feat(buglog): one Markdown record per bug, checked against a record standard

The buglog was one 27K-line JSON file whose fields covered only symptom,
root cause and fix, as free text: 2% of entries named the code version a
bug was found on, 12% the build profile, 36% a way to reproduce, and 58% of
the file was OpenWolf hook auto-detections ("Missing guard clause",
"Function not marked async" on .md files).

- .claude/skills/buglog/bug-record.md: the record standard. Eight
  sections (Summary as the title, Description, Environment, Reproduction;
  Root cause, Fix, Verification, References once fixed), each with the
  content it must contain -- e.g. Environment needs the OS, the libc the
  failing binary loads (from its ELF interpreter: glibc 2.42 in the nix
  shell vs 2.40 on the host), toolchain, build profile and commit.
- .wolf/bugs/<id>.md: 500 records migrated from buglog.json; every field
  verified to round-trip. They carry legacy: true and an explicit "not
  recorded" where the old log had no such field; component derived from
  file paths, severity from keywords (else unknown), fix_commits from
  hashes in status_note/fix that git resolves (91 of 463 fixed).
- .wolf/buglog-archive.json: the 710 hook auto-detections, verbatim.
- .wolf/buglog.json is now an index generated from the records, keeping
  the fields OpenWolf's hooks and `openwolf bug search` read.
- scripts/buglog.py rewritten: new (template + Environment collected from
  the machine and --binary), check, status (refuses a status the record
  doesn't support; fixed needs Root cause, Fix, Verification and
  --commit hashes git resolves), note, recur, set, show, list, triage,
  env, index. 29 unittest cases in scripts/tests/test_buglog.py.
- scripts/git-hooks/pre-commit runs `check --staged`: incomplete staged
  records, a legacy record hand-changed to fixed without the fix-time
  sections, a new record claiming legacy: true, or a stale index refuse
  the commit.
- scripts/gitea-sync.py reads the records: issue body = the record's
  sections plus linked fix commits (origin remote, GITEA_COMMIT_REPO to
  override), and a body hash so an issue's text is refreshed when the
  record changes.
- bug-1866 rewritten to the full standard as the worked example.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1866.md

@@ -0,0 +1,59 @@
+---
+id: "bug-1866"
+status: "fixed"
+status_updated: "2026-09-27"
+status_note: ""
+component: "worker"
+severity: "leak"
+timestamp: "2026-09-25T15:42:02Z"
+last_seen: "2026-09-25T15:42:02Z"
+occurrences: 1
+files: ["src/worker/src/xcecd_worker_utils.c"]
+tags: ["worker", "leak", "asan"]
+related: []
+fix_commits: ["e84a8d43"]
+gitea_issue: 285
+gitea_synced_status: "fixed"
+---
+
+# bug-1866: xcecd_virtual leaks up to five strings per finished job (LeakSanitizer at exit)
+
+## Description
+**Observed:**
+```
+Direct leak of 12 byte(s) in 12 object(s) allocated from:
+    strndup  add_worker (xcecd_worker_utils.c:140)
+    <- xcecd_process_command <- handle_message_from_queue
+```
+**Expected:** no leaks reported when xcecd_virtual exits.
+**Impact:** one leaked string per job that carries a launch type, plus one per queue/job pre- or post-exec command; grows with the number of finished jobs for the life of the daemon.
+**Found by:** LeakSanitizer at xcecd_virtual exit after a job burst run, 2026-09-25.
+
+## Environment
+- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
+- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: asan (xce.build), leak detection on at process exit
+- Code: scheduler-framework @ d87b78dc
+- Deployment: xcecd_virtual worker; the burst run's cluster topology was not recorded
+
+## Reproduction
+1. Check out d87b78dc and add `test_remove_worker_frees_every_startinfo_copy` from e84a8d43 to `src/worker/testsuite/test_finished_job_retention.c`.
+2. `/xce-build worker`
+3. `ASAN_OPTIONS=detect_leaks=0 src/xce.build/worker/testsuite/finished_job_retention_test`
+- Frequency: deterministic (58 bytes leaked per add/remove round trip)
+- Evidence: the unit test; the original burst-run log was not kept.
+
+## Root cause
+add_worker() strndup()s launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec out of the job's start info, but remove_worker() only freed exechome, execcwd, execuser, job_cmd, pids and job_exdata. LeakSanitizer reported only the launch_type copy because the burst's jobs had no pre/post-exec commands. Pre-existing, origin unknown. remove_worker() is the only place a worker entry is freed, so no other path is affected.
+
+## Fix
+remove_worker() also frees launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec (src/worker/src/xcecd_worker_utils.c).
+
+## Verification
+- Test: test_remove_worker_frees_every_startinfo_copy in src/worker/testsuite/test_finished_job_retention.c compares ASAN's live-heap bytes across an add/remove round trip (the suite runs with detect_leaks=0): RED before the fix leaked 58 B, the five strings; GREEN after, 0 B
+- Suites: worker 12/12, asan
+- Live: n/a; the leak is in a pure unlink/free path the unit test covers completely
+
+## References
+- Gitea: #285