diff --git a/.claude/skills/xce-test-ha/SKILL.md b/.claude/skills/xce-test-ha/SKILL.md
index 319b610..b6abc09 100644
--- a/.claude/skills/xce-test-ha/SKILL.md
+++ b/.claude/skills/xce-test-ha/SKILL.md
@@ -108,8 +108,24 @@ XCE_HA_ROUNDS=10 XCE_HA_TOP=/tmp/my-ha-run nix develop ./src --command bash "$SK
    restart the node downed in the *previous* round (so the cluster returns to 3
    members) → wait for a new primary → `verify_no_loss` (expect-job every tracked
    JobId) → submit another batch → `verify_no_loss` again → `walcompare`.
-12. **Verdict** — exits `0` (PASS) only if every round verified zero job loss;
-    any missing job, failed election, or unreachable primary exits non-zero (FAIL).
+   Each elected primary is recorded for the leadership-coverage check.
+11b. **Leadership coverage** — every node must serve as primary at least once.
+   The natural kill loop only ever elects the two highest-priority nodes
+   (`ctrl-1`/`ctrl-2`): the election timeout is **priority-staggered**
+   (`my_priority * election_priority_step_ms` — p0 immediate, p1 +500ms,
+   p2 +1000ms), so the lowest-priority node (`ctrl-3`) never wins while a
+   lower-index node survives alongside it. After the loop, the driver restores
+   3-of-3 and **forces any never-yet-primary node to leadership** via a
+   deterministic, loss-free maneuver that exploits the RequestVote freshness
+   gate (a behind node cannot win): kill the spoiler standby → commit a batch so
+   it falls behind → kill the primary (target holds all commits) → restart the
+   stale spoiler so the freshness-fenced quorum elects the target → verify no
+   loss → reconverge. A node staying behind cannot catch up while there is no
+   primary, so the target wins **deterministically**, not by timing.
+12. **Verdict** — exits `0` (PASS) only if every round verified zero job loss
+    **and all three nodes (`ctrl-1`, `ctrl-2`, `ctrl-3`) acted as primary**;
+    any missing job, failed election, unreachable primary, or a node that never
+    led exits non-zero (FAIL). The PASS line names the nodes that led.
 
 ## Step 3 — Report the result
 
diff --git a/.claude/skills/xce-test-ha/run-ha-soak.sh b/.claude/skills/xce-test-ha/run-ha-soak.sh
index d379774..5e3941d 100755
--- a/.claude/skills/xce-test-ha/run-ha-soak.sh
+++ b/.claude/skills/xce-test-ha/run-ha-soak.sh
@@ -53,13 +53,28 @@ declare -A PORT=( [ctrl-1]=9991 [ctrl-2]=9992 [ctrl-3]=9993 )
 PEERS="ctrl-1=localhost:9991,ctrl-2=localhost:9992,ctrl-3=localhost:9993"
 MASTERS="localhost:9991,localhost:9992,localhost:9993"
 
-ALL_JOBIDS=()   # every JobId we have ever successfully submitted
+ALL_JOBIDS=()           # every JobId we have ever successfully submitted
+declare -A SEEN_PRIMARY  # node name -> 1 once it has served as primary
 
 log()  { echo "[xce-test-ha] $*"; }
 fail() { echo "[xce-test-ha] FAIL: $*" >&2; cleanup; exit 1; }
 
 cleanup() { pkill -9 -x xce_controller 2>/dev/null; sleep 0.3; }
 
+# Record that a node has acted as primary at least once (leadership-coverage
+# tracking — the run asserts all three nodes lead, see the verdict).
+record_primary() { [ -n "$1" ] && SEEN_PRIMARY["$1"]=1; }
+
+# kill -9 a controller by node name. Match on BINARY + --myname so the pattern
+# cannot hit this driver's own shell snapshot (its argv carries "--myname ctrl-N").
+kill_node() {
+    local node="$1" pid
+    pid="$(pgrep -f -- "xce_controller --myname $node ")"
+    [ -n "$pid" ] || return 1
+    kill -9 $pid 2>/dev/null
+    return 0
+}
+
 # ── Preconditions ────────────────────────────────────────────────────────────
 [ -x "$BIN" ] || { echo "[xce-test-ha] FAIL: controller binary missing: $BIN (run /xce-build controller)" >&2; exit 2; }
 [ -x "$XT" ] || { echo "[xce-test-ha] FAIL: xce_test missing: $XT (run /xce-build controller)" >&2; exit 2; }
@@ -285,6 +300,66 @@ walcheck() {
     fi
 }
 
+# Drive a SPECIFIC node to primary — used to exercise leadership on the
+# lowest-priority node (ctrl-3), which the natural single-failover loop NEVER
+# elects: the election timeout is priority-staggered (my_priority * step_ms, p0
+# immediate / p1 +500ms / p2 +1000ms), so whenever ctrl-3 is in the surviving
+# pair a lower-index node out-races it.
+#
+# Mechanism — exploits the RequestVote freshness gate (a behind node cannot win):
+#   precondition: cluster 3-of-3 converged, target T caught up, T not primary.
+#   P = current primary; S = the third node (not P, not T).
+#   1. kill S (a standby) so it stops receiving entries.
+#   2. submit a batch → it commits on {P, T}; S is now provably BEHIND.
+#   3. kill P → only T alive (brief, deliberate no-quorum). T holds EVERY
+#      committed entry (all commits were on {P,T}), so nothing is lost.
+#   4. restart S (still behind — it cannot catch up while there is no primary,
+#      so it stays fenced for the whole election): quorum {T fresh, S stale};
+#      the freshness gate denies S, and T wins DETERMINISTICALLY (not by timing).
+#   5. verify no loss, restart P, reconverge 3-of-3.
+# Fails the run loudly if T does not win.
+force_elect_node() {
+    local T="$1" P S n
+    P="$(discover_primary)"
+    [ -n "$P" ] || { log "force-elect $T: no serving primary"; return 1; }
+    if [ "$P" = "$T" ]; then record_primary "$T"; log "force-elect: $T already primary"; return 0; fi
+    S=""
+    for n in "${NODES[@]}"; do [ "$n" != "$P" ] && [ "$n" != "$T" ] && S="$n"; done
+    [ -n "$S" ] || { log "force-elect $T: could not pick spoiler"; return 1; }
+
+    log "force-elect $T: primary=$P spoiler=$S (freshness-fence $S so $T wins)"
+    local PREV_TERM; PREV_TERM="$(latest_primary_term)"; PREV_TERM="${PREV_TERM:-0}"
+
+    # 1. Kill the spoiler standby so it falls behind.
+    kill_node "$S" || fail "force-elect $T: could not kill spoiler $S"
+    sleep 2
+
+    # 2. Commit a batch on {P,T} — guarantees S is behind and T is caught up.
+    submit_jobs "$NJOBS" || fail "force-elect $T: submit on {$P,$T} failed"
+    verify_no_loss || fail "force-elect $T: loss after spoiler-down submit"
+
+    # 3. Kill the primary. Only T is alive (transient no-quorum); T has all commits.
+    kill_node "$P" || fail "force-elect $T: could not kill primary $P"
+    sleep 2
+
+    # 4. Restart the (behind) spoiler to restore quorum; T must win on freshness.
+    log "force-elect $T: restarting behind-spoiler $S — expecting $T to win"
+    start_node "$S"
+    NEWP="$(wait_for_new_primary "$PREV_TERM")"
+    [ -n "$NEWP" ] || fail "force-elect $T: no new primary after restoring quorum"
+    [ "$NEWP" = "$T" ] || fail "force-elect $T: expected $T to win, got $NEWP (freshness-fence failed)"
+    record_primary "$T"
+    PRIMARY="$(discover_primary)"
+    [ -n "$PRIMARY" ] || fail "force-elect $T: $T elected but client cannot reach it"
+    verify_no_loss || fail "force-elect $T: committed job LOST during maneuver"
+    log "force-elect $T: SUCCESS — $T is primary (term=$(latest_primary_term))"
+
+    # 5. Restart P and reconverge to a healthy 3-of-3.
+    start_node "$P"
+    wait_for_full_convergence || fail "force-elect $T: cluster did not reconverge 3-of-3 after $T led"
+    return 0
+}
+
 # ── Step 2: deploy ───────────────────────────────────────────────────────────
 log "deploying 3-node cluster to $TOP"
 cleanup
@@ -314,6 +389,7 @@ log "waiting for primary election (cold start ~15s)"
 wait_for_primary_log || fail "no primary elected within 45s (check $TOP/logs)"
 PRIMARY="$(discover_primary)"
 [ -n "$PRIMARY" ] || fail "primary elected in logs but client could not reach it"
+record_primary "$PRIMARY"
 log "primary is $PRIMARY"
 
 # ── Step 5: initial submit + verify + waldump ────────────────────────────────
@@ -371,6 +447,7 @@ for round in $(seq 1 "$ROUNDS"); do
     NEWP="$(wait_for_new_primary "$PREV_TERM")"
     [ -n "$NEWP" ] || fail "round $round: no new primary elected after kill (no CTRL_PRIMARY term>$PREV_TERM)"
     log "round $round: new primary elected: $NEWP (term=$(latest_primary_term))"
+    record_primary "$NEWP"
     PRIMARY="$(discover_primary)"
     [ -n "$PRIMARY" ] || fail "round $round: new primary $NEWP elected but client cannot reach it (bug-854 class)"
     verify_no_loss || fail "round $round: a committed job was LOST after failover"
@@ -383,7 +460,35 @@ for round in $(seq 1 "$ROUNDS"); do
     walcheck "$((1 + 2 * ${#ALL_JOBIDS[@]}))"
 done
 
-log "PASS: $ROUNDS rounds, ${#ALL_JOBIDS[@]} jobs submitted, zero job loss"
+# ── Leadership coverage: EVERY node must have served as primary ──────────────
+# The natural single-failover loop only ever elects the two highest-priority
+# nodes (ctrl-1/ctrl-2) — the priority-staggered election timeout means ctrl-3
+# never wins while a lower-index node survives alongside it. Drive any
+# never-yet-primary node to leadership explicitly so all three are exercised.
+# First restore the cluster to 3-of-3 (the loop leaves the last-killed primary
+# down).
+if [ -n "$DOWN" ]; then
+    log "leadership-coverage: restarting $DOWN to restore 3-of-3 before maneuver"
+    start_node "$DOWN"
+    wait_for_full_convergence || fail "leadership-coverage: cluster did not reconverge before maneuver"
+    DOWN=""
+fi
+for n in "${NODES[@]}"; do
+    if [ -z "${SEEN_PRIMARY[$n]:-}" ]; then
+        log "leadership-coverage: $n has never been primary — forcing election"
+        force_elect_node "$n"
+    fi
+done
+
+# Assert all three nodes acted as primary at some point in the run.
+MISSING=""
+for n in "${NODES[@]}"; do
+    [ -z "${SEEN_PRIMARY[$n]:-}" ] && MISSING="$MISSING $n"
+done
+[ -z "$MISSING" ] || fail "not all nodes acted as primary — never led:$MISSING"
+LED="$(printf '%s\n' "${!SEEN_PRIMARY[@]}" | sort | tr '\n' ',' | sed 's/,$//')"
+
+log "PASS: $ROUNDS rounds, ${#ALL_JOBIDS[@]} jobs submitted, zero job loss; all 3 nodes led ($LED)"
 cleanup
 trap - EXIT INT TERM
 exit 0
diff --git a/.wolf/anatomy.md b/.wolf/anatomy.md
index 954ce1c..8c4ec57 100644
--- a/.wolf/anatomy.md
+++ b/.wolf/anatomy.md
@@ -1,10 +1,21 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-06-23T04:47:56.802Z
-> Files: 551 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-06-24T08:33:10.048Z
+> Files: 570 tracked | Anatomy hits: 0 | Misses: 0
+
+## ../../../../../../tmp/xce-ha-verify/
+
+- `test.sh` (~291 tok)
+
+## ../../../../../claude/.claude/plans/
+
+- `piped-mixing-glade.md` — Fix bug-854 (client primary-discovery) and bug-1028 (post-failover availability) (~1921 tok)
+- `task-notification-task-id-bkkk2llpr-tas-zany-locket.md` — XCE HA Failover Soak — Result (~343 tok)
 
 ## ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/
 
+- `project_bug1060_leader_completeness.md` (~538 tok)
+- `project_bug1067_ae_two_terms.md` (~716 tok)
 - `project_raft_commit_safety_done.md` (~603 tok)
 - `project_raft_log_replication_done.md` (~507 tok)
 
@@ -19,6 +30,8 @@
 - `package-lock.json` — npm lock file (~1039 tok)
 - `package.json` — Node.js package manifest (~1 tok)
 - `README.md` — Project documentation (~612 tok)
+- `repro_joblist.sh` — Restart the kept failover-e2e cluster and query joblist via the client to see (~201 tok)
+- `repro854.sh` — Reproduce bug-854 client discovery against the kept failover-e2e cluster. (~422 tok)
 - `uninstall-code-review-graph.sh` — Fully uninstall `code-review-graph` (the Python/uv MCP tool). (~672 tok)
 
 ## .claude/
@@ -203,6 +216,11 @@
 
 - `SKILL.md` — XCE HA Cluster Deployment (~1345 tok)
 
+## .claude/skills/xce-test-ha/
+
+- `run-ha-soak.sh` — run-ha-soak.sh — driver for /xce-test-ha: deploy a 3-node XCE HA cluster, then (~6047 tok)
+- `SKILL.md` — XCE HA Failover Soak Test (~2511 tok)
+
 ## .codegraph/
 
 - `.gitignore` — Git ignore rules (~47 tok)
@@ -764,13 +782,14 @@
 
 ## src/controller/
 
-- `cluster.c` — include "config.h" (~16351 tok)
+- `CLAUDE.md` — XCE Controller (~3309 tok)
+- `cluster.c` — include "config.h" (~16451 tok)
 - `commit.c` — Declares persist_t (~5043 tok)
-- `config_repl.c` — define _GNU_SOURCE (~24927 tok)
-- `config_repl.h` — pragma once (~5622 tok)
+- `config_repl.c` — define _GNU_SOURCE (~25407 tok)
+- `config_repl.h` — pragma once (~6008 tok)
 - `ha_convergence.c` — Declares char (~4868 tok)
-- `ha.c` — define _GNU_SOURCE (~77256 tok)
-- `ha.h` — ifndef HA_H (~21010 tok)
+- `ha.c` — define _GNU_SOURCE (~78897 tok)
+- `ha.h` — ifndef HA_H (~21515 tok)
 - `meson.build` (~1352 tok)
 - `myapp.c` — define _GNU_SOURCE (~4691 tok)
 - `persist.c` — define _GNU_SOURCE (~33172 tok)
@@ -784,21 +803,23 @@
 
 - `clean_failover_preservation.sh` — clean_failover_preservation.sh — ha-term-safety task 5.2 live integration test. (~4972 tok)
 - `controller_test.c` — include <argp.h> (~1623 tok)
+- `test_coldstart_lsn0.c` — Declares char (~4405 tok)
 - `test_commit_barrier_rollout.c` — Declares explicitly (~19506 tok)
-- `test_config_repl.c` — define _GNU_SOURCE (~34816 tok)
+- `test_config_repl.c` — define _GNU_SOURCE (~35905 tok)
 - `test_demotion_convergence.c` — define _GNU_SOURCE (~9602 tok)
 - `test_e2e_capnp.c` — include <stdint.h> (~2760 tok)
-- `test_ha_election.c` — Declares char (~12140 tok)
+- `test_ha_election.c` — Declares char (~12969 tok)
 - `test_ha_prevote.c` — Declares char (~11053 tok)
 - `test_ha_vote_gate.c` — define _GNU_SOURCE (~13251 tok)
+- `test_persist_recovery.c` — define _GNU_SOURCE (~3654 tok)
 - `test_repl_apply.c` — include <dirent.h> (~5744 tok)
 - `test_repl_unit.c` — include <assert.h> (~6231 tok)
-- `test_term_safety_adapter.c` — define _GNU_SOURCE (~25125 tok)
+- `test_term_safety_adapter.c` — define _GNU_SOURCE (~26786 tok)
 - `test_walcompare.c` — define _GNU_SOURCE (~3795 tok)
 - `test.c` — include <argp.h> (~27479 tok)
 - `walcompare.c` — define _GNU_SOURCE (~2485 tok)
 - `walcompare.h` — pragma once (~839 tok)
-- `waldump.c` — define _GNU_SOURCE (~4586 tok)
+- `waldump.c` — define _GNU_SOURCE (~4758 tok)
 - `waldump.h` — pragma once (~1006 tok)
 
 ## src/controller/testsuite/clean_failover_preservation.sh (~330 lines, ~3k tokens)
@@ -806,14 +827,19 @@
 
 ## src/include/
 
+- `netio.h` — if !defined(_NETIO_H_) (~1293 tok)
 - `persist.h` — pragma once (~9539 tok)
 - `repl.h` — pragma once (~2163 tok)
-- `typemap.h` — if !defined(_TYPEMAP_H_) (~4480 tok)
+- `typemap.h` — if !defined(_TYPEMAP_H_) (~4632 tok)
 - `wal_types.h` — pragma once (~1400 tok)
 
 ## src/lib/
 
-- `request.c` — include <errno.h> (~15710 tok)
+- `client.c` — include <errno.h> (~6440 tok)
+- `hook.c` — include <errno.h> (~1197 tok)
+- `netio.c` — include <arpa/inet.h> (~6688 tok)
+- `request.c` — include <errno.h> (~15862 tok)
+- `xcectx.c` — include <errno.h> (~3042 tok)
 
 ## src/lib/raft/
 
@@ -824,8 +850,10 @@
 ## src/lib/testsuite/
 
 - `test_config.c` — include <stdio.h> (~490 tok)
+- `test_hooks.c` — include <errno.h> (~1416 tok)
 - `test_raft.c` — include <errno.h> (~68779 tok)
+- `test_wal_wire.c` — include <errno.h> (~2970 tok)
 
