docs(skills): promote the 2026-08 run's lessons into the skills that own them

[JArmandoAnaya]

The 2026-08 audit remediation run (T1–T10, PRs #304–#313) accumulated eight lessons and a "found, not fixed" list in run-log.tmp.md — a gitignored, local-only file. This moves the durable knowledge to its strategic homes and deletes the ephemeral reports. Docs and issues only; no application code.

The three durable homes: skills for rules, issues for open work, git history / PR bodies for what happened (already there — each of #304–#313 carries its findings, decisions and test plan).

Lessons → skills

Each lands in exactly one skill, distilled to the rule, in that skill's voice, provenance-tagged.

#	Lesson	Skill	Section
3	A declaration is a cached answer — invalidate the resource's own query, not just its counts	ui-capabilities	Required patterns
1	check.sh runs no browser suite; the real-server cycle run was 3× the only detector	refactor-protocol	Testing requirements
2	reuseExistingServer: !CI — always CI=1 locally	refactor-protocol	Testing requirements (folded into the same rule)
6	Gates read git ls-files; untracked files are invisible	refactor-protocol	Testing requirements
8	Test doubles must not encode invisible-order or frozen-state semantics	refactor-protocol	Testing requirements
5	tsconfig.build.json excludes tests — a green build is not a green typecheck	nodejs-setup	Before you say it works
4	A new wire field is not additive: three mirrors move together	annotator-core	new section, before the boundary gates
7	A method named after a builtin shadows it for later annotations	python-setup	Typing

Frontmatter, auto_invoke and allowed-tools untouched in all five files; additions only (+46 lines, 0 deletions).

One clause beyond the eight, and why

While filing Part C I found that #281 had been auto-closed in error. #312's squash commit message contained the sentence "Nothing here closes #281" — GitHub parses a closing keyword regardless of the words around it. Nothing about #281 was implemented.

I reopened it, said so in the comment, and added a one-clause extension to refactor-protocol's existing "Closes #NNN only for issues actually and fully closed" rule. That rule already existed; what was missing is that its negation also fires it. Flagging it here because it is a ninth item on a task that specified eight — it is an extension of a rule already in the skill, and a live defect I caused rather than a lesson I chose.

Issues touched and created

Issue	Action
#281	Reopened (auto-closed in error), commented, milestoned 0.1.0. edit_membership is now the last declared capability with no wire surface — the shape F24 had. Recommended as the next implementation task, with the suggested route shape.
#314	New — check.sh runs no browser suite; proposal to run all three or announce loudly when skipping, plus documenting CI=1. Labels: tooling, ci. Milestone 0.1.0.
#315	New — G5 trunk supersession, stated in T8's vocabulary ("which annotation does the trunk project?"), with T10's concrete trigger (a correction batch starts unannotated) and F14 named as the adjacent policy. Labels: deferred-needs-input, kernel.
#316	New — Dataset screen has no remove-asset control though DELETE /datasets/{id}/assets/{id} exists. Labels: ui-core, frontend. Milestone 0.1.0.
#317	New — IngestFailure.name leaks a full server path for directory ingests. Labels: kernel, api. Milestone 0.1.0.

A tooling label was created (it did not exist); everything else used existing labels.

Each issue body is self-contained — the ledger and the audit report are gone, so none of them depends on a dead file.

Deleted

run-log.tmp.md and repost-2.tmp.md, from the working tree only (both gitignored — not a commit). repost-2.tmp.md was already absent before this task began.

No archive document created. No docs/audits/, no copied report. Before deleting I cross-checked the ledger's two remaining sections:

• "Decisions worth a human's review" (5 items) — all five are in the merged PR bodies: T7's hasReleases deviation (IA restructure: Dataset is a tab, Schema history nests, Overview is a dashboard #310), T3's Accept gate (The annotator opens as a viewer when nothing can be written (F2, F23) #306), T8's job_id on update (Correction-batch prerequisites: batch lineage and annotation provenance (G3, G4) #311), T10's dropped filtered-set scope (Correction-batch UI: the end of the forward-only story (G6) #313), T9 not closing api: batch membership editing is not on the wire, and the gallery is now the caller #29 was waiting for #281 (Correction-batch surfaces: creation, corrections, and asset→batches (G1, G2, G7) #312).
• "Found, not fixed" (6 items) — edit_membership → api: batch membership editing is not on the wire, and the gallery is now the caller #29 was waiting for #281; G5 and its correction-batch trigger → kernel: trunk supersession — which annotation does the dataset project when a correction re-annotates a promoted asset? (G5) #315; remove-asset control → ui-core: the Dataset screen cannot remove an asset from the trunk, though the route exists #316; IngestFailure.name → kernel: IngestFailure.name leaks a full server path for a directory ingest #317; F14 → named inside kernel: trunk supersession — which annotation does the dataset project when a correction re-annotates a promoted asset? (G5) #315; the rail/dataset-entry note → deliberately dropped per the task, since the IA rule ("≤1 click from any project tab") is satisfied by the tab IA restructure: Dataset is a tab, Schema history nests, Overview is a dashboard #310 added.

Nothing durable existed only in the ledger.

Found, not fixed

• api: batch membership editing is not on the wire, and the gallery is now the caller #29 was waiting for #281 was closed for ~2 hours by my own commit message. Reopened; the mechanism is now a rule. No other issue was affected — the timeline shows one closed event across the run.

Test plan

Docs-only, so the browser suites are not applicable under the rule this PR itself adds ("mandatory for anything touching state, gating, or progress" — this touches none):

• pnpm test:scripts — 33 pass, 0 fail (the node gates over tests/scripts/, which include the design-token and boundary checks that read tracked files).
• bash scripts/check.sh generated — green (openapi drift, generated-client drift, MCP tool reference drift, version sync — all unchanged, as expected for a docs change).
• Full CI on this PR covers the rest.