The degraded-data summary assigns from a command substitution, and the step
runs under `bash -e`, where that construct propagates failure. A jq error while
reading fetch-status.json would therefore have killed the step at exit 2 -
immediately before the one line that says the context is incomplete, and after
everything else had already been written.

Verified both ways against the extracted block: with the guard the step exits 0
and prints the summary, without it the step exits 2.

The two aggregates (annotations, pr-comments) marked themselves `partial` as
soon as one per-item call failed, which also caught the case where every call
failed and nothing came back at all.

That distinction decides what the agent does. `partial` says the file is usable
but incomplete, so the agent reads it; `failed` says the file is a placeholder,
so the agent does not. Reporting `partial` over an aggregate that received
nothing therefore points the agent at an empty file it has been told to trust -
the same absent-versus-empty confusion the ledger exists to remove.

Counting attempts and failures separately gives the three-way rule: none failed
is `ok`, all failed is `failed`, anything between is `partial`. Zero failures
over zero attempts stays `ok`, because a run with no failed jobs genuinely has
no annotations.

Four new test functions cover the rule and the gaps around it: an aggregate
where every call fails, one where a pr-comments call fails, a run with no
failed jobs, and a fetch that exits 0 with a body jq cannot parse.

Six review dimensions ran over the previous commits. The substantive findings,
and what each one cost:

The prompt tested ledger entries by file name (`run.json`) while the ledger is
keyed without the extension (`run`). Every such lookup returns null, null is
not usable, and the prompt's own rule then discards a perfectly healthy datum -
the original bug in mirror image. The keys are now stated explicitly and a test
fails on any file name used as the subject of a ledger predicate.

`gh api` writes the HTTP error body to stdout before it checks the status code,
and the aggregate loop appended stdout straight to the merge input. One 404
therefore pushed {"message":"Not Found"} in beside the arrays, `jq -s add`
refused to add an object to an array, and the merge failed - discarding the
annotations that DID arrive and grading the datum `failed`. That is the exact
data loss `partial` exists to prevent, and the old test passed only because the
stub was kinder than GitHub. Each response is now buffered and merged only
after it parses.

Neither aggregate passed `--paginate`, so a run with more than thirty failing
tests was graded `complete: true` over a truncated first page - a false
completeness claim, which is the class of defect this ledger exists to remove.

`partial` carried a definition and no action rule, so the blanket
"not ok means absent" rule discarded partial aggregates the step had gone out
of its way to preserve. The ledger now derives `usable` and `complete` per
datum, and the prompt branches on those two booleans rather than mapping a
four-value enum to an action.

Step 1 offered "infrastructure failure -> no-fix" as the only one-hop exit, and
a blank context looks exactly like one from the agent's seat. That inference is
now prohibited by name, with a fifth category and an investigation path that
terminates in a stated sentinel status.

Step 0c told the agent to hunt for a rival fix branch and then keep
`existing_pr` as null. Committing onto that branch makes the publish step push
successfully and then fail opening a second PR for the same head, reporting a
red job for a fix that shipped. The instruction now takes the fresh-branch path
and reports the suspicion instead.

`/tmp/fix-agent-summary.md` was a bare name on a persistent runner, so an agent
that crashed before writing left the previous run's summary to be reported as
this one's. It moves to the job-scoped result directory.

Also: the ledger's own build failure is now loud rather than a silent `{}`; id
enumeration failures no longer grade an empty aggregate `ok`; all-failed
aggregates report `failed` rather than `partial`; fetch errors are scrubbed of
CR and query strings, so remote error text cannot forge a workflow command or
echo a signed blob URL; a non-numeric run id fails up front; a sentinel naming
`develop` or `main` is refused before the push; and the context directory is
purged rather than merely created.

The suite grows to 28 test functions. It now executes the prerequisite step
too, rather than pattern-matching its text, and pins what is fetched - run id,
repo, endpoints, paging - not only how the result is graded. Six mutations that
previously survived are now caught, including a wrong run id, a wrong
repository, and reverting the buffering fix. Folded into the required CI Status
gate, because a path-filtered advisory workflow cannot block a merge and this
repo has already been bitten by exactly that.