 ## src/schema/
 
-- `controller.capnp` — Declares OPCode (~8927 tok)
+- `controller.capnp` — Declares OPCode (~9156 tok)
diff --git a/.wolf/buglog.json b/.wolf/buglog.json
index 4b1105b..be6cc30 100644
--- a/.wolf/buglog.json
+++ b/.wolf/buglog.json
@@ -7,7 +7,7 @@
       "error_message": "Significant refactor of ",
       "file": "CLAUDE.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 23\u219230 lines (3 removed)",
+      "fix": "Rewrote 23→30 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -39,7 +39,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 14\u219219 lines (2 removed)",
+      "fix": "Rewrote 14→19 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -55,7 +55,7 @@
       "error_message": "Wrong reference: g_tmpdir should be g_instdir",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "Used \"g_tmpdir\" instead of \"g_instdir\"",
-      "fix": "Changed g_tmpdir \u2192 g_instdir",
+      "fix": "Changed g_tmpdir → g_instdir",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -87,7 +87,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/docs/config-replication-design.md",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 17\u219220 lines (7 removed)",
+      "fix": "Rewrote 17→20 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -135,7 +135,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u21929 lines (2 removed)",
+      "fix": "Rewrote 6→9 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -151,7 +151,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 11\u21925 lines (5 removed)",
+      "fix": "Rewrote 11→5 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -167,7 +167,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/docs/config-replication-impl-status.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 10\u219212 lines (4 removed) | Also: | `handle_config_request()` (primary handler) | \u2705 ; | `fetch_config_from_primary()` (standby fetch) |  | Also: | `handle_upgrade_config()` | \u2705 Compiled, gated | ; | `push_config_to_standbys()` | \u26a0 Stub (returns 0)",
+      "fix": "Rewrote 10→12 lines (4 removed) | Also: | `handle_config_request()` (primary handler) | ✅ ; | `fetch_config_from_primary()` (standby fetch) |  | Also: | `handle_upgrade_config()` | ✅ Compiled, gated | ; | `push_config_to_standbys()` | ⚠ Stub (returns 0)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -183,7 +183,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/docs/config-replication-impl-status.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 17\u219221 lines (4 removed)",
+      "fix": "Rewrote 17→21 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -199,7 +199,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u21927 lines (3 removed)",
+      "fix": "Rewrote 6→7 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -215,7 +215,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 13\u219224 lines (6 removed)",
+      "fix": "Rewrote 13→24 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -231,7 +231,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u219210 lines (4 removed)",
+      "fix": "Rewrote 4→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -247,7 +247,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u21929 lines (4 removed)",
+      "fix": "Rewrote 8→9 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -262,7 +262,7 @@
       "timestamp": "2026-05-25T11:05:06.112Z",
       "error_message": "Missing error handling in send",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -278,7 +278,7 @@
       "timestamp": "2026-05-25T11:06:26.871Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -295,7 +295,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 23\u219240 lines (2 removed)",
+      "fix": "Rewrote 23→40 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -326,7 +326,7 @@
       "timestamp": "2026-05-25T11:32:18.221Z",
       "error_message": "Missing error handling in types",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -343,7 +343,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "36 lines replaced/restructured",
-      "fix": "Rewrote 63\u219279 lines (36 removed) | Also: 6. **No simultaneous primaries**: Only one node ca; 7. **Majority-commit WAL replication (CP writes)** | Also: - `handle_request_vote()` handler on all peers; - Config tag + LSN comparison for vote decision",
+      "fix": "Rewrote 63→79 lines (36 removed) | Also: 6. **No simultaneous primaries**: Only one node ca; 7. **Majority-commit WAL replication (CP writes)** | Also: - `handle_request_vote()` handler on all peers; - Config tag + LSN comparison for vote decision",
       "tags": [
         "auto-detected",
         "refactor",
@@ -391,7 +391,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 11\u219228 lines (3 removed)",
+      "fix": "Rewrote 11→28 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -439,7 +439,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 13\u219228 lines (2 removed)",
+      "fix": "Rewrote 13→28 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -471,7 +471,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 17\u219228 lines (11 removed)",
+      "fix": "Rewrote 17→28 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -487,7 +487,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 28\u219245 lines (4 removed)",
+      "fix": "Rewrote 28→45 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -519,7 +519,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "13 lines replaced/restructured",
-      "fix": "Rewrote 22\u219235 lines (13 removed) | Also: **Files**: `src/controller/main.c`, `src/lib/netio; 1. **Peer-count validation in `main.c`** (before `",
+      "fix": "Rewrote 22→35 lines (13 removed) | Also: **Files**: `src/controller/main.c`, `src/lib/netio; 1. **Peer-count validation in `main.c`** (before `",
       "tags": [
         "auto-detected",
         "refactor",
@@ -567,7 +567,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21927 lines (2 removed)",
+      "fix": "Rewrote 4→7 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -583,7 +583,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219211 lines (2 removed)",
+      "fix": "Rewrote 9→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -631,7 +631,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "18 lines replaced/restructured",
-      "fix": "Rewrote 29\u219234 lines (18 removed)",
+      "fix": "Rewrote 29→34 lines (18 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -679,7 +679,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 13\u219229 lines (8 removed) | Also: 8. **Register OP_requestVote handler** in cluster'; switch at line ~195): since vtaskmgr and iomgr run",
+      "fix": "Rewrote 13→29 lines (8 removed) | Also: 8. **Register OP_requestVote handler** in cluster'; switch at line ~195): since vtaskmgr and iomgr run",
       "tags": [
         "auto-detected",
         "refactor",
@@ -695,7 +695,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 13\u219260 lines (9 removed) | Also: 3. **Replace timestamp polling with `EPOLLRDHUP`**; is replaced by an epoll event handler. On `EPOLLRD | Also: - **Split vote recovery**: After failing quorum, s; (using existing `jitter_seed` xorshift64), retry o",
+      "fix": "Rewrote 13→60 lines (9 removed) | Also: 3. **Replace timestamp polling with `EPOLLRDHUP`**; is replaced by an epoll event handler. On `EPOLLRD | Also: - **Split vote recovery**: After failing quorum, s; (using existing `jitter_seed` xorshift64), retry o",
       "tags": [
         "auto-detected",
         "refactor",
@@ -711,7 +711,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 8\u219234 lines (8 removed) | Also: 2. **Replace `ha_check_heartbeat_nocluster()` with; - On `EPOLLRDHUP` from `primary_ctrl_fd`: **close ",
+      "fix": "Rewrote 8→34 lines (8 removed) | Also: 2. **Replace `ha_check_heartbeat_nocluster()` with; - On `EPOLLRDHUP` from `primary_ctrl_fd`: **close ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -726,7 +726,7 @@
       "timestamp": "2026-05-26T13:51:32.274Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: - [ ] `test_heartbeat_carries_committed_lsn`: heartbeat payl; `committed_lsn`; standby updates `ha.last_known_committed_ls",
       "tags": [
         "auto-detected",
@@ -742,7 +742,7 @@
       "timestamp": "2026-05-26T13:52:49.044Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: // Catch-up gate (Clarification 6): behind nodes must not in; if (c->ha.in_catch_up) {",
       "tags": [
         "auto-detected",
@@ -758,7 +758,7 @@
       "timestamp": "2026-05-27T03:02:34.912Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: name, key, applied_lsn, and config_tag immediately after TCP; - [ ] `test_ctrl_hello_registers_standby_in_repl`: handle_ct",
       "tags": [
         "auto-detected",
@@ -774,7 +774,7 @@
       "timestamp": "2026-05-27T03:03:26.016Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -791,7 +791,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 37\u219251 lines (9 removed)",
+      "fix": "Rewrote 37→51 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -807,7 +807,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 8\u219223 lines (8 removed) | Also: - [ ] `test_persistent_conn_single_node_noop`: ha_; when n_peers == 1; primary_ctrl_fd remains -1 (uni",
+      "fix": "Rewrote 8→23 lines (8 removed) | Also: - [ ] `test_persistent_conn_single_node_noop`: ha_; when n_peers == 1; primary_ctrl_fd remains -1 (uni",
       "tags": [
         "auto-detected",
         "refactor",
@@ -823,7 +823,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 34\u219251 lines (10 removed)",
+      "fix": "Rewrote 34→51 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -838,7 +838,7 @@
       "timestamp": "2026-05-27T03:56:41.037Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -855,7 +855,7 @@
       "error_message": "Significant refactor of ",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 21\u219228 lines (11 removed)",
+      "fix": "Rewrote 21→28 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -870,7 +870,7 @@
       "timestamp": "2026-05-27T03:59:16.145Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/plans/prancy-herding-nest.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -887,7 +887,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 10\u219213 lines (2 removed) | Also: **Replace LSF priority election with Raft-style qu; Five focused changes: | Also: 8. **Hard SSL/cert gate**: Controller refuses to b; 9. **Observable via logs**: Election results, vote",
+      "fix": "Rewrote 10→13 lines (2 removed) | Also: **Replace LSF priority election with Raft-style qu; Five focused changes: | Also: 8. **Hard SSL/cert gate**: Controller refuses to b; 9. **Observable via logs**: Election results, vote",
       "tags": [
         "auto-detected",
         "refactor",
@@ -902,7 +902,7 @@
       "timestamp": "2026-05-27T06:45:34.951Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -919,7 +919,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/brief.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219211 lines (2 removed)",
+      "fix": "Rewrote 8→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -967,7 +967,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/schema/controller.capnp",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21927 lines (2 removed)",
+      "fix": "Rewrote 5→7 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -982,7 +982,7 @@
       "timestamp": "2026-05-28T02:55:40.362Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/schema/controller.capnp",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -999,7 +999,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u219240 lines (2 removed)",
+      "fix": "Rewrote 5→40 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1014,7 +1014,7 @@
       "timestamp": "2026-05-28T03:39:14.341Z",
       "error_message": "Missing error handling in struct",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1030,7 +1030,7 @@
       "timestamp": "2026-05-28T03:40:17.891Z",
       "error_message": "Missing error handling in struct",
       "file": "src/include/typemap.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1047,7 +1047,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21926 lines (2 removed)",
+      "fix": "Rewrote 4→6 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1095,7 +1095,7 @@
       "error_message": "Wrong reference: vcpus should be nres",
       "file": "src/include/clusterconfig.h",
       "root_cause": "Used \"vcpus\" instead of \"nres\"",
-      "fix": "Changed vcpus \u2192 nres",
+      "fix": "Changed vcpus → nres",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1111,7 +1111,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 12\u21926 lines (8 removed)",
+      "fix": "Rewrote 12→6 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1143,7 +1143,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_startup.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 12\u219218 lines (8 removed)",
+      "fix": "Rewrote 12→18 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1159,7 +1159,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 109\u2192144 lines (4 removed)",
+      "fix": "Rewrote 109→144 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1206,7 +1206,7 @@
       "timestamp": "2026-05-28T07:13:42.089Z",
       "error_message": "Missing error handling in struct",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1222,7 +1222,7 @@
       "timestamp": "2026-05-28T07:14:03.724Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1255,7 +1255,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "14 lines replaced/restructured",
-      "fix": "Rewrote 92\u2192344 lines (14 removed)",
+      "fix": "Rewrote 92→344 lines (14 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1271,7 +1271,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 25\u219249 lines (6 removed)",
+      "fix": "Rewrote 25→49 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1335,7 +1335,7 @@
       "error_message": "Wrong reference: capn_str_null should be str",
       "file": "src/controller/config_repl.c",
       "root_cause": "Used \"capn_str_null\" instead of \"str\"",
-      "fix": "Changed capn_str_null \u2192 str",
+      "fix": "Changed capn_str_null → str",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1351,7 +1351,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 17\u219284 lines (7 removed)",
+      "fix": "Rewrote 17→84 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1398,7 +1398,7 @@
       "timestamp": "2026-05-28T13:34:49.513Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1415,7 +1415,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/repl.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (3 removed) | Also: /* ACK handling \u2014 call from io_worker read callbac; /* Majority-quorum ACK wait \u2014 stub until task 7.3 ",
+      "fix": "Rewrote 3→4 lines (3 removed) | Also: /* ACK handling — call from io_worker read callbac; /* Majority-quorum ACK wait — stub until task 7.3 ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1430,7 +1430,7 @@
       "timestamp": "2026-05-28T13:52:52.636Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1447,7 +1447,7 @@
       "error_message": "Wrong reference: in_catch_up should be acked_config_lsn",
       "file": "src/controller/repl.c",
       "root_cause": "Used \"in_catch_up\" instead of \"acked_config_lsn\"",
-      "fix": "Changed in_catch_up \u2192 acked_config_lsn",
+      "fix": "Changed in_catch_up → acked_config_lsn",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1479,7 +1479,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 20\u219229 lines (4 removed)",
+      "fix": "Rewrote 20→29 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1495,7 +1495,7 @@
       "error_message": "Wrong reference: ha_state_t should be _Atomic",
       "file": "src/controller/ha.h",
       "root_cause": "Used \"ha_state_t\" instead of \"_Atomic\"",
-      "fix": "Changed ha_state_t \u2192 _Atomic",
+      "fix": "Changed ha_state_t → _Atomic",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1511,7 +1511,7 @@
       "error_message": "Wrong reference: socket should be epoll",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"socket\" instead of \"epoll\"",
-      "fix": "Changed socket \u2192 epoll",
+      "fix": "Changed socket → epoll",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1559,7 +1559,7 @@
       "error_message": "Wrong reference: XCE_ERR_STANDBY should be E_XCE_STANDBY",
       "file": "src/lib/request.c",
       "root_cause": "Used \"XCE_ERR_STANDBY\" instead of \"E_XCE_STANDBY\"",
-      "fix": "Changed XCE_ERR_STANDBY \u2192 E_XCE_STANDBY",
+      "fix": "Changed XCE_ERR_STANDBY → E_XCE_STANDBY",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1575,7 +1575,7 @@
       "error_message": "Wrong reference: XCE_ERR_NOT_READY should be E_XCE_NOT_READY",
       "file": "src/lib/testsuite/test_libxce_retry.c",
       "root_cause": "Used \"XCE_ERR_NOT_READY\" instead of \"E_XCE_NOT_READY\"",
-      "fix": "Changed XCE_ERR_NOT_READY \u2192 E_XCE_NOT_READY",
+      "fix": "Changed XCE_ERR_NOT_READY → E_XCE_NOT_READY",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1590,7 +1590,7 @@
       "timestamp": "2026-05-29T03:27:20.556Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1606,7 +1606,7 @@
       "timestamp": "2026-05-29T03:29:44.753Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/config_repl.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1623,7 +1623,7 @@
       "error_message": "Wrong reference: data should be ctrl_hello_reply_t",
       "file": "src/include/typemap.h",
       "root_cause": "Used \"data\" instead of \"ctrl_hello_reply_t\"",
-      "fix": "Changed data \u2192 ctrl_hello_reply_t",
+      "fix": "Changed data → ctrl_hello_reply_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1638,7 +1638,7 @@
       "timestamp": "2026-05-29T03:53:48.559Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/schema/controller.capnp",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1654,7 +1654,7 @@
       "timestamp": "2026-05-29T03:54:23.205Z",
       "error_message": "Missing error handling in struct",
       "file": "src/include/typemap.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: wal_catchup_entry_t*      walcatchupentrymsg;; snapshot_transfer_t*      snapshottransfermsg; | Also: /* Forward declarations for types defined later in this file; typedef struct snapshot_transfer_t      snapshot_transfer_fw",
       "tags": [
         "auto-detected",
@@ -1671,7 +1671,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21925 lines (2 removed)",
+      "fix": "Rewrote 5→5 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1687,7 +1687,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/schema/controller.capnp",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21923 lines (2 removed)",
+      "fix": "Rewrote 5→3 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1702,7 +1702,7 @@
       "timestamp": "2026-05-29T04:04:12.693Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1719,7 +1719,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 10\u219212 lines (2 removed)",
+      "fix": "Rewrote 10→12 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1751,7 +1751,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 10\u219220 lines (5 removed)",
+      "fix": "Rewrote 10→20 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1783,7 +1783,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/manual-tests.md",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 18\u219220 lines (9 removed)",
+      "fix": "Rewrote 18→20 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1798,7 +1798,7 @@
       "timestamp": "2026-05-29T10:59:37.144Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-config-bootstrap/manual-tests.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1815,7 +1815,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/manual-tests.md",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 20\u219236 lines (10 removed) | Also: ### 11.1 Concurrent Startup (3 nodes); - Result: PASS / FAIL",
+      "fix": "Rewrote 20→36 lines (10 removed) | Also: ### 11.1 Concurrent Startup (3 nodes); - Result: PASS / FAIL",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1831,7 +1831,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 29\u219245 lines (5 removed)",
+      "fix": "Rewrote 29→45 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1847,7 +1847,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_bootstrap.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21928 lines (2 removed)",
+      "fix": "Rewrote 4→8 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1879,7 +1879,7 @@
       "error_message": "Wrong reference: nres should be vcpus",
       "file": "src/include/clusterconfig.h",
       "root_cause": "Used \"nres\" instead of \"vcpus\"",
-      "fix": "Changed nres \u2192 vcpus",
+      "fix": "Changed nres → vcpus",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1895,7 +1895,7 @@
       "error_message": "Wrong reference: data should be request_vote_reply_t",
       "file": "src/include/typemap.h",
       "root_cause": "Used \"data\" instead of \"request_vote_reply_t\"",
-      "fix": "Changed data \u2192 request_vote_reply_t",
+      "fix": "Changed data → request_vote_reply_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1911,7 +1911,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 19\u219225 lines (10 removed)",
+      "fix": "Rewrote 19→25 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1926,7 +1926,7 @@
       "timestamp": "2026-05-29T16:36:41.731Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -1943,7 +1943,7 @@
       "error_message": "Wrong reference: cluster_init_phase2 should be cluster_register_listener",
       "file": "src/controller/include/cluster.h",
       "root_cause": "Used \"cluster_init_phase2\" instead of \"cluster_register_listener\"",
-      "fix": "Changed cluster_init_phase2 \u2192 cluster_register_listener",
+      "fix": "Changed cluster_init_phase2 → cluster_register_listener",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -1975,7 +1975,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "30 lines replaced/restructured",
-      "fix": "Rewrote 79\u219261 lines (30 removed)",
+      "fix": "Rewrote 79→61 lines (30 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -1991,7 +1991,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/xce/cluster_def.h",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 8\u219215 lines (5 removed)",
+      "fix": "Rewrote 8→15 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2007,7 +2007,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219216 lines (4 removed)",
+      "fix": "Rewrote 7→16 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2023,7 +2023,7 @@
       "error_message": "Wrong reference: CTRL_PERF_NHASH should be c",
       "file": "src/controller/cluster.c",
       "root_cause": "Used \"CTRL_PERF_NHASH\" instead of \"c\"",
-      "fix": "Changed CTRL_PERF_NHASH \u2192 c",
+      "fix": "Changed CTRL_PERF_NHASH → c",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -2039,7 +2039,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "36 lines replaced/restructured",
-      "fix": "Rewrote 77\u219241 lines (36 removed)",
+      "fix": "Rewrote 77→41 lines (36 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2055,7 +2055,7 @@
       "error_message": "Wrong reference: true should be false",
       "file": ".claude/skills/xce-build/SKILL.md",
       "root_cause": "Used \"true\" instead of \"false\"",
-      "fix": "Changed true \u2192 false",
+      "fix": "Changed true → false",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -2071,7 +2071,7 @@
       "error_message": "Wrong reference: 120 should be 300",
       "file": "src/controller/meson.build",
       "root_cause": "Used \"120\" instead of \"300\"",
-      "fix": "Changed 120 \u2192 300",
+      "fix": "Changed 120 → 300",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -2086,7 +2086,7 @@
       "timestamp": "2026-05-30T02:37:40.267Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/myapp.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -2103,7 +2103,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 15\u219221 lines (2 removed)",
+      "fix": "Rewrote 15→21 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2119,7 +2119,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219213 lines (2 removed)",
+      "fix": "Rewrote 9→13 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2135,7 +2135,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/election-iomgr-refactor/design.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 10\u219227 lines (3 removed)",
+      "fix": "Rewrote 10→27 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2166,8 +2166,8 @@
       "timestamp": "2026-05-30T06:38:09.325Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/election-iomgr-refactor/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* After election determines role: */; int is_first_boot = !c->running;  /* running=1 only after cl | Also: #### `ha_dispatch_gate` \u2014 CTRL_PRIMARY_COMMITTING case; ```c | Also: ### 3-node startup \u2014 ctrl-a wins (with COMMITTING phase); participant PeerC as ctrl-c endpoint | Also: - **`ha_start_election_async()` is fully non-blocking**: Arm; - *Initial startup* (`ha->phase2_done == 0`): calls `cluster",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* After election determines role: */; int is_first_boot = !c->running;  /* running=1 only after cl | Also: #### `ha_dispatch_gate` — CTRL_PRIMARY_COMMITTING case; ```c | Also: ### 3-node startup — ctrl-a wins (with COMMITTING phase); participant PeerC as ctrl-c endpoint | Also: - **`ha_start_election_async()` is fully non-blocking**: Arm; - *Initial startup* (`ha->phase2_done == 0`): calls `cluster",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -2183,7 +2183,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/election-iomgr-refactor/design.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 19\u219226 lines (4 removed) | Also: \u251c\u2500\u2500 ha.h                 # Add to ha_state_t: clie; \u2502                        #          ha_repl_ack_re | Also: \u2514\u2500\u2500 myapp.c              # Restructured: phase1 + ; #         for(;;) retry loop, cluster_init_phase2,",
+      "fix": "Rewrote 19→26 lines (4 removed) | Also: ├── ha.h                 # Add to ha_state_t: clie; │                        #          ha_repl_ack_re | Also: └── myapp.c              # Restructured: phase1 + ; #         for(;;) retry loop, cluster_init_phase2,",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2199,7 +2199,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/election-iomgr-refactor/design.md",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 15\u219220 lines (12 removed) | Also: - `src/controller/ha.h` \u2014 Add `client_ssl_ctx`, `r; - `src/controller/ha.c` \u2014 Main changes above; `ha_ | Also: \u251c\u2500\u2500 delay.c              # Add delay_task_ms() (ms; \u2502                        # Add delay_task_cancel()",
+      "fix": "Rewrote 15→20 lines (12 removed) | Also: - `src/controller/ha.h` — Add `client_ssl_ctx`, `r; - `src/controller/ha.c` — Main changes above; `ha_ | Also: ├── delay.c              # Add delay_task_ms() (ms; │                        # Add delay_task_cancel()",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2231,7 +2231,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/delay.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 53\u219285 lines (3 removed)",
+      "fix": "Rewrote 53→85 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2247,7 +2247,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u21928 lines (4 removed)",
+      "fix": "Rewrote 7→8 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2327,7 +2327,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 14\u219217 lines (3 removed)",
+      "fix": "Rewrote 14→17 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2359,7 +2359,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_start_election_async.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 24\u219242 lines (8 removed)",
+      "fix": "Rewrote 24→42 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2390,7 +2390,7 @@
       "timestamp": "2026-05-30T11:08:59.808Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -2406,7 +2406,7 @@
       "timestamp": "2026-05-30T11:09:47.905Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -2423,7 +2423,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 62\u2192164 lines (8 removed) | Also: /* Store candidate own tag/lsn in votes[0] for eva; * n_peers==1 \u2192 n_other==0, so votes[] has 0 entrie | Also: * election_timeout_ctx_t: argument for the delay_t; * ha_elect_evaluate_and_signal when the election d",
+      "fix": "Rewrote 62→164 lines (8 removed) | Also: /* Store candidate own tag/lsn in votes[0] for eva; * n_peers==1 → n_other==0, so votes[] has 0 entrie | Also: * election_timeout_ctx_t: argument for the delay_t; * ha_elect_evaluate_and_signal when the election d",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2454,7 +2454,7 @@
       "timestamp": "2026-05-30T11:43:44.829Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* Push config to standbys with lower config_tag (Req 7.1) *; #ifdef XCE_TESTING",
       "tags": [
         "auto-detected",
@@ -2470,7 +2470,7 @@
       "timestamp": "2026-05-30T11:44:15.059Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -2486,7 +2486,7 @@
       "timestamp": "2026-05-30T11:45:24.946Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -2519,7 +2519,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 22\u219232 lines (2 removed)",
+      "fix": "Rewrote 22→32 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2631,7 +2631,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 15\u21925 lines (10 removed)",
+      "fix": "Rewrote 15→5 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2695,7 +2695,7 @@
       "error_message": "Wrong reference: third should be second",
       "file": "src/controller/testsuite/test_ha_repl_ack.c",
       "root_cause": "Used \"third\" instead of \"second\"",
-      "fix": "Changed third \u2192 second",
+      "fix": "Changed third → second",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -2727,7 +2727,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 10\u219215 lines (5 removed)",
+      "fix": "Rewrote 10→15 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2759,7 +2759,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "15 lines replaced/restructured",
-      "fix": "Rewrote 23\u219210 lines (15 removed)",
+      "fix": "Rewrote 23→10 lines (15 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2775,7 +2775,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21929 lines (2 removed)",
+      "fix": "Rewrote 5→9 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2791,7 +2791,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 14\u219216 lines (2 removed)",
+      "fix": "Rewrote 14→16 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2823,7 +2823,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 15\u219220 lines (12 removed)",
+      "fix": "Rewrote 15→20 lines (12 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2839,7 +2839,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21928 lines (2 removed)",
+      "fix": "Rewrote 4→8 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2855,7 +2855,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/xce.build/lib/controller.capnp.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 11\u219219 lines (4 removed) | Also: encode_Data_ptr(cs, &(d->sha256), s->sha256);; encode_Data_ptr(cs, &(d->bytes), s->bytes);",
+      "fix": "Rewrote 11→19 lines (4 removed) | Also: encode_Data_ptr(cs, &(d->sha256), s->sha256);; encode_Data_ptr(cs, &(d->bytes), s->bytes);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2871,7 +2871,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "28 lines replaced/restructured",
-      "fix": "Rewrote 31\u21924 lines (28 removed)",
+      "fix": "Rewrote 31→4 lines (28 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2887,7 +2887,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u219218 lines (4 removed)",
+      "fix": "Rewrote 8→18 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2903,7 +2903,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/request.h",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 10\u219219 lines (4 removed)",
+      "fix": "Rewrote 10→19 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2935,7 +2935,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u219210 lines (2 removed)",
+      "fix": "Rewrote 5→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2951,7 +2951,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219211 lines (2 removed)",
+      "fix": "Rewrote 9→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -2966,7 +2966,7 @@
       "timestamp": "2026-05-31T04:11:45.534Z",
       "error_message": "Missing error handling in struct",
       "file": ".kiro/specs/raft-library/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: Caller->>RaftSM: raft_on_vote_request(state, from, term); alt term < current_term",
       "tags": [
         "auto-detected",
@@ -2983,7 +2983,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/raft-library/design.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 8\u219226 lines (5 removed) | Also: * raft_init: initialize state for a node.; * All required callbacks (except on_trace and on_v | Also: - C standard library only (`stdint.h`, `pthread.h`; - `raft.c` may include `<stdatomic.h>` for lock-fr | Also: | Threading | `pthread_mutex_t` (caller-owned) | P; | Atomics | None in library | Caller uses atomics ",
+      "fix": "Rewrote 8→26 lines (5 removed) | Also: * raft_init: initialize state for a node.; * All required callbacks (except on_trace and on_v | Also: - C standard library only (`stdint.h`, `pthread.h`; - `raft.c` may include `<stdatomic.h>` for lock-fr | Also: | Threading | `pthread_mutex_t` (caller-owned) | P; | Atomics | None in library | Caller uses atomics ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3014,7 +3014,7 @@
       "timestamp": "2026-05-31T04:58:21.609Z",
       "error_message": "Missing error handling in RAFT_H",
       "file": "src/lib/raft/raft.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -3063,7 +3063,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 77\u2192107 lines (8 removed)",
+      "fix": "Rewrote 77→107 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3079,7 +3079,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 9\u219262 lines (5 removed)",
+      "fix": "Rewrote 9→62 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3095,7 +3095,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u219257 lines (4 removed)",
+      "fix": "Rewrote 8→57 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3111,7 +3111,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 15\u219238 lines (4 removed)",
+      "fix": "Rewrote 15→38 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3127,7 +3127,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft_sim.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u21923 lines (2 removed)",
+      "fix": "Rewrote 6→3 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3159,7 +3159,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "32 lines replaced/restructured",
-      "fix": "Rewrote 49\u219216 lines (32 removed)",
+      "fix": "Rewrote 49→16 lines (32 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3174,7 +3174,7 @@
       "timestamp": "2026-05-31T07:26:39.758Z",
       "error_message": "Missing error handling in before",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -3191,7 +3191,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u219219 lines (3 removed) | Also: typedef struct {; ha_state_t     *ha; | Also: /* \u2500\u2500 Type definitions needed by ha_elect_evaluate; *",
+      "fix": "Rewrote 6→19 lines (3 removed) | Also: typedef struct {; ha_state_t     *ha; | Also: /* ── Type definitions needed by ha_elect_evaluate; *",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3207,7 +3207,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "167 lines replaced/restructured",
-      "fix": "Rewrote 291\u2192137 lines (167 removed) | Also: /* Clear voted_for: the old primary is dead; any v; * is stale and must not block the new election. */",
+      "fix": "Rewrote 291→137 lines (167 removed) | Also: /* Clear voted_for: the old primary is dead; any v; * is stale and must not block the new election. */",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3223,7 +3223,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 28\u219268 lines (12 removed)",
+      "fix": "Rewrote 28→68 lines (12 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3239,7 +3239,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 16\u219221 lines (2 removed) | Also: /* Task 6.3: delegate vote reply accumulation to r; * raft_on_vote_reply owns quorum tracking and fire",
+      "fix": "Rewrote 16→21 lines (2 removed) | Also: /* Task 6.3: delegate vote reply accumulation to r; * raft_on_vote_reply owns quorum tracking and fire",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3255,7 +3255,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 10\u21924 lines (7 removed)",
+      "fix": "Rewrote 10→4 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3271,7 +3271,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u219214 lines (2 removed)",
+      "fix": "Rewrote 5→14 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3284,7 +3284,7 @@
     {
       "id": "bug-206",
       "timestamp": "2026-05-31T08:40:00.000Z",
-      "error_message": "test_vote_reply_handler_term_fencing FAIL: Expected 10 Was 3 \u2014 ha->term must be atomically updated to peer term when peer term > ours",
+      "error_message": "test_vote_reply_handler_term_fencing FAIL: Expected 10 Was 3 — ha->term must be atomically updated to peer term when peer term > ours",
       "file": "src/controller/ha.c",
       "root_cause": "vote_reply_msg_handler delegated term fencing entirely to raft_cb_become_follower (via raft_on_vote_reply). In XCE_TESTING builds, vote_reply_dispatch calls xce_vote_reply_hook and returns early, bypassing raft_on_vote_reply and thus never updating ha->term.",
       "fix": "Added explicit CAS loop in vote_reply_msg_handler before vote_reply_dispatch to advance ha->term when vr_term > ha->term. This applies on both the production path and the XCE_TESTING hook path.",
@@ -3306,7 +3306,7 @@
       "error_message": "Wrong reference: test_raft_init_zero_peers_returns_einval should be test_raft_init_even_peers_returns_einval",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "Used \"test_raft_init_zero_peers_returns_einval\" instead of \"test_raft_init_even_peers_returns_einval\"",
-      "fix": "Changed test_raft_init_zero_peers_returns_einval \u2192 test_raft_init_even_peers_returns_einval",
+      "fix": "Changed test_raft_init_zero_peers_returns_einval → test_raft_init_even_peers_returns_einval",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3319,7 +3319,7 @@
     {
       "id": "bug-208",
       "timestamp": "2026-05-31",
-      "error_message": "ASAN LeakSanitizer: detected memory leaks in scheduler testsuite \u2014 build exits with error code",
+      "error_message": "ASAN LeakSanitizer: detected memory leaks in scheduler testsuite — build exits with error code",
       "file": "src/scheduler/testsuite/test.c",
       "root_cause": "sched_meet_host_selection() lazily allocates w->host_eval_ctx via build_host_eval_ctx(). Four test functions (test_meet_host_selection_always_true_passes, test_meet_host_selection_always_false_fails, test_meet_host_selection_numeric_match, test_meet_host_selection_string_match) called zarray_fini() without first calling sched_worker_release_host_ctx() to free the lazily-allocated host_eval_ctx.",
       "fix": "Added sched_worker_release_host_ctx(&w) calls before zarray_fini() in all four affected test functions.",
@@ -3356,7 +3356,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "24 lines replaced/restructured",
-      "fix": "Rewrote 28\u21923 lines (24 removed) | Also: if (my_config_tag == 0) {; INFO(\"ha_start_election_async: no local config (ta",
+      "fix": "Rewrote 28→3 lines (24 removed) | Also: if (my_config_tag == 0) {; INFO(\"ha_start_election_async: no local config (ta",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3372,7 +3372,7 @@
       "error_message": "Wrong reference: 2000 should be 5000",
       "file": "src/controller/ha.h",
       "root_cause": "Used \"2000\" instead of \"5000\"",
-      "fix": "Changed 2000 \u2192 5000",
+      "fix": "Changed 2000 → 5000",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3388,7 +3388,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 15\u219225 lines (3 removed)",
+      "fix": "Rewrote 15→25 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3404,7 +3404,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 10\u219214 lines (8 removed)",
+      "fix": "Rewrote 10→14 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3420,7 +3420,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219217 lines (4 removed) | Also: /* Trigger async config fetch from primary so stan; #ifndef XCE_TESTING | Also: handle_request_vote_reply(vctx->ha, vctx->ctx, vct; /* Fix 5 (HIGH): do NOT free vctx here.",
+      "fix": "Rewrote 7→17 lines (4 removed) | Also: /* Trigger async config fetch from primary so stan; #ifndef XCE_TESTING | Also: handle_request_vote_reply(vctx->ha, vctx->ctx, vct; /* Fix 5 (HIGH): do NOT free vctx here.",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3467,7 +3467,7 @@
       "timestamp": "2026-05-31T12:54:26.372Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -3484,7 +3484,7 @@
       "error_message": "Wrong reference: Request_body_nodata should be Request_body_nomsg",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"Request_body_nodata\" instead of \"Request_body_nomsg\"",
-      "fix": "Changed Request_body_nodata \u2192 Request_body_nomsg",
+      "fix": "Changed Request_body_nodata → Request_body_nomsg",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3500,7 +3500,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 10\u219218 lines (4 removed)",
+      "fix": "Rewrote 10→18 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3516,7 +3516,7 @@
       "error_message": "Wrong reference: vote_reply_msg_handler should be vote_reply_msg_handler_for_test",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"vote_reply_msg_handler\" instead of \"vote_reply_msg_handler_for_test\"",
-      "fix": "Changed vote_reply_msg_handler \u2192 vote_reply_msg_handler_for_test",
+      "fix": "Changed vote_reply_msg_handler → vote_reply_msg_handler_for_test",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3532,7 +3532,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 13\u219236 lines (3 removed)",
+      "fix": "Rewrote 13→36 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3548,7 +3548,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "20 lines replaced/restructured",
-      "fix": "Rewrote 36\u219213 lines (20 removed)",
+      "fix": "Rewrote 36→13 lines (20 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3563,7 +3563,7 @@
       "timestamp": "2026-06-01T01:49:30.537Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -3596,7 +3596,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "42 lines replaced/restructured",
-      "fix": "Rewrote 64\u219219 lines (42 removed)",
+      "fix": "Rewrote 64→19 lines (42 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3611,7 +3611,7 @@
       "timestamp": "2026-06-01T02:27:55.942Z",
       "error_message": "Missing error handling in struct",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -3628,7 +3628,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 10\u219214 lines (5 removed)",
+      "fix": "Rewrote 10→14 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3644,7 +3644,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/CLAUDE.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 5\u219215 lines (5 removed)",
+      "fix": "Rewrote 5→15 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3660,7 +3660,7 @@
       "error_message": "Wrong operator: && should be !=",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"&&\" instead of \"!=\"",
-      "fix": "Changed operator && \u2192 !=",
+      "fix": "Changed operator && → !=",
       "tags": [
         "auto-detected",
         "operator-fix",
@@ -3676,7 +3676,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 16\u21927 lines (10 removed)",
+      "fix": "Rewrote 16→7 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3692,7 +3692,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "140 lines replaced/restructured",
-      "fix": "Rewrote 173\u219211 lines (140 removed)",
+      "fix": "Rewrote 173→11 lines (140 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3708,7 +3708,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "16 lines replaced/restructured",
-      "fix": "Rewrote 25\u219212 lines (16 removed)",
+      "fix": "Rewrote 25→12 lines (16 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3740,7 +3740,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 31\u219237 lines (2 removed)",
+      "fix": "Rewrote 31→37 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3788,7 +3788,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "21 lines replaced/restructured",
-      "fix": "Rewrote 28\u21925 lines (21 removed)",
+      "fix": "Rewrote 28→5 lines (21 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3852,7 +3852,7 @@
       "error_message": "Wrong reference: test_ha_connect should be test_ha_ctrlhello",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_ha_connect\" instead of \"test_ha_ctrlhello\"",
-      "fix": "Changed test_ha_connect \u2192 test_ha_ctrlhello",
+      "fix": "Changed test_ha_connect → test_ha_ctrlhello",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3868,7 +3868,7 @@
       "error_message": "Wrong reference: vcpu should be vcpus",
       "file": "src/tools/deploy-ha.sh",
       "root_cause": "Used \"vcpu\" instead of \"vcpus\"",
-      "fix": "Changed vcpu \u2192 vcpus",
+      "fix": "Changed vcpu → vcpus",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -3884,7 +3884,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 10\u21926 lines (10 removed)",
+      "fix": "Rewrote 10→6 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3900,7 +3900,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 7\u219222 lines (2 removed)",
+      "fix": "Rewrote 7→22 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3916,7 +3916,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 5\u219210 lines (3 removed)",
+      "fix": "Rewrote 5→10 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3932,7 +3932,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/request.c",
       "root_cause": "32 lines replaced/restructured",
-      "fix": "Rewrote 49\u219260 lines (32 removed)",
+      "fix": "Rewrote 49→60 lines (32 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3948,7 +3948,7 @@
       "error_message": "Significant refactor of ",
       "file": ".claude/skills/xce-deploy-ha/SKILL.md",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 17\u219232 lines (7 removed)",
+      "fix": "Rewrote 17→32 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3964,7 +3964,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/CLAUDE.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u21929 lines (3 removed)",
+      "fix": "Rewrote 6→9 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -3979,7 +3979,7 @@
       "timestamp": "2026-06-01T07:28:15.703Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_connection_reuse.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4012,7 +4012,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_connection_reuse.c",
       "root_cause": "19 lines replaced/restructured",
-      "fix": "Rewrote 67\u219286 lines (19 removed)",
+      "fix": "Rewrote 67→86 lines (19 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4044,7 +4044,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-heartbeat-liveness/requirements.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 10\u219217 lines (5 removed)",
+      "fix": "Rewrote 10→17 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4060,7 +4060,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u219210 lines (2 removed)",
+      "fix": "Rewrote 6→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4092,7 +4092,7 @@
       "error_message": "Wrong reference: startup_validation should be testsuite_test_ha_liveness",
       "file": "src/xce.build/build.ninja",
       "root_cause": "Used \"startup_validation\" instead of \"testsuite_test_ha_liveness\"",
-      "fix": "Changed startup_validation \u2192 testsuite_test_ha_liveness",
+      "fix": "Changed startup_validation → testsuite_test_ha_liveness",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -4108,7 +4108,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "76 lines replaced/restructured",
-      "fix": "Rewrote 112\u2192155 lines (76 removed)",
+      "fix": "Rewrote 112→155 lines (76 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4124,7 +4124,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_liveness.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 21\u219224 lines (5 removed)",
+      "fix": "Rewrote 21→24 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4140,7 +4140,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_failover.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 29\u219247 lines (7 removed)",
+      "fix": "Rewrote 29→47 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4172,7 +4172,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "22 lines replaced/restructured",
-      "fix": "Rewrote 53\u219221 lines (22 removed)",
+      "fix": "Rewrote 53→21 lines (22 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4188,7 +4188,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219210 lines (2 removed)",
+      "fix": "Rewrote 8→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4219,7 +4219,7 @@
       "timestamp": "2026-06-03T05:20:44.299Z",
       "error_message": "Missing error handling in lives",
       "file": ".kiro/specs/ha-config-bootstrap/research.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4268,7 +4268,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 14\u21923 lines (11 removed)",
+      "fix": "Rewrote 14→3 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4284,7 +4284,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "79 lines replaced/restructured",
-      "fix": "Rewrote 87\u21923 lines (79 removed)",
+      "fix": "Rewrote 87→3 lines (79 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4300,7 +4300,7 @@
       "error_message": "Wrong reference: test_am_i_primary should be test_ha_cluster",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_am_i_primary\" instead of \"test_ha_cluster\"",
-      "fix": "Changed test_am_i_primary \u2192 test_ha_cluster",
+      "fix": "Changed test_am_i_primary → test_ha_cluster",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -4316,7 +4316,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 10\u21923 lines (8 removed)",
+      "fix": "Rewrote 10→3 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4332,7 +4332,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "21 lines replaced/restructured",
-      "fix": "Rewrote 26\u21924 lines (21 removed) | Also: /* ha_check_heartbeat_nocluster() removed from the; * ha_watchdog_thread().  XCE_TESTING shim preserve",
+      "fix": "Rewrote 26→4 lines (21 removed) | Also: /* ha_check_heartbeat_nocluster() removed from the; * ha_watchdog_thread().  XCE_TESTING shim preserve",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4348,7 +4348,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "63 lines replaced/restructured",
-      "fix": "Rewrote 68\u21924 lines (63 removed) | Also: /* SIGUSR1 must set failover_requested via async-s; static void test_sigusr1_sets_failover_requested(v | Also: RUN_TEST(test_watchdog_starts_and_stops);; RUN_TEST(test_heartbeat_no_action_when_no_primary)",
+      "fix": "Rewrote 68→4 lines (63 removed) | Also: /* SIGUSR1 must set failover_requested via async-s; static void test_sigusr1_sets_failover_requested(v | Also: RUN_TEST(test_watchdog_starts_and_stops);; RUN_TEST(test_heartbeat_no_action_when_no_primary)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4364,7 +4364,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/manual-tests.md",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 8\u21928 lines (6 removed) | Also: **Expected within 1 second on both standbys:**; **Expected on the winner (needs 1 vote from the ot | Also: defer_config_fetch=1; Config fetch successful from primary (tag=...) | Also: Date:; Commit: (run: cd /home/rshen/projects/xce/worktree",
+      "fix": "Rewrote 8→8 lines (6 removed) | Also: **Expected within 1 second on both standbys:**; **Expected on the winner (needs 1 vote from the ot | Also: defer_config_fetch=1; Config fetch successful from primary (tag=...) | Also: Date:; Commit: (run: cd /home/rshen/projects/xce/worktree",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4380,7 +4380,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-config-bootstrap/manual-tests.md",
       "root_cause": "95 lines replaced/restructured",
-      "fix": "Rewrote 158\u219265 lines (95 removed) | Also: - [ ] `ha-term.bin` file exists after election; - [ ] Magic bytes are `0xDEADBEEFCAFEBABE` (little",
+      "fix": "Rewrote 158→65 lines (95 removed) | Also: - [ ] `ha-term.bin` file exists after election; - [ ] Magic bytes are `0xDEADBEEFCAFEBABE` (little",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4396,7 +4396,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 45\u219262 lines (6 removed)",
+      "fix": "Rewrote 45→62 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4411,7 +4411,7 @@
       "timestamp": "2026-06-04T00:24:46.380Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/myapp.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4428,7 +4428,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/CLAUDE.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 5\u21927 lines (4 removed)",
+      "fix": "Rewrote 5→7 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4443,7 +4443,7 @@
       "timestamp": "2026-06-04T09:46:14.610Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-repl-hardening/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4476,7 +4476,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/schema/controller.capnp",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 4\u21924 lines (3 removed)",
+      "fix": "Rewrote 4→4 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4492,7 +4492,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 5\u21927 lines (4 removed)",
+      "fix": "Rewrote 5→7 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4508,7 +4508,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/schema/controller.capnp",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u219213 lines (2 removed)",
+      "fix": "Rewrote 4→13 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4524,7 +4524,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21928 lines (2 removed)",
+      "fix": "Rewrote 4→8 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4539,8 +4539,8 @@
       "timestamp": "2026-06-04T14:33:03.464Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* \u2500\u2500 Task 2.1: OPCode_walCatchupEntry handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500; #ifdef XCE_TESTING | Also: /* Task 2.1: OPCode_walCatchupEntry handler */; RUN_TEST(test_wal_catchup_entry_advances_applied_lsn);",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* ── Task 2.1: OPCode_walCatchupEntry handler ─────────────; #ifdef XCE_TESTING | Also: /* Task 2.1: OPCode_walCatchupEntry handler */; RUN_TEST(test_wal_catchup_entry_advances_applied_lsn);",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -4555,7 +4555,7 @@
       "timestamp": "2026-06-04T14:41:35.073Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: case OPCode_walCatchupEntry:; /* Task 2.1: standby applies a single WAL catch-up entry fro",
       "tags": [
         "auto-detected",
@@ -4572,7 +4572,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "57 lines replaced/restructured",
-      "fix": "Rewrote 82\u219216 lines (57 removed)",
+      "fix": "Rewrote 82→16 lines (57 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4587,7 +4587,7 @@
       "timestamp": "2026-06-04T14:45:42.730Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4603,7 +4603,7 @@
       "timestamp": "2026-06-04T14:46:44.652Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: #include \"persist.h\"      /* persist_t, apply_wal_entry */; #include \"typemap.h\"      /* wal_catchup_entry_t */",
       "tags": [
         "auto-detected",
@@ -4619,7 +4619,7 @@
       "timestamp": "2026-06-04T15:09:54.280Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4636,7 +4636,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "22 lines replaced/restructured",
-      "fix": "Rewrote 58\u2192114 lines (22 removed)",
+      "fix": "Rewrote 58→114 lines (22 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4652,7 +4652,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 10\u219215 lines (3 removed)",
+      "fix": "Rewrote 10→15 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4684,7 +4684,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 44\u219289 lines (4 removed) | Also: /* Decode stateReport and call convergence tracker; memset(&sr, 0, sizeof(sr));",
+      "fix": "Rewrote 44→89 lines (4 removed) | Also: /* Decode stateReport and call convergence tracker; memset(&sr, 0, sizeof(sr));",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4732,7 +4732,7 @@
       "error_message": "Wrong reference: test_evaluate_repl_action_stream_wal_from_zero should be test_evaluate_repl_action_send_snapshot_lsn_zero",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "Used \"test_evaluate_repl_action_stream_wal_from_zero\" instead of \"test_evaluate_repl_action_send_snapshot_lsn_zero\"",
-      "fix": "Changed test_evaluate_repl_action_stream_wal_from_zero \u2192 test_evaluate_repl_action_send_snapshot_lsn_zero",
+      "fix": "Changed test_evaluate_repl_action_stream_wal_from_zero → test_evaluate_repl_action_send_snapshot_lsn_zero",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -4763,7 +4763,7 @@
       "timestamp": "2026-06-04T17:34:23.150Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4780,7 +4780,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 71\u219293 lines (4 removed)",
+      "fix": "Rewrote 71→93 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4795,7 +4795,7 @@
       "timestamp": "2026-06-04T17:40:05.798Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4844,7 +4844,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u219215 lines (2 removed)",
+      "fix": "Rewrote 6→15 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4859,7 +4859,7 @@
       "timestamp": "2026-06-04T23:21:45.737Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -4876,7 +4876,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219212 lines (2 removed)",
+      "fix": "Rewrote 9→12 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4892,7 +4892,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-repl-hardening/tasks.md",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 9\u219235 lines (9 removed)",
+      "fix": "Rewrote 9→35 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4908,7 +4908,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219210 lines (4 removed) | Also: /* Task 3.5: snapshot transfer.; * Creates a checkpoint in the delaymgr thread (not",
+      "fix": "Rewrote 7→10 lines (4 removed) | Also: /* Task 3.5: snapshot transfer.; * Creates a checkpoint in the delaymgr thread (not",
       "tags": [
         "auto-detected",
         "refactor",
@@ -4988,7 +4988,7 @@
       "error_message": "Wrong reference: uintptr_t should be void",
       "file": "src/controller/testsuite/test_ha_evaluate_committing.c",
       "root_cause": "Used \"uintptr_t\" instead of \"void\"",
-      "fix": "Changed uintptr_t \u2192 void",
+      "fix": "Changed uintptr_t → void",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5004,7 +5004,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "149 lines replaced/restructured",
-      "fix": "Rewrote 207\u219238 lines (149 removed)",
+      "fix": "Rewrote 207→38 lines (149 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5036,7 +5036,7 @@
       "error_message": "Wrong reference: 10000 should be 60000",
       "file": "src/controller/ha.h",
       "root_cause": "Used \"10000\" instead of \"60000\"",
-      "fix": "Changed 10000 \u2192 60000",
+      "fix": "Changed 10000 → 60000",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5052,7 +5052,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 24\u219242 lines (5 removed)",
+      "fix": "Rewrote 24→42 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5068,7 +5068,7 @@
       "error_message": "Wrong reference: 10000 should be HA_DEFAULT_COMMITTING_TIMEOUT_MS",
       "file": "src/controller/testsuite/test_ha_evaluate_committing.c",
       "root_cause": "Used \"10000\" instead of \"HA_DEFAULT_COMMITTING_TIMEOUT_MS\"",
-      "fix": "Changed 10000 \u2192 HA_DEFAULT_COMMITTING_TIMEOUT_MS",
+      "fix": "Changed 10000 → HA_DEFAULT_COMMITTING_TIMEOUT_MS",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5083,7 +5083,7 @@
       "timestamp": "2026-06-05T05:10:13.646Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5099,7 +5099,7 @@
       "timestamp": "2026-06-05T05:39:48.707Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5115,7 +5115,7 @@
       "timestamp": "2026-06-05T06:50:00Z",
       "error_message": "3-node startup: majority convergence never fires; cluster falls through to committing_timeout degraded-mode WARN",
       "file": "src/controller/ha.c",
-      "root_cause": "ha->n_peers was set to candidates_count (3, total including self) in ha_start_election_async. ha_check_majority_convergence loops i=0..n_peers-1 checking standby_converged[], but standby_converged[] is indexed by votes_idx (relative, self excluded: 0..n_other-1). With n_peers=3, it checked standby_converged[2] which is never set, so n_converged (2) < n_peers (3) always \u2014 majority convergence path could never succeed.",
+      "root_cause": "ha->n_peers was set to candidates_count (3, total including self) in ha_start_election_async. ha_check_majority_convergence loops i=0..n_peers-1 checking standby_converged[], but standby_converged[] is indexed by votes_idx (relative, self excluded: 0..n_other-1). With n_peers=3, it checked standby_converged[2] which is never set, so n_converged (2) < n_peers (3) always — majority convergence path could never succeed.",
       "fix": "Changed ha->n_peers = n_peers to ha->n_peers = n_other (= n_peers-1 = other-node count). Moved the assignment after n_other is computed. ha_repl_ack_received quorum formula (ha->n_peers+2)/2 still yields correct majority for both old and new value.",
       "tags": [
         "ha",
@@ -5134,7 +5134,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 7\u219212 lines (2 removed) | Also: /* Disarm any existing poll ctx */; free(old);",
+      "fix": "Rewrote 7→12 lines (2 removed) | Also: /* Disarm any existing poll ctx */; free(old);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5149,7 +5149,7 @@
       "timestamp": "2026-06-05T07:23:00.000Z",
       "error_message": "AddressSanitizer: attempting double-free on sctx in ha_connect_to_peer",
       "file": "src/controller/ha.c",
-      "root_cause": "endpoint_fini calls FREEUP(ep->data) which frees sctx, then ha_connect_to_peer also calls free(sctx) \u2014 double-free at lines 3594-3595 and 3600-3601",
+      "root_cause": "endpoint_fini calls FREEUP(ep->data) which frees sctx, then ha_connect_to_peer also calls free(sctx) — double-free at lines 3594-3595 and 3600-3601",
       "fix": "Set ep->data = NULL before endpoint_fini so FREEUP becomes a no-op; then free(sctx) explicitly in the error paths",
       "tags": [
         "double-free",
@@ -5165,7 +5165,7 @@
     {
       "id": "bug-007",
       "timestamp": "2026-06-05T07:23:00.000Z",
-      "error_message": "AddressSanitizer: heap-use-after-free in liveness_poll_fn at ha.c:3293 \u2014 reading ctx->cancelled after ha_arm_heartbeat_timeout_vtask freed the old ctx",
+      "error_message": "AddressSanitizer: heap-use-after-free in liveness_poll_fn at ha.c:3293 — reading ctx->cancelled after ha_arm_heartbeat_timeout_vtask freed the old ctx",
       "file": "src/controller/ha.c",
       "root_cause": "ha_arm_heartbeat_timeout_vtask freed the old liveness_poll_ctx_t immediately after setting cancelled=1, but the delaymgr task was already in flight reading ctx->cancelled=0 and then continued to read ctx->ha after free",
       "fix": "ha_arm_heartbeat_timeout_vtask no longer frees old ctx; liveness_poll_fn now frees ctx when it fires with cancelled=1 (guarded by #ifndef XCE_TESTING to avoid bad-free on stack-allocated test ctxs)",
@@ -5187,7 +5187,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 41\u219287 lines (2 removed)",
+      "fix": "Rewrote 41→87 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5203,7 +5203,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 8\u21925 lines (6 removed)",
+      "fix": "Rewrote 8→5 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5219,7 +5219,7 @@
       "error_message": "Wrong reference: DEBUG2 should be INFO",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"DEBUG2\" instead of \"INFO\"",
-      "fix": "Changed DEBUG2 \u2192 INFO",
+      "fix": "Changed DEBUG2 → INFO",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5283,7 +5283,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/docs/cluster-config-split-analysis.md",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 11\u219221 lines (8 removed) | Also: ### Phase 1: Schema split (wire-compatible); 4. **Keep the old `ClusterConfig` fields intact** ",
+      "fix": "Rewrote 11→21 lines (8 removed) | Also: ### Phase 1: Schema split (wire-compatible); 4. **Keep the old `ClusterConfig` fields intact** ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5299,7 +5299,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 27\u219236 lines (5 removed)",
+      "fix": "Rewrote 27→36 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5315,7 +5315,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 9\u219215 lines (4 removed)",
+      "fix": "Rewrote 9→15 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5331,7 +5331,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "37 lines replaced/restructured",
-      "fix": "Rewrote 41\u21924 lines (37 removed)",
+      "fix": "Rewrote 41→4 lines (37 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5471,7 +5471,7 @@
       "error_message": "Wrong reference: last_heartbeat should be voted_for_term",
       "file": "src/controller/ha.h",
       "root_cause": "Used \"last_heartbeat\" instead of \"voted_for_term\"",
-      "fix": "Changed last_heartbeat \u2192 voted_for_term",
+      "fix": "Changed last_heartbeat → voted_for_term",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5487,7 +5487,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 13\u219217 lines (4 removed)",
+      "fix": "Rewrote 13→17 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5538,7 +5538,7 @@
       "timestamp": "2026-06-10T01:36:59.112Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/schema/controller.capnp",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5554,7 +5554,7 @@
       "timestamp": "2026-06-10T01:37:29.771Z",
       "error_message": "Missing error handling in struct",
       "file": "src/include/typemap.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5571,7 +5571,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/typemap.h",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 16\u219231 lines (6 removed)",
+      "fix": "Rewrote 16→31 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5586,7 +5586,7 @@
       "timestamp": "2026-06-10T01:38:31.262Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/include/request.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5618,7 +5618,7 @@
       "timestamp": "2026-06-10T01:39:31.683Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/request.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: if (req->body_which == Request_body_walcatchupentrymsg; && req->body.walcatchupentrymsg != NULL) { | Also: /* wal_entry_to_wire: fill a wire WalCatchupEntry from a C e; * fields and raw payload bytes.  Sub-entry nesting is one le",
       "tags": [
         "auto-detected",
@@ -5653,7 +5653,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 29\u219232 lines (4 removed)",
+      "fix": "Rewrote 29→32 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5669,7 +5669,7 @@
       "error_message": "Wrong reference: payload should be raw_payload",
       "file": "src/controller/config_repl.c",
       "root_cause": "Used \"payload\" instead of \"raw_payload\"",
-      "fix": "Changed payload \u2192 raw_payload",
+      "fix": "Changed payload → raw_payload",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5685,7 +5685,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 13\u219216 lines (2 removed)",
+      "fix": "Rewrote 13→16 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5701,7 +5701,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 49\u2192137 lines (7 removed)",
+      "fix": "Rewrote 49→137 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5716,7 +5716,7 @@
       "timestamp": "2026-06-10T01:49:36.997Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5785,7 +5785,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/scheduler/src/scheduler.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u21926 lines (4 removed)",
+      "fix": "Rewrote 4→6 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5838,7 +5838,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 9\u219215 lines (4 removed)",
+      "fix": "Rewrote 9→15 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5870,7 +5870,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 8\u219213 lines (3 removed) | Also: /* Req 4.1: ctrlhello counts as primary activity \u2014; if ((ctrl_role_t)atomic_load_explicit(&c->ha.role,",
+      "fix": "Rewrote 8→13 lines (3 removed) | Also: /* Req 4.1: ctrlhello counts as primary activity —; if ((ctrl_role_t)atomic_load_explicit(&c->ha.role,",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5886,7 +5886,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u219212 lines (3 removed)",
+      "fix": "Rewrote 6→12 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5901,7 +5901,7 @@
       "timestamp": "2026-06-10T07:56:21.347Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_repl_unit.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* =========================================================; * Task 1.1: repl_broadcast send path tests",
       "tags": [
         "auto-detected",
@@ -5918,7 +5918,7 @@
       "error_message": "Wrong reference: WAL_JOB should be WAL_JOB_SUBMIT",
       "file": "src/controller/testsuite/test_repl_unit.c",
       "root_cause": "Used \"WAL_JOB\" instead of \"WAL_JOB_SUBMIT\"",
-      "fix": "Changed WAL_JOB \u2192 WAL_JOB_SUBMIT",
+      "fix": "Changed WAL_JOB → WAL_JOB_SUBMIT",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5933,7 +5933,7 @@
       "timestamp": "2026-06-10T07:58:15.167Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -5950,7 +5950,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/repl.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 42\u219265 lines (3 removed)",
+      "fix": "Rewrote 42→65 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5966,7 +5966,7 @@
       "error_message": "Wrong reference: DEBUG3 should be TRACE",
       "file": "src/controller/repl.c",
       "root_cause": "Used \"DEBUG3\" instead of \"TRACE\"",
-      "fix": "Changed DEBUG3 \u2192 TRACE",
+      "fix": "Changed DEBUG3 → TRACE",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -5982,7 +5982,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 12\u219216 lines (3 removed)",
+      "fix": "Rewrote 12→16 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -5998,7 +5998,7 @@
       "error_message": "Wrong reference: request should be ep",
       "file": "src/controller/cluster.c",
       "root_cause": "Used \"request\" instead of \"ep\"",
-      "fix": "Changed request \u2192 ep",
+      "fix": "Changed request → ep",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -6013,7 +6013,7 @@
       "timestamp": "2026-06-10T08:47:48.296Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_role.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* Task 3.3 (ha-wal-replication): dispatch gate standby-role; RUN_TEST(test_dispatch_gate_allows_wal_catchup_in_standby_ro",
       "tags": [
         "auto-detected",
@@ -6029,7 +6029,7 @@
       "timestamp": "2026-06-10T08:50:27.397Z",
       "error_message": "Missing error handling in struct",
       "file": "src/include/typemap.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6061,7 +6061,7 @@
       "timestamp": "2026-06-10T09:59:08.979Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_p2_integration.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6096,7 +6096,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_p2_integration.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 50\u219272 lines (4 removed)",
+      "fix": "Rewrote 50→72 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6112,7 +6112,7 @@
       "error_message": "Wrong reference: test_catchup_full_lifecycle_integration should be test_single_node_committed_lsn_unchanged",
       "file": "src/controller/testsuite/test_p2_integration.c",
       "root_cause": "Used \"test_catchup_full_lifecycle_integration\" instead of \"test_single_node_committed_lsn_unchanged\"",
-      "fix": "Changed test_catchup_full_lifecycle_integration \u2192 test_single_node_committed_lsn_unchanged",
+      "fix": "Changed test_catchup_full_lifecycle_integration → test_single_node_committed_lsn_unchanged",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -6127,7 +6127,7 @@
       "timestamp": "2026-06-10T10:37:49.028Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_repl_unit.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6160,7 +6160,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/steering/product.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 13\u219222 lines (5 removed)",
+      "fix": "Rewrote 13→22 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6192,7 +6192,7 @@
       "error_message": "Significant refactor of ",
       "file": "CLAUDE.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 5\u21925 lines (4 removed)",
+      "fix": "Rewrote 5→5 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6224,7 +6224,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/CLAUDE.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u21925 lines (3 removed) | Also: ### Controllers; - Struct: `type {Resource}Controller struct{}`",
+      "fix": "Rewrote 6→5 lines (3 removed) | Also: ### Controllers; - Struct: `type {Resource}Controller struct{}`",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6256,7 +6256,7 @@
       "error_message": "Wrong reference: signal should be stdio",
       "file": "src/lib/delay.c",
       "root_cause": "Used \"signal\" instead of \"stdio\"",
-      "fix": "Changed signal \u2192 stdio",
+      "fix": "Changed signal → stdio",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -6271,7 +6271,7 @@
       "timestamp": "2026-06-11T03:30:54.341Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6320,7 +6320,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/job.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 15\u219228 lines (2 removed)",
+      "fix": "Rewrote 15→28 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6352,7 +6352,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-consistency-invariants/research.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 7\u21927 lines (3 removed)",
+      "fix": "Rewrote 7→7 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6387,7 +6387,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-consistency-invariants/requirements.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (2 removed)",
+      "fix": "Rewrote 3→4 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6466,7 +6466,7 @@
       "timestamp": "2026-06-11T07:53:43.868Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-consistency-invariants/research.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6498,7 +6498,7 @@
       "timestamp": "2026-06-11T08:46:20.815Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/steering/roadmap.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6579,7 +6579,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/steering/roadmap.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 6\u21928 lines (4 removed)",
+      "fix": "Rewrote 6→8 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6594,7 +6594,7 @@
       "timestamp": "2026-06-11T13:30:00Z",
       "error_message": "test_commit_engine fixture: Expected 0 Was 1 from repl_add_standby",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "repl_add_standby returns the slot index (>=0) on success, not 0 \u2014 second add legitimately returns 1",
+      "root_cause": "repl_add_standby returns the slot index (>=0) on success, not 0 — second add legitimately returns 1",
       "fix": "fixture asserts TEST_ASSERT_EQUAL_INT(i, repl_add_standby(...)) per standby slot",
       "tags": [
         "controller",
@@ -6611,8 +6611,8 @@
       "timestamp": "2026-06-11T13:35:00Z",
       "error_message": "3 pre-existing controller testsuite failures masked by exit code 0: test_committed_lsn_does_not_advance_on_timeout (-110), test_repl_ack_after_promote_gate_allows_jobsub (-10013), test_rdhup_primary_dispatch_gate_opens (-10013)",
       "file": "src/controller/testsuite/controller_test.c",
-      "root_cause": "each test group calls UNITY_BEGIN/UNITY_END internally, resetting Unity counters \u2014 main()'s final UNITY_END returns 0 unless the LAST group fails, so meson reported the suite green despite 3 real failures; Unity also misattributes failure FILE names to whichever file's UNITY_BEGIN ran (e.g. reports test_repl_unit.c for a test living in test_p2_integration.c)",
-      "fix": "not fixed (out of task 1.1 boundary) \u2014 documented; failures exist identically on baseline without ha-commit-engine changes (verified by stash/rebuild). persist_wal_sync_append returns -ETIMEDOUT while the test expects rc==0 with sync_rc==-ETIMEDOUT; the two gate tests fail ha_has_write_quorum (standby_endpoints empty with n_peers=2)",
+      "root_cause": "each test group calls UNITY_BEGIN/UNITY_END internally, resetting Unity counters — main()'s final UNITY_END returns 0 unless the LAST group fails, so meson reported the suite green despite 3 real failures; Unity also misattributes failure FILE names to whichever file's UNITY_BEGIN ran (e.g. reports test_repl_unit.c for a test living in test_p2_integration.c)",
+      "fix": "not fixed (out of task 1.1 boundary) — documented; failures exist identically on baseline without ha-commit-engine changes (verified by stash/rebuild). persist_wal_sync_append returns -ETIMEDOUT while the test expects rc==0 with sync_rc==-ETIMEDOUT; the two gate tests fail ha_has_write_quorum (standby_endpoints empty with n_peers=2)",
       "tags": [
         "controller",
         "testsuite",
@@ -6631,7 +6631,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/commit.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 11\u219221 lines (2 removed) | Also: (void)timeout_ms; /* RETAIN never honors the timeo; * via commit_on_ack (Req 2.1). */",
+      "fix": "Rewrote 11→21 lines (2 removed) | Also: (void)timeout_ms; /* RETAIN never honors the timeo; * via commit_on_ack (Req 2.1). */",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6646,8 +6646,8 @@
       "timestamp": "2026-06-11T15:28:35.990Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550; * Task 3.1 \u2014 membership re-evaluation (commit_on_membership_ | Also: /* Task 3.1 \u2014 membership re-evaluation */; RUN_TEST(test_catchup_standby_ack_does_not_count_toward_pend",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* ═════════════════════════════════════════════════════════; * Task 3.1 — membership re-evaluation (commit_on_membership_ | Also: /* Task 3.1 — membership re-evaluation */; RUN_TEST(test_catchup_standby_ack_does_not_count_toward_pend",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -6662,7 +6662,7 @@
       "timestamp": "2026-06-11T15:55:52.451Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/include/repl.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6678,7 +6678,7 @@
       "timestamp": "2026-06-11T15:56:20.945Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6695,7 +6695,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_engine.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 10\u219215 lines (2 removed)",
+      "fix": "Rewrote 10→15 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6710,7 +6710,7 @@
       "timestamp": "2026-06-11T15:57:43.900Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6726,7 +6726,7 @@
       "timestamp": "2026-06-11T16:15:06.660Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-engine/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6742,7 +6742,7 @@
       "timestamp": "2026-06-11T16:19:30.370Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6758,8 +6758,8 @@
       "timestamp": "2026-06-11T16:19:51.195Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* Task 4.2 \u2014 wired gate: registry truth at ha_dispatch_gate; RUN_TEST(test_gate_wired_registry_catchup_standby_rejects_th",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* Task 4.2 — wired gate: registry truth at ha_dispatch_gate; RUN_TEST(test_gate_wired_registry_catchup_standby_rejects_th",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -6790,7 +6790,7 @@
       "timestamp": "2026-06-11T16:23:59.453Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6806,8 +6806,8 @@
       "timestamp": "2026-06-11T22:39:24.704Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550; * Task 5.1 \u2014 integration: ACK feed and the job-submit sync-a | Also: #include \"typemap.h\"          /* wal_catchup_entry_t (task 5; #include \"wal_types.h\"        /* WAL_JOB_SUBMIT (task 5.1 sy",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* ═════════════════════════════════════════════════════════; * Task 5.1 — integration: ACK feed and the job-submit sync-a | Also: #include \"typemap.h\"          /* wal_catchup_entry_t (task 5; #include \"wal_types.h\"        /* WAL_JOB_SUBMIT (task 5.1 sy",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -6855,7 +6855,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/repl.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 13\u219227 lines (5 removed)",
+      "fix": "Rewrote 13→27 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6870,7 +6870,7 @@
       "timestamp": "2026-06-11T23:32:42.365Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-engine/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -6919,7 +6919,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "16 lines replaced/restructured",
-      "fix": "Rewrote 40\u219267 lines (16 removed)",
+      "fix": "Rewrote 40→67 lines (16 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -6967,7 +6967,7 @@
       "error_message": "Wrong reference: test_single_node_committed_lsn_unchanged should be test_single_node_committed_lsn_advances",
       "file": "src/controller/testsuite/test_p2_integration.c",
       "root_cause": "Used \"test_single_node_committed_lsn_unchanged\" instead of \"test_single_node_committed_lsn_advances\"",
-      "fix": "Changed test_single_node_committed_lsn_unchanged \u2192 test_single_node_committed_lsn_advances",
+      "fix": "Changed test_single_node_committed_lsn_unchanged → test_single_node_committed_lsn_advances",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -7068,7 +7068,7 @@
       "timestamp": "2026-06-12T04:13:06.326Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-barrier-rollout/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -7101,7 +7101,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219212 lines (4 removed) | Also: return persist_wal_async(p, wal_type, &js, sizeof(; persist_t* p       = cls; | Also: int rc = persist_wal_async(p, wal_type, pkt, (uint; persist_t* p       = cls;",
+      "fix": "Rewrote 7→12 lines (4 removed) | Also: return persist_wal_async(p, wal_type, &js, sizeof(; persist_t* p       = cls; | Also: int rc = persist_wal_async(p, wal_type, pkt, (uint; persist_t* p       = cls;",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7149,7 +7149,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_barrier_reply.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21925 lines (2 removed) | Also: static xce_signal_t  g_sigkill = { .signo = SIGKIL; static xce_jobctrl_t g_jobctrl;",
+      "fix": "Rewrote 3→5 lines (2 removed) | Also: static xce_signal_t  g_sigkill = { .signo = SIGKIL; static xce_jobctrl_t g_jobctrl;",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7257,7 +7257,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_barrier_reply.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 12\u219256 lines (7 removed) | Also: xce_job_t  jdef;; static int jobobj_ready; /* jobj module tables \u2014 o",
+      "fix": "Rewrote 12→56 lines (7 removed) | Also: xce_job_t  jdef;; static int jobobj_ready; /* jobj module tables — o",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7272,7 +7272,7 @@
       "timestamp": "2026-06-12T11:05:00-07:00",
       "error_message": "va_list type confusion: WAL_JOB_RUSAGE hook payload reads job_t fields from an xce_job_rusages_t*",
       "file": "src/controller/job.c (caller) / src/controller/persist.c (consumer)",
-      "root_cause": "update_job_rusages fires AFTER_EVENT HOOK_DETAIL_JOB_RUSAGE_UPDATE with (cluster_t*, xce_job_rusages_t*) at job.c:1015-1016, but persist_job_hook_fun's default arm (persist.c:1354-1359) reads the second vararg as job_t* and dereferences j->job.state at offset 56 == sizeof(xce_job_rusages_t) \u2014 an out-of-bounds read on an exactly-sized allocation; the WAL_JOB_RUSAGE payload state field is garbage (jobid at offset 0 lines up by accident)",
+      "root_cause": "update_job_rusages fires AFTER_EVENT HOOK_DETAIL_JOB_RUSAGE_UPDATE with (cluster_t*, xce_job_rusages_t*) at job.c:1015-1016, but persist_job_hook_fun's default arm (persist.c:1354-1359) reads the second vararg as job_t* and dereferences j->job.state at offset 56 == sizeof(xce_job_rusages_t) — an out-of-bounds read on an exactly-sized allocation; the WAL_JOB_RUSAGE payload state field is garbage (jobid at offset 0 lines up by accident)",
       "fix": "NOT FIXED (discovered while writing task 3.3 receipt-ACK verdict pins; production out of boundary). Test test_update_op_rusage_receipt_reply_facts_retained uses a padded union so the pin stays in-bounds under ASAN without masking the bug; fix candidates: dedicated RUSAGE arm in persist_job_hook_fun reading xce_job_rusages_t*, or fire the hook with (c, j) like the other job hooks",
       "tags": [
         "pre-existing",
@@ -7313,7 +7313,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_repl_majority.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u219210 lines (3 removed) | Also: * walAck half is engine-wired per-LSN; the configA; * byte-identical legacy behavior (config barrier o | Also: /* upgradeConfigAck with no pending ACKs \u2192 timeout; int rc_cfg = repl_wait_majority_ack(&g_mp.repl, 0,",
+      "fix": "Rewrote 3→10 lines (3 removed) | Also: * walAck half is engine-wired per-LSN; the configA; * byte-identical legacy behavior (config barrier o | Also: /* upgradeConfigAck with no pending ACKs → timeout; int rc_cfg = repl_wait_majority_ack(&g_mp.repl, 0,",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7329,7 +7329,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/repl.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 6\u219211 lines (5 removed)",
+      "fix": "Rewrote 6→11 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7345,7 +7345,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/repl.h",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u21927 lines (4 removed)",
+      "fix": "Rewrote 4→7 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7361,7 +7361,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "28 lines replaced/restructured",
-      "fix": "Rewrote 73\u219285 lines (28 removed) | Also: /* 7. Push to standbys (best-effort; see push_conf; int acked = push_config_to_standbys(c, out_bytes,  | Also: *   7. Push to standbys (best-effort); *   8. ACK admin tool",
+      "fix": "Rewrote 73→85 lines (28 removed) | Also: /* 7. Push to standbys (best-effort; see push_conf; int acked = push_config_to_standbys(c, out_bytes,  | Also: *   7. Push to standbys (best-effort); *   8. ACK admin tool",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7392,7 +7392,7 @@
       "timestamp": "2026-06-13T00:19:39.908Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/config_repl.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -7430,7 +7430,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 14\u219219 lines (7 removed) | Also: cluster_t *c, const char *msg); reply.status     = -EINVAL;",
+      "fix": "Rewrote 14→19 lines (7 removed) | Also: cluster_t *c, const char *msg); reply.status     = -EINVAL;",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7462,7 +7462,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.h",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 22\u219239 lines (8 removed)",
+      "fix": "Rewrote 22→39 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7478,7 +7478,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 10\u219218 lines (6 removed)",
+      "fix": "Rewrote 10→18 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7493,7 +7493,7 @@
       "timestamp": "2026-06-13T01:14:15.668Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/join.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -7598,7 +7598,7 @@
       "error_message": "Wrong reference: test_ha_cluster should be test_ha_role_lifecycle",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_ha_cluster\" instead of \"test_ha_role_lifecycle\"",
-      "fix": "Changed test_ha_cluster \u2192 test_ha_role_lifecycle",
+      "fix": "Changed test_ha_cluster → test_ha_role_lifecycle",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -7630,7 +7630,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role_lifecycle.c",
       "root_cause": "15 lines replaced/restructured",
-      "fix": "Rewrote 64\u2192108 lines (15 removed)",
+      "fix": "Rewrote 64→108 lines (15 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7662,7 +7662,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role_lifecycle.c",
       "root_cause": "21 lines replaced/restructured",
-      "fix": "Rewrote 35\u219257 lines (21 removed) | Also: /* \u2500\u2500 Case 3: HOOKS REGISTERED BY THE SHARED PROMO; * canonical promotion entry point ha_promote_to_pr",
+      "fix": "Rewrote 35→57 lines (21 removed) | Also: /* ── Case 3: HOOKS REGISTERED BY THE SHARED PROMO; * canonical promotion entry point ha_promote_to_pr",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7678,7 +7678,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 10\u219214 lines (5 removed) | Also: /* Start primary heartbeat immediately in COMMITTI; * NOP during the committing window and their liven",
+      "fix": "Rewrote 10→14 lines (5 removed) | Also: /* Start primary heartbeat immediately in COMMITTI; * NOP during the committing window and their liven",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7706,7 +7706,7 @@
     },
     {
       "error_message": "AddressSanitizer: global-buffer-overflow in xce_wal_batch_req_raw <- repl_broadcast <- persist_wal_async <- ha_arm_own_term_gate <- ha_promote_to_primary, during test_promotion_registers_persist_hooks (test_ha_role_lifecycle.c case 3)",
-      "file": "src/controller/testsuite/test_ha_role_lifecycle.c (fixture defect \u2014 OUT OF task 2.2 boundary)",
+      "file": "src/controller/testsuite/test_ha_role_lifecycle.c (fixture defect — OUT OF task 2.2 boundary)",
       "root_cause": "task-2.2's ha_promote_to_primary now appends a WAL_NOOP via persist_wal_async, which broadcasts to registered standbys. The lifecycle fixture (lifecycle_cluster_setup) registers fake `int g_lc_eps[]` endpoints via repl_add_standby and NEVER installs repl_broadcast_send_hook, so repl_broadcast calls xce_wal_batch_req_raw(s->ep) and reads ep->peer (offset 36) past the 4-byte int. IDENTICAL to the prior test_p2_integration tests 8/9 bug already in buglog.",
       "fix": "Test-side fix (parent must apply, mirrors the documented p2_integration fix): in test_ha_role_lifecycle.c add `extern int (*repl_broadcast_send_hook)(void*, wal_catchup_entry_t**, int);` and a no-op drop hook, install it in lifecycle_cluster_setup before promotion (reset to NULL in teardown), and cast endpoints to (void*). Production ha.c is correct per design (persist_wal_async appends+broadcasts by design).",
       "tags": [
@@ -7726,9 +7726,9 @@
     },
     {
       "error_message": "task-2.1 lifecycle fixture off-by-one: case 5/6/7 assert writable_lsn==noop_lsn and current_lsn==noop_lsn+1, but lifecycle_cluster_setup primes current_lsn = appended_lsn + 1, so a real persist_wal_async appends the noop at appended_lsn+1 (current_lsn->appended_lsn+2), giving noop_lsn=appended_lsn+1 != asserted appended_lsn.",
-      "file": "src/controller/testsuite/test_ha_role_lifecycle.c (fixture defect \u2014 OUT OF task 2.2 boundary)",
+      "file": "src/controller/testsuite/test_ha_role_lifecycle.c (fixture defect — OUT OF task 2.2 boundary)",
       "root_cause": "persist_wal_async assigns hdr.lsn = current_lsn++ (entry takes the CURRENT value). The fixture comment assumes the next append takes current_lsn-1, which is off by one. To make the noop land at `appended_lsn`, the prime must be `current_lsn = appended_lsn`, not `appended_lsn + 1`.",
-      "fix": "Test-side fix (parent): set g_lc.persist.current_lsn = appended_lsn in lifecycle_cluster_setup. Production noop_lsn = current_lsn-1 (post-append) is correct per design \u00a7Promotion Rewrite / brief.",
+      "fix": "Test-side fix (parent): set g_lc.persist.current_lsn = appended_lsn in lifecycle_cluster_setup. Production noop_lsn = current_lsn-1 (post-append) is correct per design §Promotion Rewrite / brief.",
       "tags": [
         "ha-single-leader-role",
         "task-2.2",
@@ -7748,7 +7748,7 @@
       "timestamp": "2026-06-13T08:56:36.044Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_ha_role_lifecycle.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -7781,7 +7781,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role_lifecycle.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21927 lines (2 removed)",
+      "fix": "Rewrote 5→7 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7845,7 +7845,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 16\u21924 lines (11 removed) | Also: /* Task 5.2: After updating convergence tracking, ; * majority of standbys have converged and promote ",
+      "fix": "Rewrote 16→4 lines (11 removed) | Also: /* Task 5.2: After updating convergence tracking, ; * majority of standbys have converged and promote ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7861,7 +7861,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/meson.build",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21923 lines (2 removed)",
+      "fix": "Rewrote 5→3 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7877,7 +7877,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21923 lines (2 removed) | Also: TEST(test_ha_evaluate_committing);; TEST(test_ha_repl_ack);",
+      "fix": "Rewrote 5→3 lines (2 removed) | Also: TEST(test_ha_evaluate_committing);; TEST(test_ha_repl_ack);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7893,7 +7893,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u219210 lines (2 removed)",
+      "fix": "Rewrote 4→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7909,7 +7909,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "196 lines replaced/restructured",
-      "fix": "Rewrote 230\u219212 lines (196 removed) | Also: /* \u2500\u2500 Task 5.3: committing timeout default value a; * Requirements: 6.4, 7.5 (ha-repl-hardening)",
+      "fix": "Rewrote 230→12 lines (196 removed) | Also: /* ── Task 5.3: committing timeout default value a; * Requirements: 6.4, 7.5 (ha-repl-hardening)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7925,7 +7925,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_rdhup_integration.c",
       "root_cause": "34 lines replaced/restructured",
-      "fix": "Rewrote 48\u21929 lines (34 removed) | Also: * Test 4: 3-node cluster RDHUP \u2014 two acks needed, ; * | Also: /* Drive to CTRL_PRIMARY via ack */; ha_repl_ack_received(&c.ha, &c); | Also: RUN_TEST(test_rdhup_committing_to_primary_on_ack);; RUN_TEST(test_rdhup_3node_one_ack_promotes);",
+      "fix": "Rewrote 48→9 lines (34 removed) | Also: * Test 4: 3-node cluster RDHUP — two acks needed, ; * | Also: /* Drive to CTRL_PRIMARY via ack */; ha_repl_ack_received(&c.ha, &c); | Also: RUN_TEST(test_rdhup_committing_to_primary_on_ack);; RUN_TEST(test_rdhup_3node_one_ack_promotes);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7941,7 +7941,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_connection_reuse.c",
       "root_cause": "26 lines replaced/restructured",
-      "fix": "Rewrote 35\u21928 lines (26 removed) | Also: /* \u2500\u2500 Test 10 (Task 7.3): promoted connection carr; *",
+      "fix": "Rewrote 35→8 lines (26 removed) | Also: /* ── Test 10 (Task 7.3): promoted connection carr; *",
       "tags": [
         "auto-detected",
         "refactor",
@@ -7956,7 +7956,7 @@
       "timestamp": "2026-06-13T12:04:59.483Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-single-leader-role/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -7989,7 +7989,7 @@
       "error_message": "Wrong reference: CTRL_PRIMARY_COMMITTING should be CTRL_PRIMARY",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"CTRL_PRIMARY_COMMITTING\" instead of \"CTRL_PRIMARY\"",
-      "fix": "Changed CTRL_PRIMARY_COMMITTING \u2192 CTRL_PRIMARY",
+      "fix": "Changed CTRL_PRIMARY_COMMITTING → CTRL_PRIMARY",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8005,7 +8005,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "21 lines replaced/restructured",
-      "fix": "Rewrote 24\u21925 lines (21 removed) | Also: /* Task 5.3: committing timeout config-default kno; * survives until task 5.2; the degraded-mode commi",
+      "fix": "Rewrote 24→5 lines (21 removed) | Also: /* Task 5.3: committing timeout config-default kno; * survives until task 5.2; the degraded-mode commi",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8037,7 +8037,7 @@
       "error_message": "Wrong reference: CTRL_PRIMARY_COMMITTING should be CTRL_PRIMARY",
       "file": "src/controller/testsuite/test_ha_connection_reuse.c",
       "root_cause": "Used \"CTRL_PRIMARY_COMMITTING\" instead of \"CTRL_PRIMARY\"",
-      "fix": "Changed CTRL_PRIMARY_COMMITTING \u2192 CTRL_PRIMARY",
+      "fix": "Changed CTRL_PRIMARY_COMMITTING → CTRL_PRIMARY",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8068,7 +8068,7 @@
       "timestamp": "2026-06-13T13:14:03.917Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_startup.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8101,7 +8101,7 @@
       "error_message": "Wrong reference: test_nonblocking_single_node_election_enters_committing should be test_nonblocking_single_node_election_enters_primary_directly",
       "file": "src/controller/testsuite/test_ha_startup.c",
       "root_cause": "Used \"test_nonblocking_single_node_election_enters_committing\" instead of \"test_nonblocking_single_node_election_enters_primary_directly\"",
-      "fix": "Changed test_nonblocking_single_node_election_enters_committing \u2192 test_nonblocking_single_node_election_enters_primary_directly",
+      "fix": "Changed test_nonblocking_single_node_election_enters_committing → test_nonblocking_single_node_election_enters_primary_directly",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8117,7 +8117,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_rdhup_integration.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (3 removed)",
+      "fix": "Rewrote 3→4 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8152,7 +8152,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21923 lines (2 removed)",
+      "fix": "Rewrote 4→3 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8168,7 +8168,7 @@
       "error_message": "Wrong reference: uint32_t should be ha_config_t",
       "file": "src/controller/ha.h",
       "root_cause": "Used \"uint32_t\" instead of \"ha_config_t\"",
-      "fix": "Changed uint32_t \u2192 ha_config_t",
+      "fix": "Changed uint32_t → ha_config_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8184,7 +8184,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_role.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 7\u21924 lines (2 removed)",
+      "fix": "Rewrote 7→4 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8199,8 +8199,8 @@
       "timestamp": "2026-06-13T14:43:54.194Z",
       "error_message": "Incorrect value in code",
       "file": ".kiro/steering/ha-async-io.md",
-      "root_cause": "Had `CTRL_PRIMARY_COMMITTING \u2192 CTRL_PRIMARY`",
-      "fix": "Changed to 's own-term commit rule (\u00a75.4.2): an election winn",
+      "root_cause": "Had `CTRL_PRIMARY_COMMITTING → CTRL_PRIMARY`",
+      "fix": "Changed to 's own-term commit rule (§5.4.2): an election winn",
       "tags": [
         "auto-detected",
         "wrong-value",
@@ -8215,8 +8215,8 @@
       "timestamp": "2026-06-13T14:54:21.781Z",
       "error_message": "Incorrect value in code",
       "file": ".claude/skills/xce-deploy-ha/SKILL.md",
-      "root_cause": "Had `\u2192 CTRL_PRIMARY_COMMITTING`",
-      "fix": "Changed to `HA FSM (raft): \u2192 CTRL_PRIMARY (term=...)`",
+      "root_cause": "Had `→ CTRL_PRIMARY_COMMITTING`",
+      "fix": "Changed to `HA FSM (raft): → CTRL_PRIMARY (term=...)`",
       "tags": [
         "auto-detected",
         "wrong-value",
@@ -8231,8 +8231,8 @@
       "timestamp": "2026-06-13T15:31:21.740Z",
       "error_message": "Incorrect value in code",
       "file": "../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_ha_consistency_invariants.md",
-      "root_cause": "Had \"XCE HA Raft+CP umbrella \u2014 sub-specs 1&2 of 4 IMPL",
-      "fix": "Changed to \"XCE HA Raft+CP umbrella \u2014 sub-specs 1,2,3 of 4 IM",
+      "root_cause": "Had \"XCE HA Raft+CP umbrella — sub-specs 1&2 of 4 IMPL",
+      "fix": "Changed to \"XCE HA Raft+CP umbrella — sub-specs 1,2,3 of 4 IM",
       "tags": [
         "auto-detected",
         "wrong-value",
@@ -8248,7 +8248,7 @@
       "error_message": "Wrong reference: stdint should be stdbool",
       "file": "src/controller/include/cluster.h",
       "root_cause": "Used \"stdint\" instead of \"stdbool\"",
-      "fix": "Changed stdint \u2192 stdbool",
+      "fix": "Changed stdint → stdbool",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8264,7 +8264,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_egress_filter.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219217 lines (4 removed) | Also: /* \u2500\u2500 Cross-module link stubs (dataex.c/misc.c/sch; /* clang-format off */",
+      "fix": "Rewrote 7→17 lines (4 removed) | Also: /* ── Cross-module link stubs (dataex.c/misc.c/sch; /* clang-format off */",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8280,7 +8280,7 @@
       "error_message": "Wrong reference: xlist_destroy should be xlist_fini",
       "file": "src/controller/testsuite/test_egress_filter.c",
       "root_cause": "Used \"xlist_destroy\" instead of \"xlist_fini\"",
-      "fix": "Changed xlist_destroy \u2192 xlist_fini",
+      "fix": "Changed xlist_destroy → xlist_fini",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8328,7 +8328,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_egress_filter.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 12\u219217 lines (2 removed) | Also: jdef.jobid = 202;; jdef.state = JOB_STAT_PEND;",
+      "fix": "Rewrote 12→17 lines (2 removed) | Also: jdef.jobid = 202;; jdef.state = JOB_STAT_PEND;",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8360,7 +8360,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21926 lines (2 removed) | Also: extern int restore_job(cluster_t* c, uint64_t jobi; extern int restore_job_old_unused(cluster_t* c, ui",
+      "fix": "Rewrote 4→6 lines (2 removed) | Also: extern int restore_job(cluster_t* c, uint64_t jobi; extern int restore_job_old_unused(cluster_t* c, ui",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8408,7 +8408,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 9\u21924 lines (8 removed)",
+      "fix": "Rewrote 9→4 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8440,7 +8440,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/include/cluster.h",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 12\u21923 lines (8 removed)",
+      "fix": "Rewrote 12→3 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8472,7 +8472,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_demotion_convergence.c",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 16\u219234 lines (11 removed)",
+      "fix": "Rewrote 16→34 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8488,7 +8488,7 @@
       "error_message": "AddressSanitizer: heap-use-after-free in ha_rejoin_reconcile_fn (ha_convergence.c:236) during test_rejoin_second_call_no_second_restart",
       "file": "src/controller/testsuite/test_demotion_convergence.c",
       "root_cause": "dc_run_pending_task peeked tasks.head and ran entry(args) WITHOUT dequeuing. The once-guard correctly makes the 2nd ha_rejoin_reconcile schedule no new task, so head still pointed at the first (already-run) task whose body had freed its heap ctx (args). The 2nd dc_run_pending_task re-ran that task on the freed ctx. The convergence task bodies free their own args (production delaymgr killer frees only the delay_task_t node, never args; production execv never re-runs a one-shot).",
-      "fix": "Made dc_run_pending_task DEQUEUE via ordq_get(&mgr->tasks, NULL), run the body, then free(t)/free(it) \u2014 mirroring the real delaymgr worker (ordq_get -> runner_fn -> FREEUP for runcount==1). A 2nd call now returns DC_NO_TASK as production would. Production ha_rejoin_reconcile/ha_rejoin_reconcile_fn unchanged (the body-frees-ctx pattern is correct).",
+      "fix": "Made dc_run_pending_task DEQUEUE via ordq_get(&mgr->tasks, NULL), run the body, then free(t)/free(it) — mirroring the real delaymgr worker (ordq_get -> runner_fn -> FREEUP for runcount==1). A 2nd call now returns DC_NO_TASK as production would. Production ha_rejoin_reconcile/ha_rejoin_reconcile_fn unchanged (the body-frees-ctx pattern is correct).",
       "tags": [
         "asan",
         "use-after-free",
@@ -8524,7 +8524,7 @@
       "timestamp": "2026-06-14T04:57:22.178Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /*; * ha_walack_continuation_for_test: test-only entry point for",
       "tags": [
         "auto-detected",
@@ -8540,7 +8540,7 @@
       "timestamp": "2026-06-14T04:57:59.221Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha_convergence.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8556,7 +8556,7 @@
       "timestamp": "2026-06-14T05:23:00.737Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8572,7 +8572,7 @@
       "timestamp": "2026-06-14T05:24:33.033Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/config_repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8588,7 +8588,7 @@
       "timestamp": "2026-06-14T05:25:04.524Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8620,8 +8620,8 @@
       "timestamp": "2026-06-14T06:37:35.904Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_convergence_verification.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: printf(\"\\n>> Regression pins: fan-out / snapshot fallback / ; \"re-inclusion (task 6.1 \u2014 PASS against current code)\\n\\n\"); | Also: /* \u2500\u2500 Fan-out counting send-hook (task 6.1 (a)/(d), umbrella; * repl_broadcast routes each enqueue through repl_broadcast_",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: printf(\"\\n>> Regression pins: fan-out / snapshot fallback / ; \"re-inclusion (task 6.1 — PASS against current code)\\n\\n\"); | Also: /* ── Fan-out counting send-hook (task 6.1 (a)/(d), umbrella; * repl_broadcast routes each enqueue through repl_broadcast_",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -8653,7 +8653,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_convergence_verification.c",
       "root_cause": "22 lines replaced/restructured",
-      "fix": "Rewrote 33\u21923 lines (22 removed)",
+      "fix": "Rewrote 33→3 lines (22 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8720,7 +8720,7 @@
       "timestamp": "2026-06-14T08:35:02.456Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_vote_gate.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -8737,7 +8737,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 12\u219217 lines (6 removed)",
+      "fix": "Rewrote 12→17 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8753,7 +8753,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 8\u219216 lines (3 removed)",
+      "fix": "Rewrote 8→16 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8785,7 +8785,7 @@
       "error_message": "WAL HOLE on cold-start catch-up: a fresh EMPTY standby (standby_lsn=0) catching up to a primary holding [0,1] receives ONLY lsn 1, missing lsn 0",
       "file": "src/controller/config_repl.c",
       "root_cause": "ha_stream_wal_to_standby filter `if (hdr.lsn > standby_lsn)` excludes lsn 0 when standby_lsn==0 (0>0 is false). standby_lsn=0 is ambiguous: it means BOTH 'empty standby (applied nothing)' AND 'standby has applied lsn 0'. The streamer cannot distinguish, computes start_lsn=standby_lsn+1=1, and drops the genuine lsn-0 entry. Only non-cosmetic because lsn-0 entries can be REAL data (first-ever WAL entry of a fresh cluster is lsn 0 from a real write OR the promotion NOOP).",
-      "fix": "FIXED via reserve-lsn-0: persist_init() now sets current_lsn=1 on a fresh store (persist.c), so lsn 0 is reserved as the none/empty sentinel and the first-ever WAL entry (promotion NOOP) is lsn 1. The streamer filter hdr.lsn>standby_lsn now yields 1>0=true for an empty standby (standby_lsn=0), streaming the first entry \u2014 no hole. No streamer change needed; the reserved base makes the existing filter correct. Also fixes the uncommittable cold-start NOOP (now lsn 1, committable 0->1) and the own-term writable_lsn gate (now 1, effective). Test: test_coldstart_lsn0.c H1-H4 all green incl H4 no-hole. Base-shift fallout fixed in test_commit_engine, test_commit_barrier_rollout, test_commit_barrier_reply, test_p2_integration, test_egress_filter (removed now-redundant priming appends / wired engine).",
+      "fix": "FIXED via reserve-lsn-0: persist_init() now sets current_lsn=1 on a fresh store (persist.c), so lsn 0 is reserved as the none/empty sentinel and the first-ever WAL entry (promotion NOOP) is lsn 1. The streamer filter hdr.lsn>standby_lsn now yields 1>0=true for an empty standby (standby_lsn=0), streaming the first entry — no hole. No streamer change needed; the reserved base makes the existing filter correct. Also fixes the uncommittable cold-start NOOP (now lsn 1, committable 0->1) and the own-term writable_lsn gate (now 1, effective). Test: test_coldstart_lsn0.c H1-H4 all green incl H4 no-hole. Base-shift fallout fixed in test_commit_engine, test_commit_barrier_rollout, test_commit_barrier_reply, test_p2_integration, test_egress_filter (removed now-redundant priming appends / wired engine).",
       "tags": [
         "ha",
         "replication",
@@ -8806,7 +8806,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_egress_filter.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 7\u21929 lines (3 removed)",
+      "fix": "Rewrote 7→9 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8822,7 +8822,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_p3_hardening.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u21926 lines (4 removed)",
+      "fix": "Rewrote 4→6 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8838,7 +8838,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_barrier_reply.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u21929 lines (4 removed)",
+      "fix": "Rewrote 8→9 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8854,7 +8854,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_convergence_verification.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 32\u2192111 lines (3 removed)",
+      "fix": "Rewrote 32→111 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8870,7 +8870,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219215 lines (2 removed)",
+      "fix": "Rewrote 8→15 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8886,7 +8886,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 30\u219238 lines (4 removed)",
+      "fix": "Rewrote 30→38 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8902,7 +8902,7 @@
       "error_message": "Wrong reference: test_pin_dispatch_gate_degraded_allowlist should be test_empty_standby_fresh_cluster_streams_not_snapshot",
       "file": "src/controller/testsuite/test_convergence_verification.c",
       "root_cause": "Used \"test_pin_dispatch_gate_degraded_allowlist\" instead of \"test_empty_standby_fresh_cluster_streams_not_snapshot\"",
-      "fix": "Changed test_pin_dispatch_gate_degraded_allowlist \u2192 test_empty_standby_fresh_cluster_streams_not_snapshot",
+      "fix": "Changed test_pin_dispatch_gate_degraded_allowlist → test_empty_standby_fresh_cluster_streams_not_snapshot",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -8934,7 +8934,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_convergence_verification.c",
       "root_cause": "18 lines replaced/restructured",
-      "fix": "Rewrote 35\u219254 lines (18 removed) | Also: /* HA_REPL_SEND_SNAPSHOT: standby_lsn predates the; \"heartbeat decision: standby_lsn below oldest_wal_",
+      "fix": "Rewrote 35→54 lines (18 removed) | Also: /* HA_REPL_SEND_SNAPSHOT: standby_lsn predates the; \"heartbeat decision: standby_lsn below oldest_wal_",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8950,7 +8950,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u219210 lines (2 removed)",
+      "fix": "Rewrote 5→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -8966,7 +8966,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_p2_integration.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 5\u219220 lines (3 removed)",
+      "fix": "Rewrote 5→20 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9030,7 +9030,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 7\u21929 lines (5 removed) | Also: config.nmasters        = 1;; config.masters[0]      = get_setting(\"host\");",
+      "fix": "Rewrote 7→9 lines (5 removed) | Also: config.nmasters        = 1;; config.masters[0]      = get_setting(\"host\");",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9046,7 +9046,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u219214 lines (2 removed)",
+      "fix": "Rewrote 4→14 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9062,7 +9062,7 @@
       "error_message": "Wrong reference: myconf_t should be uint32_t",
       "file": "src/include/myconf.h",
       "root_cause": "Used \"myconf_t\" instead of \"uint32_t\"",
-      "fix": "Changed myconf_t \u2192 uint32_t",
+      "fix": "Changed myconf_t → uint32_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -9118,8 +9118,8 @@
       "timestamp": "2026-06-15T09:16:53.679025Z",
       "error_message": "jobsub returns ok (status 0, jobid) but joblist AND jobinfo show the job absent on a stable single primary (ctrl-1); reslist works.",
       "file": "src/lib/request.c",
-      "root_cause": "SOLVED (reproduced locally via /xce-build + 3-node deploy-ha, ASAN). cluster_start() \u2014 the ONLY place that sets c->running=1 \u2014 is ORPHANED (zero callers; grep confirms). The HA startup path (myapp_run) starts iomgr/vtaskmgr/delaymgr/persist_start itself but never calls cluster_start, so c->running stays 0 (calloc default) on the primary. check_controller() (the streaming gate passed to xce_reply_get for joblist/workerlist) returns -EINVAL when !c->running; xce_reply_get then sets nc=0 (chunk count), shipping an EMPTY list to the client even though collect_jobs/key_find found the job. reslist passes checkf=NULL so it was immune. DIAG proof: 'reply_get send: table=2 pos=0 nc=0 nrows=1 checkstatus=-22' (pre-fix) -> 'nc=1 ... checkstatus=1' (post-fix). Single-node/legacy cluster_init path called cluster_start, which is why non-replicated worked.",
-      "fix": "Set c->running=1 at the TOP of cluster_run() (src/controller/cluster.c), symmetric with the existing c->running=0 on shutdown \u2014 the orphaned cluster_start() used to set it. c->running is a liveness/shutdown flag: check_controller() is polled PER CHUNK inside xce_reply_get()'s streaming loop so a long multi-chunk fetch (e.g. thousands of jobs) ABORTS mid-stream (nc=0) if a shutdown request arrives during it. The bug: running started 0 and was never set under HA, so the gate fired on every reply, not just during shutdown. Fix restores running=1 for the run-loop lifetime; the shutdown abort path (running=0 when cluster_run's cbuf_get loop breaks on the stop signal) is unchanged. Verified E2E on a local 3-node deploy-ha (ASAN): jobs now appear in joblist; DIAG showed checkstatus/nc flip -22/0 -> 1/1. Final fix is in cluster_run (not myapp_run \u2014 moved there so the 1<->0 lifecycle is co-located in the function that receives the shutdown signal).",
+      "root_cause": "SOLVED (reproduced locally via /xce-build + 3-node deploy-ha, ASAN). cluster_start() — the ONLY place that sets c->running=1 — is ORPHANED (zero callers; grep confirms). The HA startup path (myapp_run) starts iomgr/vtaskmgr/delaymgr/persist_start itself but never calls cluster_start, so c->running stays 0 (calloc default) on the primary. check_controller() (the streaming gate passed to xce_reply_get for joblist/workerlist) returns -EINVAL when !c->running; xce_reply_get then sets nc=0 (chunk count), shipping an EMPTY list to the client even though collect_jobs/key_find found the job. reslist passes checkf=NULL so it was immune. DIAG proof: 'reply_get send: table=2 pos=0 nc=0 nrows=1 checkstatus=-22' (pre-fix) -> 'nc=1 ... checkstatus=1' (post-fix). Single-node/legacy cluster_init path called cluster_start, which is why non-replicated worked.",
+      "fix": "Set c->running=1 at the TOP of cluster_run() (src/controller/cluster.c), symmetric with the existing c->running=0 on shutdown — the orphaned cluster_start() used to set it. c->running is a liveness/shutdown flag: check_controller() is polled PER CHUNK inside xce_reply_get()'s streaming loop so a long multi-chunk fetch (e.g. thousands of jobs) ABORTS mid-stream (nc=0) if a shutdown request arrives during it. The bug: running started 0 and was never set under HA, so the gate fired on every reply, not just during shutdown. Fix restores running=1 for the run-loop lifetime; the shutdown abort path (running=0 when cluster_run's cbuf_get loop breaks on the stop signal) is unchanged. Verified E2E on a local 3-node deploy-ha (ASAN): jobs now appear in joblist; DIAG showed checkstatus/nc flip -22/0 -> 1/1. Final fix is in cluster_run (not myapp_run — moved there so the 1<->0 lifecycle is co-located in the function that receives the shutdown signal).",
       "tags": [
         "joblist",
         "workerlist",
@@ -9144,7 +9144,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/opget.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u21923 lines (2 removed) | Also: {; extern uint64_t g_diag_last_jobid;",
+      "fix": "Rewrote 6→3 lines (2 removed) | Also: {; extern uint64_t g_diag_last_jobid;",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9159,7 +9159,7 @@
       "timestamp": "2026-06-15T10:46:08.441Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_rdhup_integration.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9175,7 +9175,7 @@
       "timestamp": "2026-06-15T10:46:31.815Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9192,7 +9192,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 5\u21924 lines (3 removed)",
+      "fix": "Rewrote 5→4 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9231,7 +9231,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u219211 lines (2 removed)",
+      "fix": "Rewrote 3→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9263,7 +9263,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/steering/product.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21927 lines (2 removed)",
+      "fix": "Rewrote 4→7 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9295,7 +9295,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 13\u21925 lines (9 removed)",
+      "fix": "Rewrote 13→5 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9308,10 +9308,10 @@
     {
       "id": "bug-340",
       "timestamp": "2026-06-15T15:00:00.000Z",
-      "error_message": "After kill+RESTART of a controller (ctrl-1), the restarted node loops forever: ha_on_primary_ctrl_fd_rdhup \u2192 CTRL_ELECTING \u2192 raft_cb_become_follower \u2192 CTRL_STANDBY every ~heartbeat_timeout, term climbing unbounded (473+), while ctrl-2 stays PRIMARY at term 3. On ctrl-2: every heartbeat tick logs `xce_encode op 0 (NOP)` then `WARN endpoint_update_epoll rc1=-1 < 0` (netio.c:575) \u2014 a wedged outbound standby endpoint.",
+      "error_message": "After kill+RESTART of a controller (ctrl-1), the restarted node loops forever: ha_on_primary_ctrl_fd_rdhup → CTRL_ELECTING → raft_cb_become_follower → CTRL_STANDBY every ~heartbeat_timeout, term climbing unbounded (473+), while ctrl-2 stays PRIMARY at term 3. On ctrl-2: every heartbeat tick logs `xce_encode op 0 (NOP)` then `WARN endpoint_update_epoll rc1=-1 < 0` (netio.c:575) — a wedged outbound standby endpoint.",
       "file": "src/controller/ha.c, src/controller/testsuite/test_ha_liveness.c",
-      "root_cause": "primary_heartbeat_fn never evicted a dead/wedged outbound standby endpoint from ha->standby_endpoints. When a peer is killed/restarted, its outbound ep on the primary wedges: handle_error (netio.c:420) runs iomgr_unmonitor (EPOLL_CTL_DEL, does NOT close the fd) and the err handler may leave the ep in standby_endpoints; epoll_ctl(EPOLL_CTL_MOD) on the DEL'd fd then returns ENOENT (rc1=-1) on every heartbeat enqueue. xce_nop_req still returns >=0 (enqueue ok) so the heartbeat layer never detected the wedge. Critically, primary_heartbeat_fn step 2 (reconnect) treats a peer as 'found' (connected) if ANY ep for it is in standby_endpoints \u2014 so the wedged ep SUPPRESSED reconnection. ctrl-2 therefore never opened a fresh connection to the restarted ctrl-1, never sent a ctrlhello, so ctrl-1 never set primary_ctrl_fd / refreshed last_activity and its liveness watchdog re-elected every heartbeat_timeout forever. (The earlier suspected 'become_follower doesn't reset last_activity' was NOT a bug: ha_arm_heartbeat_timeout_vtask already stamps last_activity=now, so the ~11s period is exactly one full timeout \u2014 confirming the watchdog is correct and the sole cause is the broken channel.)",
-      "fix": "In primary_heartbeat_fn (ha.c) step 1, added liveness eviction symmetric with the standby's own liveness poll: for each standby ep, if ep->ts_last_in > 0 (was responsive at least once) AND (now_wall - ep->ts_last_in) > heartbeat_timeout_s, remove it from ha->standby_endpoints (zarray_del, under ha->lock) and collect it; after releasing ha->lock, repl_remove_standby() each evicted ep. Removal is the load-bearing action \u2014 the reconnect scan (step 2) then re-establishes a fresh ctrlhello channel to the restarted peer on this/next tick, and ctrl-1 settles via ha_discover_primary (no term gate, ha.c:3807) \u2192 become_follower \u2192 STANDBY. ts_last_in/ts_last_out are existing endpoint_t fields (wall clock, set in handle_input/handle_output), so no libnetio change. The evicted ep object itself is reclaimed by its err handler when the dead connection finally surfaces an epoll event (bounded leak, consistent with codebase). Eviction keys on ts_last_in>0 so a just-connected joiner (ts_last_in==0) gets grace. Regression tests: test_primary_hb_evicts_silent_standby (RED\u2192GREEN), test_primary_hb_keeps_live_standby, test_primary_hb_keeps_unconfirmed_standby in test_ha_liveness.c.",
+      "root_cause": "primary_heartbeat_fn never evicted a dead/wedged outbound standby endpoint from ha->standby_endpoints. When a peer is killed/restarted, its outbound ep on the primary wedges: handle_error (netio.c:420) runs iomgr_unmonitor (EPOLL_CTL_DEL, does NOT close the fd) and the err handler may leave the ep in standby_endpoints; epoll_ctl(EPOLL_CTL_MOD) on the DEL'd fd then returns ENOENT (rc1=-1) on every heartbeat enqueue. xce_nop_req still returns >=0 (enqueue ok) so the heartbeat layer never detected the wedge. Critically, primary_heartbeat_fn step 2 (reconnect) treats a peer as 'found' (connected) if ANY ep for it is in standby_endpoints — so the wedged ep SUPPRESSED reconnection. ctrl-2 therefore never opened a fresh connection to the restarted ctrl-1, never sent a ctrlhello, so ctrl-1 never set primary_ctrl_fd / refreshed last_activity and its liveness watchdog re-elected every heartbeat_timeout forever. (The earlier suspected 'become_follower doesn't reset last_activity' was NOT a bug: ha_arm_heartbeat_timeout_vtask already stamps last_activity=now, so the ~11s period is exactly one full timeout — confirming the watchdog is correct and the sole cause is the broken channel.)",
+      "fix": "In primary_heartbeat_fn (ha.c) step 1, added liveness eviction symmetric with the standby's own liveness poll: for each standby ep, if ep->ts_last_in > 0 (was responsive at least once) AND (now_wall - ep->ts_last_in) > heartbeat_timeout_s, remove it from ha->standby_endpoints (zarray_del, under ha->lock) and collect it; after releasing ha->lock, repl_remove_standby() each evicted ep. Removal is the load-bearing action — the reconnect scan (step 2) then re-establishes a fresh ctrlhello channel to the restarted peer on this/next tick, and ctrl-1 settles via ha_discover_primary (no term gate, ha.c:3807) → become_follower → STANDBY. ts_last_in/ts_last_out are existing endpoint_t fields (wall clock, set in handle_input/handle_output), so no libnetio change. The evicted ep object itself is reclaimed by its err handler when the dead connection finally surfaces an epoll event (bounded leak, consistent with codebase). Eviction keys on ts_last_in>0 so a just-connected joiner (ts_last_in==0) gets grace. Regression tests: test_primary_hb_evicts_silent_standby (RED→GREEN), test_primary_hb_keeps_live_standby, test_primary_hb_keeps_unconfirmed_standby in test_ha_liveness.c.",
       "tags": [
         "ha",
         "heartbeat",
@@ -9332,7 +9332,7 @@
       "timestamp": "2026-06-16T00:10:49.295Z",
       "error_message": "Incorrect value in code",
       "file": ".kiro/specs/ha-prevote/research.md",
-      "root_cause": "Had 't understand PreVote (older binary) \u2014 does the ca",
+      "root_cause": "Had 't understand PreVote (older binary) — does the ca",
       "fix": "Changed to 's \"",
       "tags": [
         "auto-detected",
@@ -9364,7 +9364,7 @@
       "timestamp": "2026-06-16T00:26:16.193Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-prevote/research.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9413,7 +9413,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-prevote/tasks.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 7\u21927 lines (3 removed) | Also: - [ ] 5.1 Wire the PreVote reply opcode to the can; - Dispatch the incoming PreVote-reply opcode to th",
+      "fix": "Rewrote 7→7 lines (3 removed) | Also: - [ ] 5.1 Wire the PreVote reply opcode to the can; - Dispatch the incoming PreVote-reply opcode to th",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9429,7 +9429,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21925 lines (2 removed)",
+      "fix": "Rewrote 4→5 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9444,7 +9444,7 @@
       "timestamp": "2026-06-16T04:18:41.611Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/testsuite/test_raft.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9460,7 +9460,7 @@
       "timestamp": "2026-06-16T04:19:25.513Z",
       "error_message": "Missing error handling in never",
       "file": "src/lib/raft/raft.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9508,8 +9508,8 @@
       "timestamp": "2026-06-16T04:50:38.855Z",
       "error_message": "Missing error handling in struct",
       "file": "src/controller/testsuite/test_ha_vote_gate.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* Task 3.1 \u2014 voter-side PreVote dispatch gate (stickiness +; * no mutation, reply term unchanged) */",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* Task 3.1 — voter-side PreVote dispatch gate (stickiness +; * no mutation, reply term unchanged) */",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -9525,7 +9525,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_vote_gate.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u21924 lines (2 removed)",
+      "fix": "Rewrote 4→4 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9540,7 +9540,7 @@
       "timestamp": "2026-06-16T04:57:16.230Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9557,7 +9557,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 20\u219225 lines (6 removed)",
+      "fix": "Rewrote 20→25 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9572,7 +9572,7 @@
       "timestamp": "2026-06-16T05:21:02.997Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-prevote/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9589,7 +9589,7 @@
       "error_message": "Wrong reference: test_commit_engine should be test_ha_prevote",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_commit_engine\" instead of \"test_ha_prevote\"",
-      "fix": "Changed test_commit_engine \u2192 test_ha_prevote",
+      "fix": "Changed test_commit_engine → test_ha_prevote",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -9653,7 +9653,7 @@
       "error_message": "Wrong reference: test_commit_engine should be test_ha_failover_prevote",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_commit_engine\" instead of \"test_ha_failover_prevote\"",
-      "fix": "Changed test_commit_engine \u2192 test_ha_failover_prevote",
+      "fix": "Changed test_commit_engine → test_ha_failover_prevote",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -9669,7 +9669,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "104 lines replaced/restructured",
-      "fix": "Rewrote 157\u219290 lines (104 removed)",
+      "fix": "Rewrote 157→90 lines (104 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9716,7 +9716,7 @@
       "timestamp": "2026-06-16T06:58:28.916Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_prevote.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9733,7 +9733,7 @@
       "error_message": "Significant refactor of ",
       "file": ".claude/settings.json",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 13\u21923 lines (9 removed) | Also: },; {",
+      "fix": "Rewrote 13→3 lines (9 removed) | Also: },; {",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9748,7 +9748,7 @@
       "timestamp": "2026-06-16T07:55:35.829Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-prevote/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -9765,7 +9765,7 @@
       "error_message": "Significant refactor of ",
       "file": ".claude/settings.json",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 13\u21923 lines (9 removed) | Also: },; {",
+      "fix": "Rewrote 13→3 lines (9 removed) | Also: },; {",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9796,7 +9796,7 @@
       "timestamp": "2026-06-16T15:55:00Z",
       "error_message": "controller unit test TIMEOUT 300.01s killed by SIGTERM; suite exceeds 300s meson cap",
       "file": "src/controller/persist.c",
-      "root_cause": "fsync_worker slept the full wal_sync_ms in one uninterruptible nanosleep() then checked fsync_stop. persist_stop sets the flag and immediately pthread_join()s, so the join blocked until the in-progress sleep returned \u2014 up to a full wal_sync_ms per teardown. Tests set wal_sync_ms=5000 ('slow fsync, no races'), so each persist_stop cost ~5s; across ~7 suites with many fixtures the cumulative teardown time blew past the 300s controller-test cap. The 'commit: WAIT deadline expired' warnings in the log were unrelated intentional negative tests (50-300ms).",
+      "root_cause": "fsync_worker slept the full wal_sync_ms in one uninterruptible nanosleep() then checked fsync_stop. persist_stop sets the flag and immediately pthread_join()s, so the join blocked until the in-progress sleep returned — up to a full wal_sync_ms per teardown. Tests set wal_sync_ms=5000 ('slow fsync, no races'), so each persist_stop cost ~5s; across ~7 suites with many fixtures the cumulative teardown time blew past the 300s controller-test cap. The 'commit: WAIT deadline expired' warnings in the log were unrelated intentional negative tests (50-300ms).",
       "fix": "Replaced the nanosleep with pthread_cond_timedwait on a new fsync_mutex/fsync_cond (added to persist_t, init in persist_init, destroyed in persist_fini). persist_stop now sets fsync_stop and pthread_cond_signal(fsync_cond) under fsync_mutex before join, so the worker wakes immediately. fdatasync still runs under p->lock, released before re-acquiring fsync_mutex (no lock nesting). Full controller suite now completes in ~10s (was >300s); 0 failures.",
       "tags": [
         "controller",
@@ -9839,10 +9839,10 @@
     {
       "id": "bug-606",
       "timestamp": "2026-06-16T17:46:00Z",
-      "error_message": "After killing the primary (ctrl-1), the two surviving standbys (ctrl-2,ctrl-3) livelock in synchronized elections: PreVote win \u2192 CTRL_ELECTING \u2192 become_follower (term bumped) \u2192 ~10s \u2192 repeat, term climbing unbounded (3\u21929\u2192\u221e), no new primary ever elected. Reproduce: deploy 3-node HA, elect primary, submit 3-5 jobs, kill ctrl-1.",
+      "error_message": "After killing the primary (ctrl-1), the two surviving standbys (ctrl-2,ctrl-3) livelock in synchronized elections: PreVote win → CTRL_ELECTING → become_follower (term bumped) → ~10s → repeat, term climbing unbounded (3→9→∞), no new primary ever elected. Reproduce: deploy 3-node HA, elect primary, submit 3-5 jobs, kill ctrl-1.",
       "file": "src/controller/ha.c (ha_begin_failover, ha_election_stagger_ms, ha_failover_stagger_fn); src/controller/ha.h; test: src/controller/testsuite/test_ha_role.c",
-      "root_cause": "Dueling-candidates split-vote livelock \u2014 Raft \u00a75.2 randomized election timeout is missing on the FAILOVER path. Both survivors lose the primary at the same instant; their liveness polls fire on the identical fixed heartbeat_timeout, so they start PreVote+real-election in perfect lock-step (ms-aligned timestamps). Both win PreVote (neither sees a primary, so each grants the other \u2014 PreVote cannot break this tie), then both campaign at the same term, each votes for itself and denies the other (quorum 2, only 2 live nodes) \u2192 split vote \u2192 election times out (fixed election_timeout_ms, raft.c:105, NO jitter) \u2192 become_follower, term+1 \u2192 repeat forever. The priority/jitter config (election_jitter_max_ms, election_priority_step_ms) is applied ONLY at startup (ha_wait_for_heartbeat_or_timeout); the failover re-election path (liveness_poll_fn \u2192 ha_on_primary_ctrl_fd_rdhup \u2192 PreVote \u2192 ha_start_election_async \u2192 raft_start_election) has no de-synchronization. raft_on_leader_lost DOES have a priority stagger (raft.c:421) but the failover loop does not go through it.",
-      "fix": "Added ha_election_stagger_ms() (ha.c/ha.h): per-node failover delay = my_priority*election_priority_step_ms + random[0,election_jitter_max_ms], re-randomized each call (mirrors the startup stagger). ha_begin_failover() now schedules the PreVote start via delaymgr after that stagger (production only; c==NULL/no-delaymgr stays synchronous so existing tests are unaffected). The delaymgr callback ha_failover_stagger_fn guards with role==STANDBY && ha_heartbeat_is_fresh \u2192 skips PreVote if a primary connected during the stagger. Effect: two survivors no longer campaign in lock-step; the higher-priority survivor wins and its heartbeats reset the other. TDD: test_election_stagger_desyncs_by_priority (bounds + step>jitter ordering). VERIFIED on kill-primary repro: ctrl-2 (stagger 630ms) won \u2192 PRIMARY term=1; ctrl-3 (stagger 1072ms) received ctrl-2's ctrlhello first \u2192 STANDBY, then its stagger timer hit the guard and skipped PreVote ('a primary is alive \u2014 skipping PreVote'). No term inflation, no livelock. NOTE: optional raft.c:105 give-up-watchdog randomization NOT needed \u2014 the failover-start stagger alone resolves it; left as future defense-in-depth.",
+      "root_cause": "Dueling-candidates split-vote livelock — Raft §5.2 randomized election timeout is missing on the FAILOVER path. Both survivors lose the primary at the same instant; their liveness polls fire on the identical fixed heartbeat_timeout, so they start PreVote+real-election in perfect lock-step (ms-aligned timestamps). Both win PreVote (neither sees a primary, so each grants the other — PreVote cannot break this tie), then both campaign at the same term, each votes for itself and denies the other (quorum 2, only 2 live nodes) → split vote → election times out (fixed election_timeout_ms, raft.c:105, NO jitter) → become_follower, term+1 → repeat forever. The priority/jitter config (election_jitter_max_ms, election_priority_step_ms) is applied ONLY at startup (ha_wait_for_heartbeat_or_timeout); the failover re-election path (liveness_poll_fn → ha_on_primary_ctrl_fd_rdhup → PreVote → ha_start_election_async → raft_start_election) has no de-synchronization. raft_on_leader_lost DOES have a priority stagger (raft.c:421) but the failover loop does not go through it.",
+      "fix": "Added ha_election_stagger_ms() (ha.c/ha.h): per-node failover delay = my_priority*election_priority_step_ms + random[0,election_jitter_max_ms], re-randomized each call (mirrors the startup stagger). ha_begin_failover() now schedules the PreVote start via delaymgr after that stagger (production only; c==NULL/no-delaymgr stays synchronous so existing tests are unaffected). The delaymgr callback ha_failover_stagger_fn guards with role==STANDBY && ha_heartbeat_is_fresh → skips PreVote if a primary connected during the stagger. Effect: two survivors no longer campaign in lock-step; the higher-priority survivor wins and its heartbeats reset the other. TDD: test_election_stagger_desyncs_by_priority (bounds + step>jitter ordering). VERIFIED on kill-primary repro: ctrl-2 (stagger 630ms) won → PRIMARY term=1; ctrl-3 (stagger 1072ms) received ctrl-2's ctrlhello first → STANDBY, then its stagger timer hit the guard and skipped PreVote ('a primary is alive — skipping PreVote'). No term inflation, no livelock. NOTE: optional raft.c:105 give-up-watchdog randomization NOT needed — the failover-start stagger alone resolves it; left as future defense-in-depth.",
       "tags": [
         "ha",
         "raft",
@@ -9868,7 +9868,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/requirements.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 5\u21928 lines (5 removed) | Also: 1. If a controller returns a not-ready (no current; shall retry the request with backoff.",
+      "fix": "Rewrote 5→8 lines (5 removed) | Also: 1. If a controller returns a not-ready (no current; shall retry the request with backoff.",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9904,7 +9904,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/requirements.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 6\u21929 lines (2 removed)",
+      "fix": "Rewrote 6→9 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9936,7 +9936,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/design.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 20\u219227 lines (3 removed) | Also: - On every reply, copy `reply.status` and **deep-c; with the reply \u2014 see request.c:243-250 hazard) + ` | Also: - Preconditions: `ctx` initialized; `conf->nmaster; exhaustion returns `-E_XCE_NOT_READY`; ctx left us",
+      "fix": "Rewrote 20→27 lines (3 removed) | Also: - On every reply, copy `reply.status` and **deep-c; with the reply — see request.c:243-250 hazard) + ` | Also: - Preconditions: `ctx` initialized; `conf->nmaster; exhaustion returns `-E_XCE_NOT_READY`; ctx left us",
       "tags": [
         "auto-detected",
         "refactor",
@@ -9952,7 +9952,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/design.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 6\u219210 lines (4 removed)",
+      "fix": "Rewrote 6→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10000,7 +10000,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/research.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u219210 lines (4 removed)",
+      "fix": "Rewrote 4→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10016,7 +10016,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/design.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 12\u219220 lines (2 removed) | Also: F->>E: reconnect to address; F->>E: reconnect to next master | Also: | 5.1, 5.3 | Reads+writes; no silent drop | Xcecli; | XcecliRetryLoop | client (`client.c`) | `do/whil | Also: - `src/lib/client.c` \u2014 wrap each `xcecli_*` op bod; (xcecli_retry_next(ac,&rc,is_write,&st));` loop; a",
+      "fix": "Rewrote 12→20 lines (2 removed) | Also: F->>E: reconnect to address; F->>E: reconnect to next master | Also: | 5.1, 5.3 | Reads+writes; no silent drop | Xcecli; | XcecliRetryLoop | client (`client.c`) | `do/whil | Also: - `src/lib/client.c` — wrap each `xcecli_*` op bod; (xcecli_retry_next(ac,&rc,is_write,&st));` loop; a",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10048,7 +10048,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/libxce-failover/tasks.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u21923 lines (3 removed)",
+      "fix": "Rewrote 3→3 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10064,7 +10064,7 @@
       "error_message": "Wrong reference: address should be hint",
       "file": ".kiro/specs/libxce-failover/tasks.md",
       "root_cause": "Used \"address\" instead of \"hint\"",
-      "fix": "Changed address \u2192 hint",
+      "fix": "Changed address → hint",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10080,7 +10080,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client.c",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 22\u219210 lines (11 removed)",
+      "fix": "Rewrote 22→10 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10096,7 +10096,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/request.c",
       "root_cause": "81 lines replaced/restructured",
-      "fix": "Rewrote 106\u219214 lines (81 removed)",
+      "fix": "Rewrote 106→14 lines (81 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10112,7 +10112,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/request.h",
       "root_cause": "22 lines replaced/restructured",
-      "fix": "Rewrote 40\u219217 lines (22 removed)",
+      "fix": "Rewrote 40→17 lines (22 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10128,7 +10128,7 @@
       "error_message": "Wrong reference: XCE_MAXHOST_LEN should be XCE_MAXHOSTNAME_LEN",
       "file": ".kiro/specs/libxce-failover/design.md",
       "root_cause": "Used \"XCE_MAXHOST_LEN\" instead of \"XCE_MAXHOSTNAME_LEN\"",
-      "fix": "Changed XCE_MAXHOST_LEN \u2192 XCE_MAXHOSTNAME_LEN",
+      "fix": "Changed XCE_MAXHOST_LEN → XCE_MAXHOSTNAME_LEN",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10160,7 +10160,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client_failover.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 13\u219223 lines (4 removed)",
+      "fix": "Rewrote 13→23 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10192,7 +10192,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/xce/client_failover.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 7\u21923 lines (3 removed) | Also: * EndpointRotator \u2014 choose the next connect target; *",
+      "fix": "Rewrote 7→3 lines (3 removed) | Also: * EndpointRotator — choose the next connect target; *",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10208,7 +10208,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client_failover.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (2 removed)",
+      "fix": "Rewrote 3→4 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10240,7 +10240,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client_failover.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219221 lines (2 removed)",
+      "fix": "Rewrote 9→21 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10272,7 +10272,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client_internal.h",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 10\u21927 lines (6 removed)",
+      "fix": "Rewrote 10→7 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10304,7 +10304,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client_failover.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 35\u219253 lines (5 removed)",
+      "fix": "Rewrote 35→53 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10336,7 +10336,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/client.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21927 lines (2 removed)",
+      "fix": "Rewrote 5→7 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10400,7 +10400,7 @@
       "error_message": "Wrong reference: test_p1_integration should be test_join_redirect",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_p1_integration\" instead of \"test_join_redirect\"",
-      "fix": "Changed test_p1_integration \u2192 test_join_redirect",
+      "fix": "Changed test_p1_integration → test_join_redirect",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10416,7 +10416,7 @@
       "error_message": "Wrong reference: test_recover_resets_err_state_to_run should be test_decide_jitter_staggers_many_clients",
       "file": "src/lib/testsuite/test_libxce_retry.c",
       "root_cause": "Used \"test_recover_resets_err_state_to_run\" instead of \"test_decide_jitter_staggers_many_clients\"",
-      "fix": "Changed test_recover_resets_err_state_to_run \u2192 test_decide_jitter_staggers_many_clients",
+      "fix": "Changed test_recover_resets_err_state_to_run → test_decide_jitter_staggers_many_clients",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10429,7 +10429,7 @@
     {
       "id": "bug-609",
       "timestamp": "2026-06-17T04:45:00Z",
-      "error_message": "After primary killed, libxce client xce_joblist/jobsubmit returns 'Invalid argument' (-EINVAL) on every fresh call \u2014 transparent failover did not engage",
+      "error_message": "After primary killed, libxce client xce_joblist/jobsubmit returns 'Invalid argument' (-EINVAL) on every fresh call — transparent failover did not engage",
       "file": "src/lib/client_failover.c",
       "root_cause": "handle_disconnect leaves xce_ctx_t.state=XCE_CTX_ERR after the primary's connection drops; the per-op xceapi guard (xceapi.c:14) returns -EINVAL when state!=XCE_CTX_RUN, BEFORE the op reaches a primary. xcecli_retry_decide classified -EINVAL as TERMINAL (non-retriable), so the failover loop bailed without rotating/recovering. The ctx->state ERR->RUN recovery only ran AFTER a rotate, which a terminal classification never triggered. Surfaced by the live 3-node E2E (task 6.2); the unit tests fed status codes directly to decide() and bypassed the real guard, so they missed it.",
       "fix": "In xcecli_retry_decide, before classifying *rc, detect ac->ctx.state==XCE_CTX_ERR (known-dead connection) and treat it as a prompt transport-style failover cause (XCE_FO_RETRY_NOW, no backoff) regardless of *rc, so the loop rotates+recovers. On budget exhaustion surface -E_XCE_NOT_READY (cluster-not-ready), never -EINVAL. Regression: test_decide_known_dead_ctx_retries_not_terminal.",
@@ -10450,10 +10450,10 @@
     {
       "id": "bug-610",
       "timestamp": "2026-06-17T15:00:00Z",
-      "error_message": "ASan SEGV in endpoint_connect (netio.c:672) via xce_failover_rotate \u2192 xcecli_retry_next \u2192 xcecli_joblist during live master failover (NULL ep->iomgr deref)",
+      "error_message": "ASan SEGV in endpoint_connect (netio.c:672) via xce_failover_rotate → xcecli_retry_next → xcecli_joblist during live master failover (NULL ep->iomgr deref)",
       "file": "src/lib/client_failover.c",
-      "root_cause": "xce_failover_rotate reconnected via endpoint_fini + endpoint_init + endpoint_connect, but endpoint_init (do_endpoint_init) resets the endpoint struct including ep->iomgr, and the rotate never re-bound it. The client's endpoint gets ep->iomgr = &ctx->iomgr only via xce_ctx_set_endpoint (called once in xcecli_start). endpoint_connect derefs iomgr->ssl_ctx when ep->ssl==NULL (true after endpoint_fini frees the SSL) \u2192 NULL deref crash. Also the rotate never re-set owner/msg_handler/err_handler nor iomgr_monitor'd the new fd, so even without the crash the reconnected endpoint would not route replies. Pure unit tests could not exercise the live socket/iomgr path; only the live failover E2E hit it.",
-      "fix": "Added xce_ctx_reconnect(ctx,host,port) in xcectx.c (where static handle_msg/handle_disconnect live) that mirrors the connection-establishment of xcecli_start/xce_ctx_start without restarting iomgr/vtaskmgr or touching ctx->state: endpoint_fini \u2192 endpoint_init \u2192 endpoint_set_peer \u2192 re-bind ep->iomgr=&ctx->iomgr \u2192 endpoint_connect \u2192 re-set owner+msg/err handlers \u2192 iomgr_monitor. xce_failover_rotate now delegates the reconnect to it.",
+      "root_cause": "xce_failover_rotate reconnected via endpoint_fini + endpoint_init + endpoint_connect, but endpoint_init (do_endpoint_init) resets the endpoint struct including ep->iomgr, and the rotate never re-bound it. The client's endpoint gets ep->iomgr = &ctx->iomgr only via xce_ctx_set_endpoint (called once in xcecli_start). endpoint_connect derefs iomgr->ssl_ctx when ep->ssl==NULL (true after endpoint_fini frees the SSL) → NULL deref crash. Also the rotate never re-set owner/msg_handler/err_handler nor iomgr_monitor'd the new fd, so even without the crash the reconnected endpoint would not route replies. Pure unit tests could not exercise the live socket/iomgr path; only the live failover E2E hit it.",
+      "fix": "Added xce_ctx_reconnect(ctx,host,port) in xcectx.c (where static handle_msg/handle_disconnect live) that mirrors the connection-establishment of xcecli_start/xce_ctx_start without restarting iomgr/vtaskmgr or touching ctx->state: endpoint_fini → endpoint_init → endpoint_set_peer → re-bind ep->iomgr=&ctx->iomgr → endpoint_connect → re-set owner+msg/err handlers → iomgr_monitor. xce_failover_rotate now delegates the reconnect to it.",
       "tags": [
         "libxce",
         "failover",
@@ -10493,7 +10493,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/netio.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 25\u219239 lines (3 removed)",
+      "fix": "Rewrote 25→39 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10509,7 +10509,7 @@
       "error_message": "Wrong reference: 611 should be 646",
       "file": "src/lib/testsuite/test_netio_arm_failure.c",
       "root_cause": "Used \"611\" instead of \"646\"",
-      "fix": "Changed 611 \u2192 646",
+      "fix": "Changed 611 → 646",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10525,7 +10525,7 @@
       "error_message": "Wrong reference: 611 should be 646",
       "file": "src/lib/netio.c",
       "root_cause": "Used \"611\" instead of \"646\"",
-      "fix": "Changed 611 \u2192 646",
+      "fix": "Changed 611 → 646",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10567,7 +10567,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/netio.c",
       "root_cause": "13 lines replaced/restructured",
-      "fix": "Rewrote 48\u219266 lines (13 removed)",
+      "fix": "Rewrote 48→66 lines (13 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10623,9 +10623,9 @@
     {
       "id": "bug-650",
       "timestamp": "2026-06-17T18:30:00Z",
-      "error_message": "xce_test jobsub hangs in cbuf_get (xceapi.c:304) after failover even with bug-646/648 deployed. Log shows 'endpoint marked dead' (bug-646 firing) then a permanent hang; target primary (ctrl-2) is fully idle (no vtask in handle_jobsubmit) and the client fd is an unconnected TCP socket \u2014 the request was never transmitted yet the client waits for a reply forever.",
+      "error_message": "xce_test jobsub hangs in cbuf_get (xceapi.c:304) after failover even with bug-646/648 deployed. Log shows 'endpoint marked dead' (bug-646 firing) then a permanent hang; target primary (ctrl-2) is fully idle (no vtask in handle_jobsubmit) and the client fd is an unconnected TCP socket — the request was never transmitted yet the client waits for a reply forever.",
       "file": "src/lib/request.c",
-      "root_cause": "xce_request() and the 5 other request.c senders (xce_reply, xce_replconfigpush_req_raw, xce_wal_batch_req_raw, xce_snapshot_chunk_req_raw, xce_replconfig_reply_raw) called endpoint_enq(ep,&pkt->link) and IGNORED its return, always `return 0`. So when the transport was dead, endpoint_enq() correctly returned <0 and ran handle_error() (bug-646 fix) \u2014 but xce_request() swallowed that <0 and reported success. xce_jobsubmit() (xceapi.c:299-304) then saw rc>=0 and fell through to the BLOCKING cbuf_get(); the request was never flushed (server idle) and when err_handler was NULL after a failed reconnect, handle_disconnect never injected -ECONNRESET, so nothing woke the waiter. The bug-646 netio fix was defeated one layer up: the request layer reported success on a failed send. This was the missing link making every prior netio fix insufficient for the live hang.",
+      "root_cause": "xce_request() and the 5 other request.c senders (xce_reply, xce_replconfigpush_req_raw, xce_wal_batch_req_raw, xce_snapshot_chunk_req_raw, xce_replconfig_reply_raw) called endpoint_enq(ep,&pkt->link) and IGNORED its return, always `return 0`. So when the transport was dead, endpoint_enq() correctly returned <0 and ran handle_error() (bug-646 fix) — but xce_request() swallowed that <0 and reported success. xce_jobsubmit() (xceapi.c:299-304) then saw rc>=0 and fell through to the BLOCKING cbuf_get(); the request was never flushed (server idle) and when err_handler was NULL after a failed reconnect, handle_disconnect never injected -ECONNRESET, so nothing woke the waiter. The bug-646 netio fix was defeated one layer up: the request layer reported success on a failed send. This was the missing link making every prior netio fix insufficient for the live hang.",
       "fix": "All six request.c senders propagate the enq result: `int enq_rc = endpoint_enq(ep,&pkt->link); return (enq_rc < 0) ? enq_rc : 0;`. A failed send now returns <0 through xce_jobsubmit_req -> xce_jobsubmit, which returns before cbuf_get; the failover loop classifies the transport error and rotates instead of blocking on a reply that never arrives. TDD: test_request_send_propagation.c builds an OPCode_nop request (encodes OK) on a dead endpoint (EPOLL_CTL_MOD ENOENT) and asserts xce_request returns <0 (verified red with old `return 0`, green with fix). libxce 169/0; controller_unit_test links clean.",
       "tags": [
         "libxce",
@@ -10651,7 +10651,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/netio.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 14\u219219 lines (8 removed)",
+      "fix": "Rewrote 14→19 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10683,7 +10683,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/testsuite/test_netio_arm_failure.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 11\u219213 lines (3 removed)",
+      "fix": "Rewrote 11→13 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10699,7 +10699,7 @@
       "error_message": "Wrong reference: test_enq_arm_failure_is_loud_and_fires_errhandler should be test_enq_arm_failure_is_loud_no_errhandler",
       "file": "src/lib/testsuite/test_netio_arm_failure.c",
       "root_cause": "Used \"test_enq_arm_failure_is_loud_and_fires_errhandler\" instead of \"test_enq_arm_failure_is_loud_no_errhandler\"",
-      "fix": "Changed test_enq_arm_failure_is_loud_and_fires_errhandler \u2192 test_enq_arm_failure_is_loud_no_errhandler",
+      "fix": "Changed test_enq_arm_failure_is_loud_and_fires_errhandler → test_enq_arm_failure_is_loud_no_errhandler",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -10714,7 +10714,7 @@
       "timestamp": "2026-06-17T19:10:00Z",
       "error_message": "Controller (primary) self-deadlocks on ha->lock after bug-646/650 deploy: jobsub now works, but the controller freezes. gdb shows Thread 3 in primary_heartbeat_fn holding ha->lock (owner=self) and re-acquiring it via xce_nop_req -> xce_request -> endpoint_enq -> handle_error -> vote_ep_err_handler (ha.c:3478); Thread 9 (io_worker) also blocked on the same ha->lock. Whole controller frozen.",
       "file": "src/lib/netio.c",
-      "root_cause": "REGRESSION from bug-646: endpoint_enq() invoked handle_error() synchronously on the send path when the poll arm failed. handle_error() calls the endpoint's err_handler, which on a controller vote endpoint is vote_ep_err_handler() \u2014 it locks ha->lock. But endpoint_enq runs on the CALLER's thread, and the controller's primary_heartbeat_fn already holds ha->lock when it sends heartbeat NOPs. Non-recursive mutex -> self-deadlock. The err_handler is contractually an io_worker-thread callback (off an epoll error event, holding no caller locks); calling it from the synchronous send path violated that. With bug-650 now propagating the enq error up the return chain, the handle_error call in endpoint_enq was both redundant and harmful.",
+      "root_cause": "REGRESSION from bug-646: endpoint_enq() invoked handle_error() synchronously on the send path when the poll arm failed. handle_error() calls the endpoint's err_handler, which on a controller vote endpoint is vote_ep_err_handler() — it locks ha->lock. But endpoint_enq runs on the CALLER's thread, and the controller's primary_heartbeat_fn already holds ha->lock when it sends heartbeat NOPs. Non-recursive mutex -> self-deadlock. The err_handler is contractually an io_worker-thread callback (off an epoll error event, holding no caller locks); calling it from the synchronous send path violated that. With bug-650 now propagating the enq error up the return chain, the handle_error call in endpoint_enq was both redundant and harmful.",
       "fix": "endpoint_enq() no longer calls handle_error(); on arm failure it just returns a RETRIABLE -ECONNRESET. The caller propagates it (request.c senders return it -> client failover classifies ECONNRESET as RETRY_NOW and rotates; controller heartbeat path simply gets the error, no lock re-entry). The real teardown stays on the io_worker thread (handle_input/handle_output -> io_handler -> handle_error), which holds no caller locks. Updated test_netio_arm_failure.c: endpoint_enq must return <0 AND must NOT invoke the err_handler (g_err_count==0). libxce 169/0; controller_unit_test links clean.",
       "tags": [
         "libxce",
@@ -10772,8 +10772,8 @@
       "timestamp": "2026-06-17T22:00:00Z",
       "error_message": "Failover election takes minutes (11+ PreVote rounds) to converge. A standby keeps denying a legitimately-higher-term candidate's PreVote with reason=fresh_heartbeat for ~2.5 min AFTER its primary died (ctrl-3 killed 21:44:14, ctrl-2 logs 'PreVote DENIED ... reason=fresh_heartbeat (my_term=3)' until 21:46:58).",
       "file": "src/controller/ha.c",
-      "root_cause": "The PreVote/vote eligibility gate raft_cb_vote_eligible (ha.c:311) denied on `role==CTRL_STANDBY && ha_heartbeat_is_fresh(ha)` \u2014 checking freshness ALONE. ha_heartbeat_is_fresh derives from ha->last_activity, but ha_arm_heartbeat_timeout_vtask resets last_activity=now on EVERY watchdog (re-)arm, and ha_prevote_rearm_liveness re-arms it after every lost PreVote. So a node with NO live primary perpetually refreshes its own 'fresh heartbeat' each failover cycle and denies all other candidates (reason=fresh_heartbeat), blocking convergence until it happens to restart. The sibling gate in handle_request_vote (ha.c:2205) already required `primary_ctrl_fd >= 0 && is_fresh`; raft_cb_vote_eligible was missing the primary_ctrl_fd guard. The existing fresh-deny tests even documented the intent ('the deny gate requires a live connection AND a fresh heartbeat', set primary_ctrl_fd=999), but production didn't enforce it.",
-      "fix": "Added `ha->primary_ctrl_fd >= 0 &&` to the ha.c:311 eligibility gate (mirrors ha.c:2205). primary_ctrl_fd is -1 on init / after the primary RDHUPs / after the liveness watchdog fires, and a real fd only via config_repl.c:1451 (first ctrlhello from the live primary) \u2014 so a dead/absent primary no longer masquerades as fresh and the standby GRANTS, converging in ~1 round. Kept cluster.c:526 denial-reason logging in sync. TDD: test_pre_vote_dead_primary_grants_despite_fresh_activity (fresh last_activity + primary_ctrl_fd=-1 -> GRANT); verified RED (Expected 1 Was 0) without the guard, GREEN with it, and the 3 existing fresh-deny tests (fd=999) unaffected. Full controller suite + libxce 169/0, zero regressions.",
+      "root_cause": "The PreVote/vote eligibility gate raft_cb_vote_eligible (ha.c:311) denied on `role==CTRL_STANDBY && ha_heartbeat_is_fresh(ha)` — checking freshness ALONE. ha_heartbeat_is_fresh derives from ha->last_activity, but ha_arm_heartbeat_timeout_vtask resets last_activity=now on EVERY watchdog (re-)arm, and ha_prevote_rearm_liveness re-arms it after every lost PreVote. So a node with NO live primary perpetually refreshes its own 'fresh heartbeat' each failover cycle and denies all other candidates (reason=fresh_heartbeat), blocking convergence until it happens to restart. The sibling gate in handle_request_vote (ha.c:2205) already required `primary_ctrl_fd >= 0 && is_fresh`; raft_cb_vote_eligible was missing the primary_ctrl_fd guard. The existing fresh-deny tests even documented the intent ('the deny gate requires a live connection AND a fresh heartbeat', set primary_ctrl_fd=999), but production didn't enforce it.",
+      "fix": "Added `ha->primary_ctrl_fd >= 0 &&` to the ha.c:311 eligibility gate (mirrors ha.c:2205). primary_ctrl_fd is -1 on init / after the primary RDHUPs / after the liveness watchdog fires, and a real fd only via config_repl.c:1451 (first ctrlhello from the live primary) — so a dead/absent primary no longer masquerades as fresh and the standby GRANTS, converging in ~1 round. Kept cluster.c:526 denial-reason logging in sync. TDD: test_pre_vote_dead_primary_grants_despite_fresh_activity (fresh last_activity + primary_ctrl_fd=-1 -> GRANT); verified RED (Expected 1 Was 0) without the guard, GREEN with it, and the 3 existing fresh-deny tests (fd=999) unaffected. Full controller suite + libxce 169/0, zero regressions.",
       "tags": [
         "controller",
         "ha",
@@ -10795,7 +10795,7 @@
       "error_message": "3-node failover test lost committed jobs: 7 earliest JobIds (WAL LSN<=20), majority-ACKed and survived first failover, permanently gone after a restarted node with near-empty WAL won election. joblist dropped from 10 to 3.",
       "file": "src/controller/persist.c, src/controller/commit.c, src/controller/repl.c",
       "root_cause": "'committed' does not imply 'durable'. WAL fsync is asynchronous (persist.c:173 fsync_worker, timer wal_sync_ms); persist_append and the standby WalAck path do NOT fdatasync before ACK. commit_on_ack (commit.c:303) advances committed_lsn on majority ACK = OS page cache only, durable on zero disks. On kill+restart, killed nodes lose the not-yet-fsynced tail; persist_recover hits CRC break at zeroed region (prev_crc=00000000, offset 40) and truncates replay to ~0 entries, yet the hollow node stays eligible, wins election under degraded required=1 quorum (PreVote+freshness gate cannot fence it because the committed entries were durable on nobody), self-promotes advertising committed_lsn=21 over an empty job table, and the node holding the real data converges DOWN. Violates Leader-Completeness assumption (majority-ACK != durable-on-majority) in src/controller/CLAUDE.md.",
