fix(docs): one row per bug id in state.md, and a gate that keeps it that way

.github/workflows/rule-enforcement.yml

@@ -673,6 +673,15 @@ jobs:
         # other release-contract tests.
         run: bash scripts/ci/tests/test-check-container-build.sh
 
+      - name: state.md row hygiene (ADR-0165)
+        # A keep-both rebase resolution can leave a bug id in both "## Open
+        # bugs" and "## Recently closed", so a fixed bug reads as open forever
+        # (five rows were in that state on 2026-09-05). The gate and its
+        # hermetic self-test run on every PR.
+        run: |
+          bash scripts/ci/check-state-md-rows.sh
+          bash scripts/ci/tests/test-check-state-md-rows.sh
+
       - name: One-shot release-please fields must not outlive the first release
         run: |
           # ADR-1151. `release-as` and `bootstrap-sha` are one-shot cutover

.pre-commit-config.yaml

@@ -213,6 +213,13 @@ repos:
         language: script
         pass_filenames: false
         always_run: true
+      - id: check-state-md-rows
+        name: Every docs/state.md bug id appears exactly once (ADR-0165)
+        entry: scripts/ci/check-state-md-rows.sh
+        language: script
+        pass_filenames: false
+        always_run: true
+
       - id: check-aggregator-names
         name: Check required CI checks aggregator list matches workflows
         entry: scripts/ci/check-aggregator-names.sh

CHANGELOG.md

@@ -24714,6 +24714,15 @@ Fix three broken ADR slug refs in `docs/state.md` that pointed to renamed ADR fi
   and #217 (motion SAD batching).
 
 
+- `docs/state.md` no longer carries five bug ids twice. A keep-both rebase
+  resolution had left `T-CUDA-INIT-SUBMIT-LEAKS-2026-06-19` and
+  `T-UPSTREAM-1564-ADM-CM-GPU-BORDER-AND-ROUNDING-2026-09-03` in **both** "Open
+  bugs" and "Recently closed" (so two fixed bugs read as open), plus three
+  duplicated rows inside "Recently closed". `scripts/ci/check-state-md-rows.sh`
+  now rejects any id that appears more than once; it runs in pre-commit, in
+  `make lint-sh` and in the Rules workflow, with a hermetic self-test.
+
+
 Fix three broken table rows in `docs/state.md` caused by `\|` outside backtick
 spans (FINDING-10, HP-2, fr_regressor_v2 seed-redo row). Backslash-pipe outside
 backticks is parsed as a literal backslash followed by a cell boundary, creating

Makefile

@@ -208,6 +208,7 @@ lint-sh:
 	@scripts/ci/test-prune-corrupt-fixtures.sh
 	@scripts/ci/check-no-tracked-venv.sh
 	@scripts/ci/check-aggregator-names.sh
+	@scripts/ci/check-state-md-rows.sh
 
 # Markdown lint (ADR-0866). Default scope is the touched-file delta vs
 # origin/master so the ~6.2k pre-existing-warning tail (ADR-0864) doesn't

changelog.d/fixed/state-md-duplicate-rows.md

@@ -0,0 +1,7 @@
+- `docs/state.md` no longer carries five bug ids twice. A keep-both rebase
+  resolution had left `T-CUDA-INIT-SUBMIT-LEAKS-2026-06-19` and
+  `T-UPSTREAM-1564-ADM-CM-GPU-BORDER-AND-ROUNDING-2026-09-03` in **both** "Open
+  bugs" and "Recently closed" (so two fixed bugs read as open), plus three
+  duplicated rows inside "Recently closed". `scripts/ci/check-state-md-rows.sh`
+  now rejects any id that appears more than once; it runs in pre-commit, in
+  `make lint-sh` and in the Rules workflow, with a hermetic self-test.

docs/rebase-notes.md

@@ -7,6 +7,12 @@ No rebase impact: `.github/workflows/lint-and-format.yml` is fork-added. Invaria
 only purpose is to emit `compile_commands.json` for clang-tidy must configure with `-Db_lto=false`,
 because the project default (`b_lto_threads=4`, ADR-1172) renders as a GCC-only `-flto=<n>` that
 clang rejects outright.
+## fix/state-md-duplicate-rows — one row per bug id (2026-09-05)
+
+No rebase impact: `docs/state.md`, `scripts/ci/check-state-md-rows.sh` and its test are fork-added.
+The gate exists **because** of rebases: resolving a `docs/state.md` conflict by keeping both sides is
+the documented shortcut for the append-only sections, and it silently duplicates a row that a PR was
+moving between sections. After any such resolution, run `bash scripts/ci/check-state-md-rows.sh`.
 
