Core code review — Inspection/GNC + Inspection/analysis

Whole-tree quality review (read-only, no code edited) using the new clean-review rubric skill + ponytail-ultra, run as an ultracode workflow: 20 review units (opus on the load-bearing files, sonnet on the mechanical pairs), each briefed with the rubric, its tree’s governing contract, and an INSIGHTS quirk-check, followed by an adversarial verification pass in which every bug/footgun/drift claim was handed to an independent refuter instructed to default-refute. 89 agents total (~7.9M subagent tokens). 54 findings survived verification (11 were refuted and discarded); ~35 modularity/style observations pass through as unverified judgment calls, marked ⊘ below. Findings cite clean-review rule IDs.

Verdict: the core is sound — the equations are implemented faithfully and the architecture is load-bearing, not ceremonial — but the review found 7 confirmed bugs (2 live in shipped numbers, 5 latent), a band of change-detonated footguns concentrated exactly where the thesis is headed (singularity handling, risk-aware Monte Carlo), and doc drift in current_sota.md that would defeat a pencil-and-paper re-derivation in 3 places.

1. Confirmed bugs

Every entry here survived independent adversarial refutation; the two live ones I additionally verified by hand.

1.1 cumulative reduction integrates with dt = 1.0 — LIVE in shipped reports

analysis/data_analyzer.py:1211 (G5). SignalAnalysis.window_reduction calls reduction.apply(signal, threshold=...) without threading dt, and Reductions.CUMULATIVE defaults dt=1.0. The view knows the real dt (self.log_dt(), ~0.03 s); it just is not wired through. Every cumulative row is therefore ~33× the physical time-integral. I verified the live impact myself: YAMLs_by_domain/metrics.yaml:107 lists cumulative on control_effort.default_control, inherited by the force/torque/wrench metrics that reports render. The 1e-12 parity test cannot catch it — measure and the sweep are wrong in lockstep. Fix: pass self.log_dt() into reduction.apply. Note when fixing: every historical cumulative value shifts by ~33×; re-pin anything gated on it.

1.2 Aim-clock floor double-advances per step (POSE + analytic-FF)

GNC/guidance/ee_guidance.py:679 (N7; reported footgun, verifier upgraded to bug). _aim_arclength reads like a getter but mutates _s_aim_prev, and the POSE + analytic-feedforward path calls it twice per step (orbit_path_pose at :688, then analytic_desired_nu_e_feedforward at :277 via breve_controller.build_desired_for_step). With aim_floor_rate>0 or aim_lead_max>0, a stalled floor climbs at 2× the configured rate, and the commanded pose and its feedforward twist are evaluated at different arclengths within one step. The verifier found this exact knob combination in a real campaign spec (analysis_YAMLs/mission_analytic_ff_guarded_jun19.yaml), and validation/legacy/test_aim_clock.py never exercises the double-call path. Fix: memoize per step_idx, or advance the floor once in add_ee_goal.

1.3 One hung box crashes the whole dispatch loop

analysis/dispatch.py:301 (G). run_ssh/rsync pass timeout=30 to subprocess.run, which raises TimeoutExpired on a connected-but-stalled command — and nothing in the chain catches it (_poll_and_route catches DispatchError; TimeoutExpired is a SubprocessError, not an OSError). The 2-strikes box-down resilience design is bypassed by the single most common LAN failure; the controller aborts mid-cycle and abandons every in-flight run. Fix: catch TimeoutExpired in run_ssh/rsync and return non-zero rc so the existing transport-error path handles it.

1.4 cmd_status reports healthy idle boxes as UNREACHABLE

analysis/dispatch.py:1215 (G9). _poll_box returns the TRANSPORT_ERROR sentinel whenever zero status lines parse, so a reachable box with no runs under today’s dated dir (“no runs found…” matches no status regex) reads as UNREACHABLE — every box at once on a morning after midnight rollover. The if not result: (idle) branch is dead. Also confirmed adjacent: FINISHED stems land in an invisible finished counts bucket the summary never prints, while the hardcoded collected/exhausted buckets can never be produced (dispatch.py:1225). Fix: distinguish rc==0-with-no-stems from transport failure; add a finished bucket.

