knowledge: ingest 7 verified insights (hook stderr capture, shell empty-vs-unset, leaked test artifacts, mutation restore, foreign config keys, client rate limiting, call-site enumeration)

[choiyounggi]

Full review report is committed at .dev-loop/INGEST_REPORT.md in this branch — read that file for the complete verification, dedup, and routing detail. Summary below.

7 queued candidates in → 6 new pages, 1 merge, 1 new category (testing/migration), 0 dropped. Every directive re-verified against primary sources or a local reproduction. Two candidates were changed during verification.

#	Insight	Target	New?
I-1	Tool warns on stderr and exits 0 → capture stderr (2>&1 >/dev/null), exit 2	platforms/shells/zero-exit-diagnostics-into-a-hook.md	new
I-2	Attribute leaked temp artifacts by prefix count × call sites, enforce with an AST rule proven red	testing/data/leaked-test-artifacts.md	new
I-3	Read the consumer's parser before pre-declaring an unreleased config key	infrastructure/config/keys-ahead-of-their-consumer.md	new
I-4	Restoring a hand-mutated file when the work under test is uncommitted	testing/quality/tests-that-cannot-fail.md	merge
I-5	Credential refresh bypasses a wrapper-level throttle; first call is unmetered	backend/common/reliability/client-side-rate-limiting.md	new
I-6	Enumerate call sites by callee, not parameter name; sweep test helpers	testing/migration/call-site-enumeration.md	new + new category
I-7	${VAR:-d} substitutes for empty as well as unset, so VAR= cannot disable	platforms/shells/unset-versus-empty-parameters.md	new

Two candidates changed by verification

• I-4 corrected. The queued claim was "git checkout -- <path> restores from HEAD". It restores from the index (git-checkout: "Replace the specified files and/or directories with the version from the index"; git-restore: "By default, if --staged is given, the contents are restored from HEAD, otherwise from the index"). That yields a remedy the candidate lacked — git add the fix before mutating and git checkout -- reverts only the mutation. Reproduced all three states in a scratch repo; the page now carries a state table instead of a blanket prohibition.
• I-5 narrowed. No primary source found for the KIS 2-req/s figure in the evidence (search returned secondary sources only), so no provider's number is stated as fact — the quota is a parameter, and the KIS log timeline stays in a dated Field context block. The general mechanism rests on Auth0's rate-limit policy: "A single end user request (e.g., Login or Signup) typically initiates multiple requests to Authentication API Endpoints."

All 7 pages are confidence: verified. Sources include POSIX XCU (redirection order; the colon rule in parameter expansion), the Claude Code hooks doc (PostToolUse exit-2 row — exit 2 is the only code that shows stderr to the model), git-checkout/git-restore, pydantic ConfigDict.extra, JSON Schema additionalProperties/unevaluatedProperties, serde deny_unknown_fields, CPython Calls (positional slots), LSP textDocument/references + callHierarchy/incomingCalls, tempfile/pytest tmp_path, Semgrep rule testing, and Auth0. refactoring.com/catalog/changeFunctionDeclaration.html was attempted, returned only the page shell, and is not cited. Local reproductions on macOS (bash 3.2 / sh / zsh) cover redirection ordering, colon expansion across all three shells, and the three git restore states.

Dedup — merged rather than created

I-4 merged into tests-that-cannot-fail because its step 1 already ended "…re-verify red before restoring the code" — the restore mechanism was that page's missing half, not a new situation. Body 58 → 91 lines, under the 120 limit.

The other six were checked against their nearest neighbours and kept separate for stated reasons — notably I-1 is the PostToolUse mirror of the existing PreToolUse page command-text-inspected-before-execution, and I-6 is a signature-changing migration where tests are supposed to change, the opposite invariant to behavior-not-implementation. test-data-and-isolation gained a cross-link to the new I-2 page from its temp-files row.

One thing to decide

testing/migration is a new category, and I flagged it as a judgement call rather than an obvious fit — also logged as a gap entry in log.md. The I-6 directive generalizes past tests to any signature migration, and no domain owns cross-cutting refactoring mechanics. testing is the best available home (its detection channel and the test-helper sweep are suite-specific), but if a second refactoring-shaped insight arrives, that is a domain-level decision for you rather than something to grow testing/ sideways one page at a time.

Invariants (checked mechanically)

New pages listed in their domain index 6/6 · page id matches path 7/7 · related: and inline [page-id] refs 0 broken · max body 91 lines · 0 banned vague qualifiers (one "usually" was caught by the check and rewritten) · every prohibition paired with a replacement in an Instead of table · log.md has an ingest and a gap entry.

Not merged — for your review.