# Review-history mining — all merged PRs through #261 (2026-06-12)

What 14 days of review actually caught, missed, and wasted — mined from the
full history (185 merged PRs' bot reviews + the local multi-agent review
outcomes recorded in squash messages, 379 records) plus a skeptical census of
50 post-merge `fix:` commits (three chronological samples of the
fix-prefixed log — not an exhaustive sweep; 131 fix-prefixed commits exist
all-history). Method: 8 parallel harvesters → escapes
census → synthesis deduped against existing guidance → adversarial skeptic
per proposal (already-covered? premise holds against `gh`/`git`? over-fires?).
Companion to the token-side [`baseline-2026-06.md`](baseline-2026-06.md).

## What review reliably catches (keep doing)

| class | records | note |
|---|---|---|
| docs-drift / stale CLAUDE.md–README refs | ~26 | the single most-enforced convention |
| TDD test gaps (new behavior unpinned) | ~20 | bots persist across rounds until fixed |
| parallel-structure / twin drift | ~13 | but the in-diff sibling form escaped twice (below) |
| security input-validation & hardening | ~12 | |
| lifecycle/state-machine edge races | ~10 | |
| panic/OOB/overflow guards | ~9 | |
| silent-fallback / config-parse fatality | ~9 | |
| vacuous/wrong-path tests | ~7 | mutation-verified pins are the counter |
| byte-vs-char slicing | ~6 | CONTRIBUTING pitfall 1 |
| YAGNI dead code | ~5 | |

## The escapes (7 adjudicated, ≈4% of merged PRs)

Of the 50 censused fixes, most were *not* escapes (pre-review-era origin,
emergent cross-PR composition, upstream discovery, or caught by the PR's own
review round). The 7 that were, each named a guideline change:

1. **Ignored finding, no terminal disposition** — #40's flagged migration-shim
   removal merged anyway → 0.4.1 release-blocker (#46); 3 more drops never
   reached fixed/refuted/issue-filed (#178's "worth a follow-up issue" never
   filed; #163's two MEDIUMs out-lived three rounds; #112's docs gap open at
   merge). → disposition sweep (prompt file).
2. **Runtime-visible motion regression, code-only review** — #61 shipped FIVE
   walk bugs visible within minutes of watching (fixed in #62). → render-and-
   watch escalation trigger.
3. **Unwired field defeating its own PR's fix** — #61 shipped `snap_prev`
   bound as `_snap_prev`, and it survived #62's dedicated fix-round review
   too (wired in #66); the class was caught 3 other times when someone
   looked. → CONTRIBUTING pitfall 5.
4. **Guard on one sibling path in the same diff** — #159's empty-`RUST_LOG`
   guard at one call site (twin caught later in #172). → pitfall 2 sharpened.
5. **Comment-named hazard pinned on one side of its window** — the
   Waiting-clobber pin covered only in-window (#150 arc, fixed in #232).
   → pitfall 4 sharpened.
6. **Shim never-panic violation** — #198 added `env::args()` (non-UTF-8 argv
   panics, visible to CC) past bot + local rounds (fixed post-merge,
   bae3541). → whole-shim audit escalation trigger.
7. **Denylist incompleteness vs the documented set** — `CMD_UNSAFE` missing
   cmd.exe's first-token delimiters through TWO dedicated security reviews
   (#198/#201). → CONTRIBUTING pitfall 6.

## What wastes verifier tokens (false-positive classes)

- **Design-intent / premise-inversion refutations** — the bulk (26 + 12 + 8 in
  the three biggest reviews alone); governed since #261 by the REVIEW-LEDGER's
  premise-anchored demote-don't-kill protocol.
- **Stale external-world claims** — 3 incidents, 2–4 re-review rounds each
  (`checkout@v6` "doesn't exist" ×2 rounds, the homebrew tap "doesn't exist"
  ×4 rounds — both existed; the third, #31's author-side artifact-version
  claim, self-refuted next round). → negative-space + anti-hallucination
  additions.
- **Hallucinated findings** — 2 total; existing trace-before-claim defenses
  hold.
- **Verification false-negative** — 1 (the socket-steal seam), already the
  ledger's canonical case.

## The PR #86 backtest (data-shape lens validation)

The one *design*-class review miss — caught pre-merge only by a
self-dispatched architect pass, hence absent from the post-merge escape
census — got its own controlled experiment before the guideline changed: the `[pet-names]` draft added a kind-keyed names map next
to `enabled-pets` (two structures, one identity); the bot called it "clean,
focused" and the `[[pets]]` consolidation arrived two commits later.
Backtest on the real draft diff:
**0/3** reviewers under the then-current lens-2 brief flagged consolidation;
**3/3** flagged it with the data-shape item added (two independently
re-derived `[[pets]]`); **0/4** over-fires on negative controls (the
deliberate `active_pet`/`last_pet_pos` non-merge and a scalar-key addition).
The item ships in lens 2 on that evidence.

## Re-measuring

Re-run this census after the next ~50 PRs. Success criteria: the 7 named
escape classes at zero recurrences; stale-external-fact rounds at zero;
disposition sweep verified by harvesting `bot-finding-ignored` records
(currently the drop channel is invisible until something breaks).

Each census files the next one as a tracked issue at +~50 PRs, so the cadence
rides the issue backlog rather than anyone's memory (next: #266, pinned, due
~PR #310).