-      "fix": "NOT YET FIXED. Discovery -> new spec ha-commit-durability (Path C, brief written). R1 fsync-before-ACK (standby fdatasync before WalAck, primary self-count only after local fdatasync, committed_lsn advances only on durable majority, group-commit to bound latency). R2 promotion fence (WAL CRC/replay failure => ineligible to lead until caught up, FATAL not silent truncate; never lead below known committed high-water even under degraded quorum). Live E2E reproduces via xce_test jobsub + primary kills on /xce-deploy-ha. DETERMINISTIC REPRO (task 1.3, 2026-06-18): `bash src/tools/test-commit-durability.sh --deterministic` launches the cluster with --wal-sync-ms 30000 (plumbed via deploy-ha.sh start.sh `$*` passthrough, EXTRA_CTRL_ARGS) so the primary's fsync_worker never fires in-window -> every committed entry is page-cache-only on the primary (majority_candidate_locked counts cap=highest_appended_lsn=current_lsn-1, NOT durable). It then drives rolling PRIMARY kills (each right after committing to that primary) + restart, so hollow nodes re-lead. RED CONFIRMED: 6-round run lost the 3 EARLIEST committed JobIds permanently (rounds 4 and 6 + final check), Results 5 passed/3 failed, exit=1 \u2014 matching the incident signature (earliest jobs gone). NOTE: a single double-kill does NOT repro \u2014 this codebase enforces strict majority (lone survivor will NOT self-elect: log shows 'no single-voter primary within 40s'); loss needs the ROLLING/term-accumulating path the incident used. Evidence log: dur-det-run.log in worktree.",
+      "fix": "NOT YET FIXED. Discovery -> new spec ha-commit-durability (Path C, brief written). R1 fsync-before-ACK (standby fdatasync before WalAck, primary self-count only after local fdatasync, committed_lsn advances only on durable majority, group-commit to bound latency). R2 promotion fence (WAL CRC/replay failure => ineligible to lead until caught up, FATAL not silent truncate; never lead below known committed high-water even under degraded quorum). Live E2E reproduces via xce_test jobsub + primary kills on /xce-deploy-ha. DETERMINISTIC REPRO (task 1.3, 2026-06-18): `bash src/tools/test-commit-durability.sh --deterministic` launches the cluster with --wal-sync-ms 30000 (plumbed via deploy-ha.sh start.sh `$*` passthrough, EXTRA_CTRL_ARGS) so the primary's fsync_worker never fires in-window -> every committed entry is page-cache-only on the primary (majority_candidate_locked counts cap=highest_appended_lsn=current_lsn-1, NOT durable). It then drives rolling PRIMARY kills (each right after committing to that primary) + restart, so hollow nodes re-lead. RED CONFIRMED: 6-round run lost the 3 EARLIEST committed JobIds permanently (rounds 4 and 6 + final check), Results 5 passed/3 failed, exit=1 — matching the incident signature (earliest jobs gone). NOTE: a single double-kill does NOT repro — this codebase enforces strict majority (lone survivor will NOT self-elect: log shows 'no single-voter primary within 40s'); loss needs the ROLLING/term-accumulating path the incident used. Evidence log: dur-det-run.log in worktree.",
       "tags": [
         "controller",
         "ha",
@@ -10841,7 +10841,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/tools/test-commit-durability.sh",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 19\u219235 lines (4 removed)",
+      "fix": "Rewrote 19→35 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10872,7 +10872,7 @@
       "timestamp": "2026-06-18T00:04:40.582Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/brief.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -10937,7 +10937,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/design.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 6\u21926 lines (5 removed) | Also: - **Persistence & consistency:** `durable_lsn` adv; - **Concurrency strategy:** advanced under `p->loc",
+      "fix": "Rewrote 6→6 lines (5 removed) | Also: - **Persistence & consistency:** `durable_lsn` adv; - **Concurrency strategy:** advanced under `p->loc",
       "tags": [
         "auto-detected",
         "refactor",
@@ -10952,7 +10952,7 @@
       "timestamp": "2026-06-18T03:14:30.410Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -10985,7 +10985,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/tasks.md",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 18\u219225 lines (7 removed) | Also: - _Depends: 4.1, 3.3_; - Before a member becomes primary, refuse promotio",
+      "fix": "Rewrote 18→25 lines (7 removed) | Also: - _Depends: 4.1, 3.3_; - Before a member becomes primary, refuse promotio",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11017,7 +11017,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/tasks.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u21926 lines (2 removed)",
+      "fix": "Rewrote 5→6 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11032,7 +11032,7 @@
       "timestamp": "2026-06-18T03:59:55.411Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11065,7 +11065,7 @@
       "error_message": "Wrong reference: myconf_t should be uint32_t",
       "file": "src/include/myconf.h",
       "root_cause": "Used \"myconf_t\" instead of \"uint32_t\"",
-      "fix": "Changed myconf_t \u2192 uint32_t",
+      "fix": "Changed myconf_t → uint32_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -11112,7 +11112,7 @@
       "timestamp": "2026-06-18T05:00:22.007Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/tools/test-commit-durability.sh",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11129,7 +11129,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/tools/test-commit-durability.sh",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 85\u2192202 lines (4 removed)",
+      "fix": "Rewrote 85→202 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11160,7 +11160,7 @@
       "timestamp": "2026-06-18T05:07:20.589Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/tools/test-commit-durability.sh",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11192,7 +11192,7 @@
       "timestamp": "2026-06-18T05:42:21.676Z",
       "error_message": "Missing error handling in advances",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11225,7 +11225,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 41\u2192152 lines (7 removed) | Also: /* Wake any WAIT caller blocked on the commit eval; * advanced, so a majority candidate may now cover ",
+      "fix": "Rewrote 41→152 lines (7 removed) | Also: /* Wake any WAIT caller blocked on the commit eval; * advanced, so a majority candidate may now cover ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11256,7 +11256,7 @@
       "timestamp": "2026-06-18T05:55:28.140Z",
       "error_message": "Missing error handling in FAILS",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11273,7 +11273,7 @@
       "error_message": "Wrong reference: else should be RUN_TEST",
       "file": "src/controller/testsuite/test_commit_durability.c",
       "root_cause": "Used \"else\" instead of \"RUN_TEST\"",
-      "fix": "Changed else \u2192 RUN_TEST",
+      "fix": "Changed else → RUN_TEST",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -11289,7 +11289,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 24\u219252 lines (5 removed) | Also: * already joined and will not advance it again). *; fdatasync(p->wal_fd);",
+      "fix": "Rewrote 24→52 lines (5 removed) | Also: * already joined and will not advance it again). *; fdatasync(p->wal_fd);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11404,7 +11404,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/commit.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 12\u219224 lines (2 removed)",
+      "fix": "Rewrote 12→24 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11435,7 +11435,7 @@
       "timestamp": "2026-06-18T06:15:12.451Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_engine.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11467,7 +11467,7 @@
       "timestamp": "2026-06-18T06:16:09.746Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11484,7 +11484,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_engine.c",
       "root_cause": "40 lines replaced/restructured",
-      "fix": "Rewrote 49\u21926 lines (40 removed)",
+      "fix": "Rewrote 49→6 lines (40 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11539,7 +11539,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u219222 lines (2 removed) | Also: int fsrc = fdatasync(p->wal_fd);; if (fsrc != 0 || flusher_fsync_forced_fail(p)) {",
+      "fix": "Rewrote 3→22 lines (2 removed) | Also: int fsrc = fdatasync(p->wal_fd);; if (fsrc != 0 || flusher_fsync_forced_fail(p)) {",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11587,7 +11587,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_durability.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219210 lines (4 removed)",
+      "fix": "Rewrote 7→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11602,7 +11602,7 @@
       "timestamp": "2026-06-18T06:50:13.989Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11635,7 +11635,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219210 lines (2 removed)",
+      "fix": "Rewrote 8→10 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11651,7 +11651,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 9\u21926 lines (5 removed) | Also: /* RED-PHASE: invariant assert DISABLED to let the; * the over-advance instead of aborting the binary.",
+      "fix": "Rewrote 9→6 lines (5 removed) | Also: /* RED-PHASE: invariant assert DISABLED to let the; * the over-advance instead of aborting the binary.",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11682,7 +11682,7 @@
       "timestamp": "2026-06-18T07:15:03.763Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11698,7 +11698,7 @@
       "timestamp": "2026-06-18T07:15:30.633Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/include/persist.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11715,7 +11715,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 10\u219223 lines (2 removed) | Also: break; /* clean end of segment */; break; /* truncated or pre-allocated zeros */",
+      "fix": "Rewrote 10→23 lines (2 removed) | Also: break; /* clean end of segment */; break; /* truncated or pre-allocated zeros */",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11731,7 +11731,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_durability.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 12\u219214 lines (2 removed)",
+      "fix": "Rewrote 12→14 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11746,7 +11746,7 @@
       "timestamp": "2026-06-18T07:51:32.985Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11762,8 +11762,8 @@
       "timestamp": "2026-06-18T07:52:20.595Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* task 3.2 \u2014 Boot Policy Decision Table skeletons (IGNORED,; * 3.3/4.3). Registered so each row is reported as IGNORED, n",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* task 3.2 — Boot Policy Decision Table skeletons (IGNORED,; * 3.3/4.3). Registered so each row is reported as IGNORED, n",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -11778,7 +11778,7 @@
       "timestamp": "2026-06-18T08:04:18.857Z",
       "error_message": "Missing error handling in enum",
       "file": "src/include/persist.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* Bounded catch-up window (ha-commit-durability task 3.3, R; * The FINITE deadline a recovery-truncated / behind member i",
       "tags": [
         "auto-detected",
@@ -11794,7 +11794,7 @@
       "timestamp": "2026-06-18T08:05:05.233Z",
       "error_message": "Missing error handling in of",
       "file": "src/controller/persist.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11811,7 +11811,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_durability.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219251 lines (4 removed) | Also: TEST_IGNORE_MESSAGE(; \"row 4b (CLEAN + below + no peer + bounded catch-u",
+      "fix": "Rewrote 7→51 lines (4 removed) | Also: TEST_IGNORE_MESSAGE(; \"row 4b (CLEAN + below + no peer + bounded catch-u",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11826,7 +11826,7 @@
       "timestamp": "2026-06-18T08:07:00.123Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11842,7 +11842,7 @@
       "timestamp": "2026-06-18T08:18:57.946Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11874,7 +11874,7 @@
       "timestamp": "2026-06-18T08:32:37.878Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/design.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -11890,7 +11890,7 @@
       "timestamp": "2026-06-18T08:39:54.889Z",
       "error_message": "Incorrect value in code",
       "file": ".kiro/specs/ha-commit-durability/design.md",
-      "root_cause": "Had `durable_floor \u2264 applied_lsn`",
+      "root_cause": "Had `durable_floor ≤ applied_lsn`",
       "fix": "Changed to `applied_lsn`",
       "tags": [
         "auto-detected",
@@ -11907,7 +11907,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 9\u219214 lines (3 removed) | Also: /* RED-DEMO (temporary): simulate the PRE-FIX bug ; * with a stale-high learned value so the candidate",
+      "fix": "Rewrote 9→14 lines (3 removed) | Also: /* RED-DEMO (temporary): simulate the PRE-FIX bug ; * with a stale-high learned value so the candidate",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11923,7 +11923,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 11\u219217 lines (7 removed)",
+      "fix": "Rewrote 11→17 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11939,7 +11939,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/cluster.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 10\u219215 lines (6 removed) | Also: uint64_t local_lsn = (uint64_t)atomic_load_explici; &c->ha.applied_lsn, memory_order_acquire);",
+      "fix": "Rewrote 10→15 lines (6 removed) | Also: uint64_t local_lsn = (uint64_t)atomic_load_explici; &c->ha.applied_lsn, memory_order_acquire);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -11986,7 +11986,7 @@
       "timestamp": "2026-06-18T09:07:33.096Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12002,8 +12002,8 @@
       "timestamp": "2026-06-18T09:08:09.215Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* \u2500\u2500 ha-commit-durability task 4.3: pre-promotion eligibili; * Refuse promotion BEFORE the node becomes authoritative CTR",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* ── ha-commit-durability task 4.3: pre-promotion eligibili; * Refuse promotion BEFORE the node becomes authoritative CTR",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -12018,7 +12018,7 @@
       "timestamp": "2026-06-18T09:09:28.348Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* Empty first-boot WAL: durable=0, HWM=0 -> ELIGIBLE.  A fr; * member is not behind anything and must be promotable (no f",
       "tags": [
         "auto-detected",
@@ -12035,7 +12035,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_durability.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 7\u219236 lines (4 removed) | Also: TEST_IGNORE_MESSAGE(; \"row 3 (TRUNCATED + peer + catch-up ok -> FENCE+CA | Also: TEST_IGNORE_MESSAGE(; \"row 5 (snapshot-sentinel CLEAN + below + peer -> ",
+      "fix": "Rewrote 7→36 lines (4 removed) | Also: TEST_IGNORE_MESSAGE(; \"row 3 (TRUNCATED + peer + catch-up ok -> FENCE+CA | Also: TEST_IGNORE_MESSAGE(; \"row 5 (snapshot-sentinel CLEAN + below + peer -> ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12098,7 +12098,7 @@
       "timestamp": "2026-06-18T09:49:58.840Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* Test-injectable send hook (defined in repl.c under XCE_TE; * repl_broadcast from dereferencing the dummy endpoints as r",
       "tags": [
         "auto-detected",
@@ -12114,7 +12114,7 @@
       "timestamp": "2026-06-18T10:22:00.509Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12130,7 +12130,7 @@
       "timestamp": "2026-06-18T10:25:02.673Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* ha_cancel_promotion_fence_timer: cancel a pending bounded; * (idempotent; no-op when none is armed).  Called when the m",
       "tags": [
         "auto-detected",
@@ -12146,7 +12146,7 @@
       "timestamp": "2026-06-18T10:26:12.640Z",
       "error_message": "Missing error handling in XCE_TESTING",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12163,7 +12163,7 @@
       "error_message": "Wrong operator: != should be ==",
       "file": "src/controller/ha.c",
       "root_cause": "Used \"!=\" instead of \"==\"",
-      "fix": "Changed operator != \u2192 ==",
+      "fix": "Changed operator != → ==",
       "tags": [
         "auto-detected",
         "operator-fix",
@@ -12178,8 +12178,8 @@
       "timestamp": "2026-06-18T10:30:18.073Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* task 4.4 \u2014 bounded-window catch-up before FATAL (no synch; * deferred-timer FATAL only after a real bounded failure; fe",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* task 4.4 — bounded-window catch-up before FATAL (no synch; * deferred-timer FATAL only after a real bounded failure; fe",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -12194,7 +12194,7 @@
       "timestamp": "2026-06-18T10:42:48.932Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/include/persist.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12211,7 +12211,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/persist.h",
       "root_cause": "10 lines replaced/restructured",
-      "fix": "Rewrote 17\u219227 lines (10 removed)",
+      "fix": "Rewrote 17→27 lines (10 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12226,7 +12226,7 @@
       "timestamp": "2026-06-18T10:44:38.816Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/persist.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12243,7 +12243,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 15\u219222 lines (11 removed)",
+      "fix": "Rewrote 15→22 lines (11 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12258,7 +12258,7 @@
       "timestamp": "2026-06-18T10:47:24.587Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12275,7 +12275,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u21929 lines (3 removed)",
+      "fix": "Rewrote 6→9 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12290,7 +12290,7 @@
       "timestamp": "2026-06-18T10:48:41.920Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12307,7 +12307,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/design.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u21929 lines (2 removed) | Also: | Intent | Distinguish clean log end from corrupti; - FATAL policy: if a recovery-truncated member can | Also: > **Status:** DECISION recorded (task 3.2). No pro; **Decision (Req 2.2, 2.4):** A member that boots w",
+      "fix": "Rewrote 8→9 lines (2 removed) | Also: | Intent | Distinguish clean log end from corrupti; - FATAL policy: if a recovery-truncated member can | Also: > **Status:** DECISION recorded (task 3.2). No pro; **Decision (Req 2.2, 2.4):** A member that boots w",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12338,7 +12338,7 @@
       "timestamp": "2026-06-18T11:07:54.918Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/CLAUDE.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12354,7 +12354,7 @@
       "timestamp": "2026-06-18T11:08:39.844Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/steering/ha-async-io.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12370,7 +12370,7 @@
       "timestamp": "2026-06-18T11:14:25.437Z",
       "error_message": "Missing error handling in gap",
       "file": "src/controller/CLAUDE.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12400,10 +12400,10 @@
     {
       "id": "bug-760",
       "timestamp": "2026-06-18T13:00:00Z",
-      "error_message": "test_commit_barrier_rollout.c:446 test_fact_hook_append_is_retained_and_nonblocking FAIL: Expected 1 Was 0 \u2014 a covering ACK must advance committed_lsn over the retained fact (6/6 deterministic)",
+      "error_message": "test_commit_barrier_rollout.c:446 test_fact_hook_append_is_retained_and_nonblocking FAIL: Expected 1 Was 0 — a covering ACK must advance committed_lsn over the retained fact (6/6 deterministic)",
       "file": "src/controller/testsuite/test_commit_barrier_rollout.c",
       "root_cause": "ha-commit-durability task 2.2 capped the primary commit self-contribution at durable_lsn (advanced asynchronously by the demand-driven group-commit flusher) and wired a durable-advance commit-wake callback. This adjacent-spec (ha-commit-barrier-rollout) test uses a REAL persist+flusher and checks committed_lsn SYNCHRONOUSLY the instant after repl_on_ack(fact_lsn); the flusher has not yet fdatasync'd LSN1, so durable_lsn==0, self-cap==0, majority candidate==0, committed_lsn stays 0. Pre-spec the test passed (self counted the appended tip immediately). Task 2.2 primed durable_lsn in the in-memory stub fixtures (barrier_setup_vcpus) but did NOT update this real-flusher test. The implementation-note claim that this is a pre-existing /tmp-overlay fdatasync-EIO artifact is FALSE in this env: fdatasync returns rc=0 on /tmp here, and the test passed pre-spec.",
-      "fix": "FIXED \u2014 test_commit_barrier_rollout.c:445: insert persist_flush(g_fp) + assert persist_durable_lsn>=fact_lsn BEFORE repl_on_ack, so the covering ACK (commit_on_ack runs synchronously inside repl_on_ack) deterministically completes the durable majority. Mirrors task 2.2's durable_lsn priming of the in-memory barrier_setup_vcpus stubs. Verified: was 6/6 deterministic FAIL, now fact_hook PASS across 4 runs + meson controller suite Ok:1 Fail:0, all groups 0 Failures. Production was never affected (RETAIN facts have no waiter; WAIT-mode replies block on commit barrier commit.c:334).",
+      "fix": "FIXED — test_commit_barrier_rollout.c:445: insert persist_flush(g_fp) + assert persist_durable_lsn>=fact_lsn BEFORE repl_on_ack, so the covering ACK (commit_on_ack runs synchronously inside repl_on_ack) deterministically completes the durable majority. Mirrors task 2.2's durable_lsn priming of the in-memory barrier_setup_vcpus stubs. Verified: was 6/6 deterministic FAIL, now fact_hook PASS across 4 runs + meson controller suite Ok:1 Fail:0, all groups 0 Failures. Production was never affected (RETAIN facts have no waiter; WAIT-mode replies block on commit barrier commit.c:334).",
       "tags": [
         "ha-commit-durability",
         "commit-barrier-rollout",
@@ -12474,7 +12474,7 @@
       "timestamp": "2026-06-18T14:55:00.167Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/steering/error-handling.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12488,10 +12488,10 @@
     {
       "id": "bug-765",
       "timestamp": "2026-06-18T14:30:00Z",
-      "error_message": "scheduler-controller-msg-gap marked 36/36 [x] but NOT truly implemented: schedUpdateJob notify path hits the bulk CREATE path (sched_update_existing_job is dead code) \u2192 corrupts/duplicates live job state, no -ENOENT; Req 3 broken at dequeue, Req 6 stores nothing (rusage never stored).",
-      "file": "src/scheduler/ (sched_update_existing_job dead; schedUpdateJob \u2192 CREATE path)",
+      "error_message": "scheduler-controller-msg-gap marked 36/36 [x] but NOT truly implemented: schedUpdateJob notify path hits the bulk CREATE path (sched_update_existing_job is dead code) → corrupts/duplicates live job state, no -ENOENT; Req 3 broken at dequeue, Req 6 stores nothing (rusage never stored).",
+      "file": "src/scheduler/ (sched_update_existing_job dead; schedUpdateJob → CREATE path)",
       "root_cause": "Tasks were checked [x] without the dequeue/update path and rusage storage actually being wired; gap surfaced only by cross-task re-audit (per-task review missed it).",
-      "fix": "FIXED 2026-06-18 (commits 5c1f715,93124c5,080ff78,276e26c): G-8/G-4 (route notify job-update to in-place sched_update_existing_job, all mutable fields, -ENOENT no-create); G-5 (store rusage on xce_sched_job_t via sched_apply_job_rusage + free_JobRusages_ptr); G-3 (free all 5 killer op payloads with generated deep-freers); G-7 (doc reconciliation \u2014 sched_op_name stays static in scheduler.c, lib must not depend on scheduler headers); G-6 (real white-box tests: test_handlers.c 6/6 for 9.2/9.3, test_job_update.c 10/10 for 9.4/9.5/9.7, registered as meson tests). Scheduler suite 31/31 GREEN, ASAN-clean, boundary-clean. validate-impl GO. RESIDUAL (documented, non-blocking): 9.6 dequeue worker-resvals APPLY unit test (dormant path R-3 \u2014 enqueue tested), 9.8 documented compile-time absence, 9.9 log-capture gated, 9.2 -ENOMEM fault-injection.",
+      "fix": "FIXED 2026-06-18 (commits 5c1f715,93124c5,080ff78,276e26c): G-8/G-4 (route notify job-update to in-place sched_update_existing_job, all mutable fields, -ENOENT no-create); G-5 (store rusage on xce_sched_job_t via sched_apply_job_rusage + free_JobRusages_ptr); G-3 (free all 5 killer op payloads with generated deep-freers); G-7 (doc reconciliation — sched_op_name stays static in scheduler.c, lib must not depend on scheduler headers); G-6 (real white-box tests: test_handlers.c 6/6 for 9.2/9.3, test_job_update.c 10/10 for 9.4/9.5/9.7, registered as meson tests). Scheduler suite 31/31 GREEN, ASAN-clean, boundary-clean. validate-impl GO. RESIDUAL (documented, non-blocking): 9.6 dequeue worker-resvals APPLY unit test (dormant path R-3 — enqueue tested), 9.8 documented compile-time absence, 9.9 log-capture gated, 9.2 -ENOMEM fault-injection.",
       "tags": [
         "scheduler",
         "controller",
@@ -12527,7 +12527,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/scheduler/src/schedobj.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 18\u219212 lines (7 removed)",
+      "fix": "Rewrote 18→12 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12559,7 +12559,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/scheduler/src/scheduler.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 18\u219233 lines (2 removed)",
+      "fix": "Rewrote 18→33 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12575,7 +12575,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/scheduler-controller-msg-gap/tasks.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 9\u219211 lines (4 removed)",
+      "fix": "Rewrote 9→11 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12591,7 +12591,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/scheduler-controller-msg-gap/design.md",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21925 lines (2 removed) | Also: #### New function: `xce_sched_op_name`; Signature: char* xce_sched_op_name(xce_sched_op_t ",
+      "fix": "Rewrote 3→5 lines (2 removed) | Also: #### New function: `xce_sched_op_name`; Signature: char* xce_sched_op_name(xce_sched_op_t ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12607,7 +12607,7 @@
       "error_message": "Wrong reference: xce_sched_op_name should be sched_op_name",
       "file": ".kiro/specs/scheduler-controller-msg-gap/design.md",
       "root_cause": "Used \"xce_sched_op_name\" instead of \"sched_op_name\"",
-      "fix": "Changed xce_sched_op_name \u2192 sched_op_name",
+      "fix": "Changed xce_sched_op_name → sched_op_name",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -12655,7 +12655,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/scheduler/testsuite/test_handlers.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 5\u219211 lines (2 removed)",
+      "fix": "Rewrote 5→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12671,7 +12671,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/scheduler-controller-msg-gap/tasks.md",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 7\u21927 lines (7 removed)",
+      "fix": "Rewrote 7→7 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12686,8 +12686,8 @@
       "timestamp": "2026-06-19T13:00:00Z",
       "error_message": "3-node rolling-SIGKILL soak round 3: 'no new primary elected within 40s'; soak reports 'DATA LOSS 5/5 jobs vanished'. Both surviving nodes recovered RECOVER_TRUNCATED after SIGKILL (torn WAL tail) and stay permanently fenced/non-promotable even though durable_floor==cluster_hwm (they hold ALL committed data).",
       "file": "src/controller/ha.c (raft_cb_become_leader promotion fence release) + persist.c (recovery_truncated verdict stickiness); design ha-commit-durability Req 2.2/2.6 + Boot Policy Decision Table",
-      "root_cause": "A SIGKILL tears the WAL tail; on restart replay_wal hits a CRC-break/short-read at the tail -> RECOVER_TRUNCATED (sticky flag). The promotion-fence release condition requires `!recovery_truncated`, but the truncated flag is NEVER cleared by catch-up \u2014 so a node whose intact durable prefix (durable_floor) already reaches/exceeds the cluster committed high-water (durable_floor>=hwm, i.e. holds ALL committed entries; the torn tail is entirely UNCOMMITTED) stays permanently non-promotable. The design assumed 'TRUNCATED => provably below HWM', which is FALSE for a torn TAIL above the committed prefix. When all survivors are in this state (after multiple rolling failovers), none can promote => election/availability WEDGE. Observed: ctrl-1 recovery_truncated=1 durable_floor=13 cluster_hwm=13, PreVote-DENY peers reason=catch_up, indefinitely.",
-      "fix": "DATA-LOSS dimension RESOLVED by the bug-778 fix (commit 64ab210): the cold-restart loss was the CRC-chain clobber; with the chain intact, cold restart recovers all committed jobs (soak 5/5, joblist 6/6 after cold restart). The AVAILABILITY-WEDGE dimension was a CONSEQUENCE of the spurious RECOVER_TRUNCATED from the broken chain \u2014 no longer triggered (nodes now recover CLEAN; round-3 re-elects normally). RESIDUAL HARDENING (latent, not currently triggered): the promotion fence keeps recovery_truncated sticky even when durable_floor>=HWM, so a GENUINE torn-tail that leaves a node RECOVER_TRUNCATED while holding all committed data could still over-fence. Optional follow-up: clear the truncated fence when durable_floor>=cluster_hwm (the torn tail is provably uncommitted). Not blocking \u2014 the systematic trigger is gone.",
+      "root_cause": "A SIGKILL tears the WAL tail; on restart replay_wal hits a CRC-break/short-read at the tail -> RECOVER_TRUNCATED (sticky flag). The promotion-fence release condition requires `!recovery_truncated`, but the truncated flag is NEVER cleared by catch-up — so a node whose intact durable prefix (durable_floor) already reaches/exceeds the cluster committed high-water (durable_floor>=hwm, i.e. holds ALL committed entries; the torn tail is entirely UNCOMMITTED) stays permanently non-promotable. The design assumed 'TRUNCATED => provably below HWM', which is FALSE for a torn TAIL above the committed prefix. When all survivors are in this state (after multiple rolling failovers), none can promote => election/availability WEDGE. Observed: ctrl-1 recovery_truncated=1 durable_floor=13 cluster_hwm=13, PreVote-DENY peers reason=catch_up, indefinitely.",
+      "fix": "DATA-LOSS dimension RESOLVED by the bug-778 fix (commit 64ab210): the cold-restart loss was the CRC-chain clobber; with the chain intact, cold restart recovers all committed jobs (soak 5/5, joblist 6/6 after cold restart). The AVAILABILITY-WEDGE dimension was a CONSEQUENCE of the spurious RECOVER_TRUNCATED from the broken chain — no longer triggered (nodes now recover CLEAN; round-3 re-elects normally). RESIDUAL HARDENING (latent, not currently triggered): the promotion fence keeps recovery_truncated sticky even when durable_floor>=HWM, so a GENUINE torn-tail that leaves a node RECOVER_TRUNCATED while holding all committed data could still over-fence. Optional follow-up: clear the truncated fence when durable_floor>=cluster_hwm (the torn tail is provably uncommitted). Not blocking — the systematic trigger is gone.",
       "tags": [
         "ha",
         "convergence",
@@ -12742,7 +12742,7 @@
       "timestamp": "2026-06-19T13:59:32.538Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_commit_durability.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -12759,7 +12759,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/persist.h",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 5\u219212 lines (3 removed)",
+      "fix": "Rewrote 5→12 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12775,7 +12775,7 @@
       "error_message": "Wrong reference: hdr should be payload_len",
       "file": "src/controller/persist.c",
       "root_cause": "Used \"hdr\" instead of \"payload_len\"",
-      "fix": "Changed hdr \u2192 payload_len",
+      "fix": "Changed hdr → payload_len",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -12791,7 +12791,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21925 lines (2 removed)",
+      "fix": "Rewrote 3→5 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12807,7 +12807,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "8 lines replaced/restructured",
-      "fix": "Rewrote 9\u21927 lines (8 removed)",
+      "fix": "Rewrote 9→7 lines (8 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12823,7 +12823,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_repl_apply.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 11\u219213 lines (4 removed)",
+      "fix": "Rewrote 11→13 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12839,7 +12839,7 @@
       "error_message": "Wrong reference: NULL should be type",
       "file": "src/controller/testsuite/test_ha_role_lifecycle.c",
       "root_cause": "Used \"NULL\" instead of \"type\"",
-      "fix": "Changed NULL \u2192 type",
+      "fix": "Changed NULL → type",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -12855,7 +12855,7 @@
       "error_message": "xce_test jobsub prints 'jobsubmit ok: JobId: 63-15--1-1015808' (uninitialized/garbage jobid) on repeated/mid-failover submits; controller then logs 'handle_jobsubmit fail to lock job 63-15--1-...'. Client claims success with a malformed id it never got a clean ack for.",
       "file": "src/controller/testsuite/test.c (cmd_jobsub)",
       "root_cause": "On the 2nd+ submit (and during failover windows) the jobsub reply/jobid is not cleanly populated, leaving an uninitialized jobid struct; cmd_jobsub still prints 'jobsubmit ok' with the garbage id instead of verifying the controller reply status and failing. Forces E2E scripts (test-commit-durability.sh) to strict-regex-filter the 4-field id to avoid chasing phantom jobs.",
-      "fix": "PENDING \u2014 jobsub must report success ONLY on a clean ack with a valid jobid; otherwise print a typed error (REDIRECT/NOMASTER/NOT_READY/TIMEOUT) and set non-zero status. Part of the xce-test-e2e-primitives work (exit-code-as-verdict + $jobid auto-var). | STRENGTHENED 2026-06-19 (commit 8609976): `jobid != 0` gate was insufficient \u2014 a stale non-zero reply id (63-15--1-1015808) from a non-jobid reply during failover slipped through. New gate requires the echoed jobid == the locally idgen-generated jobsubmit.jobid (controller commits/echoes exactly that id, job.c:616). Surfaced by the live durability soak (task 7.2).",
+      "fix": "PENDING — jobsub must report success ONLY on a clean ack with a valid jobid; otherwise print a typed error (REDIRECT/NOMASTER/NOT_READY/TIMEOUT) and set non-zero status. Part of the xce-test-e2e-primitives work (exit-code-as-verdict + $jobid auto-var). | STRENGTHENED 2026-06-19 (commit 8609976): `jobid != 0` gate was insufficient — a stale non-zero reply id (63-15--1-1015808) from a non-jobid reply during failover slipped through. New gate requires the echoed jobid == the locally idgen-generated jobsubmit.jobid (controller commits/echoes exactly that id, job.c:616). Surfaced by the live durability soak (task 7.2).",
       "tags": [
         "xce_test",
         "jobsub",
@@ -12877,7 +12877,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "13 lines replaced/restructured",
-      "fix": "Rewrote 27\u219211 lines (13 removed) | Also: *; * XCE_TEST_VERDICT_FLAG gates the new exit-code/ab",
+      "fix": "Rewrote 27→11 lines (13 removed) | Also: *; * XCE_TEST_VERDICT_FLAG gates the new exit-code/ab",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12909,7 +12909,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 9\u21923 lines (5 removed)",
+      "fix": "Rewrote 9→3 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12925,7 +12925,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 7\u21923 lines (5 removed) | Also: #if JOBSUB_RED_FORCE_SUCCESS; /* RED only: simulate a non-clean ack that surface",
+      "fix": "Rewrote 7→3 lines (5 removed) | Also: #if JOBSUB_RED_FORCE_SUCCESS; /* RED only: simulate a non-clean ack that surface",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12941,7 +12941,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 38\u219285 lines (2 removed) | Also: * g_last_jobcount most recent job count; -1 means ; *                 cmd_joblist (task 5.1).",
+      "fix": "Rewrote 38→85 lines (2 removed) | Also: * g_last_jobcount most recent job count; -1 means ; *                 cmd_joblist (task 5.1).",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12973,7 +12973,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/tools/test-commit-durability.sh",
       "root_cause": "31 lines replaced/restructured",
-      "fix": "Rewrote 63\u2192115 lines (31 removed) | Also: if ! wait_for_primary 40; then; fail \"cluster did not elect an initial primary wit | Also: # Wait until some live node is CTRL_PRIMARY and th; wait_for_primary() { | Also: script=$(printf 'set masters %s\\nclient\\n' \"$MASTE; script+=$(printf 'expect-job %s\\n' \"$jid\") | Also: # format-agnostically, instead of re-imposing a br; # submit did not cleanly ack, jobsub fails -> sess",
+      "fix": "Rewrote 63→115 lines (31 removed) | Also: if ! wait_for_primary 40; then; fail \"cluster did not elect an initial primary wit | Also: # Wait until some live node is CTRL_PRIMARY and th; wait_for_primary() { | Also: script=$(printf 'set masters %s\\nclient\\n' \"$MASTE; script+=$(printf 'expect-job %s\\n' \"$jid\") | Also: # format-agnostically, instead of re-imposing a br; # submit did not cleanly ack, jobsub fails -> sess",
       "tags": [
         "auto-detected",
         "refactor",
@@ -12989,7 +12989,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 8\u219220 lines (7 removed) | Also: if (jobid == 0) {; /* Non-negative rc but no JobId was written: not a",
+      "fix": "Rewrote 8→20 lines (7 removed) | Also: if (jobid == 0) {; /* Non-negative rc but no JobId was written: not a",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13003,9 +13003,9 @@
       "id": "bug-795",
       "timestamp": "2026-06-19",
       "error_message": "Cold-restart-all (kill ALL 3 controllers + restart) non-deterministically loses a committed job: a job that returned 'jobsubmit ok' and survived every rolling single-node failover round vanishes after a full-cluster restart (expect-jobs expected N, actual N-2; expect-job <id> not found). Recovery logs show WAL truncate.",
-      "file": "src/controller/{persist.c recovery/truncate, commit.c commit-gate, ha.c promotion-fence/election} \u2014 UPSTREAM ha-commit-durability Phase 6.2",
-      "root_cause": "Commit-durability race under TOTAL-cluster-outage recovery. Acked (committed) entry not durable on a fault-tolerant majority before all nodes die, OR recovery truncates committed entries on cold restart. Non-deterministic (passed 1 run, failed next). Surfaced on overlayfs sandbox (NOT a real fsync-able fs) \u2014 must be reconfirmed on real hardware. UPDATE: with the hardened (trustworthy) soak, the loss ALSO reproduces in ROLLING single-node failover with the cluster confirmed serving (~1/3 runs) \u2014 broader than cold-restart-all; bug-661 not fully closed for rolling failover. Separate finding: >60s post-kill election (liveness) every run, always recovers. CORRECTION: NOT an overlay-fdatasync artifact \u2014 reproduces OUTSIDE the container (user's real host) AND on an in-sandbox real ext2/3 fs with ZERO fdatasync EIO. Real controller durability bug + a coupled liveness stall (>60s / stuck election after killing ctrl-1). Phase 6.1 answered (REAL); now at 6.2 root-cause.",
-      "fix": "NOT FIXED HERE \u2014 out of boundary for xce-test-e2e-primitives (this spec changes no controller/replication code). Routed to spec ha-commit-durability owner. The converted durability soak (src/tools/test-commit-durability.sh, new run_cold_restart_recovery phase) correctly detects it via the exit-code verdict.",
+      "file": "src/controller/{persist.c recovery/truncate, commit.c commit-gate, ha.c promotion-fence/election} — UPSTREAM ha-commit-durability Phase 6.2",
+      "root_cause": "Commit-durability race under TOTAL-cluster-outage recovery. Acked (committed) entry not durable on a fault-tolerant majority before all nodes die, OR recovery truncates committed entries on cold restart. Non-deterministic (passed 1 run, failed next). Surfaced on overlayfs sandbox (NOT a real fsync-able fs) — must be reconfirmed on real hardware. UPDATE: with the hardened (trustworthy) soak, the loss ALSO reproduces in ROLLING single-node failover with the cluster confirmed serving (~1/3 runs) — broader than cold-restart-all; bug-661 not fully closed for rolling failover. Separate finding: >60s post-kill election (liveness) every run, always recovers. CORRECTION: NOT an overlay-fdatasync artifact — reproduces OUTSIDE the container (user's real host) AND on an in-sandbox real ext2/3 fs with ZERO fdatasync EIO. Real controller durability bug + a coupled liveness stall (>60s / stuck election after killing ctrl-1). Phase 6.1 answered (REAL); now at 6.2 root-cause.",
+      "fix": "NOT FIXED HERE — out of boundary for xce-test-e2e-primitives (this spec changes no controller/replication code). Routed to spec ha-commit-durability owner. The converted durability soak (src/tools/test-commit-durability.sh, new run_cold_restart_recovery phase) correctly detects it via the exit-code verdict.",
       "tags": [
         "ha-commit-durability",
         "commit-durability",
@@ -13049,7 +13049,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/xce-test-e2e-primitives/spec.json",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21928 lines (2 removed)",
+      "fix": "Rewrote 3→8 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13064,7 +13064,7 @@
       "timestamp": "2026-06-20T01:05:04.547Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/tools/test-commit-durability.sh",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13080,8 +13080,8 @@
       "timestamp": "2026-06-20T01:05:25.091Z",
       "error_message": "Incorrect value in code",
       "file": "src/tools/test-commit-durability.sh",
-      "root_cause": "Had \"$label: DATA LOSS \u2014 a committed job vanished (bug",
-      "fix": "Changed to \"$label: DATA LOSS \u2014 a committed job vanished from",
+      "root_cause": "Had \"$label: DATA LOSS — a committed job vanished (bug",
+      "fix": "Changed to \"$label: DATA LOSS — a committed job vanished from",
       "tags": [
         "auto-detected",
         "wrong-value",
@@ -13097,7 +13097,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/tools/test-commit-durability.sh",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u219212 lines (4 removed)",
+      "fix": "Rewrote 8→12 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13113,7 +13113,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/tools/test-commit-durability.sh",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 8\u219210 lines (4 removed)",
+      "fix": "Rewrote 8→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13128,7 +13128,7 @@
       "timestamp": "2026-06-20T01:21:21.789Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/tools/test-commit-durability.sh",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13144,7 +13144,7 @@
       "timestamp": "2026-06-20T01:27:31.000Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/xce-test-e2e-primitives/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13193,7 +13193,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/controller-lsid/requirements.md",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 6\u21928 lines (3 removed) | Also: ### Requirement 5: Committed configuration version; **Objective:** As an operator, I want the configur",
+      "fix": "Rewrote 6→8 lines (3 removed) | Also: ### Requirement 5: Committed configuration version; **Objective:** As an operator, I want the configur",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13209,7 +13209,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/controller-status/design.md",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 16\u219213 lines (12 removed) | Also: clusterName     @0:  Text;; primaryName     @1:  Text;    # empty \u21d2 \"unknown\"  | Also: /* failover-aware read (is_write=false) */; - Postconditions: on success `*status` owns a deco | Also: - `configChecksum`/`configVersion` equal across tw; - `ctrlstatus` against a healthy 3-node cluster pr | Also: - Answerable on **any** node and across failover \u2014; - Report a content checksum of the committed confi",
+      "fix": "Rewrote 16→13 lines (12 removed) | Also: clusterName     @0:  Text;; primaryName     @1:  Text;    # empty ⇒ \"unknown\"  | Also: /* failover-aware read (is_write=false) */; - Postconditions: on success `*status` owns a deco | Also: - `configChecksum`/`configVersion` equal across tw; - `ctrlstatus` against a healthy 3-node cluster pr | Also: - Answerable on **any** node and across failover —; - Report a content checksum of the committed confi",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13257,7 +13257,7 @@
       "error_message": "Wrong reference: Data should be Text",
       "file": "src/schema/controller.capnp",
       "root_cause": "Used \"Data\" instead of \"Text\"",
-      "fix": "Changed Data \u2192 Text",
+      "fix": "Changed Data → Text",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -13273,7 +13273,7 @@
       "error_message": "Wrong reference: xce_data_t should be char",
       "file": "src/include/typemap.h",
       "root_cause": "Used \"xce_data_t\" instead of \"char\"",
-      "fix": "Changed xce_data_t \u2192 char",
+      "fix": "Changed xce_data_t → char",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -13305,7 +13305,7 @@
       "error_message": "Wrong operator: >= should be ==",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "Used \">=\" instead of \"==\"",
-      "fix": "Changed operator >= \u2192 ==",
+      "fix": "Changed operator >= → ==",
       "tags": [
         "auto-detected",
         "operator-fix",
@@ -13321,7 +13321,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ctrlstatus.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 23\u219273 lines (3 removed)",
+      "fix": "Rewrote 23→73 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13337,7 +13337,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ctrlstatus.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u219213 lines (3 removed) | Also: /* primary identity \u2014 guarded by ha->lock (Req 2.2; st->primaryName = (ha->primary_host[0] != '\\0') ? ",
+      "fix": "Rewrote 3→13 lines (3 removed) | Also: /* primary identity — guarded by ha->lock (Req 2.2; st->primaryName = (ha->primary_host[0] != '\\0') ? ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13353,7 +13353,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ctrlstatus.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 13\u219216 lines (4 removed)",
+      "fix": "Rewrote 13→16 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13367,7 +13367,7 @@
       "id": "bug-817",
       "timestamp": "2026-06-19",
       "error_message": "client op (joblist, ctrlstatus, wait-primary) returns EINVAL / 'Invalid argument' and fails to reach the live primary when a DEAD controller is FIRST in the masters list; with a live-only masters list the same op succeeds in ~46ms.",
-      "file": "src/lib/client_failover.c / client.c failover-rotation (libxce) \u2014 UPSTREAM, not controller-status",
+      "file": "src/lib/client_failover.c / client.c failover-rotation (libxce) — UPSTREAM, not controller-status",
       "root_cause": "libxce client failover does not cleanly advance past a dead FIRST master to the live nodes; surfaces a typed EINVAL instead of rotating. Pre-existing (controller-status consumes failover unchanged). Surfaced by controller-status task 5.1 E2E (authoritative wait-primary timed out after a primary kill while a dead node led the masters list, even though a new primary was serving).",
       "fix": "NOT fixed in controller-status (out of boundary). Route to libxce-failover. Confirmed affects plain joblist identically. Workaround: ensure the masters list does not lead with a known-dead node, or restart killed nodes (as the durability soak does).",
       "tags": [
@@ -13407,7 +13407,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u21928 lines (4 removed) | Also: /* Session verdict toggle (xce-test-e2e-primitives; * `set continue-on-error` keeps the read loop runn",
+      "fix": "Rewrote 4→8 lines (4 removed) | Also: /* Session verdict toggle (xce-test-e2e-primitives; * `set continue-on-error` keeps the read loop runn",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13455,7 +13455,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/controller-status/spec.json",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 24\u219230 lines (6 removed)",
+      "fix": "Rewrote 24→30 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13471,7 +13471,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ctrlstatus.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u219212 lines (4 removed)",
+      "fix": "Rewrote 4→12 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13519,7 +13519,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/utils.c",
       "root_cause": "13 lines replaced/restructured",
-      "fix": "Rewrote 26\u219250 lines (13 removed)",
+      "fix": "Rewrote 26→50 lines (13 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13637,7 +13637,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 12\u219226 lines (2 removed)",
+      "fix": "Rewrote 12→26 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13739,7 +13739,7 @@
       "timestamp": "2026-06-20T13:51:29.352Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/MEMORY.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13788,7 +13788,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 6\u21925 lines (5 removed)",
+      "fix": "Rewrote 6→5 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13820,7 +13820,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 6\u219216 lines (4 removed)",
+      "fix": "Rewrote 6→16 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13834,31 +13834,34 @@
       "id": "bug-845",
       "timestamp": "2026-06-20T14:30:00.000Z",
       "error_message": "Every committed job appears as TWO consecutive WAL_JOB_SUBMIT entries with the SAME jobid (e.g. ctrl-1 LSN 2,3 = jobid 1868520205844480). Surfaced by waldump on /tmp/xce-ha-deploy.",
-      "file": "src/controller/job.c (handle_jobsubmit / persist_job_hook_fun path)",
-      "root_cause": "NOT array expansion \u2014 job_submit() assigns array members DISTINCT ids (base_id+i, job.c) and the Job capnp schema has a single jobid field, so identical-jobid pairs cannot be two array tasks. A single client submit is producing two WAL_JOB_SUBMIT appends of the same job. EXACTLY 2 entries per job (never 1 or 3), always at ADJACENT LSNs, for every job on every node. CONFIRMED via enhanced waldump (payload-CRC + subtime columns): each pair is BYTE-IDENTICAL (same PCRC, e.g. LSN 2,3 both 6d79074e; same subtime 1781959730) \u2014 proving a literal double-append of the SAME encoded job_t in one submit flow; a failover retry would re-stamp subtime=time(NULL) and differ, so retry is DEFINITIVELY ruled out. Remaining candidates: AFTER_EVENT jlist contains the job twice, or the JOB_NEW hook/handler persists twice per submit. So 'ctrl-1 has 12 submits' is really 6 jobs (halve when reconciling failover-test job totals). Doubles LSN consumption; consistent across nodes here (F@14,15 on both ctrl-1 and ctrl-3) so not itself divergence, but a latent cross-node LSN-divergence risk if the duplicate count ever varies by primary.",
-      "fix": "NOT YET FIXED \u2014 investigation finding. Next: extend waldump to print per-entry CRC + payload taskid to confirm byte-identical duplicates, then trace handle_jobsubmit -> persist_job_hook_fun AFTER_EVENT loop for the double append.",
+      "file": "src/lib/hook.c (xce_add_hook idempotency); root path src/controller/{persist.c persist_start, ha.c ha_register_persist_hooks}",
+      "root_cause": "NOT array expansion — job_submit() assigns array members DISTINCT ids (base_id+i, job.c) and the Job capnp schema has a single jobid field, so identical-jobid pairs cannot be two array tasks. A single client submit is producing two WAL_JOB_SUBMIT appends of the same job. EXACTLY 2 entries per job (never 1 or 3), always at ADJACENT LSNs, for every job on every node. CONFIRMED via enhanced waldump (payload-CRC + subtime columns): each pair is BYTE-IDENTICAL (same PCRC, e.g. LSN 2,3 both 6d79074e; same subtime 1781959730) — proving a literal double-append of the SAME encoded job_t in one submit flow; a failover retry would re-stamp subtime=time(NULL) and differ, so retry is DEFINITIVELY ruled out. Remaining candidates: AFTER_EVENT jlist contains the job twice, or the JOB_NEW hook/handler persists twice per submit. So 'ctrl-1 has 12 submits' is really 6 jobs (halve when reconciling failover-test job totals). Doubles LSN consumption; consistent across nodes here (F@14,15 on both ctrl-1 and ctrl-3) so not itself divergence, but a latent cross-node LSN-divergence risk if the duplicate count ever varies by primary.",
+      "fix": "FIXED 2026-06-23 (src/lib/hook.c). Root cause: persist_job_hook_fun was registered on XCE_CONTROLLER_HOOK_JOB by TWO owners — persist_start() (unconditional, boot) AND ha_register_persist_hooks() (on PRIMARY promotion) — with the SAME persist_t closure. xce_add_hook did not dedup, xce_run_hooks fires ALL slots, so a promoted primary had 2 active slots => persist_job_hook_fun ran twice per submit => 2 byte-identical adjacent WAL_JOB_SUBMIT appends. Fix: made xce_add_hook idempotent on exact (fn,data) — re-registering an active (fn,data) is a no-op; same fn with DISTINCT data still registers (legitimate multi-closure). Preserves the persist_start test contract many unit tests rely on. Verified: WAL now single-entry per job (waldump); 5/5 hook unit tests; controller suite 343 tests 0 new failures; 3/3 post-fix HA soaks zero job loss. NOTE: an earlier post-fix soak hit the KNOWN intermittent failover durability race (bug-795/828 class, LSN-10 cross-node divergence) — confirmed pre-existing (baseline passes/fails on timing too), NOT caused by this dedup.",
       "tags": [
-        "ha",
-        "wal",
-        "persistence",
-        "job-submit",
+        "double-register",
         "duplicate",
-        "waldump",
-        "investigation"
+        "fixed",
+        "ha",
+        "hook-dedup",
+        "investigation",
+        "job-submit",
+        "persistence",
+        "wal",
+        "waldump"
       ],
       "related_bugs": [
-        "bug-828",
-        "bug-795"
+        "bug-795",
+        "bug-828"
       ],
-      "occurrences": 1,
-      "last_seen": "2026-06-20T14:30:00.000Z"
+      "occurrences": 2,
+      "last_seen": "2026-06-23T23:30:00.000Z"
     },
     {
       "id": "bug-846",
       "timestamp": "2026-06-20T14:27:17.198Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13875,7 +13878,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/waldump.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 27\u219238 lines (6 removed) | Also: /* Per-entry line, with jobid for submits. */; char info[64] = \"\"; | Also: fprintf(out, \"  %8s | %5s | %-11s | %5s | %s\\n\",; \"LSN\", \"TERM\", \"TYPE\", \"PLEN\", \"INFO\");",
+      "fix": "Rewrote 27→38 lines (6 removed) | Also: /* Per-entry line, with jobid for submits. */; char info[64] = \"\"; | Also: fprintf(out, \"  %8s | %5s | %-11s | %5s | %s\\n\",; \"LSN\", \"TERM\", \"TYPE\", \"PLEN\", \"INFO\");",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13891,7 +13894,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_waldump.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 13\u219216 lines (5 removed) | Also: size_t plen;; uint8_t* job = encode_job(2001, &plen);",
+      "fix": "Rewrote 13→16 lines (5 removed) | Also: size_t plen;; uint8_t* job = encode_job(2001, &plen);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -13938,7 +13941,7 @@
       "timestamp": "2026-06-20T15:20:00.000Z",
       "error_message": "After the primary dies, xce_test client ops (ctrlstatus/joblist/jobsub) fail PERSISTENTLY with 'Invalid argument' (EINVAL) and wait-primary times out, even though a new primary was elected (ctrl-2 term 3). Blocks failover testing from the client.",
       "file": "src/lib/xceapi.c (per-op state guard) + src/lib/client_failover.c (xce_failover_classify / xcecli_retry_decide)",
-      "root_cause": "Client-side, NOT server. ha_dispatch_gate ALLOWS OPCode_ctrlstatus in every role and rejects client writes with the RETRYABLE -XCE_ERR_NOT_READY (never EINVAL), so a reachable controller would answer. The EINVAL is the xceapi per-op guard: `if (ctx->state != XCE_CTX_RUN) return -EINVAL`. The failover loop only AUTO-RECOVERS ctx.state==XCE_CTX_ERR (xcecli_retry_decide rotates+recovers); xce_failover_classify maps EINVAL -> XCE_FO_TERMINAL ('everything else -> terminal'), so a bare EINVAL is surfaced and the sticky master cursor never advances to the live new primary. So once the ctx lands in a non-ERR non-RUN state (INIT/DOWN) \u2014 or yields a bare EINVAL while RUN \u2014 failover gives up permanently. Exact stuck state needs a live repro to confirm.",
+      "root_cause": "Client-side, NOT server. ha_dispatch_gate ALLOWS OPCode_ctrlstatus in every role and rejects client writes with the RETRYABLE -XCE_ERR_NOT_READY (never EINVAL), so a reachable controller would answer. The EINVAL is the xceapi per-op guard: `if (ctx->state != XCE_CTX_RUN) return -EINVAL`. The failover loop only AUTO-RECOVERS ctx.state==XCE_CTX_ERR (xcecli_retry_decide rotates+recovers); xce_failover_classify maps EINVAL -> XCE_FO_TERMINAL ('everything else -> terminal'), so a bare EINVAL is surfaced and the sticky master cursor never advances to the live new primary. So once the ctx lands in a non-ERR non-RUN state (INIT/DOWN) — or yields a bare EINVAL while RUN — failover gives up permanently. Exact stuck state needs a live repro to confirm.",
       "fix": "NOT YET FIXED. Recommended (B): make the xceapi guard return a connection-state code (-ECONNRESET or -XCE_ERR_NOT_READY) instead of -EINVAL when state != RUN, so xce_failover_classify rotates/recovers instead of treating it as terminal (EINVAL conflates 'bad argument' with 'not connected'). Reproduce first (drive a fresh /xce-deploy-ha, kill primary mid-session, capture rc+ctx.state) before patching.",
       "tags": [
         "libxce",
@@ -13959,7 +13962,7 @@
       "timestamp": "2026-06-20T15:27:35.465Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/testsuite/test_wal_wire.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -13976,7 +13979,7 @@
       "error_message": "Wrong reference: test_wal_batch_entry_without_payload should be test_wal_batch_roundtrip_large_payloads",
       "file": "src/lib/testsuite/test_wal_wire.c",
       "root_cause": "Used \"test_wal_batch_entry_without_payload\" instead of \"test_wal_batch_roundtrip_large_payloads\"",
-      "fix": "Changed test_wal_batch_entry_without_payload \u2192 test_wal_batch_roundtrip_large_payloads",
+      "fix": "Changed test_wal_batch_entry_without_payload → test_wal_batch_roundtrip_large_payloads",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -13990,9 +13993,9 @@
       "id": "bug-847",
       "timestamp": "2026-06-20T15:35:00.000Z",
       "error_message": "Catch-up WAL streaming silently DROPS entry payloads at scale: a rejoining controller (ctrl-1 restarted) received [1..14] with correct LSN/type/CRC but PLEN=0 / empty job blobs (waldump PCRC=00000000, jobid=?). Structurally-intact but content-empty WAL = silent data corruption. THE committed-job-loss mechanism.",
-      "file": "src/lib/request.c (xce_wal_batch_encode_raw / wal_entry_to_wire / xce_decode extract loop) \u2014 capnp multi-segment Data pointers",
-      "root_cause": "Multi-segment capnp bug. xce_wal_batch_encode_raw builds a WalCatchupEntry struct-list where each element's payload is a capnp Data (List(UInt8)) allocated via capn_new_list8(cs=root_seg,...). When the message outgrows its first segment (large batch), the per-element payload Data pointer is lost across the segment boundary \u2014 on decode extract_data_bytes(we.payload) reads CAPN_NULL and returns len 0. write_WalCatchupEntry uses capn_setp (far-pointer-capable) so the fault is in the overflow/segment handling as used here. REPRODUCED deterministically: src/lib/testsuite/test_wal_wire.c test_wal_batch_roundtrip_large_payloads (14 entries x 872B) FAILS 'Expected 872 Was 0'; the 2-entry test_wal_batch_roundtrip_payload_bytes PASSES. Threshold is size, not count. Live replication (repl_broadcast) carries payloads fine \u2014 ONLY the catch-up/rejoin path corrupts, which is why loss only appears after a node restarts and catches up.",
-      "fix": "NOT YET FIXED. RED reproducer test_wal_batch_roundtrip_large_payloads is currently TEST_IGNORE'd (in src/lib/testsuite/test_wal_wire.c) so the libxce suite stays green \u2014 it both fails 'Expected 872 Was 0' AND leaks the orphaned multi-segment decode allocations under ASAN (meson runs abort_on_error=1 -> SIGABRT). The ASAN leak (decode_WalCatchupEntry_list/decode_Data_ptr, ~13.7KB over 61 allocs) is an EXTRA symptom: the lost cross-segment payload pointers also orphan the decoded sub-entry Data. When fixing, REMOVE the TEST_IGNORE_MESSAGE line and assert payloads survive + no leak. Candidate fixes: (a) carry all sub-entry payloads as ONE top-level capnp Data blob + lengths array (single Data round-trips correctly, sidesteps per-element cross-segment pointers) \u2014 LEAN; (b) cap WAL_STREAM_BATCH_BYTES below the single-segment threshold (fragile); (c) fix the cross-segment Data encoding in c-capnproto usage.",
+      "file": "src/lib/request.c (xce_wal_batch_encode_raw / wal_entry_to_wire / xce_decode extract loop) — capnp multi-segment Data pointers",
+      "root_cause": "Multi-segment capnp bug. xce_wal_batch_encode_raw builds a WalCatchupEntry struct-list where each element's payload is a capnp Data (List(UInt8)) allocated via capn_new_list8(cs=root_seg,...). When the message outgrows its first segment (large batch), the per-element payload Data pointer is lost across the segment boundary — on decode extract_data_bytes(we.payload) reads CAPN_NULL and returns len 0. write_WalCatchupEntry uses capn_setp (far-pointer-capable) so the fault is in the overflow/segment handling as used here. REPRODUCED deterministically: src/lib/testsuite/test_wal_wire.c test_wal_batch_roundtrip_large_payloads (14 entries x 872B) FAILS 'Expected 872 Was 0'; the 2-entry test_wal_batch_roundtrip_payload_bytes PASSES. Threshold is size, not count. Live replication (repl_broadcast) carries payloads fine — ONLY the catch-up/rejoin path corrupts, which is why loss only appears after a node restarts and catches up.",
+      "fix": "NOT YET FIXED. RED reproducer test_wal_batch_roundtrip_large_payloads is currently TEST_IGNORE'd (in src/lib/testsuite/test_wal_wire.c) so the libxce suite stays green — it both fails 'Expected 872 Was 0' AND leaks the orphaned multi-segment decode allocations under ASAN (meson runs abort_on_error=1 -> SIGABRT). The ASAN leak (decode_WalCatchupEntry_list/decode_Data_ptr, ~13.7KB over 61 allocs) is an EXTRA symptom: the lost cross-segment payload pointers also orphan the decoded sub-entry Data. When fixing, REMOVE the TEST_IGNORE_MESSAGE line and assert payloads survive + no leak. Candidate fixes: (a) carry all sub-entry payloads as ONE top-level capnp Data blob + lengths array (single Data round-trips correctly, sidesteps per-element cross-segment pointers) — LEAN; (b) cap WAL_STREAM_BATCH_BYTES below the single-segment threshold (fragile); (c) fix the cross-segment Data encoding in c-capnproto usage.",
       "tags": [
         "ha",
         "wal",
@@ -14017,7 +14020,7 @@
       "timestamp": "2026-06-20T15:30:48.257Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14033,7 +14036,7 @@
       "timestamp": "2026-06-20T15:31:23.821Z",
       "error_message": "Missing error handling in unknown",
       "file": "../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_failover_job_loss.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14047,7 +14050,7 @@
     {
       "id": "bug-848",
       "timestamp": "2026-06-20T15:50:00.000Z",
-      "error_message": "On a PRESERVED-DATA restart (no wipe \u2014 user confirmed), a controller recovers its WAL [1..7] from disk but rejoins advertising applied_lsn=0, so the primary re-streams the WHOLE log [1..committed] and O_TRUNC-overwrites the node's already-correct WAL. Logs: 'HA: learned committed_lsn=10 ... (was 0)'. THE root trigger that forces the full re-stream (then bug-847 empties it).",
+      "error_message": "On a PRESERVED-DATA restart (no wipe — user confirmed), a controller recovers its WAL [1..7] from disk but rejoins advertising applied_lsn=0, so the primary re-streams the WHOLE log [1..committed] and O_TRUNC-overwrites the node's already-correct WAL. Logs: 'HA: learned committed_lsn=10 ... (was 0)'. THE root trigger that forces the full re-stream (then bug-847 empties it).",
       "file": "src/controller/cluster.c (cluster_init_phase2, after persist_recover) + src/controller/ha.c (ha_init applied_lsn=0; state report sr->applied_lsn)",
       "root_cause": "ha->applied_lsn is NEVER reconstructed from the recovered WAL on boot. ha_init zeros it (ha.c:1367); persist_recover (cluster.c:1352) replays the WAL and advances persist->current_lsn/durable_lsn, but nothing copies that recovered position into ha->applied_lsn (persist_t and ha_state_t are separate; the only setter besides ha_init is the SNAPSHOT receive path ha.c:1771 = checkpoint_lsn). So the standby state report advertises sr->applied_lsn = ha->applied_lsn = 0 (ha.c:1787) and the primary's ha_evaluate_repl_action streams [0+1 .. committed]. ASYMMETRY proving it's a bug: ELECTION advertise uses ha_candidate_advertise_lsn = persist_durable_floor (the RECOVERED position, correct), but CATCH-UP advertise uses the un-recovered applied_lsn=0. The system knows its durable tip for voting but not for catch-up. Defeats Raft incremental catch-up for every restarted node; also the upstream cause of the earlier missing-prefix cases (full re-stream from a trimmed primary -> prefix gap).",
       "fix": "FIXED 2026-06-20 (HA-layer). Added ha_sync_applied_lsn_from_recovery(ha,p) (ha.c/ha.h) = monotonic store of persist_durable_floor(p) into ha->applied_lsn; wired into cluster_init_phase2 right after persist_recover, plus a diagnostic INFO log of recovered durable_floor/current_lsn/applied_lsn. TDD: test_recovered_member_advertises_real_applied_lsn (test_persist_recovery.c) write->recover->sync asserts applied_lsn==durable_floor>0 and monotonic. controller_unit_test 6/6 + adjacent HA 8/8, daemon builds. CAVEAT: live ctrl-1 also showed current_lsn=1 (seg O_TRUNC'd from LSN 1) implying persist_recover may not have loaded the WAL on that restart at all; if so this HA-layer fix is necessary but not sufficient. The new INFO log reveals on the next live restart whether persist_recover is effective (durable_floor>0) or not (bug-849 candidate: recovery not running/loading on the rejoin path).",
@@ -14074,7 +14077,7 @@
       "timestamp": "2026-06-21T00:18:54.350Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14090,7 +14093,7 @@
       "timestamp": "2026-06-21T00:19:18.673Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14106,7 +14109,7 @@
       "timestamp": "2026-06-21T00:19:50.700Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/cluster.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14136,10 +14139,10 @@
     {
       "id": "bug-849",
       "timestamp": "2026-06-21T11:15:00.000Z",
-      "error_message": "After bug-848 fix, restart still loses the committed prefix: restarted ctrl-1 ended with WAL [15..16] only \u2014 missing [1..14] (waldump 'GAP: missing prefix LSN 1..14'). Payloads now full (bug-848 era), but the prefix is gone. Loss mode changed (empty-payload -> missing-prefix), loss remains.",
+      "error_message": "After bug-848 fix, restart still loses the committed prefix: restarted ctrl-1 ended with WAL [15..16] only — missing [1..14] (waldump 'GAP: missing prefix LSN 1..14'). Payloads now full (bug-848 era), but the prefix is gone. Loss mode changed (empty-payload -> missing-prefix), loss remains.",
       "file": "src/controller/myapp.c (standby-rejoin path ~317-320) + src/controller/cluster.c cluster_init_phase2 (holds persist_recover)",
-      "root_cause": "CONFIRMED from live logs (/tmp/xce-ha-deploy/logs/ctrl-1.log). persist_recover (and the bug-848 applied_lsn sync, and catch-up) run ONLY inside cluster_init_phase2, which is ELECTION-GATED \u2014 its real callers are all ha.c election/promotion paths (ha.c:1021,1166,2943,3022) + cluster_init. First boot ran it (ctrl-1 won an election; logged 'persist_recover done \u2014 durable_floor=0 current_lsn=1'). The 11:07:20 RESTART came up as a follower ('myapp_run: CTRL_STANDBY \u2014 waiting for primary to connect and push config') with NO election \u2192 cluster_init_phase2 NEVER ran \u2192 NO 'persist_recover done' line for pid 304897. So the rejoining follower never recovered its on-disk [1..7], operated with current_lsn=1/applied_lsn=0, then received LIVE replication of the new job [15..16] (repl_broadcast), O_TRUNC'd seg-001 and wrote [15..16] there. [1..7] never recovered + [1..14] never caught up = permanent prefix gap. Ordering corollary: live replication advances applied past the gap so the primary's catch-up never backfills it.",
-      "fix": "FIXED 2026-06-21 (design B \u2014 boot-path-universal recovery). Refined root cause: phase2 is invoked ONLY from the election-result path; a rejoining follower that SKIPS its election (goto skip_election in myapp_run because a primary already exists) never reaches it. Fix: in myapp.c the skip-election standby branch now calls cluster_init_phase2(&c) (build resources + persist_recover + bug-848 ha_sync_applied_lsn) when !ha.phase2_done, BEFORE cluster_run starts serving \u2014 so every boot path recovers its own WAL and advertises its real applied_lsn before accepting replication. Idempotent via phase2_done (same once-per-process contract as the election callers); recovery decoupled from the primary config push (a restart already loaded config from disk pre-election). Daemon builds; controller suite incl. test_persist_recovery/test_ha_startup/test_repl_catchup/test_ha_failover 8/8 green. LIVE VALIDATION PENDING: redeploy + kill/restart ctrl-1; expect a 'HA: persist_recover done \u2014 durable_floor=7 current_lsn=8' line for the restarted pid and ctrl-1 keeping [1..7] + catching up only the suffix.",
+      "root_cause": "CONFIRMED from live logs (/tmp/xce-ha-deploy/logs/ctrl-1.log). persist_recover (and the bug-848 applied_lsn sync, and catch-up) run ONLY inside cluster_init_phase2, which is ELECTION-GATED — its real callers are all ha.c election/promotion paths (ha.c:1021,1166,2943,3022) + cluster_init. First boot ran it (ctrl-1 won an election; logged 'persist_recover done — durable_floor=0 current_lsn=1'). The 11:07:20 RESTART came up as a follower ('myapp_run: CTRL_STANDBY — waiting for primary to connect and push config') with NO election → cluster_init_phase2 NEVER ran → NO 'persist_recover done' line for pid 304897. So the rejoining follower never recovered its on-disk [1..7], operated with current_lsn=1/applied_lsn=0, then received LIVE replication of the new job [15..16] (repl_broadcast), O_TRUNC'd seg-001 and wrote [15..16] there. [1..7] never recovered + [1..14] never caught up = permanent prefix gap. Ordering corollary: live replication advances applied past the gap so the primary's catch-up never backfills it.",
+      "fix": "FIXED 2026-06-21 (design B — boot-path-universal recovery). Refined root cause: phase2 is invoked ONLY from the election-result path; a rejoining follower that SKIPS its election (goto skip_election in myapp_run because a primary already exists) never reaches it. Fix: in myapp.c the skip-election standby branch now calls cluster_init_phase2(&c) (build resources + persist_recover + bug-848 ha_sync_applied_lsn) when !ha.phase2_done, BEFORE cluster_run starts serving — so every boot path recovers its own WAL and advertises its real applied_lsn before accepting replication. Idempotent via phase2_done (same once-per-process contract as the election callers); recovery decoupled from the primary config push (a restart already loaded config from disk pre-election). Daemon builds; controller suite incl. test_persist_recovery/test_ha_startup/test_repl_catchup/test_ha_failover 8/8 green. LIVE VALIDATION PENDING: redeploy + kill/restart ctrl-1; expect a 'HA: persist_recover done — durable_floor=7 current_lsn=8' line for the restarted pid and ctrl-1 keeping [1..7] + catching up only the suffix.",
       "tags": [
         "ha",
         "raft",
@@ -14165,7 +14168,7 @@
       "error_message": "A rejoining standby receives LIVE replication of new entries before its historical catch-up, advancing current_lsn past the gap so the idempotency guard skips the catch-up of the prefix. Explains ctrl-1 ending with [15..16] only (gap [1..14]). Distinct from bug-849; persists even after recovery.",
       "file": "src/controller/repl.c repl_add_standby (line ~119) + repl_broadcast in_catch_up gate",
       "root_cause": "repl_add_standby initializes a freshly-registered standby with in_catch_up=0, so it is IMMEDIATELY eligible for repl_broadcast (which correctly skips in_catch_up standbys at repl.c:27). Mechanism (confirmed from ctrl-1.log 11:07:21): ctrl-1 reconnects -> registered in_catch_up=0 -> the new job [15..16] is live-broadcast to it (not gated) -> persist_wal_write_replicated writes them, current_lsn jumps to 17 -> THEN the catch-up stream of [1..14] arrives but persist_wal_write_replicated's idempotency guard (lsn+1 <= current_lsn) skips ALL of them (1+1<=17 ... 14+1<=17) -> permanent prefix gap [1..14]. Independent of bug-849: even with recovery (current_lsn=8), a live [15..16] arriving first jumps current_lsn to 17 and the catch-up of [8..14] is skipped (gap [8..14]). Root architectural cause: catch-up streaming and live broadcast are SEPARATE unordered paths (unlike Raft AppendEntries which is one ordered per-follower stream).",
-      "fix": "FIXED 2026-06-21 via a CONTIGUITY GUARD at the persist layer (Raft log-matching), NOT in_catch_up. First tried defaulting in_catch_up=1 in repl_add_standby \u2014 REVERTED: it broke the whole controller suite (commit-WAIT tests TIMEOUT 300s because a fresh standby no longer counts toward write quorum until convergence, and the unit tests don't run the heartbeat dispatch that would clear it). Correct fix: persist_wal_write_replicated now REJECTS a forward gap (lsn > current_lsn) with -EAGAIN instead of writing it \u2014 so a live broadcast that arrives ahead of the in-order catch-up is DROPPED (no write, no ack, no current_lsn jump), and the ACK-driven catch-up continuation re-streams from current_lsn so the log fills in order. ha_apply_single_entry + ha_apply_wal_catchup_entry treat -EAGAIN as a quiet skip (TRACE, no ack, no ERROR spam). Combined with bug-848 (advertise durable_floor == current_lsn-1) the catch-up always starts AT current_lsn so it is never spuriously rejected; only genuine forward gaps are. Files: src/controller/persist.c (guard), src/controller/ha.c (quiet -EAGAIN). TDD: test_repl_write_rejects_forward_gap (test_repl_apply.c) \u2014 contiguous write ok, forward-gap lsn 5 @ current_lsn 2 -> -EAGAIN + current_lsn unchanged, fill 2..4 then 5 ok, recovery clean. FULL controller suite green (129/0/0, no timeout); daemon builds. LIVE VALIDATION PENDING with bug-848+849+850 together.",
+      "fix": "FIXED 2026-06-21 via a CONTIGUITY GUARD at the persist layer (Raft log-matching), NOT in_catch_up. First tried defaulting in_catch_up=1 in repl_add_standby — REVERTED: it broke the whole controller suite (commit-WAIT tests TIMEOUT 300s because a fresh standby no longer counts toward write quorum until convergence, and the unit tests don't run the heartbeat dispatch that would clear it). Correct fix: persist_wal_write_replicated now REJECTS a forward gap (lsn > current_lsn) with -EAGAIN instead of writing it — so a live broadcast that arrives ahead of the in-order catch-up is DROPPED (no write, no ack, no current_lsn jump), and the ACK-driven catch-up continuation re-streams from current_lsn so the log fills in order. ha_apply_single_entry + ha_apply_wal_catchup_entry treat -EAGAIN as a quiet skip (TRACE, no ack, no ERROR spam). Combined with bug-848 (advertise durable_floor == current_lsn-1) the catch-up always starts AT current_lsn so it is never spuriously rejected; only genuine forward gaps are. Files: src/controller/persist.c (guard), src/controller/ha.c (quiet -EAGAIN). TDD: test_repl_write_rejects_forward_gap (test_repl_apply.c) — contiguous write ok, forward-gap lsn 5 @ current_lsn 2 -> -EAGAIN + current_lsn unchanged, fill 2..4 then 5 ok, recovery clean. FULL controller suite green (129/0/0, no timeout); daemon builds. LIVE VALIDATION PENDING with bug-848+849+850 together.",
       "tags": [
         "ha",
         "raft",
@@ -14208,7 +14211,7 @@
       "timestamp": "2026-06-21T03:39:17.593Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14225,7 +14228,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/repl.c",
       "root_cause": "11 lines replaced/restructured",
-      "fix": "Rewrote 15\u21925 lines (11 removed) | Also: /* Transition-aware (bug-850): only the actual 1\u21920; * (membership re-eval + waiter wakeup) work, so th",
+      "fix": "Rewrote 15→5 lines (11 removed) | Also: /* Transition-aware (bug-850): only the actual 1→0; * (membership re-eval + waiter wakeup) work, so th",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14241,7 +14244,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 13\u21927 lines (7 removed)",
+      "fix": "Rewrote 13→7 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14256,7 +14259,7 @@
       "timestamp": "2026-06-21T03:56:40.908Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/persist.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14272,7 +14275,7 @@
       "timestamp": "2026-06-21T03:57:03.979Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14288,7 +14291,7 @@
       "timestamp": "2026-06-21T04:00:51.551Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_repl_apply.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14305,7 +14308,7 @@
       "error_message": "Wrong reference: test_repl_write_rejects_checkpoint should be test_repl_write_rejects_forward_gap",
       "file": "src/controller/testsuite/test_repl_apply.c",
       "root_cause": "Used \"test_repl_write_rejects_checkpoint\" instead of \"test_repl_write_rejects_forward_gap\"",
-      "fix": "Changed test_repl_write_rejects_checkpoint \u2192 test_repl_write_rejects_forward_gap",
+      "fix": "Changed test_repl_write_rejects_checkpoint → test_repl_write_rejects_forward_gap",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -14320,7 +14323,7 @@
       "timestamp": "2026-06-21T13:30:00.000Z",
       "error_message": "CHAOTIC leadership churn (3x kill-the-primary) causes SILENT committed-prefix DIVERGENCE: all 3 nodes report committedLsn=54 with lsn range 1..54 / 0 gaps / CRC intact, but WAL CONTENT diverges at LSN 45-54 (ctrl-1/ctrl-2/ctrl-3 each hold DIFFERENT jobs at the same LSNs; fps bfeb26ad/216af434/865304ec). Violates Raft committed-prefix invariant (a committed entry must be byte-identical on every member). Originally seen as a liveness 'commit stall'; the deeper defect is divergence + acked-job loss under churn.",
       "file": "src/controller/persist.c:588/726/1040 (hdr.term=p->term, p->term never set) + src/controller/ha.c (election term = local+1, PreVote no-persist; two leaders per term) + src/controller/ha_convergence.c (reconcile cannot (term,lsn) log-match)",
-      "root_cause": "ROOT-CAUSED 2026-06-21 (owned-cluster repro, see .kiro/specs/ha-commit-durability/repro-851/). THREE compounding defects: (1) Election term not monotonic across cluster: term = locally-persisted+1, PreVote does NOT persist/propagate ('PreVote round ... no persist'); under chaotic kills a leader wins term N, appends own-term noop+jobs, and is killed BEFORE term N propagates to a majority; a restarted node recovers a STALE term and elects at the SAME N+1 => TWO leaders share a term (logs: term3 led by ctrl-3@08:40 AND ctrl-1@08:47:39; term4 led by ctrl-2@08:47:52 AND ctrl-3@08:48:04), each appending its own-term noop at the SAME lsn 45. (2) WAL entry term field is DEAD (always 0): wal_entry_hdr_t.term exists (wal_types.h:30) but writer does hdr.term=p->term (persist.c:588/726/1040) and p->term is NEVER assigned from ha->term anywhere in the controller (zero matches) => every entry persists term=0; waldump confirms term=0 cluster-wide. (3) No (term,lsn) reconcile: with no usable per-entry term, ha_convergence.c reconcile cannot Raft-log-match, so a divergent same-lsn suffix (45@term3 vs 45@term4) looks already-present and is never truncated; ha_compute_safe_committed_lsn then advances committed 'from 1 granted voter' over content other members never received. NOTE: a CLEAN single failover fully converges (all WALs identical 1..22, 848/849/850 validated) \u2014 only CHAOTIC churn triggers it.",
+      "root_cause": "ROOT-CAUSED 2026-06-21 (owned-cluster repro, see .kiro/specs/ha-commit-durability/repro-851/). THREE compounding defects: (1) Election term not monotonic across cluster: term = locally-persisted+1, PreVote does NOT persist/propagate ('PreVote round ... no persist'); under chaotic kills a leader wins term N, appends own-term noop+jobs, and is killed BEFORE term N propagates to a majority; a restarted node recovers a STALE term and elects at the SAME N+1 => TWO leaders share a term (logs: term3 led by ctrl-3@08:40 AND ctrl-1@08:47:39; term4 led by ctrl-2@08:47:52 AND ctrl-3@08:48:04), each appending its own-term noop at the SAME lsn 45. (2) WAL entry term field is DEAD (always 0): wal_entry_hdr_t.term exists (wal_types.h:30) but writer does hdr.term=p->term (persist.c:588/726/1040) and p->term is NEVER assigned from ha->term anywhere in the controller (zero matches) => every entry persists term=0; waldump confirms term=0 cluster-wide. (3) No (term,lsn) reconcile: with no usable per-entry term, ha_convergence.c reconcile cannot Raft-log-match, so a divergent same-lsn suffix (45@term3 vs 45@term4) looks already-present and is never truncated; ha_compute_safe_committed_lsn then advances committed 'from 1 granted voter' over content other members never received. NOTE: a CLEAN single failover fully converges (all WALs identical 1..22, 848/849/850 validated) — only CHAOTIC churn triggers it.",
       "fix": "NOT FIXED (HA-core + persistence => full spec workflow per CLAUDE.md, not a quick patch). Keystone lever: stamp hdr.term from live ha->term on the primary append path + carry term through the repl envelope + persist it, THEN make ha_convergence reconcile truncate any local suffix whose (term,lsn) != leader's (standard Raft log-matching). MUST pair with durably-establishing the election term before a new leader acts (no two leaders per term: persist/propagate the won term to a majority before appending the own-term noop, or bump term beyond any (term,lsn) a voter advertises). Route to ha-consistency-invariants / ha-convergence-recovery as a new sub-spec.",
       "tags": [
         "ha",
@@ -14349,7 +14352,7 @@
       "timestamp": "2026-06-21T09:15:48.912Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -14365,23 +14368,27 @@
       "timestamp": "2026-06-21T09:10:00.000Z",
       "error_message": "Client primary-discovery is POSITIONAL, not failover-correct: with masters=[m0,m1,...] the client only finds the primary if m0 IS the primary. wait-primary: 9993(primary-first)=ok 45ms; 9992,9993(standby-first)=no primary; 9991,9993(dead-first)=no primary; 9993,9991=ok.",
       "file": "src/lib/client.c:403 xcecli_ctrlstatus_primary + src/controller/ctrlstatus.c:104 (standby primaryName=\"\")",
-      "root_cause": "Standby answers ctrlstatus with primaryName=\"\" (unknown, by design \u2014 voted_for_name/primary_host unreliable), so xcecli_ctrlstatus_primary_addr returns -ENOENT and no redirect hint is captured; the inner xcecli_ctrlstatus SUCCEEDS on the reachable non-primary so transport-level failover never rotates to the next master. Net: client pins to whichever master answers first. Compounded by the dead node returning EINVAL (bug-846). This is what made earlier remote sessions misread bug-851 as 'committed frozen' \u2014 the client was pinned to a stale/standby node. Found during the 2026-06-21 owned-cluster bug-851 repro.",
-      "fix": "NOT FIXED. Options: (a) standby tracks+reports the primary name it heartbeats with (populates primaryName so the existing redirect-hint path in xcecli_ctrlstatus_primary works), or (b) client forces rotation to the next master on a reachable-but-non-authoritative reply. (a) is more robust (direct redirect).",
+      "root_cause": "Two compounding defects in libxce: (1) XCECLI_FAILOVER_CALL classifies a standby's status-0 ctrlstatus reply as SUCCESS and never rotates the endpoint (ctrlstatus is answerable in every role, so ANY reachable standby answers 0 — the inner call never rotates off it). (2) xcecli_ctrlstatus_primary captures a redirect hint from the non-authoritative reply but does not force rotation to consume it — it re-queries the same standby until the retry budget exhausts, never traversing the master ring. No server-side primaryName source existed on a standby (voted_for_name is not the leader, and primary_host is vestigial/never-written). Verified: baseline (no fix) with standby-first masters does NOT find the primary (pins to standby).",
+      "fix": "FIXED (2026-06-23). xcecli_ctrlstatus_primary: force xce_failover_rotate(ctx) + xcecli_ctx_recover(ctx) under failover.lock on every non-authoritative reply (hint-first then next-master rotation). Loop floor raised to max(max_retries, nmasters+1). Verified: wait-primary 'ctrl-3' serving after 92 ms with standby-first masters list; end-to-end clean-failover discover pass. Deliberately NOT adding server-side primaryName source — it is only a latency optimization; the client rotation fix alone resolves the hang.",
       "tags": [
         "libxce",
         "client",
         "failover",
         "primary-discovery",
         "ctrlstatus",
-        "ha"
+        "ha",
+        "FIXED",
+        "client",
+        "rotation",
+        "xcecli_ctrlstatus_primary"
       ],
       "related_bugs": [
         "bug-846",
         "bug-851",
         "bug-646"
       ],
-      "occurrences": 1,
-      "last_seen": "2026-06-21T09:10:00.000Z"
+      "occurrences": 2,
+      "last_seen": "2026-06-23"
     },
     {
       "id": "bug-875",
@@ -14405,7 +14412,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-term-safety/requirements.md",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 14\u219226 lines (5 removed)",
+      "fix": "Rewrote 14→26 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14512,7 +14519,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-term-safety/design.md",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 15\u219229 lines (7 removed)",
+      "fix": "Rewrote 15→29 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14577,7 +14584,7 @@
       "error_message": "Wrong reference: test_raft_init_zero_peers_returns_einval should be test_raft_init_oversize_peers_returns_einval",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "Used \"test_raft_init_zero_peers_returns_einval\" instead of \"test_raft_init_oversize_peers_returns_einval\"",
-      "fix": "Changed test_raft_init_zero_peers_returns_einval \u2192 test_raft_init_oversize_peers_returns_einval",
+      "fix": "Changed test_raft_init_zero_peers_returns_einval → test_raft_init_oversize_peers_returns_einval",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -14673,7 +14680,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 6\u219211 lines (4 removed)",
+      "fix": "Rewrote 6→11 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14689,7 +14696,7 @@
       "error_message": "Wrong reference: g_te_spy should be g_pe_spy",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "Used \"g_te_spy\" instead of \"g_pe_spy\"",
-      "fix": "Changed g_te_spy \u2192 g_pe_spy",
+      "fix": "Changed g_te_spy → g_pe_spy",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -14737,7 +14744,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft_sim.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219211 lines (2 removed)",
+      "fix": "Rewrote 8→11 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14753,7 +14760,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft_sim.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 4\u21926 lines (4 removed)",
+      "fix": "Rewrote 4→6 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14769,7 +14776,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21925 lines (2 removed)",
+      "fix": "Rewrote 3→5 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14800,7 +14807,7 @@
       "timestamp": "2026-06-21T16:51:25.960Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/testsuite/test_raft.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: RUN_TEST(test_sim_9_1_replication_and_partition_catch_up);; RUN_TEST(test_sim_9_2_divergent_suffix_truncation);",
       "tags": [
         "auto-detected",
@@ -14817,7 +14824,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 13\u219216 lines (4 removed)",
+      "fix": "Rewrote 13→16 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14833,7 +14840,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 15\u219230 lines (5 removed)",
+      "fix": "Rewrote 15→30 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14849,7 +14856,7 @@
       "error_message": "Wrong operator: <= should be >=",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "Used \"<=\" instead of \">=\"",
-      "fix": "Changed operator <= \u2192 >=",
+      "fix": "Changed operator <= → >=",
       "tags": [
         "auto-detected",
         "operator-fix",
@@ -14897,7 +14904,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft_sim.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 14\u219219 lines (3 removed)",
+      "fix": "Rewrote 14→19 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14961,7 +14968,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219226 lines (2 removed) | Also: * Denies if cand_term < s->term; otherwise returns; * from_idx, cand_term) (granting when the gate is ",
+      "fix": "Rewrote 9→26 lines (2 removed) | Also: * Denies if cand_term < s->term; otherwise returns; * from_idx, cand_term) (granting when the gate is ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -14993,7 +15000,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (2 removed)",
+      "fix": "Rewrote 3→4 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15009,7 +15016,7 @@
       "error_message": "Wrong reference: TEST_ASSERT_NOT_EQUAL_INT should be TEST_ASSERT_NOT_EQUAL",
       "file": "src/lib/testsuite/test_raft.c",
       "root_cause": "Used \"TEST_ASSERT_NOT_EQUAL_INT\" instead of \"TEST_ASSERT_NOT_EQUAL\"",
-      "fix": "Changed TEST_ASSERT_NOT_EQUAL_INT \u2192 TEST_ASSERT_NOT_EQUAL",
+      "fix": "Changed TEST_ASSERT_NOT_EQUAL_INT → TEST_ASSERT_NOT_EQUAL",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -15041,7 +15048,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/specs/ha-term-safety/spec.json",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 7\u21928 lines (2 removed)",
+      "fix": "Rewrote 7→8 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15057,7 +15064,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_ha_prevote.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 9\u219215 lines (2 removed)",
+      "fix": "Rewrote 9→15 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15072,7 +15079,7 @@
       "timestamp": "2026-06-22T02:57:27.792Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_e2e_capnp.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15113,7 +15120,7 @@
       "error_message": "nix develop fails: hash mismatch for c-capnproto fixed-output derivation (expected sha256-9dzSc3w+yxYzsF/rZe3qIarKOpjt2zvIyjuS5FXngIM=, got sha256-9rTlcTia+s9ARGeTi+8auGvM0RkS+wZK7aIkzecaeSk=)",
       "file": "src/flake.nix",
       "root_cause": "flake pins c-capnproto to the MUTABLE github archive/main.tar.gz; upstream main branch advanced so the tarball content/hash drifted, breaking the fixed-output derivation. Only pre-cached nix stores still build.",
-      "fix": "RESOLVED: user refreshed src/flake.lock; fresh nix develop builds (capnproto 1.2.0). A clean controller rebuild made the full controller test suite green (Ok:1 Fail:0, 12.7s) \u2014 the earlier wal_catchup -EAGAIN/decode failures were a STALE incremental-build artifact (schema compiled against the drifted toolchain), not fsync or a source regression.",
+      "fix": "RESOLVED: user refreshed src/flake.lock; fresh nix develop builds (capnproto 1.2.0). A clean controller rebuild made the full controller test suite green (Ok:1 Fail:0, 12.7s) — the earlier wal_catchup -EAGAIN/decode failures were a STALE incremental-build artifact (schema compiled against the drifted toolchain), not fsync or a source regression.",
       "tags": [
         "nix",
         "flake",
@@ -15148,7 +15155,7 @@
       "error_message": "Wrong reference: test_waldump should be test_term_safety_adapter",
       "file": "src/controller/testsuite/controller_test.c",
       "root_cause": "Used \"test_waldump\" instead of \"test_term_safety_adapter\"",
-      "fix": "Changed test_waldump \u2192 test_term_safety_adapter",
+      "fix": "Changed test_waldump → test_term_safety_adapter",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -15248,7 +15255,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 19\u219225 lines (4 removed)",
+      "fix": "Rewrote 19→25 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15327,7 +15334,7 @@
       "timestamp": "2026-06-22T05:47:00.864Z",
       "error_message": "Missing error handling in xce_wal_batch_req_raw",
       "file": "src/controller/repl.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15360,7 +15367,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 15\u219220 lines (2 removed)",
+      "fix": "Rewrote 15→20 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15375,7 +15382,7 @@
       "timestamp": "2026-06-22T06:38:20.255Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15392,7 +15399,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/commit.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 10\u219225 lines (2 removed)",
+      "fix": "Rewrote 10→25 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15424,7 +15431,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/commit.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 12\u219218 lines (9 removed)",
+      "fix": "Rewrote 12→18 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15440,7 +15447,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "14 lines replaced/restructured",
-      "fix": "Rewrote 24\u219233 lines (14 removed) | Also: /* Standby ACKs LSN 2 \u2192 durable majority covers LS; /* Fire the WIRED callback with commit_index=1 \u2192 t",
+      "fix": "Rewrote 24→33 lines (14 removed) | Also: /* Standby ACKs LSN 2 → durable majority covers LS; /* Fire the WIRED callback with commit_index=1 → t",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15456,7 +15463,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 17\u219247 lines (2 removed)",
+      "fix": "Rewrote 17→47 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15520,7 +15527,7 @@
       "error_message": "Wrong reference: ha_arm_own_term_gate should be ha_arm_own_term_gate_for_test",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "Used \"ha_arm_own_term_gate\" instead of \"ha_arm_own_term_gate_for_test\"",
-      "fix": "Changed ha_arm_own_term_gate \u2192 ha_arm_own_term_gate_for_test",
+      "fix": "Changed ha_arm_own_term_gate → ha_arm_own_term_gate_for_test",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -15551,7 +15558,7 @@
       "timestamp": "2026-06-22T08:16:54.023Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15567,7 +15574,7 @@
       "timestamp": "2026-06-22T08:19:44.572Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/request.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15583,7 +15590,7 @@
       "timestamp": "2026-06-22T08:21:57.062Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: /* ha-term-safety task 3.2 (R2.6 / G5): route the heartbeat ; * library as a 0-entry AppendEntries so the LIBRARY performs",
       "tags": [
         "auto-detected",
@@ -15599,7 +15606,7 @@
       "timestamp": "2026-06-22T08:22:36.807Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.h",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15616,7 +15623,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha_convergence.c",
       "root_cause": "43 lines replaced/restructured",
-      "fix": "Rewrote 59\u219227 lines (43 removed) | Also: * ha_rejoin_reconcile_ctx_t \u2014 heap context for the; * Carries the clamped cutoff computed at trigger t",
+      "fix": "Rewrote 59→27 lines (43 removed) | Also: * ha_rejoin_reconcile_ctx_t — heap context for the; * Carries the clamped cutoff computed at trigger t",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15632,7 +15639,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_demotion_convergence.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 10\u219215 lines (6 removed)",
+      "fix": "Rewrote 10→15 lines (6 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15647,7 +15654,7 @@
       "timestamp": "2026-06-22T08:42:30.744Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-term-safety/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -15680,7 +15687,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 39\u219279 lines (9 removed) | Also: * path; neither library call performs I/O. */; ha_raft_on_repl_ack(c, vctx->peer_idx, acked_lsn, ",
+      "fix": "Rewrote 39→79 lines (9 removed) | Also: * path; neither library call performs I/O. */; ha_raft_on_repl_ack(c, vctx->peer_idx, acked_lsn, ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15696,7 +15703,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.h",
       "root_cause": "7 lines replaced/restructured",
-      "fix": "Rewrote 12\u219230 lines (7 removed)",
+      "fix": "Rewrote 12→30 lines (7 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15712,7 +15719,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 3\u21924 lines (3 removed)",
+      "fix": "Rewrote 3→4 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15832,7 +15839,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 8\u219214 lines (2 removed) | Also: /* Sentinel header: magic (8 bytes) + checkpoint_l; char header[16];",
+      "fix": "Rewrote 8→14 lines (2 removed) | Also: /* Sentinel header: magic (8 bytes) + checkpoint_l; char header[16];",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15864,7 +15871,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 22\u219226 lines (9 removed)",
+      "fix": "Rewrote 22→26 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15896,7 +15903,7 @@
       "error_message": "Wrong reference: persist_roll_segment should be persist_test_force_new_segment",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "Used \"persist_roll_segment\" instead of \"persist_test_force_new_segment\"",
-      "fix": "Changed persist_roll_segment \u2192 persist_test_force_new_segment",
+      "fix": "Changed persist_roll_segment → persist_test_force_new_segment",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -15912,7 +15919,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_commit_barrier_rollout.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 12\u219225 lines (3 removed)",
+      "fix": "Rewrote 12→25 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15928,7 +15935,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 25\u219234 lines (4 removed) | Also: /* Commit the marker's WAL LSN through the real co; * exactly as a majority WAL ack does in production",
+      "fix": "Rewrote 25→34 lines (4 removed) | Also: /* Commit the marker's WAL LSN through the real co; * exactly as a majority WAL ack does in production",
       "tags": [
         "auto-detected",
         "refactor",
@@ -15941,7 +15948,7 @@
     {
       "id": "bug-970",
       "timestamp": "2026-06-22T10:24:35.905518Z",
-      "error_message": "ha-term-safety task 4.2 rejected (review r1): live config-change path (do_upgrade_config_with_bytes) never appended WAL_CONFIG_MARKER \u2014 config_committed_marker had ZERO production callers (dead primitive); and checkpoint/compaction could trim a committed marker segment, regressing the derive to -ENOENT.",
+      "error_message": "ha-term-safety task 4.2 rejected (review r1): live config-change path (do_upgrade_config_with_bytes) never appended WAL_CONFIG_MARKER — config_committed_marker had ZERO production callers (dead primitive); and checkpoint/compaction could trim a committed marker segment, regressing the derive to -ENOENT.",
       "file": "src/controller/config_repl.c, src/controller/persist.c",
       "root_cause": "Finding1: do_upgrade_config_with_bytes still drove the term-blind committed_config_tag push/ack/advance and never called config_append_marker, so the derive primitive was dead code. Finding2: persist_checkpoint->trim_wal_segments unlinks older segments and the snapshot sentinel carried no config reference, so a committed marker in a trimmed segment vanished and config_committed_marker regressed/returned -ENOENT.",
       "fix": "Added config_commit_change() wired into do_upgrade_config_with_bytes step 7: appends WAL_CONFIG_MARKER as the consensus record (config_append_marker), then delegates byte delivery + the existing majority barrier to push_config_to_standbys (mechanism unchanged); committed_config_tag is now only a cache, config_committed_marker (committed-prefix derive) is authoritative. Compaction safety: persist_checkpoint scans the committed prefix for the latest marker {version_tag,sha256} (scan_latest_committed_config_ref) BEFORE trim and stamps it into the snapshot sentinel (41-byte optional tail); load_snapshot reads it back into persist.cfgref_*; config_committed_marker falls back to it when no marker survives the live WAL. Added integration test (drives config_commit_change) + checkpoint-trim test + persist_test_force_new_segment seam. cb5 upgrade pins made persist-backed so the marker append succeeds. RED confirmed (Expected 1 Was 0; Expected 0 Was -110); GREEN 0 failures direct-run.",
@@ -15999,7 +16006,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 7\u219218 lines (2 removed)",
+      "fix": "Rewrote 7→18 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16015,7 +16022,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/myapp.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 8\u219226 lines (3 removed)",
+      "fix": "Rewrote 8→26 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16047,7 +16054,7 @@
       "error_message": "ha-term-safety task 4.3 REJECTED r1: verify-before-activate BYPASSED on push path (handle_repl_config_push pre-activated via load_primary_config before the hash gate); recovery-activate had NO production call site (boot loaded blindly); serve-fence had NO production reader (a fenced member still served)",
       "file": "src/controller/config_repl.c, src/controller/ha.c, src/controller/myapp.c",
       "root_cause": "config_activate_committed (verify-before-activate + fence) was unit-correct but not integrated: (A) handle_repl_config_push called load_primary_config UNCONDITIONALLY before config_activate_committed, so mismatched bytes went live before the gate; (B) myapp.c boot step 7 + on_commit_advanced never called the consumer, so a recovering member loaded config blind against the committed marker; (C) ha_dispatch_gate / pre-promotion gate never read config_serve_fence, so a fenced member still served + could promote",
-      "fix": "(A) handle_repl_config_push now SAVES bytes (conf_save_config) then calls config_activate_committed ONLY \u2014 removed premature load_primary_config; activate is the sole activation point (hash-verify gate). (B) config_activate_committed -ENOENT branch falls back to load_primary_config (absent marker != mismatch, no false fence); myapp.c step 7 calls config_activate_committed (latest committed marker, verified). on_commit_advanced documents why activation is deferred off the iomgr thread (async-I/O invariant: scan/load do disk I/O). (C) ha_dispatch_gate CTRL_PRIMARY now refuses config-dependent state-changing ops when config_serve_fenced (replication/read-only pass), pre-promotion gate in raft_cb_become_leader refuses promotion when fenced via new ha_config_promotion_fenced; member stays ALIVE, never self-terminates; fence clears on correct bytes re-verify",
+      "fix": "(A) handle_repl_config_push now SAVES bytes (conf_save_config) then calls config_activate_committed ONLY — removed premature load_primary_config; activate is the sole activation point (hash-verify gate). (B) config_activate_committed -ENOENT branch falls back to load_primary_config (absent marker != mismatch, no false fence); myapp.c step 7 calls config_activate_committed (latest committed marker, verified). on_commit_advanced documents why activation is deferred off the iomgr thread (async-I/O invariant: scan/load do disk I/O). (C) ha_dispatch_gate CTRL_PRIMARY now refuses config-dependent state-changing ops when config_serve_fenced (replication/read-only pass), pre-promotion gate in raft_cb_become_leader refuses promotion when fenced via new ha_config_promotion_fenced; member stays ALIVE, never self-terminates; fence clears on correct bytes re-verify",
       "tags": [
         "ha-term-safety",
         "config-replication",
@@ -16088,7 +16095,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 17\u219233 lines (5 removed)",
+      "fix": "Rewrote 17→33 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16104,7 +16111,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 26\u219221 lines (9 removed) | Also: * commit barrier, which would advance committed_ls; * live (active tag is still the OLD marker's tag).",
+      "fix": "Rewrote 26→21 lines (9 removed) | Also: * commit barrier, which would advance committed_ls; * live (active tag is still the OLD marker's tag).",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16120,7 +16127,7 @@
       "error_message": "Wrong reference: ClusterConfig should be cluster_config_t",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "Used \"ClusterConfig\" instead of \"cluster_config_t\"",
-      "fix": "Changed ClusterConfig \u2192 cluster_config_t",
+      "fix": "Changed ClusterConfig → cluster_config_t",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -16158,7 +16165,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 16\u21928 lines (12 removed) | Also: /* A standby's durable ACK covers LSN 2; route the; * The agreed entries are current-term (T), so the ",
+      "fix": "Rewrote 16→8 lines (12 removed) | Also: /* A standby's durable ACK covers LSN 2; route the; * The agreed entries are current-term (T), so the ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16253,7 +16260,7 @@
       "timestamp": "2026-06-22T13:05:15.064Z",
       "error_message": "Missing error handling in degrades",
       "file": ".kiro/specs/ha-term-safety/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16270,7 +16277,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/clean_failover_preservation.sh",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 4\u219213 lines (2 removed)",
+      "fix": "Rewrote 4→13 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16337,7 +16344,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/include/repl.h",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 3\u219213 lines (2 removed)",
+      "fix": "Rewrote 3→13 lines (2 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16369,7 +16376,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "15 lines replaced/restructured",
-      "fix": "Rewrote 21\u21925 lines (15 removed)",
+      "fix": "Rewrote 21→5 lines (15 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16384,7 +16391,7 @@
       "timestamp": "2026-06-22T15:13:02.631Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/lib/request.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16401,7 +16408,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_repl_unit.c",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 15\u219223 lines (4 removed)",
+      "fix": "Rewrote 15→23 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16416,7 +16423,7 @@
       "timestamp": "2026-06-22T15:26:52.514Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16433,7 +16440,7 @@
       "error_message": "Wrong reference: test_repl_ack_currentterm_quorum_advances_commit should be test_live_broadcast_receive_persists_leader_term",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "Used \"test_repl_ack_currentterm_quorum_advances_commit\" instead of \"test_live_broadcast_receive_persists_leader_term\"",
-      "fix": "Changed test_repl_ack_currentterm_quorum_advances_commit \u2192 test_live_broadcast_receive_persists_leader_term",
+      "fix": "Changed test_repl_ack_currentterm_quorum_advances_commit → test_live_broadcast_receive_persists_leader_term",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -16466,7 +16473,7 @@
       ],
       "occurrences": 1,
       "last_seen": "2026-06-22T16:00:00.000000",
-      "validation": "Unit RED->GREEN: test_broadcast_carries_leader_term_and_prev_tuple (repl: neuter term -> Expected 7 Was 0) + test_live_broadcast_receive_persists_leader_term (adapter: neuter receive route -> Expected 7 Was 3, i.e. standby persisted its LOCAL term). Full controller suite 175 Tests 0 Failures (clean /tmp direct binary) + meson Ok:1 Fail:0. Live STRICT_TERM gate (clean_failover_preservation.sh) NOT runnable in this overlayfs sandbox: baseline-confirmed no failover completes (split-vote no-promotion within 20s + fdatasync errno=5) \u2014 bug-924 env limitation, requires real-fs. The 7 test_wal_catchup_* (test_config_repl.c) + occasional durability FAILs on the direct binary are the SAME pre-existing bug-924 overlayfs fdatasync artifact (identical on baseline)."
+      "validation": "Unit RED->GREEN: test_broadcast_carries_leader_term_and_prev_tuple (repl: neuter term -> Expected 7 Was 0) + test_live_broadcast_receive_persists_leader_term (adapter: neuter receive route -> Expected 7 Was 3, i.e. standby persisted its LOCAL term). Full controller suite 175 Tests 0 Failures (clean /tmp direct binary) + meson Ok:1 Fail:0. Live STRICT_TERM gate (clean_failover_preservation.sh) NOT runnable in this overlayfs sandbox: baseline-confirmed no failover completes (split-vote no-promotion within 20s + fdatasync errno=5) — bug-924 env limitation, requires real-fs. The 7 test_wal_catchup_* (test_config_repl.c) + occasional durability FAILs on the direct binary are the SAME pre-existing bug-924 overlayfs fdatasync artifact (identical on baseline)."
     },
     {
       "id": "bug-1000",
@@ -16489,8 +16496,8 @@
       "timestamp": "2026-06-22T15:44:54.113Z",
       "error_message": "Missing error handling in errno",
       "file": ".kiro/specs/ha-term-safety/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: - _Blocked (live portion only \u2014 build+unit gate CONFIRMED GR",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: - _Blocked (live portion only — build+unit gate CONFIRMED GR",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -16538,7 +16545,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/lib/raft/raft.c",
       "root_cause": "12 lines replaced/restructured",
-      "fix": "Rewrote 16\u21923 lines (12 removed)",
+      "fix": "Rewrote 16→3 lines (12 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16553,7 +16560,7 @@
       "timestamp": "2026-06-22T22:31:03.315Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block | Also: RUN_TEST(test_catchup_applied_lsn_is_last_held_no_skip);",
       "tags": [
         "auto-detected",
@@ -16569,8 +16576,8 @@
       "timestamp": "2026-06-22T22:32:53.722Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/ha.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
-      "fix": "Added try/catch block | Also: /* Advance applied_lsn to last_good_lsn after the full batch; * last contiguously-held LSN, NOT last_good_lsn + 1 \u2014 see th",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: /* Advance applied_lsn to last_good_lsn after the full batch; * last contiguously-held LSN, NOT last_good_lsn + 1 — see th",
       "tags": [
         "auto-detected",
         "error-handling",
@@ -16586,7 +16593,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 7\u219210 lines (3 removed) | Also: *     advance applied_lsn to last-successfully-app; *     directly and advance applied_lsn to lsn+1 on",
+      "fix": "Rewrote 7→10 lines (3 removed) | Also: *     advance applied_lsn to last-successfully-app; *     directly and advance applied_lsn to lsn+1 on",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16602,7 +16609,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "2 lines replaced/restructured",
-      "fix": "Rewrote 13\u219216 lines (2 removed) | Also: /* applied_lsn must advance to 21+1=22 */; TEST_ASSERT_EQUAL_UINT64(22, | Also: /* applied_lsn must reach at least 31 (e0 applied); TEST_ASSERT_TRUE(final_lsn >= 31);",
+      "fix": "Rewrote 13→16 lines (2 removed) | Also: /* applied_lsn must advance to 21+1=22 */; TEST_ASSERT_EQUAL_UINT64(22, | Also: /* applied_lsn must reach at least 31 (e0 applied); TEST_ASSERT_TRUE(final_lsn >= 31);",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16634,7 +16641,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_config_repl.c",
       "root_cause": "9 lines replaced/restructured",
-      "fix": "Rewrote 14\u21926 lines (9 removed)",
+      "fix": "Rewrote 14→6 lines (9 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16649,7 +16656,7 @@
       "timestamp": "2026-06-22T23:44:22.860Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/commit.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16666,7 +16673,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/testsuite/test_term_safety_adapter.c",
       "root_cause": "39 lines replaced/restructured",
-      "fix": "Rewrote 84\u2192147 lines (39 removed) | Also: RUN_TEST(test_commit_advanced_is_commit_source);; RUN_TEST(test_commit_advanced_ceiling_caps_durable | Also: * which raises the barrier ceiling. 3-peer cluster; * self holds LSN 1,2 at the current term; one stan | Also: /* Durable majority: the standby's durable positio; * barrier ceiling is not held below the library co | Also: /* (3) on_commit_advanced fired \u2192 the barrier ceil; * advanced to the library point under the durable ",
+      "fix": "Rewrote 84→147 lines (39 removed) | Also: RUN_TEST(test_commit_advanced_is_commit_source);; RUN_TEST(test_commit_advanced_ceiling_caps_durable | Also: * which raises the barrier ceiling. 3-peer cluster; * self holds LSN 1,2 at the current term; one stan | Also: /* Durable majority: the standby's durable positio; * barrier ceiling is not held below the library co | Also: /* (3) on_commit_advanced fired → the barrier ceil; * advanced to the library point under the durable ",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16679,7 +16686,7 @@
     {
       "id": "bug-1013",
       "timestamp": "2026-06-22T00:00:00Z",
-      "error_message": "Stable HA cluster: committed_lsn pinned at 1 (< 5) while all 5 entries are durable on all 3 nodes \u2014 STRICT_TERM live failover gate fails 'committed_lsn>=5'",
+      "error_message": "Stable HA cluster: committed_lsn pinned at 1 (< 5) while all 5 entries are durable on all 3 nodes — STRICT_TERM live failover gate fails 'committed_lsn>=5'",
       "file": "src/controller/commit.c",
       "root_cause": "ha-term-safety task 2.4 added a min(durable-majority, raft_commit_index) ceiling in majority_candidate_locked. raft_commit_index is fed only via the library ACK path (ha_raft_on_repl_ack -> raft_advance_commit -> on_commit_advanced), which advances from match_index[] driven by the asynchronous catch-up streamer and routinely LAGS the durable majority. When delivery goes via catch-up, raft_commit_index stays low and PINS committed_lsn below the safe durable watermark (a redundant, starvation-prone gate). The durable-majority barrier was already current-term-safe under single-writer + the own-term NOOP writable gate, making the ceiling redundant.",
       "fix": "Option A: removed the raft_commit_index fold from majority_candidate_locked (commit.c). The durable-majority barrier + own-term writable_lsn gate are now authoritative for commit-advance. commit_set_raft_commit_index / ce->raft_commit_index made INERT-ADVISORY (recorded for observability/conformance-oracle only; still fed by on_commit_advanced so the library half keeps a sink). Kept durable self-cap (persist_durable_lsn), persist-before-ACK, and assert(cand<=persist_durable_lsn). Verified live: commit advances 4->5 via durable barrier (commit.c:184); walcompare OK committed prefix byte-identical across 3 nodes up to LSN 5.",
@@ -16707,7 +16714,7 @@
       "timestamp": "2026-06-23T00:22:40.544Z",
       "error_message": "Missing error handling in can",
       "file": "src/controller/testsuite/clean_failover_preservation.sh",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16723,7 +16730,7 @@
       "timestamp": "2026-06-23T01:30:18.896Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_election.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16740,7 +16747,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "5 lines replaced/restructured",
-      "fix": "Rewrote 56\u2192117 lines (5 removed)",
+      "fix": "Rewrote 56→117 lines (5 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16756,7 +16763,7 @@
       "error_message": "Clean single failover under-computes safe_committed_lsn: new leader logs 'safe_committed_lsn=1 ... (from 1 granted voters)' (self only) and truncates committed entries down to its own boot floor. Post-election safe-commit-from-votes plumbing was DEAD in production.",
       "file": "src/controller/ha.c (vote_reply_dispatch), src/controller/persist.c (persist_wal_write_replicated)",
       "root_cause": "vote_reply_decode_and_dispatch decoded the granting voter's advertised peerLastLogLsn (vr_lsn at ha.c ~4254) but vote_reply_dispatch DISCARDED it ('(void)peer_lsn; raft_on_vote_reply(...)'). raft_on_vote_reply only bumps s->votes_granted; it never records the peer LSN. The only writer of ctx->votes[idx].vote_granted/peer_lsn (handle_request_vote_reply) was, in production, called ONLY from the connect/error failure paths with (granted=0, lsn=0); the real-grant caller was gated behind a test-only hook (xce_vote_reply_hook, never set in production). So ctx->votes[*] stayed calloc'd zero -> ha_compute_safe_committed_lsn saw n_granted=1 (self) -> safe_committed_lsn = self_lsn. A standby promoting with its own durable_floor=1 then persist_truncate_wal_above(1) destroyed committed LSN 2..5.",
-      "fix": "PRIMARY: in vote_reply_dispatch production branch, route the decoded reply into the election context via a NEW record-only seam ha_record_vote_reply(ha,ctx,idx,term,granted,tag,lsn) BEFORE raft_on_vote_reply. Factored ha_record_vote_reply_locked out of handle_request_vote_reply: it records ctx->votes[idx] under ctx->lock with the idempotency guard but does NOT call ha_elect_evaluate_and_signal -> no second/racing legacy promotion path (raft_on_vote_reply remains the SOLE production promotion driver; the two quorum tallies (raft s->votes_granted / legacy ctx->votes_granted) and their guards (s->election_decided / ctx->done_posted) stay independent and idempotent). idx == vctx->peer_idx == the local ctx->votes[] index (absolute->local map done in raft_cb_send_vote_request), exactly the index ha_compute_safe_committed_lsn + the test hook use. SECONDARY: persist_wal_write_replicated now advances durable_lsn to the synced tip immediately after the inline fdatasync (mirror persist_flush; monotonic max; fail-loud rc-gated) so a standby advertises its own synced durable floor without waiting for the 10ms cadence flusher. VERIFIED: unit test_safe_commit_reflects_granting_voter_lsn RED (safe=1 'from 1 granted voters') -> GREEN (safe=5 'from 3 granted voters'); 177/177 controller_unit_test pass. NOTE: the LIVE clean_failover_preservation harness still FAILS, but the failure is PRE-EXISTING on baseline 14c41cb (verified by stash+rerun: baseline runs also diverge / lose jobs) \u2014 it is the SEPARATE bug-795/828 replication+catch-up gap (standbys' WALs physically contain only LSN 1..2, durable_floor=1; committed entries 2..5 never reach the standby WAL; primary advanced committed_lsn to 5 without a standby durable at 5). The fix DID change the live fingerprint from 'from 1 granted voters' to 'from 2 granted voters', proving the plumbing is now alive. safe-commit-from-votes is correct; the residual live job loss is out of scope (needs the catch-up/snapshot-backfill fix tracked under ha-commit-durability).",
+      "fix": "PRIMARY: in vote_reply_dispatch production branch, route the decoded reply into the election context via a NEW record-only seam ha_record_vote_reply(ha,ctx,idx,term,granted,tag,lsn) BEFORE raft_on_vote_reply. Factored ha_record_vote_reply_locked out of handle_request_vote_reply: it records ctx->votes[idx] under ctx->lock with the idempotency guard but does NOT call ha_elect_evaluate_and_signal -> no second/racing legacy promotion path (raft_on_vote_reply remains the SOLE production promotion driver; the two quorum tallies (raft s->votes_granted / legacy ctx->votes_granted) and their guards (s->election_decided / ctx->done_posted) stay independent and idempotent). idx == vctx->peer_idx == the local ctx->votes[] index (absolute->local map done in raft_cb_send_vote_request), exactly the index ha_compute_safe_committed_lsn + the test hook use. SECONDARY: persist_wal_write_replicated now advances durable_lsn to the synced tip immediately after the inline fdatasync (mirror persist_flush; monotonic max; fail-loud rc-gated) so a standby advertises its own synced durable floor without waiting for the 10ms cadence flusher. VERIFIED: unit test_safe_commit_reflects_granting_voter_lsn RED (safe=1 'from 1 granted voters') -> GREEN (safe=5 'from 3 granted voters'); 177/177 controller_unit_test pass. NOTE: the LIVE clean_failover_preservation harness still FAILS, but the failure is PRE-EXISTING on baseline 14c41cb (verified by stash+rerun: baseline runs also diverge / lose jobs) — it is the SEPARATE bug-795/828 replication+catch-up gap (standbys' WALs physically contain only LSN 1..2, durable_floor=1; committed entries 2..5 never reach the standby WAL; primary advanced committed_lsn to 5 without a standby durable at 5). The fix DID change the live fingerprint from 'from 1 granted voters' to 'from 2 granted voters', proving the plumbing is now alive. safe-commit-from-votes is correct; the residual live job loss is out of scope (needs the catch-up/snapshot-backfill fix tracked under ha-commit-durability).",
       "tags": [
         "safety",
         "failover",
@@ -16780,7 +16787,7 @@
       "timestamp": "2026-06-23T02:58:38.185Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_ha_vote_gate.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16796,8 +16803,8 @@
       "timestamp": "2026-06-23T03:05:00.000Z",
       "error_message": "Clean failover still truncates committed jobs: new primary logs 'safe_committed_lsn=1 (from 2 granted voters)' and walcompare reports committed-prefix DIVERGENCE at LSN 2; jobs at LSN 2..5 lost.",
       "file": "src/controller/testsuite/test_ha_vote_gate.c (test added); ha.c/persist.c advertise path investigated (no change needed)",
-      "root_cause": "INVESTIGATED, NOT an advertisement-staleness bug. The advertise path already reflects the live durable tip: ha_candidate_advertise_lsn -> persist_durable_floor, and the voter floor = max(persist_durable_floor, learned_committed); persist_durable_floor == persist_durable_lsn (both read p->durable_lsn, the fsync watermark), and part-1's secondary fix advances durable_lsn after the standby's inline fdatasync in persist_wal_write_replicated. LIVE evidence (fix828c_r1..r3, STRICT_TERM clean failover x3) proves the surviving voters advertise 1 because they are GENUINELY durable only at LSN 1: their WAL physically holds 1..2 (LSN2 = their own term-3 NOOP), recovered tip=2, durable_floor=1. The original primary ctrl-1 (down at election time, WAL 1..5 tip=5) advanced committed_lsn 1->2->3->4->5 in ~250ms while standbys had only converged applied_lsn=1 and catch-up streaming was still in flight. So committed advanced past what the surviving majority durably held \u2014 the UPSTREAM replication / commit-barrier durability gap (bug-795/661), not the vote advertisement. safe_committed_lsn=1 is the CORRECT, SAFE Raft answer given the real durable state; advertising the true durable tip cannot conjure data never replicated.",
-      "fix": "No production code change required for part-2 \u2014 the durable-tip advertisement is already correct & safe after part-1. Added unit test test_live_durable_tip_advertised_over_lagging_learned (test_ha_vote_gate.c): a standby durable at LSN5 (real persist, flush -> durable_lsn=5) with learned_committed lagging at 1 must advertise 5 as BOTH candidate self-LSN (ha_candidate_advertise_lsn) and voter floor (ha_vote_self_freshness over persist_durable_floor, dominating learned=1), and ha_compute_safe_committed_lsn from two such granting voters must return 5 \u2014 locking in the in-scope contract. Explicitly did NOT fold learned_committed into the CANDIDATE advertise (the requested max(...,learned_committed)) because that re-opens the truncated-candidate-over-advertises-and-wins hole ha-commit-durability task 4.2 deliberately closed (candidate must advertise only a DURABLE position; learned_committed is volatile/not necessarily durable on this node). The residual live job loss is bug-795/661, out of scope.",
+      "root_cause": "INVESTIGATED, NOT an advertisement-staleness bug. The advertise path already reflects the live durable tip: ha_candidate_advertise_lsn -> persist_durable_floor, and the voter floor = max(persist_durable_floor, learned_committed); persist_durable_floor == persist_durable_lsn (both read p->durable_lsn, the fsync watermark), and part-1's secondary fix advances durable_lsn after the standby's inline fdatasync in persist_wal_write_replicated. LIVE evidence (fix828c_r1..r3, STRICT_TERM clean failover x3) proves the surviving voters advertise 1 because they are GENUINELY durable only at LSN 1: their WAL physically holds 1..2 (LSN2 = their own term-3 NOOP), recovered tip=2, durable_floor=1. The original primary ctrl-1 (down at election time, WAL 1..5 tip=5) advanced committed_lsn 1->2->3->4->5 in ~250ms while standbys had only converged applied_lsn=1 and catch-up streaming was still in flight. So committed advanced past what the surviving majority durably held — the UPSTREAM replication / commit-barrier durability gap (bug-795/661), not the vote advertisement. safe_committed_lsn=1 is the CORRECT, SAFE Raft answer given the real durable state; advertising the true durable tip cannot conjure data never replicated.",
+      "fix": "No production code change required for part-2 — the durable-tip advertisement is already correct & safe after part-1. Added unit test test_live_durable_tip_advertised_over_lagging_learned (test_ha_vote_gate.c): a standby durable at LSN5 (real persist, flush -> durable_lsn=5) with learned_committed lagging at 1 must advertise 5 as BOTH candidate self-LSN (ha_candidate_advertise_lsn) and voter floor (ha_vote_self_freshness over persist_durable_floor, dominating learned=1), and ha_compute_safe_committed_lsn from two such granting voters must return 5 — locking in the in-scope contract. Explicitly did NOT fold learned_committed into the CANDIDATE advertise (the requested max(...,learned_committed)) because that re-opens the truncated-candidate-over-advertises-and-wins hole ha-commit-durability task 4.2 deliberately closed (candidate must advertise only a DURABLE position; learned_committed is volatile/not necessarily durable on this node). The residual live job loss is bug-795/661, out of scope.",
       "tags": [
         "safety",
         "failover",
@@ -16826,7 +16833,7 @@
       "timestamp": "2026-06-23T03:27:59.030Z",
       "error_message": "Missing error handling in unknown",
       "file": "src/controller/testsuite/test_repl_apply.c",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16843,7 +16850,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/ha.c",
       "root_cause": "6 lines replaced/restructured",
-      "fix": "Rewrote 8\u219225 lines (6 removed) | Also: INFO(\"DBG828 lib_ack lsn=%\" PRIu64 \" e_term=%\" PRI; \" after_term=%\" PRIu64 \" before_term=%\" PRIu64,",
+      "fix": "Rewrote 8→25 lines (6 removed) | Also: INFO(\"DBG828 lib_ack lsn=%\" PRIu64 \" e_term=%\" PRI; \" after_term=%\" PRIu64 \" before_term=%\" PRIu64,",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16859,7 +16866,7 @@
       "error_message": "Significant refactor of ",
       "file": "src/controller/persist.c",
       "root_cause": "3 lines replaced/restructured",
-      "fix": "Rewrote 8\u21925 lines (3 removed)",
+      "fix": "Rewrote 8→5 lines (3 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16874,8 +16881,8 @@
       "timestamp": "2026-06-23T03:45:00Z",
       "error_message": "Clean single failover (STRICT_TERM) loses committed jobs: safe_committed_lsn=1 from votes despite a standby being genuinely durable at LSN 5; walcompare reports committed-prefix divergence at LSN 2 (jobs gone on the new leader).",
       "file": "src/controller/ha.c",
-      "root_cause": "ha_enter_real_election() PRE-TRUNCATED the candidate's WAL above ha->last_known_committed_lsn BEFORE the vote. last_known_committed_lsn is the LOCALLY-LEARNED commit watermark, which LAGS the true cluster commit point (the primary commits an entry on a durable majority, then dies before a heartbeat carries that committed LSN to the standby). persist_truncate_wal_above clamps durable_lsn down to the cutoff (clamp_durable_lsn_locked). So a standby durably holding committed entries [committed+1..tip] discarded them, then advertised the stale-low cutoff as its durable floor (ha_candidate_advertise_lsn / ha_vote_self_freshness both read persist_durable_floor). Every voter doing the same collapsed safe-committed-from-votes to the stale watermark; the AUTHORITATIVE post-election truncate (raft_cb_become_leader -> persist_truncate_wal_above(safe_committed_lsn)) then kept only that stale prefix, losing committed jobs. Live trace (DBG828) PROVED the standbys wrote+fdatasync'd LSN 2-5 (durable_lsn=5) and only LOST them at the pre-election truncate clamp \u2014 NOT a durability/ack-before-fsync violation. Final bug-828/795 slice.",
-      "fix": "Removed the pre-election persist_truncate_wal_above(last_known_committed_lsn) in ha_enter_real_election (src/controller/ha.c). Raft model: a candidate does NOT truncate its log before campaigning \u2014 it keeps its full durable log and advertises its real durable tip so voters holding more committed entries deny a colder candidate and the winner has every committed entry (Leader Completeness). Divergent UNCOMMITTED tails are removed only by the authoritative post-election safe-commit truncate (above the majority-held point) and by the library's per-entry (term,lsn) reconcile (on_truncate_from) during AppendEntries. RED: live STRICT_TERM harness safe=1 + walcompare divergence at LSN 2. GREEN: every run now logs safe_committed_lsn=5 (from 2 granted voters) and walcompare 'committed prefixes identical'. Unit: new test_repl_catchup_durable_floor_survives_failover (test_repl_apply.c) + 177/177 unit GREEN. NOTE: live EXIT still 1 due to a PRE-EXISTING libxce client-failover bug (bug: 'client op fails to reach live primary when a DEAD controller is FIRST in the masters list') surfacing now that the durability bug no longer masks the post-walcompare expect-job/wait-primary step \u2014 committed jobs are physically present on disk (walcompare proves it).",
+      "root_cause": "ha_enter_real_election() PRE-TRUNCATED the candidate's WAL above ha->last_known_committed_lsn BEFORE the vote. last_known_committed_lsn is the LOCALLY-LEARNED commit watermark, which LAGS the true cluster commit point (the primary commits an entry on a durable majority, then dies before a heartbeat carries that committed LSN to the standby). persist_truncate_wal_above clamps durable_lsn down to the cutoff (clamp_durable_lsn_locked). So a standby durably holding committed entries [committed+1..tip] discarded them, then advertised the stale-low cutoff as its durable floor (ha_candidate_advertise_lsn / ha_vote_self_freshness both read persist_durable_floor). Every voter doing the same collapsed safe-committed-from-votes to the stale watermark; the AUTHORITATIVE post-election truncate (raft_cb_become_leader -> persist_truncate_wal_above(safe_committed_lsn)) then kept only that stale prefix, losing committed jobs. Live trace (DBG828) PROVED the standbys wrote+fdatasync'd LSN 2-5 (durable_lsn=5) and only LOST them at the pre-election truncate clamp — NOT a durability/ack-before-fsync violation. Final bug-828/795 slice.",
+      "fix": "Removed the pre-election persist_truncate_wal_above(last_known_committed_lsn) in ha_enter_real_election (src/controller/ha.c). Raft model: a candidate does NOT truncate its log before campaigning — it keeps its full durable log and advertises its real durable tip so voters holding more committed entries deny a colder candidate and the winner has every committed entry (Leader Completeness). Divergent UNCOMMITTED tails are removed only by the authoritative post-election safe-commit truncate (above the majority-held point) and by the library's per-entry (term,lsn) reconcile (on_truncate_from) during AppendEntries. RED: live STRICT_TERM harness safe=1 + walcompare divergence at LSN 2. GREEN: every run now logs safe_committed_lsn=5 (from 2 granted voters) and walcompare 'committed prefixes identical'. Unit: new test_repl_catchup_durable_floor_survives_failover (test_repl_apply.c) + 177/177 unit GREEN. NOTE: live EXIT still 1 due to a PRE-EXISTING libxce client-failover bug (bug: 'client op fails to reach live primary when a DEAD controller is FIRST in the masters list') surfacing now that the durability bug no longer masks the post-walcompare expect-job/wait-primary step — committed jobs are physically present on disk (walcompare proves it).",
       "tags": [
         "ha",
         "raft",
@@ -16904,7 +16911,7 @@
       "timestamp": "2026-06-23T04:07:37.423Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/specs/ha-term-safety/tasks.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16921,7 +16928,7 @@
       "error_message": "Wrong reference: $MASTERS should be $MASTERS_LIVE",
       "file": "src/controller/testsuite/clean_failover_preservation.sh",
       "root_cause": "Used \"$MASTERS\" instead of \"$MASTERS_LIVE\"",
-      "fix": "Changed $MASTERS \u2192 $MASTERS_LIVE",
+      "fix": "Changed $MASTERS → $MASTERS_LIVE",
       "tags": [
         "auto-detected",
         "wrong-reference",
@@ -16937,7 +16944,7 @@
       "error_message": "Significant refactor of ",
       "file": ".kiro/steering/ha-async-io.md",
       "root_cause": "4 lines replaced/restructured",
-      "fix": "Rewrote 10\u219210 lines (4 removed)",
+      "fix": "Rewrote 10→10 lines (4 removed)",
       "tags": [
         "auto-detected",
         "refactor",
@@ -16952,7 +16959,7 @@
       "timestamp": "2026-06-23T04:47:28.669Z",
       "error_message": "Missing error handling in unknown",
       "file": ".kiro/steering/ha-async-io.md",
-      "root_cause": "Code path had no error handling \u2014 exceptions would propagate uncaught",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
       "fix": "Added try/catch block",
       "tags": [
         "auto-detected",
@@ -16968,8 +16975,8 @@
       "timestamp": "2026-06-23",
       "error_message": "Post-failover AVAILABILITY: after a clean failover the new primary never becomes available to serve clients (wait-primary times out). New primary logs 'ha_dispatch_repl_action_for_standby: standby[0] lsn=5 < committed_lsn=6 -> stream WAL batches' every ~3s indefinitely; the lagging standby never advances to the new primary's own-term tip, and the client cannot reach a serving primary. Surfaced only AFTER bug-828 was fixed (the committed-job-loss previously masked this by failing the harness earlier at walcompare).",
       "file": "src/controller/ha.c (ha_dispatch_repl_action_for_standby / catch-up streamer on the NEW term), config_repl.c (ha_stream_wal_to_standby), persist.c (standby apply) -- NOT data loss; committed prefix is byte-identical on disk (walcompare OK).",
-      "root_cause": "UNDER INVESTIGATION (provisional). After promotion the new primary appends its own-term NOOP (e.g. LSN 6 @ term 3) and repeatedly streams [committed-1+1..committed] to a standby stuck at LSN 5, which never converges -- a catch-up completion stall on the new term (possible (term,lsn)/logOk prev-tuple mismatch on the new-term entry, or an ack-accounting gap so the streamer re-sends forever). The new primary's client-serving readiness appears gated on standby convergence, so the stall keeps it non-serving. DISTINCT from bug-854 (client-side positional discovery) and from bug-828 (server-side committed-job-loss, FIXED). Orthogonal to data safety: walcompare shows the committed prefix byte-identical across all members with all jobs on disk. Live evidence: $HOME/tmp/xce-ha-deploy/final_green (kept).",
-      "fix": "NOT FIXED. Needs a dedicated investigation: (1) why the lagging standby does not converge to the new primary's own-term tip (trace the new-term catch-up apply + ACK + the streamer's re-send condition); (2) whether/why client-serving readiness is gated on full standby convergence and whether a freshly-promoted single-writer primary should serve as soon as its own-term NOOP is majority-durable. Owner: ha-commit-durability / failover-availability. Pairs with bug-854 (client discovery) for a fully-green live clean-failover harness; bug-828 (data safety) already fixed.",
+      "root_cause": "ha_stream_wal_to_standby (config_repl.c) stamped each streamed entry's term and the AppendEntries prev_log_term from raw on-disk hdr.term (the WAL header), but the standby's logOk (raft_on_append_entries_request) and the library's own send path both source terms from persist_entry_term (the authoritative in-memory per-LSN term index), which maps a legacy-0 entry to WAL_LEGACY_TERM(1). So for a legacy-0 predecessor entry (raw hdr.term==0), the streamer sent prev_log_term=0 while the standby computed its own term as 1 → logOk mismatch → the new-term NOOP (the post-promotion first entry) is perpetually rejected → no WalAck → applied_lsn stuck at pre-promotion value → the heartbeat state report advertises the stale lsn → the primary re-streams [lsn+1..committed] every heartbeat cycle. The committed prefix stays byte-identical because only term metadata diverges, not data. CONFIRMED: baseline walcompare shows committed-prefix DIVERGENCE (term mismatch → CRC-chain breaks on some members); with the fix the committed prefix is IDENTICAL.",
+      "fix": "FIXED (2026-06-23). ha_stream_wal_to_standby gained a const persist_t* p parameter (decl in config_repl.h). All three hdr.term source sites in the streamer body (entry->term, prev_streamed_term on the main path, prev_streamed_term on the OOM-skip path) replaced with p ? persist_entry_term(p, hdr.lsn) : hdr.term (NULL-p path for count-only unit tests). Callers (ha_dispatch_repl_action_for_standby in ha.c, catchup_stream_range in config_repl.c) pass &c->persist. Unit test (test_wal_stream_term_from_index_not_raw_hdr) legacy-appends LSN 1 at term 0 + LSN 2 at term 3; streams standby_lsn=1,committed=2; asserts streamed entry term==3 and prev_log_term==WAL_LEGACY_TERM(1). RED→GREEN proven (Expected 1 Was 0 → PASS). Live: standby converge + committed prefix identical.",
       "tags": [
         "failover",
         "availability",
@@ -16978,7 +16985,12 @@
         "new-primary",
         "not-serving",
         "ha-commit-durability",
-        "NOT-FIXED"
+        "NOT-FIXED",
+        "FIXED",
+        "catch-up",
+        "ha_stream_wal_to_standby",
+        "persist_entry_term",
+        "logOk"
       ],
       "related_bugs": [
         "bug-828",
@@ -16986,8 +16998,813 @@
         "bug-795",
         "bug-991"
       ],
+      "occurrences": 2,
+      "last_seen": "2026-06-23"
+    },
+    {
+      "id": "bug-1029",
+      "timestamp": "2026-06-23T07:35:43.178Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/config_repl.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T07:35:43.178Z"
+    },
+    {
+      "id": "bug-1030",
+      "timestamp": "2026-06-23T07:35:55.634Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/config_repl.c",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 6→8 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T07:35:55.634Z"
+    },
+    {
+      "id": "bug-1031",
+      "timestamp": "2026-06-23T07:39:57.698Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/testsuite/test_config_repl.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T07:39:57.698Z"
+    },
+    {
+      "id": "bug-1032",
+      "timestamp": "2026-06-23T07:47:02.265Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/lib/client.c",
+      "root_cause": "4 lines replaced/restructured",
+      "fix": "Rewrote 20→33 lines (4 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T07:47:02.265Z"
+    },
+    {
+      "id": "bug-1033",
+      "timestamp": "2026-06-23T08:05:43.916Z",
+      "error_message": "Incorrect value in code",
+      "file": "repro854.sh",
+      "root_cause": "Had 'set masters %s\\nwait-primary 6000\\nctrlstatus\\nqu",
+      "fix": "Changed to 'set masters %s\\nset myname failover-test\\nclient\\",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T08:05:43.916Z"
+    },
+    {
+      "id": "bug-1034",
+      "timestamp": "2026-06-23T09:44:33.687Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/cluster.c",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 53→71 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T09:44:33.687Z"
+    },
+    {
+      "id": "bug-1035",
+      "timestamp": "2026-06-23T09:53:37.812Z",
+      "error_message": "Incorrect value in code",
+      "file": "src/lib/xcectx.c",
+      "root_cause": "Had \"xcectx.h\"",
+      "fix": "Changed to \"controller.capnp.h\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T09:53:37.812Z"
+    },
+    {
+      "id": "bug-1036",
+      "timestamp": "2026-06-23T10:44:48.074Z",
+      "error_message": "Wrong reference: handle_ssl_handshake should be endpoint_ssl_handshake",
+      "file": "src/lib/netio.c",
+      "root_cause": "Used \"handle_ssl_handshake\" instead of \"endpoint_ssl_handshake\"",
+      "fix": "Changed handle_ssl_handshake → endpoint_ssl_handshake",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T10:44:48.074Z"
+    },
+    {
+      "id": "bug-1037",
+      "timestamp": "2026-06-23T10:48:18.493Z",
+      "error_message": "Wrong reference: handle_ssl_handshake should be endpoint_ssl_handshake",
+      "file": "src/controller/cluster.c",
+      "root_cause": "Used \"handle_ssl_handshake\" instead of \"endpoint_ssl_handshake\"",
+      "fix": "Changed handle_ssl_handshake → endpoint_ssl_handshake",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T10:48:18.493Z"
+    },
+    {
+      "id": "bug-1038",
+      "timestamp": "2026-06-23T10:49:09.336Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/cluster.c",
+      "root_cause": "35 lines replaced/restructured",
+      "fix": "Rewrote 84→53 lines (35 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T10:49:09.336Z"
+    },
+    {
+      "id": "bug-1039",
+      "timestamp": "2026-06-23T10:51:44.066Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/lib/netio.c",
+      "root_cause": "6 lines replaced/restructured",
+      "fix": "Rewrote 35→29 lines (6 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T10:51:44.066Z"
+    },
+    {
+      "id": "bug-1040",
+      "timestamp": "2026-06-23T10:54:14.342Z",
+      "error_message": "Wrong reference: endpoint_ssl_handshake should be handle_ssl_handshake",
+      "file": "src/lib/netio.c",
+      "root_cause": "Used \"endpoint_ssl_handshake\" instead of \"handle_ssl_handshake\"",
+      "fix": "Changed endpoint_ssl_handshake → handle_ssl_handshake",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T10:54:14.342Z"
+    },
+    {
+      "id": "bug-1041",
+      "timestamp": "2026-06-23T13:27:41.076Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "6 lines replaced/restructured",
+      "fix": "Rewrote 25→32 lines (6 removed) | Also: local out; echo \"$out\" | sed -n 's/^Primary: \\(ctrl-[0-9]\\)$/",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-23T13:30:32.319Z"
+    },
+    {
+      "id": "bug-1042",
+      "timestamp": "2026-06-23T13:37:30.231Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/testsuite/waldump.c",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 8→15 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T13:37:30.231Z"
+    },
+    {
+      "id": "bug-1043",
+      "timestamp": "2026-06-23T13:42:03.549Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 7→10 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T13:42:03.549Z"
+    },
+    {
+      "id": "bug-1044",
+      "timestamp": "2026-06-23T13:59:31.958Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/lib/client.c",
+      "root_cause": "8 lines replaced/restructured",
+      "fix": "Rewrote 34→53 lines (8 removed) | Also: * rotates onward to the authoritative primary as n; /* This master is unreachable — drop the half-open",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-23T14:01:19.943Z"
+    },
+    {
+      "id": "bug-1045",
+      "timestamp": "2026-06-23T14:08:05.466Z",
+      "error_message": "Missing error handling in unknown",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: # ── Steps 7–10 looped: kill primary, verify, submit, restar; #",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-23T14:08:49.394Z"
+    },
+    {
+      "id": "bug-1046",
+      "timestamp": "2026-06-23T14:15:02.057Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 33→75 lines (3 removed) | Also: log \"round $round: killing primary $PRIMARY (pid=$; # Step 7: a new primary must be elected and serve ",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-23T14:15:40.333Z"
+    },
+    {
+      "id": "bug-1047",
+      "timestamp": "2026-06-23T14:23:30.550Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/ha.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T14:23:30.550Z"
+    },
+    {
+      "id": "bug-1042",
+      "timestamp": "2026-06-23",
+      "error_message": "Standby-rejoin never converges: a restarted controller recovers durable_floor=7 but the primary logs 'standby[0] lsn=7 < committed_lsn=14 -> stream WAL batches' every ~3s forever; the rejoined node's ha_consume_append_entries returns success=0 ae_reject_logmismatch for prevIdx=7..13. Surfaced by /xce-test-ha soak round 2 (kill primary, restart downed node, it never catches up).",
+      "file": "src/controller/myapp.c (ha_init_raft before persist_recover) + src/controller/cluster.c cluster_init_phase2 (fix site)",
+      "root_cause": "Init-ordering: ha_init_raft (myapp.c:263, before election) sources the raft library's initial_log_len from persist_durable_floor — but on the standby-rejoin boot persist_recover runs LATER (cluster_init_phase2, myapp.c:356). So the library comes up with log_len=0 and is never told about the 7 recovered durable entries. With log_len=0 the library's logOk gate rejects every incoming AppendEntries (prevLogIndex>=1 vs empty log), so the rejoined member is permanently stuck as a non-converging standby and the primary re-streams [tip+1..committed] forever. Distinct from bug-1028 (streamer term-source): here the LIBRARY's own log position is wrong, not the streamed prev_log_term.",
+      "fix": "FIXED (2026-06-23). Added ha_sync_raft_log_from_recovery(ha,p) (ha.c, decl ha.h): after persist_recover, raise ha->raft.log_len to persist_durable_floor (recovered WAL tip), commit_index to the durable floor clamped to log_len, and raft.term to ha->term — all monotonic. Called in cluster_init_phase2 right after the existing ha_sync_applied_lsn_from_recovery. Mirrors bug-848's applied_lsn sync. The library holds no entry bytes (on_get_entry_term reads the recovered per-LSN term index rebuilt by replay_wal), so raising log_len is sufficient for logOk to accept the catch-up suffix.",
+      "tags": [
+        "ha",
+        "failover",
+        "rejoin",
+        "standby",
+        "convergence",
+        "raft",
+        "log_len",
+        "init-ordering",
+        "logOk",
+        "FIXED"
+      ],
+      "related_bugs": [
+        "bug-1028",
+        "bug-848",
+        "bug-854"
+      ],
       "occurrences": 1,
       "last_seen": "2026-06-23"
+    },
+    {
+      "id": "bug-1049",
+      "timestamp": "2026-06-23T14:39:01.881Z",
+      "error_message": "Wrong condition in logic",
+      "file": "src/controller/ha.c",
+      "root_cause": "Condition was: if (0 && recovered_tip > ha->raft.log_len)",
+      "fix": "Changed to: if (recovered_tip > ha->raft.log_len)",
+      "tags": [
+        "auto-detected",
+        "logic-fix",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T14:39:01.881Z"
+    },
+    {
+      "id": "bug-1043",
+      "timestamp": "2026-06-23",
+      "error_message": "After a failover where the new primary caught up the missing suffix via REPLICATION (not local recovery), joblist/expect-job on that primary cannot find a committed job (e.g. 0-0-1782224710-0 at LSN 9-10) — even though the entry IS on disk on all members and walcompare passes. Surfaced by /xce-test-ha soak round 2: ctrl-1 (down during round 1) restarted, caught up entries 8..14 by replication, became primary, and could not list jobs submitted while it was down.",
+      "file": "src/controller/ha.c ha_apply_term_entry_via_library (catch-up apply path)",
+      "root_cause": "The term-safe library catch-up route (ha_apply_wal_catchup_entry → ha_apply_term_entry_via_library → ha_consume_append_entries → on_persist_entry → persist_wal_write_replicated) writes the replicated entry to the WAL but NEVER applies it to the in-memory entity state (job/queue/worker tables). The LEGACY direct-apply path (ha_apply_single_entry) called apply_wal_entry (→ restore_job) right after persist_wal_write_replicated; the term-safe route (ha-term-safety task 3.4) replaced that path for term-carrying entries but dropped the apply_wal_entry call. So a member that catches up via replication holds the entries on disk but not in the queryable job table; on promotion joblist/expect-job miss them — looks like committed-job loss but is an apply gap, not data loss (walcompare byte-identical).",
+      "fix": "FIXED (2026-06-23). In ha_apply_term_entry_via_library, after the library accepts+persists the entry (after_term == e->term), call apply_wal_entry(p, e->entry_type, e->lsn, e->raw_payload, e->raw_payload_len) — mirroring the legacy ha_apply_single_entry path — so the entity state (restore_job etc.) is rebuilt for replicated catch-up entries. Idempotent on re-stream (restore_job upserts by jobid); WAL_NOOP/WAL_CONFIG_MARKER no-op in apply_wal_entry.",
+      "tags": [
+        "ha",
+        "failover",
+        "catch-up",
+        "replication",
+        "job-table",
+        "apply",
+        "promotion",
+        "not-data-loss",
+        "FIXED"
+      ],
+      "related_bugs": [
+        "bug-1028",
+        "bug-1042",
+        "bug-828"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-06-23"
+    },
+    {
+      "id": "bug-1051",
+      "timestamp": "2026-06-23T14:48:18.998Z",
+      "error_message": "Wrong operator: >= should be ==",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "Used \">=\" instead of \"==\"",
+      "fix": "Changed operator >= → ==",
+      "tags": [
+        "auto-detected",
+        "operator-fix",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T14:48:18.998Z"
+    },
+    {
+      "id": "bug-1052",
+      "timestamp": "2026-06-23T14:53:22.593Z",
+      "error_message": "Missing error handling in unknown",
+      "file": ".claude/skills/xce-test-ha/SKILL.md",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T14:53:22.593Z"
+    },
+    {
+      "id": "bug-1053",
+      "timestamp": "2026-06-23T14:54:33.747Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "9 lines replaced/restructured",
+      "fix": "Rewrote 25→38 lines (9 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T14:54:33.747Z"
+    },
+    {
+      "id": "bug-1054",
+      "timestamp": "2026-06-23T16:02:42.489Z",
+      "error_message": "Incorrect value in code",
+      "file": ".claude/skills/xce-test-ha/SKILL.md",
+      "root_cause": "Had \"End-to-end HA failover soak test for an XCE contr",
+      "fix": "Changed to \"End-to-end HA failover soak test for an XCE contr",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T16:02:42.489Z"
+    },
+    {
+      "id": "bug-1055",
+      "timestamp": "2026-06-23T16:02:53.637Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/SKILL.md",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 8→16 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T16:02:53.637Z"
+    },
+    {
+      "id": "bug-1056",
+      "timestamp": "2026-06-23T16:04:15.564Z",
+      "error_message": "Significant refactor of ",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 5→9 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T16:04:15.564Z"
+    },
+    {
+      "id": "bug-1057",
+      "timestamp": "2026-06-23T22:52:51.718Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/lib/hook.c",
+      "root_cause": "5 lines replaced/restructured",
+      "fix": "Rewrote 16→31 lines (5 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-23T22:52:51.718Z"
+    },
+    {
+      "id": "bug-1058",
+      "timestamp": "2026-06-24T03:00:17.256Z",
+      "error_message": "Missing error handling in unknown",
+      "file": ".claude/skills/xce-test-ha/run-ha-soak.sh",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "sh"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T03:00:17.256Z"
+    },
+    {
+      "id": "bug-1059",
+      "timestamp": "2026-06-24T03:01:22.373Z",
+      "error_message": "Missing error handling in unknown",
+      "file": ".claude/skills/xce-test-ha/SKILL.md",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T03:01:22.373Z"
+    },
+    {
+      "id": "bug-1060",
+      "timestamp": "2026-06-24T12:05:00.000Z",
+      "error_message": "After soak test coverage maneuver, ctrl-1 and ctrl-2 enter permanent prevote deadlock: ctrl-1 denies ctrl-2 (freshness: LSN=45 < floor=47), ctrl-2 denies ctrl-1 (log_stale: cand_llt=12 < local_last_log_term=13). Neither can ever win.",
+      "file": "src/controller/ha.c (raft_cb_become_leader / safe_committed_lsn), src/controller/cluster.c (OPCode_preVoteRequest)",
+      "root_cause": "ctrl-3 computed safe_committed_lsn=44 from voter peerLastLogLsn (ctrl-3=47, ctrl-2=44 → majority at 44) and truncated committed entries 45-47 (term=12, acked by ctrl-3 itself as standby under ctrl-1). ctrl-3 then wrote leadership NOP at LSN=45 (term=13) and replicated it to ctrl-2. Result: ctrl-1 has LSN=45=JOB_SUBMIT/term=12, ctrl-2 has LSN=45=NOOP/term=13 — divergent WALs. The safe_committed_lsn formula ignores the candidate's own durable knowledge of committed entries, violating Leader Completeness: the new leader must never truncate entries it has that were committed by a prior leader.",
+      "fix": "IMPLEMENTED (2026-06-24): added pure helper ha_promotion_truncate_floor(safe_lsn, durable_tip)=max(safe_lsn,durable_tip) in ha.c/ha.h; raft_cb_become_leader now truncates at max(safe_committed_lsn, persist_durable_floor(&c->persist)) instead of bare safe_committed_lsn. Since the cutoff is never below the leader's own durable tip, persist_truncate_wal_above is a no-op on the leader's durable log — the new leader NEVER truncates entries it holds (Raft §5.4 Leader Completeness). safe_committed_lsn is still the commit lower-bound and promotion-gate HWM (NOT clamped — clamping it would defeat the behind-node fence). The leadership NOP now appends at the true tip (current_lsn) so replication converges peers to the leader's WAL with zero job loss. Unit test test_promotion_never_truncates_own_committed_entries in test_ha_election.c (GREEN). Steering src/controller/CLAUDE.md updated (Leader Completeness section + Post-Election Safe Commit Point + verification checklist). Recovery of an already-diverged cluster still requires restarting the over-truncated node (loses the cut jobs); this fix prevents the divergence.",
+      "tags": [
+        "prevote",
+        "deadlock",
+        "safe_committed_lsn",
+        "truncation",
+        "leader-completeness",
+        "data-loss",
+        "coverage-maneuver",
+        "FIXED"
+      ],
+      "related_bugs": [
+        "bug-795",
+        "bug-828"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T18:00:00.000Z"
+    },
+    {
+      "id": "bug-1061",
+      "timestamp": "2026-06-24T04:20:48.527Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/testsuite/test_ha_election.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T04:20:48.527Z"
+    },
+    {
+      "id": "bug-1062",
+      "timestamp": "2026-06-24T04:21:33.501Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/ha.c",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 7→20 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T04:21:33.501Z"
+    },
+    {
+      "id": "bug-1063",
+      "timestamp": "2026-06-24T04:31:30.033Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/ha.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T04:31:30.033Z"
+    },
+    {
+      "id": "bug-1064",
+      "timestamp": "2026-06-24T04:31:50.319Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/ha.c",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 7→20 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T04:31:50.319Z"
+    },
+    {
+      "id": "bug-1065",
+      "timestamp": "2026-06-24T04:33:23.913Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/testsuite/test_ha_election.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T04:33:23.913Z"
+    },
+    {
+      "id": "bug-1066",
+      "timestamp": "2026-06-24T04:36:50.602Z",
+      "error_message": "Incorrect value in code",
+      "file": "src/controller/CLAUDE.md",
+      "root_cause": "Had `persist_truncate_wal_above(safe_committed_lsn)`",
+      "fix": "Changed to 's own durable log**: the cutoff is `",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-24T04:37:04.779Z"
+    },
+    {
+      "id": "bug-1067",
+      "timestamp": "2026-06-24T00:00:00.000Z",
+      "error_message": "Cross-term WAL catch-up permanently stalls: ctrl-2 stuck at lsn=8, all walCatchupEntry rejected (ae_reject_stale + ae_reject_logmismatch)",
+      "file": "src/controller/config_repl.c, src/controller/ha.c",
+      "root_cause": "AE term conflation: entry->term is the WAL entry's stored term (e.g. 4 for entries written by ctrl-1 at term=4), but ha_consume_append_entries uses it as the AE header ae_term. For live appends this is correct (leader appends at current term), but for catch-up streaming of historical entries from prior terms, ae_term = entry_term < leader.current_term. The Raft AE stale-term check (if term < s->term → ae_reject_stale) correctly rejects, but it should never fire — the AE header term must always be the leader's current term. There is no separate leader_term field in wal_catchup_entry_t. Consequence: historical entries at entry_term < raft.term are permanently rejected; standby_reported_lsn never advances; streamer retransmits forever.",
+      "fix": "IMPLEMENTED (2026-06-24): separated the AppendEntries HEADER term (leader's CURRENT term) from the per-entry STORED term. Added wire field WalCatchupEntry.leaderCurrentTerm @8 (controller.capnp) + C field wal_catchup_entry_t.leader_current_term (typemap.h, hand-defined struct — capnp generates encode/decode against it). Encoder (request.c wal_entry_to_wire + top container) writes it; decode auto-populates (generated, scalar mapname field). The catch-up streamer ha_stream_wal_to_standby gained a leader_term param (callers pass atomic_load(&c->ha.term)) and stamps entry->leader_current_term=leader_term on every streamed entry. Receiver ha_consume_append_entries now uses ae_term = e->leader_current_term ? e->leader_current_term : entry_term (single-entry branch) — the leader term rides on the sub-entry e by reference through ha_apply_term_entry_via_library, so no extra threading needed. entry->term (@4) remains the per-entry stored term for logOk/on_persist_entry. 0 = unset (legacy/live sender) → falls back to stored term (live appends have entry_term==leader_term, so unchanged). repl.c live paths UNTOUCHED. Tests (test_term_safety_adapter.c): test_intake_crossterm_catchup_uses_leader_current_term (historical entry@term4 streamed by leader@term5 to follower@term5 is ACCEPTED, not stale-rejected) + test_intake_stale_leader_term_still_rejected (leader_current_term=3 < follower term 5 still REJECTED — safety preserved). GREEN: 185 PASS term-safety+config-repl, 6 PASS wal_wire wire round-trip, 80 PASS failover/repl/durability, 0 failures.",
+      "tags": [
+        "catch-up",
+        "replication",
+        "raft",
+        "ae_reject_stale",
+        "ae_reject_logmismatch",
+        "walCatchupEntry",
+        "cross-term",
+        "FIXED"
+      ],
+      "related_bugs": [
+        "bug-1028",
+        "bug-991"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T20:00:00.000Z"
+    },
+    {
+      "id": "bug-1068",
+      "timestamp": "2026-06-24T08:17:50.386Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/schema/controller.capnp",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "capnp"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:17:50.386Z"
+    },
+    {
+      "id": "bug-1069",
+      "timestamp": "2026-06-24T08:17:58.670Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/lib/request.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:17:58.670Z"
+    },
+    {
+      "id": "bug-1070",
+      "timestamp": "2026-06-24T08:18:27.510Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/config_repl.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block | Also: if (c && c->persist.wal_path[0]) {; /* bug-1067: pass the leader's CURRENT term so historical ca",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-24T08:18:42.316Z"
+    },
+    {
+      "id": "bug-1071",
+      "timestamp": "2026-06-24T08:18:57.361Z",
+      "error_message": "Significant refactor of ",
+      "file": "src/controller/ha.c",
+      "root_cause": "3 lines replaced/restructured",
+      "fix": "Rewrote 12→17 lines (3 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:18:57.361Z"
+    },
+    {
+      "id": "bug-1072",
+      "timestamp": "2026-06-24T08:19:19.691Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/config_repl.h",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "h"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:19:19.691Z"
+    },
+    {
+      "id": "bug-1073",
+      "timestamp": "2026-06-24T08:20:01.379Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/ha.c",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:20:01.379Z"
+    },
+    {
+      "id": "bug-1074",
+      "timestamp": "2026-06-24T08:21:09.937Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/include/typemap.h",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "h"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:21:09.937Z"
+    },
+    {
+      "id": "bug-1075",
+      "timestamp": "2026-06-24T08:23:04.980Z",
+      "error_message": "Wrong reference: standby_lsn should be leader_term",
+      "file": "src/controller/testsuite/test_coldstart_lsn0.c",
+      "root_cause": "Used \"standby_lsn\" instead of \"leader_term\"",
+      "fix": "Changed standby_lsn → leader_term",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "c"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:23:04.980Z"
+    },
+    {
+      "id": "bug-1076",
+      "timestamp": "2026-06-24T08:32:38.896Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "src/controller/CLAUDE.md",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-24T08:32:38.896Z"
     }
   ]
 }
\ No newline at end of file
diff --git a/.wolf/cerebrum.md b/.wolf/cerebrum.md
index 4d8fe00..c23515c 100644
--- a/.wolf/cerebrum.md
+++ b/.wolf/cerebrum.md
@@ -9,6 +9,8 @@
 <!-- How the user likes things done. Code style, tools, patterns, communication. -->
 
