chore: upgrade vendored worklog tooling 0.18.0 to 0.22.2

[RichardHightower]

Epic 01KZD823EG6R5E1FXFX416RQ0G. Plan: docs/plans/2026-08-07-worklog-0-22-2-upgrade.md.

Why

The backlog was empty and the only open thread was upstream
wiki_ticket_sdd#292 — the plan-banner defect we filed rather than patched
locally, because bin/ia_render.py is vendored and init.sh overwrites it.
That issue is now closed, fixed in worklog 0.20.0. Our vendored copy was on
0.18.0 against upstream 0.22.2, so collecting the fix meant upgrading.

The payoff, visible on the wiki

Before, all three completed plan pages read:

Current — the latest status report. Reports freeze once published…

After:

Current — completed plan; plans are frozen once written…

And the new upgrade plan correctly reads plan not yet started — the state
distinction that did not exist before.

trace-check also drops 56 → 24 gaps. 0.20.0 scoped it to released
milestones and exempted kind:ops, which is exactly what our release items
were being flagged for.

Three things the upgrade did not do for itself

1. It deleted this repo's local pre-commit gates. init.sh rewrites
hooks/pre-commit wholesale, which silently removed the two lines added in
v0.3.0 and v0.3.1 gating the graph suite and the curate shell tests. CI still
ran them, so nothing was lost — but the local gate was gone and nothing said
so.

Restored, and now pinned by test_pre_commit_keeps_the_local_gates(). There
is no extension point in the vendored hook, so the loss cannot be prevented;
the test makes it loud instead. It lives in the suite CI runs directly,
not through the hook, so it still fires in exactly the case where the hook has
been clobbered. Verified by re-running init's overwrite against the suite:
25/26, exit 1.

This is the fourth gate-that-cannot-fire in this project's history, after the
okf-curate hook (v0.3.0) and the ungated curate shell test (v0.3.1).

2. doc-verify was installed, wired, and dead. init.sh does not copy
doc_verify.py or provenance.py, yet pre-commit calls doc-verify behind
[ ! -f bin/doc_verify.py ] — a guard that short-circuits to pass when the
file is missing. Vendored both by hand. The doc-verify warning now appears
in gate output, which is the proof it was not running before.

On its first real run it found 4 fabricated citations. One was in the live
code walkthrough (test_mermaid_ids_are_unique_per_path(), lines 153–156,
where the symbol spans 146–158 — the author cited the excerpt's lines, not the
symbol's) and is fixed. The other three are in frozen release documents and
keep their errors, as frozen records do.

I verified all of them independently rather than trusting the tool, resolving
the symbol at each document's own stamped commit: line 146 at c9c6c99, line
96 at 6bf5d65. The tool was right in every case.

3. The documented SessionEnd step points at a file nothing creates. The
0.19.0 notes say to wire hooks/session-end.sh; init.sh copies only the
three git hooks, and the plugin manifest wires four events but not
SessionEnd. Reachable by neither route. Vendored the script and added
.claude/settings.json; smoke-tested inside and outside a worklog repo.

All three are the same defect — a guard whose absence is indistinguishable
from a pass — and are filed upstream as wiki_ticket_sdd#344.

Merge style

Working rule 9 added to both host guides: merge commits, not squash. Frozen
documents are stamped with the commit they were written against and doc-verify
resolves citations at that commit; a squash keeps it off the default branch.
PRs #38–#45 were squashed before this was understood — the rule names them so
they are not read as precedent. provenance-backfill stamped merged_in on
12 documents.

0 unresolvable, so the squashed history does still resolve; that was
checked rather than assumed.

Also filed upstream

wiki_ticket_sdd#345 — doc-verify --strict cannot pass once any frozen
document carries a fabricated citation. failing() exempts frozen docs from
drift but not fabrication, while the freeze rule forbids the fix. Upstream's
own repo fails its own gate at 48 fabrications. Reported as a genuine
tension rather than with a proposed answer, since it is their policy call.

Blast radius

The plugin's own surface is untouched — scripts/ has an empty diff, and
the graph suite (26 cases), curate suite and validate sample-okf --strict all
pass unchanged. A tooling upgrade that moved okf-graph.py behaviour would
itself be a bug.

Gate exits 0. The doc-verify warning it prints is the frozen-document
situation above, warn-level by design.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WMk8bhkMEUWfHi7VYzMzFX