Best possible solution:

Merge the focused patch after maintainer review confirms current-head validation, keeping lifecycle status precedence in WorkboardStore and migrate-hermes assertions aligned with the current auth-profile shape.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main reuses one bulk patch object across card ids while updateCard mutates that object for stale lifecycle writes. I did not execute the failing test path in this read-only review.

Is this the best way to solve the issue?

Yes, this is the narrow owner-boundary fix: local effectivePatch normalization prevents updateCard from mutating caller-owned input for both bulk reuse and direct callers, without adding a second API path.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 58f7d7e5f8ff.

Label justifications:

• P2: This is a normal-priority Workboard state persistence bugfix with focused plugin/test blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is maintainer-associated with a protected maintainer label, so the external contributor real-behavior-proof gate does not apply; the body records maintainer validation commands instead.

PR surface:

Source +14, Tests +43. Total +57 across 4 files.

What I checked:

• Repository policy read: Root AGENTS.md was read fully, and scoped guides for extensions, UI, and tests were checked before reviewing the PR surface. (AGENTS.md:1, 58f7d7e5f8ff)
• Protected maintainer state: The provided live GitHub context marks the PR author association as MEMBER and includes the protected maintainer label, so this cleanup review should not close it automatically.
• Current main bug path: On current main, bulkUpdate normalizes one patch object and passes that same object to update for every id, making mutation inside updateCard observable across later cards. (extensions/workboard/src/store.ts:4198, 58f7d7e5f8ff)
• Current main mutation: The stale lifecycle branch on current main mutates patch.status and patch.metadata in place before returning or applying the update. (extensions/workboard/src/store.ts:2649, 58f7d7e5f8ff)
• PR repair shape: The PR head introduces effectivePatch and routes subsequent normalization, metadata, automation, status-hold, and timestamp handling through that local value instead of mutating the caller patch. (extensions/workboard/src/store.ts:2643, 5ee8b3dd5f4a)
• Regression coverage: The new test covers a stale first target and fresh later target sharing one bulk patch, and also asserts the original patch object remains unchanged. (extensions/workboard/src/store.test.ts:424, 5ee8b3dd5f4a)

Likely related people:

• BunsDev: Authored the merged Workboard lifecycle status persistence work that introduced the stale lifecycle precedence path this PR repairs, and also authored this follow-up branch. (role: recent area contributor; confidence: high; commits: e07dbb27d91f, 175ce70cf7be; files: extensions/workboard/src/store.ts, extensions/workboard/src/store.test.ts, ui/src/ui/controllers/workboard.ts)
• steipete: The current bulkUpdate implementation that reuses a normalized patch object traces to the grafted baseline commit in the reviewed history. (role: adjacent owner; confidence: medium; commits: 381c5e0762d1; files: extensions/workboard/src/store.ts)
• vincentkoc: Recent current-main commits changed migrate-hermes auth-profile storage expectations in the same tests touched by this PR's test-only narrowing. (role: recent adjacent test contributor; confidence: high; commits: 96136e6d7147, 6d84fb35c7a5; files: extensions/migrate-hermes/secrets.test.ts, extensions/migrate-hermes/files-and-skills.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.