 ## Key Learnings
+- (2026-06-23, bug-1028 FIXED) There MUST be exactly ONE authoritative source for a WAL entry's Raft term. The leader's library send path (`ha_read_wal_entry_at`, ha.c:1472-1476) and the standby's `logOk`/`on_get_entry_term` both source terms from `persist_entry_term` (in-memory index, legacy-0→WAL_LEGACY_TERM). The heartbeat catch-up streamer (`ha_stream_wal_to_standby`, config_repl.c) — the third consumer — was sourcing terms from raw on-disk `hdr.term` (0 for legacy entries). A standby's `prev_log_term=1` (normalised) ≠ streamer's `prev_log_term=0` (raw) → `logOk` rejects the new-term NOOP forever → `applied_lsn` stuck → primary re-streams every heartbeat cycle. Fix: all three `hdr.term` reads in the streamer replaced with `persist_entry_term(&persist, hdr.lsn)`; function gained a `const persist_t*` parameter. This is the pattern: every source of the per-LSN (term,index) tuple MUST go through `persist_entry_term`; NEVER read `hdr.term` raw from disk — it is not normalised.
+- (2026-06-23, bug-854 FIXED) The `XCECLI_FAILOVER_CALL` retry loop classifies a status-0 reply from ANY reachable node as SUCCESS and returns — it only rotates on failure. But ctrlstatus is answerable in every role, so a standby always answers 0, making `xcecli_ctrlstatus` pin to the first reachable node forever. The outer `xcecli_ctrlstatus_primary` loop captures a redirect hint from the non-authoritative reply but never forces rotation to the next master — so the configured master list is never traversed. Fix: `xcecli_ctrlstatus_primary` now calls `xce_failover_rotate(ctx)` + `xcecli_ctx_recover(ctx)` under `failover.lock` on every non-authoritative reply; the floor of `max_attempts` was raised to `nmasters+1` to cover the full ring. General pattern: any outer retry loop that queries a role-agnostic status must **force endpoint rotation** on a non-authoritative reply — do not rely on the inner failover wrapper, because status-0 preempts it.
 - (2026-06-22, ha-term-safety task 3.1) The single primary-append seam is `ha_primary_log_append(cluster_t*,type,payload,len,&out_lsn)` (ha.c, decl ha.h ~333): packs the `raft_entry_blob_t` envelope and calls `raft_log_append(&c->ha.raft,...)` so the LIBRARY stamps `s->term` + assigns LSN + fires `on_persist_entry`. CRITICAL: `raft_log_append` returns `-EPERM` unless `s->role==RAFT_LEADER` — and `ha_do_promote`/the non-raft `ha_promote_to_primary` road sets `ha->role=CTRL_PRIMARY` but NOT `ha->raft.role` (only the raft election road via on_become_leader sets RAFT_LEADER). So `ha_primary_log_append` MUST have a `-EPERM`→legacy `persist_wal_async` fallback (stamping `ha->term` via persist_set_term first) or init-time/non-raft/engine-less promotion breaks. Retired the hand-rolled bypass by routing persist.c `wal_hook_append_classified` (RETAIN job/queue/worker hooks) + `persist_wal_sync_append` (WAL_JOB_SUBMIT WAIT) through `ha_primary_log_append` GUARDED on `p->cluster != NULL` — standalone persist (lib-level tests, `persist_init(p,&cfg,NULL)`) keeps the direct persist_wal_async path. `p->cluster` is the back-ref (persist.h, set in persist_init); ha.h is reachable in persist.c via `xce/cluster_def.h`. Co-tracking invariant `p->current_lsn == s->log_len + 1` holds because raft_init (2.5) seeds log_len from durable floor and every primary append advances both by 1. To make a controller TEST drive raft_log_append: `ha_init_raft` then set `c->ha.raft.role=RAFT_LEADER` + `c->ha.raft.term=T` directly (the raft-sim convention). on_persist_entry calls persist_wal_async (NOT the hooks) so no recursion. `ha_arm_own_term_gate` is static → test seam `ha_arm_own_term_gate_for_test`. Validation: pre-existing `test_wal_catchup_*` (7, bug-924 overlayfs) fail IDENTICALLY on baseline (git stash + rebuild proves it); every other group 0 fail.
 - (2026-06-20, waldump tooling) The `xce_test` binary (`src/controller/meson.build`) builds from `testsuite/test.c` ONLY + `libxce_dep` — it does NOT link `persist.c`/`job.c` (those are in the `controller_unit_test` target). The investigation doc's claim that xce_test "links persist.c/job.c" was WRONG. BUT capnp `read_Job` is generated into `controller.capnp.c` which IS compiled into `libxce`, so it's reachable transitively. To USE capnp/zlib symbols from test.c you must add `c_capnproto_dep` + `zlib_dep` to `xce_test_deps` (static-lib deps don't auto-propagate through `declare_dependency(link_with: libxce)`). For a zero-alloc jobid decode read `struct Job.jobid` directly after `read_Job` — skip the allocating `decode_Job`. WAL CRC reader template = `persist_test_durable_lsn_on_disk` (persist.c ~888): seg files `seg-%016llx.wal` under `<node>/data/wal`, 40B `wal_entry_hdr_t`, crc32 over `WAL_HDR_CRC_SIZE`(=32) header bytes + payload, prev_crc chain, all-zero hdr = clean EOF (pre-alloc). Offline `waldump` lives in `testsuite/waldump.{c,h}` + `cmd_waldump` in test.c top_commands.
 - (2026-06-18, ha-commit-durability task 5.2 VALIDATION) Deterministic E2E on the FIXED build = GREEN, stable 3/3 runs (9/9 probes PASS), in-window primary fdatasync=2 on EVERY probe (vs 0/RED on the unfixed 1.3 build) — the RED→GREEN flip is the deterministic acceptance and is confirmed. Run via `nix develop ./src --command bash -c 'bash src/tools/test-commit-durability.sh --deterministic <deploy>'` background+poll worktree log; cold election ~15s, 3 probes, exit 0. The ROLLING SIGKILL SOAK is host-verification-needed in-sandbox: rounds 1-2 PASS (jobs survive failover), then round 3 onward "no new primary elected within 40s" and every "DATA LOSS" report is a query against a cluster with NO live primary (same 5 jobs frozen, never re-acked). ROOT CAUSE of the collapse is the durability fix's OWN promotion fence working AS DESIGNED: ctrl-1 won PreVote for term=5, computed safe_committed_lsn=13, then `persist_recover_fatal_if_unrecoverable` FATAL-terminated ("recovery-truncated log ... no healthy peer reachable ... durable_floor_lsn=13 < hwm=13 ... terminating rather than serving divergent state, Req 2.4") — refusing to let a structurally-truncated node lead and overwrite the good timeline (exactly the bug-661 failure mode the fix prevents). Under aggressive rolling-kill+immediate-restart the fence repeatedly self-terminates recovering nodes → cluster drops below quorum → liveness collapse, NOT durable loss. PROOF it's not loss: committed entries still on disk after the run (ctrl-3 WAL has seg-1 + seg-15; ctrl-2 seg-1) and 0 live controllers at end. So the soak's exit=1 / "DATA LOSS" verdict is a HARNESS ARTIFACT (it equates empty-joblist-with-no-primary to loss) — the soak harness conflates election-stall liveness failure with durability loss. The deterministic flip is the must-have and passed; the live multi-round soak needs a real host (slower election timing, no sandbox reaping) to distinguish fence-driven safety self-termination from a true regression. Did NOT patch production (5.2 is validation-only).
@@ -88,6 +90,8 @@
 - (2026-06-22, ha-term-safety task 3.3 remediation) Do NOT run `clang-format -i` on whole XCE controller source files (ha.c/ha.h/test files): these files are NOT clang-format-clean against the repo's config, so a full reformat rewrites ~1700 lines and BURIES the targeted change (and violates a "preserve the existing diff" instruction). I then made it worse with `git checkout HEAD -- <files>` to undo the format — but the uncommitted task-3.3 work lived ONLY in the working tree, so that wiped it (no stash, unrecoverable from git). Recovery worked only because the full original content was already in my context. Lesson: (1) only format the exact changed regions or skip formatting; (2) NEVER `git checkout HEAD -- <file>` to discard formatting noise when the file also holds uncommitted feature work — instead revert just the format hunks, or stash first. The reflog showed branch HEAD was already at task-3.2 (754e586), and the initial-context "recent commit 2c5d298" was a stale snapshot — the uncommitted 3.3 diff sat on top of 3.2.
 - (2026-06-22, ACK peer-index, bug-960) The walAck branch of `repl_ack_decode_and_dispatch` (ha.c) fires for TWO endpoint types whose stored `peer_idx` means DIFFERENT things: promoted-vote eps (`vote_ep_ctx_t`, `ctx!=NULL`) carry a self-EXCLUDED *votes* index (relative); heartbeat standby eps (`standby_ep_ctx_t`, `ctx==NULL`) carry an ALREADY-ABSOLUTE candidate index. The authoritative branch is ha.c:6187-6189 (`sctx->ctx != NULL ? votes_idx : i`). The pre-existing ACK consumer `ha_walack_on_ack(c, vctx->peer_idx, …)` uses `peer_idx` DIRECTLY (no remap) — proof the ACK path's index is already absolute. Any code consuming the ACK `peer_idx` for the library (match_index[]/next_index[], which raft.c writes UNCHECKED) MUST branch on `vctx->ctx != NULL` before remapping, or it double-maps the heartbeat path → wrong-peer false quorum / OOB write. `self_idx == ha->my_priority` (raft_cfg.self_idx = my_priority everywhere).
 
