--- name: bug-museum-data-layer description: "The Bug Museum's data layer: bugs/<slug>/record.md format, ratchet-test result, curation decision, and the mockup-specimen-08 correction" metadata: node_type: memory type: project originSessionId: 0072641d-0832-4943-9105-dde864b03010 modified: 2026-07-21T18:05:11.759Z --- DONE (2026-07-21, commit ab4ca16, local only — never pushed). Built the structured defect records the Bug Museum needs (`museum/design/.../04-bug-museum-records.html`), because a generator can't infer "this was a defect" from prose. **Format:** `bugs/<slug>/record.md` at repo root, parallel to `graveyard/` and OUTSIDE `museum/` (museum/ is excluded from the manifest walk). YAML front-matter + fixed `##` body sections. Load-bearing fields: `caught_by`, guard + `guard_location`, **what the guard costs**, `verified`, `provenance` (commit refs mandatory). Lifecycle `status`: SEALED / IN-FLIGHT / ANTICIPATED / OPEN. Spec in `bugs/README.md`; full reasoning in `bugs/BACKFILL_REPORT.md`. **Ratchet test (Protocol 36b):** 168/204 (82%) app fix-commits pair with a guard/test change in the same commit. The 36 that don't are mostly doc-only "fixes", pre-gate early history, or visual defects with no cheap code guard. The ratchet holds where a code guard is cheap; its blind spot is the room's best specimen class (human-caught defects). So the format does NOT assume a code guard exists. **Curation decision:** `exhibited` is HAND-SET at record birth, paid for with a truthful `lesson` line — NOT derived. Justified against the project's hand-flag distrust: it tracks no moving state (a birth-time placard, like graveyard's one_line), no honest structural proxy exists, and a derivation is itself mis-fireable. Wall ordering/cap handed to the generator (a report item, not built). **Going-forward obligation:** recommended (not created — app owns protocol numbers) as per-commit *practice* + per-*release* enforcement (the --release ritual is the only real enforcement point; per-commit can't be mechanically checked). **Corrections filed:** (1) "every bug recorded" can't mean one-per-git-fix without fabrication — scope is every defect the sources document richly enough; app-vein backfill is exemplary not exhaustive (dozens of `planning/2.8.5/audits/` un-mined). (2) Mockup specimen 08 (cross-game) was WRONG — it's a data-integrity bug that deleted real save data (commit 2210b57, AUDIT_registry_leak.md), not the cosmetic skin bug the mockup showed. (3) Right now every app-side record is IN-FLIGHT (app pinned to v2.8.0; 2.8.5 untagged). 11 records: 8 wall specimens + [[museum-lf-normalization]] (crlf-page-rename) + ai-inventory-overwrite. Related: [[museum-readme-txt-leak]], [[museum-thumb-render-nondeterminism]], [[museum-path-based-naming-and-redirects]] are the archive-vein specimens' source material. **WIRED 2026-07-21 (commit 4d0cac3, local only).** `museum/generate.mjs` now globs `bugs/*/record.md` and renders `bugs.html` (the four hand-off items from the report, all built): (1) IN-FLIGHT→SEALED promotion via `git merge-base --is-ancestor` on the first provenance entry's commit hash(es) against the PINNED release — not `git tag --contains` as the README suggested, because that would check any tag, not specifically the pin the rest of the museum is disciplined to; currently a no-op (both app records' 2.8.5 commits aren't ancestors of the v2.8.0 pin yet — correct, not a bug). (2) Wall ordering = named-Protocol-rule first, then observed date desc; capped at 16 (no-op at 10/10). (3) Release coverage note ("N fix-commits since last release, M records cite one") computed fresh from git + provenance, never hand-typed. (4) Honest gaps render as gaps — missing section → "Not recorded", no guard → "No guard exists yet", unlabelled cost → "Cost not documented"; body sections rendered in full (not just front-matter one-liners) so hedged attributions like silent-flatline's unconfirmed "owner's eye" pass through verbatim. Cross-game specimen confirmed rendering the RECORD's corrected data-integrity account, not the mockup's cosmetic framing, plus its two real BUGGY/FIXED captures with captions derived from filename (last hyphen segment). Also fixed `classify()`: `bugs/` was falling into 'unclassified' before this, tripping the lobby's integrity-report false alarm — now classified like `graveyard/` (real doc page + structured room reads it directly, same precedent, not double-counting).