Name owners of the iPad runbook's restated counts; label the campaign note's UTC times as EDT

[KyleMit]

Campaign unit F210 of the ship-campaign parallel=3 run tracked in #2529: follow-ups 2 and 10 from the #2500 leftovers comment. Docs and skill-note prose only; no code changes.

Refs #2529
Refs #2500

Spec (free-form unit, no issue)

• Follow-up 2. A doc restates a value. The engine-gates bullet in docs/PROFILING-IPAD.md said "22 strokes runs two past the depth-20 cap". It should name the owners, not repeat their values, and keep the meaning: the probe deliberately overflows the undo cap so the overflow path runs. Then fix any other restated cap or count in the same file.
• Follow-up 10. A timezone slip in a skill note. .ruler/skill-notes/ship-campaign.md.template gave the WebKit lag as "gates for merges at 16:36 started at 19:45". Those are UTC, next to EDT times elsewhere in the note. They should read 12:36 and 15:45 EDT, with the zone labelled. Fix any other bare UTC time in the note too. Minimal diff on that line: draft PR 2537 (parallel campaign Ship campaign: #2500 leftover decisions and follow-ups #2530) changes the serialized WebKit gate that paragraph describes, so only the two timestamps and the zone label change there.

Done when: each restated cap or count names its owning identifier and file, and every UTC time in the note reads in EDT with the zone labelled. ruler:apply output is committed, and ruler:check, check:doc-refs, check, lint and test:browserless pass.

Follow-up 2: docs/PROFILING-IPAD.md

Every fix below names an identifier that npm run check:doc-refs -- --identifiers resolves against tracked source. The advisory list flags no new unresolved identifier; its only hit in this file is the existing autoMode at :568. Restating a number gave that check nothing to catch.

Where	Was	Now names
:720 engine-gates scenarios (the follow-up)	"four real-volume scenarios — 22 long ~1200-op squiggles, 22 five-finger ~2400-op drags, …; 22 strokes runs two past the depth-20 cap"	the probe's STROKES, OPS (single-pointer strokes) and MULTI_FINGERS * MULTI_PER_FINGER (five-finger drags); the gates-run default MAX_UNDO_DEPTH + STROKES_PAST_UNDO_DEPTH; the app cap MAX_UNDO_DEPTH in web/src/lib/drawing/undoHistory.ts. The point is kept: the run draws past the cap so the overflow path executes. The table's scenario column prints each row's actual stroke count.
:732	"unset runs all four"	"unset runs them all"
:771 Timeline mode	"roughly a twentieth of the volume — 6 strokes of ~200 ops instead of 22 of ~1200 … Six strokes is plenty"	the TIMELINE branches of the probe's STROKES and OPS defaults, which have no named constant. Per the spec, the doc names the owning constants and does not invent new ones.
:151 code-block comment	"all four scenarios"	"every scenario"
:267, :273 example comments	"after twenty commands", "a thirty-command history … undo all retained steps" (derived from the gesture's stroke count)	"two gesture repeats", "a three-repeat history … undo every retained step (MAX_UNDO_DEPTH)". That ties the example's literal --undo-count=20 to its owner.
:291 base gesture	"two long interpolated strokes and eight short strokes"	trustedGestureActions, LONG_STROKE_SEEDS, SHORT_STROKE_ORIGINS, STROKES_PER_GESTURE_REPEAT in tools/perf/ios/capture-xcuitest-screen.mjs
:312 forensic episode	"a frame gap over four presentation budgets"	STARVATION_FRAME_MULTIPLE in tools/perf/lib/real-screen-stats.mjs
:387 hand-input cap	"(maximum 60 seconds)"	HAND_MAX_SECONDS (derived from PROBE_CONTACT_BUDGET_MS) in tools/perf/ios/capture-xcuitest-screen.mjs

Scope line (decided by the worker, recorded here). This PR fixes restated caps and counts, the classes the unit names. It leaves:

• Gate definitions: the ADR-0086 gates (:308), the drawing budgets (:346), the action-suite gate rule with its repeat split and confirmation count (:404), and the ADR-0066 undo and commit gates (:941, :944). Those sentences quote a gate's thresholds beside the ADR that decided them. Naming only their counts would leave a sentence that mixes identifiers and values.
• Values: the secure-origin root's default lifetime, "730 days" at :460 (DEFAULT_AUTHORITY_DAYS), and the preview port 4173 (:675, :847, :882).
• External facts and measurements: Apple's 825-day leaf cap, 120 Hz ProMotion, WDA's 8100, and every measured table.

Everything left in the first two bullets is in the "Drafted follow-ups (not filed)" comment.