+- (2026-06-24, bug-1060 — RECURRENCE of the 2026-06-22 entry above) Ran `clang-format -i` on whole ha.c/ha.h/test_ha_election.c AGAIN → spurious whole-file reformat (3268/969/635 lines) that buried a ~180-line fix. Confirmed spurious by checking the repo's HEAD ha.c is NOT idempotent under the nix `clang-format` (a `.clang-format` exists at src/.clang-format but the pinned formatter version differs from whatever produced HEAD). Recovery THIS time succeeded because: (a) I had already printed the full pre-format `git diff ha.c` (5 hunks: bug-1028/1042/1043 pre-existing + my bug-1060) into context; (b) ha.h's only genuine new symbol vs HEAD was `ha_sync_raft_log_from_recovery` (found via `comm` on `grep -oE '\bha_[a-z_]+\b'` of HEAD-vs-current — everything else was pointer-style/comment reflow); (c) test_ha_election.c was NOT in the session-start `M` list so it held only my changes. Then `git checkout HEAD -- <3 files>` + re-applied the logical hunks by Edit. LESSON STANDS: do NOT clang-format whole files here; format only changed regions or skip. The `git checkout HEAD --` rescue is ONLY safe after you have positively accounted for EVERY uncommitted change in those files (capture the pre-format `git diff` FIRST, and confirm which files had pre-existing work via the session-start `git status`).
+
 <!-- Mistakes made and corrected. Each entry prevents the same mistake recurring. -->
 <!-- Format: [YYYY-MM-DD] Description of what went wrong and what to do instead. -->
 
