Record slice one's first run against 881 real events

Seven eligible items, three gaps, and four defects in the model that a
read-only projection surfaced before any schema was committed to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

DEBT-DESIGN.md

@@ -346,3 +346,65 @@ This design changes no part of the task lifecycle, phases, leases, review,
 submission, federation or the plan machinery. The only extensions it needs are
 two event types, one projection, one pure eligibility function and one
 read-only endpoint.
+
+---
+
+# Slice one, run against real history
+
+Built and deployed as `a757cff`. `GET /v1/debt` folded 881 events from the
+live log, wrote nothing, and produced 15 candidate items and 3 gaps.
+
+## What it recovered
+
+```text
+v1:operational:lease_expired:workpc-opencode:lease      r=41  tasks=4
+v1:operational:lease_expired:workpc-claude:lease        r=29  tasks=13
+v1:operational:lease_failure:-:lease                    r=20  tasks=16
+v1:operational:system_error:-:lease                     r=11  tasks=7
+v1:correctness:handoff_validation:-:lease               r=5   tasks=5
+v1:correctness:plan_mismatch:-:...                      r=1   tasks=1
+v1:structural:minor:-:scripts/orchestra_e2e_healthcheck.sh  r=1  tasks=1
+```
+
+The opencode failure shape is the top item, found mechanically. Run 14
+diagnosed the same thing by hand from a pane capture. The retry-idleness
+dynamic is the second item, and it is now a number: 29 expiries across 13
+tasks on one harness.
+
+Seven items are eligible under the stated policy. Polish and the single
+structural finding correctly are not.
+
+## What it reported that it could not see
+
+```text
+durable=false  manual_intervention  no event type records an operator repair
+durable=false  worker_observation   worker health is not persisted
+durable=true   deferred_finding     carried by the log, this history has none
+```
+
+The 409 release loop does not appear, and it should not. That evidence lived in
+the F18 worker ring, which no event carries. The ledger says so rather than
+inferring it, which is the result slice two exists to change.
+
+## Four defects the first run exposed
+
+**The component part is too coarse for lease evidence.** Everything
+lease-related normalizes to `lease`, so `lease_expired:workpc-claude` is one
+bucket holding idle agents, rig interference and real failures. Recurrence 29
+is true and the item is not a defect.
+
+**`harness` is often empty on block reasons.** `TaskBlocked` payloads do not
+always carry `harness_id`, so `lease_failure:-` mixes harnesses that should be
+separate items.
+
+**Path normalization mangled a mismatch reference.**
+`scripts/orchestra_e2e_healthcheck.sh:12` became
+`scripts/orchestra_e2e_healthcheck.sh_12`, because the signature sanitizer
+replaces `:` and the mismatch evidence field holds prose, not clean paths.
+
+**Recurrence alone is the wrong sort.** 41 occurrences on 4 tasks currently
+outranks 29 on 13 tasks. Breadth is in the design and not yet in the ordering,
+which is the priority function slice one deliberately omitted.
+
+None of these required a schema commitment to discover. That was the point of
+making the first slice read-only.