 ## fix/gpu-init-leaks-and-hip-mirror — fix CUDA init error path leaks and close verified GPU state issues (2026-09-04)
 

scripts/ci/check-state-md-rows.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# check-state-md-rows.sh — docs/state.md row hygiene (ADR-0165).
+#
+# Every bug id may appear as a table row exactly once. Two ways this breaks:
+#
+#   1. A PR moves a row from "## Open bugs" to "## Recently closed" and a later
+#      rebase resolves the conflict by keeping BOTH sides — the stale
+#      present-tense row stays under Open while the past-tense one lands under
+#      Recently closed, so the bug reads as open forever. Five rows were in that
+#      state on 2026-09-05 (T-CUDA-INIT-SUBMIT-LEAKS, T-UPSTREAM-1564,
+#      T-SPEED-GPU-REGISTRY-ORPHAN, T-SIMD-BIT-EXACT-ROUND2,
+#      T-SIMD-ICX-FP-CONTRACT).
+#   2. The same keep-both resolution duplicates a row inside one section.
+#
+# Both are invisible to a reviewer reading a diff hunk, so they are gated here.
+#
+# The id is matched as the bold token that OPENS the first cell, not as the whole
+# cell. Rows come in two shapes, `| **T-ID** | ...` and the far more common
+# `| **T-ID** -- one-line description | ...`; anchoring on `\*\* \|` silently
+# skips every row of the second shape. It did: 30 of 335 rows were invisible to
+# the first version of this gate, and two duplicate pairs
+# (T-SYCL-DMABUF-IMPORT-WIN32-ENOSYS, T-VK-VIF-1.4-RESIDUAL) survived its first
+# sweep. The id character class includes `.` for the same reason
+# (T-VK-VIF-1.4-RESIDUAL).
+#
+# Usage: check-state-md-rows.sh [PATH]   (default: docs/state.md)
+# Exit:  0 clean; 1 a duplicate id; 2 the file is missing.
+set -euo pipefail
+
+file="${1:-docs/state.md}"
+if [[ ! -f "$file" ]]; then
+  echo "check-state-md-rows: $file not found" >&2
+  exit 2
+fi
+
+# Row ids: a table line whose first cell OPENS with a bold T-… identifier.
+dupes="$(grep -oE '^\| \*\*T-[A-Z0-9._-]+\*\*' "$file" |
+  sed -E 's/^\| \*\*//; s/\*\*$//' |
+  sort | uniq -d || true)"
+
+if [[ -n "$dupes" ]]; then
+  echo "::error title=state.md duplicate rows::each bug id must appear exactly once" >&2
+  while IFS= read -r id; do
+    [[ -z "$id" ]] && continue
+    echo "  $id appears on lines:" >&2
+    grep -nF "| **${id}**" "$file" | cut -d: -f1 | sed 's/^/    /' >&2
+  done <<<"$dupes"
+  echo "" >&2
+  echo "A keep-both rebase resolution usually caused this: keep the row that" >&2
+  echo "matches the bug's real state and delete the other (ADR-0165)." >&2
+  exit 1
+fi
+
+count="$(grep -cE '^\| \*\*T-[A-Z0-9._-]+\*\*' "$file" || true)"
+echo "check-state-md-rows: OK ($count rows, no duplicate ids)"

scripts/ci/tests/test-check-state-md-rows.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Tests for scripts/ci/check-state-md-rows.sh (ADR-0165 row hygiene).
+set -euo pipefail
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+script="$here/../check-state-md-rows.sh"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+expect() { # $1 label, $2 expected rc, $3 file
+  local rc=0
+  bash "$script" "$3" >/dev/null 2>&1 || rc=$?
+  if [ "$rc" -ne "$2" ]; then
+    echo "FAIL $1: expected rc=$2 got rc=$rc" >&2
+    exit 1
+  fi
+  echo "ok   $1 (rc=$rc)"
+}
+
+cat >"$tmp/clean.md" <<'MD'
+## Open bugs
+
+| ID | Description |
+| --- | --- |
+| **T-ALPHA-2026-01-01** | still broken |
+
+## Recently closed
+
+| ID | Description |
+| --- | --- |
+| **T-BETA-2026-01-02** | fixed |
+MD
+expect "a file with unique ids passes" 0 "$tmp/clean.md"
+
+# the keep-both artefact: the same id under Open and under Recently closed
+sed 's/T-BETA-2026-01-02/T-ALPHA-2026-01-01/' "$tmp/clean.md" >"$tmp/cross.md"
+expect "an id in two sections fails" 1 "$tmp/cross.md"
+
+# the same id twice inside one section
+{
+  cat "$tmp/clean.md"
+  printf '| **T-BETA-2026-01-02** | fixed again |\n'
+} >"$tmp/same.md"
+expect "an id twice in one section fails" 1 "$tmp/same.md"
+
+# Regression: the id opens the first cell but a description follows it, so the
+# cell does not end right after the bold token. This is the majority row shape in
+# docs/state.md (30 of 335 rows were invisible to the first version of the gate,
+# which anchored on `\*\* \|`), and it hid two real duplicate pairs.
+cat >"$tmp/described.md" <<'MD'
+## Open bugs
+
+| ID | Description |
+| --- | --- |
+| **T-GAMMA-2026-01-03** — `core/src/x.c:12` returns `-ENOSYS` | still broken |
+
+## Deferred (waiting on external trigger)
+
+| ID | Description |
+| --- | --- |
+| **T-GAMMA-2026-01-03** — the same bug, filed a second time | no action required |
+MD
+expect "an id with a trailing description in the first cell fails" 1 "$tmp/described.md"
+
+# Regression: ids are not restricted to [A-Z0-9-]; T-VK-VIF-1.4-RESIDUAL carries a
+# dot and slipped through the first version of the character class.
+cat >"$tmp/dotted.md" <<'MD'
+## Recently closed
+
+| ID | Description |
+| --- | --- |
+| **T-DELTA-VIF-1.4-RESIDUAL** — dotted id | fixed |
+| **T-DELTA-VIF-1.4-RESIDUAL** — dotted id, kept twice by a rebase | fixed |
+MD
+expect "an id containing a dot fails" 1 "$tmp/dotted.md"
+
+expect "a missing file is rc=2" 2 "$tmp/nope.md"
+
+# the real file must be clean
+expect "docs/state.md is clean" 0 "$here/../../../docs/state.md"
+echo "all check-state-md-rows cases passed"