red-team: area 12 round 2026-08-04 — scope-coverage diff, routing-channel finding, rearrange.cpp header correction

[ms609]

Round record for the 2026-08-04 area-12 red-team round (process meta-review, sonnet / Sonnet 5).

No closing keywords. The two findings this round produced — #41 and
#42 — are restructuring decisions for you, not things this PR fixes. They
stay open deliberately.

What's in the diff

• log.md — the round entry, and last_focus: 11 → 12. The rotation pointer only
  advances when this merges; until then a fresh /red-team re-runs area 12.
• focus-areas.md — 17 files added to rows 1/2/4/5/6, area 7 extended to the Shiny app's own
  test suite, area 8's glob broadened from test-ts-*.R to tests/testthat/*.R (it had been
  excluding ~44 of ~110 test files). Every addition annotated UNMEASURED / no inherited
  maturity, per this area's own standing lesson that a grown scope row inherits no dry verdict.
  Also corrects the start_tier rationales for areas 12 and 13, both of which still read
  "NEVER REVIEWED" despite rounds having run — area 13's since 2026-07-02, through two rounds
  that reviewed it.
• README.md — the hand-kept severity breakdown read 6/5/13 against a true 6/4/14, having
  drifted within the same round it was written, two lines above the file's own instruction not
  to maintain it by hand; replaced with a query. Plus the undocumented gh label create area:N
  dependency, a missing migration-map-todo.tsv row, and a glob-case gotcha
  (R/pp_info_extra_step.r is silently skipped by R/*.R).
• escalation-backlog.md — P1/P2 → sev: vocabulary on item 7, and an explicit
  do-not-promote-this-row note explaining why (see below).
• src/rearrange.cpp — comment only, no code change. Its header claimed "DEAD CODE … no
  functions are exported or called … Safe to remove" and that is false: the
  [[Rcpp::export]] tags are commented out, but RcppExports.cpp and TreeSearch-init.c were
  never regenerated, so _TreeSearch_nni / _TreeSearch_spr / _TreeSearch_spr_moves remain
  declared and registered in the callMethods table, are bound at R/RcppExports.R:60-68, and
  are exercised by three test files. Acting on that header breaks them. Only tbr_moves is
  genuinely unexported.

One tracker change was made and then reverted

The finder labelled #18 and #19 needs-escalation, following the skill's promote-to-label rule.
I reverted both; zero issues carry the label now, as before the round. That flag encodes only
"dispatch at opus+", and area 13's start_tier is already opus — but the real problem is
that step 3 treats a label hit as "no further reading needed for this check", so it would have
suppressed reading the backlog row that holds the actual ask (a sequencing decision, which that
row says in as many words). Generalised into #41.

Please read before dispatching the next round

Rotation reaches area 13 next, and area 13 carries a standing "NEXT VISIT: NOT another
finder — a BOUNDED EXHAUSTIVE HARNESS" verdict from 2026-07-03. Step 4 reads the entry
containing it; step 5 launches a finder regardless. This PR applies the only project-local
mitigation available — making the verdict unmissable in the rationale read at step 1 — but the
mechanical fix is a shared-skill edit, which is the decision in #41.

Checks

• spelling::spell_check_package() — clean (0 errors), run with the same invocation
  tests/spelling.R uses.

• agent-check.yml run 30908977215:
  ubuntu-arm64 success, windows failure. The Windows failure is pre-existing and
  branch-independent — it is in Set up R dependencies, before anything compiles, because
  pak cannot resolve MaxMin (Suggests:, no Remotes: field). An unrelated branch
  (claude/treesearch-issue-38-8103cc,
  run 30908703022) fails
  identically. Filed as agent-check.yml windows job fails on every branch: MaxMin is not published in ms609.github.io/packages, so pak cannot resolve it #43 rather than buried here.

  Flagging the process consequence rather than quietly merging past it: AGENTS.md says to open
  a PR "on GHA success", and right now no branch can reach that state. I have not treated a
  red check as acceptable — I have shown it is not attributable to this diff. Merging is your
  call; a docs-plus-one-comment change is about as safe as it gets, but agent-check.yml windows job fails on every branch: MaxMin is not published in ms609.github.io/packages, so pak cannot resolve it #43 should be fixed
  before anything touching the kernels lands.

  No local build was run: the only source change is a comment block, so there is no signature
  change and compile-attrs.R is not triggered.

🤖 Generated with Claude Code