chore(closeout): reconcile remediation v2 evidence and enforce comment hygiene

.github/workflows/ci.yml

@@ -89,6 +89,8 @@ jobs:
       - name: Install devDependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Tracked JavaScript comment and test-title guard
+        run: pnpm run test:quality
       - name: Typecheck (tsc --checkJs)
         run: pnpm run typecheck
       - name: Lint (eslint)

docs/archive/2026-09-29-aqe-released-artifact-receipt.md

@@ -0,0 +1,46 @@
+# AQE 3.14.5 released-artifact receipt (2026-09-29)
+
+Capture: 2026-09-29. Documentation basis: `b5a0a946ae0aca2e1d435c78b12a98bc587d1266`. Probe observations: 2026-09-29T14:27:38Z; compilation of retained evidence, without new runtime probes. The upstream issues [#655](https://github.com/proffesor-for-testing/agentic-qe/issues/655), [#753](https://github.com/proffesor-for-testing/agentic-qe/issues/753), and [#778](https://github.com/proffesor-for-testing/agentic-qe/issues/778) are closed, but closure does not establish installed behavior. This receipt reports only the selected tests below. It is not an issue-closing request.
+
+## Exact artifact and environment
+
+The controller registry capture at 2026-09-29 14:16:56 UTC listed `agentic-qe@3.14.5` as latest. The registry tarball had SHA-512 integrity `sha512-mDvWB1fUaGevg6F3QNWK7ESXHeZnlvc0MiQ4Ue9do4SJwggM6aP5dl3DZNWKmO2g5GGFjYJuikl53KeuT3uazg==` and SHA-256 `32cd29f00201cbcba19313b62bac20ffaa5c7d032b5246e5d08d94d6d24b9221`. Its installed selected source files matched tarball bytes:
+
+| Package-relative path | SHA-256 |
+| --- | --- |
+| `package.json` | `6a854da5e68636739a400b6237ad77b2250480471d5a4e643cc6474f297ee3a0` |
+| `dist/cli/bundle.js` | `a8b61993b4286336f79f9d7db9195b26d86626924adbd522a158fad222b08a84` |
+| `dist/init/codex-installer.js` | `79dda90da0faa7202ea61fc0c449d9ef4062d96f6062324bb98ecd6e9980d78a` |
+| `dist/audit/witness-chain.js` | `a712fa97849efdfe160c3c2e440901d25e48450e2d6bdaa69af4225c824f3458` |
+
+The tarball was installed in a disposable private prefix with lifecycle scripts ignored; only `better-sqlite3` was rebuilt there. Both commands exited 0. Acquisition and native dependency preparation ran unsandboxed with a private constructed environment; the sandbox claim applies only to the later probes. The before/after global check covered package metadata, not a complete global installation fingerprint. Public `aqe` bin reported 3.14.5. Runtime: Node 26.4.0, `better-sqlite3` 12.11.1, SQLite 3.53.2, macOS arm64. Probe invocations ran with a credential-free, private environment, denied network, and sandboxed writes. The probe script relied on an earlier setup step that created the empty project and environment; the retained setup commands and logs support that initial state, but the probe script is not a self-contained fresh-root reproducer. Optional Vibium bootstrap attempted network access and failed as expected under the sandbox during the three init runs. No global install was made: global AQE metadata was 3.14.4 both before and after. The release's npm publication timestamp was 2026-09-29 10:08:33 UTC; [PR #783's merge commit](https://github.com/proffesor-for-testing/agentic-qe/commit/63d3debab54105dbc93030eb0b0088e2f9bebd9c) is dated 13:05:19 UTC, after that publication. The release metadata supplied no `gitHead`, so this ordering and the artifact probe bound the conclusion rather than an assumed source tag.
+
+## Selected results
+
+| Issue | Verdict on released 3.14.5 | Observed contract and limit |
+| --- | --- | --- |
+| [#655](https://github.com/proffesor-for-testing/agentic-qe/issues/655) | Verified selected compact path | `aqe init --auto --with-codex --codex-guidance compact` exited 0. The AQE-owned sentinel region was 315 UTF-8 bytes, below the released 512-byte constant. A separate foreign prefix/suffix fixture survived two identical calls with complete `AGENTS.md` bytes and mtime stable between calls 1 and 2. The fixture creation mtime was not captured. Full/none modes, CRLF and malformed/duplicate sentinels, all-platform verification, and receipt correctness remain unverified. Prior 3.14.4 broader conformance failed; this narrow result does not sunset the registry constraint. |
