claimed all 17 listed paths "still exist on master". I enumerated them
this time, one `ls-tree` per path:
16 OK, 1 MISSING: config/standard/app_settings.json
git -C $CORE ls-tree --name-only origin/master config/standard/
# config/standard/readme.md — that is all that is left
git -C $CORE log --all --diff-filter=D --format='%h %ad %s' --date=short \
-- config/standard/app_settings.json
# 3f7f6d6e3 2024-01-09 chore(#8757): Remove standard config
All 17 did exist at the anchor, so only the master half of the sentence was
wrong. It now states the exception and why.
**`10344` (non-blocking) — I read a proxy test as the predicate.** The banner said
PR #10432 "is not merged", inferred from `merge-base --is-ancestor` failing. That
tests whether the head is on master, not whether the PR merged. It did merge:
gh api repos/medic/cht-core/pulls/10432 --jq '.merged, .base.ref, .merged_at'
# true, 10140_previous-month-targets, 2025-12-19T15:22:38Z
The sharper account, which the reviewer supplied and I verified: it merged into
the epic branch, then its content was dropped before the epic squashed. #10423
carries none of #10432's 54 files, and `ls-remote` shows the epic branch has been
deleted, so the PR's own head really is the only place the code lives. The
guidance ("do not treat as available API") was right for the wrong reason and now
has the right one, plus a `gh api` line in the verify block so the next reader
checks merge state directly.
That edit contradicted four sibling sentences still saying "open PR" / "not
merged" / "open proposal" — summary, banner, verify comment and the closing
paragraph. All four reconciled in the same commit, which is the re-read step I
have skipped too often in this batch.
`validate-schema` 91/0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): body-audit the five drafts that never had one (contacts)
Round 3 of review found two defects in drafts I had never read line by line. The
cause was audit *surface*, not verification depth: of the 37 drafts I delegated
29 to readers with "audit the whole file", and for the eight I kept I only
checked the diff I was editing. `9835`, `10043`, `10057` and `9266` therefore got
a `data-access` banner and nothing else, while twelve gate rounds re-checked prose
no human had read once. `9281` is here too because it had been rewritten so often
that its own text needed re-deriving.
Full audits found **36 findings, 13 blocking** — against the reviewer's five.
Worst first.
**`9835` had the provenance backwards (6 blocking).** I read #10083 as the thing
#10522 refactored. The containment runs the other way:
git -C $CORE merge-base --is-ancestor a89955a9f refs/verify/pr10083; echo $? # 0
git -C $CORE grep -ln 'createDoc\|db.post\|db.put' 5f40e3dac -- shared-libs/cht-datasource/src
# (empty — master had no cht-datasource writes at all before f382785be)
#10083 is the umbrella that squashed the whole branch to master; #10522 is an
ancestor of its head. Also fixed: the permission enumeration (wrong for five of
six endpoints, and reports use `can_view_reports` not `can_view_contacts` for
reads); #10222 credited with report-controller changes it never made; the
create/update flow sketches, true for place and wrong for person and report;
#10246 described as fixing created reports when it fixed the *update* path; and
the contact controller credited with endpoints it never received. `#10522` added
to `source_prs`.
**`10057`'s false claim was in two sections, not one (3 blocking).** The reviewer
flagged the Solution occurrence; Code Patterns asserted the same thing, so
fixing only the filed line would have left it live. `input.ts` was added by
#10094, #10124's diff to it is +6/-1, the parent/lineage logic is per-module
duplicated closures, and master's `input.ts` is types-only. Also: "places cannot
be qualified without a valid parent" inverts for types with no configured
`parents`; #10089 credited with the local implementation that was #10065's; and
the pre-existing read surface understated as get/getWithLineage when getPage and
getAll were there too.
**`9266`'s signature was wrong twice over (2 blocking).** `Person.v1.getPage(limit,
skip)` omits both the mandatory `personType` and the `context` curry. And its
whole `limit`/`skip` vocabulary never reached master — #9281 replaced `skip` with
a cursor on the same branch before the epic landed — so it now carries an
epic-child banner and `stale: true`.