@@ -245,6 +249,17 @@ Pure library core (no I/O/threads) + controller callback adapters keeps it simul
 - FEATURE GATE: raft_commit_index==0 means INERT (library source not yet wired by tasks 3.x) → barrier keeps autonomous durable-majority behavior. This is what stops 2.4 from regressing the whole test_commit_engine suite (which sets no raft index). The ceiling only engages at commit_index>=1.
 - Unit-test runner: `./xce.build/controller/controller_unit_test -t <group> [-t <group2>]` runs only named groups (argp `--run`/`-t`). Far faster than the full binary which times out (bug-924). Full clean build still `nix develop --command bash tools/xce-build.sh controller`.
 
+## Key Learning (2026-06-24, bug-1060) — a new leader MUST NEVER truncate its own log (Raft §5.4 Leader Completeness)
+- The post-election `safe_committed_lsn` (median of granted-voter LSNs) is a valid commit LOWER-BOUND and the promotion-gate HWM, but it is NOT a safe WAL-truncation cutoff: it can sit BELOW entries the new leader itself holds durably. Those entries were acked by this node as a standby ⇒ committed by the prior leader. `raft_cb_become_leader` calling `persist_truncate_wal_above(safe_lsn)` destroyed them (granted `{self=47, peer=44}` → median 44 cut the leader's own committed 45..47), and `persist_truncate_wal_above` ALSO sets `committed_lsn=cutoff` (a commitIndex DECREASE) + clamps durable down. The leadership NOP then landed at LSN 45 (the rewound tip) under term+1, diverging vs peers still holding the old job at 45 → contradictory freshness denials (one node fresher by index, the other by term) → permanent prevote deadlock + committed-job loss.
+- FIX shape: clamp the truncation cutoff to `max(safe_lsn, persist_durable_floor)` via pure helper `ha_promotion_truncate_floor` so truncate is a no-op on the leader's durable log. Do NOT clamp `safe_lsn` itself inside `ha_compute_safe_committed_lsn` — `promotion_safe_lsn` is also the behind-node fence HWM; inflating it to self's tip would make every node trivially pass its own gate. The deadlock was a SYMPTOM; the freshness gate is correct (it refused to elect a leader that would lose committed data). Same class as bug-795/bug-828 ("new leader truncates own committed entries"); bug-828 fixed grant-RECORDING so the median reflects the majority, bug-1060 fixes the remaining case where the median is below the leader's OWN tip.
+- `persist_truncate_wal_above(cutoff)` is a NO-OP when `cutoff+1 >= current_lsn` (returns early, does NOT touch committed_lsn). Only when it actually cuts does it set committed_lsn=cutoff + clamp durable. So clamping the cutoff to >= durable tip makes it inert on a recovered leader (current_lsn == durable_tip+1).
+
+## Key Learning (2026-06-24, bug-1067) — AppendEntries has TWO terms; never conflate them
+- Raft's AppendEntries carries (a) the HEADER/leader term — `term` arg of raft_on_append_entries_request, used for UpdateTerm + the stale-reject `if term < s->term → ae_reject_stale` — and (b) each ENTRY's STORED term (`entry_term` arg), used for logOk + on_persist_entry. The XCE library `raft_on_append_entries_request` already takes them as SEPARATE args; the controller adapter `ha_consume_append_entries` was setting `ae_term = entry_term` (the stored term). Correct for a LIVE append (leader appends at its current term ⇒ equal), but for CATCH-UP of a HISTORICAL entry written by a PRIOR leader, entry_term < current leader term ⇒ stale-reject of every historical entry ⇒ cross-term catch-up wedges forever (standby stuck, streamer retransmits). FIX: carry the leader's current term out-of-band per entry (`wal_catchup_entry_t.leader_current_term`, wire `WalCatchupEntry.leaderCurrentTerm @8`), stamped by `ha_stream_wal_to_standby` = ha->term, used as ae_term with fallback to entry_term when 0.
+- DO NOT try to fix this receiver-side by using `s->term` as the AE term: a genuinely STALE leader (leader term < s->term) could then push divergent entries through (the stale-check is the ONLY thing rejecting it). The leader's current term MUST travel on the wire and be checked. Test both: cross-term ACCEPT + stale-leader REJECT.
+- `wal_catchup_entry_t` is HAND-DEFINED in src/include/typemap.h, NOT generated — but `capnp compile` GENERATES encode/decode (controller.capnp.c) AGAINST it via `$C.mapname`. So adding a schema field requires editing BOTH controller.capnp (wire) AND typemap.h (the C struct) or the build fails "no member". All scalar mapname fields auto-decode (request.c xce_decode only hand-extracts the Data payload); the leader term rides on each sub-entry and reaches ha_consume via ae.entries[0]=e by reference (no extra plumbing through ha_apply_term_entry_via_library).
+- `ha_stream_wal_to_standby` has MANY callers incl. several in test_config_repl.c (2589/2630/2664/2740) and test_coldstart_lsn0.c (339/387) — grep ALL of them before changing the signature, not just the production caller.
+
 ## Do-Not-Repeat (2026-06-21)
 - Don't trust a green "baseline" reading blindly: the lib suite was actually red on HEAD via a stale test_config.c assertion (DEFAULT_SYNC_TIMEOUT_MS 50 vs committed 500 from commit ca1d9ae). Verify with the exact meson test command, not assumptions.
 