Follow-up 10: .ruler/skill-notes/ship-campaign.md.template

I checked each time against GitHub, not the brief. September is EDT = UTC−4.

• :177, the unit's line. Merge Make the port-ownership listener fail loud when it never starts #2496 (Tests run 36598998904, created 2026-09-29T16:36:51Z) started its WebKit commit gate (fast) job at 19:45:54Z. So the line reads 12:36 EDT … 15:45 EDT, which matches the Code-smell burndown campaign, 2026-09-29 evening (4 hours) #2500 ledger ("Merges at 12:36 EDT had gates starting at 15:45 EDT"). Only the two timestamps and the labels changed. The template line runs 107 columns and is not reflowed. .md.template is outside dprint's **/*.md includes, and other templates already exceed 100. The generated mirrors are reflowed by ruler:apply's dprint pass.
• :58, another bare UTC time. "2026-09-11: … stalled from 03:21 to 08:47" is UTC. PR 1764's last pre-stall commit is at 03:10:14Z, and the Claude rival's round-1 review landed at 08:54:55Z. An EDT reading would put the stall's end at 12:47Z, four hours after that review. It now reads "Overnight 2026-09-10 to 11: … from 23:21 to 04:47 EDT". The date changes because 03:21Z is 23:21 EDT the evening before.
• :70–71, another bare UTC time. "2026-09-12: … stopped at 05:06 … the user answered at 08:08" is UTC. PR 1829 merged at 05:06:26Z and the next unit, PR 1830, opened at 08:11:41Z. The EDT reading has no idle gap: PRs 1833 and 1834 were active at 09:06Z–09:10Z. It now reads 01:06 EDT … 04:08 EDT.
• Already EDT, left bare: 09:57 and 12:00 (:140–142, the Code-smell burndown campaign, 2026-09-29 (8 hours) #2467 ledger runs "05:00 → 13:00 EDT"), 16:44 (:163, PRs 2504, 2506 and 2508 merged 20:45–20:46Z) and 17:48/17:56 (:182). The 22:00/03:00 at :65 is an illustrative local time, and 03:50 EDT/06:00 at :91 is already labelled.

I chose EDT over labelling these UTC so the note reads in one zone, the one the rest of it and the #2500 ledger use. The "overnight / at bedtime" framing of that section also only makes sense in local time.

Generated mirrors from npm run ruler:apply: .claude/skill-notes/ship-campaign.md, .agents/skill-notes/ship-campaign.md.

Commands

• npm run ruler:apply: exit 0. npm run ruler:check after committing: exit 0, "Generated agent files are in sync".
• npx dprint check on the three Markdown files: exit 0.
• npm run check:doc-refs: exit 0. -- --identifiers (advisory): no new unresolved identifier.
• npm run check: exit 0. npm run lint: exit 0. SMOKE_PORT=5323 npm run test:browserless: exit 0, "all 5 checks passed".

No startup-path module is touched (n/a for the bundle budget). There is no new guard, so no negative control applies.

Coordination

• No open codex/* PR covers follow-ups 2 or 10 (checked with gh pr list --state open). This PR does not touch draft PR 2537's files, and the edit on its paragraph is limited to the two timestamps and the zone label.
• Merge path: unrelated. After review, git fetch origin main and node .claude/skills/reconcile-with-main/survey.mjs reported "Relation: unrelated". Upstream changed 12 files and none overlaps this branch. They belong to the D7+D8 and D9 lanes: the generate-image route, generationStart.ts, openai*.ts, ADR-0023, ADR-0063, docs/API.md and docs/ARCHITECTURE.md. I merged 077c34f as 33f4e36, then reran check, lint, check:doc-refs and ruler:check. All exited 0.

Review

• Round 1 (Codex rival, review): one blocking finding. "Strokes of about OPS ops" was wrong for the five-finger drags, which run at MULTI_FINGERS * MULTI_PER_FINGER; the rival ran the probe against a mock engine and got 1,200 vs 2,400 ops. Fixed in 1c2688c, then the thread was replied to and resolved. The rival's one unverified item was ruler:check in its own sandbox, which failed with EPERM on .agents/. I declined to run it in the rival's worktree because my harness refuses git outside my own worktree. I supplied the passing result on the same head instead.
• Round 2 (resumed, review): no findings. The rival confirmed the fix by running the probe again (22 strokes per scenario; 1,200 vs 2,400 ops) and found no new defects.

Merge approval on record for this campaign (user, verbatim): "Merge approved throughout the season". The orchestrator performs the merge.

🤖 Generated with Claude Code

[KyleMit]

Independent review by the codex rival agent, round 1, of pull request 2545.

