audit.toml (root) — inert. cargo-audit reads `.cargo/audit.toml`, and that file
exists and carries the live ignore list. I proved the root file has no effect
with a controlled A/B on this repo's Cargo.lock against a real advisory
(RUSTSEC-2025-0141): with the ignore in `./audit.toml` the advisory is still
reported; with the same ignore in `.cargo/audit.toml` it is suppressed. Every
directive in the root file is commented out, `cargo audit` 0.22.1 has no
`--config` flag, and .github/workflows/security-audit.yml:31 runs it bare. The
`'**/audit.toml'` paths trigger at security-audit.yml:11 is a glob that matches
`.cargo/audit.toml` too, so nothing breaks — but it means editing the inert file
fires CI and looks like it took effect.
assets/locale-config-step1.jpg, assets/locale-config-step2.jpg — orphaned since
b5b4d49324, which removed the README.zh-CN locale walkthrough that embedded them
(`-`). `git grep -l -i
locale-config` returns nothing; GitHub code search finds no reference in any
indexed fork. The only tracked asset any README references is
assets/screenshot.png, which is what web/lib/public-surface-contract.test.ts:539
asserts. They are also stale in content: step1's status line reads
`agent · deepseek-v4-pro · draft` and step2 sits beside a `DeepSeek T…` sidebar,
i.e. pre-Codewhale branding and a mode word outside Plan/Act/Operate.
docs/TUI_PARALLEL_REVIEW_2026-07-12.md — 276 lines scoped at lines 3-5 to "the
uncommitted + local diff on branch codex/underwater-tui-20260711". That branch
does not exist (`git branch -a --list '*underwater-tui*'` is empty), so the
headline P0 ("does not currently pass `cargo clippy -D warnings`, 37 errors") is
unfalsifiable by construction. Its concrete P0 items are closed or wrong:
settings_picker/transaction.rs does not exist; `composer_owns_printable` has
zero hits; `format_usage_chip` is consumed (route_billing.rs); the
`PrefillCommand` item was closed by the doc's own third remedy —
crates/tui/src/tui/app.rs:841 now carries `#[allow(dead_code)]` with a
TUI-DOG-008 note. Its cited style-lint line numbers now land on unrelated code
(settings_picker/mod.rs:352 is a test assert; views/fleet_setup.rs:1851 is a
panic arm). P1.1 and P1.2 are also resolved — SpawnRequest now carries
write_authority and expected_artifact (subagent/mod.rs:1714,1717) and
AgentsInterruptTool gets its caller (coord.rs:704). `rg 'TUI_PARALLEL_REVIEW'`
across the repo including .github/ and scripts/ returns nothing.
One item in that review is still open and does NOT die with the file, so it is
recorded here: P1.3 — crates/tui/src/tui/streaming/mod.rs:91 `note_delta` still
hardcodes `note_delta_with_backlog(now, 1, None)`, and every caller passing a
real backlog is a test (:885, :894, :912), so the full-motion catch-up path is
unreachable in production. That deserves an issue.
Hmbown
91840fe9d0
