diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 4131c473b..404c190f2 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -354,12 +354,11 @@ jobs:
               return 'skip';
             }
             function latestIso(values) {
-              const times = values
-                .map(value => Date.parse(value))
-                .filter(Number.isFinite);
-              return times.length > 0
-                ? new Date(Math.max(...times)).toISOString()
-                : null;
+              const maxTime = values.reduce((max, val) => {
+                const time = Date.parse(val);
+                return Number.isFinite(time) && time > max ? time : max;
+              }, -Infinity);
+              return maxTime > -Infinity ? new Date(maxTime).toISOString() : null;
             }
             function workflowRunId(targetUrl) {
               const target = String(targetUrl || '');
diff --git a/.jules/bolt.md b/.jules/bolt.md
index fa5a3cfc9..d458b9bdc 100644
--- a/.jules/bolt.md
+++ b/.jules/bolt.md
@@ -16,4 +16,4 @@
 **Action:** Extract pure transformation logic on static/infrequent data into `useMemo` hooks (e.g., memoizing the paragraph split on `transcript` and precomputing search `RegExp` based on `searchQuery`).
 ## 2026-07-24 - Avoiding spread operator for large arrays in calculations
 **Learning:** Using `Math.max(...array.map())` on potentially large data structures runs the risk of hitting the "Maximum call stack size exceeded" error, and creates unnecessary intermediate array allocations, reducing performance.
-**Action:** Replace multiple O(N) array mapping and spread operations with a single O(N) `for` loop to compute bounds simultaneously with zero intermediate allocations.
+**Action:** Replace multiple O(N) array mapping and spread operations with a single O(N) `for` loop to compute bounds simultaneously with zero intermediate allocations. Or in cases finding the max of parsed strings, use a `.reduce()` loop for a safe single pass without generating intermediate array structures.
diff --git a/docs/triage/pr-remediation-2026-08-02.md b/docs/triage/pr-remediation-2026-08-02.md
new file mode 100644
index 000000000..60be4ee9e
--- /dev/null
+++ b/docs/triage/pr-remediation-2026-08-02.md
@@ -0,0 +1,159 @@
+# PR Remediation Run — 2026-08-02
+
+Entry-scan + terminal-state disposition of **all open PRs** under the PR Remediation &
+Publish Runbook. This run advances the same routine as the 2026-07-03 → 2026-08-01 runs.
+
+- **Surface:** GitHub MCP (PR read + status). Write is available, but merge to protected
+  `main` is held for owner sign-off per the runbook's publish gate and repo policy.
+- **Auto-merge policy:** `never` for this run. No PR carries an `automerge` label, the
+  runbook's `auto_merge_policy` parameter was not filled, and every review-ready PR is on
+  a protected-branch review gate. Nothing is auto-merged.
+- **Definition of Done reached:** every open PR is in a terminal state
+  (`DEFERRED` or `HALTED`). The remaining actionable items are **all owner-gated** — see
+  "Owner action queue" at the end.
+
+## Headline
+
+**62 open PRs: 57 drafts (`DEFERRED`), 5 review-ready (all `HALTED` on human sign-off).**
+
+The entire review-ready set is blocked on the same wall, and it is a **human** wall by
+design, not an automatable one:
+
+1. **Branch protection on `main` requires one independent approving review + resolved
+   conversations.** That approval is the true merge gate. `#1251` is fully CI-green and
+   sits at `mergeable_state: blocked` for exactly this reason — it is merge-ready the
+   moment an owner approves.
+2. **`agent-completion/truth-gate` is red on 4 of the 5**, but per
+   `docs/agent-completion-truth-gate.md` that status is **advisory, not a required
+   check** ("must not be added as a required status"). Its red state reflects missing
+   agent-lock provenance (frozen pre-dispatch intent + trusted terminal agent result)
+   that these bot/agent branches structurally lack. Per `REAL_MODE_ONLY` and the gate's
+   own spec ("human approval alone cannot satisfy those signals"), that manifest **must
+   not be hand-filled** — doing so would impersonate the gate. `#810` and `#1252` authors
+   explicitly left it red on purpose and deferred to human sign-off; this run does the
+   same.
+
+Net: **no PR can be legitimately driven to `MERGED` from an unattended session.** The
+completable automation is done; the rest needs a human.