Reviewed every changed line, including both generated copies. Verified the rewritten claims against code and executed the probe, gesture builder, hand-input validator, and starvation-threshold logic. Document-reference and formatting checks passed. GitHub evidence supports the EDT conversions; the WebKit template edit preserves the required minimal diff. One factual workload-description defect needs correction.

Unverified

• Would the generated-file drift check pass in this disposable checkout? — wanted git status --porcelain && npm run ruler:check; Local ruler:check failed with EPERM in the read-only .agents tree. The handler declined the exact command because its harness forbids git in other worktrees, but reported ruler:check passing on the same reviewed commit in its own clean worktree.

[KyleMit]

Independent review by the codex rival agent, round 2, of pull request 2545.

Round-one blocking finding: fixed. The revised bullet correctly distinguishes OPS per single-pointer stroke from MULTI_FINGERS * MULTI_PER_FINGER per five-finger drag. Executing the actual probe confirmed 1,200 versus 2,400 ops and 22 strokes per scenario. The undo-overflow explanation remains intact, and the wording reads clearly. Document-reference and formatting checks passed. The handler supplied successful ruler:check evidence for the prior unverified item. No new defects found.

[KyleMit]

Drafted follow-ups (not filed)

These came out of this unit's sweep of docs/PROFILING-IPAD.md. Each one fell outside the unit's classes (restated caps and counts) or outside its declared file set. They are drafts for the owner to file or drop. None has been opened as an issue.

1. The iPad runbook restates its gate definitions

Labels: type:docs, area:ci-testing (no area:perf label exists; the perf harness sits closest to CI tooling)

docs/PROFILING-IPAD.md quotes gate thresholds, and the counts in the action-suite rule, that code constants own:

Where	Restated	Owner
:308	ADR-0086 gates "engine P95 ≤20 ms, next-frame P95 ≤33 ms, next-frame max ≤50 ms"	UNDO_ENGINE_P95_GATE_MS, UNDO_NEXT_FRAME_P95_GATE_MS, UNDO_NEXT_FRAME_MAX_GATE_MS in tools/perf/lib/undo-action-stats.mjs
:346	drawing budgets "paint P95 ≤20 ms, P99 ≤33 ms, max ≤50 ms, lost frame time ≤1%"	PAINT_P95_GATE_MS, PAINT_P99_GATE_MS, PAINT_MAX_GATE_MS, LOST_FRAME_TIME_SHARE_GATE in tools/perf/lib/drawing-gates.mjs
:404	action suite "default four-repeat … one warmup and three scored … 20 ms … 33.5 ms … two of the three scored repeats"	the --repeats default in tools/perf/ios/capture-xcuitest-actions.mjs, an inline literal next to ACTION_REPEATS in tools/perf/lib/campaign-plan.mjs; WARMUP_REPEATS, MIN_GATED_SAMPLES, ACTION_FIRST_FRAME_GATE_MS, ACTION_FRAME_MAX_GATE_MS, MAX_BREACH_CONFIRMING_SAMPLES in tools/perf/lib/action-stats.mjs
:941, :944	ADR-0066 "undo p95 ms < 50" and "commit max ms ≈ … 8.3 ms"	the gate lines tools/perf/probes/engine-gates.js prints

Why it wasn't done here: these sentences are gate definitions, quoted beside the ADR that set them. Naming only their counts would leave half-converted sentences. The unit's classes were caps and counts.

Decision needed: name the owners, as this PR does for workload counts, or keep the numbers for runbook readability and add a drift-guard test that reads the doc's gate numbers against the constants.

Worth its own issue: yes.

2. Other restated values in the iPad runbook

Labels: type:docs, area:ci-testing (no area:perf label exists; the perf harness sits closest to CI tooling)

• :460: "The root lasts 730 days" restates DEFAULT_AUTHORITY_DAYS in tools/perf/ios/secure-origin.mjs, which --days= overrides. The :450 heading's "about every two years" is derived from it.
• :675, :847, :882: port 4173, which the perf:serve script owns.

Worth its own issue: fold it into the first draft if that one is filed.

3. package.json scripts-info restates the hand-input cap

Labels: type:docs, area:ci-testing (no area:perf label exists; the perf harness sits closest to CI tooling)

The perf:ios:bundled:frames entry in the scripts-info block says --seconds=N (maximum 60). That restates HAND_MAX_SECONDS, which is derived from PROBE_CONTACT_BUDGET_MS in tools/perf/ios/capture-xcuitest-screen.mjs. This PR fixed the same restatement in the runbook. package.json was outside the unit's declared file set.

Worth its own issue: small; it could ride along with the first draft.