1.5 The log-driver broadsheet silently drops the written narrative

analysis/upstart_reporter.py:382 (bug, empirically reproduced by the verifier). summary_from_md splits on blank lines, so the exact shape the log-driver SKILL.md template mandates (## Heading immediately followed by its paragraph) swallows the body into the <h3> and renders zero <p> tags. demo()’s fixture blank-line-separates everything, so the self-check never catches it. Fix: parse line-wise on ## boundaries.

1.6 Multi-key overlays lose every key after the first in the broadsheet

analysis/upstart_reporter.py:336 (bug). _metrics() takes keys[0] per overlay block and ignores secondary_keys entirely — a documented, smoke-tested Orchestrator feature (multi-key overlay, twinx) silently renders incomplete. Currently masked because the one wired stem uses single-key blocks. Fix: loop over Orchestrator.overlay_keys(fields) + secondary_keys.

1.7 OrchestrationResult.relative_figure_paths is a one-shot generator in a tuple-typed field

analysis/orchestrator.py:1090 (G16; confirmed independently by two units). run() assigns a generator expression to a field declared tuple (dataclasses don’t enforce), while fake_report_inputs assigns a list — so smokes mask it. The only live consumer iterates once today, so nothing fires yet; any second reader silently gets an empty sequence and drops every figure. Fix: tuple(...).

2. Latent footguns — GNC

These are correct today and break under a likely change. The first three sit directly on the singularity-handling priority and the risk-aware phase.

• Arm derate reaches the plant but not the logged EE wrench — GNC/breve_controller.py:277-312 vs breve_core_controller.py:91 (G5 / drift on eq 6.4). compute_omega_e_oplus builds P/D/I from raw g.arm gains with no arm_gain_scale(), while the RHS/plant path uses γ-scaled arm_breve_gains and the base wrench IS derated. Enable arm conditioning near a singularity and “minimize control effort” is measured against a wrench the arm never applied. Verified against my own read of both files. Fix: scale the logged wrench like the plant path.
• Shared RNG across all three uncertainty channels — GNC/uncertainty_model.py:33 (G16). Camera/state/actuation draws share one default_rng(seed) stream, so activating or resizing any channel desyncs the others at the same seed — defeating common-random-numbers ablation, the standard technique the risk-aware Monte Carlo phase will need. Fix: np.random.default_rng(seed).spawn(3), one child per channel.
• Guidance-only rollout is a second CoM kinematics implementation — GNC/guidance/guidance_rollout.py:45 (G5). _sample_nominal_com re-derives desired-CoM via discrete interpolation, never applies the startup speed ramp, and no test compares it to the live path — coverage-vs-time predictions run systematically early, and future gain/ramp changes won’t propagate. Fix: route through com_guidance desired-state functions + one parity smoke.
