docs(review): weekly review lessons 2026-10-05

[dilux-bot]

📝 What changes

• General profile: new rule on bash set -e traps (unguarded grep, $(cmd || true) under if !, fixtures built in $( ) ||).
• General profile: new rule to check docs and PR descriptions that state rules, conditions or coverage against the code or CI, exceptions included.
• WordPress plugin profile: new rule that every path that ends, fails or deletes work must clear retries, run callbacks and abort remote state.
• WordPress plugin profile: new rule that a header, limit or option meant for every upload or request path needs a test per variant.
• No safe-path or removal proposals: no merged PR met the 5-PR bar, and none was reverted.
• For a person to write as rules in kinds/wordpress-plugin/rules.yml with fixtures: the unguarded grep under set -e, and $(cmd || true) inside if !.

💡 Why

• Bash traps: seen in .github#15 and .github#16, both recent.
• Doc claims against code: multisite-user-sync#26, offload#27, #28, #29 and #42.
• Cleanup on every path: multisite-user-sync#28, #29 and offload#30.
• Test per path: offload#39 and #41.
• Almost every PR is rated high with no reverts, so there is no evidence for safe paths.

✅ If you approve

The reviewer will check these four patterns on every pull request, and the WordPress ones on WordPress plugins. It will raise them as findings earlier, with no change to what merges on its own.

_{Proposed by the weekly review learnings from the reviews of the last 90 days. A human merges this; nothing changes until then.}

🤖 AI-generated · claude-sonnet-5-5 (Anthropic) · $0.47884000000000004 for the whole weekly run