coord-sweep.sh shipped in 0.10.0 and had never run once against the real
mailbox. Measured 2026-09-03 with a denominator (docs/2026-09-03-coordination-
debt-measurement.md): 55 mailbox directories, 52 with an inbox/, 27 pending
directed messages - 23 of them pure notices, re-injected at every session start
in repos nobody had opened. The script was correct and unreachable.
WP5 (order 20260902T113745Z-1254925290) asked for a mechanism and named two
candidates. The measurement chose neither, and the first session returned the
order saying so: bulk-ack for pure notices was already built - it is this
script - so the second candidate would have been two copies of one policy, and
the broadcast class converges on its own (reading sets seen), with 34 of 263
unread pairs belonging to two mailboxes no session can hold, so a TTL would
have closed those rather than reduced them. The operator then chose the window
and authorized the schedule.
launchd/com.ktg.repo-mailbox-sweep.plist runs --write --days 14 daily at 05:30.
That is the entire behavioural change. The window is written out in the plist
rather than inherited from the script's default: it is a policy constant chosen
on a measured distribution (30d -> 0 messages, 14d -> 7, 7d -> 13), so a later
change to DAYS=14 must not silently change what an unattended job closes across
51 other repos. It runs BEFORE the 06:00 briefing agent, which scans the same
mailbox this mutates, so the morning briefing reports the debt that remains
rather than counting notices being closed underneath it.
coord-selftest.sh section 38 pins the launchd templates (242 -> 257 checks). A
wrong program path is the one defect here that nothing catches at runtime: the
agent loads cleanly and then silently never runs, with no output to be wrong
and no exit status to read. launchctl list proves an agent is LOADED, never
that it is RIGHT. The section covers every plist in launchd/, not only the new
one - the plist grammar gets one reader rather than one per agent - while
board-selftest.sh section 9 keeps owning brief-nightly.sh's behaviour. Each
plist must name a script that exists here, carry a Label matching its filename,
keep its __CHECKOUT__/__HOME__ placeholders (public mirror), and never point
into the version-pinned plugin cache.
The cache assertion runs on the extracted path, never the whole file - caught
by the check itself on its first run: the brief plist's header explains in
prose why it does not point at the cache, and a file-wide grep read that
explanation as the defect it warns about, the same shape as prose saying
status=done triggering the board's done-guard. Four controls present; mutation-
verified against the real file, where a one-letter typo (coord-sweeep.sh) turns
exactly that check red. XML well-formedness is deliberately not checked:
plutil is not coreutils, and malformed XML already fails loudly at launchctl
load - the opposite of the silent failure this section exists for.
Also fixes the README selftest-checks badge, stale at 529 since 0.25.0; the
real total is 868 (257 + 368 + 73 + 116 + 54).
Suites: coord 257, board 368, route 73, orders 116, guard 54. npm test 11/11.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WP5 asked for one of two candidate mechanisms, chosen by measurement. The
measurement chose neither.
coord-sweep.sh already IS the bulk-ack for pure notices, and it has never
run: no _sweep.log at the default path, and none anywhere under ~/.claude
(stated that way because --log can override the default, so an absent
default-path log alone would not prove it). Its own dry-run agrees exactly
with an independent classification of the same inboxes - 0 at 30 days, 7 at
14, 13 at 7 - so the gap is invocation, not mechanism.
The broadcast class converges on its own: reading records a broadcast as
seen, so a mailbox clears its backlog on its next session. 263 of 884 pairs
are unread, but 34 of those belong to two mailboxes no session can hold -
one a documented retired --to address, one with no checkout anywhere under
/Users/ktg (known-positive control: llm-ingestion-okf resolves). A TTL would
close those rather than reduce them.
What remains is running coord-sweep --write unattended, which closes mail in
51 other repos' inboxes unread. That is a decision on another repo's behalf
and a policy constant of the same class as the STATE.md line limit, so it is
left to the operator rather than shipped. No version bump: nothing here
changes behaviour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
