chore: promote mechanism notes to LESSONS.md on first occurrence

.agents/memory/INBOX.md

@@ -18,11 +18,6 @@ One note per PR that hit friction, four lines:
   Would have prevented it: review-pr should check whether the PR author is the current gh user and, if so, post the verdict as a comment review saying "approve" instead of trying the approve event.
   Cost: review round
   Seen: 2026-09-24
-- 2026-09-24 #99 skill: implement-issue
-  What went wrong: the new integration test set NODE_TLS_REJECT_UNAUTHORIZED=0 and rejectUnauthorized: false, copied from older tests, which raised two high CodeQL alerts and a second review round.
-  Would have prevented it: a daemon integration test trusts the daemon's certificate via `ca: daemon.tls.current().certPem` and never disables TLS verification.
-  Cost: review round
-  mechanism: ESLint rule banning NODE_TLS_REJECT_UNAUTHORIZED / rejectUnauthorized: false in test files, filed as #104
 - 2026-09-24 #100 skill: work-issue
   What went wrong: device E2E could not run in the cloud session because the Linux container has no iOS simulator, so both slices waited for a human to run it locally.
   Would have prevented it: at the start, check for a simulator (xcrun, or an Android emulator with KVM) and, if there is none, ask the human up front to run e2e-device locally.

.agents/memory/LESSONS.md

@@ -4,7 +4,7 @@ Curated memory for agents working on this repo. Read only the section named afte
 you are running, plus General. Written only by the `review-memory` skill; everything else
 goes to [INBOX.md](INBOX.md) first.
 
-Entry format, two lines:
+Entry format, two lines, plus a third `Mechanism: #<issue>` while a lint rule or test is pending:
 
 ```
 - YYYY-MM-DD (#PR, #PR) <the rule, one sentence>
@@ -19,6 +19,10 @@ Caps: 10 entries per section, 40 in total. Over the cap, the next review merges
 
 ## implement-issue
 
+- 2026-09-24 (#99) A daemon integration test trusts the daemon's certificate with `ca: daemon.tls.current().certPem` and never disables TLS verification, even where older tests do.
+  Evidence: copying `NODE_TLS_REJECT_UNAUTHORIZED=0` and `rejectUnauthorized: false` from older tests raised two high CodeQL alerts and cost a review round.
+  Mechanism: #104
+
 ## review-pr
 
 ## triage-issue

.claude/skills/review-memory/SKILL.md

@@ -33,10 +33,12 @@ Otherwise branch: `git switch -c "memory/$(date +%Y-%m-%d)"`.
   different PRs, or once when the cost was a wrong merge or a security miss. Merge the
   notes into one entry citing all PRs.
 - **Promote to General** only when it applies to every skill. Expect this to be rare.
-- **Mark for a mechanism** when the rule could be a lint rule or a test. Keep the entry
-  and add "mechanism: <what>" to it; file a `type:chore` issue via the `file-issue` skill
-  so a human can schedule it; skip its interview, the notes are the spec. Once the
-  mechanism lands, the entry is deleted on the next review.
+- **Mark for a mechanism** when the rule could be a lint rule or a test. File a
+  `type:chore` issue via the `file-issue` skill so a human can schedule it; skip its
+  interview, the notes are the spec. Then promote the note to its skill section even on a
+  single occurrence, with a third line `Mechanism: #<issue>`, and remove it from the inbox:
+  agents never read the inbox, and the entry covers the gap until the mechanism lands. Once
+  it lands, the entry is deleted on the next review.
 - **Keep** a note that matches nothing yet and has no `Seen:` line. Add
   `Seen: <today>` as its fifth line so the next review can pair it with a later note.
 - **Drop** a note that already carries a `Seen:` line and still matches nothing, or whose