@@ -257,3 +272,28 @@ Pure library core (no I/O/threads) + controller callback adapters keeps it simul
 - conf_save_config bumps myconf->config_version_tag (the advertised tag) WITHOUT decoding/activating (cluster_config unchanged). Only load_primary_config decodes into mc->cluster_config. So the activation witness in tests is the cluster_config POINTER (load_primary_config frees+reallocates it), NOT config_version_tag.
 - In the single-member commit fixture (commit_engine_init n_peers=1), majority_candidate_locked returns persist_durable_lsn => committed_lsn auto-advances to the durable WAL tip on any commit re-eval (incl. conf_save_config). To hold a flushed marker "uncommitted" in a test, SAVE first then atomic_store committed_lsn back below the marker LSN (models a standby whose committed prefix lags its local WAL tip).
 - Off-iomgr scheduling pattern: ha_convergence.c is the canonical example — delay_task_ms(&c->delaymgr, 1, 1, entry, ctx) enqueues (ordq_put only, non-blocking) and the delaymgr worker runs the body off the iomgr ACK thread. Tests drive the queued task by calling its entry fn directly (the fixture leaves delaymgr unstarted). Guard scheduling on c->delaymgr.running to avoid leaking tasks into an undrained queue in the unit-test fixture.
+
+## Key Learnings (2026-06-23, /xce-test-ha HA soak — 3 failover bugs)
+- (bug-854 dead-first residual) The client `client`/`xcecli_start` initial connect was hardcoded to `endpoint_connect(masters[0])`; if masters[0] is a KILLED node (connection-refused), the whole session fails BEFORE the failover loop (which only runs on an already-connected ctx) can rotate. FIX: loop `xcecli_start` over ALL masters, re-init the endpoint between attempts (endpoint_fini + endpoint_init + endpoint_set_peer + rebind ctx.iomgr — same as xce_ctx_reconnect), set failover.cur_master to the connected index. Verified: dead-first masters list discovers primary in 46ms (was: hang). Distinct from the earlier bug-854 fix (xcecli_ctrlstatus_primary force-rotation) which only covered the all-live standby-first case.
+- (bug-1042 rejoin never converges) ha_init_raft (myapp.c, BEFORE election) sources the raft library `initial_log_len` from persist_durable_floor — but on a standby-REJOIN boot persist_recover runs LATER (cluster_init_phase2). So a restarted node's library comes up log_len=0 and its logOk rejects EVERY AppendEntries (prevLogIndex>=1 vs empty log) → permanently stuck non-converging standby; primary logs "standby[i] lsn=N < committed_lsn=M -> stream WAL batches" forever. FIX: ha_sync_raft_log_from_recovery(ha,p) after persist_recover (cluster.c), raising raft.log_len/commit_index/term to recovered values (monotonic, clamp commit<=log_len). Mirrors bug-848's applied_lsn sync. Diagnostic tell: `ae_reject_logmismatch` at prevIdx==recovered_floor on the rejoined node.
+- (bug-1043 catch-up apply gap) The term-safe library catch-up route (ha_apply_term_entry_via_library → ha_consume_append_entries → on_persist_entry → persist_wal_write_replicated) writes the WAL but NEVER calls apply_wal_entry/restore_job — so a member that catches up the missing suffix by REPLICATION holds entries on disk but NOT in the queryable job table. On promotion joblist/expect-job miss them → looks like committed-job loss but walcompare is byte-identical (it's an apply gap, not data loss). The LEGACY ha_apply_single_entry path called apply_wal_entry after persist; the term-safe route (ha-term-safety 3.4) dropped it. FIX: re-add apply_wal_entry on the accepted path in ha_apply_term_entry_via_library.
+- (HA soak harness design) /xce-test-ha convergence gate must NOT key on "standby[i] converged" log (only re-emitted for a standby that was NOT-converged under the current primary term — a standby restarted already-caught-up never logs it). Use "no NEW 'stream WAL batches' line on the primary for ~6s" == all standbys converged (HA_REPL_CONVERGED is a silent no-op). Detect new-primary election via the INFO line "HA FSM (raft): → CTRL_PRIMARY (term=N)" with term STRICTLY > pre-kill term (user guidance). Only SINGLE-failover is guaranteed — the soak MUST wait full 3-of-3 reconvergence before the next kill, else it tests an unsupported double-fault window and reports false loss.
+
+## Do-Not-Repeat (2026-06-23, shell portability)
+- This deploy env's `realpath` is BUSYBOX (`/sbin/realpath`): it does NOT support `-m` (treats it as a filename, errors to stderr, and on a relative path whose parent exists still prints a resolved line to stdout → with `|| echo "$TOP"` you get MULTI-LINE garbage in the var). `readlink -f` also fails on nonexistent paths here. Don't rely on `realpath -m`/`readlink -f` for path normalization in scripts that run under nix/this host. Use pure-bash absolutization instead: `case "$P" in /*) : ;; *) P="$PWD/$P" ;; esac`. (Caught while adding the [dir] arg to run-ha-soak.sh.)
+
+## Key Learnings (2026-06-23, /xce-test-ha [dir] arg)
+- run-ha-soak.sh deploy dir now resolves: positional `$1` > `$XCE_HA_TOP` env > default `/home/claude/tmp/xce-ha-deploy`. The skill maps `/xce-test-ha [rounds] [dir]` → rounds to `XCE_HA_ROUNDS` env, dir to the positional arg. Because the deploy is `rm -rf`-destructive and the dir is now caller-chosen, a sentinel `.xce-ha-deploy` marker is written at deploy time and a guard refuses to wipe a non-empty dir lacking it (fail-loud, protects a typo'd home/source path). Empty/nonexistent dir is always safe.
+
+## Key Learnings (2026-06-23, bug-845 WAL double-append fixed)
+- The hook system (src/lib/hook.c) had NO dedup: xce_add_hook appended a new slot for a repeat (fn,data); xce_run_hooks fires ALL slots; xce_disable_hook NULLs only ONE. So registering the same hook twice = fires twice + survives one disable. Every WAL_JOB_SUBMIT was double-appended (byte-identical, adjacent LSN) because persist_start() (boot, unconditional) AND ha_register_persist_hooks() (PRIMARY promotion) both register persist_job_hook_fun with the same persist_t. The hooks_registered guard only stops ha_register from re-adding ITSELF — it's blind to persist_start's registration.
+- FIX = make xce_add_hook idempotent on exact (fn,data): re-adding an active (fn,data) is a no-op; same fn + DISTINCT data still creates a 2nd slot (legitimate multi-closure, preserved by test). Chosen over "remove persist_start's registration" because MANY controller unit tests (test_e2e_checkpoint, test_ha_role_lifecycle, test_commit_barrier_reply:387 "persist_start registers the production hooks") DEPEND on persist_start registering the hooks and do NOT call ha_register — removing it would break that contract.
+- ack gating: handle_jobsubmit (job.c) acks the client iff xce_run_hooks(AFTER_EVENT JOB_NEW) returns 0, and xce_run_hooks returns the LAST hook's rc. With the double-register the ack was (accidentally) gated on the 2nd append's repl_wait_majority_ack (LSN+1) — an extra majority round-trip that MASKED a latent failover durability race. Single-append (correct) removed that margin: one post-fix soak then hit the KNOWN intermittent committed-job-loss (bug-795/828 class — LSN-N cross-node divergence: killed primary had the entry, the 2 survivors did not). Confirmed pre-existing/timing (baseline also passes-or-fails on timing; 3/3 post-fix soaks then passed), NOT caused by the dedup. Validation recipe for HA soak: rebuild controller/xce_controller+xce_test, then run .claude/skills/xce-test-ha/run-ha-soak.sh; judge by waldump single-vs-double entries, not the leaky ASAN exit code.
+
+## Do-Not-Repeat (2026-06-23, isolate before blaming your own change)
+- When a soak regresses right after your edit, DO NOT assume your edit caused it: the working tree here had pre-existing UNCOMMITTED HA changes (cluster.c/ha.c/persist.c/config_repl.c) that the stale prebuilt binaries (dated 15:01) had NEVER compiled. The first rebuild pulls BOTH your change AND those deltas. Isolate by `git stash push -- <your files>`, rebuild, re-run. Here it proved the WAL-dup fix was clean and the job-loss was the known intermittent durability race.
+
+## Key Learnings (2026-06-23, /xce-test-ha leadership coverage — ctrl-3 never primary)
+- WHY ctrl-3 never led: HA election timeout is PRIORITY-STAGGERED. my_priority = index in --peers list (ctrl-1=0, ctrl-2=1, ctrl-3=2; lower = higher priority), and the election delay = my_priority * election_priority_step_ms (ha.h:138, default 500ms → p0 immediate / p1 +500 / p2 +1000). The soak only ever kills ONE node (single-failover), so the surviving pair always contains a lower-index node that out-races ctrl-3. Confirmed: ctrl-3 had 0 CTRL_PRIMARY announcements but DID start 6 elections (it tries, always loses the race). No leadership-transfer/stepdown command exists in xce_test or ha.c, so leadership can't be handed over directly.
+- HOW to force a specific (lowest-priority) node T to lead, DETERMINISTICALLY and loss-free (run-ha-soak.sh force_elect_node): exploit the RequestVote freshness gate (a behind node cannot win). P=current primary, S=third node. (1) kill S so it stops receiving entries; (2) submit a batch → commits on {P,T}, S now provably behind; (3) kill P → only T alive briefly (T holds ALL commits — they were on {P,T} — so nothing is lost); (4) restart the STILL-BEHIND S → quorum {T fresh, S stale}; S cannot catch up while there is no primary, so it stays freshness-fenced for the whole election → T wins deterministically (NOT by timing); (5) verify no loss, restart P, reconverge. KEY INSIGHT: a behind node can't catch up without a primary, and there's no primary during the election, so the spoiler is guaranteed fenced — this removes all timing-race flakiness.
+- The soak now tracks SEEN_PRIMARY per node and the verdict ASSERTS all 3 led (PASS line: "all 3 nodes led (ctrl-1,ctrl-2,ctrl-3)"); a node that never leads is a FAIL. force_elect_node is generic (works for any never-led node), run post-loop for each missing node after restoring 3-of-3.
diff --git a/.wolf/hooks/_session.json b/.wolf/hooks/_session.json
index 2912e79..f561934 100644
--- a/.wolf/hooks/_session.json
+++ b/.wolf/hooks/_session.json
@@ -1,2146 +1,23 @@
 {
-  "session_id": "session-2026-06-22-2331",
-  "started": "2026-06-22T06:31:33.746Z",
+  "session_id": "session-2026-06-24-0200",
+  "started": "2026-06-24T09:00:25.072Z",
   "files_read": {
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md": {
-      "count": 18,
-      "tokens": 13122,
-      "first_read": "2026-06-22T06:32:00.997Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/spec.json": {
-      "count": 1,
-      "tokens": 141,
-      "first_read": "2026-06-22T06:32:01.909Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/kiro-impl/templates/implementer-prompt.md": {
-      "count": 1,
-      "tokens": 1659,
-      "first_read": "2026-06-22T06:32:26.638Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/kiro-impl/templates/reviewer-prompt.md": {
-      "count": 1,
-      "tokens": 1352,
-      "first_read": "2026-06-22T06:32:27.509Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/kiro-impl/templates/debugger-prompt.md": {
-      "count": 1,
-      "tokens": 812,
-      "first_read": "2026-06-22T06:32:27.626Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/design.md": {
-      "count": 14,
-      "tokens": 11209,
-      "first_read": "2026-06-22T06:32:44.772Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/requirements.md": {
-      "count": 19,
-      "tokens": 4240,
-      "first_read": "2026-06-22T06:32:52.419Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c": {
-      "count": 160,
-      "tokens": 77256,
-      "first_read": "2026-06-22T06:34:41.876Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c": {
-      "count": 14,
-      "tokens": 5043,
-      "first_read": "2026-06-22T06:34:52.833Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.h": {
+    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xceapi.c": {
       "count": 1,
       "tokens": 0,
-      "first_read": "2026-06-22T06:35:00.982Z"
+      "first_read": "2026-06-24T09:04:12.496Z"
     },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/include/commit.h": {
-      "count": 2,
-      "tokens": 1070,
-      "first_read": "2026-06-22T06:35:15.248Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c": {
-      "count": 12,
-      "tokens": 9032,
-      "first_read": "2026-06-22T06:35:26.921Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c": {
-      "count": 61,
-      "tokens": 25053,
-      "first_read": "2026-06-22T06:35:35.923Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_engine.c": {
+    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c": {
       "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T06:36:39.867Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/xce/cluster_def.h": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T06:36:56.692Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h": {
-      "count": 15,
-      "tokens": 20686,
-      "first_read": "2026-06-22T06:37:15.920Z"
-    },
-    "/tmp/claude-1000/-home-rshen-projects-xce-worktrees-raft-tla/6dc27133-d2d4-451b-b63b-974988312a32/tasks/b116jgvi1.output": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T06:57:59.516Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/controller_test.c": {
-      "count": 5,
-      "tokens": 1616,
-      "first_read": "2026-06-22T06:58:42.314Z"
-    },
-    "/tmp/claude-1000/-home-rshen-projects-xce-worktrees-raft-tla/6dc27133-d2d4-451b-b63b-974988312a32/tasks/bnugvwvcf.output": {
-      "count": 2,
-      "tokens": 0,
-      "first_read": "2026-06-22T07:07:12.525Z"
-    },
-    "/tmp/claude-1000/-home-rshen-projects-xce-worktrees-raft-tla/6dc27133-d2d4-451b-b63b-974988312a32/tasks/btz2pubrd.output": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T07:07:18.041Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_durability.c": {
-      "count": 2,
-      "tokens": 0,
-      "first_read": "2026-06-22T07:30:52.723Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.h": {
-      "count": 5,
-      "tokens": 8168,
-      "first_read": "2026-06-22T07:34:35.806Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c": {
-      "count": 4,
-      "tokens": 0,
-      "first_read": "2026-06-22T07:41:17.727Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/wal_types.h": {
-      "count": 7,
-      "tokens": 1400,
-      "first_read": "2026-06-22T07:49:12.870Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c": {
-      "count": 45,
-      "tokens": 33229,
-      "first_read": "2026-06-22T07:49:33.758Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha_convergence.c": {
-      "count": 6,
-      "tokens": 4868,
-      "first_read": "2026-06-22T08:11:42.677Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c": {
-      "count": 12,
-      "tokens": 16351,
-      "first_read": "2026-06-22T08:11:59.417Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c": {
-      "count": 12,
-      "tokens": 7500,
-      "first_read": "2026-06-22T08:12:49.911Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c": {
-      "count": 6,
-      "tokens": 15576,
-      "first_read": "2026-06-22T08:13:01.606Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h": {
-      "count": 2,
-      "tokens": 4411,
-      "first_read": "2026-06-22T08:13:52.014Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp": {
-      "count": 3,
-      "tokens": 8927,
-      "first_read": "2026-06-22T08:17:21.350Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_demotion_convergence.c": {
-      "count": 4,
-      "tokens": 9602,
-      "first_read": "2026-06-22T08:24:47.645Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c": {
-      "count": 43,
-      "tokens": 24927,
-      "first_read": "2026-06-22T08:28:29.552Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_unit.c": {
-      "count": 8,
-      "tokens": 6231,
-      "first_read": "2026-06-22T08:34:49.938Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c": {
-      "count": 28,
-      "tokens": 34947,
-      "first_read": "2026-06-22T08:35:07.723Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/xce.build/lib/controller.capnp.h": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T08:49:24.448Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h": {
-      "count": 6,
-      "tokens": 5622,
-      "first_read": "2026-06-22T09:27:39.300Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c": {
-      "count": 8,
-      "tokens": 19506,
-      "first_read": "2026-06-22T09:34:42.796Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h": {
-      "count": 4,
-      "tokens": 9539,
-      "first_read": "2026-06-22T10:00:16.667Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_persist_checkpoint.c": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T10:09:18.651Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/myconf.h": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T10:37:12.474Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/delay.c": {
-      "count": 4,
-      "tokens": 0,
-      "first_read": "2026-06-22T11:16:46.531Z"
-    },
-    "/home/claude/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/6dc27133-d2d4-451b-b63b-974988312a32/tool-results/b5qfla467.txt": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T11:39:19.548Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.h": {
-      "count": 2,
-      "tokens": 1006,
-      "first_read": "2026-06-22T12:04:59.234Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c": {
-      "count": 2,
-      "tokens": 4586,
-      "first_read": "2026-06-22T12:04:59.515Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_waldump.c": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T12:05:06.623Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/meson.build": {
-      "count": 1,
-      "tokens": 1329,
-      "first_read": "2026-06-22T12:05:12.295Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c": {
-      "count": 5,
-      "tokens": 27479,
-      "first_read": "2026-06-22T12:08:24.768Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/walcompare.h": {
-      "count": 1,
-      "tokens": 839,
-      "first_read": "2026-06-22T12:17:08.388Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/walcompare.c": {
-      "count": 1,
-      "tokens": 2485,
-      "first_read": "2026-06-22T12:17:08.596Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_walcompare.c": {
-      "count": 1,
-      "tokens": 3795,
-      "first_read": "2026-06-22T12:17:08.722Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/tools/deploy-ha.sh": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T13:08:33.978Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/include/repl.h": {
-      "count": 1,
-      "tokens": 1983,
-      "first_read": "2026-06-22T15:09:44.212Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/xce.build/lib/controller.capnp.c": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T15:13:19.758Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh": {
-      "count": 5,
-      "tokens": 4741,
-      "first_read": "2026-06-22T15:21:02.953Z"
-    },
-    "/home/claude/tmp/xce-ha-deploy/run-strict/logs/ctrl-1.log": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T21:00:07.587Z"
-    },
-    "/home/claude/tmp/xce-ha-deploy/run-strict2/logs/ctrl-1.log": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-22T21:06:51.075Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/main.c": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-23T00:00:56.628Z"
-    },
-    "/home/claude/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/6dc27133-d2d4-451b-b63b-974988312a32/tool-results/bb91zy8yj.txt": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-23T00:09:25.115Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-commit-durability/INVESTIGATION-failover-job-loss.md": {
-      "count": 1,
-      "tokens": 5299,
-      "first_read": "2026-06-23T01:16:20.139Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_apply.c": {
-      "count": 5,
-      "tokens": 4730,
-      "first_read": "2026-06-23T01:22:10.670Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/raft/raft.c": {
-      "count": 1,
-      "tokens": 0,
-      "first_read": "2026-06-23T01:27:52.545Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_election.c": {
-      "count": 2,
-      "tokens": 12140,
-      "first_read": "2026-06-23T01:29:49.714Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_vote_gate.c": {
-      "count": 3,
-      "tokens": 11971,
-      "first_read": "2026-06-23T02:50:26.628Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/steering/ha-async-io.md": {
-      "count": 1,
-      "tokens": 1603,
-      "first_read": "2026-06-23T04:45:56.026Z"
-    },
-    "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/steering/persistence.md": {
-      "count": 1,
-      "tokens": 2042,
-      "first_read": "2026-06-23T04:47:46.435Z"
+      "tokens": 3042,
+      "first_read": "2026-06-24T09:04:12.779Z"
     }
   },
-  "files_written": [
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 42,
-      "at": "2026-06-22T06:37:29.392Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 2847,
-      "at": "2026-06-22T06:38:20.250Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 120,
-      "at": "2026-06-22T06:38:29.942Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/include/commit.h",
-      "action": "edit",
-      "tokens": 262,
-      "at": "2026-06-22T06:38:55.368Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/include/commit.h",
-      "action": "edit",
-      "tokens": 190,
-      "at": "2026-06-22T06:39:03.246Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 362,
-      "at": "2026-06-22T06:39:16.190Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 67,
-      "at": "2026-06-22T06:39:24.334Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 452,
-      "at": "2026-06-22T06:39:37.159Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 419,
-      "at": "2026-06-22T06:39:51.346Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 122,
-      "at": "2026-06-22T06:40:15.279Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 167,
-      "at": "2026-06-22T06:40:22.302Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 197,
-      "at": "2026-06-22T06:40:30.958Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 504,
-      "at": "2026-06-22T06:40:58.901Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 345,
-      "at": "2026-06-22T07:19:14.721Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 486,
-      "at": "2026-06-22T07:19:47.213Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 809,
-      "at": "2026-06-22T07:20:23.432Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 261,
-      "at": "2026-06-22T07:21:33.761Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 224,
-      "at": "2026-06-22T07:21:45.142Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 253,
-      "at": "2026-06-22T07:22:08.891Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 34,
-      "at": "2026-06-22T07:32:35.765Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 630,
-      "at": "2026-06-22T07:32:54.831Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 1215,
-      "at": "2026-06-22T07:37:36.830Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 45,
-      "at": "2026-06-22T07:37:42.293Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 727,
-      "at": "2026-06-22T07:39:01.957Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 28,
-      "at": "2026-06-22T07:47:11.742Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 556,
-      "at": "2026-06-22T07:47:26.780Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 1749,
-      "at": "2026-06-22T07:53:06.453Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 507,
-      "at": "2026-06-22T07:53:50.114Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 84,
-      "at": "2026-06-22T07:53:59.899Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 1110,
-      "at": "2026-06-22T07:54:52.947Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 238,
-      "at": "2026-06-22T07:55:05.054Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 324,
-      "at": "2026-06-22T07:55:30.709Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 138,
-      "at": "2026-06-22T07:55:45.858Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 114,
-      "at": "2026-06-22T07:56:03.075Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 28,
-      "at": "2026-06-22T07:56:08.614Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 284,
-      "at": "2026-06-22T07:56:59.548Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 312,
-      "at": "2026-06-22T07:57:34.120Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 175,
-      "at": "2026-06-22T07:58:45.945Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 18,
-      "at": "2026-06-22T08:09:22.966Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 660,
-      "at": "2026-06-22T08:09:41.501Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 2327,
-      "at": "2026-06-22T08:16:54.019Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 76,
-      "at": "2026-06-22T08:17:01.783Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
-      "action": "edit",
-      "tokens": 129,
-      "at": "2026-06-22T08:17:29.427Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h",
-      "action": "edit",
-      "tokens": 113,
-      "at": "2026-06-22T08:17:35.796Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
-      "action": "edit",
-      "tokens": 194,
-      "at": "2026-06-22T08:19:25.147Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
-      "action": "edit",
-      "tokens": 418,
-      "at": "2026-06-22T08:19:44.568Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
-      "action": "edit",
-      "tokens": 506,
-      "at": "2026-06-22T08:20:03.890Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
-      "action": "edit",
-      "tokens": 333,
-      "at": "2026-06-22T08:20:41.653Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c",
-      "action": "edit",
-      "tokens": 195,
-      "at": "2026-06-22T08:20:57.004Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 1764,
-      "at": "2026-06-22T08:21:57.055Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 111,
-      "at": "2026-06-22T08:22:19.335Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 325,
-      "at": "2026-06-22T08:22:36.802Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 736,
-      "at": "2026-06-22T08:23:05.001Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 680,
-      "at": "2026-06-22T08:23:54.536Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha_convergence.c",
-      "action": "edit",
-      "tokens": 416,
-      "at": "2026-06-22T08:24:31.826Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_demotion_convergence.c",
-      "action": "edit",
-      "tokens": 620,
-      "at": "2026-06-22T08:25:26.931Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_demotion_convergence.c",
-      "action": "edit",
-      "tokens": 376,
-      "at": "2026-06-22T08:25:44.400Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_demotion_convergence.c",
-      "action": "edit",
-      "tokens": 274,
-      "at": "2026-06-22T08:26:04.783Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_demotion_convergence.c",
-      "action": "edit",
-      "tokens": 69,
-      "at": "2026-06-22T08:26:13.197Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha_convergence.c",
-      "action": "edit",
-      "tokens": 155,
-      "at": "2026-06-22T08:27:13.904Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 42,
-      "at": "2026-06-22T08:42:08.228Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 727,
-      "at": "2026-06-22T08:42:30.736Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 2332,
-      "at": "2026-06-22T08:47:44.200Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 71,
-      "at": "2026-06-22T08:47:50.619Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 442,
-      "at": "2026-06-22T08:48:11.998Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 633,
-      "at": "2026-06-22T08:48:45.787Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 370,
-      "at": "2026-06-22T08:49:11.866Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 1249,
-      "at": "2026-06-22T09:04:06.844Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 400,
-      "at": "2026-06-22T09:04:19.609Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 569,
-      "at": "2026-06-22T09:05:02.682Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 446,
-      "at": "2026-06-22T09:05:19.739Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 91,
-      "at": "2026-06-22T09:05:30.535Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 58,
-      "at": "2026-06-22T09:05:36.480Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 51,
-      "at": "2026-06-22T09:05:42.660Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 1974,
-      "at": "2026-06-22T09:06:23.610Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 103,
-      "at": "2026-06-22T09:06:31.533Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 57,
-      "at": "2026-06-22T09:08:05.530Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 66,
-      "at": "2026-06-22T09:08:41.171Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 1314,
-      "at": "2026-06-22T09:11:38.485Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 550,
-      "at": "2026-06-22T09:12:06.608Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 816,
-      "at": "2026-06-22T09:12:31.811Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 4331,
-      "at": "2026-06-22T09:13:57.768Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 40,
-      "at": "2026-06-22T09:14:11.646Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 160,
-      "at": "2026-06-22T09:14:19.264Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 26,
-      "at": "2026-06-22T09:25:14.646Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 889,
-      "at": "2026-06-22T09:25:38.096Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 1026,
-      "at": "2026-06-22T09:29:00.839Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 104,
-      "at": "2026-06-22T09:29:07.535Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/wal_types.h",
-      "action": "edit",
-      "tokens": 495,
-      "at": "2026-06-22T09:29:56.089Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 48,
-      "at": "2026-06-22T09:30:34.793Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 595,
-      "at": "2026-06-22T09:30:51.848Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 609,
-      "at": "2026-06-22T09:31:11.223Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 20,
-      "at": "2026-06-22T09:37:02.337Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 557,
-      "at": "2026-06-22T09:37:19.037Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 727,
-      "at": "2026-06-22T09:42:10.063Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 38,
-      "at": "2026-06-22T09:42:30.283Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 2564,
-      "at": "2026-06-22T09:43:23.305Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 130,
-      "at": "2026-06-22T09:43:45.518Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 236,
-      "at": "2026-06-22T09:44:06.148Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 285,
-      "at": "2026-06-22T09:44:16.257Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c",
-      "action": "edit",
-      "tokens": 93,
-      "at": "2026-06-22T09:44:27.767Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 1580,
-      "at": "2026-06-22T09:45:31.772Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
-      "action": "edit",
-      "tokens": 447,
-      "at": "2026-06-22T10:03:21.482Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 1006,
-      "at": "2026-06-22T10:04:06.954Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 184,
-      "at": "2026-06-22T10:04:17.704Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 247,
-      "at": "2026-06-22T10:04:29.633Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 336,
-      "at": "2026-06-22T10:04:40.284Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 396,
-      "at": "2026-06-22T10:04:52.177Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 1225,
-      "at": "2026-06-22T10:05:22.002Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 419,
-      "at": "2026-06-22T10:05:36.933Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 458,
-      "at": "2026-06-22T10:06:19.488Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 1587,
-      "at": "2026-06-22T10:08:44.743Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
-      "action": "edit",
-      "tokens": 148,
-      "at": "2026-06-22T10:09:44.832Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 184,
-      "at": "2026-06-22T10:10:11.663Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 22,
-      "at": "2026-06-22T10:10:17.805Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 124,
-      "at": "2026-06-22T10:10:24.575Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 23,
-      "at": "2026-06-22T10:10:57.883Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 917,
-      "at": "2026-06-22T10:16:08.936Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c",
-      "action": "edit",
-      "tokens": 419,
-      "at": "2026-06-22T10:16:44.412Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c",
-      "action": "edit",
-      "tokens": 62,
-      "at": "2026-06-22T10:16:51.348Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c",
-      "action": "edit",
-      "tokens": 30,
-      "at": "2026-06-22T10:16:57.489Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_commit_barrier_rollout.c",
-      "action": "edit",
-      "tokens": 190,
-      "at": "2026-06-22T10:17:11.371Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 516,
-      "at": "2026-06-22T10:19:46.329Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 168,
-      "at": "2026-06-22T10:19:58.470Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 128,
-      "at": "2026-06-22T10:20:17.586Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 84,
-      "at": "2026-06-22T10:20:27.633Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 33,
-      "at": "2026-06-22T10:21:56.095Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 34,
-      "at": "2026-06-22T10:22:07.440Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 247,
-      "at": "2026-06-22T10:25:49.658Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 32,
-      "at": "2026-06-22T10:33:38.818Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 966,
-      "at": "2026-06-22T10:34:03.739Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 413,
-      "at": "2026-06-22T10:38:01.001Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 759,
-      "at": "2026-06-22T10:38:18.787Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 3311,
-      "at": "2026-06-22T10:39:44.067Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 121,
-      "at": "2026-06-22T10:39:54.460Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 1560,
-      "at": "2026-06-22T10:40:31.126Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 312,
-      "at": "2026-06-22T10:40:45.876Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 2257,
-      "at": "2026-06-22T10:56:35.576Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 192,
-      "at": "2026-06-22T10:57:10.567Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 322,
-      "at": "2026-06-22T10:57:25.056Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 483,
-      "at": "2026-06-22T10:57:44.284Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
-      "action": "edit",
-      "tokens": 85,
-      "at": "2026-06-22T10:58:05.846Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
-      "action": "edit",
-      "tokens": 464,
-      "at": "2026-06-22T10:58:21.737Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 215,
-      "at": "2026-06-22T10:58:41.151Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 376,
-      "at": "2026-06-22T10:59:04.199Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 601,
-      "at": "2026-06-22T10:59:21.651Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 375,
-      "at": "2026-06-22T11:00:05.966Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 190,
-      "at": "2026-06-22T11:00:30.657Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 163,
-      "at": "2026-06-22T11:00:42.656Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 1250,
-      "at": "2026-06-22T11:21:09.737Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
-      "action": "edit",
-      "tokens": 489,
-      "at": "2026-06-22T11:21:41.586Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 631,
-      "at": "2026-06-22T11:21:58.598Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 109,
-      "at": "2026-06-22T11:22:05.736Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 1588,
-      "at": "2026-06-22T11:22:58.111Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 113,
-      "at": "2026-06-22T11:23:05.099Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 1940,
-      "at": "2026-06-22T11:26:14.950Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 392,
-      "at": "2026-06-22T11:30:41.081Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 28,
-      "at": "2026-06-22T11:30:48.087Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 941,
-      "at": "2026-06-22T11:32:15.080Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 27,
-      "at": "2026-06-22T11:32:35.960Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 26,
-      "at": "2026-06-22T11:46:40.052Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 1030,
-      "at": "2026-06-22T11:47:05.665Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 49,
-      "at": "2026-06-22T11:50:00.998Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 2522,
-      "at": "2026-06-22T11:50:46.176Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 55,
-      "at": "2026-06-22T11:50:52.584Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 447,
-      "at": "2026-06-22T11:52:19.085Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 180,
-      "at": "2026-06-22T11:52:31.743Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 62,
-      "at": "2026-06-22T11:53:12.322Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 49,
-      "at": "2026-06-22T11:53:28.231Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 58,
-      "at": "2026-06-22T11:53:36.576Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 41,
-      "at": "2026-06-22T11:54:07.517Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 425,
-      "at": "2026-06-22T11:54:34.023Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 289,
-      "at": "2026-06-22T11:55:01.937Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 53,
-      "at": "2026-06-22T11:55:22.304Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 41,
-      "at": "2026-06-22T11:55:44.648Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 14,
-      "at": "2026-06-22T12:02:57.878Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 513,
-      "at": "2026-06-22T12:03:15.860Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.h",
-      "action": "edit",
-      "tokens": 597,
-      "at": "2026-06-22T12:06:17.147Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
-      "action": "edit",
-      "tokens": 148,
-      "at": "2026-06-22T12:06:24.782Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
-      "action": "edit",
-      "tokens": 258,
-      "at": "2026-06-22T12:06:33.458Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
-      "action": "edit",
-      "tokens": 91,
-      "at": "2026-06-22T12:06:43.523Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
-      "action": "edit",
-      "tokens": 160,
-      "at": "2026-06-22T12:06:52.578Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/walcompare.h",
-      "action": "create",
-      "tokens": 898,
-      "at": "2026-06-22T12:07:19.836Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/walcompare.c",
-      "action": "create",
-      "tokens": 2662,
-      "at": "2026-06-22T12:08:06.271Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 45,
-      "at": "2026-06-22T12:08:51.523Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 34,
-      "at": "2026-06-22T12:08:57.913Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 76,
-      "at": "2026-06-22T12:09:04.472Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 84,
-      "at": "2026-06-22T12:09:12.355Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 716,
-      "at": "2026-06-22T12:09:28.301Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
-      "action": "edit",
-      "tokens": 23,
-      "at": "2026-06-22T12:09:45.845Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/meson.build",
-      "action": "edit",
-      "tokens": 25,
-      "at": "2026-06-22T12:09:51.693Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/meson.build",
-      "action": "edit",
-      "tokens": 45,
-      "at": "2026-06-22T12:09:58.946Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/controller_test.c",
-      "action": "edit",
-      "tokens": 40,
-      "at": "2026-06-22T12:10:25.375Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/controller_test.c",
-      "action": "edit",
-      "tokens": 32,
-      "at": "2026-06-22T12:10:35.306Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_walcompare.c",
-      "action": "create",
-      "tokens": 4066,
-      "at": "2026-06-22T12:11:41.292Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 15,
-      "at": "2026-06-22T13:04:49.630Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 486,
-      "at": "2026-06-22T13:05:15.058Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "create",
-      "tokens": 4052,
-      "at": "2026-06-22T13:14:43.393Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 300,
-      "at": "2026-06-22T13:19:16.409Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 340,
-      "at": "2026-06-22T13:26:52.217Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 96,
-      "at": "2026-06-22T13:27:00.491Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 129,
-      "at": "2026-06-22T13:27:11.410Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 509,
-      "at": "2026-06-22T15:02:10.248Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/repl.h",
-      "action": "edit",
-      "tokens": 245,
-      "at": "2026-06-22T15:09:54.482Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c",
-      "action": "edit",
-      "tokens": 49,
-      "at": "2026-06-22T15:10:02.974Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c",
-      "action": "edit",
-      "tokens": 327,
-      "at": "2026-06-22T15:10:13.531Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 257,
-      "at": "2026-06-22T15:10:39.712Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 122,
-      "at": "2026-06-22T15:10:51.145Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 160,
-      "at": "2026-06-22T15:10:58.213Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 239,
-      "at": "2026-06-22T15:11:20.033Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 530,
-      "at": "2026-06-22T15:11:40.862Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
-      "action": "edit",
-      "tokens": 188,
-      "at": "2026-06-22T15:11:49.969Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 742,
-      "at": "2026-06-22T15:12:19.831Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 68,
-      "at": "2026-06-22T15:12:30.044Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
-      "action": "edit",
-      "tokens": 238,
-      "at": "2026-06-22T15:13:02.627Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 366,
-      "at": "2026-06-22T15:13:33.705Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_unit.c",
-      "action": "edit",
-      "tokens": 302,
-      "at": "2026-06-22T15:14:29.182Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_unit.c",
-      "action": "edit",
-      "tokens": 59,
-      "at": "2026-06-22T15:14:35.738Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_unit.c",
-      "action": "edit",
-      "tokens": 562,
-      "at": "2026-06-22T15:14:50.119Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_unit.c",
-      "action": "edit",
-      "tokens": 65,
-      "at": "2026-06-22T15:15:14.159Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 1124,
-      "at": "2026-06-22T15:26:52.509Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 56,
-      "at": "2026-06-22T15:27:10.698Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 40,
-      "at": "2026-06-22T15:44:07.427Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 836,
-      "at": "2026-06-22T15:44:38.461Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 202,
-      "at": "2026-06-22T15:44:54.106Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 108,
-      "at": "2026-06-22T15:45:02.955Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 217,
-      "at": "2026-06-22T15:48:39.771Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 128,
-      "at": "2026-06-22T20:56:04.530Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 171,
-      "at": "2026-06-22T20:56:19.821Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 564,
-      "at": "2026-06-22T21:03:38.953Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 556,
-      "at": "2026-06-22T21:10:31.340Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 303,
-      "at": "2026-06-22T22:09:14.392Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
-      "action": "edit",
-      "tokens": 236,
-      "at": "2026-06-22T22:09:23.060Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
-      "action": "edit",
-      "tokens": 29,
-      "at": "2026-06-22T22:09:40.197Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 85,
-      "at": "2026-06-22T22:09:50.156Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 330,
-      "at": "2026-06-22T22:21:16.218Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c",
-      "action": "edit",
-      "tokens": 137,
-      "at": "2026-06-22T22:21:41.857Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 1608,
-      "at": "2026-06-22T22:31:03.309Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 54,
-      "at": "2026-06-22T22:31:08.787Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 262,
-      "at": "2026-06-22T22:32:53.718Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 120,
-      "at": "2026-06-22T22:33:00.058Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 154,
-      "at": "2026-06-22T22:33:09.225Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 428,
-      "at": "2026-06-22T22:33:23.724Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 202,
-      "at": "2026-06-22T22:34:27.469Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 61,
-      "at": "2026-06-22T22:34:33.349Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 69,
-      "at": "2026-06-22T22:34:39.302Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 123,
-      "at": "2026-06-22T22:34:47.029Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 91,
-      "at": "2026-06-22T22:34:54.725Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 66,
-      "at": "2026-06-22T22:35:00.547Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 125,
-      "at": "2026-06-22T22:35:08.305Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 196,
-      "at": "2026-06-22T22:35:17.219Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 189,
-      "at": "2026-06-22T22:44:50.360Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
-      "action": "edit",
-      "tokens": 50,
-      "at": "2026-06-22T22:47:11.319Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 461,
-      "at": "2026-06-22T23:44:22.855Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 533,
-      "at": "2026-06-22T23:44:40.974Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/include/commit.h",
-      "action": "edit",
-      "tokens": 191,
-      "at": "2026-06-22T23:44:51.407Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/include/commit.h",
-      "action": "edit",
-      "tokens": 163,
-      "at": "2026-06-22T23:45:00.774Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 25,
-      "at": "2026-06-22T23:45:11.004Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 2130,
-      "at": "2026-06-22T23:46:05.729Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 401,
-      "at": "2026-06-22T23:46:23.092Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 983,
-      "at": "2026-06-22T23:46:56.222Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 110,
-      "at": "2026-06-22T23:47:26.669Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 202,
-      "at": "2026-06-22T23:47:54.153Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 197,
-      "at": "2026-06-22T23:48:03.243Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 130,
-      "at": "2026-06-22T23:48:10.083Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
-      "action": "edit",
-      "tokens": 506,
-      "at": "2026-06-22T23:48:39.337Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/commit.c",
-      "action": "edit",
-      "tokens": 150,
-      "at": "2026-06-23T00:22:04.704Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 348,
-      "at": "2026-06-23T00:22:40.539Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 711,
-      "at": "2026-06-23T00:28:58.105Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_election.c",
-      "action": "edit",
-      "tokens": 276,
-      "at": "2026-06-23T01:29:57.640Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_election.c",
-      "action": "edit",
-      "tokens": 857,
-      "at": "2026-06-23T01:30:18.892Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_election.c",
-      "action": "edit",
-      "tokens": 97,
-      "at": "2026-06-23T01:30:25.438Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 457,
-      "at": "2026-06-23T01:30:51.362Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_apply.c",
-      "action": "edit",
-      "tokens": 200,
-      "at": "2026-06-23T01:31:21.869Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 1441,
-      "at": "2026-06-23T01:31:58.765Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
-      "action": "edit",
-      "tokens": 461,
-      "at": "2026-06-23T01:32:19.532Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 378,
-      "at": "2026-06-23T01:32:36.420Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_vote_gate.c",
-      "action": "edit",
-      "tokens": 1415,
-      "at": "2026-06-23T02:58:38.178Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_vote_gate.c",
-      "action": "edit",
-      "tokens": 21,
-      "at": "2026-06-23T02:58:57.170Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_vote_gate.c",
-      "action": "edit",
-      "tokens": 105,
-      "at": "2026-06-23T02:59:03.798Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 752,
-      "at": "2026-06-23T03:14:34.321Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 172,
-      "at": "2026-06-23T03:21:40.978Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 91,
-      "at": "2026-06-23T03:21:54.525Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_apply.c",
-      "action": "edit",
-      "tokens": 1326,
-      "at": "2026-06-23T03:27:59.026Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 510,
-      "at": "2026-06-23T03:28:20.594Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
-      "action": "edit",
-      "tokens": 53,
-      "at": "2026-06-23T03:28:31.146Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
-      "action": "edit",
-      "tokens": 40,
-      "at": "2026-06-23T03:28:37.100Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/specs/ha-term-safety/tasks.md",
-      "action": "edit",
-      "tokens": 789,
-      "at": "2026-06-23T04:07:37.415Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 274,
-      "at": "2026-06-23T04:09:17.200Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 44,
-      "at": "2026-06-23T04:09:25.642Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
-      "action": "edit",
-      "tokens": 30,
-      "at": "2026-06-23T04:09:32.735Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/steering/ha-async-io.md",
-      "action": "edit",
-      "tokens": 660,
-      "at": "2026-06-23T04:47:06.134Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/steering/ha-async-io.md",
-      "action": "edit",
-      "tokens": 834,
-      "at": "2026-06-23T04:47:28.664Z"
-    },
-    {
-      "file": "/home/rshen/projects/xce/worktrees/raft_tla/.kiro/steering/persistence.md",
-      "action": "edit",
-      "tokens": 134,
-      "at": "2026-06-23T04:47:56.811Z"
-    }
-  ],
-  "edit_counts": {
-    "src/controller/testsuite/test_term_safety_adapter.c": 48,
-    "src/controller/include/commit.h": 4,
-    "src/controller/commit.c": 8,
-    "src/controller/ha.c": 47,
-    "src/controller/ha.h": 10,
-    ".kiro/specs/ha-term-safety/tasks.md": 33,
-    "src/controller/persist.c": 15,
-    "src/schema/controller.capnp": 1,
-    "src/include/typemap.h": 1,
-    "src/lib/request.c": 5,
-    "src/controller/repl.c": 4,
-    "src/controller/ha_convergence.c": 2,
-    "src/controller/testsuite/test_demotion_convergence.c": 4,
-    "src/controller/testsuite/test_config_repl.c": 34,
-    "src/include/wal_types.h": 1,
-    "src/controller/config_repl.h": 6,
-    "src/controller/config_repl.c": 17,
-    "src/controller/testsuite/test_commit_barrier_rollout.c": 5,
-    "src/include/persist.h": 2,
-    "src/controller/myapp.c": 2,
-    "src/controller/testsuite/waldump.h": 1,
-    "src/controller/testsuite/waldump.c": 4,
-    "src/controller/testsuite/walcompare.h": 1,
-    "src/controller/testsuite/walcompare.c": 1,
-    "src/controller/testsuite/test.c": 6,
-    "src/controller/meson.build": 2,
-    "src/controller/testsuite/controller_test.c": 2,
-    "src/controller/testsuite/test_walcompare.c": 1,
-    "src/controller/testsuite/clean_failover_preservation.sh": 9,
-    "src/include/repl.h": 1,
-    "src/controller/testsuite/test_repl_unit.c": 4,
-    "src/lib/raft/raft.c": 2,
-    "src/controller/testsuite/test_ha_election.c": 3,
-    "src/controller/testsuite/test_repl_apply.c": 2,
-    "src/controller/testsuite/test_ha_vote_gate.c": 3,
-    ".kiro/steering/ha-async-io.md": 2,
-    ".kiro/steering/persistence.md": 1
-  },
-  "anatomy_hits": 30,
-  "anatomy_misses": 36,
-  "repeated_reads_warned": 518,
+  "files_written": [],
+  "edit_counts": {},
+  "anatomy_hits": 1,
+  "anatomy_misses": 1,
+  "repeated_reads_warned": 0,
   "cerebrum_warnings": 0,
-  "stop_count": 6
+  "stop_count": 0
 }
\ No newline at end of file
diff --git a/.wolf/memory.md b/.wolf/memory.md
index c9bcba1..b2c4f83 100644
--- a/.wolf/memory.md
+++ b/.wolf/memory.md
@@ -2579,3 +2579,221 @@
 | 21:47 | Edited .kiro/steering/persistence.md | inline fix | ~126 |
 | 21:48 | Session end: 294 writes across 37 files (test_term_safety_adapter.c, commit.h, commit.c, ha.c, ha.h) | 66 reads | ~607176 tok |
 | 00:04 | Session end: 294 writes across 37 files (test_term_safety_adapter.c, commit.h, commit.c, ha.c, ha.h) | 66 reads | ~607176 tok |
+
+## Session: 2026-06-23 00:14
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 00:29 | Created ../../../../../claude/.claude/plans/piped-mixing-glade.md | — | ~2049 |
+| 00:34 | Edited src/controller/config_repl.h | expanded (+10 lines) | ~391 |
+| 00:34 | Edited src/controller/config_repl.h | modified struct() | ~91 |
+| 00:35 | Edited src/controller/config_repl.c | modified ha_stream_wal_to_standby() | ~64 |
+| 00:35 | Edited src/controller/config_repl.c | added error handling | ~285 |
+| 00:35 | Edited src/controller/config_repl.c | modified persist_entry_term() | ~140 |
+| 00:36 | Edited src/controller/config_repl.c | modified persist_entry_term() | ~110 |
+| 00:36 | Edited src/controller/config_repl.c | 3→3 lines | ~47 |
+| 00:36 | Edited src/controller/ha.c | modified if() | ~202 |
+| 00:37 | Edited src/controller/testsuite/test_config_repl.c | 4→4 lines | ~66 |
+| 00:37 | Edited src/controller/testsuite/test_config_repl.c | 4→4 lines | ~66 |
+| 00:37 | Edited src/controller/testsuite/test_config_repl.c | 4→4 lines | ~67 |
+| 00:38 | Edited src/controller/testsuite/test_coldstart_lsn0.c | 3→3 lines | ~50 |
+| 00:38 | Edited src/controller/testsuite/test_coldstart_lsn0.c | 3→3 lines | ~50 |
+| 00:39 | Edited src/controller/testsuite/test_config_repl.c | added error handling | ~1034 |
+| 00:40 | Edited src/controller/testsuite/test_config_repl.c | 4→5 lines | ~76 |
+| 00:44 | Edited src/controller/config_repl.c | 3→3 lines | ~48 |
+| 00:45 | Edited src/controller/config_repl.c | modified persist_entry_term() | ~49 |
+| 00:46 | Edited src/lib/client.c | added 1 condition(s) | ~188 |
+| 00:47 | Edited src/lib/client.c | added 1 condition(s) | ~487 |
+| 01:03 | Created repro854.sh | — | ~416 |
+| 01:05 | Edited repro854.sh | 3→3 lines | ~45 |
+| 01:22 | Created repro_joblist.sh | — | ~201 |
+| 08:30 | bug-1028: streamer term-source FIXED (persist_entry_term); bug-854: client rotation FIXED (xce_failover_rotate on non-auth reply); both RED→GREEN, full build 0, unit :FAIL:=0, live committed-prefix identical + wait-primary 92ms | config_repl.c/.h, ha.c, client.c, test_config_repl.c | bugs CLOSED | ~28k |
+| 01:29 | Session end: 23 writes across 9 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 16 reads | ~250791 tok |
+| 01:33 | Session end: 23 writes across 9 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 16 reads | ~250791 tok |
+| 01:44 | Edited src/lib/testsuite/test_wal_wire.c | modified heartbeat() | ~150 |
+| 01:46 | Session end: 24 writes across 10 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 18 reads | ~266661 tok |
+| 02:15 | Session end: 24 writes across 10 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 19 reads | ~275693 tok |
+| 02:44 | Edited src/controller/cluster.c | added 1 condition(s) | ~660 |
+| 02:53 | Edited src/lib/xcectx.c | 1→2 lines | ~26 |
+| 02:54 | Edited src/lib/xcectx.c | added 2 condition(s) | ~286 |
+| 02:58 | Session end: 27 writes across 12 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 22 reads | ~281425 tok |
+| 03:07 | Session end: 27 writes across 12 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 22 reads | ~281425 tok |
+| 03:25 | Edited src/lib/netio.c | modified iomgr_monitor() | ~240 |
+| 03:27 | Session end: 28 writes across 13 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 22 reads | ~282052 tok |
+| 03:31 | Created ../../../../../../tmp/xce-ha-verify/test.sh | — | ~291 |
+| 03:37 | Edited src/lib/netio.c | modified handle_ssl_handshake() | ~276 |
+| 03:40 | Edited src/controller/cluster.c | expanded (+13 lines) | ~282 |
+| 03:43 | Edited src/lib/netio.c | inline fix | ~12 |
+| 03:44 | Edited src/lib/netio.c | inline fix | ~7 |
+| 03:46 | Edited src/include/netio.h | 2→3 lines | ~60 |
+| 03:48 | Edited src/controller/cluster.c | inline fix | ~12 |
+| 03:49 | Edited src/controller/cluster.c | modified if() | ~290 |
+| 03:51 | Edited src/lib/netio.c | modified iomgr_monitor() | ~161 |
+| 03:52 | Edited src/lib/netio.c | modified handle_ssl_handshake() | ~202 |
+| 03:53 | Edited src/include/netio.h | 3→2 lines | ~37 |
+| 03:54 | Edited src/lib/netio.c | inline fix | ~6 |
+| 03:58 | Session end: 40 writes across 15 files (piped-mixing-glade.md, config_repl.h, config_repl.c, ha.c, test_config_repl.c) | 23 reads | ~290775 tok |
+
+## Session: 2026-06-23 06:20
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 06:24 | Created .claude/skills/xce-test-ha/run-ha-soak.sh | — | ~2292 |
+| 06:25 | Created .claude/skills/xce-test-ha/SKILL.md | — | ~1430 |
+| 06:27 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified xtest() | ~112 |
+| 06:27 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified code() | ~263 |
+| 06:28 | Edited .claude/skills/xce-test-ha/SKILL.md | 7→12 lines | ~194 |
+| 06:30 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified discover_primary() | ~199 |
+| 06:37 | Edited src/controller/testsuite/waldump.c | 3→4 lines | ~69 |
+| 06:37 | Edited src/controller/testsuite/waldump.c | added 1 condition(s) | ~227 |
+| 06:37 | Edited src/controller/testsuite/waldump.c | 2→3 lines | ~50 |
+| 06:42 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | 7→10 lines | ~158 |
+| 06:59 | Edited src/lib/client.c | added 1 condition(s) | ~550 |
+| 07:01 | Edited src/lib/client.c | added 2 condition(s) | ~451 |
+| 07:04 | Edited .claude/skills/xce-test-ha/SKILL.md | expanded (+33 lines) | ~516 |
+| 07:08 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified wait_for_primary_log() | ~503 |
+| 07:08 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified 10() | ~770 |
+| 07:15 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified logs() | ~790 |
+| 07:15 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | expanded (+8 lines) | ~467 |
+| 07:23 | Edited src/controller/ha.c | added error handling | ~746 |
+| 07:23 | Edited src/controller/ha.h | expanded (+11 lines) | ~214 |
+| 07:24 | Edited src/controller/cluster.c | 2→7 lines | ~135 |
+| 07:25 | Edited src/controller/testsuite/test_persist_recovery.c | modified test_recovered_member_syncs_raft_log_len() | ~955 |
+| 07:39 | Edited src/controller/ha.c | 3→3 lines | ~37 |
+| 07:43 | Edited src/controller/ha.c | modified if() | ~516 |
+| 07:48 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified wait_for_full_convergence() | ~537 |
+| 14:52 | /xce-test-ha skill + 3 failover bug fixes (bug-854 dead-first, bug-1042 rejoin log_len, bug-1043 catch-up apply); 5-round soak PASS zero loss | client.c, ha.c, cluster.c, ha.h, waldump.c, skill | 3 bugs FIXED + skill created | ~60k |
+| 07:53 | Edited .claude/skills/xce-test-ha/SKILL.md | expanded (+8 lines) | ~175 |
+| 07:54 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified submit_jobs() | ~426 |
+| 08:00 | Session end: 26 writes across 8 files (run-ha-soak.sh, SKILL.md, waldump.c, client.c, ha.c) | 13 reads | ~186275 tok |
+
+## Session: 2026-06-23 08:01
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-06-23 08:15
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 08:31 | Created ../../../../../claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md | — | ~366 |
+| 08:31 | Session end: 1 writes across 1 files (task-notification-task-id-bkkk2llpr-tas-zany-locket.md) | 1 reads | ~392 tok |
+| 08:47 | Session end: 1 writes across 1 files (task-notification-task-id-bkkk2llpr-tas-zany-locket.md) | 1 reads | ~392 tok |
+| 09:01 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | expanded (+13 lines) | ~379 |
+| 09:02 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | expanded (+9 lines) | ~286 |
+| 09:02 | Edited .claude/skills/xce-test-ha/SKILL.md | "End-to-end HA failover so" → "End-to-end HA failover so" | ~62 |
+| 09:02 | Edited .claude/skills/xce-test-ha/SKILL.md | expanded (+8 lines) | ~213 |
+| 09:03 | Edited .claude/skills/xce-test-ha/SKILL.md | expanded (+9 lines) | ~153 |
+| 09:04 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | 5→9 lines | ~136 |
+| 22:11 | enhance /xce-test-ha: add [dir] arg (positional $1 > XCE_HA_TOP > default) + rm-rf safety guard (.xce-ha-deploy marker, fail-loud) | run-ha-soak.sh, SKILL.md | verified: guard refuses unmarked non-empty dir; custom-dir 5-round soak PASS 18 jobs zero loss | ~3k |
+| 15:11 | Session end: 7 writes across 3 files (task-notification-task-id-bkkk2llpr-tas-zany-locket.md, run-ha-soak.sh, SKILL.md) | 3 reads | ~7892 tok |
+| 15:13 | Session end: 7 writes across 3 files (task-notification-task-id-bkkk2llpr-tas-zany-locket.md, run-ha-soak.sh, SKILL.md) | 3 reads | ~7892 tok |
+| 15:50 | Edited src/lib/testsuite/test_hooks.c | modified AND() | ~682 |
+| 15:52 | Edited src/lib/hook.c | added 4 condition(s) | ~377 |
+| 23:10 | fix bug-845 WAL double-append: xce_add_hook idempotent on (fn,data) | src/lib/hook.c, test_hooks.c | duplicates gone (waldump single-entry), 5/5 hook tests, 343 ctrl tests 0 new fails, 3/3 soaks pass; 1 earlier soak hit known intermittent bug-795/828 loss (pre-existing) | ~9k |
+| 16:10 | Session end: 9 writes across 5 files (task-notification-task-id-bkkk2llpr-tas-zany-locket.md, run-ha-soak.sh, SKILL.md, test_hooks.c, hook.c) | 10 reads | ~120437 tok |
+
+## Session: 2026-06-24 10:37
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 19:58 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | modified log() | ~227 |
+| 10:58 | Session end: 1 writes across 1 files (run-ha-soak.sh) | 3 reads | ~5079 tok |
+| 19:58 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | 3→4 lines | ~44 |
+| 19:58 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | 4→5 lines | ~91 |
+| 20:00 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | added error handling | ~890 |
+| 20:00 | Edited .claude/skills/xce-test-ha/run-ha-soak.sh | expanded (+28 lines) | ~369 |
+| 20:01 | Edited .claude/skills/xce-test-ha/SKILL.md | modified nodes() | ~447 |
+| 03:04 | enhance /xce-test-ha: force lowest-priority ctrl-3 to lead (freshness-fence maneuver) + assert all 3 nodes led | run-ha-soak.sh, SKILL.md | verified: ctrl-3 elected term 8, zero loss, PASS "all 3 nodes led" | ~7k |
+| 20:21 | Session end: 6 writes across 2 files (run-ha-soak.sh, SKILL.md) | 4 reads | ~9263 tok |
+
+## Session: 2026-06-24 11:28
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 11:35 | /xce-test-ha 10 /tmp/xce-test-ha: 10 rounds, 36 jobs, zero job loss, all 3 nodes led | xce-ha-soak.log | PASS (exit 0) | ~50 |
+
+## Session: 2026-06-24 11:50
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 12:05 | Diagnosed prevote deadlock after soak test: ctrl-3 incorrectly truncated committed entries 45-47 (term=12) on becoming primary (safe_committed_lsn=44 from voter quorum, not honoring own ack knowledge); ctrl-2 received term=13 NOOP at LSN=45 (conflicts with ctrl-1 term=12 job); 2-node deadlock permanent — restart ctrl-3 to resolve | ctrl-*.log, WALs | ANALYZED: bug-795 class | ~1200 |
+
+## Session: 2026-06-24 21:15
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 21:20 | Edited src/controller/testsuite/test_ha_election.c | added error handling | ~841 |
+| 21:20 | Edited src/controller/testsuite/test_ha_election.c | 3→6 lines | ~78 |
+| 21:21 | Edited src/controller/ha.h | expanded (+20 lines) | ~362 |
+| 21:21 | Edited src/controller/ha.c | modified ha_promotion_truncate_floor() | ~195 |
+| 21:21 | Edited src/controller/ha.c | modified 1060() | ~356 |
+| 21:30 | Edited src/controller/ha.c | expanded (+15 lines) | ~308 |
+| 21:30 | Edited src/controller/ha.c | 6→10 lines | ~188 |
+| 21:31 | Edited src/controller/ha.c | added error handling | ~738 |
+| 21:31 | Edited src/controller/ha.c | modified ha_promotion_truncate_floor() | ~195 |
+| 21:31 | Edited src/controller/ha.c | modified 1060() | ~356 |
+| 21:32 | Edited src/controller/ha.h | expanded (+11 lines) | ~235 |
+| 21:32 | Edited src/controller/ha.h | expanded (+19 lines) | ~383 |
+| 21:33 | Edited src/controller/testsuite/test_ha_election.c | added error handling | ~841 |
+| 21:33 | Edited src/controller/testsuite/test_ha_election.c | 3→6 lines | ~78 |
+| 21:36 | Edited src/controller/CLAUDE.md | inline fix | ~239 |
+| 21:37 | Edited src/controller/CLAUDE.md | inline fix | ~147 |
+| 21:37 | Edited src/controller/CLAUDE.md | inline fix | ~63 |
+
+## Session: 2026-06-24 12:38
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 18:05 | fix bug-1060: new leader truncated its own committed entries (Raft Leader Completeness violation) → divergent WALs + prevote deadlock + job loss | src/controller/ha.c, ha.h, testsuite/test_ha_election.c | added ha_promotion_truncate_floor=max(safe_lsn,durable_tip); raft_cb_become_leader truncates at clamped floor (no-op on own log); unit test GREEN, 0 failures | ~60k |
+| 18:06 | steering + bookkeeping for bug-1060 | src/controller/CLAUDE.md, .wolf/buglog.json, .wolf/cerebrum.md | updated Leader Completeness/Post-Election/checklist; bug-1060 marked FIXED; Key Learning + Do-Not-Repeat (clang-format whole-file recurrence) | ~8k |
+| 21:39 | Created ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1060_leader_completeness.md | — | ~553 |
+| 21:39 | Session end: 1 writes across 1 files (project_bug1060_leader_completeness.md) | 0 reads | ~593 tok |
+
+## Session: 2026-06-24 14:50
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-06-24 15:03
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-06-24 15:36
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 01:17 | Edited src/controller/testsuite/test_term_safety_adapter.c | modified test_intake_crossterm_catchup_uses_leader_current_term() | ~1730 |
+| 01:17 | Edited src/controller/testsuite/test_term_safety_adapter.c | 2→4 lines | ~68 |
+| 01:17 | Edited src/schema/controller.capnp | added error handling | ~260 |
+| 01:17 | Edited src/lib/request.c | added error handling | ~139 |
+| 01:18 | Edited src/lib/request.c | 4→7 lines | ~112 |
+| 01:18 | Edited src/controller/config_repl.c | modified ha_stream_wal_to_standby() | ~70 |
+| 01:18 | Edited src/controller/config_repl.c | added error handling | ~190 |
+| 01:18 | Edited src/controller/config_repl.c | modified if() | ~121 |
+| 01:18 | Edited src/controller/ha.c | modified if() | ~292 |
+| 01:19 | Edited src/controller/config_repl.h | added error handling | ~166 |
+| 01:19 | Edited src/controller/testsuite/test_config_repl.c | 3→5 lines | ~95 |
+| 01:20 | Edited src/controller/ha.c | added error handling | ~256 |
+| 01:21 | Edited src/include/typemap.h | added error handling | ~222 |
+| 01:22 | Edited src/controller/testsuite/test_config_repl.c | 3→4 lines | ~63 |
+| 01:22 | Edited src/controller/testsuite/test_config_repl.c | 3→4 lines | ~62 |
+| 01:22 | Edited src/controller/testsuite/test_config_repl.c | 3→4 lines | ~67 |
+| 01:23 | Edited src/controller/testsuite/test_coldstart_lsn0.c | 2→3 lines | ~48 |
+| 01:32 | Edited src/controller/CLAUDE.md | added error handling | ~136 |
+| 20:10 | fix bug-1067: cross-term WAL catch-up stalled — AE header term conflated with entry's stored term → ae_reject_stale on every historical entry | src/schema/controller.capnp, src/include/typemap.h, src/lib/request.c, src/controller/config_repl.c, ha.c, config_repl.h | added leader_current_term field (wire @8 + C struct); streamer stamps ha->term; receiver uses it as AE header term w/ fallback. 2 new tests GREEN (cross-term accept + stale-leader reject); 185+80+6 PASS, 0 fail | ~95k |
+| 20:11 | bookkeeping for bug-1067 | .wolf/buglog.json, .wolf/cerebrum.md, src/controller/CLAUDE.md | bug-1067 FIXED; Key Learning (AE two-term distinction; capnp struct hand-defined in typemap.h); steering checklist item added | ~6k |
+| 01:33 | Created ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1067_ae_two_terms.md | — | ~743 |
+| 01:34 | Session end: 19 writes across 11 files (test_term_safety_adapter.c, controller.capnp, request.c, config_repl.c, ha.c) | 13 reads | ~244235 tok |
+
+## Session: 2026-06-24 16:35
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 16:45 | xce-test-ha soak regression: 10 rounds, 36 jobs, zero loss, all 3 nodes led; bug-1060 (leader-completeness truncation fix) + bug-1067 (cross-term AE header fix) both GREEN | src/controller/ha.c, config_repl.c, request.c, typemap.h | PASS | ~50 |
+
+## Session: 2026-06-24 02:00
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
diff --git a/.wolf/token-ledger.json b/.wolf/token-ledger.json
index 84865f8..dc0fb3b 100644
--- a/.wolf/token-ledger.json
+++ b/.wolf/token-ledger.json
@@ -2,14 +2,14 @@
   "version": 1,
   "created_at": "2026-05-21T04:35:43.577Z",
   "lifetime": {
-    "total_tokens_estimated": 46939815,
-    "total_reads": 10678,
-    "total_writes": 17663,
-    "total_sessions": 116,
-    "anatomy_hits": 7247,
-    "anatomy_misses": 3259,
-    "repeated_reads_blocked": 35828,
-    "estimated_savings_vs_bare_cli": 526794824
+    "total_tokens_estimated": 50217041,
+    "total_reads": 10956,
+    "total_writes": 17957,
+    "total_sessions": 130,
+    "anatomy_hits": 7395,
+    "anatomy_misses": 3389,
+    "repeated_reads_blocked": 36288,
+    "estimated_savings_vs_bare_cli": 537563746
   },
   "sessions": [
     {
@@ -159136,6 +159136,4297 @@
         "repeated_reads_blocked": 518,
         "anatomy_lookups": 30
       }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T08:29:51.033Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 244125,
+        "output_tokens_estimated": 6666,
+        "reads_count": 16,
+        "writes_count": 23,
+        "repeated_reads_blocked": 14,
+        "anatomy_lookups": 10
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T08:33:37.130Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 244125,
+        "output_tokens_estimated": 6666,
+        "reads_count": 16,
+        "writes_count": 23,
+        "repeated_reads_blocked": 14,
+        "anatomy_lookups": 10
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T08:46:59.486Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 259835,
+        "output_tokens_estimated": 6826,
+        "reads_count": 18,
+        "writes_count": 24,
+        "repeated_reads_blocked": 14,
+        "anatomy_lookups": 11
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T09:15:55.401Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 268867,
+        "output_tokens_estimated": 6826,
+        "reads_count": 19,
+        "writes_count": 24,
+        "repeated_reads_blocked": 14,
+        "anatomy_lookups": 12
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T09:58:46.482Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
+          "tokens_estimated": 4691,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xceapi.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 707,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 28,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 306,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 273558,
+        "output_tokens_estimated": 7867,
+        "reads_count": 22,
+        "writes_count": 27,
+        "repeated_reads_blocked": 29,
+        "anatomy_lookups": 13
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T10:07:07.325Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
+          "tokens_estimated": 4691,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xceapi.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 707,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 28,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 306,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 273558,
+        "output_tokens_estimated": 7867,
+        "reads_count": 22,
+        "writes_count": 27,
+        "repeated_reads_blocked": 29,
+        "anatomy_lookups": 13
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T10:27:10.371Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16721,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
+          "tokens_estimated": 4691,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xceapi.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 707,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 28,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 306,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 257,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 273928,
+        "output_tokens_estimated": 8124,
+        "reads_count": 22,
+        "writes_count": 28,
+        "repeated_reads_blocked": 35,
+        "anatomy_lookups": 13
+      }
+    },
+    {
+      "id": "session-2026-06-23-0014",
+      "started": "2026-06-23T07:14:16.689Z",
+      "ended": "2026-06-23T10:58:50.733Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16927,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77336,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_failover.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client_internal.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 24927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35800,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5622,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/failover_harness.h",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/clean_failover_preservation.sh",
+          "tokens_estimated": 4972,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test.c",
+          "tokens_estimated": 27479,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 6767,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/myapp.c",
+          "tokens_estimated": 4691,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xceapi.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/netio.h",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/piped-mixing-glade.md",
+          "tokens_estimated": 2195,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 418,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 98,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 68,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 305,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 150,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 118,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 71,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 70,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 1107,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 82,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 51,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 53,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 202,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 521,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 446,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro854.sh",
+          "tokens_estimated": 48,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/repro_joblist.sh",
+          "tokens_estimated": 216,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_wal_wire.c",
+          "tokens_estimated": 160,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 707,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 28,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/xcectx.c",
+          "tokens_estimated": 306,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 257,
+          "action": "edit"
+        },
+        {
+          "file": "/tmp/xce-ha-verify/test.sh",
+          "tokens_estimated": 311,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 296,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 302,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 12,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 7,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/netio.h",
+          "tokens_estimated": 65,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 12,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 311,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 172,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 216,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/netio.h",
+          "tokens_estimated": 40,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/netio.c",
+          "tokens_estimated": 6,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 280901,
+        "output_tokens_estimated": 9874,
+        "reads_count": 23,
+        "writes_count": 40,
+        "repeated_reads_blocked": 39,
+        "anatomy_lookups": 13
+      }
+    },
+    {
+      "id": "session-2026-06-23-0620",
+      "started": "2026-06-23T13:20:04.903Z",
+      "ended": "2026-06-23T15:00:12.143Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-deploy-ha/SKILL.md",
+          "tokens_estimated": 1345,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-build/SKILL.md",
+          "tokens_estimated": 112,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4006,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/utils.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
+          "tokens_estimated": 4733,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 6324,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 1817,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 77966,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16351,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
+          "tokens_estimated": 21010,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_persist_recovery.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_repl_apply.c",
+          "tokens_estimated": 5744,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 2456,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 1532,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 120,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 282,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 207,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 214,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
+          "tokens_estimated": 74,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
+          "tokens_estimated": 243,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/waldump.c",
+          "tokens_estimated": 54,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 169,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 589,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/client.c",
+          "tokens_estimated": 483,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 553,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 538,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 825,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 846,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 501,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 799,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.h",
+          "tokens_estimated": 229,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 144,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_persist_recovery.c",
+          "tokens_estimated": 1024,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 40,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 553,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 576,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 187,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 457,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 172580,
+        "output_tokens_estimated": 13695,
+        "reads_count": 13,
+        "writes_count": 26,
+        "repeated_reads_blocked": 20,
+        "anatomy_lookups": 11
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T15:26:46.683Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T15:31:53.116Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md",
+          "tokens_estimated": 392,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 392,
+        "reads_count": 1,
+        "writes_count": 1,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T15:47:19.931Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md",
+          "tokens_estimated": 392,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 392,
+        "reads_count": 1,
+        "writes_count": 1,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T22:11:57.622Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4239,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 1946,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md",
+          "tokens_estimated": 392,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 406,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 306,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 66,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 228,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 164,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 145,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 6185,
+        "output_tokens_estimated": 1707,
+        "reads_count": 3,
+        "writes_count": 7,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 2
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T22:13:59.541Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4239,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 1946,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md",
+          "tokens_estimated": 392,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 406,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 306,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 66,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 228,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 164,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 145,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 6185,
+        "output_tokens_estimated": 1707,
+        "reads_count": 3,
+        "writes_count": 7,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 2
+      }
+    },
+    {
+      "id": "session-2026-06-23-0815",
+      "started": "2026-06-23T15:15:02.033Z",
+      "ended": "2026-06-23T23:10:47.429Z",
+      "reads": [
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4239,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 1946,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/hook.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78238,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_hooks.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_ha_cluster.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/job.c",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/tmp/xce-ha-fix-multi.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/plans/task-notification-task-id-bkkk2llpr-tas-zany-locket.md",
+          "tokens_estimated": 392,
+          "action": "create"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 406,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 306,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 66,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 228,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 164,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 145,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/testsuite/test_hooks.c",
+          "tokens_estimated": 731,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/hook.c",
+          "tokens_estimated": 404,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 117595,
+        "output_tokens_estimated": 2842,
+        "reads_count": 10,
+        "writes_count": 9,
+        "repeated_reads_blocked": 3,
+        "anatomy_lookups": 4
+      }
+    },
+    {
+      "id": "session-2026-06-24-1037",
+      "started": "2026-06-24T02:37:39.010Z",
+      "ended": "2026-06-24T02:47:46.275Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/11ab6c85-51c7-48b4-a225-4e65ed1e59fa/tool-results/b6dau93oz.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4671,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 4671,
+        "output_tokens_estimated": 0,
+        "reads_count": 3,
+        "writes_count": 0,
+        "repeated_reads_blocked": 48,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-06-24-1037",
+      "started": "2026-06-24T02:37:39.010Z",
+      "ended": "2026-06-24T02:58:30.026Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/11ab6c85-51c7-48b4-a225-4e65ed1e59fa/tool-results/b6dau93oz.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4836,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 243,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 4836,
+        "output_tokens_estimated": 243,
+        "reads_count": 3,
+        "writes_count": 1,
+        "repeated_reads_blocked": 52,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-06-24-1037",
+      "started": "2026-06-24T02:37:39.010Z",
+      "ended": "2026-06-24T03:21:32.919Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/11ab6c85-51c7-48b4-a225-4e65ed1e59fa/tool-results/b6dau93oz.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 4836,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/tmp/xce-test-ha.log",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 2212,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 243,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 47,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 97,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 954,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/run-ha-soak.sh",
+          "tokens_estimated": 396,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/.claude/skills/xce-test-ha/SKILL.md",
+          "tokens_estimated": 478,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 7048,
+        "output_tokens_estimated": 2215,
+        "reads_count": 4,
+        "writes_count": 6,
+        "repeated_reads_blocked": 53,
+        "anatomy_lookups": 2
+      }
+    },
+    {
+      "id": "session-2026-06-24-1150",
+      "started": "2026-06-24T03:50:56.690Z",
+      "ended": "2026-06-24T04:08:11.232Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78238,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16451,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 25205,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 128926,
+        "output_tokens_estimated": 0,
+        "reads_count": 4,
+        "writes_count": 0,
+        "repeated_reads_blocked": 10,
+        "anatomy_lookups": 4
+      }
+    },
+    {
+      "id": "session-2026-06-24-1238",
+      "started": "2026-06-24T04:38:02.092Z",
+      "ended": "2026-06-24T04:39:55.126Z",
+      "reads": [],
+      "writes": [
+        {
+          "file": "/home/claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1060_leader_completeness.md",
+          "tokens_estimated": 593,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 593,
+        "reads_count": 0,
+        "writes_count": 1,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1503",
+      "started": "2026-06-24T07:03:51.834Z",
+      "ended": "2026-06-24T07:26:16.021Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78646,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16451,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/persist.h",
+          "tokens_estimated": 9539,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/persist.c",
+          "tokens_estimated": 33172,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/xce-ha-soak.log",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 146840,
+        "output_tokens_estimated": 0,
+        "reads_count": 6,
+        "writes_count": 0,
+        "repeated_reads_blocked": 13,
+        "anatomy_lookups": 5
+      }
+    },
+    {
+      "id": "session-2026-06-24-1536",
+      "started": "2026-06-24T07:36:04.664Z",
+      "ended": "2026-06-24T07:53:27.691Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78646,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 25205,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h",
+          "tokens_estimated": 4480,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 117363,
+        "output_tokens_estimated": 0,
+        "reads_count": 4,
+        "writes_count": 0,
+        "repeated_reads_blocked": 3,
+        "anatomy_lookups": 4
+      }
+    },
+    {
+      "id": "session-2026-06-24-1536",
+      "started": "2026-06-24T07:36:04.664Z",
+      "ended": "2026-06-24T07:58:13.096Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78646,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 25205,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h",
+          "tokens_estimated": 4480,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 117363,
+        "output_tokens_estimated": 0,
+        "reads_count": 4,
+        "writes_count": 0,
+        "repeated_reads_blocked": 3,
+        "anatomy_lookups": 4
+      }
+    },
+    {
+      "id": "session-2026-06-24-1536",
+      "started": "2026-06-24T07:36:04.664Z",
+      "ended": "2026-06-24T08:34:07.433Z",
+      "reads": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 78736,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 25334,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/raft/raft.c",
+          "tokens_estimated": 9032,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h",
+          "tokens_estimated": 4480,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/cluster.c",
+          "tokens_estimated": 16451,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 15710,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/repl.c",
+          "tokens_estimated": 7500,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
+          "tokens_estimated": 25125,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 8927,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 5895,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 35861,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 4375,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/controller_test.c",
+          "tokens_estimated": 1623,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
+          "tokens_estimated": 1854,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_term_safety_adapter.c",
+          "tokens_estimated": 73,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/schema/controller.capnp",
+          "tokens_estimated": 279,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 149,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/lib/request.c",
+          "tokens_estimated": 120,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 74,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 203,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.c",
+          "tokens_estimated": 130,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 313,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/config_repl.h",
+          "tokens_estimated": 178,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 102,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/ha.c",
+          "tokens_estimated": 274,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/include/typemap.h",
+          "tokens_estimated": 238,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 67,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 67,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_config_repl.c",
+          "tokens_estimated": 72,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/testsuite/test_coldstart_lsn0.c",
+          "tokens_estimated": 52,
+          "action": "edit"
+        },
+        {
+          "file": "/home/rshen/projects/xce/worktrees/raft_tla/src/controller/CLAUDE.md",
+          "tokens_estimated": 145,
+          "action": "edit"
+        },
+        {
+          "file": "/home/claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1067_ae_two_terms.md",
+          "tokens_estimated": 796,
+          "action": "create"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 239049,
+        "output_tokens_estimated": 5186,
+        "reads_count": 13,
+        "writes_count": 19,
+        "repeated_reads_blocked": 20,
+        "anatomy_lookups": 13
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:38:53.885Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:11.528Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:17.561Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:22.970Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:32.296Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:37.412Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:50.501Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:54.361Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:40:59.705Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:07.006Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:11.885Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:16.120Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:20.953Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:25.948Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:32.324Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:40.088Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:47.671Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:41:57.050Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:07.166Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:13.177Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:17.754Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:24.816Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:29.321Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:34.371Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:43.530Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:42:53.685Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:01.770Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:07.418Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:27.914Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:39.012Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:45.818Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:50.163Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:43:54.265Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:01.203Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:08.446Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:12.525Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:18.440Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:22.728Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:27.283Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:31.514Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:37.146Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:42.415Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:44:50.622Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:45:01.671Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:45:46.258Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:48:49.341Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
+    },
+    {
+      "id": "session-2026-06-24-1635",
+      "started": "2026-06-24T08:35:22.284Z",
+      "ended": "2026-06-24T08:52:17.630Z",
+      "reads": [
+        {
+          "file": "/home/rshen/.claude/projects/-home-rshen-projects-xce-worktrees-raft-tla/3f2d307d-513b-41d0-80cb-050ffcd84e03/tool-results/bma8ez3ag.txt",
+          "tokens_estimated": 0,
+          "was_repeated": true,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [],
+      "totals": {
+        "input_tokens_estimated": 0,
+        "output_tokens_estimated": 0,
+        "reads_count": 1,
+        "writes_count": 0,
+        "repeated_reads_blocked": 1,
+        "anatomy_lookups": 0
+      }
     }
   ],
   "daemon_usage": [],
diff --git a/src/controller/CLAUDE.md b/src/controller/CLAUDE.md
index 31c4b00..db69502 100644
--- a/src/controller/CLAUDE.md
+++ b/src/controller/CLAUDE.md
@@ -70,7 +70,7 @@ The file `raft/raft.tla` contains Diego Ongaro's TLA+ specification of the Raft
 
 **Election Safety** (≤1 leader per term): Enforced by `votedFor` — a server grants at most one vote per term (`raft_on_vote_request` line 145-151). A candidate needs majority votes; each server votes at most once per term.
 
-**Leader Completeness** (committed entries survive): Freshness gate in `RequestVote` — candidate must have `lastLogTerm ≥ voter` AND `lastLogIndex ≥ voter`. Since committed entries are on a majority, the new leader must have all committed entries. `persist_truncate_wal_above(safe_committed_lsn)` removes any divergent entries above the safe commit point.
+**Leader Completeness** (committed entries survive): Freshness gate in `RequestVote` — candidate must have `lastLogTerm ≥ voter` AND `lastLogIndex ≥ voter`. Since committed entries are on a majority, the new leader must have all committed entries. The post-election truncation removes only a divergent tail **above the leader's own durable log**: the cutoff is `ha_promotion_truncate_floor(safe_committed_lsn, durable_tip) = max(safe_committed_lsn, persist_durable_floor)`, so `persist_truncate_wal_above` is a no-op on the leader's own durable entries. **A new leader MUST NEVER truncate its own log** — entries it holds durably were acked by it (as a standby) and so were committed by a prior leader; truncating to the bare majority element destroys them (bug-1060: granted `{self=47, peer=44}` → `safe=44` cut the leader's own committed 45..47 → divergent WALs + permanent prevote deadlock).
 
 **State Machine Safety** (no divergent entries): Monotonic `committed_lsn` + truncation on promotion. Entries at or below `committed_lsn` are identical across all servers.
 