• Integrator hidden inside a compute-named method — breve_controller.py:294 (F2/N7). compute_omega_e_oplus advances x_e_int as a side effect; x_e_rhs reads it later in the step. Reordering all_control_terms or re-invoking the compute in a diagnostic double-advances it silently. Fix: advance once, explicitly, in all_control_terms.
• CoM integral anti-windup is asymmetric — GNC/com_controller.py:341 (G28). Back-off fires on any saturating step, but forward accumulation only runs when |x_c_tilde| ≤ disable_error — during sustained saturating cruise the integral winds the wrong way to its clamp, then overshoots on recovery. Masked because the CoM integral is OFF in the adopted default. Fix: gate the back-off on the same condition, or use true back-calculation.
  • Addendum 2026-07-03 (adversarially verified): “OFF in the adopted default” is imprecise — controller.com.integral.enable: true survives raw→built for every gold baseline, with no run-spec override anywhere. The correct masking statement is enabled-but-frozen: the accumulation gate disable_error 0.08 m sits below the ~0.09–0.10 m cruise floor, so x_c_int stays ~0 until t≈695 s. The symmetric-gate fix recommendation stands unchanged. Full trace: notes/anti_windup_verification.md.
• desired_at_window slices before its None-clamp — GNC/com_guidance.py:180 (T5; confirmed independently by two units). The documented end_idx=None default raises TypeError at path[start_idx:None+1] before _clamp_window_bounds ever runs. Every current caller passes explicit indices. Fix: clamp first.
• Mixed and/or precedence on the mode-routing gate — GNC/guidance/ee_guidance.py:711 (G16; two units). Parses correctly today as (A and B) or C or D, where the and-clause is the load-bearing hook that lets guidance-only rollout skip the INITIAL hold; one added clause or misread flips mode routing with no error. Fix: parenthesize.
• Selection.p_ce carries two frame conventions — ee_guidance.py:364 (N4). Body-frame on default_selection, world-frame on active_selection — same field name, silently wrong by R_b if ever cross-assigned. Fix: name the frames apart.
• Finder reaches into Mesh._legacy — GNC/guidance/target_finder.py:55 (G36). All sampling/area work rides a private attribute of another module; a mesh migration breaks construction. Fix: public accessor on Mesh.
• Head-on view scores zero — target_finder.py:343 (T5). 0 < angle excludes exact incidence 0 (reachable: np.clip caps dot at exactly 1.0), zeroing q2 for the best possible view. ANCHOR-only today. Fix: 0 <=.
• frame_from_z_axis shares a mutable default array — GNC/base_guidance.py:170 (G16). Def-time x_hint=as_flat([1,0,0]); safe under current callees, corrupted state for all future calls if any callee writes in place. Fix: None default.
• Window docstring says half-open, code is closed-interval — base_guidance.py:39 (C2). Every consumer treats i1 inclusively (one-sample overlap is deliberate); a reader “fixing the off-by-one” per the docstring drops the last sample of every window. Fix: rewrite the docstring.