+
+## Oldest-first disposition — review-ready (non-draft) set (5)
+
+| PR | Author | Age | Review / CI | Conflicts | Action taken | Terminal state |
+|----|--------|-----|-------------|-----------|--------------|----------------|
+| #810 | groupthinking (`claude/*`) | 07-17 | truth-gate ✗ (`scope_drift`, `missing_agent_result`, `missing_copilot_current_head_review`); Vercel + CodeRabbit(skip) ✓ | none (`unstable`) | Observed. Author checklist itself leaves provenance + final human review open; do not fabricate the gate. | HALTED(awaiting_provenance + human_review) |
+| #1242 | google-labs-jules[bot] | 08-02 | truth-gate ✗ (`invalid_payload`); Vercel canceled | none (`unstable`) | Observed. Red is the missing provenance manifest, not a code/CI failure. JS error-handling refactor (8 files). | HALTED(awaiting_provenance + human_review) |
+| **#1251** | groupthinking (`perf/*`) | 08-02 | **All CI ✓; truth-gate `not_applicable: all rules passed`; Vercel ✓** | none (`blocked`) | **Verified merge-ready.** Only branch-protection approving review remains. Staged: squash-merge on owner approval. | **HALTED(awaiting_merge_approval)** |
+| #1252 | groupthinking (`claude/*`) | 08-02 | truth-gate ✗ (`invalid_payload`); all other CI ✓; Vercel ✓ | none (`unstable`) | Observed. **Redundant with #1251** (see below). Author deliberately left truth-gate red; deferred to human. | HALTED(redundant + human_review) |
+| #1256 | google-labs-jules[bot] | 08-02 | truth-gate ✗ (`invalid_payload`); Vercel canceled | none (`unstable`) | Observed. 6-line `reduce()` micro-opt in workflow checks; red is provenance, not code. Awaiting owner review. | HALTED(awaiting_provenance + human_review) |
+
+### #1251 — the one merge-ready PR
+
+`perf: batch project scaffolding disk writes off the event loop` (Closes #1250). Moves 28
+inline filesystem calls in `code_generator.py` off the event loop into one `to_thread`
+hop per generator, with a cancellation drain-and-discard fix. Fully green: all code CI
+passed, `agent-completion/truth-gate` returned `not_applicable: all rules passed`, Vercel
+deployment completed. `mergeable_state: blocked` is the required-review gate, not a
+failure. This is the cleanest merge candidate in the set — merge-ready on owner approval.
+
+### ⚠️ #1251 and #1252 are redundant — pick one
+
+Both are `groupthinking`-owned, both branch from `main@6847a1f`, both rewrite the same
+`code_generator.py` cancellation / orphaned-scaffold cleanup:
+
+- **#1251** already contains the cancellation drain-and-discard fix (its "Risk #4",
+  *"found in review, fixed here"*) on top of the perf change, and is **fully green**.
+- **#1252** (`fix(codegen): clean up orphaned scaffold…`, Closes #1253) implements the
+  *same* cancellation cleanup on a separate branch, explicitly *"byte-for-byte output
+  equality from #1251 preserved,"* and is **red on truth-gate**.
+
+Merging both would conflict. **Recommendation: merge #1251 (green, canonical); close
+#1252 as superseded.** Left as an owner decision — not closed autonomously, since both
+are hours-old and may be under active authoring.
