v0.6.0 audit sweep: findings not yet given their own issue

This is a tracking dump of many unverified audit items, not one change. Maintainers ask you to confirm a single finding and file its own issue before coding. Start from the cited paths (src/storage/loader.ts, wikilink.ts, auto-chain.ts, cli/migrate.ts, bin/palee.ts) and reproduce against temp-dir fixtures. Done for this ticket is splitting and verifying one item, not landing a sweep-wide patch.

A 16-agent read-only audit of v0.6.0 (c02c114) ran on 2026-10-03. The high-severity items were verified and filed individually (#251, #255, #257, #258, #259, #260, #261, #262, #263, #264, #265, #266, #267, #268). What follows is everything else the sweep produced. Each was reproduced by an automated probe against fixtures under the OS temp dir with bin/palee.ts; none was re-verified by hand, so confirm before fixing.

Status: re-verified against main at 81e9c9c on 2026-10-09 — 16 fixed, 4 still open, 4 refuted (list at the bottom). The file:line citations are from c02c114 and have drifted everywhere; navigate by the PR named on each item instead. Checked means fixed and merged, not merely worked.

Loss of user-authored state

• loader.ts required a string palee_id, so a note with unreadable YAML or a numeric id failed to load and resolveWikilinkRoadmap minted a new id for the same path, orphaning every edge that named it. Fixed in #277 (4b414c4): the string rule stands — it is B7, deliberate — but the mint now refuses instead, "declares a palee_id that is not a usable topic ID … would orphan every edge", and adopt skips such notes by name.
• palee roadmap --from could re-ID an already-adopted note, after which validate reported depends on missing topic errors. Fixed in #277: an incumbent check refuses the re-ID before any write (INV-32), pinned in test/cli-roadmap-edge-integrity.test.ts. The claim's second half was inverted as written: a dangling prerequisite does not get ignored, it hard-gates the dependent, and validate counts a missing dependency as a warning because INV-24 says so.
• palee adopt overwrote hand-authored topic_mastery and difficulty on first adoption, and --fix then said "Nothing to repair". Fixed in #277: carriedPillarScores omits absent pillars instead of injecting zeros, difficulty is preserved unless --difficulty is passed, and the mastery rule skips all-pillars-absent notes. test/cli-adopt-preservation.test.ts.

Wrong target or wrong rank, silently

• vault-walker.ts matched .md case-sensitively while the resolvable-path checks folded case, so Setup.MD was invisible to loadTopics yet resolvable by [[setup.md]]. Fixed in #281 (e200597): the walk filter, stemOfNote and foldNoteKey now agree, and withWalkedCasing returns the walked spelling so an id is not re-minted under a second casing.
• No NFC/NFD folding anywhere, so a note stored decomposed was unresolvable from a composed link — an entire accented subtree under-chained on APFS. Fixed in #281, with two follow-ups: #289 (46d14cf) closed withWalkedCasing, which folded the index key but compared paths case-only and was visible only as a macOS CI failure, and #292 (open) folds the three sites this audit never named — adopt's declared-prerequisite index keys, the section scanner's dedupe key, and matchesPattern's non-wildcard branch.

Reporting that does not add up

• A lock/OCC conflict on the relabel pass set hadConflict but incremented neither stale nor failed, so the summary read Relabelled 1 of 2 notes unannotated. Fixed in #283 (9f634c8): its own counter, (N locked: re-run to retry), and exit 4.
• A note deleted between scan and write was reported as a write error ("The notes remain gated"). Fixed in #283 (c577eba): classified vanished, counted separately, dropped from the schema pass that follows.
• RelabelOutcome.unresolved was never populated on the write path. Fixed in #283: every return from the write path carries the count it just printed.
• An unknown depends_on_source label gated the note but no validation rule flagged it, so validate --json said valid: true. Fixed in #283: the dependency-list rule errors on a present-but-unrecognised label; toc-typo, weird, "", ['toc'] and 7 are covered.

