chore(todo): close debugging-skills audit items

1 files changed, 9 insertions, 17 deletions

diff --git a/todo.org b/todo.org
index 00b749f..528019c 100644
--- a/todo.org
+++ b/todo.org
@@ -791,9 +791,9 @@ Each item below is a one-line summary of a sub-TODO further down. Tick the box w
 - [ ] [#B] =add-tests=: explicit exceptions to "all three categories per function"
 
 **** Debugging / RCA
-- [ ] [#B] =debug=: capture environment + recent-change context before hypotheses
-- [ ] [#B] =root-cause-trace=: constrain defense-in-depth to trust boundaries
-- [ ] [#B] =five-whys=: require evidence + counterfactual validation per why
+- [X] [#B] =debug=: capture environment + recent-change context before hypotheses
+- [X] [#B] =root-cause-trace=: constrain defense-in-depth to trust boundaries
+- [X] [#B] =five-whys=: require evidence + counterfactual validation per why
 
 **** Brainstorming
 - [ ] [#B] =brainstorm=: timebox + research/source rules for high-stakes designs
@@ -1014,25 +1014,17 @@ generated code, tiny wrappers, or framework glue. Add an exception protocol:
 state why a category does not apply, and cover the behavior at the integration
 or E2E level when unit categories would test framework behavior.
 
-*** TODO [#A] =debug=: capture environment and recent-change context before hypotheses
+*** 2026-05-22 Fri @ 14:25:37 -0500 Added environment + recent-change capture to debug Phase 1
 
-The debugging workflow covers reproduction and logs, but should explicitly
-record environment, versions, feature flags, data set, seed/time, concurrency,
-and recent commits/config changes. Many intermittent failures are environment
-or state transitions, not just local code paths.
+Added a fourth Phase-1 step in =debug/SKILL.md=: record versions, feature-flag/config state, dataset/fixture, seed/clock, concurrency, and recent commits/config-infra changes. Noted that intermittent bugs usually live in environment/state transitions (and "what changed recently" is often the fastest route), while a deterministic local bug only needs a one-liner. Updated the phase's closing recap to include the context.
 
-*** TODO [#A] =root-cause-trace=: constrain defense-in-depth to trust boundaries and invariants
+*** 2026-05-22 Fri @ 14:25:37 -0500 Constrained root-cause-trace defense-in-depth to boundaries
 
-The skill says add defense at each intermediate layer that could have caught
-the bad value. That risks validation spam. Tighten it: add checks at ingress,
-trust boundaries, persistence boundaries, and invariant-owning layers; avoid
-duplicative null checks in every pass-through function.
+Rewrote step b in =root-cause-trace/SKILL.md=: instead of "add a check at each layer that could have caught it," add one only at a layer that owns a boundary or invariant — ingress/trust, persistence, invariant-owning service, final render. Added the explicit rule that a pass-through function owning neither shouldn't get a duplicate null check (validation spam). Recast the three example layers as the boundary types.
 
-*** TODO [#A] =five-whys=: require evidence and counterfactual validation per why
+*** 2026-05-22 Fri @ 14:25:37 -0500 Required evidence + counterfactual per why in five-whys
 
-The skill says "one best-supported answer" but should require an evidence
-field for each link and a counterfactual check: if this cause were removed,
-would the next symptom plausibly disappear? This reduces monocausal storytelling.
+Expanded step 2 in =five-whys/SKILL.md=: each link now owes an evidence field (a log/commit/metric/config you can point to) and a counterfactual check (remove this cause — does the symptom above plausibly not happen?). Framed the counterfactual as the main guard against monocausal storytelling, and updated the worked example to show both fields.
 
 *** TODO [#A] =brainstorm=: add timebox and research/source rules for high-stakes designs