docs: finish ADR 0179 and 0176, audit the ADR 0013 companion, and file #1516

[wshallwshall]

Closes out the ADR record audit. Follow-on to #1003 and #1006, both merged.

The two corrections that needed three attempts each

Neither was rejected for a wrong finding. Both were rejected for a defect introduced by the correction itself, which is the pattern this whole exercise kept surfacing.

ADR 0179 — the record decided _RESOLVE_INTERVAL_S = 5.0; the tree ships 15.0. Attempt 2 was rejected for asserting the constant was born at 15.0 and that this repository never assigns 5.0. That was false, so I settled it before dispatching attempt 3 rather than sending the same disputed question round again:

git log --all --oneline -S "_RESOLVE_INTERVAL_S = 5.0" -- harness/load/connscale/probe.py
  227568a94  re-resolve the FD probe's subtree on TIME, front-loaded (#1357)
  51ead1399  the re-walk interval equalled the walk timeout, so the amortisation was worth zero (#1357)

This clone is shallow (16 grafts), so that instrument was paired with a control on the value that ships, which returned many commits. 5.0 really shipped and was really raised: it equalled _PROBE_TIMEOUT_S, and _resolve_pids stamps _last_walk_at before the walk, so a walk that spent its whole budget was due again the instant it returned — the probe re-walked every tick and the amortisation was worth zero on the one path it bounds.

The sharpest detail is how the record went stale: PR 669 squashed both commits, landing a Decision reading 5.0 beside a probe.py reading 15.0. The record reached main already disagreeing with the code beside it. The amendment says so, keeps both superseded values quoted in place, and fences off the post-fix measurements that were taken at 5.0 so nobody reads them as measured at 15.0.

ADR 0176 — Status and index row both said the engine change was still being built; D1/D2/D3 all ship and BACKLOG #343 is banner-marked SHIPPED 2026-08-26. Attempt 2 was rejected for a splice defect, not a wrong fact: its old_string stopped one clause short, leaving a trailing (NSSM captures it to files) whose nearest antecedent became a dead line anchor — so the corrected sentence said NSSM captures an anchor to files. A new false clause inside a correction about anchor precision. This attempt swallows the parenthetical and rewrites the clause whole, and every edit here carries a recorded splice check: the real text either side of the cut, read as a joined sentence.

The ADR 0013 companion, audited for the first time

0013-increment-2-reingress-design.md is a declared companion — sanctioned by the README, named in its own row. Nothing is wrong with the convention and nothing is renumbered here.

The problem is that two audits over all 172 ADR numbers each graded the primary and never opened it, because a number-keyed enumeration yields one file per number. My own batch list was built by taking each filename's first four characters and deduplicating, which collapsed the two files before any agent read anything. Filed as #1516 (in this PR).

Audited now, in both directions. All six items the companion claims BUILT are built and wired, not mention-only — Stage.RESPONSE with lane-key support across five SQLite sites and the Postgres helper, Loopback() / LoopbackSource registered, reingress_to on six connector factories (wider than the ADR's own Q1 text), and real cross-registry validation. One under-claim found: the Status bullet scopes ingress_handoff to "(Q3/Q8, SQLite + Postgres)" where the tree also has SQL Server. Corrected with a dated amendment.

So the coverage hole cost one narrow under-claim, not a hidden over-claim. Worth knowing before sizing #1516.

Checks

Check	Result
pre-commit, both commits	passed, ledger gate included
open-count control	items 492 to 493, open 303 to 304, closed 189 flat
backlog_status_check.py --quiet	exit 0
link_check.py docs	all relative links resolve
control_char_check.py	clean on all four edited files
ADR 0179 constant vs tree	ADR now says 15.0; probe.py ships 15.0. The two remaining 5.0 mentions are the superseded value quoted inside its own correction, per the append-only rule
ADR 0056 row	0 occurrences in this diff — it belongs to PR 1004
ruff / mypy / pytest	not run — no code changed, docs only

Rebuilt onto current main: #1006 squash-merged mid-run, so its commits are not ancestors and the old branch would have re-proposed merged work.