3. Latent footguns — analysis pipeline

• tmux launch failure exits 0 — analysis/detached_run.py:148. Breaks dispatch’s “non-zero exit = box-down” contract (dispatch.py:1022); the stem strands in DISPATCHED forever (VANISHED + was_ever_alive=False never re-pools). The known unverified precondition is loginctl enable-linger. Fix: sys.exit non-zero on any tmux rc≠0.
• Empty exit-status sentinel crashes the poll batch — detached_run.py:76 (T5). echo $? > exit_status is not atomic; a poll in the truncate-to-write window reads '' and int('') raises, counting a spurious transport error. Fix: guard the empty/non-numeric read.
• tolerance.py measures divergence on boxes that failed to sync — analysis/tolerance.py:100 (drift on the tool’s own invariant). Sync result is printed and discarded; a dirty/divergent box still runs and its divergence conflates code drift with the numerical divergence the tool exists to bound. Fix: filter hosts on SyncResult.ok, mirroring cmd_run’s sync→preflight order.
• Paired-series zip truncates silently — analysis/logger.py:160. populate_logger_from_raw_payload zips primary/_desired with no length check — a corrupted or hand-edited NPZ shifts every actual-vs-desired pairing with no signal, unlike every neighboring fail-loud reject in the file. Fix: assert equal lengths before zipping.
• place_legend lost its twin’s None-guard — analysis/plotter.py:713 (G5). Diverged copy of the outside-legend rule; one deleted YAML key (enable_label_count) away from a TypeError on every comparison-figure legend. Fix: reunify with legend_kwargs.
• Run stamps are minute-resolution — analysis/orchestrator.py:117 (T5, verified by hand). Two runs of the same stem in one minute silently clobber each other’s npz/figures, and verify_provenance (string-membership on the run’s own stamp) still passes. Fix: seconds in the stamp or mkdir-fail-if-exists.
• back_half_pkpk composes after and steady_frac on the wrong span — analysis/data_analyzer.py:2339 (G16, numerically reproduced). include_ratio fractions over the RAW sample count, so “back half after 90 s” is actually “back half of the whole run ∩ t≥90”. Fix: ratio over the already-windowed span, or document non-composition.
• peak_signal(use_norm=False) flattens vector metrics — data_analyzer.py:1383 (T5, reproduced live: inspect_peak("nu_e", use_norm=False) → IndexError on a real baseline log). Fix: collapse to 1-D before argmax or reject multi-column.
• Signed ERROR delta is desired−actual, docs say actual−desired — data_analyzer.py:1122 (C2). Norms cancel the sign so every shipped number is right; the signed per-component channel and its docstrings disagree with measurement.md’s stated convention. Fix: reconcile docstrings (or flip) once, now, before a signed consumer appears.
• pairwise_divergence swallows all exceptions as NaN — data_analyzer.py:321 (G16). The documented absent-key→NaN case is KeyError; the bare except Exception also eats genuine ValueError measurement failures — and this function backs the tolerance gate. Fix: except KeyError.
• NaN counts as above-level in threshold_crossings — data_analyzer.py:398 (T5). A below→NaN→below signal fabricates crossings; local_growth_rate legitimately emits NaN steps, so the composition is a real path. Fix: finite-to-finite transitions only.
• merge_runs can shrink a span — data_analyzer.py:373 (G16). Unconditional merged[-1][1] = end holds only for contiguous_runs-sorted input; the advertised general API has no guard. Fix: max(...).
• Even smoothing window phase-shifts λ(t) — data_analyzer.py:354 (T5). np.convolve(mode='same') with an even kernel is half-a-sample off-center; INSIGHTS documents “odd window” but nothing enforces it — time-misaligns the chaos-vs-ill-conditioning diagnostic. Fix: assert or round up to odd.
• catalog_specs fallback crashes instead of degrading — analysis/metric_catalog.py:73 (G16, reproduced). The docstring-promised namespace-without-specs shape hits .values() on a namespace. Fix: use the catalog_fields dict computed one line above.
• matched_control_windows silently drops unplaceable spans — analysis/statistics.py:276 (T5). Breaks 1:1 span↔︎window correspondence exactly in the dense-episode regime it targets; the golden test only covers spans that always succeed. Fix: raise or placeholder.
• Verification report pokes a private cache — analysis/metric_alignment.py:312 (G16). Sets DataSummary._metric_catalog from outside because DataSummary (unlike sibling SignalAnalysis) has no injection kwarg; an internal rename turns the filtered-catalog count silently unfiltered while ok stays True. Fix: add the kwarg, mirror the sibling.
• boresight_roll_figure._op rebuilds time from override-blind defaults — analysis/boresight_roll_figure.py:43 (drift). Reconstructs t = arange(n)*dt from default cfg instead of the log’s own time series (which build() already computes), so any dt-overriding stem (they exist: omega_ripple_dt010.yaml) silently mis-windows the headline “op median”. This script is also a checked-in instance of the contract’s own last-resort shim with its keep-or-retire decision still open. Fix: use view.time_window(); decide the script’s fate.
• ast_duplication skip filter hides any path containing “legacy” — analysis/ast_duplication.py:199. Bare substring, not path-component match — a future live legacy_*.py module vanishes from duplication scans. Fix: part == "legacy" on f.parts.

4. Contract & doc drift

The math sheet first — these three defeat a pencil-and-paper re-derivation, which is the defense-critical failure mode:

1. Eq 5.2 prints the opposite feedforward shape — GNC/equations/current_sota.md:472 vs com_guidance.py:320-328 (confirmed independently by two units). The doc’s a_ff = a_cd·exp(−t/τ) decays to zero; the code is a warm-start blend a_seed + (1−e^{−t/τ})(a_c − a_seed) that RISES to the live centripetal demand. The code is the intended behavior per INSIGHTS; the printed formula is stale. Fix the sheet.
2. Eq 4.1’s J_x̃e omits the coupling block the code carries — current_sota.md §4.1 vs breve_controller.py:320 (confirmed by three independent traces, including my own read). Code sets J_12 = cross(e_p) — the physically-correct rotating-frame term for a body-frame position error; both the sheet and Giordano eq 24 print block-diagonal. Per the house provenance bar, an uncited correct term is still a drift: derive and cite it in §4.1 (or confirm-and-remove).
3. Eq 6.2 documents only the full-Γ Tikhonov solve — the live 6-DOF UR3 path (z_a is None) runs a hierarchical solve (damped arm sub-solve + exact closed-form base-linear row, preserving v_c near singularities, breve_controller.py:526-541). A reader reproducing 6.3’s single solve will not reproduce live velocities near a singularity. Add the 6-DOF branch to the sheet.

Pointer bit-rot (all verified against disk):

• gnc.md:10 names GNC/guidance_classes.py; the enums live at GNC/guidance/guidance_classes.py.
• measurement.md:29 cites validation/washout_theta3_figures.py as the worked shim example; the file is deleted and line 137 of the same doc says so.
• measurement.md:103 names correlate/regress/effect_size as importable symbols; the real names are pearson_r/spearman_rho/tail_corr, linfit, cliffs_delta/event_effect_size (the copy-paste block below it is already correct).
• ANALYSIS.md:107 points at validation/regen_flat_report.py; the purge automation moved it to validation/legacy/.
• helpers.md:90 locates formatted_dict in utils.infra; it is defined in utils/printing.py (works today only via a module-scope re-import).
• The “stem IS the spec name” rule is enforced only in orchestrator.py, not in RunSpecLoader.prepare() — the gateway Runner and the baseline validators actually call (log-loader unit; no committed spec triggers it today).

5. SOTA map — current_sota.md ↔︎ code (the re-up)

Traced by a dedicated opus unit; each row re-read at the cited lines. Live path: validation/run_mission.py::run → BreveController.run_all → ControlLoop.run_control_loop.

The gnc-small unit additionally traced analytic_feedforward.py line-by-line against eq 5.7–5.18 and 4.14: every formula matches, including both published-typo corrections. Between this table, §4, and the three-way-confirmed coupling-block derivation, the sheet needs exactly three edits to be defensible end-to-end.

6. Test-coverage gaps (the ones that already bit or guard live claims)

• All 15 tests in test_signal_measurement.py are SKIPPED right now (T4; empirically run during review). The golden NPZ lives under gitignored logs/logs_*/ and the module-level pytestmark extends the skip to 5 tests that never touch the fixture (3× local_growth_rate, as_pointing_deg, reductions vocab). measurement.md’s “parity is pinned at 1e-12” is currently an unverified claim on this checkout. Fix: per-function skipif (the file already does this correctly for two tests); regenerate or commit a tiny golden fixture.
• raw_series_values’ 0-d hard-reject has no pinning test (T1) — the write-time enforcement of the NPZ contract could be loosened without any suite failure.
• units_for_item’s NaN→"" coalesce has no regression test (T6) — the exact CHAIN_7 row-dropping bug it fixed would return silently.
• The aim-clock double-call path (§1.2) and the rollout-vs-live CoM parity (§2) are also untested — both named above.

7. Modularity — ponytail-ultra ⊘ (unverified judgment calls, all safe deletions per zero-caller greps)

The architecture verdict first, because it’s the headline: the structure is load-bearing, not ceremonial. ControlLoop has-a COMController; BreveCoreController is a genuine Template Method whose per-subclass forks (RHS34b, calc_posture, v_breve_dot, reconstruct) are deliberate and documented; the guidance chain is a real 3-deep tower. The prior byte-identical duplication was already resolved by the base-class extraction. What remains is accreted dead weight:

• GNC dead clusters: x_tilde_dot/x_e_tilde_dot/x_b_tilde_dot (no caller); sample_guidance_goal + base_guidance_window (superseded); window_duration + sample_progress_anchor; dead idx param on set_ee_target; dead sign-inconsistent fake_kinematics.p_ec write; seen_triangles shadow set + provably-no-op loop (its one consumer was deleted Jun 25; logger.py’s exclude-keys for it are stale too); dead combined_score normalization branch; redundant self.g re-assignment in base_controller.
• The one lying seam: _sync_loop_state’s update_views param + _loop_sync_uses_update_views() hook are inert (param never read) while INSIGHTS documents the hook as live — delete or wire it, don’t leave it lying (com_controller.py:263).
• Duplicated math to unify: _v_breve_consistent re-derives the guidance twist finite-difference (breve_controller.py:386 vs ee_guidance.py:225); two axis-clamp implementations (_slew_limit_axis vs clamp_axis_motion — the code’s own comment flags it).
• Analysis dead weight: LogStore.__init__(spec) stored-never-read; RunOpts.allow_dirty + unused opts param; plotter’s PlotAxis.annotate/PlotLine.has_label/figure_name + unreachable list branch + line_kwargs local shadowing the module resolver; star_reporter’s object_mapping (reinvents utils.infra.object_fields), dead dataframe/rows branches, dead MINIPAGE_WIDTH; node_mapping no-op wrapper (5 call sites); SignalAnalysis’s four dead public methods (nearest_peak, signal_frame, two mode forwarders) on a ~900-line god-class with no __all__ curating the palace’s public surface; RunResult re-declaring RunContract’s five fields; stdlib swaps (html.escape, scipy.integrate.cumulative_trapezoid — parity-test-guarded).
• Not duplication (checked and cleared): star_reporter vs upstart_reporter is a deliberate, documented parallel successor mid-migration, not legacy copy-paste.

8. AX/UX — the happy path (why one-offs keep happening, and what makes rigor fast)

The AX/UX unit’s verdict: the palace hot path is correct by construction, and the skills (lab-report → sim-runner → log-driver) need no change — the friction is concentrated in the one-call surface, and each gap below is a place where the rigorous path is measurably slower than a hand-roll, which is exactly the pressure that births shadow scripts. Prioritized (P1 first):

1. P1 — v_sat is the one catalog metric measure() cannot touch (data_analyzer.py:2325): it needs a per-run v_max and the API has no way to pass it, so clip-rate questions force either 6+ lines of DataSummary plumbing or the banned hand-roll. Add v_max=None to measure/series.
2. P2 — load-once + batch: every measure(path, ...) call re-reads the NPZ and re-parses the metric catalog; k reductions cost k disk loads. Memoize _measure_view by path and add measure_many (or accept a reduction list) — and flip measurement.md’s copy-paste examples to lead with a load-once LogView, because the taught pattern currently models the reload-per-call antipattern.
3. P3 — series() has no mask= while measure() does, so band-restricted signals for plots push agents back to hand-built masks. Mirror the parameter.
4. P4 — fix back_half_pkpk composition (§3).
5. P5 — tuple() the figure-path generator (§1.7).
6. P6 — the two PONY swaps (scipy trapezoid; shared DataSummary in pairwise_divergence).

This is the palace answer to the AX/UX collision: don’t lower the rigor bar, shorten the rigorous path until it wins on speed too.

9. What is healthy (so the above reads in proportion)

The measurement hot path (z_b rms, p_e p99, frac_below) traces correctly end-to-end and parity holds by construction. LogView windowing composes masks correctly and returns NaN rather than crashing on empty windows. The mode-enum discipline is clean — zero magic strings in guidance. analytic_feedforward.py matches the sheet term-for-term. runner.py‘s controller map is complete; the # noqa: F401 guard on metric_alignment still holds all 12 names. Plotter honors the boundary (renders only, computes nothing, imports no analysis module) and render_line_panels has not crept. The reporters’ minipage/conclusions contracts are honored in both engines. Dispatch’s length is genuinely load-bearing, not bloat. The batch-1 primitives are NaN-aware and empty-guarded at every boundary the review probed except the four named in §3.

