docs(19.8): record code review disposition

.planning/phases/19.8-console-commands-overhaul/19.8-REVIEW-DISPOSITION.md

@@ -0,0 +1,118 @@
+---
+phase: 19.8
+review: 19.8-REVIEW.md
+titles: json
+findings:
+  - id: CR-01
+    severity: critical
+    disposition: open
+    title: "Lines printed above a live view are reordered and can be lost"
+  - id: CR-02
+    severity: critical
+    disposition: open
+    title: "summer delegates print a second error block and turn exit code 2 into 1"
+  - id: CR-03
+    severity: critical
+    disposition: open
+    title: "summer delegates hide the terminal from the app and merge its stderr into stdout"
+  - id: WR-01
+    severity: warning
+    disposition: open
+    title: "Ctrl+C during a spinner, progress bar or process view leaves the cursor hidden"
+  - id: WR-02
+    severity: warning
+    disposition: open
+    title: "Any console's Println and Printf are sent to whichever live view is running"
+  - id: WR-03
+    severity: warning
+    disposition: open
+    title: "summer dev kills serve 2 seconds after SIGTERM, but serve drains for up to 10"
+  - id: WR-04
+    severity: warning
+    disposition: open
+    title: "One failed open switches a daily log file off until the process exits"
+  - id: WR-05
+    severity: warning
+    disposition: open
+    title: "Error blocks, process views and tables write untrusted text to the terminal without stripping escape sequences"
+  - id: WR-06
+    severity: warning
+    disposition: open
+    title: "Setup and ApplyGlobals close daily files that other goroutines may still be writing through"
+  - id: WR-07
+    severity: warning
+    disposition: open
+    title: "PendingMigrations keeps its own copy of Migrate's migration sets"
+  - id: WR-08
+    severity: warning
+    disposition: open
+    title: "The wrong-directory hint repeats every argument, including a --password value, on stderr"
+  - id: IN-01
+    severity: info
+    disposition: open
+    title: "A forced-color console drops HideOnTTY records even when stderr is not a terminal"
+  - id: IN-02
+    severity: info
+    disposition: open
+    title: "PeekGlobals and cobra disagree on some argument forms"
+  - id: IN-03
+    severity: info
+    disposition: open
+    title: "isUsage recognises cobra's unknown-command error by its text"
+  - id: IN-04
+    severity: info
+    disposition: open
+    title: "The --json flag is read two different ways"
+  - id: IN-05
+    severity: info
+    disposition: open
+    title: "summer's scaffolding result lines are now hidden by -q"
+  - id: IN-06
+    severity: info
+    disposition: open
+    title: "fang replaces the root help function that NewRootIO installs"
+  - id: IN-07
+    severity: info
+    disposition: open
+    title: "diary pulls the whole TUI stack into security modules"
+  - id: IN-08
+    severity: info
+    disposition: open
+    title: "The console sanitizer passes raw C1 bytes through on its fast path"
+  - id: IN-09
+    severity: info
+    disposition: open
+    title: "The phase gate names consuming applications"
+open: 20
+total: 20
+recorded: 2026-10-21T22:35:50.040Z
+---
+
+# Phase 19.8: Code Review Disposition
+
+| Finding | Severity | Disposition | Source |
+|---------|----------|-------------|--------|
+| CR-01 | critical | open | - |
+| CR-02 | critical | open | - |
+| CR-03 | critical | open | - |
+| WR-01 | warning | open | - |
+| WR-02 | warning | open | - |
+| WR-03 | warning | open | - |
+| WR-04 | warning | open | - |
+| WR-05 | warning | open | - |
+| WR-06 | warning | open | - |
+| WR-07 | warning | open | - |
+| WR-08 | warning | open | - |
+| IN-01 | info | open | - |
+| IN-02 | info | open | - |
+| IN-03 | info | open | - |
+| IN-04 | info | open | - |
+| IN-05 | info | open | - |
+| IN-06 | info | open | - |
+| IN-07 | info | open | - |
+| IN-08 | info | open | - |
+| IN-09 | info | open | - |
+
+Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`.
+Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run.
+Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.