2026-08-26 — Bug-hunt round 8 (bughunt-b): baseline green after unshallowing

2026-08-26 — Bug-hunt round 8 (bughunt-b): baseline green after unshallowing the environment's clone (the shallow false-red itself became a finding). Five parallel hunters returned 16 substantive candidates and 7 nitpicks across the four dimensions; per-finding adversarial refutation confirmed 9 substantive and 4 fixable nitpicks and refuted 5 — the merge-queue RS001/RS002 skip (RS003 at the batch head plus the push-to-main range cover it, the attribution/external-review exemption shape), the ungated mkdocs half (adr-48's deploy-fail-closed design plus the preview job on every main push), the CODEOWNERS baseline gap (round-3 prior adjudication; external-review is strictly stronger), the site verb-roster counts (inside iss-2608231346137587's do-not-hand-fix corpus), and the site-render depth-1 gate (shallow history changes bytes, never the exit). Fixed and resolved with provenance: gitutil.RepoShaped three-state fail-closed (privacy-hygiene scan, private banlist write gate), capture/record-lint quoted-null parity at the gate, the RS001 deleted-record hole, shallow-checkout refusal in both history gates, the pre-push roster plus its detector blind spot, scanner config containment via ReadGuardedInRoot, phase-audit design-target corrections, invariant 12's SessionEnd clause assertion, the install guide's installer subject, verify-as-subset framing, skew-tripwire messages, and persona pronouns in two planned intents. Recorded open: the memory store-lock S_IFMT mask (rides iss-129), the quoted-enum impact split, and a deferral-currency detector seed.