docs: weekly TODOs re-verification and MODULE_AUDIT refresh (August 2, 2026) by cursor[bot] · Pull Request #171 · kyleve/Stuff

cursor · 2026-08-02T13:24:59Z

The weekly todo-triage pass. INBOX.md was empty, so this is steps 2–5: re-verify the open backlog against current source, review the week's landings, rewrite the audit from what the backlog now says, and fix the docs the week invalidated.

The heaviest week the repo has had — 359 → 501 source files, 14 → 19 library targets, three new modules (Flyover, Inspector's boot runtime, LifecycleKitUI), demo mode reshaping composition around WhereScope, and spans pushed through every expensive path in the app.

What moved in the backlog

Every open item in all 11 TODOs.md files was read against current source. Most citations moved and are corrected; the verdicts that changed:

Closed: WherePreferences.init(store:) lost its parameter default (#150), IntentSnippets' preview literal is localized, the LocationsView/YearView empty-state snapshot cases exist, and SnapshotCase now rebuilds content per configuration.

Corrected rather than carried:

The "one remaining isCapturingSnapshot read that isn't a stand-in" claim was wrong — LaunchSplashView reads it twice more. Both are sanctioned carve-outs (a wall-clock timer and a motion end-state), which is the distinction the old wording lost. CalendarContentView's scroll skip is still the real exception.
Periscope's "no eager store handle" item described a WhereModel that no longer exists; Add demo mode, and open nothing until the user picks a world #150 replaced the bare Optional<PeriscopeStore> with a typed LogStoreState. The consumer side is honest now; the async make() that forces the state machine is what's still open.
The SnapshotKit shared-content item is half fixed — SnapshotCase is no longer the culprit, one runner call site is.
The where.gregorian_calendar P0 said "seven production sites"; it's four shipped sites plus preview fixtures, and there are now zero explicit Calendar.current spellings left, so the rule's match set is provably empty.

Three new findings:

WhereTests double-links LifecycleKit beside WhereUI, and never imports it (Project.swift:311-315) — exactly what the "Never double-link a product WhereUI already carries" rule forbids. It slipped past because the rule's prose scopes itself to the unitTests helper's extraPackageProducts and WhereTests is hand-rolled, and because the guard test lives in WhereUITests. WhereTests is in Stuff-iOS-Tests, which is where the failure reproduces.
A store opened without a resolvable URL silently loses remote-change observation in release (SwiftDataStore.swift:222-229) — the else branch is a bare assertionFailure, so a debug build traps and a release build returns a store that never sees a share-extension add or a CloudKit sync.
Flyover shipped 50 sources against 10 namesake test files — the largest untested surface in the repo. Opened Shared/Flyover/TODOs.md for it.

What the audit now says

Rewritten from the refreshed backlog. Two things worth flagging in the report itself rather than only in the diff:

The July 26 pass listed the LifecycleKit terminal-phase race as an open high against a tree where Typed LifecycleKit: compile-checked launch plans, engine/UI split, Where migration #116 had already fixed it that same day. The new report says so instead of quietly dropping it.
The severity-count tables are gone. They mixed filed items with findings folded into module summaries, so they couldn't be reconciled against the backlog — which is the only place a finding lives. A top-findings table of pointers replaces them.

It also records what verified clean, which a backlog has no room for — including Inspector's twelve data-deletion safety invariants, each checked against code individually rather than sampled, and all twelve enforced.

Docs

Where/AGENTS.md documented Inspector's boot runtime but not Flyover, which landed the same week.
WhereUI/AGENTS.md claimed views don't branch on \.isCapturingSnapshot. Three do; the rule is now stated as the carve-out it actually is, with the one real exception named so it doesn't read as precedent.
SnapshotKitTesting/AGENTS.md quoted settle-cost percentages measured over 260 references; it's 273 now. Dated the measurement and added a tripwire rather than restating stale numbers as current.
Root AGENTS.md listed the image suites that don't link WhereUI; Flyover's is a third.

Regenerated the CLAUDE.md mirrors with ./sync-agents.