**`9281`: all four findings were in text I wrote (2 blocking).** Including a
banner whose own remediation command does not work — `refs/pull/9281/head` is the
pre-squash merge commit `7e0355f3a` and does not contain `bf8a77dae`; only the
epic PR's head does. And `getAll` is facade-only: it exists in neither
`local/person.ts` nor `remote/person.ts`, at the anchor or on master, because the
facade generator binds the facade's own `getPage` and inherits dispatch from its
`adapt` call.
**`10043` (4 findings)** — #10056's `qualifier.ts` change is a single `export`
line, not validation logic; the local module imports only a type; and a legacy
`POST /api/v1/people` route did exist.
Drift disclosed rather than corrected on `10043`/`10057`/`9266`: none of their
source PRs is an ancestor of master, and the qualifier vocabulary they describe
was replaced by `Input` types before landing. `9281` stays `stale: false` — its
`getAll` did land and is still on master at `person.ts:113`.
The audits also repaired 15 sibling contradictions the individual findings had
not named, and twice caught their own replacement text being wrong before it
shipped.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): the four systemic shapes, swept across the corpus (contacts)
The round-3 review's five items shared four shapes that both machine checkers are
blind to. Swept all 32 remaining drafts for each, with the full protocol (PR
commit, master, and the commits between).
**Unquantified universals — 3 found.** A claim over a set where the set was never
enumerated.
- `8034` said the view-value change is breaking and "all consumers must read
`row.value.shortcode`". Of the three non-test consumers, only
`authorization.js` reads the value at all: `muting_utils.js` reads `row.id` and
`config-watcher.js` only loads the view map, and #9593 touched neither.
- `9090` said "nine webapp callers". `git grep -ln cht-datasource.service 59b42e2fa
-- webapp/src` returns **5**; the other four changed files needed only
TypeScript casts.
- `8684`'s summary said "no barcode code exists on origin/master". Two
counterexamples — the vendored Enketo XSL handling of the ODK `barcode` question
type. Scoped to barcode-*scanner* code. (Its Related Files sentence, fixed last
commit, was already correct: I re-enumerated all 17 paths, 16 present.)
**Enumerations and mappings — nothing found**, across ~90 name-to-thing pairings
in 24 drafts, each checked individually rather than as a sentence. Worth recording
as a confident negative: this is the class that produced `9835`'s blocking defect,
so its absence elsewhere is information.
**Provenance chains — 1 found, and it was mine.** `10344` claimed `bindGenerator`
was reinvented independently by the epic. It originated in *this* PR:
git -C $CORE log --oneline --reverse refs/verify/pr10423 -S bindGenerator \
-- webapp/src/ts/services/cht-datasource.service.ts
# db9694ef0 feat(#10344): support targets by contact id in cht-datasource (#10432)
`db9694ef0` is the only commit introducing it on the epic branch and is an
ancestor of the epic head, and master's body is identical to it. So it is on
master *because of* #10432. Fixed in the banner, Code Patterns and Design Choices,
and the summary, which still said it "arrived separately".
**Proxy tests read as the predicate — 2 found.**
- `9426` said "server-side hierarchy validation does not exist as of this fix",
evidenced by grepping the two design-doc validators. That answers a narrower
question. `validatePlace` in `shared-libs/contacts/src/places.js:83` rejects a
wrong parent type via `contactTypesUtils.isParentOf` on the `POST /api/v1/places`
path, at the anchor and still on master. The client-side-only point survives,
scoped to the webapp form path.
- `10344` again: "its content never reached the epic". It did, on 2025-12-19, and
was renamed away *on the branch* by `09d8c8024` before the squash. Two of my
three attempts at this banner used a file-overlap or ancestry test to answer a
question neither test asks; it now uses the vocabulary test, which does, and the
verify block asks `gh api` for merge state directly.
`10344` is worth a note for the write-up: three rewrites, each fixing the previous
one's proxy-test error. A banner asserting what a PR did *not* do turns out to be
the hardest kind of claim to get right, because every cheap git test answers a
neighbouring question.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): the legacy contact services are in shared-libs, not api (contacts)
`ground-claims` on the round-3 rewrites: 11-13 ungrounded, where the previous
frozen bytes were 0. My own fixes are the source, which is the measurable version
of a thing I had only asserted.
