crux sys audits check leaves last_result_note stale + silently drops --note typo

[claude]

Observed (weekly maintenance sweep 2026-06-28)

While recording audit results, two related defects in crux sys audits check:

1. last_result_note is never updated by check

The check handler (crux/commands/audits.ts:485-498) sets last_checked and last_result and appends a history entry (with notes), but never sets data.audits[idx].last_result_note. And saveAudits (audits.ts:114-152) only has regex updates for last_checked and last_result — there is no branch that writes last_result_note.

Result: the top-level last_result_note field goes permanently stale. After this sweep:

• model-freshness → last_result: fail but last_result_note: "...opus=claude-opus-4-6... Current." (now wrong — opus-4-6 is 2 releases behind opus-4-8)
• scheduled-workflows-running → last_result: pass but note still says "ci-pr-health failing..."
• gate-override-frequency → note says "10% (10/100 PRs)..." but actual is 21% (7/33)

This matters because crux maintain and audits report surface last_result_note, so future sweeps read misleading summaries. (The accurate values do land in history[].notes, so the data isn't lost — only the summary field is stale.)

2. --note (singular typo) is silently accepted and dropped

The flag is --notes. Passing --note="..." is silently ignored — no note recorded, no error. The arg parser should either alias --note→--notes or reject unknown flags.

Prescribed fix

1. In the check handler, set data.audits[auditIdx].last_result_note = options.notes (when provided) before saveAudits(data).
2. In saveAudits, persist last_result_note scoped to the item block. Do NOT reuse the flat non-greedy (- id: X[\s\S]*?last_result_note:) pattern: when an audit lacks the field, non-greedy [\s\S]*? will cross-match the next audit's last_result_note and corrupt it. Use the item-boundary slicing already implemented in appendHistoryEntry (audits.ts:222-243) to bound the replace/insert to the single item, and insert the field after last_result: when absent.
3. Alias or reject --note.

Tests

• check --notes updates both history[].notes and top-level last_result_note.
• check --notes on an audit that has no last_result_note field inserts it without touching adjacent audits (regression test for the cross-item match).
• --note either works (aliased) or returns a non-zero "unknown flag" error.

Found during the automated weekly maintenance sweep; filed in GitHub because LINEAR_API_KEY is unset in the CI sweep environment.