+| [#753](https://github.com/proffesor-for-testing/agentic-qe/issues/753) | Verified fresh-chain append case | Released `createWitnessChain` places tail read and insert inside an immediate SQLite transaction. One native WAL sequential control and three synchronized two-process rounds each ended at 4001 rows (seed plus 2000 per process), `valid: true`, `signatureFailures: 0`, and SQLite integrity check `ok`. Only concurrent round 1 demonstrably interleaved the writers. Entries were synthesized unsigned `PATTERN_CREATE` records; signature validation, old-fork repair, import splices, live host concurrency, and Windows/Linux remain unverified. The kit's live-holder refusal still protects stray-store merge and must not be removed from this proof. |
+| [#778](https://github.com/proffesor-for-testing/agentic-qe/issues/778) | Refuted fixed-in-3.14.5 claim | Three same-option public init calls on one unchanged minimal project each exited 0, yet `.claude/settings.json` hashes and mtimes changed on every call. Run 2 added a backup and changed domain/learning defaults; run 3 still changed `aqe.initialized`. `AGENTS.md` and `CLAUDE.md` bytes/mtimes were stable after run 1. The merged source fix is newer than the tested release. Subsequent-release conformance is unverified; keep installed/released convergence outstanding under own [#239](https://github.com/pacphi/agentic-kit/issues/239). |
+
+The source-bound report's private retained logs, snapshots, lockfile, scripts and synthesized databases have SHA-256 receipts. The digest of its artifact binding record is `200d11393cab0617bdd92b7218e5dcc5ab146e26e55ba7f58efee20d17471b1b`; selected result records are `init-results.json` `c03ee35435c5946bb18afa2bab96bbf5a29d2c3761bb102e80083d8e492789e4`, `foreign-results.json` `933883e6b9720ad01fb9b560919077247d65ab601750bf3fa4213a0c4ee3fb7b`, and `witness-results.json` `95b38b5c30380a53c1f7284fcaafb257a6b8c513381c9c824ad3a0748451c3f4`. This receipt intentionally omits private acquisition locations and raw project data. Time bounds were 30/60 s registry requests, 240 s dependency install, 180 s native rebuild, 150 s per init, 45 s per native child, and 20 s readiness; none expired in successful observed runs. The retained witness harness has a failure-path cleanup gap: if the first child fails, it can raise before killing and reaping its sibling. Do not reuse it without fixing that gap.
+
+There is no evidence here for broad Windows AQE support, repaired old forks, signed-entry verification, all guidance modes, or installed 3.14.4 conformance with the selected 3.14.5 behaviors. No upstream post, local store merge, or issue closure is authorized by this receipt.
+
+## Native holder and host-support boundary
+
+The [dated host-support addendum](../host-support.md) records released AQE 3.14.4 and
+3.14.5 live-owner lock checks on macOS and Linux: status and the shipped adapter
+reported `LockHeld`, without `FsyncFailed`; holder and storage bytes remained intact.
+V4 [PR #275](https://github.com/pacphi/agentic-kit/pull/275), squash
+`bb2e7efe88abd3cb2d73baf26530386549e3dc2e`, removed the exact temporary
+`FsyncFailed`-as-busy exception. Ordinary `LockHeld` remains busy. Older 3.14.3
+error sequences now fail closed; no universal managed AQE minimum was introduced.
+
+Native Windows AQE was untested. Ruflo 3.48.0 native Windows CLI-to-MCP and
+MCP-to-CLI visibility used one database with reported sql.js + HNSW and its native
+bridge disabled. That separate proof establishes neither Windows AQE behavior nor
+one native backend guarantee across platforms. The earlier Linux Ruflo result was
+asymmetric. Own [#240](https://github.com/pacphi/agentic-kit/issues/240) remains open
+on its literal managed-floor and combined live-MCP/`ak x verify aqe` criteria;
+the native holder probe does not prove that combined final-artifact path.