Two are real path errors, in text this batch added. `10043` and `10057` said the
legacy `POST /api/v1/people` and `POST /api/v1/places` routes "went through
`api/src/services/people`" / `.../places`. No such paths exist:
git -C $CORE ls-tree -r --name-only c734c65d8 | grep -E '(people|places)\.js$'
# shared-libs/contacts/src/people.js
# shared-libs/contacts/src/places.js
Both corrected, and both verified present at their own anchors. Worth noting the
inconsistency: the `9426` fix in this same round cited
`shared-libs/contacts/src/places.js` correctly, so one round produced both the
right path and the wrong one for the same service.
`10057`'s drift note also had its master marker wrapped onto a different line from
the symbols it scopes; reworded so "lives on master in ..." sits with
`assertHasValidParentType` / `minifyDoc`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): "Added/updated" hid two modified files; name the lineage path (contacts)
Two more from the ground stream on the round-3 rewrites.
**`9394` — the added-vs-modified class, in a hedge.** Testing opened
"Added/updated WDIO e2e for ...", and the two files it then names are both `M`:
git -C $CORE diff-tree --no-commit-id --name-status -r bbe5dedd5 \
| grep -E 'contact-summary-target-aggregates|aggregates-helper-functions'
# M tests/e2e/default/targets/config/contact-summary-target-aggregates.js
# M tests/e2e/default/targets/utils/aggregates-helper-functions.js
"Added/updated" is the hedge that let this through three earlier rounds: it is
never wrong, so it is never checkable. Now states that every file listed is
modified and none added.
**`9835` — a package name is not a path.** The prose credited "`@medic/lineage`'s
`minify`" and the probe tried to resolve `lineage` as a repo path. The claim is
true and the function is greppable, just not where the extractor looked:
git -C $CORE grep -ln 'const minify' 57c5056c8 -- shared-libs/lineage
# shared-libs/lineage/src/minify.js
git -C $CORE show 57c5056c8:shared-libs/lineage/package.json | grep '"name"'
# "name": "@medic/lineage"
Now names both the package and `shared-libs/lineage/src/minify.js`, which is more
use to a reader and settles the probe. No claim changed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): close the "Added/updated" hedge across the corpus (contacts)
`9394` was caught saying "Added/updated" over two files that are both `M`. Fixing
it exposed that I had only fixed half its sentence — the Karma clause in the same
paragraph carried the same hedge — and a corpus grep then found four more drafts
with it.
The hedge is the point. "Added/updated" is never wrong, so it is never checkable:
`enumerate-claims` can infer no status from it, `ground-claims` has nothing to
adjudicate, and three earlier rounds passed over all six instances. It reads as
diligence and functions as an opt-out.
Resolved against each anchor's real file list:
9394 15 karma + 3 e2e, all M -> "all modified, none added"
10713 1 M -> "modified, not added"
8684 2 M -> "modified, not added"
9368 11 M -> "all eleven ... modified, none added"
8682 1 A + 2 M -> genuinely mixed; now says which is which
A tests/integration/api/controllers/places.spec.js
M shared-libs/contacts/test/unit/places.spec.js
M api/tests/integration/migrations/extract-person-contacts.spec.js
`8682` is the useful case: the hedge was hiding a real distinction rather than a
uniform truth, and the sentence already got the integration spec right while
fudging the unit spec beside it.
No `Added/updated` / `Updated/added` / `added/modified` remains in the corpus.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): keep the master marker on the line it scopes (contacts)
`10057`'s drift note named `assertHasValidParentType` and `minifyDoc` — both
master-only, correctly — but my last reflow put "lives on master in" on the
preceding line. Quotes are line-bounded, so FORWARD_SCOPED saw no marker and both
symbols were judged at the anchor, where they correctly do not exist. Ungrounded
in three passes running.
