Summary

Operator @tobiu V-B-A on 2026-05-18 ~04:30Z caught the empirical bug: 0 of 104 on-disk Discussion markdown files carry closed / closedAt in frontmatter despite #11554 having merged the frontmatter-emit fix ~1h before the most recent chore-sync ran. Two compounding factors uncovered + fixed:

• Factor A (operational, primary): MCP daemons load DiscussionSyncer.mjs at startup and don't reload on code change. The MCP server that wrote discussion-11557.md at 709d9c44f was running pre-#11554 code despite the merge.
• Factor B (architectural, latent): IssueSyncer.pullFromGitHub returns a fresh newMetadata carrying only {issues, pushFailures, lastSync}. DiscussionSyncer.syncDiscussions(metadata) and PullRequestSyncer.syncPullRequests(metadata) mutate the OLD metadata argument; without explicit carry-over those mutations were dropped at save(newMetadata), leaving metadata.discussions = {} permanently empty on disk.

This PR closes Factor B (the substrate fix) and adds a runtime integrity gate that catches future Factor A regressions at sync time. Operational re-sync from a restarted MCP daemon will heal the existing 104 files.

FAIR-band: acceptable — REQUEST-REVIEW.

Evidence: 17 tests pass across the affected specs (DiscussionSyncer 2/2 + SyncService.Stage2 3/3 with 2 new + verifyFrontmatterIntegrity 12/12 with 4 new vs cycle-1). Empirical V-B-A trace below.

Resolves #11573.

Authored by @neo-opus-ada (origin session 0526ccc8-019a-4145-84c2-52b27ef09efd).

Empirical V-B-A trace

$ grep -l "^closed:" resources/content/discussions/chunk-*/*.md | wc -l
0
$ grep -l "^closedAt:" resources/content/discussions/chunk-*/*.md | wc -l
0
$ find resources/content -name "discussion-*.md" | wc -l
104

$ cat resources/content/.sync-metadata.json | jq '.discussions | length'
0
$ cat resources/content/.sync-metadata.json | jq '.pulls | length'
0
$ cat resources/content/.sync-metadata.json | jq '.issues | length'
8519   # ← issues populated; discussions + pulls empty (Factor B signature)

Confirms: code at DiscussionSyncer.mjs:241-250 includes closed: discussion.closed, closedAt: discussion.closedAt and matter.stringify smoke produces those keys correctly under fixtures. But production-synced markdown lacks them across all 104 files including discussion-11557.md written AFTER the #11554 merge.

Fix

1. SyncService.mjs:120-126 — metadata carry-over

// 9. Carry over per-syncer metadata mutations (#11573).
//
// `newMetadata` is a fresh object constructed by `IssueSyncer.pullFromGitHub` carrying
// only `{issues, pushFailures, lastSync}`. `DiscussionSyncer.syncDiscussions(metadata)`
// and `PullRequestSyncer.syncPullRequests(metadata)` mutate the OLD `metadata` argument
// ...
newMetadata.discussions = metadata.discussions || {};
newMetadata.pulls       = metadata.pulls       || {};

Defaults to {} when syncers leave the field undefined (early-exit path).

2. ai/services/github-workflow/sync/verifyFrontmatterIntegrity.mjs — YAML-scoped integrity helper

• Parses via gray-matter (the same parser the syncer uses for serialization) and inspects parsed.data via hasOwnProperty. The check operates on the actual frontmatter substrate, NOT the full markdown document.
• Eliminates the body-line false-positive class GPT empirically caught in cycle-1 V-B-A (where a body line closed: could falsely satisfy a frontmatter-closed: check). Now: content = '---\nnumber: 1\n---\nclosed:\nclosedAt:\n' correctly returns {ok: false, missing: ['closed', 'closedAt']}.
• Handles null / undefined content + malformed YAML defensively.
• Empty requiredKeys array trivially {ok: true}.
• Convenience wrapper verifyDiscussionFrontmatter encapsulates the 8-key Discussion contract (number, title, author, category, createdAt, updatedAt, closed, closedAt).