10. Method, provenance, and limits

• Rubric: .claude/skills/clean-review/SKILL.md (assimilated this session from the seven clean-code skills + the orphaned Inspection/PYTHON.md conventions). Contracts folded into every brief: gnc.md, measurement.md, ANALYSIS.md, with INSIGHTS quirk-checks to keep documented deliberate choices out of the findings.
• Verification: every bug/footgun/drift claim went to an independent refuter (default-refute-if-uncertain; opus for bug-severity, sonnet otherwise). 11 claims were refuted and discarded — including plausible-looking ones (a logger aliasing claim died because LogEntry.append copies every leaf at append time). Items marked ⊘ (modularity/style) are unverified judgment calls backed by zero-caller greps.
• Caps and holes, honestly: 3 opus units returned schema-probe stubs and were re-run (the workhorse pair ultimately reviewed via a plain-markdown agent; details in notes/structured_output_stub_footgun.md); the dedicated orchestrator unit twice returned a stub summary while its individual findings verified, so orchestrator’s health narrative is assembled from cross-unit traces rather than one dedicated pass. Not covered at all: validation/ (except its tests), utils/ (only via SOTA traces), run_spec.py, GNC/equations/ prose beyond the SOTA cross-check.
• Peer coordination: Inspection/analysis/** sits under the facade session’s CLAIM until the P5 atomic delete — every §1/§3 fix in that tree should route through or be announced to that stream; nothing was edited here.

Addendum — fix wave 1 applied (2026-07-02, user-directed)

The five live bugs plus the one-liner are FIXED (facade CLAIM honored via AGENT_COMMS ping; pathspec commits only): §1.1 cumulative now integrates with the view’s real dt (SignalAnalysis.window_reduction threads log_dt()); §1.3 run_ssh/rsync fold TimeoutExpired into the rc≠0 transport path (rc 124); §1.4 _poll_box returns {} for a reachable idle discovery poll (garbled output with expected stems stays a transport error) and cmd_status grew the finished bucket, dropping the impossible collected/exhausted ones; §1.5 summary_from_md parses line-wise and demo() now pins the adjacent-line template shape; §1.6 _metrics walks all overlay keys + secondary_keys; §1.7 relative_figure_paths is a real tuple.

Validation: 5 targeted synthetic-data checks pass (_heredocs/test_fix_wave_2026_07_02.py, transient); the analysis smoke suite’s 18 logic tests pass unchanged — its 7 failures are the pre-existing missing-fixture aborts documented in §6, upstream of every edited line. ⚠ Post-fix, any historical cumulative value is ~33× off relative to the corrected definition — re-derive before comparing old and new control-effort rows. Still open: §1.2 (aim-clock, GNC), the §2 thesis-path footguns, the three current_sota.md edits, and the §8 palace punch list.

Addendum — fix wave 2 applied (2026-07-02, user go; 29 agents across two workflows, every code change adversarially verified)

Analysis half (facade CLAIM honored via AGENT_COMMS ping; commits b2f64c9e, 7f8aa142, a8dff5b3, 3cdecc22): §8 P1–P3 landed additively (v_max= on measure/series; mtime-keyed load-once + measure_many; series(mask=)) — verifier re-ran the golden parity suite through the new cache, green (validation/tests/test_signal_measurement.py asserts abs=1e-12). §6 test gaps closed: per-function @needs_golden (5 fixture-free tests now always run) + pins for raw_series_values 0-d reject and units_for_item missing-units→"" (probed: a literal NaN does NOT coalesce — bool(nan) is True — so the pin asserts the real missing-units path, correcting this report’s §6 wording). §4 pointer bit-rot fixed across gnc.md, ANALYSIS.md, measurement.md, helpers.md (formatted_dict truly lives in utils/printing.py). All 12 GNC wiki pages reconciled (17 fixes; notes/clean_review_wave2.md).