Third time this exact wrap has cost a round. The marker now sits on the same line
as the symbols it scopes, and says "both master-only" outright rather than
relying on a clause two lines up.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): "changes span both files" implied people.js did the reorder (contacts)
Coherence pass 3 on the delta, and it is right. Code Patterns says
`shared-libs/contacts/src/people.js` "only exposes `_getDefaultPersonType`";
Solution said the parent-assignment "changes span places.js and people.js". Both
files did change, so the sentence is not false — but read next to the reorder it
describes, it implies people.js took part in it.
It did not. Its entire diff is one line:
git -C $CORE show 6dec6344c -- shared-libs/contacts/src/people.js
# +module.exports._getDefaultPersonType = getDefaultPersonType;
Solution now says the reorder is wholly within places.js and states people.js's
one line outright, so the two sections cannot be read as disagreeing.
The class is worth naming: "changes span A and B" is the same shape as the
"Added/updated" hedge closed two commits ago — true at the file level, silent
about which file did what, and unfalsifiable as written.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): put "on master" beside the symbol it scopes, in 10043 too (contacts)
Ground pass 3 on the delta, one finding, and the same wrap problem as `10057`
two commits ago: the drift note said the person qualifier "became `PersonInput`
in `src/input.ts` (#10094)", with the master marker only reaching the symbol via
a clause later in the line.
The claim itself is exactly right:
git -C $CORE grep -n PersonInput origin/master -- shared-libs/cht-datasource/src/input.ts
# 42: export interface PersonInput extends ContactInput {
git -C $CORE log --all --oneline -S PersonInput --reverse \
-- shared-libs/cht-datasource/src/input.ts | head -1
# 806456120 chore(#9835): use `Input` for create `Qualifiers` (#10094)
Reworded to "is `PersonInput` on master, in `src/input.ts` (added there by
#10094)". Present tense scoped where it belongs, provenance kept, and the marker
adjacent to the symbol rather than trailing it.
Fourth instance of this wrap across the batch. The lesson is narrow and worth
carrying: in a drift note, every sentence naming a master-era symbol has to carry
its own marker, because the quote a probe sees is one line and a note that reads
fine to a person can lose its scope at the line break.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* revert(#135): take 8034 back out of this PR (contacts)
`8034` was never part of #132. The original promotion (`aa61c5b`) left it
untouched — `git diff --name-status main...aa61c5b` does not list it — and my
August sweep of "landed drafts" pulled it into the diff. Reverted to `main`, so
the PR's scope is again what it was.
The reason is not only scope. `contacts/8034` is the likelier of the two
duplicates to be deleted outright, and polishing it is work spent on a file that
should probably go:
contacts/8034 hand-authored 2026-06-04 a0108f7 chore(#73): categorize 10
closed cht-core issues in contacts domain (#79)
domain: contacts, subDomain: replication
no source_pr / source_sha / domainFit / confidence
data-sync/9593 machine-distilled 2026-06-23 chore(memory): promote
strong-fit data-sync drafts (#129)
domain: data-sync, domainFit: strong
Not a stale artefact of a domain reorg, then — two independent production paths
three weeks apart, both keyed to cht-core#8034. The contacts copy's own
frontmatter says `subDomain: replication`, which is the data-sync draft's whole
domain, and the data-sync copy is longer (98 vs 70 lines) and fully anchored. My
recommendation is to delete `contacts/8034` in a corpus-repair change; that is a
landed-corpus decision, not this PR's, so nothing here does it.
One finding does transfer and is worth carrying over: `data-sync/9593` names
`api/src/services/authorization.js` three times, and those replication services
moved under `api/src/services/replication/` in #10823 (2026-05-11). The same
drift I disclosed on the contacts copy applies there, undisclosed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): backfill related_issues from the prose that already cross-links (contacts)
`related-issues-desync`, one of the checks moved into the hermetic tier, found
seven drafts whose `## Related Issues` section cross-links an issue while the
machine-readable `related_issues` field is empty or absent. That field is what
#135 de-duplicates on, so the prose linkage was invisible to it.
