[Epic] Deferred review findings sweep — PR #313 (12 Important + 17 Minor)

[DrumRobot]

Tracking issue for the review findings that #313 deferred at merge time.

#313 merged on 2026-08-16 (merge commit 2d9308ab3e7e0086a88a7f64d3ed4d5c4d36e017). Its one Critical — duplicate (event, matcher, script) registrations in hooks/hooks.json — was fixed in-PR (a9b6831) before merge. 12 Important + 17 Minor/Nitpick were deferred to author follow-up and have had no tracker of their own since. This issue is that tracker.

Sources (full file:line detail lives here, not duplicated below):

• Internal Code Review
• AI Review Summary

Re-verify before starting each item

The list below is transcribed from the deferred record as written at merge time. Two things have moved since:

• fix(hook-kit): sync 7 diverged hooks from es6p-hooks canonical #326 and fix(hook-kit): relocate cleanup/wip-owned guard hooks to their owning skill #330 both touched hook-kit afterwards, so some items may already be resolved.
• fix(hook-kit): relocate cleanup/wip-owned guard hooks to their owning skill #330 relocated several guards out of hook-kit/resources/ into the resources/ of the skill they gate, so the paths recorded at merge time no longer resolve for those files.

Three items were spot-checked on 2026-08-17 and are annotated below. The rest carry no verification — check current state before working one.

Important (12)

• claude-session/list.md:91-92 — GNU-only ls flag, plus a sort whose UUID field offset is wrong
• fix-plan/claim.md:38 — lease acquisition is TOCTOU
• fix-plan/SKILL.md:98 — recency marker referenced but never defined
• fix-plan/SKILL.md:136 — pm-handoff contradicts the file's own ask-skip HARD STOP
• git-repo/rebase-audit.md:40 — index vs working-tree description is inverted, and the git add shown stages whole files rather than the hunk the surrounding text describes
• hook-kit/resources/ask-guard.sh — push-detail regex fails in both directions (false negative and false positive)
• hook-kit/resources/block-ask-without-token-measure.sh:17 — not registered in hooks/hooks.json; dead code
• hook-kit/resources/block-ask-without-token-measure.sh:40 — regex is unanchored
• [verified still open 2026-08-17] block-cleanup-option-below-context-gate.sh (now cleanup/resources/, was hook-kit/resources/) — HAS_CLEANUP holds a jq ... | length count but is compared against the string "1" (3 sites). An ask carrying 2+ cleanup-matching options yields "2", every branch falls through, and the gate silently enforces nothing
• [verified still open 2026-08-17] block-manual-handoff-web-task.sh (hook-kit/resources/) and block-cleanup-missing-rename.sh (now cleanup/resources/) — neither Stop hook guards on stop_hook_active; both still contain 0 occurrences
• [likely resolved 2026-08-17 — confirm before closing] hooks/hooks.json — the two scripts above were recorded as unregistered; both now appear in hooks/hooks.json
• hook-kit/resources/block-agent-spawn-without-model.sh — 3-gate branching logic with zero tests
• 2 further Important items — the record above names 10 as representative; recover the remaining 2 from the Internal Code Review comment

Minor / Nitpick (17)

• Sweep as one batch from the AI Review Summary table — these were not enumerated in the deferred record, only counted

Scope

es6kr/skills only. Deferred findings from other PRs are tracked elsewhere: #94 covers 66/90/91/92/81, #295 covers 292, #189 covers 143. Groups from 111, 50, 268/285 remain unbundled and are deliberately not in this issue.