GNC half (user unlocked Edit(Inspection/GNC/**) session-only; lock restored after):

• §4 sheet edits ALL THREE landed in current_sota.md: eq 5.2 → warm-start blend matching COMController.feedforward_accel; eq 4.1a → the [e_p]^ coupling block derived first-principles (rotating error frame transport term) with an explicit deliberate-divergence-from-Giordano-eq-24 note, SymPy witness green (_heredocs/test_coupling_block_sympy.py, 2 passed); eq 6.3a/6.3b → the live 6-DOF hierarchical solve documented. The stale closing disclaimer (“no source file was inspected”) amended to cite §5 of this report.
• §1.2 aim-clock FIXED: _aim_arclength memoized on step_idx (sentinel-initialized, cleared in reset_runtime_state); within one step every caller sees the same arclength and the floor advances once. Follow-up: three validation/legacy/ stubs build EEGuidance via __new__ and lack the memo fields (legacy is outside the standard gate; rewrite or retire).
• §2 shared RNG FIXED: default_rng(seed).spawn(3), fixed order (camera, state, actuation); legacy no-op suite 6 passed. ⚠ Any pre-fix seeded uncertainty run will not reproduce bit-for-bit post-fix; nominal (OFF) runs unaffected.
• §2 logged-wrench derate: fix applied, then REVERTED by the verify chain — validate_ee_initial_baseline.py proved the pinned EE/INITIAL rollout runs with the derate ACTIVE (max_abs_diff=1.892e-01 on control_effort.arm.omega_e_oplus; also moves tau_b and tau via F=ΓᵀG). The correction is scientifically right (logged |ω_e⊕|max 1.0398 → 0.8341 on the same rollout) but is inherently baseline-moving: landing it requires a deliberate user re-pin of every derate-exercising baseline, and accepts that historical arm-effort values under active derate are not comparable across the change. Decision escalated; tree reverted; this report’s §2 “correct today” classification was wrong for this baseline. RESOLVED same day (user ping → re-pin now): fix re-applied; movers identified (all four EE baselines at exactly 1.892e-01 on control_effort.arm.omega_e_oplus; base at 0, rs-independent, left untouched); --pin on the four movers per the baselines.md ceremony; double reproduction green (all 5 validators at 0.000e+00, seeded TARGETING/COVERAGE re-checked, behavior guards PASS — tracking slow-pkpk 4.166e-02 ≤ the 0.0862 guard, no re-level). ⚠ Historical arm-effort values recorded under an active derate (control_effort.arm.omega_e_oplus, plus tau_b/tau via F=ΓᵀG) are NOT comparable across 2026-07-02 — re-derive before comparing old and new rows (same class as the cumulative ×33 note).
• Validation of the final tree: all 5 pinned baseline validators PASS at max_abs_diff=0.000e+00 (base, ee_initial, ee_targeting, ee_tracking, ee_coverage; run locally 2026-07-02).

New contradiction surfaced (wiki reconciliation): YAMLs_by_domain/parameters.yaml:34 sets controller.com.integral.enable: true, contradicting §2’s “the CoM integral is OFF in the adopted default” masking claim for the anti-windup asymmetry — verify against the BUILT baseline config before trusting either (boarded). Also: the committed fragility_table.md is stale-or-mislabeled (notes/uncertainty_implementation_trace.md §8). Resolved 2026-07-03: the contradiction dissolved into wording — enabled-but-frozen (see the §2 G28 addendum + notes/anti_windup_verification.md).

Still open after wave 2: the anti-windup masking verification, §2 guidance-rollout CoM parity, the three validation/legacy/ EEGuidance stubs, and the §7 ⊘ modularity cleanups.

Elevator pitch

The machine is sound: equations faithful (two published typos correctly fixed, one uncited improvement found), architecture earning its keep, measurement palace correct on the hot path. The review’s real yield is seven confirmed bugs — two already in your shipped numbers (cumulative ×33, broadsheet narrative/overlay drops) and five waiting on config flips — plus a cluster of footguns sitting precisely on the singularity and risk-aware work you’re about to do (un-derated logged wrench, shared RNG, double-advancing aim clock), three current_sota.md edits that make the math sheet defensible again, and a six-item palace punch list that makes the rigorous path also the fast one.