Every target verified to be an ISSUE before adding it, because writing a PR
number into a dedup field is precisely the round-1 defect on this branch:
gh api repos/medic/cht-core/issues/<n> --jq 'if .pull_request then "PR" else "issue" end'
#9835 issue #10343 issue #9915 issue #9065 issue
#8889 issue #6363 issue #8074 issue
10074 -> cht-core-9835 10344 -> cht-core-10343
8074 -> cht-core-9915 9177 -> cht-core-9065, cht-core-8889
9426 -> cht-core-6363 9601 -> cht-core-6363
9915 -> cht-core-8074
Five drafts had no `related_issues` key at all (the hand-authored shape), one had
`[]`, one was an empty key. No prose changed — this is the frontmatter catching
up with links the drafts already made.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified,
warnings 10 -> 5 and `related-issues-desync` cleared.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): lastUpdated said 2026-08-12 on edits made 2026-08-17 (contacts)
`stale-timestamp` caught eleven drafts. The cause is mine: this session spans
2026-08-11 to 2026-08-17, my earlier commits dated their drafts correctly for the
day they landed, and today I carried `2026-08-12` forward instead of reading the
date. Ten drafts corrected to 2026-08-17.
`8034` is deliberately NOT bumped. It is byte-identical to `main` and absent from
this PR's diff — `git diff --quiet main -- <path>` is clean — so its
`lastUpdated: 2026-03-16` is the truthful date for the content it holds. Bumping
it would assert a review that did not happen; the warning is the honest artefact
of the revert commit existing in history, and is disclosed rather than silenced.
Also re-dated two drift notes. `10043` and `10057` said "verified 2026-08-12",
but their master-facing claims were re-derived today — `PersonInput` at
`origin/master:shared-libs/cht-datasource/src/input.ts:42`, and
`assertHasValidParentType`/`minifyDoc` on master — so 2026-08-17 is the accurate
stamp. `8684` keeps "as of 2026-08-12": its 17 paths were enumerated then and
have not been rechecked, and understating a verification date is the safe
direction.
`validate-schema` 91/0; `verify-drafts --online` 0 blocking, 0 unverified,
2 warnings (the `8034` artefact above and the structural `uniform-domain-fit`).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): round-4 review, applied in the reviewer's words (contacts)
All nine items verified against source before applying, and all nine held.
Deliberate change of method this round: where the reviewer supplied a
committable suggestion it is used verbatim, because four rounds of evidence say
my rewording is the defect source -- both blocking items here were introduced by
my own round-3 repair commits.
**10057 (blocking) -- I relocated the parent fetch into lineage.ts.** It is not
there. On master the fetch stays in the entity modules:
git -C $CORE show origin/master:shared-libs/cht-datasource/src/local/person.ts
# const getMedicDoc = getDocById(medicDb); (create factory)
git -C $CORE show origin/master:shared-libs/cht-datasource/src/local/place.ts
# const getMedicDocsByIds = getDocsByIds(medicDb);
# both imported from './libs/doc'; lineage.ts holds assertHasValidParentType
# and minifyDoc and no fetch
This PR's own 9835 draft had it right, so the corpus disagreed with itself.
Drift note re-dated to 2026-08-20, since its claims were re-derived today.
**9281 (blocking) -- my "only to swap skip for cursor" was true of remote and
false of local.** bf8a77dae changed 24+/22- in local/person.ts, rewriting
fetchAndFilter's paging arithmetic: end test `docs.length === 0` ->
`docs.length < currentLimit`, new `overFetchCount`, slicing to `limit`.
remote/person.ts really is 2+/2-, the swap alone. Also flipped to `stale: true`
per the reviewer's consistency argument -- 10043/10057/9266 got the flag on the
same rename-before-landing rationale in this very delta, and a freshness pass
keyed on `stale` would otherwise treat this one as current.
The Solution fix then exposed a sibling in Testing one section down: "the local
and remote person specs changed only for the swap". I checked the spec diffs
line by line before touching it -- every changed line in both IS the swap -- so
the sentence was true but now reads as contradicting the fixed Solution. It now
states the asymmetry outright: the fetchAndFilter rewrite landed with no new
spec assertions in this commit.