+
+## Draft set (57) — `DEFERRED(draft)` per SCOPE GATE
+
+Drafts are deferred by the runbook's scope gate and skipped this run. Includes 4 prior
+triage-run docs (#1044, #1059, #1077, #1177) and 8 Dependabot bumps (#1000, #1003, #1171,
+#1172, #1173, #1174, #1175, #1176) still in draft. Full list, oldest first:
+
+| PR | Author | Created | Title | Terminal state |
+|----|--------|---------|-------|----------------|
+| #734 | groupthinking | 2026-07-12 | fix(security): pin cloud callbacks against DNS rebinding | DEFERRED(draft) |
+| #869 | groupthinking | 2026-07-18 | fix: harden API-cost webhook outbox retries (MYX-79) | DEFERRED(draft) |
+| #903 | jules | 2026-07-20 | fix(auth): restore Google OAuth configuration in Vercel prod | DEFERRED(draft) |
+| #906 | groupthinking | 2026-07-21 | fix(ci): remediate PR #877 rollout and verification gaps | DEFERRED(draft) |
+| #987 | Copilot | 2026-07-25 | [DRAFT EVIDENCE] unbound CI and module-shadowing proposal | DEFERRED(draft) |
+| #995 | groupthinking | 2026-07-25 | perf(mcp): reuse pooled aiohttp session in orchestrator task | DEFERRED(draft) |
+| #996 | groupthinking | 2026-07-25 | fix(mcp): actually reuse pooled aiohttp session in _execute | DEFERRED(draft) |
+| #1000 | dependabot | 2026-07-25 | build(deps): bump actions/checkout 4.2.2 → 7.0.1 | DEFERRED(draft) |
+| #1003 | dependabot | 2026-07-25 | build(deps): bump actions/github-script 8 → 9 | DEFERRED(draft) |
+| #1020 | jules | 2026-07-26 | perf: optimize call stack operations and string allocations | DEFERRED(draft) |
+| #1040 | groupthinking | 2026-07-27 | fix(mcp): green up MCPOrchestrator._execute_on_server E2E | DEFERRED(draft) |
+| #1043 | jules | 2026-07-27 | perf(web): optimize viewBox boundary computation in AgentFlow | DEFERRED(draft) |
+| #1044 | groupthinking | 2026-07-27 | docs(triage): PR remediation run 2026-07-27 | DEFERRED(draft) |
+| #1045 | jules | 2026-07-27 | 🎨 Palette: keyboard focus-visible styling to dashboard | DEFERRED(draft) |
+| #1047 | jules | 2026-07-27 | ci: suppress failure issues on no-op runs for CI Investigator | DEFERRED(draft) |
+| #1049 | groupthinking | 2026-07-27 | fix(a11y): dashboard focus contrast and regression | DEFERRED(draft) |
+| #1050 | jules | 2026-07-27 | Configure agentic workflows no-op comments suppression | DEFERRED(draft) |
+| #1052 | jules | 2026-07-27 | fix: allow awmg-mcpg gateway in workflow firewalls | DEFERRED(draft) |
+| #1059 | groupthinking | 2026-07-28 | docs(triage): PR remediation run 2026-07-28 | DEFERRED(draft) |
+| #1064 | groupthinking | 2026-07-28 | docs(runbook): diagnose Google OAuth 403 org_internal | DEFERRED(draft) |
+| #1075 | groupthinking | 2026-07-29 | fix(pipeline): preserve captured transcript on analysis timeout | DEFERRED(draft) |
+| #1077 | groupthinking | 2026-07-29 | docs(triage): PR remediation run 2026-07-29 + CWE refresh | DEFERRED(draft) |
+| #1080 | jules | 2026-07-29 | perf(ci): replace Math.max spread anti-pattern in pr-checks | DEFERRED(draft) |
+| #1114 | groupthinking | 2026-07-30 | fix(deps): realign apps/web lockfile with declared ranges | DEFERRED(draft) |
+| #1117 | groupthinking | 2026-07-30 | fix(deps): raise brace-expansion override floors | DEFERRED(draft) |
+| #1118 | groupthinking | 2026-07-31 | fix(security): stop proxy credentials leaking from subprocess | DEFERRED(draft) |
+| #1119 | groupthinking | 2026-07-31 | test(web): make billing chat gating test assert real behavior | DEFERRED(draft) |
+| #1122 | groupthinking | 2026-07-31 | fix: harden Dockerfile.production install | DEFERRED(draft) |
+| #1123 | groupthinking | 2026-07-31 | fix(aw): require explicit noop terminal state in agentic wf | DEFERRED(draft) |
+| #1129 | groupthinking | 2026-07-31 | fix: route every transcript client through centralized proxy | DEFERRED(draft) |
+| #1132 | Copilot | 2026-07-31 | fix(cloud): authenticate task requests before payload validation | DEFERRED(draft) |
+| #1145 | jules | 2026-08-01 | 🛡️ Sentinel: [MEDIUM] Fix internal error message leakage | DEFERRED(draft) |