`gh api --paginate` concatenates one JSON array per page on stdout, so a
buffered item body can hold several top-level arrays. Both the per-item parse
check and the merge already handle that, but nothing proved it, and paging was
added specifically to stop a truncated first page being graded `complete`. A
regression there would trade one silent truncation for another.

The publish step pushes the sentinel's branch with an App token carrying
contents: write, and it pushes before it opens the pull request, so a bad
branch value lands even when PR creation then fails. The existing validation
checks only the character set, which accepts `develop` and `main`.

That matters because much of what the agent reads is text any GitHub user can
write: PR titles, PR bodies and issue comments all reach it through
existing-fix-prs.json and pr-comments.json. An injected claim that the fix
branch for this failure is `develop` should not be able to turn a fix into a
direct push that bypasses review and every CI gate.

Both branch names are now refused before the push. Tests cover the gate's whole
input surface - missing sentinel, unknown status, shell metacharacters in the
branch, empty branch, non-numeric PR number, and an embedded newline - since
this is the step that decides whether a write-scoped token gets used at all.

The status ledger is accumulated as tab-separated key/status/reason rows, so a
TAB in remote error text adds a field and a NEWLINE adds a row. Removing the
scrub proves the consequence rather than implying it: the ledger comes back
missing keys, and a forged `run<TAB>ok` row relabels a failed fetch as a
healthy one - a GitHub error message rewriting the very record that says
whether GitHub answered.

`tr -c '[:print:]' ' '` already handled it, because TAB is not in `[:print:]`,
but nothing said so and nothing would have noticed its removal. Two mutations
are now caught: dropping the control-character squeeze (9 checks) and dropping
the query-string strip that keeps signed blob URLs out of the log (3 checks).

Four dimensions re-reviewed the fixes and found more in them. The substantive
ones:

`jq -e` takes its exit status from its LAST output and emits one output per
input, so the per-item parse check graded only the final page of a `--paginate`
response. An earlier page that was valid JSON of the wrong type passed the
check and was then dropped by the merge's type filter, publishing
`complete: true` over data that never made it - the same false-completeness
claim one level down from the bug this all started with. A single error object
with gh exiting 0 read as "this job genuinely has no annotations". Slurping and
requiring every page to be an array fixes all three shapes, which are now
pinned as scenarios.

`gh pr list --limit 50` gave no signal when it truncated, and a truncated list
graded complete would let the agent open a second fix PR over one it never saw.
A list returned at exactly the limit is now `partial`.

Step 8's PR menu still offered the branch choice Step 0c now forbids, and it
was the only line pairing with `FIX_READY_POSSIBLE_DUPLICATE` - so the status
pointed the agent back at the path that makes the publish step push
successfully and then fail opening a second PR.

Three of the review gate's selectable agents do not exist under those names:
`.claude/agents/` has `review-bugs` and `review-concurrency` rather than a
combined `review-bugs-concurrency`, and `review-test-quality` covers what the
table called `review-test-behavior` and `review-test-completeness`. An agent
following that table asks for names the Agent tool cannot resolve, and the
dimension is silently skipped while the gate reports itself satisfied. I hit
this myself running the gate on this change. A test now fails on any name with
no file behind it.

The /tmp cleanup step ran before the two Zulip steps, so the files those write
were never removed. It moves to the end of the job and covers them.

`uuidgen` lives in uuid-runtime, which is not essential on the image that was
already missing jq and gh; under `bash -e` a failing substitution in an
assignment would have killed the run at the starting gun. Replaced with `$$`.

Every GitHub read is now wrapped in `timeout 120`. Each failure this step
handles is a fast error, so an unbounded call that stalls would consume the
whole 12-hour job budget and publish no ledger at all; bounded, the grading
records it as failed and the agent still gets a usable partial context.