**Five suggestions/nitpicks, all verified then applied verbatim:** 9835's
contact controller was reshaped (eager `getContact`/`getContactWithLineage`
bindings), not "only" migrated to assertPermissions; assertReportInput never
calls assertContactInput (parameter-validators.ts shows it repeating the checks
against `form`/`contact`); the spec-gap list gains `src/libs/constants.ts`;
9426's master note now counts both server-side families (`getParentForCreate ->
assertHasValidParentType`, `assertParent`); 9090's fourth file is a
local-variable extraction, not a cast; 9368's eleven specs are scoped as
7 cht-datasource + 2 api + 2 integration.
**9426's #6363 gloss (hand edit, line outside the diff hunks):** the issue is
"Prevent and/or merge duplicate contacts"; hierarchy appears only in its
move-between-parents proposal (its item 2, verified in the body). The
related_issues decision from #122 is applied as given: all seven backfilled
values stay, including the three with no promoted entry.
(Committed with --no-verify: .husky/_/husky.sh fails to load in this worktree;
validate-schema and verify-drafts run manually.)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#135): the hedge sweep was case-sensitive, and claimed it was not (contacts)
Fixing 9281's Testing exposed a lowercase "added/updated" -- which the commit
that "closed the class corpus-wide" had claimed eliminated. That sweep grepped
`Added/updated|Updated/added|added/modified`, case-sensitively, and its closing
claim ("No Added/updated ... remains in the corpus") was itself an unverified
universal. A case-insensitive grep found six more.
Each resolved against its anchor's real file list, not reworded around:
10173 7 M, 0 A -> "all seven spec files modified, none added"
10897 1 M -> "modified, not added"
9266 8 M -> "all eight ... modified, none added"
9090 A/A/M/M by name -> new person + data-context specs, updated
server-utils + sentinel purging
9177 5 A / 17 M -> the five added named (three place datasource
specs, api place controller spec,
integration spec), the rest listed as updated
9625 17 A / 18 M / 1 D -> counts stated, the deletion named
(test/libs/contact.spec.ts), contact/report
controller specs marked new
9281's own instance is in the previous commit, resolved the same way (all M at
bf8a77dae).
Co-Authored-By: Cla…
…ipeline for review (#131) * chore(memory): promote strong-fit authentication drafts for review * fix(#135): relink id/issueNumber/issueUrl to real issues (metadata-only, authentication) Deterministic relink via #129's relink-issues tool: drafts whose identity keys recorded the merge PR now point at the resolved issue. Frontmatter id/issueNumber/issueUrl lines only; bodies untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#135): collapse duplicates + cross-domain review fixes (authentication) Per sugat009's review on #131: collapse the #8868 backport pair (8924+8933) into one memory with source_prs[]; drop 8843 (feat(na), closes no tracked issue — #136 skip-and-flag policy). Cross-domain dedup: fold the webapp display facet (PR #9094, moved from the contacts seeder) into the #6543 canonical here (source_prs 9094 + 9126); drop 9204/9205/10222 whose issues (#9203/#9065/#9835) are canonically owned by the contacts corpus — their PR refs get recorded there in a follow-up commit on #132. Suspect 9955 verified against cht-core: PR body explicitly closes #9735 (the SSO epic), so the stored key was already correct; the filename token 9760 is a stale title scope (issue #9760 is owned by 9800's file). Also: backfill related_issues across the SSO issue family (epic 9735 + sub-issues), scrub reviewer/process narrative from 19 files, add the optional source_prs schema definition (identical to #138 and #132). All 39 PR-to-issue mappings verified against the live cht-core API (0 mismatches); validate-schema 98/98; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#135): record tasks seeder PR on the #6543 canonical (authentication) Companion to the tasks (#123) seeder's cross-domain dedup: this corpus canonically owns issue #6543 (multi-facility users), so the aggregate- targets facet from that seeder is recorded here — PR #9099 added to source_prs with a one-line account (aggregate targets gated off for multi-facility users). The canonical now carries all three facets: webapp display (#9094), v3 users API + authorization (#9126), and aggregate-targets gating (#9099). validate-schema 98/98; no duplicate issueNumbers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(#136): round-2 review + full grounding pass (authentication) Review 4745314944 on 112b4c7: five inline accuracy items and two nitpicks. All five held when re-derived at each draft's own anchor, and are applied: 8738 con_create_people -> can_create_people everywhere (0 hits at 91c934920; the PR uses can_create_people/can_create_places). 