+| #1154 | groupthinking | 2026-08-01 | fix: scope agent gate applicability to real dispatch evidence | DEFERRED(draft) |
+| #1155 | groupthinking | 2026-08-01 | fix: repair one-click deploy paths and production manifests | DEFERRED(draft) |
+| #1156 | groupthinking | 2026-08-01 | fix(deps): drop phantom python-jose to clear ecdsa advisory | DEFERRED(draft) |
+| #1164 | groupthinking | 2026-08-01 | fix(deps): restore apps/web dependency floors | DEFERRED(draft) |
+| #1171 | dependabot | 2026-08-01 | build(deps): bump gh-aw-actions/setup 0.82.14 → 0.84.0 | DEFERRED(draft) |
+| #1172 | dependabot | 2026-08-01 | build(deps): bump actions/download-artifact 7 → 8 | DEFERRED(draft) |
+| #1173 | dependabot | 2026-08-01 | build(deps): bump openai 6.49.0 → 7.1.0 in /apps/web | DEFERRED(draft) |
+| #1174 | dependabot | 2026-08-01 | build(deps): bump github/codeql-action 4 → 4.37.3 | DEFERRED(draft) |
+| #1175 | dependabot | 2026-08-01 | build(deps): bump npm-minor-patch group (10 updates) | DEFERRED(draft) |
+| #1176 | dependabot | 2026-08-01 | build(deps): bump openai 6.48.0 → 7.1.0 | DEFERRED(draft) |
+| #1177 | groupthinking | 2026-08-01 | docs(triage): PR remediation run 2026-08-01 | DEFERRED(draft) |
+| #1179 | groupthinking | 2026-08-01 | fix: give RedisCacheLayer an event-loop ownership contract | DEFERRED(draft) |
+| #1216 | groupthinking | 2026-08-02 | fix(security): sandbox local media paths in cloud AI providers | DEFERRED(draft) |
+| #1219 | groupthinking | 2026-08-02 | docs: reference GEMINI_API_KEY env var in curl examples | DEFERRED(draft) |
+| #1220 | groupthinking | 2026-08-02 | feat(config): share validated env parsing for tunable concurrency | DEFERRED(draft) |
+| #1223 | groupthinking | 2026-08-02 | test: expand BigQuery export coverage 29.89% → 100% | DEFERRED(draft) |
+| #1225 | groupthinking | 2026-08-02 | test: restore focused skill-dispatch regression tests | DEFERRED(draft) |
+| #1226 | groupthinking | 2026-08-02 | fix(security): raise brace-expansion override floors | DEFERRED(draft) |
+| #1229 | groupthinking | 2026-08-02 | fix(web): fail closed when NEXTAUTH_SECRET missing in prod | DEFERRED(draft) |
+| #1230 | groupthinking | 2026-08-02 | test: make web suite hermetic against ambient AI gateway keys | DEFERRED(draft) |
+| #1235 | groupthinking | 2026-08-02 | test(web): lock in transcript search null/empty behavior (#908) | DEFERRED(draft) |
+| #1236 | groupthinking | 2026-08-02 | test: make OpenAI DNS-validation tests non-vacuous (#914) | DEFERRED(draft) |
+| #1237 | groupthinking | 2026-08-02 | perf: offload cache-directory scan off the event loop (#1231) | DEFERRED(draft) |
+| #1241 | groupthinking | 2026-08-02 | perf: isolate blocking file I/O from shared default executor | DEFERRED(draft) |
+| #1255 | groupthinking | 2026-08-02 | fix(security): neutralize CR/LF in rendered log records (CWE-93) | DEFERRED(draft) |
+
+## Owner action queue (the only remaining work — all human-gated)
+
+1. **Approve & squash-merge #1251** — fully green, merge-ready. Staged command:
+   `merge #1251 (squash) after one approving review`.
+2. **Decide #1251 vs #1252** — redundant `code_generator.py` cancellation-cleanup pair.
+   Recommend merge #1251, close #1252 as superseded.
+3. **#810, #1242, #1256** — agent branches red only on advisory `agent-completion/truth-gate`
+   provenance. Either register real agent-lock provenance through orchestration, or review
+   and merge on the branch-protection gate directly. The manifest must **not** be
+   hand-filled (`REAL_MODE_ONLY`).
+4. **Draft backlog (57)** — undraft the ones intended for this cycle so a future run can
+   drive them; the rest stay `DEFERRED`.
+
+## Loop exit
+
+Every open PR is at a terminal state and every remaining item is owner-gated (approving
+reviews on protected `main`, a redundant-PR decision, and provenance registration) — none
+completable from an unattended session without crossing the human sign-off boundary that
+the runbook's publish gate, the harness safety rules, and `REAL_MODE_ONLY` all forbid
+here. **No further autonomous work remains; the loop stops with the owner action queue
+above delivered.**