docs(6209): task document, query scrubbing, note pipeline, lesson door, live body, ledger clear, rule usage

Seven more test files: docstrings and comments state the property and its
reason, the SQL-twin note states why `\m` and not `\b` without the install
it broke, and fixture provenance says "real near-miss queries" rather than
naming the spike that collected them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_retrieval_query_scrubbing.py

@@ -1,4 +1,4 @@
-"""A logged query never carries a credential (#3925).
+"""A logged query never carries a credential.
 
 WHY THIS EXISTS
 
@@ -9,8 +9,7 @@ that exported a token therefore stored the token.
 
 And storing it was not the worst of it. `near_miss_samples` is the readout the
 threshold documentation tells you to open before moving a bar, so the value
-came back OUT into an agent's context on the next tuning pass — which is
-exactly how this was found, during #3853's threshold spike.
+would come back OUT into an agent's context on the next tuning pass.
 
 WHAT THIS PINS, IN BOTH DIRECTIONS, AND WHY THE SECOND HALF IS THE HARD ONE
 
@@ -21,12 +20,11 @@ A scrubber has two ways to fail and only one of them is obvious.
      because it is silent: the whole worth of a near-miss sample is reading the
      query that was actually refused, and a scrubber that chewed up ordinary
      commands would turn the one instrument for tuning a bar into unreadable
-     stubs while still looking like it worked. That is the #2663 shape — a
-     surface that reads fine and has quietly stopped saying anything.
+     stubs while still looking like it worked — a surface that reads fine and
+     has quietly stopped saying anything.
 
-So the second block is not padding. Its cases are REAL queries taken from this
-install's `near_miss_samples` during #3853, and they must survive byte for
-byte. If a future pattern is added and one of them changes, the pattern is too
+So the second block is not padding. Its cases are REAL near-miss queries, and
+they must survive byte for byte. If a future pattern is added and one of them changes, the pattern is too
 greedy — tighten it rather than editing the expectation.
 
 The secret cases use FABRICATED values in the real formats. Nothing here is or
@@ -59,7 +57,7 @@ _SECRETS = [
      "MIIEowIBAAKC"),
 ]
 
-# Real queries, from this install's near-miss samples during #3853.
+# Real queries, from near-miss samples.
 _EVIDENCE = [
     "git push origin dev",
     'git pull --rebase origin dev 2>&1 | tail -3; echo "=== HEAD ==="; git log --oneline -2',
@@ -114,7 +112,7 @@ def test_empty_and_missing_queries_pass_through():
 
 
 def test_the_write_path_scrubs_rather_than_the_read_path():
-    """The payload built for storage carries the redacted text (#3925).
+    """The payload built for storage carries the redacted text.
 
     Pinned on `_build_payload` because that is the single seam every source
     reaches the column through. A per-caller scrub would be three places for
@@ -135,21 +133,20 @@ def test_the_write_path_scrubs_rather_than_the_read_path():
     assert "git push" in payload["query"]
 
 
-# ── the SQL twin has its own word-boundary spelling (#3925) ─────────────
+# ── the SQL twin has its own word-boundary spelling ─────────────────────
 #
 # Migration 0099 carries an inlined copy of these patterns, deliberately: a
 # migration is a frozen record of what already ran, and importing the live
 # ones would mean it quietly did something different next year.
 #
-# Frozen is not the same as correct, and the first cut was neither. The
-# boundary was dropped in the port, so `sk-` matched inside any word
-# containing it — `<task-notification>` became `<ta[redacted:token]>` across
-# thousands of rows on the one install that ran it. And writing `\b` would not
-# have saved it: in Postgres ARE `\b` is a BACKSPACE, not a word boundary.
+# Frozen is not the same as correct. Without the boundary, `sk-` matches
+# inside any word containing it — `<task-notification>` becomes
+# `<ta[redacted:token]>`. And writing `\b` does not help: in Postgres ARE `\b`
+# is a BACKSPACE, not a word boundary.
 # `\m` (start of word) is the spelling that means what Python's `\b` means.
 #
 # So this pins the property no reader can eyeball, and it is a PRESENCE check
-# on a token that must appear rather than an absence check on prose (#3352).
+# on a token that must appear rather than an absence check on prose.
 
 def test_the_migrations_patterns_anchor_to_a_word_start_the_postgres_way():
     """`\\m`, never `\\b` — the two are unrelated in Postgres."""