3. DiscussionSyncer.mjs — throw-on-missing per #11573 Contract Ledger

After matter.stringify:

const integrity = verifyDiscussionFrontmatter(content);
if (!integrity.ok) {
    throw new Error(`Discussion #${discussion.number} serialized content missing required frontmatter keys: ${integrity.missing.join(', ')}. ADR 0011 / #11573 contract violation — likely stale MCP daemon code path.`);
}

Throw, not warn-only per ticket Contract Ledger AC3 ("post-sync integrity assertion fails when a synced discussion lacks a required frontmatter key"). The existing per-discussion try { ... } catch (e) at the loop boundary (DiscussionSyncer.mjs:312-314) catches the throw, logs the warning, and skips the writeFile — broken-frontmatter files are never persisted, but the sync run continues with other discussions. Net effect: per-discussion isolation preserved; broken content NEVER lands on disk.

Test Evidence

$ UNIT_TEST_MODE=true ./node_modules/.bin/playwright test \
    -c test/playwright/playwright.config.unit.mjs \
    test/playwright/unit/ai/services/github-workflow/verifyFrontmatterIntegrity.spec.mjs \
    test/playwright/unit/ai/services/github-workflow/SyncService.Stage2.spec.mjs \
    test/playwright/unit/ai/services/github-workflow/DiscussionSyncer.spec.mjs
Running 17 tests using 9 workers
  17 passed (853ms)

Coverage breakdown (cycle-2):

• verifyFrontmatterIntegrity (12 tests, +2 vs cycle-1): happy path, missing-keys detection, empty-keys safety, non-string input safety, body-line false-positive regression (GPT V-B-A reproduction), malformed-frontmatter defensive, hasOwnProperty special-char keys, Discussion convenience wrapper (active + archived + single-missing + the #11554 regression fixture).
• SyncService.Stage2 (3 tests, unchanged): metadata.discussions + metadata.pulls carry-over from per-syncer mutations onto newMetadata before save(); empty-input safety producing {} rather than undefined.
• DiscussionSyncer (2 tests, unchanged): both still pass post-import.

Post-Merge Validation

• Operator (or any agent) restarts MCP daemon from worktree on post-merge dev, runs sync_all, confirms grep -l "^closed:" resources/content/discussions/chunk-*/*.md | wc -l == 104.
• resources/content/.sync-metadata.json .discussions field populates with 104 entries (one per Discussion).
• resources/content/.sync-metadata.json .pulls field populates with N entries (one per cached PR).
• Second consecutive sync run shows skip-on-unchanged-hash log lines for unchanged discussions (cache now working).
• No ⚠️ Could not sync discussion #N: ... frontmatter keys warnings appear in sync output (all current 104 are valid; warnings would only fire on actual stale-MCP regressions going forward).

Deltas

Total: +408 / -8. No retired primitives. No canonical-file overwrites.

Cycle-1 → Cycle-2 deltas

• verifyFrontmatterIntegrity: switched from regex-on-whole-doc (^key: with multi-line flag) to gray-matter parse + hasOwnProperty on parsed.data. Eliminates the body-line false-positive class GPT empirically caught.
• DiscussionSyncer integrity call: switched from logger.warn to throw new Error(...), aligning with ticket Contract Ledger AC3 fail-on-missing semantics. Per-discussion catch boundary absorbs the throw to preserve sync-run continuity.
• Tests: added 2 new (body-line false-positive regression citing GPT cycle-1 V-B-A anchor + malformed-frontmatter defensive).

Related

• Original (incomplete) fix: PR #11555 / commit c70f2672a / ticket #11554.
• Empirical anchor: operator V-B-A 2026-05-18 ~04:30Z.
• Cycle-1 V-B-A from @neo-gpt: https://github.com/neomjs/neo/pull/11574#pullrequestreview-4307330071 (body-line false-positive + Contract Ledger drift).
• Substrate discipline: feedback_verify_effect_not_just_success (post-merge verification) + feedback_verify_before_assert (multi-layer V-B-A) + feedback_vba_completeness_layers (V-B-A must check code + test + runtime + output layers; cycle-1 V-B-A on my output-fix surfaced a new code-layer gap — cross-family V-B-A propagates discipline recursively).
• Operational follow-up: this PR does NOT trigger the re-sync itself; operator (or any agent on fresh dev) runs sync_all after merge.

_{Authored by @neo-opus-ada (Claude Opus 4.7, Claude Code) — origin session 0526ccc8-019a-4145-84c2-52b27ef09efd. Cycle-2 head: d82d7abea. Cross-family V-B-A chain: operator → me → GPT → me; substrate-discipline win shape.}