@@ -48,11 +48,10 @@ The next run is structural if a candidate scoring 6 or more has free files, else
 - A test of a re-export or forwarding wrapper belongs beside the real function: move it to the defining crate and rebuild it on that module's helpers, instead of deleting coverage the target lacks (`ui::shell_word` had no test).
 - `scan/gc.rs`'s pre-lock ledger gate (`has_ledger`) probes `--cwd`, while `run_vendor_gc` reads `project_root()` (C43): a foreign `--manifest-path` skips a due vendor-only revert. Pre-existing; it wants an issue. The preview path also drops `cargo_cache_patch_kept` warnings.
 - Pushing a branch deletion (`git push origin :branch`) is refused by the sandbox proxy. Name the branch right the first time: `arch-refactor/sweep-scan-gc-policy` is left stale.
-- `scan::hosted::run_redirect` runs only under `--json` (scan/mod.rs calls it inside `if args.common.json`); the human arm goes through `boxed_run_redirect_selected`. `run_redirect_selected` still takes `Option<Envelope>` keyed on `common.json`; making it a value touches `get.rs` (#1698) and the T24 body.
+- `run_redirect_selected` still takes `Option<Envelope>` keyed on `common.json`; making it a value touches `get.rs` (#1698) and T24.
 - The gem stale probe (`scan/hosted.rs` pass 3) has two pre-existing gaps /code-review found on #1897: it dedups vendor/cache warnings by purl string (two spellings of one installed dir can warn twice), and it names the standalone archive `{name}-{version}.gem`, missing a platform gem's suffix. Both change output, so they want an issue.
 - A dead-branch proof needs the earlier branch's exact condition: in takeover's `stage`, the residual-reference conjunct of the keep-wiring branch was dead only because `residual_only_keep` returns `Some` whenever nothing drifted. Core's `kept_for_residual_reference` also requires `kept_artifact`, which a dry-run pypi revert doesn't set, so swapping it in would not have been behavior-neutral.
 - Never restore a file with `git checkout <file>` after a mutation test while the sweep is uncommitted: it reverts the whole file to HEAD. Commit first, then mutate and `git checkout HEAD -- <file>`.
 - Making a `pub` core item private can leave public docs linking it (`rustdoc::private_intra_doc_links`); CI doesn't run rustdoc, but /code-review checks. Unlink in the same commit.
 - Folding an "is anything pending?" check ahead of a take splits one atomic step into two: keep take-then-act (durability `barrier`).
-- `hatch::require_pip_installer_documents` checks `envs` in pyproject and hatch.toml separately, ignoring that a hatch.toml `envs` key hides pyproject's: a pyproject `installer = "uv"` shadowed by hatch.toml still refuses vendored wheels and switches on the uv-sources refusal. Pre-existing and output-changing; it wants an issue (found by /code-review on #1914).
-- `HatchPlan.permission` holds whole file texts while a `HatchEdit` holds one setting line: the audit note "merge HatchPermission into HatchEdit" blurs the two, so it was reverted on review.
+- `hatch::require_pip_installer_documents` ignores the hatch.toml `envs` override (a shadowed pyproject `installer = "uv"` still refuses): output-changing, wants an issue.