docs/archive/2026-09-29-plan-remediation-v2-closeout.md

@@ -0,0 +1,41 @@
+# Remediation v2 closeout execution
+
+## Status and authority
+
+Active under the confirmed [develop execution plan](../plans/2026-09-28-remediation-v2-develop-execution.md).
+Base: `develop@88ce597f`, incorporating reviewed V1–V6 and the main watcher reconciliation.
+All 13 develop CI checks passed. Source scope remains the 189 Appendix A and 57 Appendix B
+entries in [the program](../plans/2026-09-28-remediation-program-v2.md). New release, installation,
+real-store merge, deletion, personal-memory writes and future #239 work remain outside this
+implementation authority. The final develop → main PR stays open for human review.
+
+## Units and ownership
+
+1. **Comment-label guard:** a sole writer in this closeout worktree implements a parser-based
+   guard and removes transient planning labels from comments/test titles without changing
+   behavior. Scope: tracked JavaScript in src, scripts, bin and tests; no allowlist. Preserve
+   durable audit IDs and literal strings/regex/templates. Use RED/GREEN boundary fixtures.
+2. **Scope and evidence documentation:** a separate task worktree prepares dated public
+   receipts for every original scope ID, source-bound Windows and AQE evidence, and all
+   recorded rulings. It preserves failed observations, limits and explicit deferrals. It
+   submits exact shared-index/program-status handoffs and private issue drafts to the controller.
+   No source/test edits or publication. This unit can run alongside the guard because their
+   paths are disjoint; final citation checks follow their integration.
+3. **Controller integration:** review each unit, combine their accepted commits, apply shared
+   index/status handoffs, relocate the V3 paused-time report without losing its historical body,
+   and reconcile current issue conditions. Keep the parent program/execution plans active while
+   human approval and operational gates remain. Preserve all worktrees and branches.
+4. **Final gates and delivery:** full guarded unit/legacy and browser suites, types, lint,
+   complexity, Markdown, build, offline links and independent branch review. Open the closeout
+   PR into develop, squash only after required CI/review, verify tree equality and develop CI,
+   then open the final main PR for the human. Recheck main before that final PR.
+
+## Evidence and limits
+
+The fixed Windows ten-before/ten-after cohort is historical, with all outcomes retained.
+A separate three-consecutive-PR Windows timing rule remains pending: the current latest three
+include a 358-second leg. Refresh that gate after closeout PR CI; do not manufacture green runs.
+AQE #655/#753 proofs are narrow released-artifact observations; #778 settings churn still occurred
+in the release tested before its source fix. No issue closure or installed-state inference follows
+from upstream closed status alone. Exact current evidence and unresolved gates belong in the final
+receipt and PR. No real routine trigger or paid provider run is required for this closeout.

