Session Handoff [default]: install-tools JSON Report on Develop, Promotion #2254 Ready for Merge

[ptr727]

Next steps, in priority order

Re-read each issue and pull request rather than trusting these summaries.

1. Naming a Tool Other Than the Last Makes install-tools.sh Exit 1 Silently #2256: naming a tool other than the last makes install-tools.sh exit 1 silently. This is a quick win, and it breaks --upgrade node jq, which is one of the script's own --help examples. It also breaks --json <tool> for the HomeAutomation-Config reporter. The cause is a bare cond && action as the last statement of resolve_selection's loop. Done looks like the fix plus a test that names a tool other than the last one. Read the Managed Binaries in /usr/local/bin Under a Minimal PATH in install-tools.sh #2257 (/usr/local/bin missed under a minimal cron PATH) and Hide the Home Directory in install-tools.sh Report Notes as the Windows Script Does #2260 (Linux notes print home paths) are the same script's neighbours. Take them together if the fixes stay small.
2. Deny the Remaining core.hooksPath and no-verify Bypass Routes in the Guard #2177, the guard's remaining hook-bypass routes, carried from Session Handoff [default]: Skills Installer Report Survives a NUL-Byte Path, Released as 2.0.777 #2194. Check the auto-2112 lane's heredoc work first.
3. Settle Which Surface Owns the Skills Refresh Cadence and Which Flag Each Runs #2191: implement the answered cadence decision (option 1). docs/host-setup.md owns the cadence with the full install, skill-lifecycle step 8 points there, and check-this-repo keeps --snapshot-only for its fetched checkout.
4. Decide How the Unattended Picker Recognizes an Adopted Lesson #2183's answer, then Close the Unattended Loop's Parking-Comment and Interrupted-Park Gaps #2184. Both edit the unattended-handoff picker.
5. Small follow-ups: Pair Nonstandard details Markup Correctly When Blanking the Overview Narrative #2187, Emit an Unclosed details Block's Preceding Text Once in details_spans #2186, Decide How the Prose Gate Widens Past the Latin Part of the Recorded-Name Rule #2170 (answered as option 2), Read a Non-Version winget Token as an Unread Installed Version in install-tools.ps1 #2258 (a winget Unknown version token read as installed).
6. Exercise the unattended loop's parked-lane half. An attended resume of a lane parked under blocked has never run.
7. Say the Hub Commits the Report Wherever Done-Means-Audited Is Stated #1826, Carry the code-review skill bootstrap to seven repos whose Copilot reviews never state coverage #1815, and the downstream Fleet Bootstrap resyncs, as Session Handoff [default]: Unattended Picker Narrowed and Overview Label Refusal Fixed, Released as 2.0.776 #2190 describes them.
8. Smaller and older: Copilot Refuses a Pull Request Carrying Only Default-Excluded Files, and No Rule Covers It #2180, Durable Knowledge does not say where a lesson goes when no change is open #1811, audit.py --issue path never prints the no-remote hub-name warning #1810, Skill files hard-wrap while comment-and-doc-style requires one paragraph per line #1814, then the list carried from Session Handoff [default]: WORKFLOW.md Corrections and the pyproject.toml Decision Released as 2.0.672 #1804, in Session Handoff [default]: Unattended Picker Narrowed and Overview Label Refusal Fixed, Released as 2.0.776 #2190's order.

External blockers

• Copilot code review is out until its weekly reset (stated as October 5). Each review now costs more since the default level moved from lite to medium, and the posted body says only "encountered an error". Do not re-request Copilot before the reset. Request Bot PR Reviews Judiciously, and Stop on a Quota or Rate Limit #2261 holds the decision about how the fleet spends Copilot reviews.
• CodeRabbit has used its free OSS reviews. A prompt on Promote develop to main: Fork Handoff Chains, Qodo Login, JSON Report #2254 answered "Review rate limited". Re-prompt with @coderabbitai review once it resets, and read its first comment, since it reports a finished review by editing that comment rather than through the reviews API.
• Promote develop to main: Fork Handoff Chains, Qodo Login, JSON Report #2254 waits on the maintainer's merge, and the release after it on a separate go-ahead, both through merge-and-release.
• A native Windows host is still needed to run install-tools.ps1 -Json for real, and for the bootstrap.ps1 check carried from Session Handoff [default]: WORKFLOW.md Corrections and the pyproject.toml Decision Released as 2.0.672 #1804.

Internal dependencies

• Deny the Remaining core.hooksPath and no-verify Bypass Routes in the Guard #2177 should follow, or absorb, whatever the auto-2112 lane lands on heredoc handling, since both edit the guard's tokenizer path.
• Decide How the Unattended Picker Recognizes an Adopted Lesson #2183 before Close the Unattended Loop's Parking-Comment and Interrupted-Park Gaps #2184, since both edit the unattended-handoff picker.
• Naming a Tool Other Than the Last Makes install-tools.sh Exit 1 Silently #2256 before any further install-tools.sh selection work, since every named-tool run hits it.

