_canonical_issue() strips FK/FK#/FA/FB/FLAG/FIX prefixes and normalizes separators so
duplicate representations of one root cause collapse (e.g. FK1-SELINUX_RESTORECON +
SELINUX-RESTORECON -> selinux_restorecon; FK3-WAL_CHECKPOINT +
CONCURRENT-STORE-CHECKPOINT -> checkpoint_before_exit via an alias map). Per issue only
the most-detailed note is reported. mark_covered now covers ALL uncovered finding coords
(including deduped-away duplicates) so nothing re-reports. Corresponding notes re-tagged:
issue logs -> finding, status notes -> impl (no uncategorized notes remain).
Adds the headless, cron-driven note reviewer that uses the cubesys::notes
message-save-path as its memory: it reads only uncovered findings from CUBE, gets
the model to rank them, composes a grounded (verbatim) prioritized report, marks
them covered with a checkpoint note, and writes a review .txt. Documents how the
MCP cube-notes-mcp surface is wired into the harness bundle layer (inject:[tools])
and how prior run data saved in CUBE (action trace + finding/checkpoint notes) is
replayed and traced — surfacing 7 previously un-tagged logs (GIT-SHALLOW-CLONE,
POSTFIX-TLS-CERTS, SELINUX-RESTORECON, DSH-WEB-EADDRINUSE,
CONCURRENT-STORE-CHECKPOINT, MCP-BUNDLE-LAYER, CUBES-TWO-TREES).
CUBELinux-2