OPER-KNUCK-RESCOPE-2 follow-up: hand-triage admission fields on 239 NEEDS_RESCOPE KNUCK-P tickets

---
feature_id: FEAT-studio-audit
do_not_dispatch: true
size: L
module: platform
verification_cmd: pnpm exec tsx apps/web/scripts/knuck-rescope-repair.ts --team operant
writeSets: [apps/web/scripts/backfill-reports]
phiInScope: false
---

## Context

Hand-triage follow-up required by OPER-163 constraint 4. OPER-163 built the
inference job (`apps/web/scripts/knuck-rescope-repair.ts`) and ran it against
the live Ledger; the committed scan is
`apps/web/scripts/backfill-reports/[REDACTED-DOB]-knuck-rescope-repair.md`.

The result is that the 239 `KNUCK-P*` tickets in `NEEDS_RESCOPE` cannot be
bulk-repaired from body content, and OPER-163 stopped rather than defaulting.
Two independent reasons:

1. **Routing metadata is not the whole gap.** `verificationCmd` is NULL and
   `writeSets` is empty on all 239, and both are admission requirements.
   Re-running the real `validateAdmissionFields` on the post-repair row leaves
   `missing_verify_cmd` on 239, `writesets_unresolved` on 237, `missing_size` on
   236, `missing_module` on 232 and `body_too_short` on 72. Zero of 239 would
   admit. `body_too_short` needs the body rewritten, not a column set.
2. **The 20% auto-classify ceiling is exceeded fivefold.** 236 of 239 (98.7%)
   resolve no column. `module` fails because these bodies address an external
   tree (`depmap/`, `dep-map/`, `packages/dep-map-core` — not a package in this
   repo), so no repo-anchored path resolves to a workspace package. `size` fails
   because every body carries exactly one or two `Done when` bullets, which
   cannot separate an XS config edit from an L refactor.

Neither `verificationCmd` nor `writeSets` is inferred, on purpose. All 239
bodies cite `audit/MASTER-ACTION-PLAN.md` in `## Provenance` — the corpus's most
common path-shaped token, and a citation rather than a write surface. Inferring
from it would stamp one external file as the declared write surface of 239
tickets, the exact false positive Ren's dissent in the OPER-60 memo rules out. A
synthesized `verificationCmd` would certify an unverified build.

Two premises in OPER-163 also do not hold against the schema, and are corrected
here so a later pass does not repeat them. `Task.band` is `ClassificationBand` =
SMALL/MEDIUM/LARGE/XLARGE, not the `low`/`high` risk band OPER-163 described;
`low` would fail the Prisma enum, and `validateAdmissionFields` does not check
`band` at all (the risk classifier was descoped [REDACTED-DOB]). And there is no
`admission.rerun` endpoint — the re-admission path is a PATCH to
`READY_FOR_PLANNING`, per `docs/runbooks/needs-rescope-recovery.md`, which is
what the OPER-163 apply path does.

This ticket carries `do_not_dispatch: true` deliberately. Authoring `size`,
`module`, `verificationCmd` and `writeSets` for 239 tickets requires the domain
knowledge in the external Knuckles Master Ordered Action Plan, which no agent in
this repo has. Removing that frontmatter line is what admits it, and is a human
decision. The mechanism to apply the results already exists and is gated:
`--apply` on the OPER-163 job PATCHes the columns and flips
`NEEDS_RESCOPE` → `READY_FOR_PLANNING` so the auto-planner re-admits, and it
refuses while the failure rate is over 20%.

## Acceptance Criteria

- **Done when:** the verification command reports `failureRate` at or under
  20.0% and `--apply permitted: yes`, which is the same gate the job enforces.
- The 72 tickets under `MIN_BODY_CHARS` (800) have bodies extended with real
  content, not padding — a stub is not a spec.
- `verificationCmd` on each repaired ticket names a command that exists in the
  repo's script surface. A command that no-ops certifies an unverified build.
- `writeSets` on each repaired ticket is repo-anchored against THIS repo. Paths
  under `depmap/`, `dep-map/` or `packages/dep-map-core` are resolved to a real
  location or the ticket is canceled as targeting a tree that does not exist.
- No ticket is flipped straight to `PLANNING_VALIDATED`. The flip goes to
  `READY_FOR_PLANNING` so admission and the PHI reviewer-availability check
  still run (`docs/runbooks/needs-rescope-recovery.md` §5).
- Tickets that turn out to be genuinely unfit after metadata repair still bounce
  rather than being forced through.

## Provenance

Supersedes OPER-164 (CANCELED). That POST hit `map_drift`: PR #451 changed
`products/studio/feature-map.md` on [REDACTED-DOB] but the `sync-product-checksums`
workflow's last successful run was [REDACTED-DOB], so `Product.featureMapChecksum`
had rotted — the suppressed-push failure mode that workflow's own header
predicts. Remediated by dispatching `sync-product-checksums.yml` (run
[REDACTED-MRN], success) before re-filing, per
`.claude/rules/feature-map-and-depmap.md`.

Filed by the OPER-163 agent-dispatch run on [REDACTED-DOB], as constraint 4 of that
ticket requires ("stop, surface the sample failures, and file a follow-up ticket
for hand-triage rather than defaulting to S"). Sample failures are in the
committed scan report. Paired with OPER-KNUCK-RESCOPE-1, which handles the
`unknown_feature_id` half of the cluster.