Verification

This pass ran on Linux, so it is static analysis only — no test, build, or bumper lint run backs any runtime claim, and the audit's Limitations section says so. What did execute: ./swiftformat --lint (clean, 0/818) and ./attribution --check (clean, 7 credits). CI on main was read via gh and is green through 0cce6578, which is what lets the "the Gregorian rule finds nothing" conclusion stand.

Every claim published here was spot-checked against source by hand after the verification fan-out, not taken from it directly.

Markdown only — no code changes.

Note

Low Risk
Markdown and backlog/audit updates only; no runtime, auth, or build graph changes.

Overview
Documentation-only — no Swift or build changes. This is the weekly todo-triage pass after an empty inbox: every open backlog item was re-checked against source, citations were updated, and MODULE_AUDIT.md was rewritten for the week (359→501 source files, 14→19 SPM libraries, new Flyover/Inspector/LifecycleKitUI surface).

Backlog (TODOs.md across 11 files): Several items are marked closed or corrected (e.g. tracking-toggle race, SnapshotCase half-fix, Periscope store-handle wording after WhereScope, isCapturingSnapshot reads in LaunchSplashView). Three new findings are filed: WhereTests double-linking LifecycleKit beside WhereUI, release-only silent loss of remote-change observation, and Flyover’s thin test coverage — with a new Shared/Flyover/TODOs.md. Gregorian-rule P0 is tightened (four implicit-member drift sites, empty explicit Calendar.current match set).

Audit: Drops unreconcilable severity tables; adds a top-findings pointer table; notes the July 26 LifecycleKit “high” was already fixed by #116; refreshes per-module counts and cross-cutting themes (demo mode, spans, reconciliation docs vs code, four snapshot bundles / 273 refs).

Agent/docs fixes: Root AGENTS.md image-suite note now names Flyover with Inspector and Periscope; Where/AGENTS.md documents Flyover beside Inspector; WhereUI/AGENTS.md states the real isCapturingSnapshot carve-out (and names CalendarContentView scroll as the exception); SnapshotKitTesting/AGENTS.md dates settle-cost stats and tripwires reference count 273.

^{Reviewed by Cursor Bugbot for commit 3fd0bc4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Weekly triage pass. Corrects every citation that moved under the ~29 commits since the July 26 audit, records what shipped, and files three new findings. Root TODOs.md: - Sharpen the where.gregorian_calendar P0 with the four shipped implicit-member sites the rule can't see (the old "seven" predates the call-site pass) and the current rule line. - New P1: WhereTests double-links LifecycleKit beside WhereUI and never imports it, which the documented rule forbids. It slipped past because the rule's prose scopes itself to the unitTests helper's extraPackageProducts and WhereTests is a hand-rolled target; the guard test lives in WhereUITests, so nothing catches it. - Correct ./test's affected_bundles range and the StuffTestHost scene-name duplicate line. Where/TODOs.md: - Two new WhereCore items: a store opened without a resolvable URL silently loses remote-change observation in release (assertionFailure is debug-only), and DemoDataBuilder's comment claims a reconcile the bulk ingest doesn't do. - Record what closed: WherePreferences.init(store:) lost its default, IntentSnippets' preview literal is localized, and the LocationsView / YearView empty-state snapshot cases exist. - Correct the "one remaining isCapturingSnapshot read" claim, which was wrong: LaunchSplashView reads it twice more. Both are sanctioned carve-outs, which is the distinction the old wording lost. - Sharpen the launch notification-prompt P1 with why it hits every fresh install (all three preferences default to true). - Re-cite the broken-snapshot cluster; the blank VoiceOver calendar references are confirmed not re-recorded (LFS pointer sizes).