State

• Hub: develop is at b52ab3e3, the Give install-tools a JSON Report Mode a Program Can Read #2259 squash, two commits ahead of main (Track Qodo's Open-Source Login and State Its Star Gate #2253 and Give install-tools a JSON Report Mode a Program Can Read #2259). Promotion PR Promote develop to main: Fork Handoff Chains, Qodo Login, JSON Report #2254 has that head, reads CLEAN and MERGEABLE, and its one thread is resolved. The maintainer accepted the two feature PRs' reviews as its coverage, as recorded in a comment on it. No release was dispatched.
• This round's branch feature/install-tools-json-report is merged, and its worktree, local branch, and remote branch are deleted. The primary checkout is on develop. It was clean at session start and has not been pulled since the merge.
• Unattended lanes still open: auto-2176 (Session Handoff [auto-2176]: Qualify D4.7's Pending-Run Gaps on the Dispatched Run Sharing the Concurrency Group per #2176 #2219), auto-2167 (Session Handoff [auto-2167]: Match a Wildcard Row in Copilot's File Table Against the Changed Files per #2167 #2213), auto-2157 (Session Handoff [auto-2157]: Drop the Path Argument From the VS Code Tasks Snippet's Mypy Swaps per #2157 #2211), auto-2080 (Session Handoff [auto-2080]: Read an eval Argument as a Wait-Loop Payload in the Guard per #2080 #2137), and auto-1634 (Session Handoff [auto-1634]: Narrow Nested timeout Handling per #2056 #2072, PR Deny a Signal-0 timeout as a Wait Bound in the Guard #2117). Many auto-* worktrees remain. Re-derive with handoff.py tracks, gh pr list, and git worktree list before touching them.
• Other open lane: Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).
• Another repository touched: none written. Give install-tools.sh a Machine-Readable Report Mode, So a Caller Can Act on It Without Screen-Scraping #1645's comment tells the HomeAutomation-Config peer how to use --json.

The parked decision queue

One issue: #2261, how the fleet spends Copilot reviews under the weekly rate limit. It lists five options and is waiting on the maintainer's own research, so it was not put as a prompt this round.

What the last round did

• Fixed Give install-tools.sh a Machine-Readable Report Mode, So a Caller Can Act on It Without Screen-Scraping #1645 in #2259, merged to develop. install-tools.sh --json and install-tools.ps1 -Json write the report as one ASCII JSON object. tests/test_install_tools.py drives both installers' report functions with host reads stubbed, the PowerShell one through pwsh on Linux. Every guard was mutation-proved.
• Adopted promotion PR Promote develop to main: Fork Handoff Chains, Qodo Login, JSON Report #2254, opened by an earlier session, and added Give install-tools a JSON Report Mode a Program Can Read #2259 and Closes #1645 to it.
• Filed: Naming a Tool Other Than the Last Makes install-tools.sh Exit 1 Silently #2256, Read the Managed Binaries in /usr/local/bin Under a Minimal PATH in install-tools.sh #2257, Read a Non-Version winget Token as an Unread Installed Version in install-tools.ps1 #2258, and Hide the Home Directory in install-tools.sh Report Notes as the Windows Script Does #2260 (pre-existing findings from the local review passes), and Request Bot PR Reviews Judiciously, and Stop on a Quota or Rate Limit #2261 (decision).

What not to repeat

• Six local review passes for one feature. Rounds 1 to 3 each found introduced defects, and rounds 2 and 3 found defects in the previous round's fixes, as the budget rule predicts. The two maintainer escalations past the budget were each answered in seconds. Escalate at the budget rather than reasoning around it.
• iconv -c -f UTF-8 -t UTF-8 is not a UTF-8 validator. glibc passes sequences above U+10FFFF and the old 5- and 6-byte forms. The encoder now decodes UTF-8 in bash itself.
• printf '%d' "'c" on a high byte depends on the libc. musl's C locale returns 0xDF00 plus the byte, which dropped valid characters on the Alpine bash:5.1 image. The encoder masks with & 0xff. Test an encoder on more than one bash and libc.
• A justifying clause I added in a fix round was false. "status and the notes say what is actually installed" was false for a distro jq. Deleting it was the fix.
• A monitor's comment-time cutoff was set after the event. It missed CodeRabbit's "Review rate limited" reply on Promote develop to main: Fork Handoff Chains, Qodo Login, JSON Report #2254, which had arrived three minutes earlier. Use the prompt comment's own timestamp as the cutoff.
• Copilot's "encountered an error" body is not evidence of a structural refusal. This round it was the weekly rate limit, visible only in the Copilot task log.

New learnings

• No new governance lesson. The review-loop behaviour matched local-strict-review's budget rule, which held.
• Copilot's weekly limit and its invisibility to pr_review.py are recorded in Request Bot PR Reviews Judiciously, and Stop on a Quota or Rate Limit #2261.

[ptr727]

Parked decision queue, answered at close: #2261 was answered. The default Copilot review level is back to lite, and the fleet should build a mechanism that requests bot reviews judiciously (Copilot and CodeRabbit both) and stops on a quota or rate-limit refusal. The answer is on #2261, its decision label is off, and it is retitled as implementation work. Rank it with next step 1, since every drive spends bot reviews until it lands. The queue now holds zero issues.

[ptr727]

Continued in #2273, round 41 on track default.