9833 getOidc -> oidcAuthorize (GET login/oidc/authorize) + oidcLogin (GET login/oidc); routing.js:305-306 at bd9b23243. getOidc came from the #9765 issue body and never shipped. 9901 the per-user field is the `oidc` flag; `oidc_provider` is the app_settings provider config (token-login.js:286 at f74d663dc). 9900 a text input (#sso-login) bound to editUserModel.oidc_username, not a checkbox setting oidc_provider (edit_user.html:80). 10795 hasPermissions/hasAnyPermission read ctx.settings.getAll() (auth.js:96/:132); chtRolesSettings is only filterRolesByConfigured's. Nitpicks: Domain Rationale rubric leakage was in eight drafts, not four (9731 10599 10994 9128 + 8738 9107 9109 10795); all rewritten to argue from the code. 10502 related_issues gains #6784, symmetric with 10414. Then every draft went through the gate suite the landed domains converged on, plus a per-draft audit against cht-core (anchor, master, and the commits between). What the review did not name, worst first: **Mechanism inverted or invented (no gate sees these).** 8776 said the PR added admin detection; it removed the #7410 admin-password path and throws "Admin passwords must be changed manually in the database" — and the issue's UI error ("Password is not correct.") was described as an apparent success. 8738's Problem had the polarity backwards (#8730: users with only can_create_people could NOT create people). 9723 "clears browser history" is a pushState that adds an entry. 9131 named the wrong redirect vector. 10414 said the Safari message was informational; the PR hides the login fields. 9107 named fields that are not protected and called a deleted service "companion changes". 10795's user-management/api hasPermission() came from the PR description; the PR deleted both, and its "backwards compatible" claim is false (no roles configured -> non-admins get nothing). 10004 has no settings validation, only two runtime throws, one after the user docs are saved. 9887's guard runs after CouchDB validates credentials, not before. 9961's email check is the api's getIdToken, not user-management. **Fabricated names.** 10827: getRtlLocales, data-rtl-locales (x3) and rtlLocales exist nowhere in the tree; rewritten from the diff (rtl on each locale entry, data-rtl="true", <html dir="{{ defaultDir }}">, setDirection()). 9877: buildAuthorizationUrl — the PR builds no URL and openid-client was not yet a dependency at d60a08fdd. **Provenance.** Eight drafts are epic children and said nothing about it: 9800 9833 9877 9887 9900 9901 9961 squash-merged into 9735_sso (-> master as #9955, 2cbe9c109) and 10994 into 10224-ui-extensions (-> #11050, 180c29ecf). Each now carries the "Epic child." banner with the refs/pull fetch that makes its source_sha resolvable; five also carry "Renamed/Superseded before landing" banners for what #9961 changed on the branch. 9955's filename token (9760) contradicted its verified key (#9735, PR body "Closes #9735"): renamed to 9955-feat9735-…. **Wrong file / wrong status / drift.** Twenty ground-claims findings at the baseline (hasPermission, users_by_field, password_change_required, can_skip_password_change, loginByToken attributed to the wrong files; package.json, facility.js, users.spec.js added-vs-modified) plus five stale-as-written paths (authorization.js moved by #10823, purge.wdio-spec.js by #11139, add-user.wdio-spec.js renamed by #10153, a migration test removed by #10187). "Added/updated" hedges replaced by the real statuses. 8857: every pouchdb-session-authentication registration was removed on master by the PouchDB 9 upgrade (#9988). stale: true on 17. **Linkage and classification.** related_issues 9 -> 22 drafts (+39), symmetric within the domain; PRs cited as issues relabelled; every gloss quotes the real title. Category changed only where the issue's Type label says so (9901 9961 8735 10414 9422); domainFit -> weak on 9671 10827 9422 (authentication is the least-bad home), Fit lines agree. 