docs(agents): add CI failure-signature triage catalog and index the know-how stores

AGENTS.md

@@ -99,6 +99,16 @@ history, never the organization's actual state.
   conclusions.** Sessions here share a model and tend to share blind spots. A
   read-only `codex exec -s read-only -C <dir> "<prompt>"` pass has already
   caught a factual error in this very section that same-family review missed.
+- **Your working tree is not evidence until you prove it is current.** A
+  long-running session's checkout drifts while `main` advances roughly every
+  20 minutes; on 2026-09-05 one session's `.github` tree was 218 commits
+  behind, and from it re-derived an already-fixed bug and cited line numbers
+  that do not exist on `main`. At every wake, and before reading any file you
+  will reason about, run
+  `git fetch origin main && git rev-list --count HEAD..origin/main`. If that is
+  non-zero, read files as `git show origin/main:<path>` or in a fresh
+  `git worktree add <dir> origin/main`, and never quote a line number you did
+  not read from `origin/main`.
 
 ## Verifying a "superseded — closing" claim
 
@@ -212,3 +222,34 @@ them alone proves succession.
   variable in CI, so a failure class exists that cannot reproduce locally. Before calling a
   scheduler change clean, run the affected tests both ways, including
   `GITHUB_ACTIONS=true python3 -m pytest <paths>`.
+
+## Where accumulated know-how lives
+
+Durable agent learnings are recorded in this repository, not in any session's
+private memory. Read the relevant store before working on the surface it
+covers — these records exist so the same class of bug is not reintroduced, and
+they only pay off when an agent other than their author reads them.
+
+- [`docs/doctoring/ci-failure-signature-triage.md`](docs/doctoring/ci-failure-signature-triage.md)
+  — string-matchable catalog of the recurring red-check signatures across the
+  three repositories (`opencode-review` wait-for-verdict, `strix` stale
+  `workflow_sha`, `noema-review` gateway 502, expired NIM cost evidence,
+  unscoped `pytest` collection, stale `head_sha` notifications,
+  queued-versus-failed, same-anchor merge conflicts, futile CodeQL compat
+  re-runs, cancelled-versus-failed and auto-update check starvation, and
+  drafts that no gate will ever approve, review, or rebase, and the Pingora
+  policy's 1 MiB Contents-API ceiling on oversized text), each
+  with its verified mechanism, the action to take, and the
+  actions not to take, plus the rule for deciding when a re-run can help at
+  all. Also carries the
+  research-grounding freshness KPIs, their measured baseline, and how to count
+  them without a masked API error manufacturing a phenomenon.
+- [`.jules/bolt.md`](.jules/bolt.md) — dated performance learnings for
+  `scripts/ci/` as `**Learning:**` / `**Action:**` pairs. Scan it before
+  optimizing anything on that surface.
+- [`.jules/sentinel.md`](.jules/sentinel.md) — dated security learnings for the
+  same surface as `**Vulnerability:**` / `**Learning:**` / `**Prevention:**`
+  triples, covering HTML-comment breakout in serialized JSON, cross-language
+  redaction parity, `shell=True` "security theater", and SSRF via redirects.
+  Scan it before hardening anything on that surface.
+- `docs/doctoring/` — per-incident and per-decision records generally.

CLAUDE.md

@@ -220,3 +220,16 @@ repeatable compile command.
   fence. Do not check by counting fences — a split leaves four where there were two, so an even
   count proves nothing. The damage can also arrive inherited, from an earlier commit on the same
   branch or from the autofix flow's conflict-marker resolution.
+
+- **Triage a red required check by signature, not by guesswork.**
+  [`docs/doctoring/ci-failure-signature-triage.md`](docs/doctoring/ci-failure-signature-triage.md)
+  catalogs the recurring failures across `.github`, `noema`, and `contextual-orchestrator` — the
+  `opencode-review` wait-for-verdict fail-closed, `strix` running stale trusted source because
+  `workflow_sha` is pinned at run-creation time, the `noema-review` gateway 502 that nothing re-runs
+  automatically, expired NIM cost evidence, `agent-review-runtime-quality` failing on tests the PR
+  never touched because its `pytest` call has no positional path, and queued-versus-failed. Each entry
+  gives the verified mechanism with `file:line`, what to do, and what not to do. Two of those
+  signatures look like a defect in your PR and are not. Read it before "fixing" a red check whose
+  cause you have not confirmed, and before merging `main` into a branch — main is frequently the
+  broken side. `AGENTS.md` also indexes `.jules/bolt.md` and `.jules/sentinel.md`, which are the
+  performance and security learnings for `scripts/ci/`.

docs/doctoring/actions-queue-saturation-hourly-sweep.md

@@ -1,8 +1,20 @@
 # Actions queue saturation: hourly organization sweep
 
-**Status:** active repair evidence
+**Status:** HISTORICAL / SUPERSEDED — preserved as RCA and repair evidence; not current behaviour
 **Owning repository:** `ContextualWisdomLab/.github`
-**Canonical repair PR:** `#1630`
+**Canonical repair PR (historical):** `#1630`
+**Superseded by:** `#1878`, merged `1b65dbc35e7183722ad77894e2d80b39993be90d`, which removed the
+organization-wide `org-queue-sweep` source outright; later lineage adds
+`85f4ef926feed08cf502a8e6bf26e495a0bb7bed` ("ci(actions): fold head coalescing into scheduler").
+Both are ancestors of protected `main@c9052e607e5f3cc76e73207e7786b21500721b79`, whose scheduler tree
+contains no such job.
+
+> **Read the rest of this document as history.** The 15-minute admission, the hourly heartbeat that
+> replaced it, and the rotation-counter cadence all describe a job that no longer exists. Nothing
+> here is a current production contract, no new deletion implementation is required, and this
+> document must not be cited as evidence about present queue behaviour. The RCA and the repair record
+> are kept intact deliberately.
+
 **Protected baseline:** `main@4ae90e18b03a3a455e13e501628010cabc5c37a8`
 
 ## Root cause