Periscope: re-measure Periscope.swift (931 lines, State still flat) and PeriscopeStore.swift (1230) for the decomposition item; correct the survivesRelaunch warn cite; record that #154's budgeted launch spans made the pre-store-attach P0 more expensive, since a launch span's began and ended now land in different places; recount the hosting smoke tests (18/9 -> 20/10); file SpanHistoryModel under the rebuild-per-commit item. Correct the "no eager store handle" item, which described a WhereModel that no longer exists: #150 replaced the bare Optional<PeriscopeStore> with a typed LogStoreState. The consumer side is honest now; the async make() that forces the state machine is what's still open. SnapshotKit: the shared-content item is half fixed. SnapshotCase rebuilds per access; the runner still hoists one AnyView out of the configuration loop, which is the remaining call site. SnapshotKitTesting: the settle-floor item counted 260 references and 22 floor-bound configurations. It's 273 and 24 now, and the Flyover canvas is the new one. Flag the timing percentages as needing re-measurement rather than quietly restating them. New Shared/Flyover/TODOs.md: the module landed this week with 50 sources and 10 namesake test files, and its invalid-catalog view reports an issue count without the issues. Also re-cite LifecycleKit, Broadway, CreditKit, and Inspector.

Where/AGENTS.md described Inspector's boot runtime but not Flyover, which landed the same week and which WhereUI also builds on. Both are now one section, with the split that matters: Flyover knows nothing about Where, so the seeded demo world and the never-activate rule stay WhereUI's. WhereUI/AGENTS.md claimed views don't read isCapturingSnapshot to branch themselves. Three do. Two are sanctioned (LaunchSplashView freezes a wall-clock timer and pins a motion phase, which is what the flag is for); CalendarContentView's scroll skip is the one that isn't, and is filed. State the rule as the carve-out it actually is, and name the exception so it doesn't read as precedent. SnapshotKitTesting/AGENTS.md quoted settle-cost percentages measured over 260 references. Flyover and Inspector brought their own bundles, so it is 273 now — date the measurement and add the tripwire rather than restating numbers as if they were current. Root AGENTS.md listed the image suites that don't link WhereUI; Flyover's is a third. Regenerated the CLAUDE.md mirrors with ./sync-agents.

The tree moved further in one week than in any before it: 359 -> 501 source files, 14 -> 19 library targets, three new modules. The report is derived from the TODOs.md files as they now stand, so every finding it points at is a real item rather than a restated body. Two things worth calling out in the report itself rather than only in the diff. The July 26 pass listed the LifecycleKit terminal-phase race as an open high against a tree where #116 had already fixed it that same day; this pass says so instead of quietly dropping it. And the severity-count tables are gone: they mixed filed items with findings folded into module summaries, so they could not be reconciled against the backlog, which is the only place a finding lives. A top-findings table of pointers replaces them. Records what was verified clean, which is the part a backlog has no room for — including Inspector's twelve data-deletion safety invariants, each checked against code individually rather than sampled, and all twelve enforced. Limitations are honest about the Linux VM: no test, build, or bumper run backs any runtime claim. What did execute is named (swiftformat --lint, attribution --check, gh for CI status).

kyleve · 2026-08-06T21:48:45Z

@codex mind running this again and then resolving conflicts?

chatgpt-codex-connector · 2026-08-06T21:53:21Z

Summary

Reran the backlog and module-audit review against the available PR checkout. The source/test inventory, inbox, completed backlog work, and findings were unchanged, and the audit is now dated August 6, 2026. MODULE_AUDIT.mdL3-L7 MODULE_AUDIT.mdL18-L24
Checked the repository for unresolved Git conflict markers; none remain.
Updated the limitations to accurately record that this environment lacked a configured Git remote, GitHub credentials, and downloadable pinned tooling. MODULE_AUDIT.mdL206-L212
Committed the follow-up as 0be9978 (Refresh the module audit follow-up for August 6).
I could not create the required follow-up pull request because this checkout has no Git remote, gh has no authentication, and the requested make_pr tool is unavailable in this environment.

Testing

✅ git diff --check
✅ rg -n '^(<<<<<<<|=======|>>>>>>>)' --glob '!*.xcstrings' . (no conflict markers found; rg exited 1 because there were no matches)
⚠️ ./swiftformat --lint (pinned SwiftFormat and Ruby tools could not be downloaded because network access failed)
⚠️ ./attribution --check (blocked by the same unavailable pinned tools)
⚠️ ./test (Linux checkout has no configured origin/main, and Swift package inspection failed before a test scope could be selected)
✅ git status --short --branch (clean working tree after commit)

View task →

kyleve · 2026-08-06T22:04:51Z

@codex please review and push updates

chatgpt-codex-connector · 2026-08-06T22:04:59Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

kyleve · 2026-08-06T22:05:39Z

@cursor please update to latest main on this pr

cursor · 2026-08-06T22:05:45Z

Merged origin/main into cursor/todo-triage-weekly-pass-cd91 and pushed (3fd0bc43).