Also: the publish step consumes the branch and PR number the gate validated
instead of re-reading them raw from the sentinel; an empty pr_title is
defaulted rather than left to fail `gh pr create` after the push has landed; a
non-fast-forward push rebases once and retries rather than losing a fix to a
race; the write-up is posted as a comment on the existing-PR path, where
pr-body.md was previously never read; and the gate-diagnosis fallback chain
terminates instead of demanding numbers the agent cannot get.

Step 0 was rewritten rather than patched: two reviewers independently found it
at four times the section cap with the usable/complete rule stated four times.
It is now three labelled units, the flag semantics appear once as the decision
table, and the top-level `complete` and `degraded` fields the agent's first
command prints are defined - `degraded` includes the usable `partial` data, so
the previous silence there invited discarding a datum the table says to use.

The suite reaches 37 test functions and now runs shellcheck at `info` over all
four extracted shell blocks, closing the gap where 350 lines of shell inside
YAML were invisible to every linter.

The non-numeric id guard in the aggregate loop reached `continue` before
`tried` was incremented, so a skipped id left no trace in the failed/tried
arithmetic. `failed -eq 0` then took the zero-over-zero branch that exists for
a run with genuinely no failed jobs, and a run whose ids were all non-numeric
published an empty file as `ok` and `complete: true`. That is the original
bug's shape one level down: the agent told "GitHub has no annotations" about
jobs the step declined to ask about. A skipped id now counts as a failure.

The prompt also still made a data file the subject of a ledger predicate in two
places -- "`logs.txt` can be `ok`", "`run.json`'s `event` ... when that datum is
usable" -- where the keys are `logs` and `run`. The check meant to catch that
was matching a fixed set of English phrasings, so it caught one drift in twelve
and missed both of these. It is now a proximity rule: no bare data-file name on
a line that also mentions the ledger, with two named exemptions.

Three pieces of hardening had no coverage and now do. `timeout` writes nothing
to stderr when it fires, so a timed-out fetch recorded a failure with an empty
reason and logged "Fetch 'logs' failed:" with nothing after the colon -- the
defect the aggregate path already calls out, reintroduced by the timeout
wrapper itself. A `hanging_logs` scenario drives the expiry path, which needed
the budgets to be env-overridable. A `long_error` scenario pins the 300-byte
cap, without which a whole HTML error page would land in the file the agent
reads first.

`realistic_api_404` existed but nothing asserted the property it was built for,
so reverting the response buffering left the suite green. It is now asserted
directly, including that gh's error body reaches no data file while the
ledger's reason may still quote its message.

Also: the log fetch and the paginated aggregates get a 600-second budget rather
than 120, because both are bulk transfers and `logs` is the most valuable datum
to lose to a premature kill; the open-PR limit rises to 200 and is declared
once, so the truncation guard cannot drift from it; the Zulip POST is bounded,
since it now sits above the cleanup step and a stall there would cancel the
cleanup rather than run it; a redacted query string leaves a `?<redacted>`
marker instead of vanishing; and the sentinel gate asserts its own exit status
on every input, since it runs `if: always()` and is the only path to publishing.

41 test functions, ~10s. Four more mutations verified caught.

Each of these guards my own new code, and each was verified only by reading it.

The two `|| true`s on the apt calls are documented as load-bearing: without
them a failing apt aborts the step at apt's own exit status, with a dpkg-lock
message and no statement of which tool is missing or why it matters. The stub
apt now takes an exit status, so the guarded path is exercised rather than
asserted.

The context directory is purged rather than only created, because $RUNNER_TEMP
persists across jobs on the self-hosted pool and a file an earlier version of
this step left there is indistinguishable to the agent from this run's input.
A scenario now pre-seeds the directory.

`missing_from_ledger` and its `::error::` existed for a code path that forgets
to `record`, and nothing had ever produced one. A jq wrapper drops a row from
the status TSV on its way into the ledger builder, so the self-check is
exercised on the only input that can trigger it.

44 test functions. All three mutations verified caught.