curate: 15 trap.d/ fragments -- 3 new rules, 6 merged, 3 declined, 3 deferred

[fdaviddpt]

Summary

/oss:curate pass over the 15 fragments waiting in trap.d/. Every fragment
was re-confirmed against the current tree (grep/read/reproduce) before
being decided, since several were release-audit findings that could
already have been fixed by a later commit.

This PR is the review. It closes nothing -- no_close is set -- because
this pass consumed each fragment into a rule, a merge or a decline instead
of doing the issue's own underlying work.

Promoted -- 3 new rules

Each has a reproduced must-fire payload and a must-stay-silent control
against an unrelated scripts/*.py file (checked with the shipped
pre-path-hook.sh directly, both directions, per /oss:curate's own
firing-proof requirement).

• .claude/jit-context/paths/00-manual/worktree-reap-precedence-bug.md
  (Part of doctor: clear the launcher skew WAIT, disposition the repair arm's writes, and reap idle worktrees #1637): gh pr list returns newest-first, and
  branch_merge_state only makes MERGED sticky -- every other row
  unconditionally overwrites state, so the last-processed (oldest) row
  wins. A branch whose newer PR is OPEN and whose older PR is CLOSED reads
  "closed" overall, and plan_reap then force-removes a live lane's
  worktree. Reproduced by reading the real loop in scripts/worktree_reap.py.
• .claude/jit-context/paths/00-manual/release-gate2-comment-age-type.md
  (Part of release_gate2.py: three absence/format defects share one rendering #1706): latest_review_comment_age_minutes as a string reaches
  a bare age < threshold_minutes with no type check and crashes with the
  script's own EXIT_BLOCKED code -- a malformed field renders exactly
  like "in-flight, release blocked" rather than "could not tell".
  Reproduced directly:
  echo '[{"number":1,"review_decision":"NONE","lane_active":false,"latest_review_comment_age_minutes":"5"}]' | python3 scripts/release_gate2.py --prs-json -
  raises TypeError and exits 1.
• .claude/jit-context/paths/00-manual/review-return-backref-fenced-code.md
  (Part of review_return.py's referred-not-stated heuristic false-triggers on a fully-enumerated FINDINGS message that merely uses a back-reference phrase #1727): _BACKREF fires on a back-reference-shaped phrase
  quoted as example/repro text inside a fenced code block, misclassifying
  a message that fully states every finding as referred-not-stated.
  Reproduced against the incident's own reviewer message via
  review_return.py --framed.

Merged -- 6, into 2 existing rules

Each confirmed still live against the current tree (direct grep/read)
before merging.

.claude/jit-context/paths/00-manual/loop-prose-parity.md gains five
bullets, all confirmed live:

• Part of releaser gate 2 reads the same unreviewed green PR as backlog in one run and as mid-review in the next #1681 -- release.md never states the comment-age field needs
  an explicit null, never an omitted key, for a PR with no review
  comment.
• Part of setup.md never asserts ${CLAUDE_PLUGIN_ROOT} resolves; first spawn ran setup against the plugin checkout, not cwd #1689 -- agents/scheduler-step.md's PLUGIN-ROOT: could-not-run
  handback line has no documented reader anywhere in commands/run.md.
• Part of The triager sets a lane on every issue but has no matching floor for priority, so an unrankable issue stays permanently undispatchable #1695 -- agents/triager.md's priority floor still hardcodes
  the literal priority-low instead of the declared labels.priority.
• Part of A cross-repo loop-filed issue never carries filed-by-loop #1705 -- findings.md names a gh-labels:repo:OWNER/NAME call
  that the installed supertool refuses outright (reproduced: gh-labels takes at most one argument, got 2).
• Part of Gate 3 resolved-install can return a stale plugin root, and the spawn resolves its own root independently #1721 -- tick-order.md's DOCTOR_ROOT resolution never got
  the same stale-root check Gate 3 resolved-install can return a stale plugin root, and the spawn resolves its own root independently #1721 built for gate 3.

.claude/jit-context/vocabulary/00-manual/could-not-tell-shallow-clone.md
gains one paragraph:

• Part of statusline: rel ?/? on a repo with no version tag hides a measured numerator -- every commit is banked toward the first release #1692 -- statusline.py's since_floor has the identical
  shallow-clone truncation gap release_delta.py already guards against.

Declined -- 3

Traced in .claude/jit-context/paths/00-manual/00-README.md:

• Part of oss:doctor applies, commits to main, pushes and writes permissions despite an explicit no — needs a guard in code, not prose #1690 (doctor role marker never cleared) -- already fixed by
  doctor spawn never clears its role marker, so /oss:run's first tick after step 1 always refuses (#1716 composition) #1728; agents/doctor.md clears its own marker as its last act.
• Part of oss:doctor applies, commits to main, pushes and writes permissions despite an explicit no — needs a guard in code, not prose #1690 (changelog fragment overclaims a push/commit guard) --
  already corrected inside the v0.41.1 release commit's own history;
  changelog.d/1690.fixed.md no longer exists and the shipped
  CHANGELOG.md entry makes no such claim.
• Part of fix(dispatch): delete two dead rules that survived the #1544 dispatch move #1701 -- a narrow, self-referential CLAUDE.md citation drift
  (a stale line reference in its own release-history prose), not a
  recurring pattern a rule could catch, and outside what this pass may
  rewrite.

Deferred -- 3, left unchanged in trap.d/

1630.fifty-one-worktrees-accumulate-because-every-reap-gate-declines,
1660.pytest-leg-margin-arithmetic-ignores-pre-run-tests-step-overhead
and 1667.next-minor-pin-guard-failed-on-one-leg-and-passed-on-three were
all already deferred by the 2026-09-17 pass for reasons that still hold
(a design decision on a separate reap sweep, an instrumented CI run, and
CI logs from an old run that may no longer be retrievable). Nothing new
here changes that, so they stay in trap.d/ untouched.

Test plan

• pytest tests/test_content_invariants.py tests/test_trap_scaffold_1302.py tests/test_trap_curate_905.py --no-cov -q -- 237 passed
• pytest tests/test_oss_rules.py tests/test_jit_layer_readers.py tests/test_jit_rule_migration_245.py --no-cov -q -- 104 passed
• All 3 new rules verified to fire (must-fire) and stay silent (must-stay-silent control) via the shipped pre-path-hook.sh/pre-prompt-hook.sh, both directions
• git status --porcelain trap.d/ showed every deletion as tracked ( D), recoverable via git checkout --, before committing

🤖 Generated with Claude Code

[AI-generated]