Conflicts resolved (5 files):

MODULE_AUDIT.md — kept the August audit rewrite; folded in main's fixes (tracking toggle closed via Delay visible Location card updates #198, ingest fan-out closed 2026-08-04); updated date to August 6 and CI tip to 14778027
Where/TODOs.md — merged main's backlog updates (reconcileAfterDayDataChange, PostWriteReconcile links, photo backfill item, fixed-item strikethroughs) with the PR's August-2 findings (DeveloperToolView/OpenSpansView, remote-change observation)
TODOs.md — dropped the open StuffTestHost scene-name item (completed on main)
Shared/SnapshotKitTesting/AGENTS.md — kept both main's full-content sizing bullet and the PR's dated settle-cost tripwire
Where/WhereUI/AGENTS.md — kept the PR's isCapturingSnapshot carve-out plus main's LocationDayCountPresentationModel rule

Verification: ./swiftformat --lint clean (0/910), ./attribution --check clean. CI on the PR is green through the merge commit.

PR: #171

Resolve documentation conflicts from the weekly audit pass against main's August landings: tracking-toggle and ingest fan-out fixes, PostWriteReconcile/TrackingReconciliation specs, card-designer and location-count presentation rules, and the completed StuffTestHost scene-name item. Co-authored-by: Kyle Van Essen <k@kve.me>

kyleve · 2026-08-08T21:00:00Z

Closing this since the next run will run tomorrow.