One process note worth recording

Partway through this run a subagent wrote its edits directly into the working tree rather than returning them as data for review. My tree held 89 lines of unreviewed change that a careless git commit -a would have taken. It was caught because a peer session measured my dirty file and told me. I saved the patch, reverted, and re-applied only the checker-approved edits — which is what landed here.

Giving workflow agents shell access means "return edits as data" is a request, not a constraint.

🤖 Generated with Claude Code

[wshallwshall]

Lander: recording three re-runs, as test_worktree_gate.py asks. Not enqueuing again until someone reads this.

The assertion says it outright, so I am obeying it rather than grinding:

DO NOT read this as a regression in the change under test, and DO NOT rerun until green without recording that you did.

The record

repo harness tests (windows-2025), run 34390302890, three attempts, all PWSH LAUNCH TIMED OUT after 45s (BACKLOG #1304):

attempt	started	failed
1	18:42:36	test_the_program_path_token_survives_the_backslash_separated_spelling
2	19:58:36	(different test)
3	20:28:02	test_a_carried_env_at_an_UNRELATED_repo_allows_from_a_GOVERNED_cwd and test_the_backtick_is_LITERAL_inside_a_SINGLE_quoted_powershell_span

A different test each time, 2 failed against 3589 passed on the last one. That is the flake's signature, not a defect's: a real fault picks the same test.

This PR changes docs/BACKLOG.md and four ADR files. It cannot affect process launch timing.

One thing here refines #1304, and it contradicts that item's own diagnostic

#1304's failure message prints CHILD STDOUT before the kill on the theory that empty stdout separates a startup hang from a script that started and stalled. In this job the child stdout is NOT empty:

CHILD STDOUT before the kill: '{"hookSpecificOutput":{"permissionDecisionReason":"BLOCKED: 'git reset' would change the wo...

So the gate started, ran, and produced its decision -- and then the process did not exit inside 45 seconds. That is a different sub-shape from "never launched", and the diagnostic as written would lead a reader to the wrong one.

Counted in this job's log: 6 banner occurrences, and the non-empty-stdout form appears among them. Worth attaching to #1304, which currently records the rate but not this distinction.

Not re-running again

The rate on this leg is 33 percent measured across all branches including pushes to main, so three in a row is unremarkable and a fourth would tell nobody anything new. The PR is otherwise clean against main with every other check green.

[github-actions]

CI failed while this pull request was in the merge queue, so the queue ejected it.

Its own head can still be green: the queue revalidates the merge, and the path gates that skip on a pull request run there. Read the run before retrying.

https://github.com/MEFORORG/MessageFoundry/actions/runs/34416407434

[wshallwshall]

Evicted from the merge queue by a known flake, and re-enqueued.

The batch pr-1008-3ddd0dad2... failed one job, test (windows-2025, py3.14):

FAILED tests/test_dicom_association_intake_bound.py::test_a_paced_scp_still_establishes_every_association
AssertionError: pacing applied no measurable delay: paced 1.404s vs unpaced 1.538s,
against an expected paced total near 1.33s

That is the DICOM association pacing timing test, measured at roughly 1.2% across the fleet and filed. It compares two wall-clock arms on a shared runner; when the control arm is itself slowed the difference collapses and the assertion reads as "pacing did nothing". Here the unpaced arm came in slower than the paced one.

Why it is not this PR. 1008 changes five files and every one is documentation:

docs/BACKLOG.md
docs/adr/0013-increment-2-reingress-design.md
docs/adr/0176-sandbox-child-stderr-is-captured-and-relayed-content-below-info.md
docs/adr/0179-front-loaded-time-amortised-subtree-re-resolution-in-the-connscale-fd-probe.md
docs/adr/README.md

Nothing under messagefoundry/, tests/, or any transport. The PR checks on f9b868635 pass this same test.

Re-enqueued once. If it evicts again on the same job I will stop and treat it as a real signal rather than keep paying for runs.