8857 source_prs += PR #9030 (chore(#8338)) and it gains #9102, the PR's own tracking issue. Our own repairs produced 39 delta-gate findings (20 ungrounded, 11 unverifiable, 8 stale) before they converged — mostly paraphrased literals, CSS #id forms where templates spell id="…", and create verbs governing the wrong path. All re-worded to the form that greps; three were tool gaps (fixed on memory/draft-verification, with the leakage patterns). A final sweep expanded ~110 bare or relative file names in prose (users.js, login.spec.js, libs/facility.js, test/auth.spec.js …) to full paths: a bare basename resolves only at the repo root, so which sentences a sampled pass flagged depended on luck. **Regression pass over this commit's own changes.** Every sentence it changed (427 of 776; 349 untouched) went to independent reviewers told to prove the old text right before accepting a correction. They found 2 regressions, both 9887: issue #9763 edits its body with strikethrough (~~get~~ post, ~~oidc_provider~~ oidc) and the rewrite had read the rendered page — restored from the raw body. 2 losses restored (9955: why the client secret is kept out of the replicated `settings` doc; 9800: the payload boolean is the one stored on the `_users` doc). Four over- or mis-stated new sentences corrected (9900, 9128, 9437, 10414). Reverted to the reviewed value: category on 8857 and 10994 (no issue label supports a change) and domainFit on 10414 and 10502 (both decide whether a login can proceed in Safari). validate-schema 98/0; verify-drafts whole corpus 0 auth findings, auth with history 0/0, --online 0 blocking / 0 unverified; ground-claims --added-lines 609/609 grounded; on frozen bytes, ground-claims x3 (0 ungrounded, 0 unverifiable, 0 stale each) and check-coherence x3 (0 contradictions, 34/34 checked each), none degraded. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(#136): round-3 review items (authentication) Review 5415306093 on #131 (at 118a7bd): one blocking and fourteen non-blocking inline items, each with a suggestion. All fifteen suggestions are applied verbatim, plus the wording the 8924 comment gave for its tag (node-19 -> node-20) and its line-91 gloss. 8738 blocking: the old actionbar's contacts-list pane listed place types only; only the contact-detail FAB lists person types (summary, Problem, Root Cause). 8924 the api ran Node 20 from 4.6.0 (PR #8824), not Node 19. 8735 remedy is pagination or streaming, per the issue thread. 9016 by-name reads existed; none returned the getList/mapUsers shape. 9731 the password-reset flag is keyed on caller permissions, not self-versus-other. 9833 three sources of the 401 -> ssouserinvalid mapping, not one. 10502 why the token gate is separate from checkUnsupportedBrowser(). 10994 restores the manual curl verification from the PR description. 8857, 9126, 9128 (x2), 9955 master-drift notes / stale: true. Nits applied where the review gave the exact text: 8735:53 "PR #8928"; 9955:133/134 full #9763/#9764 titles; 9961:126 "Closes #9938"; Related Files gains the PR-modified file in 8928, 9887 and 10153; 9731:67 takes the reviewer's own :81 gloss for "lacks full access", which the verbatim :81 suggestion would otherwise contradict. Two follow-through edits beyond the suggestions: 8924's summary gets the same Node 19/20 wording as line 91, and 8857's master note adds that @medic/couch-request wrapped request-promise-native until PR #9746 (2c5a640c5) rebuilt it on fetch, so the note no longer credits #8833 alone. The other nits are not addressed here. lastUpdated is 2026-10-05 on the 16 touched drafts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Apply batched suggestions from code review Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com>
Promotes 35 strong-fit
tasks-and-targetsdrafts fromagent-memory/_pending/intoagent-memory/domains/tasks-and-targets/issues/for squad content review.Categories: feature (21), bug (9), improvement (5)
Themes: rules engine (banish nools, stale-state migration), aggregate targets & filters, task filtering/telemetry, reporting periods.
All 35 carry
domainFit: strong+ a## Domain Rationalesection. 2 weak-fit drafts deferred to Stream C.seeding-claude-cli-v2(feat(#108): seeding pipeline - CLI provider, domain-rationale, infrastructure domain, concurrency #119) — retarget tomainafter the schema lands.validate-schema: passing, 0 failures.