… 9, 2026) (#217) ## Summary - Re-verified **every open item in all 13 `TODOs.md` files** against `HEAD`, refreshing citations module by module. The tree nearly doubled since the last merged audit (359 → 623 sources), so most line numbers had moved. - **Closed 6 items**, five of them in WhereUI — four from the broken-snapshots cluster that has been open since PR #101, plus the capture-time scroll skip. - **Corrected three items whose premise was wrong**, as dated corrections inside each item rather than silent edits, because each changes what the item is asking for. - **Filed ~10 new findings** and opened two new area backlogs: `Ledger/TODOs.md` (its first audit) and `Shared/Flyover/TODOs.md`. - **Rewrote `MODULE_AUDIT.md`** from the refreshed backlog. It was six weeks stale in every measured claim. - **Fixed five docs the fortnight invalidated**, including two `AGENTS.md` files making claims the code contradicts. ## Why The weekly `todo-triage` pass. One thing worth flagging up front: **last week's PR (#171) was closed unmerged**, so nothing it found reached `main`. This is therefore a two-week diff against the July 26 audit, and #171's work was re-derived from source rather than copied from its branch. The three findings I'd most want a second opinion on: 1. **The Bumper Gregorian rule and its own test fail together.** The rule matches only an explicit `Calendar` base, so it reports none of the 12 implicit `.current` sites — and `WhereProjectRulesTests.swift:164-171` only ever feeds it the explicit form. The test passes for exactly the reason the rule fails, which is why this has now survived three audits with CI green and the rule at `severity: .error`. The item now says to fix the test first. 2. **`./test` cannot run the macOS Ledger bundle at all** — no reference to Ledger or a macOS destination anywhere in its 869 lines — while the always-applied root `AGENTS.md` said it was "the only way to run tests". The `running-tests` skill and `LedgerCore/AGENTS.md` both documented the `tuist` carve-out, so the one file guaranteed to be loaded contradicted both. Root `AGENTS.md` now names the exception; whether `./test` should absorb the tier is filed. 3. **`SnapshotCase`'s doc comment tells test authors something false.** It says "Each access creates an independent view value for its configuration" — true of the accessor, false of how the runner uses it, since `AssertSnapshots.swift:44-45` reads it once per case and re-hosts that value for every configuration. The item was originally filed because the docs were *silent* on this; they're now actively misleading. ## Review focus - **The five closures in `Where/TODOs.md`.** The blank-VoiceOver-calendar one is judged from the Git LFS pointer size (66 KB → 3.2 MB; a solid-white PNG cannot be 3.2 MB), not from pixels — this VM can't render. If you want that one held open pending a macOS `./test --review`, say so and I'll reopen it. One of the four is closed as **obsolete rather than fixed**: PR #200 deleted `StintRow` and both stylesheet tokens, so nobody scaled the accent bar; the accent bar is gone. - **A trap I added to the three broken-snapshot items still open.** PR #196 re-recorded their references while their layout code went untouched, so those images now faithfully pin the same defects at a new size. Re-check the image before fixing. - **`MODULE_AUDIT.md`'s omissions.** I dropped the severity and category count tables rather than re-estimating them (they never reconciled against the backlog) and rewrote the themes so none of them prescribes a fix — the previous version had "widen the rule" / "add it to the fan-out" / "extract a `ReportLoadGate`" inline, contradicting the file's own no-actionable-items contract. - **Two reported violations I rejected**, in case you disagree: the single-module backlogs (Inspector, CreditKit, JournalKit, LifecycleKit) correctly omit the `(Scope)` tag, which the root format explicitly permits, and LifecycleKit's resolved P0 is already under `# Completed issues`. - **`convention` and `localization` are now documented as allowed item types** in the root format. Both were already load-bearing in four filed items, so the list was wrong rather than the items — but this is a change to the format contract, so it's your call. ## ⚠️ Breaking changes None. Documentation and backlog only; no Swift source, manifest, or script was modified. ## Compatibility No effect on build, runtime, or persisted formats. Two new files (`Ledger/TODOs.md`, `Shared/Flyover/TODOs.md`) and the regenerated `CLAUDE.md` mirrors, which are gitignored. ## Testing - `mise exec -- ./swiftformat --lint` — passes, 0/1007 files require formatting. - `mise exec -- ./attribution --check` — passes, `attribution.json` up to date (8 credits). - `mise exec -- ./sync-agents` — run after every `AGENTS.md` edit; regenerated `CLAUDE.md` for root, `LedgerCore`, and `SnapshotKitTesting`. - **Not run, and why:** `./test`, `swift run bumper lint`, and `./xcstrings --lint` are all unavailable here. This VM is Linux with **no Swift toolchain at all**, which rules out the two Swift-script CI gates as well as Tuist and the simulator — now recorded in the root `AGENTS.md` Linux section, since it previously named only Tuist/simulator/Xcode. CI on `main` was read via `gh` and is green at `46a84015`, which is what lets the "the Gregorian rule finds nothing" conclusion stand. - Every claim published here was spot-checked against source rather than taken from a subagent report; four candidate findings were investigated and rejected, including one that looked like a shipped bug (`\.isCapturingSnapshot` set to `true` in WhereUI) until it turned out to be inside `#if DEBUG`.

cursoragent added 4 commits August 2, 2026 13:15

kyleve marked this pull request as ready for review August 6, 2026 21:48

kyleve enabled auto-merge (squash) August 6, 2026 22:03

kyleve closed this Aug 6, 2026

auto-merge was automatically disabled August 6, 2026 23:55
Pull request was closed

kyleve reopened this Aug 6, 2026

kyleve closed this Aug 8, 2026

cursor Bot mentioned this pull request Aug 9, 2026

docs: weekly backlog re-verification and MODULE_AUDIT refresh (August 9, 2026) #217

Merged

Navigation Menu

docs: weekly TODOs re-verification and MODULE_AUDIT refresh (August 2, 2026) - #171

docs: weekly TODOs re-verification and MODULE_AUDIT refresh (August 2, 2026)#171
cursor[bot] wants to merge 5 commits into
mainfrom
cursor/todo-triage-weekly-pass-cd91

cursor Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 6, 2026

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 6, 2026

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

cursor Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

kyleve commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cursor Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What moved in the backlog

What the audit now says

Docs

Verification

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 6, 2026

Summary

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 6, 2026

Uh oh!

kyleve commented Aug 6, 2026

Uh oh!

cursor Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kyleve commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cursor Bot commented Aug 2, 2026 •

edited

Loading

cursor Bot commented Aug 6, 2026 •

edited

Loading