docs(handoff): capture the dogfood-2 workstream and the nine vacuous guards

[ZacxDev]

Handoff for the dogfood-2 workstream: issues #255–#260, six PRs merged (#262, #263, #265, #267, #268, #269) plus #287, all verified on main by re-running the original symptoms with controls rather than by a green suite.

Follows the convention of handoff-dogfood-154.md, which this one links back to.

Why this is worth committing rather than leaving in a transcript

The fix list is the least valuable part. The durable content is the catalogue of nine guards that could not fail — every one green under make ci, under all 12 PR checks, and under its own author's mutation matrix — each hiding a different way, from a t.Skip that fired on setup failure to a block labelled POSITIVE CONTROL whose condition was s == s.

The instructive one is last: a ranking-stability test whose 2-element fixture sat under Go's n=13 insertion-sort threshold, so the unstable sort was stable by accident. Nothing in that test looks wrong — and the obvious fix ("use more than 13") also fails, because with one gap kind pdqsort short-circuits an all-equal partition. It needed two kinds across 30 gaps. Applied without re-running the mutant, that fix would have shipped a tenth vacuous guard believing it closed the ninth.

Also recorded, with measurements

• Instrument validation — a peak-RSS harness that reported 0 MB for everything and was discarded; a lint control whose typecheck errors proved the parser ran, not the linters; errcheck being disabled in .golangci.yml, so a control built from an unchecked-error slip validates nothing.
• go test's vet subset includes printf, so an arity error surfaces as build failed and never --- FAIL. Hit twice for real — once producing a result that would otherwise have been scored a surviving mutant, i.e. read as good news.
• A declared equivalent mutant is a claim. One was declared equivalent with reasoning written into the source as a do-not-re-derive note, and was wrong on four inputs — three of which turned a file npm ci refuses into a clean validate.
• Operating traps that cost real time and are not in the code: zsh word-splitting and history modifiers (both produced confident wrong answers, not errors), a failed cd that let a git merge run in the base clone, a script guard whose non-zero exit the caller ignored, and git rerere replaying a resolution silently.
• The AGENTS.md item-25 three-way collision and how it resolved to 25/26/27.
• Residuals shipped deliberately, each with its measurement rather than a hand-wave.

The coverage gap that matters

🔴 Both dogfood runs were deliberately un-credentialed, so civitai generate — the CLI's only irreversibly money-spending surface, and the subject of items 12–22 — is structurally unreachable by this harness. Two clean dogfood runs say nothing about it. Written down so "we dogfooded it twice" is never read as coverage of the spend path.

Docs-only. make ci green, golangci-lint v2.12.2 clean.