docs/archive/2026-09-29-remediation-v2-integration-evidence.md

@@ -0,0 +1,86 @@
+# Remediation v2 integration evidence
+
+Capture: 2026-09-29. Documentation basis: `b5a0a946ae0aca2e1d435c78b12a98bc587d1266`.
+These are sanitized controller receipts, checked against local commit objects; they
+record integration and the cited CI observations, not fresh runtime probes.
+The [scope matrix](2026-09-29-remediation-v2-scope-matrix.md) retains original
+dispositions and row-specific limits.
+
+## Inherited documentation integration
+
+The controller baseline receipt establishes these commits as ancestors of
+`94890a00ec6f5869c186d1066076c5a2e17dfee4`. Titles and ancestry establish
+provenance; they do not allocate every moved file to one PR or test current behavior.
+
+| PR | Integration commit | Scope |
+| --- | --- | --- |
+| [#264](https://github.com/pacphi/agentic-kit/pull/264) | `e7cfe9ca4d49cb5e94fba698cd0e8376e0c829b7` | docs: one purpose per docs folder, lower-case names, archive point-in-time material |
+| [#266](https://github.com/pacphi/agentic-kit/pull/266) | `7936ca48942e4ed1b629641eb61dc0dfbcf12951` | docs(archive): repair and validate historical links |
+| [#269](https://github.com/pacphi/agentic-kit/pull/269) | `159c1c98d86d5fbb22b5752413f5889d8b8d172b` | docs: archive completed taxonomy and Sonnet routing plans |
+
+## Reviewed feature integrations
+
+| Work | PR | Reviewed source | Squash commit | Reviewed and squash tree |
+| --- | --- | --- | --- | --- |
+| V3 dashboard | [#276](https://github.com/pacphi/agentic-kit/pull/276) | `cd5cd08b52a190e2a91540b404b648f6b43a365c` | `eb963f503f806f80df7a8173d7c71314adbd7cfa` | `b5544923cee35a3e0217de1e22d9f6b7f7ddaf4c` |
+| V5 intelligence | [#274](https://github.com/pacphi/agentic-kit/pull/274) | `36d78caf2fca6a61b7fd924499da9541ae85060c` | `af825c9f165575b3ef6e1ce0a5836fcf40a1ca3b` | `7966ba916018af69fc4f4908e2d7202da5c507d6` |
+| V4 follow-ups | [#275](https://github.com/pacphi/agentic-kit/pull/275) | `f19566adf2d0f0d7027bc4ea45f9f990e2b0355e` | `bb2e7efe88abd3cb2d73baf26530386549e3dc2e` | `0674d0762339037dcf24c30b9adbf58056b01db5` |
+| V6 usage | [#282](https://github.com/pacphi/agentic-kit/pull/282) | `fa0cb7b788791a90577a2dfd9f9ca61e07d0591e` | `069553586fb3ad1d824877259562eef0765a42a1` | `78de12a7c593fc79c889cf853ff6eedf39cb583e` |
+| Main watcher reconciliation | [#283](https://github.com/pacphi/agentic-kit/pull/283) | `09b198b6960c2dae14819d08729caa8b3794129b` | `9dc018b903ac074af0d4dbfcea0891c4e2a34e94` | `9db3da69020c147a798032b2cbde74e4eb88fdda` |
+
+V4 prerequisite [#273](https://github.com/pacphi/agentic-kit/pull/273), native trace
+[#277](https://github.com/pacphi/agentic-kit/pull/277), and watcher follow-up
+[#278](https://github.com/pacphi/agentic-kit/pull/278) remain separately reviewed
+parts of the delivery. Public implementation detail is retained in the archived
+[dashboard](2026-09-28-plan-dashboard-refresh.md),
+[follow-ups](2026-09-28-plan-follow-ups-v2.md),
+[usage](2026-09-28-plan-usage-accuracy.md), and
+[native trace](2026-09-29-native-learning-trace.md) records.
+
+## Latest source-bound CI and ancestry receipts
+
+| Source | Run | Recorded result |
+| --- | --- | --- |
+| V6 reviewed `fa0cb7b788791a90577a2dfd9f9ca61e07d0591e` | [36614260309](https://github.com/pacphi/agentic-kit/actions/runs/36614260309) | 15 applicable checks passed; published-release consumer skipped |
+| V6 develop squash `069553586fb3ad1d824877259562eef0765a42a1` | [36614973862](https://github.com/pacphi/agentic-kit/actions/runs/36614973862) | 13 checks passed |
+| Main watcher reviewed `09b198b6960c2dae14819d08729caa8b3794129b` | [36616775739](https://github.com/pacphi/agentic-kit/actions/runs/36616775739) | 14 applicable checks passed; real watch skipped |
+| Develop `88ce597f444d487a34d9871a447cf8942f76f760` | [36617683730](https://github.com/pacphi/agentic-kit/actions/runs/36617683730) | 13 checks passed |
+
+The last develop commit records parents `9dc018b903ac074af0d4dbfcea0891c4e2a34e94`
+and `cb54f42e11fb6ff152ec278eb2dc1e119ee05ac5`. Its tree remains
+`9db3da69020c147a798032b2cbde74e4eb88fdda`, equal to the reviewed watcher tree
+and squash. The main input is an ancestor of the reviewed feature. This records
+already-reviewed content while retaining ancestry; it is not final main approval.
+
+## Bounded dashboard observations
+
+The V3 controller receipt supporting [#256](https://github.com/pacphi/agentic-kit/issues/256)
+records actual native-transcript replay on bounded re-entry, a failing-before and
+passing-after fixture, and stable accepted/session/project counts for that scenario.
+Offsets live in bounded memory: eviction or a new process can replay, so this is
+not durable exactly-once delivery. A separate real Codex CLI 0.159.0 idle-fork
+process/transcript join in a plain folder used the real survey. It establishes
+plain-folder binding for that case, without a model turn, billing or browser claim.
+Structured live input remains experimental with no verified producer. These three
+answers make #256 a candidate final-main closure, subject to controller reconciliation.
+No Network event-stream trace or diagnosed fix is recorded for
+[#254](https://github.com/pacphi/agentic-kit/issues/254); the final trace check remains.
+
+## Remaining release and compatibility boundaries
+
+Node.js [#65934](https://github.com/nodejs/node/issues/65934) remains an upstream
+Node 22 runner-protocol/backport boundary. The V6 test-local change replaced a
+`beforeEach` console emission with `t.diagnostic`, preserving Unicode and assertions.
+An official SHA-verified Node 22.23.2 binary and a coalesced actual-child V8 replay
+matched the CI error; native historical chunk boundaries were not proved. Five
+focused checks and five fixed replays passed in the retained receipt. This does
+not establish an upstream runtime fix or permit dropping Windows assertions.
+
+The [Windows timing gate](2026-09-29-windows-ci-evidence.md) fails its recorded
+three-run snapshot. AQE release and installed-state limitations are in the
+[artifact receipt](2026-09-29-aqe-released-artifact-receipt.md). No real routine
+trigger, paid provider run, global upgrade or real-store operation was performed
+for these receipts. The memory loop remains OFF until main approval. Final
+closeout CI, aggregate main PR review, releases, installations and approved
+operational work remain separate gates. Attended time was not instrumented;
+commit and run timestamps establish observed elapsed intervals only.