Robustness

• A malformed YAML note aborted a whole batch with exit 5 and no filename. Fixed in #277: the note is named, counted, and skipped, so one bad file costs its own edge. The demanded exit 3 collides with INV-11 — an integrity error is reported, it does not abort the vault.
• One unguarded readFileSync in resolveWikilinkRoadmap let an EACCES escape as a bare stack trace. Fixed in #277: guarded, names the target, keeps cause, and the CLI prints Error: … at exit 3.
• config.ts built a temp name from pid + Date.now() with no entropy. Fixed in #285 (3dd06fe): randomBytes(4) suffix, same as atomicWrite.
• Roadmap accepted a topic path of ".md": path.extname('.md') is '', so the walker created vault/.md/.md, reported success, and hid the file from every later command. Fixed in #281: a path the walker cannot see is refused before any write, exit 3.
• toc.ts's private toRelative bypassed relativeVaultPath, so discoverTocFiles could return paths outside the vault when the root is a junction. Fixed in #281: the shared helper is the only path now, and it re-derives from canonical endpoints.

Release health

• The PR matrix omitted the legs that broke (macOS heap limit, case-fold, symlink suites), and a tag push ran release.yml only, so a published artifact was never tested on macOS or Windows. Fixed in #285 (one event-independent 7-leg matrix, tags trigger CI) and #283 (test-platforms gates publish-npm), pinned by test/ci-workflow-matrix.test.ts.
• toc-chain.ts still commented the default tier as full; the default is strict. Fixed in #285.

Still open — needs a decision, not just a fix

• Advisory quarantine ignores depends_on_source (dependency.ts, plan.ts): a cycle made only of advisory toc/tie edges still empties plan's ready list. INV-25 ("cycles are quarantined") and INV-46 ("advisory edges never hold a note off the ready list") genuinely disagree, so this needs an owner ruling before code. Two halves of the original claim were wrong: plan prints Quarantined Cycles and exits 0, and the exit 3 comes from validate, which is deliberate containment. An advisory-only loop also cannot be created by adoption (the plan is asserted acyclic pre-write), so it takes hand-edited labels.
• plan can list one note under both Reviews Due and Blocked by prerequisites (plan.ts): any note with no due_at counts as due and any non-ready acyclic note with an unmet prerequisite counts as blocked, and nothing dedupes them. The Learning: 0 / New: 14 half of the claim is correct arithmetic, not a defect, and "Due: Never reviewed" in next.ts is deliberate; dashboard.ts disagrees with plan.ts about due, not about new. Owned jointly with #209, which touches both files.
• A SIGKILL mid-write leaves a permanent stray *.tmp.<pid>.<hex>: cleanup is only the in-process error path, and no startup sweep exists. Low impact — the stray ends in .tmp…, so no enumerator sees it, making it vault litter rather than data loss. A reaper means deleting files in a user's vault, which is a policy decision, and atomic-write.ts is the file #264/#280 just landed on.
• palee assess records no provenance for topic_mastery and lowers a score with no --force or dry run, so dependents re-hide behind the new number. "Silently" is imprecise — the count is printed, just after the write. A remedy exists but is unmerged: --force/--dry-run plus assessment_source: 'manual' on fix/269-audit-sweep (d7fe96c). Needs a frontmatter key, so it is a schema change (docs/05-1, ADR-0004), and INV-37 makes assess the sole mastery writer today.

Refuted when re-verified — do not fix these

• [[C#]] truncates at #. Stripping the anchor is the specified Obsidian rule (INV-48), pinned by test/engine-auto-chain.test.ts; [[F#]] failing closed is the documented exit-3 path. e200597 left the residue — a note named C#.md — deliberately, and the TOC sibling of that class shipped in #279.
• A fence opened inside a list item swallows later bullets because FENCE_LINE anchors ^ {0,3}. The regex does match a two-space opener, so the stated mechanism is wrong and the links survive. Worth confirming separately, and not yet verified by hand: an opener indented 4+ spaces (a nested list) is unrecognised, and its dedented closer then opens a fence that runs to end-of-file. Same harm class, different trigger — re-reproduce before filing.
• The enumerating README.md receives a prerequisite from the last lesson it lists. Ran it: guide/README.md ends with depends_on: [] at tier toc, because groups are built from the enumerated paths' parent directories and the enumerating file is not among them. A README can be chained when a different note's Contents lists it — that is that author's ordering claim, which is the tier's whole point.
• _meta/ should be in EXCLUDED_DIRS. The name appears nowhere in src, docs, planning, test, examples or .github, so excluding it would invent a convention the project does not have; WalkOptions.excludeDirs covers a caller who does use it, though no CLI flag reaches it today. Declined on the same reasoning in e200597.