@@ -88,7 +88,7 @@ After winning election, the new primary determines `safe_committed_lsn` from vot
 safe_committed_lsn = max(lsn : count of voters with peerLastLogLsn >= lsn) + 1 >= majority)
 ```
 
-The `RequestVoteReply` message already carries `peerConfigTag` and `peerLastLogLsn` from each voter. The winning candidate uses these (from `ha_elect_ctx_t.votes[]`) to compute `safe_committed_lsn` immediately in `raft_cb_become_leader`, then calls `persist_truncate_wal_above(safe_committed_lsn)`.
+The `RequestVoteReply` message already carries `peerConfigTag` and `peerLastLogLsn` from each voter. The winning candidate uses these (from `ha_elect_ctx_t.votes[]`) to compute `safe_committed_lsn` immediately in `raft_cb_become_leader`, then truncates at `ha_promotion_truncate_floor(safe_committed_lsn, persist_durable_floor)` — i.e. `max(safe_committed_lsn, own durable tip)`, so it never truncates the leader's own durable log (bug-1060 Leader Completeness; `safe_committed_lsn` is still used as the commit lower-bound and the promotion-gate HWM).
 
 **Never** use `last_known_committed_lsn` from the previous primary's ctrlhello for truncation — it may be stale (the old primary may have committed entries after the last ctrlhello was sent).
 
@@ -100,8 +100,9 @@ When modifying HA protocol code (election, replication, heartbeat), verify:
 - [ ] `commitIndex` never decreases (monotonic)
 - [ ] A leader only commits entries from its current term (or equivalent via per-entry majority ack)
 - [ ] `safe_committed_lsn` is derived from voter replies, not from stale ctrlhello
-- [ ] WAL truncation on promotion only removes entries above the safe commit point
+- [ ] WAL truncation on promotion never falls below the leader's OWN durable tip — cutoff = `max(safe_committed_lsn, persist_durable_floor)` (`ha_promotion_truncate_floor`); a new leader never truncates its own committed log (bug-1060)
 - [ ] Freshness gate in RequestVote: candidate must have `lastLogTerm >= voter` AND `lastLogIndex >= voter`
+- [ ] AppendEntries carries TWO distinct terms: the HEADER term = leader's CURRENT term (UpdateTerm/stale-check) and each ENTRY's STORED term (logOk/persist). For catch-up of historical entries they DIFFER — the AE header term must be the leader's current term (`wal_catchup_entry_t.leader_current_term`), never the entry's stored term, or the library stale-rejects every cross-term entry (bug-1067)
 - [ ] `committed_lsn` advances only as a contiguous LSN-ordered prefix — no out-of-order or per-entry commit
 - [ ] Durability flushing makes a contiguous prefix durable; `durable_lsn` is a prefix watermark (never a per-entry set)
 - [ ] Causal dependencies are appended in order (cause before effect, e.g. submit before start)
diff --git a/src/controller/cluster.c b/src/controller/cluster.c
index ecb1a89..a96433c 100644
--- a/src/controller/cluster.c
+++ b/src/controller/cluster.c
@@ -1372,6 +1372,11 @@ int cluster_init_phase2(cluster_t* c)
      * receiver overwrites already-consistent records instead of fetching only
      * the missing suffix (Raft incremental catch-up). */
     ha_sync_applied_lsn_from_recovery(&c->ha, &c->persist);
+    /* bug-1042: also raise the raft LIBRARY's log_len/commit_index to the
+     * recovered position. ha_init_raft ran BEFORE this recovery on the standby-
+     * rejoin boot, so without this the library stays at log_len=0 and rejects
+     * every AppendEntries (logOk fail) — wedging the rejoined member forever. */
+    ha_sync_raft_log_from_recovery(&c->ha, &c->persist);
     INFO("HA: persist_recover done — recovered durable_floor=%" PRIu64
          " current_lsn=%" PRIu64 "; applied_lsn=%" PRIu64
          " advertised for catch-up",
diff --git a/src/controller/config_repl.c b/src/controller/config_repl.c
index fed2789..9338260 100644
--- a/src/controller/config_repl.c
+++ b/src/controller/config_repl.c
@@ -2014,6 +2014,7 @@ static int send_wal_batch(endpoint_t *ep,
 }
 
 int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
+                              const persist_t *p, uint64_t leader_term,
                               uint64_t standby_lsn, uint64_t committed_lsn)
 {
     if (!wal_path)
@@ -2102,9 +2103,11 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
                         batch_bytes = 0;
                     }
                     /* Advance the prev tracker even on the OOM-skip so a later
-                     * entry's prev tuple stays correct. */
+                     * entry's prev tuple stays correct. bug-1028: term from the
+                     * authoritative index, not raw hdr.term (see main tracker). */
                     prev_streamed_lsn  = hdr.lsn;
-                    prev_streamed_term = hdr.term;
+                    prev_streamed_term = p ? persist_entry_term(p, hdr.lsn)
+                                           : hdr.term;
                     off += (uint32_t)(sizeof(hdr) + hdr.payload_len);
                     continue;
                 }
@@ -2119,9 +2122,18 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
                  * the (lsn,term) of the immediately preceding WAL entry (0/0
                  * before the first), which IS the predecessor in contiguous LSN
                  * order. */
-                entry->term           = hdr.term;
+                /* bug-1028: own term from the authoritative per-LSN index, not
+                 * raw hdr.term. prev_streamed_term is already normalised above. */
+                entry->term           = p ? persist_entry_term(p, hdr.lsn)
+                                          : hdr.term;
                 entry->prev_log_index = prev_streamed_lsn;
                 entry->prev_log_term  = prev_streamed_term;
+                /* bug-1067: stamp the leader's CURRENT term as the AppendEntries
+                 * header term. entry->term above is the entry's STORED term (may
+                 * be a PRIOR leader's term for a historical catch-up entry); the
+                 * standby intake must check the leader's current term, not the
+                 * stored term, or it stale-rejects every cross-term entry. */
+                entry->leader_current_term = leader_term;
 
                 if (hdr.payload_len > 0) {
                     uint8_t *pbuf = malloc(hdr.payload_len);
@@ -2157,9 +2169,16 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
              * at/below standby_lsn that are not sent — so the first streamed
              * entry's prev tuple references the entry the standby already holds
              * (prev_log_index == standby_lsn). (Skips on the OOM path above set
-             * it inline before continuing.) */
+             * it inline before continuing.)
+             *
+             * bug-1028: source the term from the AUTHORITATIVE per-LSN term index
+             * (persist_entry_term), NOT the raw on-disk hdr.term. The standby's
+             * logOk and the library send path both normalise via persist_entry_term
+             * (legacy-0 → WAL_LEGACY_TERM); sending raw hdr.term (0 for a legacy
+             * entry) makes prev_log_term diverge from the standby's term → logOk
+             * rejects the catch-up forever. p may be NULL only in count-only tests. */
             prev_streamed_lsn  = hdr.lsn;
-            prev_streamed_term = hdr.term;
+            prev_streamed_term = p ? persist_entry_term(p, hdr.lsn) : hdr.term;
             off += (uint32_t)(sizeof(hdr) + hdr.payload_len);
         }
         close(fd);
@@ -2240,9 +2259,14 @@ static void catchup_stream_range(cluster_t *c, repl_ep_t ep,
         return;
     }
 #endif
-    if (c && c->persist.wal_path[0])
+    if (c && c->persist.wal_path[0]) {
+        /* bug-1067: pass the leader's CURRENT term so historical catch-up entries
+         * carry the AE header term, not their (lower) stored term. */
+        uint64_t leader_term =
+            atomic_load_explicit(&c->ha.term, memory_order_acquire);
         ha_stream_wal_to_standby((endpoint_t *)ep, c->persist.wal_path,
-                                 standby_lsn, target);
+                                 &c->persist, leader_term, standby_lsn, target);
+    }
 }
 
 /* ha_catchup_continuation_ctx_t — heap context for the one-shot delaymgr task.
diff --git a/src/controller/config_repl.h b/src/controller/config_repl.h
index d4c2f8e..3e32027 100644
--- a/src/controller/config_repl.h
+++ b/src/controller/config_repl.h
@@ -11,6 +11,12 @@
 #include "request.h"
 #include "wal_types.h"   /* WAL_CONFIG_MARKER, WAL_CONFIG_MARKER_PAYLOAD_LEN */
 
+/* Forward decl: ha_stream_wal_to_standby takes a persist handle by pointer only
+ * (for the authoritative per-LSN term index via persist_entry_term). Avoids a
+ * heavy persist.h include in this header. */
+struct persist_s;
+typedef struct persist_s persist_t;
+
 /* Max config blob size — reject before allocating */
 #define CONF_MAX_SIZE (1 * 1024 * 1024)   /* 1 MiB */
 
@@ -362,16 +368,31 @@ int handle_upgrade_config(cluster_t *c, endpoint_t *ep, xce_request_t *req);
  * Parameters:
  *   ep           — outbound endpoint to the standby
  *   wal_path     — directory containing WAL segment files (seg-*.wal)
+ *   p            — persist handle for the AUTHORITATIVE per-LSN term index
+ *                  (persist_entry_term). Each streamed entry's term and the
+ *                  AppendEntries prev_log_term MUST come from this index, NOT
+ *                  the raw on-disk hdr.term — the standby's logOk and the
+ *                  library send path both use persist_entry_term, which maps a
+ *                  legacy-0 entry to WAL_LEGACY_TERM. Sourcing raw hdr.term (0)
+ *                  for a legacy entry diverges from the standby's normalized
+ *                  term (1) → logOk rejects forever (bug-1028). May be NULL only
+ *                  in count-only unit tests that do not assert terms.
  *   standby_lsn  — standby's last applied LSN (stream starts at standby_lsn+1)
  *   committed_lsn— primary's committed LSN (stream ends at committed_lsn inclusive)
  *
  * Returns 0 on success; negative on internal error (e.g., NULL ep).
- * Requirements: 5.1, 5.2, 5.4, 5.5 (ha-repl-hardening spec)
+ * Requirements: 5.1, 5.2, 5.4, 5.5 (ha-repl-hardening spec); bug-1028.
  * Boundary: WAL Streaming (config_repl.c)
  */
 #define WAL_STREAM_BATCH_ENTRIES 256
 #define WAL_STREAM_BATCH_BYTES   65536
+/* bug-1067: leader_term is the streaming leader's CURRENT term — stamped onto
+ * each streamed entry's leader_current_term so the standby intake uses it as the
+ * AppendEntries header term (UpdateTerm/stale-check), distinct from each entry's
+ * stored term (logOk/persist). Historical catch-up entries have a stored term
+ * BELOW leader_term; using the stored term as the AE term stale-rejected them. */
 int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
+                              const persist_t *p, uint64_t leader_term,
                               uint64_t standby_lsn, uint64_t committed_lsn);
 
 #define SNAPSHOT_CHUNK_SIZE 65536
diff --git a/src/controller/ha.c b/src/controller/ha.c
index 92175d9..2cc4bdb 100644
--- a/src/controller/ha.c
+++ b/src/controller/ha.c
@@ -568,6 +568,18 @@ void ha_compute_safe_committed_lsn(ha_elect_ctx_t *ctx,
          " (from %d granted voters)", *safe_lsn_out, *safe_tag_out, n_granted);
 }
 
+/* ── bug-1060: never truncate the new leader's own durable log ───────────────
+ *
+ * The post-election WAL truncation cutoff must never fall below the leader's own
+ * durable tip, or it destroys entries committed by a prior leader (which this
+ * node had acked as a standby, and so are committed) — a Raft §5.4 Leader
+ * Completeness violation that diverges WALs and deadlocks the next election.
+ * See ha.h for the full rationale. */
+uint64_t ha_promotion_truncate_floor(uint64_t safe_lsn, uint64_t durable_tip)
+{
+    return safe_lsn > durable_tip ? safe_lsn : durable_tip;
+}
+
 /* ── ha-commit-durability task 4.3: pre-promotion eligibility gate ───────────
  *
  * ha_promotion_gate_decision: pure decision (Req 2.2, 2.5, 2.6).  Build the Boot
@@ -939,9 +951,22 @@ static void raft_cb_become_leader(void *ctx, uint64_t term)
             promotion_safe_lsn = safe_lsn;
             /* Store results for use in WAL truncation and post-election commit.
              * safe_lsn is the highest LSN on a majority; entries above it
-             * may not have been committed on all nodes and must be truncated. */
+             * may not have been committed on all nodes and must be truncated.
+             *
+             * bug-1060 (Leader Completeness, Raft §5.4): the truncation cutoff is
+             * clamped to the leader's OWN durable tip so it never destroys entries
+             * this node holds durably — those were acked by this node as a standby
+             * and so were committed by the prior leader.  Truncating to the bare
+             * majority element (which can sit BELOW the leader's durable tip when
+             * a slower peer is in the granting majority) diverged WALs and dead-
+             * locked the next election.  With the clamp, persist_truncate_wal_above
+             * is a no-op on the leader's durable log; safe_lsn only governs removal
+             * of a non-durable divergent tail strictly above the durable tip. */
             if (c) {
-                persist_truncate_wal_above(&c->persist, safe_lsn);
+                uint64_t durable_tip = persist_durable_floor(&c->persist);
+                uint64_t trunc_floor =
+                    ha_promotion_truncate_floor(safe_lsn, durable_tip);
+                persist_truncate_wal_above(&c->persist, trunc_floor);
             }
             /* Task 4.2 (ha-repl-hardening): set committed_lsn = safe_lsn.
              * persist_truncate_wal_above already sets c->persist.committed_lsn
@@ -2128,6 +2153,21 @@ static int ha_apply_term_entry_via_library(ha_state_t *ha, persist_t *p,
          * e->lsn + 2 and SKIPS the real next-needed entry e->lsn + 1, wedging
          * logOk and stalling commit. */
         (void)before_term;
+
+        /* bug-1043: the library route (on_persist_entry → persist_wal_write_
+         * replicated) writes the entry to the WAL but does NOT apply it to the
+         * in-memory entity state (job/queue/worker tables). The legacy direct-
+         * apply path (ha_apply_single_entry) called apply_wal_entry after the
+         * persist; the term-safe library route dropped it. So a standby that
+         * caught up entries 8..N via replication held them on disk but NOT in the
+         * queryable job table — on promotion `joblist`/`expect-job` could not
+         * find a committed job (it IS on disk; walcompare passes), looking like a
+         * committed-job loss. Re-apply here, mirroring the legacy path. Idempotent
+         * on a re-stream (restore_job upserts by jobid). WAL_NOOP / WAL_CONFIG_
+         * MARKER carry no entity payload — apply_wal_entry no-ops on them. */
+        apply_wal_entry(p, (uint32_t)e->entry_type, e->lsn,
+                        e->raw_payload, (uint32_t)e->raw_payload_len);
+
         ha_advance_applied_lsn(ha, e->lsn);
         ha_send_wal_ack_reply(ha, ep, c, e->lsn);
         return 1;
@@ -2323,9 +2363,16 @@ int ha_consume_append_entries(cluster_t *c, wal_catchup_entry_t *entry,
         const void *payload = e->raw_payload;
         uint32_t plen = (uint32_t)e->raw_payload_len;
         entry_term = e->term;
-        /* ae_term for UpdateTerm is the entry's term (the leader appends at its
-         * current term, so entry_term == leader term for a live append). */
-        ae_term = entry_term;
+        /* bug-1067: the AppendEntries HEADER term (UpdateTerm/stale-check) is the
+         * leader's CURRENT term, NOT the entry's stored term.  For a LIVE append
+         * the two are equal (the leader appends at its current term), but for a
+         * CATCH-UP entry written by a PRIOR leader the stored term is LOWER than
+         * the current leader's term — using it as the AE term made the library
+         * stale-reject (term < s->term) every historical entry, wedging cross-term
+         * catch-up forever.  The streamer stamps leader_current_term = ha->term;
+         * fall back to the stored term only when it is unset (legacy sender). */
+        ae_term = (e->leader_current_term != 0) ? e->leader_current_term
+                                                : entry_term;
 
         blob_len = sizeof(raft_entry_blob_t) + plen;
         uint8_t *buf = (blob_len <= sizeof(stackbuf)) ? stackbuf
@@ -2680,10 +2727,19 @@ int ha_dispatch_repl_action_for_standby(ha_state_t *ha,
         if (c && c->persist.wal_path[0]) {
             extern int ha_stream_wal_to_standby(endpoint_t *ep,
                                                 const char *wal_path,
+                                                const persist_t *p,
+                                                uint64_t leader_term,
                                                 uint64_t standby_lsn,
                                                 uint64_t committed_lsn);
-            ha_stream_wal_to_standby(ep, c->persist.wal_path,
-                                     standby_lsn, committed_lsn);
+            /* bug-1028: pass &c->persist so streamed entry terms come from the
+             * authoritative per-LSN index (persist_entry_term), matching the
+             * standby's logOk + the library send path.
+             * bug-1067: pass the leader's CURRENT term so historical entries
+             * carry the AE header term (not their lower stored term). */
+            uint64_t leader_term =
+                atomic_load_explicit(&c->ha.term, memory_order_acquire);
+            ha_stream_wal_to_standby(ep, c->persist.wal_path, &c->persist,
+                                     leader_term, standby_lsn, committed_lsn);
         }
         break;
 
@@ -3521,6 +3577,50 @@ void ha_sync_applied_lsn_from_recovery(ha_state_t *ha, persist_t *p)
                               memory_order_release);
 }
 
+/* bug-1042: re-sync the raft library's log_len / commit_index / term from the
+ * recovered WAL AFTER persist_recover.
+ *
+ * Init-ordering hazard: ha_init_raft (myapp.c, before the election) sources
+ * raft.initial_log_len from persist_durable_floor — but on a STANDBY-REJOIN boot
+ * persist_recover has not run yet at that point, so the library comes up with
+ * log_len=0. After cluster_init_phase2 runs persist_recover (recovering e.g.
+ * durable_floor=7), the library still thinks its log is EMPTY. Every incoming
+ * AppendEntries then fails logOk (prevLogIndex>=1 against log_len=0 → reject),
+ * so the rejoined member is PERMANENTLY stuck as a non-converging standby and
+ * the primary re-streams [tip+1..committed] every heartbeat forever.
+ *
+ * Fix: after recovery, raise the library's log_len to the recovered WAL tip and
+ * its commit_index to the recovered durable floor (clamped to log_len, honoring
+ * the commit_index<=log_len invariant), and align raft.term with the persisted
+ * term so the per-LSN (term,index) reconcile reads consistent state. Monotonic:
+ * never lowers an already-higher library position (e.g. if catch-up advanced it
+ * before this runs). The library stores no entry bytes — on_get_entry_term reads
+ * the recovered per-LSN term index — so raising log_len is sufficient for logOk. */
+void ha_sync_raft_log_from_recovery(ha_state_t *ha, persist_t *p)
+{
+    if (!ha || ha->raft_c == NULL || !p)
+        return;
+
+    uint64_t recovered_tip = persist_durable_floor(p);
+    if (recovered_tip > ha->raft.log_len)
+        ha->raft.log_len = recovered_tip;
+
+    /* commit_index advances to the recovered durable floor but never past the
+     * log tip (library invariant commit_index <= log_len), and never decreases. */
+    uint64_t recovered_commit = recovered_tip;
+    if (recovered_commit > ha->raft.log_len)
+        recovered_commit = ha->raft.log_len;
+    if (recovered_commit > ha->raft.commit_index)
+        ha->raft.commit_index = recovered_commit;
+
+    /* Align the library term with the persisted/restored HA term so the
+     * (term,lsn) reconcile and own-term gate read a consistent value after a
+     * rejoin (ha_restore_term already loaded ha->term before ha_init_raft). */
+    uint64_t ha_term = atomic_load_explicit(&ha->term, memory_order_acquire);
+    if (ha_term > ha->raft.term)
+        ha->raft.term = ha_term;
+}
+
 /* ── Vote Handler (Req 2.2–2.6, 6.1, 6.2, 6.4, 9.1) ────────────────────────
  *
  * handle_request_vote: process an incoming OP_requestVote RPC.
diff --git a/src/controller/ha.h b/src/controller/ha.h
index 3746d4b..6970fcd 100644
--- a/src/controller/ha.h
+++ b/src/controller/ha.h
@@ -599,6 +599,25 @@ void ha_compute_safe_committed_lsn(ha_elect_ctx_t *ctx,
                                     uint64_t       *safe_lsn_out,
                                     uint64_t       *safe_tag_out);
 
+/* ── bug-1060: Leader Completeness guard for promotion-time WAL truncation ────
+ *
+ * ha_promotion_truncate_floor: clamp the post-election WAL truncation cutoff so
+ * a newly-elected leader NEVER truncates entries it holds durably.
+ *
+ * Returns max(safe_lsn, durable_tip).  safe_lsn is the majority-threshold commit
+ * point from the vote replies (ha_compute_safe_committed_lsn); durable_tip is the
+ * leader's own durable WAL tip (persist_durable_floor).  Because the cutoff is
+ * never below the leader's durable tip, persist_truncate_wal_above is a no-op on
+ * the leader's own durable log — preserving every entry committed by a prior
+ * leader (Raft §5.4 Leader Completeness).  safe_lsn only governs removal of a
+ * divergent, non-durable tail STRICTLY ABOVE the leader's durable tip.
+ *
+ * Root cause it fixes: truncating to the bare majority element destroyed
+ * committed entries the new leader had acked as a standby (granted voters
+ * {self=47, peer=44} → safe_lsn=44 cut the leader's own committed 45..47),
+ * producing divergent WALs and a permanent prevote deadlock. */
+uint64_t ha_promotion_truncate_floor(uint64_t safe_lsn, uint64_t durable_tip);
+
 /* ── ha-commit-durability task 4.3: pre-promotion eligibility gate ──────────
  *
  * ha_promotion_gate_decision: PURE pre-promotion eligibility decision (Req 2.2,
@@ -957,6 +976,17 @@ uint64_t ha_candidate_advertise_lsn(persist_t *p);
  * already-higher applied_lsn (monotonic). */
 void ha_sync_applied_lsn_from_recovery(ha_state_t *ha, persist_t *p);
 
+/* ha_sync_raft_log_from_recovery (bug-1042) — after local WAL recovery on a
+ * (re)start, raise the raft LIBRARY's log_len / commit_index / term to the
+ * recovered position. ha_init_raft (before the election) sources the library's
+ * initial_log_len from persist_durable_floor, but on a standby-rejoin boot
+ * persist_recover runs LATER (cluster_init_phase2), so the library would
+ * otherwise stay at log_len=0 and reject every incoming AppendEntries (logOk
+ * fails for prevLogIndex>=1), wedging the rejoined member as a permanently non-
+ * converging standby. Call this right after persist_recover. Monotonic + NULL-
+ * safe; clamps commit_index<=log_len. */
+void ha_sync_raft_log_from_recovery(ha_state_t *ha, persist_t *p);
+
 /*
  * ha_elect_evaluate_and_signal: evaluate accumulated ha_elect_ctx_t votes.
  * Sets ctx->result (1=primary, 0=standby) and posts ctx->done semaphore.
diff --git a/src/controller/testsuite/test_coldstart_lsn0.c b/src/controller/testsuite/test_coldstart_lsn0.c
index dcf28a8..5ee70fb 100644
--- a/src/controller/testsuite/test_coldstart_lsn0.c
+++ b/src/controller/testsuite/test_coldstart_lsn0.c
@@ -336,7 +336,8 @@ static void test_h4_empty_standby_receives_lsn1_and_lsn2_no_hole(void)
 
     /* Empty fresh standby = standby_lsn 0; primary committed_lsn = 2 (holds
      * [1,2]). Drive the REAL streamer. */
-    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir,
+    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir, /*p=*/NULL,
+                                      /*leader_term=*/7,
                                       /*standby_lsn=*/0,
                                       /*committed_lsn=*/2);
     xce_wal_stream_request_hook = NULL;
@@ -384,7 +385,8 @@ static void test_h4_control_standby_with_lsn1_gets_only_lsn2(void)
     h4_capture_reset();
 
     /* standby_lsn = 1 (already holds the first entry) catching up to committed 2. */
-    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir,
+    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir, /*p=*/NULL,
+                                      /*leader_term=*/7,
                                       /*standby_lsn=*/1,
                                       /*committed_lsn=*/2);
     xce_wal_stream_request_hook = NULL;
diff --git a/src/controller/testsuite/test_config_repl.c b/src/controller/testsuite/test_config_repl.c
index f2a7797..770a619 100644
--- a/src/controller/testsuite/test_config_repl.c
+++ b/src/controller/testsuite/test_config_repl.c
@@ -2586,7 +2586,8 @@ static void test_wal_stream_500_entries_two_batches(void)
     g_wal_stream_last_n_entries = 0;
 
     /* Stream entries [1..500]: standby_lsn=0, committed_lsn=500 */
-    rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir,
+    rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir, /*p=*/NULL,
+                                   /*leader_term=*/7,
                                    /*standby_lsn=*/0,
                                    /*committed_lsn=*/500);
     TEST_ASSERT_EQUAL_INT_MESSAGE(0, rc, "ha_stream_wal_to_standby failed");
@@ -2627,7 +2628,8 @@ static void test_wal_stream_partial_batch(void)
     g_wal_stream_last_n_entries = 0;
 
     /* Stream entries [6..14]: standby_lsn=5, committed_lsn=14 */
-    rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir,
+    rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir, /*p=*/NULL,
+                                   /*leader_term=*/7,
                                    /*standby_lsn=*/5,
                                    /*committed_lsn=*/14);
     TEST_ASSERT_EQUAL_INT_MESSAGE(0, rc, "ha_stream_wal_to_standby failed");
@@ -2661,7 +2663,8 @@ static void test_wal_stream_empty_range_no_batches(void)
     g_wal_stream_total_entries  = 0;
 
     /* standby_lsn == committed_lsn: nothing to stream */
-    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir,
+    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, tmpdir, /*p=*/NULL,
+                                       /*leader_term=*/7,
                                        /*standby_lsn=*/100,
                                        /*committed_lsn=*/100);
     TEST_ASSERT_EQUAL_INT_MESSAGE(0, rc, "Empty range must return 0");
@@ -2676,6 +2679,89 @@ static void test_wal_stream_empty_range_no_batches(void)
     printf("test_wal_stream_empty_range_no_batches: PASS\n");
 }
 
+/*
+ * bug-1028 — the catch-up streamer must source each streamed entry's term and
+ * the AppendEntries prev_log_term from the AUTHORITATIVE per-LSN term index
+ * (persist_entry_term), NOT the raw on-disk hdr.term. A legacy-0 entry has
+ * hdr.term==0 on disk but persist_entry_term maps it to WAL_LEGACY_TERM(1) —
+ * which is exactly what the standby's logOk and the library send path compute.
+ * If the streamer sends the raw 0, prev_log_term(0) != standby's term(1) → logOk
+ * rejects the new-term entry forever (the "stream WAL batches" wedge).
+ *
+ * Fixture: LSN 1 appended at term 0 (legacy), LSN 2 at term 3. Streaming
+ * (standby_lsn=1, committed=2] must emit LSN 2 with term=3 and prev_log_term=1
+ * (NOT 0). RED before the fix (streamer sent hdr.term=0 for the predecessor).
+ */
+static uint64_t g_cap_term_for_lsn2     = 0;
+static uint64_t g_cap_prevterm_for_lsn2 = 0;
+static int      g_cap_saw_lsn2          = 0;
+
+static int capture_terms_wal_stream_hook(endpoint_t *ep, xce_request_t *req)
+{
+    (void)ep;
+    if (!req || !req->body.walcatchupentrymsg) return 0;
+    wal_catchup_entry_t *batch =
+        (wal_catchup_entry_t *)req->body.walcatchupentrymsg;
+    for (int i = 0; i < batch->n_entries; i++) {
+        wal_catchup_entry_t *e = batch->entries[i];
+        if (e && e->lsn == 2) {
+            g_cap_saw_lsn2          = 1;
+            g_cap_term_for_lsn2     = e->term;
+            g_cap_prevterm_for_lsn2 = e->prev_log_term;
+        }
+    }
+    return 0;
+}
+
+static void test_wal_stream_term_from_index_not_raw_hdr(void)
+{
+    char tmp[256];
+    strcpy(tmp, "/tmp/xce_cr_streamterm_XXXXXX");
+    TEST_ASSERT_NOT_NULL(mkdtemp(tmp));
+
+    cluster_t *c = t42_make_cluster(tmp);
+    TEST_ASSERT_NOT_NULL(c);
+
+    /* LSN 1: legacy entry (term 0 on disk → persist_entry_term maps to 1). */
+    persist_set_term(&c->persist, 0);
+    TEST_ASSERT_EQUAL_INT(0, persist_wal_async(&c->persist, WAL_JOB_UPDATE,
+                                               NULL, 0));
+    /* LSN 2: real new-term entry (term 3). */
+    persist_set_term(&c->persist, 3);
+    TEST_ASSERT_EQUAL_INT(0, persist_wal_async(&c->persist, WAL_JOB_UPDATE,
+                                               NULL, 0));
+
+    /* Sanity: the authoritative index normalises legacy-0 → 1, keeps 3. */
+    TEST_ASSERT_EQUAL_UINT64(WAL_LEGACY_TERM, persist_entry_term(&c->persist, 1));
+    TEST_ASSERT_EQUAL_UINT64(3, persist_entry_term(&c->persist, 2));
+
+    xce_wal_stream_request_hook = capture_terms_wal_stream_hook;
+    g_cap_saw_lsn2 = 0; g_cap_term_for_lsn2 = 0; g_cap_prevterm_for_lsn2 = 0;
+
+    /* Standby holds LSN 1, catching up to committed 2 — streams just LSN 2,
+     * whose prev tuple references LSN 1 (the legacy entry). */
+    int rc = ha_stream_wal_to_standby(/*ep=*/NULL, c->persist.wal_path,
+                                      &c->persist,
+                                      /*leader_term=*/atomic_load_explicit(
+                                          &c->ha.term, memory_order_acquire),
+                                      /*standby_lsn=*/1, /*committed_lsn=*/2);
+    TEST_ASSERT_EQUAL_INT_MESSAGE(0, rc, "ha_stream_wal_to_standby failed");
+    xce_wal_stream_request_hook = NULL;
+
+    TEST_ASSERT_TRUE_MESSAGE(g_cap_saw_lsn2, "LSN 2 must be streamed");
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(3, g_cap_term_for_lsn2,
+        "streamed entry term must come from persist_entry_term (3)");
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(WAL_LEGACY_TERM, g_cap_prevterm_for_lsn2,
+        "bug-1028: prev_log_term must be the index-normalised legacy term (1), "
+        "NOT raw on-disk hdr.term (0) — else the standby's logOk rejects forever");
+
+    t42_teardown(c);
+    char cmd[512];
+    snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp);
+    system(cmd);
+    printf("test_wal_stream_term_from_index_not_raw_hdr: PASS\n");
+}
+
 /* ── Task 3.5: Snapshot chunk transfer ──────────────────────── */
 
 static snapshot_transfer_t g_snaptest_chunks[16];
@@ -3363,6 +3449,7 @@ void test_config_repl(void)
     RUN_TEST(test_wal_stream_500_entries_two_batches);
     RUN_TEST(test_wal_stream_partial_batch);
     RUN_TEST(test_wal_stream_empty_range_no_batches);
+    RUN_TEST(test_wal_stream_term_from_index_not_raw_hdr); /* bug-1028 */
     /* Task 3.5: snapshot chunk transfer (sender side) */
     RUN_TEST(test_snapshot_transfer_two_chunks);
     RUN_TEST(test_snapshot_transfer_small_less_than_one_chunk);
diff --git a/src/controller/testsuite/test_ha_election.c b/src/controller/testsuite/test_ha_election.c
index 95fd213..4eb807e 100644
--- a/src/controller/testsuite/test_ha_election.c
+++ b/src/controller/testsuite/test_ha_election.c
@@ -1001,6 +1001,60 @@ static void test_safe_commit_reflects_granting_voter_lsn(void)
     printf("test_safe_commit_reflects_granting_voter_lsn: PASS\n");
 }
 
+/* ── bug-1060: a new leader must NEVER truncate its own committed entries ─────
+ *
+ * Leader Completeness (Raft §5.4): a server that wins an election must already
+ * hold every entry committed by a prior leader, and it must never truncate its
+ * own log to "catch down" to a slower majority.
+ *
+ * Production root cause (bug-1060): raft_cb_become_leader truncated its WAL down
+ * to ha_compute_safe_committed_lsn()'s majority-threshold element.  When the new
+ * leader durably holds entries ABOVE that element (it acked them as a standby
+ * under the prior primary — so they were committed), truncating to the majority
+ * element physically destroyed those committed entries and rewound commitIndex.
+ *   e.g. granted voters {self=47, peer=44} → median safe_lsn=44, but self holds
+ *   committed entries 45..47 → truncate(44) deletes 45..47.  The leader then
+ *   wrote its leadership NOP at LSN 45 (term+1) while the diverged peers still
+ *   held the old job at LSN 45 → permanent prevote deadlock + committed-job loss.
+ *
+ * Invariant under test: the promotion truncation floor is clamped to the new
+ * leader's own durable tip, so persist_truncate_wal_above is a no-op on the
+ * leader's durable log.  safe_lsn only governs removal of entries STRICTLY ABOVE
+ * the leader's durable tip (non-durable, divergent tail).
+ *
+ * RED before the fix: ha_promotion_truncate_floor does not exist (undefined
+ * reference).
+ */
+static void test_promotion_never_truncates_own_committed_entries(void)
+{
+    /* The bug-1060 case: majority element (44) is BELOW the leader's own durable
+     * tip (47).  The truncation floor must clamp UP to the durable tip so the
+     * leader's committed entries 45..47 are never cut. */
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(
+        47ULL, ha_promotion_truncate_floor(/*safe_lsn=*/44ULL, /*durable_tip=*/47ULL),
+        "truncation floor must never fall below the leader's own durable tip "
+        "(Leader Completeness: a new leader never truncates its own committed log)");
+
+    /* Equal: floor stays at the durable tip (no truncation). */
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(
+        47ULL, ha_promotion_truncate_floor(47ULL, 47ULL),
+        "equal safe_lsn and durable tip → floor at the tip (no-op truncation)");
+
+    /* safe_lsn ABOVE the durable tip: only a divergent tail strictly above the
+     * leader's durable log can be removed — safe_lsn governs there. */
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(
+        50ULL, ha_promotion_truncate_floor(50ULL, 47ULL),
+        "when safe_lsn exceeds the durable tip, the floor follows safe_lsn "
+        "(removes only the non-durable divergent tail above the leader's log)");
+
+    /* Single-node / fresh boot: durable tip 0 → floor follows safe_lsn. */
+    TEST_ASSERT_EQUAL_UINT64_MESSAGE(
+        0ULL, ha_promotion_truncate_floor(0ULL, 0ULL),
+        "empty log: floor 0 (nothing to truncate)");
+
+    printf("test_promotion_never_truncates_own_committed_entries: PASS\n");
+}
+
 /* ── Test suite entry point ───────────────────────────────────────────────── */
 
 void test_ha_election(void)
@@ -1059,4 +1113,7 @@ void test_ha_election(void)
 
     /* bug-828 — safe-commit-from-votes must reflect the granting voter LSN */
     RUN_TEST(test_safe_commit_reflects_granting_voter_lsn);
+
+    /* bug-1060 — a new leader must never truncate its own committed entries */
+    RUN_TEST(test_promotion_never_truncates_own_committed_entries);
 }
diff --git a/src/controller/testsuite/test_persist_recovery.c b/src/controller/testsuite/test_persist_recovery.c
index c6b1874..4c8d23d 100644
--- a/src/controller/testsuite/test_persist_recovery.c
+++ b/src/controller/testsuite/test_persist_recovery.c
@@ -309,6 +309,75 @@ static void test_recovered_member_advertises_real_applied_lsn(void)
     printf("test_recovered_member_advertises_real_applied_lsn: PASS\n");
 }
 
+/* ------------------------------------------------------------------ */
+/* bug-1042: after recovery, the raft LIBRARY's log_len/commit_index   */
+/* must be raised to the recovered position. ha_init_raft runs BEFORE  */
+/* persist_recover on a standby-rejoin boot, leaving the library at    */
+/* log_len=0; without ha_sync_raft_log_from_recovery the library then  */
+/* rejects every AppendEntries (logOk fail for prevLogIndex>=1) and    */
+/* the rejoined member never converges.                                */
+/* ------------------------------------------------------------------ */
+static void test_recovered_member_syncs_raft_log_len(void)
+{
+    char tmp[256];
+    strcpy(tmp, "/tmp/xce_rec1042_XXXXXX");
+    TEST_ASSERT_NOT_NULL(mkdtemp(tmp));
+
+    /* Phase 1: write WAL entries, flush, stop. */
+    {
+        persist_t* p = make_fresh_persist(tmp);
+        TEST_ASSERT_NOT_NULL(p);
+        for (int i = 0; i < 5; i++)
+            TEST_ASSERT_EQUAL_INT(0,
+                persist_wal_async(p, WAL_JOB_UPDATE, "z", 1));
+        TEST_ASSERT_EQUAL_INT(0, persist_flush(p));
+        teardown_persist(p);
+    }
+
+    /* Phase 2: restart — recover the WAL, then mimic the init-ordering hazard:
+     * the raft library was init'd with log_len=0 BEFORE recovery ran. The sync
+     * must raise the library's log_len to the recovered durable tip. */
+    {
+        persist_t* p2 = make_fresh_persist(tmp);
+        TEST_ASSERT_NOT_NULL(p2);
+        TEST_ASSERT_EQUAL_INT(0, persist_recover(p2));
+
+        uint64_t recovered_floor = persist_durable_floor(p2);
+        TEST_ASSERT_TRUE(recovered_floor > 0);
+
+        ha_state_t ha;
+        memset(&ha, 0, sizeof(ha));
+        /* Library came up empty (ha_init_raft before recovery). */
+        ha.raft.log_len      = 0;
+        ha.raft.commit_index = 0;
+        ha.raft.term         = 0;
+        atomic_store_explicit(&ha.term, 4ULL, memory_order_release);
+        /* The helper requires a non-NULL raft_c back-ref (production wiring). */
+        ha.raft_c = (cluster_t*)0x1; /* non-NULL sentinel; helper never derefs it */
+
+        ha_sync_raft_log_from_recovery(&ha, p2);
+
+        /* The bug: log_len used to stay 0 → logOk rejects every AppendEntries. */
+        TEST_ASSERT_EQUAL_UINT64(recovered_floor, ha.raft.log_len);
+        /* commit_index advanced to the durable floor, clamped to log_len. */
+        TEST_ASSERT_EQUAL_UINT64(recovered_floor, ha.raft.commit_index);
+        TEST_ASSERT_TRUE(ha.raft.commit_index <= ha.raft.log_len);
+        /* term aligned to the persisted/restored HA term. */
+        TEST_ASSERT_EQUAL_UINT64(4ULL, ha.raft.term);
+
+        /* Monotonic: never lowers an already-higher library position. */
+        ha.raft.log_len      = recovered_floor + 100;
+        ha.raft.commit_index = recovered_floor + 50;
+        ha_sync_raft_log_from_recovery(&ha, p2);
+        TEST_ASSERT_EQUAL_UINT64(recovered_floor + 100, ha.raft.log_len);
+        TEST_ASSERT_EQUAL_UINT64(recovered_floor + 50, ha.raft.commit_index);
+
+        teardown_persist(p2);
+    }
+
+    printf("test_recovered_member_syncs_raft_log_len: PASS\n");
+}
+
 void test_persist_recovery(void)
 {
     RUN_TEST(test_recover_from_empty_state);
@@ -317,4 +386,5 @@ void test_persist_recovery(void)
     RUN_TEST(test_recover_rejects_corrupt_snapshot);
     RUN_TEST(test_recover_picks_latest_snapshot);
     RUN_TEST(test_recovered_member_advertises_real_applied_lsn);
+    RUN_TEST(test_recovered_member_syncs_raft_log_len);
 }
diff --git a/src/controller/testsuite/test_term_safety_adapter.c b/src/controller/testsuite/test_term_safety_adapter.c
index 1d26d4e..4529868 100644
--- a/src/controller/testsuite/test_term_safety_adapter.c
+++ b/src/controller/testsuite/test_term_safety_adapter.c
@@ -1529,6 +1529,141 @@ static void test_catchup_applied_lsn_is_last_held_no_skip(void)
     printf("test_catchup_applied_lsn_is_last_held_no_skip: PASS\n");
 }
 
+/* ================================================================== */
+/* bug-1067 — cross-term catch-up: the AppendEntries header term is the  */
+/*            leader's CURRENT term, NOT the streamed entry's stored term */
+/* ================================================================== */
+
+/* Root cause: ha_consume_append_entries used the entry's stored term (entry_term)
+ * as the AppendEntries header term. For LIVE appends that is the leader's current
+ * term (leader appends at its term), but for CATCH-UP streaming of HISTORICAL
+ * entries written by a PRIOR leader, entry_term < the current leader's term. The
+ * library's stale-term check (term < s->term → ae_reject_stale) then permanently
+ * rejected every historical entry, so the lagging standby could never catch up
+ * (standby_reported_lsn never advanced; the streamer retransmitted forever).
+ *
+ * The fix carries the leader's current term out-of-band per entry
+ * (wal_catchup_entry_t.leader_current_term, WalCatchupEntry.leaderCurrentTerm @8),
+ * set by the streamer to ha->term, and uses THAT as the AE header term while the
+ * entry's stored term remains the per-entry term for logOk / on_persist_entry.
+ *
+ * RED before the fix: the leader_current_term field does not exist (compile
+ * error); once added but before the receiver reads it, ae_term == entry_term (4) <
+ * s->term (5) → stale-reject → LSN 2 never persists. */
+static void test_intake_crossterm_catchup_uses_leader_current_term(void)
+{
+    char tmp[256];
+    strcpy(tmp, "/tmp/xce_ts_xterm_catchup_XXXXXX");
+    TEST_ASSERT_NOT_NULL(mkdtemp(tmp));
+
+    cluster_t* c = make_cluster(tmp);
+    TEST_ASSERT_NOT_NULL(c);
+    /* Standby has already adopted the current leader's term (5) from heartbeats. */
+    make_follower(c, /*term*/5, /*n_peers*/3);
+
+    /* Local log holds a HISTORICAL entry LSN1@term4 (written by the prior leader
+     * at term 4, replicated to this standby). */
+    uint8_t blob[64];
+    size_t n = pack_entry(blob, WAL_JOB_SUBMIT, "a", 1);
+    TEST_ASSERT_EQUAL_INT(0, ha_cb_persist_entry_for_test(&c->ha, 1, 4, blob, n));
+    c->ha.raft.log_len = 1;
+    TEST_ASSERT_EQUAL_UINT64(4, persist_entry_term(&c->persist, 1));
+
+    /* The CURRENT leader (term 5) streams the historical entry LSN2@term4 as a
+     * catch-up sub-entry: the entry's STORED term is 4, but the AppendEntries
+     * header term is the leader's CURRENT term 5 (leader_current_term). prev tuple
+     * (1,4) matches the local log so logOk holds. */
+    uint8_t lpay[1] = { 'b' };
+    wal_catchup_entry_t sub;
+    memset(&sub, 0, sizeof(sub));
+    sub.lsn                = 2;
+    sub.entry_type         = WAL_JOB_SUBMIT;
+    sub.term               = 4;   /* the entry's STORED term (prior leader)      */
+    sub.leader_current_term = 5;  /* the streaming leader's CURRENT term         */
+    sub.prev_log_index     = 1;
+    sub.prev_log_term      = 4;
+    sub.raw_payload        = lpay;
+    sub.raw_payload_len    = sizeof(lpay);
+
+    wal_catchup_entry_t* sub_arr[1] = { &sub };
+    wal_catchup_entry_t batch;
+    memset(&batch, 0, sizeof(batch));
+    batch.n_entries           = 1;
+    batch.entries             = sub_arr;
+    batch.term                = 4;
+    batch.leader_current_term = 5;
+    batch.prev_log_index      = 1;
+    batch.prev_log_term       = 4;
+
+    int rc = ha_apply_wal_catchup_entry(&c->ha, &c->persist, &batch, /*ep*/NULL, c);
+    TEST_ASSERT_EQUAL_INT(0, rc);
+
+    /* THE bug-1067 assertion: the historical entry is ACCEPTED (not stale-rejected)
+     * and persisted at its stored term 4. Pre-fix it was rejected (absent). */
+    TEST_ASSERT_EQUAL_UINT64(4, persist_entry_term(&c->persist, 2));
+    /* The agreed prefix (LSN1@term4) is untouched. */
+    TEST_ASSERT_EQUAL_UINT64(4, persist_entry_term(&c->persist, 1));
+    /* The leader's current term (5) equals our term — no spurious term change. */
+    TEST_ASSERT_EQUAL_UINT64(5, c->ha.raft.term);
+
+    teardown_cluster(c);
+    printf("test_intake_crossterm_catchup_uses_leader_current_term: PASS\n");
+}
+
+/* Safety guard: a GENUINELY stale leader (leader_current_term < our term) must
+ * STILL be rejected — the fix must not open a hole letting a deposed leader's
+ * divergent entries through. */
+static void test_intake_stale_leader_term_still_rejected(void)
+{
+    char tmp[256];
+    strcpy(tmp, "/tmp/xce_ts_stale_leader_XXXXXX");
+    TEST_ASSERT_NOT_NULL(mkdtemp(tmp));
+
+    cluster_t* c = make_cluster(tmp);
+    TEST_ASSERT_NOT_NULL(c);
+    make_follower(c, /*term*/5, /*n_peers*/3);
+
+    uint8_t blob[64];
+    size_t n = pack_entry(blob, WAL_JOB_SUBMIT, "a", 1);
+    TEST_ASSERT_EQUAL_INT(0, ha_cb_persist_entry_for_test(&c->ha, 1, 4, blob, n));
+    c->ha.raft.log_len = 1;
+
+    /* A deposed leader at term 3 (< our term 5) tries to stream. Even though the
+     * entry's stored term and prev tuple look locally plausible, the AE header
+     * term (leader_current_term=3) is stale → reject. */
+    uint8_t lpay[1] = { 'z' };
+    wal_catchup_entry_t sub;
+    memset(&sub, 0, sizeof(sub));
+    sub.lsn                 = 2;
+    sub.entry_type          = WAL_JOB_SUBMIT;
+    sub.term                = 3;
+    sub.leader_current_term = 3;   /* STALE leader term < our term 5            */
+    sub.prev_log_index      = 1;
+    sub.prev_log_term       = 4;
+    sub.raw_payload         = lpay;
+    sub.raw_payload_len     = sizeof(lpay);
+
+    wal_catchup_entry_t* sub_arr[1] = { &sub };
+    wal_catchup_entry_t batch;
+    memset(&batch, 0, sizeof(batch));
+    batch.n_entries           = 1;
+    batch.entries             = sub_arr;
+    batch.term                = 3;
+    batch.leader_current_term = 3;
+    batch.prev_log_index      = 1;
+    batch.prev_log_term       = 4;
+
+    int rc = ha_apply_wal_catchup_entry(&c->ha, &c->persist, &batch, /*ep*/NULL, c);
+    TEST_ASSERT_EQUAL_INT(0, rc);
+
+    /* Stale leader's entry was REJECTED — LSN 2 absent, our term unchanged. */
+    TEST_ASSERT_EQUAL_UINT64(0, persist_entry_term(&c->persist, 2));
+    TEST_ASSERT_EQUAL_UINT64(5, c->ha.raft.term);
+
+    teardown_cluster(c);
+    printf("test_intake_stale_leader_term_still_rejected: PASS\n");
+}
+
 /* ================================================================== */
 /* Task 3.3 — drive raft_on_append_entries_reply + raft_advance_commit */
 /* on the replication ACK path                                         */
@@ -2065,6 +2200,8 @@ void test_term_safety_adapter(void)
     RUN_TEST(test_intake_logmismatch_rejected_no_false_convergence);
     RUN_TEST(test_live_broadcast_receive_persists_leader_term);
     RUN_TEST(test_catchup_applied_lsn_is_last_held_no_skip);
+    RUN_TEST(test_intake_crossterm_catchup_uses_leader_current_term);
+    RUN_TEST(test_intake_stale_leader_term_still_rejected);
     RUN_TEST(test_repl_ack_currentterm_quorum_advances_commit);
     RUN_TEST(test_repl_ack_priorterm_quorum_holds_commit);
     RUN_TEST(test_repl_ack_staleterm_reply_dropped);
diff --git a/src/controller/testsuite/waldump.c b/src/controller/testsuite/waldump.c
index ce0fcd6..0dbfc05 100644
--- a/src/controller/testsuite/waldump.c
+++ b/src/controller/testsuite/waldump.c
@@ -14,6 +14,7 @@
 
 #include "config.h"           /* WAL_HDR_CRC_SIZE, WAL_CRC_NONE, MAX_WAL_PAYLOAD_BYTES */
 #include "controller.capnp.h" /* Job decode for WAL_JOB_SUBMIT */
+#include "utils.h"            /* fmt_jobid — human-readable JobId formatting */
 #include "wal_types.h"
 
 #define WAL_SEG_FMT "%s/seg-%016" PRIx64 ".wal"
@@ -303,8 +304,9 @@ static void scan_segment(const char* seg_path, FILE* out,
             }
         }
 
-        /* Per-entry line, with jobid/subtime for submits. */
-        char info[96]     = "";
+        /* Per-entry line, with jobid/subtime for submits. Sized to hold the
+         * formatted JobId (fmt_jobid, up to ~40 chars) + subtime + state. */
+        char info[192]    = "";
         int  is_dup       = 0;
         int  dup_identical = 0;
         if (hdr.type == WAL_JOB_SUBMIT) {
@@ -312,9 +314,16 @@ static void scan_segment(const char* seg_path, FILE* out,
             uint64_t      jobid = 0;
             if (decode_submit_info(payload, hdr.payload_len, &si) == 0) {
                 jobid = si.jobid;
+                /* Render the JobId in the same human-readable form the client
+                 * (joblist / jobsub) prints — fmt_jobid (utils.c) — so a waldump
+                 * jobid can be eyeballed against an `expect-job <id>` / joblist
+                 * entry without converting the raw uint64. */
+                char jidStr[128];
+                if (fmt_jobid(jidStr, sizeof(jidStr), si.jobid) < 0)
+                    snprintf(jidStr, sizeof(jidStr), "%" PRIu64, si.jobid);
                 snprintf(info, sizeof(info),
-                         "jobid=%" PRIu64 " subtime=%" PRIu64 " state=%u",
-                         si.jobid, si.subtime, si.state);
+                         "jobid=%s subtime=%" PRIu64 " state=%u",
+                         jidStr, si.subtime, si.state);
             } else {
                 snprintf(info, sizeof(info), "jobid=?");
             }
diff --git a/src/include/typemap.h b/src/include/typemap.h
index 1b759e5..c41e09e 100644
--- a/src/include/typemap.h
+++ b/src/include/typemap.h
@@ -364,6 +364,14 @@ struct wal_catchup_entry {
      * the AppendEntries so the standby intake passes it into
      * raft_on_append_entries_request. Wire field leaderCommit @7. */
     uint64_t                   leader_commit;
+    /* bug-1067: the streaming leader's CURRENT term — the Raft AppendEntries
+     * HEADER term, DISTINCT from `term` above (the entry's STORED term). Equal for
+     * a live append; for a HISTORICAL catch-up entry the stored term is lower than
+     * the leader's current term. The standby intake uses this as the AE header
+     * term (UpdateTerm/stale-check) so cross-term catch-up is not stale-rejected;
+     * 0 = unset (legacy sender) → fall back to the stored term. Wire field
+     * leaderCurrentTerm @8. */
+    uint64_t                   leader_current_term;
 };
 
 /* ── Persistence Cap'n Proto mapped types (P0-9) ─────────────────────
diff --git a/src/lib/client.c b/src/lib/client.c
index d7eb573..63651ae 100644
--- a/src/lib/client.c
+++ b/src/lib/client.c
@@ -123,30 +123,59 @@ int xcecli_try_wakeup(xcecli_ctx_t c, int status)
 
 int xcecli_start(xcecli_ctx_t c)
 {
-    int        rc;
+    int        rc = -ECONNREFUSED;
     api_ctx_t* ctx = (api_ctx_t*)c;
+    int        i;
+    int        connected_idx = -1;
 
     if (c == NULL) {
         return -EINVAL;
     }
 
-    rc = endpoint_connect(&(ctx->ep), ctx->conf->masters[0],
-                          ctx->conf->master_ports[0]);
-    if (rc < 0) {
+    /* Initial connect rotates through ALL configured masters, not just
+     * masters[0] (bug-854 dead-first-master): if the first master is down
+     * (connection-refused after a failover that killed it), a hardcoded
+     * masters[0] connect fails the whole `client` session before the failover
+     * loop — which only runs on an ALREADY-connected ctx — ever gets a chance
+     * to rotate. Try each master in order; the first that connects becomes the
+     * sticky cursor start. The subsequent ctrlstatus/op failover loop then
+     * rotates onward to the authoritative primary as needed.
+     *
+     * ctx->ep was endpoint_init'd + bound to the iomgr in xcecli_init. A failed
+     * endpoint_connect leaves the socket fd unusable, so before retrying the
+     * NEXT master we must rebuild the endpoint exactly as xce_ctx_reconnect
+     * does: endpoint_fini → endpoint_init (fresh fd) → re-set peer + re-bind the
+     * iomgr (endpoint_connect needs ep->iomgr->ssl_ctx). */
+    for (i = 0; i < ctx->conf->nmasters; i++) {
+        if (i > 0) {
+            endpoint_fini(&(ctx->ep));
+            if (endpoint_init(&(ctx->ep), AF_INET, SOCK_STREAM, 0, 0) < 0)
+                continue;
+            endpoint_set_peer(&(ctx->ep), &(ctx->ctx.myinfo));
+            ctx->ep.iomgr = &(ctx->ctx.iomgr);
+        }
+        rc = endpoint_connect(&(ctx->ep), ctx->conf->masters[i],
+                              ctx->conf->master_ports[i]);
+        if (rc >= 0) {
+            connected_idx = i;
+            break;
+        }
+    }
+    if (connected_idx < 0) {
+        /* No master reachable at all — surface the last transport error. */
         endpoint_fini(&(ctx->ep));
         return rc;
     }
 
-    /* Initialize per-context failover state: sticky primary starts at
-     * masters[0] (the initial connect target above), retry tunables default
-     * to XCE_RETRY_DEFAULTS, and no rejoin hook is installed for pure clients.
-     */
+    /* Initialize per-context failover state: sticky primary starts at the master
+     * we actually connected to (not always index 0), retry tunables default to
+     * XCE_RETRY_DEFAULTS, and no rejoin hook is installed for pure clients. */
     rc = mylock_init(&(ctx->failover.lock));
     if (rc < 0) {
         endpoint_fini(&(ctx->ep));
         return rc;
     }
-    ctx->failover.cur_master = 0;
+    ctx->failover.cur_master = connected_idx;
     ctx->failover.retry      = XCE_RETRY_DEFAULTS;
     ctx->failover.rejoin_cb  = NULL;
     ctx->failover.rejoin_arg = NULL;
@@ -414,11 +443,17 @@ int xcecli_ctrlstatus_primary(xcecli_ctx_t c, xce_ctrlstatus_t** status)
 
     /* Bound the redirect loop by the configured failover retry budget so we
      * never spin unbounded chasing a never-appearing primary (each inner
-     * xcecli_ctrlstatus already runs its own full reach-some-node failover). */
+     * xcecli_ctrlstatus already runs its own full reach-some-node failover).
+     * Floor it at the master-ring size so a standby-first / dead-first master
+     * list is always traversable in full before giving up (bug-854): one extra
+     * attempt lets the rotation that lands on the primary actually query it. */
     max_attempts = ctx->failover.retry.max_retries;
     if (max_attempts < 1) {
         max_attempts = 1;
     }
+    if (ctx->conf != NULL && ctx->conf->nmasters + 1 > max_attempts) {
+        max_attempts = ctx->conf->nmasters + 1;
+    }
 
     for (attempt = 0; attempt < max_attempts; attempt++) {
         hint = NULL;
@@ -436,21 +471,34 @@ int xcecli_ctrlstatus_primary(xcecli_ctx_t c, xce_ctrlstatus_t** status)
             return 0;
         }
 
-        /* Non-authoritative HINT (standby/electing/init). Direct the next query
-         * at the reported primary if we can map it to an address; otherwise let
-         * the next xcecli_ctrlstatus rotate the configured master list. The
-         * redirect hint is consumed one-shot by xce_failover_next_target. */
+        /* Non-authoritative reply (standby/electing/init). The inner
+         * xcecli_ctrlstatus SUCCEEDS against ANY reachable node — ctrlstatus is
+         * answerable in every role — so it classifies the standby's status-0
+         * reply as success and NEVER rotates off it on its own. We must advance
+         * the endpoint here, or the loop re-queries the same non-primary every
+         * attempt and exhausts the budget without ever reaching the primary
+         * (bug-854). Capture a redirect hint when the responder named the primary
+         * (1-hop direct redirect), then FORCE rotation: xce_failover_rotate
+         * consumes the hint when set, else advances to the next configured
+         * master; recover repairs the ctx so the next attempt's send proceeds.
+         * Mirror xcecli_retry_next: only recover when the rotate succeeded — a
+         * failed rotate leaves the ctx for the next inner call's own transport-
+         * error failover to heal. All under failover.lock (the inner call takes
+         * and releases it itself, so it is not held here). */
         {
             char     phost[XCE_MAXHOSTNAME_LEN];
             uint16_t pport = 0;
 
+            mylock_lock(&ctx->failover.lock);
             if (xcecli_ctrlstatus_primary_addr(hint, phost, sizeof(phost),
                                                &pport)
                 == 0) {
-                mylock_lock(&ctx->failover.lock);
                 xce_ctx_capture_redirect_hint(&ctx->ctx, phost, pport);
-                mylock_unlock(&ctx->failover.lock);
             }
+            if (xce_failover_rotate(ctx) == 0) {
+                xcecli_ctx_recover(ctx);
+            }
+            mylock_unlock(&ctx->failover.lock);
         }
 
         /* Free the non-authoritative interim reply before the next attempt — no
diff --git a/src/lib/hook.c b/src/lib/hook.c
index 00d23c2..0d56955 100644
--- a/src/lib/hook.c
+++ b/src/lib/hook.c
@@ -42,20 +42,35 @@ int xce_add_hook(hooksys_t* s, int typ, hook_fn_t fn, void* data)
         return -EINVAL;
     }
 
-    /* Scan for a disabled (NULL-fn) slot of the same type to reuse */
+    /* Single scan of the type's slots:
+     *   - if (fn,data) is ALREADY registered and active, adding again is a
+     *     no-op (idempotent). xce_disable_hook removes only ONE matching slot
+     *     and xce_run_hooks fires ALL slots, so a duplicate (fn,data) would
+     *     fire twice and survive a single disable — the bug-845 double-append
+     *     (persist_start + ha_register_persist_hooks both register the same
+     *     persist_job_hook_fun closure). Dedup is keyed on (fn,data): the same
+     *     fn with a DISTINCT closure stays a legitimate second registration.
+     *   - otherwise remember the first disabled (NULL-fn) slot to reuse. */
     {
-        xlist_t* l = &s->hooks[typ];
-        int      i;
+        xlist_t*     l     = &s->hooks[typ];
+        hook_item_t* reuse = NULL;
+        int          i;
         for (i = 0; i < l->count; i++) {
             hook_item_t* slot = (hook_item_t*)l->data[i];
             if (!slot) continue;
             hook_fn_t cur =
                 atomic_load_explicit(&slot->fn, memory_order_acquire);
             if (cur == NULL) {
-                slot->data = data;
-                atomic_store_explicit(&slot->fn, fn, memory_order_release);
-                return 0;
+                if (!reuse) reuse = slot;
+                continue;
             }
+            if (cur == fn && slot->data == data)
+                return 0; /* already registered — no duplicate */
+        }
+        if (reuse != NULL) {
+            reuse->data = data;
+            atomic_store_explicit(&reuse->fn, fn, memory_order_release);
+            return 0;
         }
     }
 
diff --git a/src/lib/request.c b/src/lib/request.c
index 34d9a09..f8fbe43 100644
--- a/src/lib/request.c
+++ b/src/lib/request.c
@@ -486,6 +486,11 @@ static void wal_entry_to_wire(struct capn_segment *cs,
     w->prevLogIndex = e->prev_log_index;
     w->prevLogTerm  = e->prev_log_term;
     w->leaderCommit = e->leader_commit;
+    /* bug-1067: carry the streaming leader's CURRENT term per sub-entry (distinct
+     * from `term` above, the entry's stored term). The standby intake uses this as
+     * the AppendEntries header term so historical (entry_term < leader_term)
+     * catch-up entries are not stale-rejected. */
+    w->leaderCurrentTerm = e->leader_current_term;
     if (e->raw_payload && e->raw_payload_len > 0) {
         capn_list8 pl = capn_new_list8(cs, (int)e->raw_payload_len);
         capn_setv8(pl, 0, e->raw_payload, (int)e->raw_payload_len);
@@ -539,6 +544,9 @@ int xce_wal_batch_encode_raw(wal_catchup_entry_t **entries, int n_entries,
     top.prevLogIndex  = entries[0]->prev_log_index;
     top.prevLogTerm   = entries[0]->prev_log_term;
     top.leaderCommit  = entries[0]->leader_commit;
+    /* bug-1067: the AppendEntries header term (leader's CURRENT term), distinct
+     * from top.term (entries[0]'s stored term). Mirrors the per-entry field. */
+    top.leaderCurrentTerm = entries[0]->leader_current_term;
 
     /* Batch container: entries list carries the per-entry payload(s) (empty for
      * a heartbeat). Each sub-entry carries lsn/entryType/term/payload. */
diff --git a/src/lib/testsuite/test_hooks.c b/src/lib/testsuite/test_hooks.c
index 14fafe4..75075b8 100644
--- a/src/lib/testsuite/test_hooks.c
+++ b/src/lib/testsuite/test_hooks.c
@@ -100,6 +100,59 @@ static void test_add_hook_reuses_null_slot(void)
     printf("test_add_hook_reuses_null_slot: PASS\n");
 }
 
+/* bug-845: re-registering the SAME (fn,data) on a type must be idempotent.
+ * xce_disable_hook removes only ONE matching slot and xce_run_hooks fires ALL
+ * slots, so a duplicate (fn,data) registration would (a) fire twice and (b)
+ * survive a single disable.  This is exactly how the controller double-appended
+ * every WAL_JOB_SUBMIT: persist_start() and ha_register_persist_hooks() both
+ * register persist_job_hook_fun with the same persist_t closure. */
+static void test_add_hook_dedups_same_fn_and_data(void)
+{
+    hooksys_t hs;
+    int       a = 0;
+
+    TEST_ASSERT_EQUAL_INT(0, xce_hook_init(&hs, 2));
+
+    /* First add registers; the second add with the SAME fn AND data must be a
+     * no-op (still rc=0, still exactly one slot). */
+    TEST_ASSERT_EQUAL_INT(0, xce_add_hook(&hs, HOOK_AFTER_EVENT, counting_fn, &a));
+    TEST_ASSERT_EQUAL_INT(0, xce_add_hook(&hs, HOOK_AFTER_EVENT, counting_fn, &a));
+    TEST_ASSERT_EQUAL_INT(1, hs.hooks[HOOK_AFTER_EVENT].count);
+
+    /* Fires ONCE per event, never twice. */
+    xce_run_hooks(&hs, HOOK_AFTER_EVENT, 0, 0);
+    TEST_ASSERT_EQUAL_INT(1, a);
+
+    /* A single disable fully removes it — no duplicate slot lingers. */
+    TEST_ASSERT_EQUAL_INT(0, xce_disable_hook(&hs, HOOK_AFTER_EVENT, counting_fn));
+    xce_run_hooks(&hs, HOOK_AFTER_EVENT, 0, 0);
+    TEST_ASSERT_EQUAL_INT(1, a); /* unchanged */
+
+    xce_hook_fini(&hs);
+    printf("test_add_hook_dedups_same_fn_and_data: PASS\n");
+}
+
+/* The dedup is keyed on (fn,data): the SAME fn with DISTINCT closures is a
+ * legitimate pair of registrations and BOTH must fire. */
+static void test_add_hook_allows_same_fn_distinct_data(void)
+{
+    hooksys_t hs;
+    int       a = 0, b = 0;
+
+    TEST_ASSERT_EQUAL_INT(0, xce_hook_init(&hs, 2));
+
+    TEST_ASSERT_EQUAL_INT(0, xce_add_hook(&hs, HOOK_AFTER_EVENT, counting_fn, &a));
+    TEST_ASSERT_EQUAL_INT(0, xce_add_hook(&hs, HOOK_AFTER_EVENT, counting_fn, &b));
+    TEST_ASSERT_EQUAL_INT(2, hs.hooks[HOOK_AFTER_EVENT].count);
+
+    xce_run_hooks(&hs, HOOK_AFTER_EVENT, 0, 0);
+    TEST_ASSERT_EQUAL_INT(1, a);
+    TEST_ASSERT_EQUAL_INT(1, b);
+
+    xce_hook_fini(&hs);
+    printf("test_add_hook_allows_same_fn_distinct_data: PASS\n");
+}
+
 /* --- suite entry point --- */
 
 void test_hooks(void)
@@ -109,4 +162,6 @@ void test_hooks(void)
     RUN_TEST(test_disable_hook_stops_invocation);
     RUN_TEST(test_disable_hook_returns_enoent_if_not_found);
     RUN_TEST(test_add_hook_reuses_null_slot);
+    RUN_TEST(test_add_hook_dedups_same_fn_and_data);
+    RUN_TEST(test_add_hook_allows_same_fn_distinct_data);
 }
diff --git a/src/lib/testsuite/test_wal_wire.c b/src/lib/testsuite/test_wal_wire.c
index 2a0adc8..9ac6943 100644
--- a/src/lib/testsuite/test_wal_wire.c
+++ b/src/lib/testsuite/test_wal_wire.c
@@ -191,8 +191,11 @@ static void test_wal_batch_encode_rejects_invalid_args(void)
 
     TEST_ASSERT_EQUAL_INT(-EINVAL,
         xce_wal_batch_encode_raw(NULL, 1, &test_peer, 0, &pkt));
+    /* n_entries == 0 is a valid heartbeat (ha-term-safety task 3.2): a 0-entry AE
+     * carries the AppendEntries metadata (term, prev tuple, leader_commit) on the
+     * top-level container to drive UpdateTerm/logOk. Only n_entries < 0 is invalid. */
     TEST_ASSERT_EQUAL_INT(-EINVAL,
-        xce_wal_batch_encode_raw(entries, 0, &test_peer, 0, &pkt));
+        xce_wal_batch_encode_raw(entries, -1, &test_peer, 0, &pkt));
     TEST_ASSERT_EQUAL_INT(-EINVAL,
         xce_wal_batch_encode_raw(entries, 1, &test_peer, 0, NULL));
 
diff --git a/src/lib/xcectx.c b/src/lib/xcectx.c
index 1af032c..c46bcb5 100644
--- a/src/lib/xcectx.c
+++ b/src/lib/xcectx.c
@@ -7,6 +7,7 @@
 #include "netio.h"
 #include "typemap.h"
 #include "utils.h"
+#include "controller.capnp.h" /* free_CtrlStatus_ptr, free_ClusterConf_ptr */
 #include "xcectx.h"
 
 static int handle_get_reply(xce_ctx_t* ctx, xce_reply_t* reply)
@@ -71,6 +72,14 @@ static int handle_reply(xce_ctx_t* ctx, xce_reply_t* reply)
     case OPCode_clusterconf:
         rc = -1;
         if (reply->data_which == RequestReply_data_clusterconf) {
+            /* Free a prior unconsumed reply before storing the new one.
+             * The consumer xce_clusterconf() MOVE_PTRs out, so in the normal
+             * single-request-per-ctx path this is a no-op; on a re-stolen slot
+             * (reply decode on a stale fd after client rotation) it prevents
+             * a permanent heap leak of the prior occupant. */
+            if (ctx->reply.u.clusterconf) {
+                free_ClusterConf_ptr(&ctx->reply.u.clusterconf);
+            }
             MOVE_PTR(ctx->reply.u.clusterconf, reply->data.clusterconf);
             rc = 1;
         }
@@ -78,6 +87,9 @@ static int handle_reply(xce_ctx_t* ctx, xce_reply_t* reply)
     case OPCode_ctrlstatus:
         rc = -1;
         if (reply->data_which == RequestReply_data_ctrlstatus) {
+            if (ctx->reply.u.ctrlstatus) {
+                free_CtrlStatus_ptr(&ctx->reply.u.ctrlstatus);
+            }
             MOVE_PTR(ctx->reply.u.ctrlstatus, reply->data.ctrlstatus);
             rc = 1;
         }
diff --git a/src/schema/controller.capnp b/src/schema/controller.capnp
index cc05816..e753b73 100644
--- a/src/schema/controller.capnp
+++ b/src/schema/controller.capnp
@@ -898,6 +898,17 @@ struct WalCatchupEntry $C.mapname("wal_catchup_entry_t") {
   # the standby intake passes it into raft_on_append_entries_request. Append-only
   # field number (@7) — no collision with the @4/@5/@6 term fields above.
   leaderCommit @7 :UInt64 $C.mapname("leader_commit");
+  # bug-1067: the streaming leader's CURRENT term — the Raft AppendEntries header
+  # term (`term` arg of raft_on_append_entries_request), DISTINCT from `term` @4
+  # which is the entry's STORED term. For a live append the two are equal; for
+  # catch-up of a HISTORICAL entry written by a prior leader, the entry's stored
+  # term is LOWER than the current leader's term. Using the stored term as the AE
+  # header term made the library stale-reject every historical entry
+  # (ae_reject_stale), wedging cross-term catch-up. The standby intake uses this
+  # as the AE header term (UpdateTerm/stale-check) and keeps `term` @4 as the
+  # per-entry term (logOk / on_persist_entry). 0 = unset (legacy sender) → the
+  # intake falls back to the entry's stored term (the prior, live-only behaviour).
+  leaderCurrentTerm @8 :UInt64 $C.mapname("leader_current_term");
 }
 
 struct CtrlHelloRequest $C.mapname("ctrl_hello_req_t") {