Planning bug: three 8.4 legal cards were typed `coding_agent` while their acceptance required counsel review — and the human-sized estimate was the tell nobody read

Filed by motir run MOTIR-657 on 2026-08-26. The correction is already submitted as plan cmtal3vdv0054i3phuw5zdwxh (awaiting approval); this card is the defect RECORD.

The defect

MOTIR-1158, MOTIR-1159 and MOTIR-1160 each carried, simultaneously:

• fields reading type: content · executor: coding_agent;
• a body header reading Type: manual (legal) · Executor: human (founder + counsel);
• an acceptance criterion no coding agent can discharge — "Both counsel-reviewed (or counsel-reviewed template per 8.4.1) and founder-approved" (MOTIR-1158), "Counsel/template-reviewed + founder-approved" (MOTIR-1159);
• a closing line reading "No PR — type: manual, marked done on the user's confirmation", while MOTIR-1134 consumes their output as Markdown committed in-repo;
• estimates of 240 / 300 / 210 minutes — counsel time — on cards typed for an agent whose estimation gate ceilings a run at roughly 70.

A card that cannot be finished by its own executor does not fail loudly. It either stalls at motir run guard #2 on a human with nothing prepared, or it is drafted by an agent and closed with the counsel review silently dropped — and for a published legal document that second outcome is the expensive one.

How it got here

The likely history, from the timestamps rather than from memory: MOTIR-1134/1135/1136/1137 all carry an identical updatedAt of 2026-08-01T15:49:39.486Z, which is the signature of a bulk field normalisation. MOTIR-1133's fields were corrected to decision/coding_agent in the same era — deliberately and correctly, per the standing rule that a decision card's executor is the agent that writes the ADR. The same pass appears to have set executor: coding_agent across the story without re-estimating and without touching the prose, so the field said one thing and every sentence around it said another.

The bulk edit was right about MOTIR-1133 and wrong about the three drafting cards, and nothing distinguished them — which is the general shape worth recording: a normalisation that is correct for the majority of a set is applied to the whole set, and the minority it breaks carries no signal a field-level pass could see.

Why it went unnoticed for eight weeks

It did not. validate_work_item on MOTIR-657 returns likely-over-gate-sizing for all three — the shipped advisory reached this before this run did. What was missing was a step that READ it: the advisory channel is deliberately non-blocking, readiness.ready was true, and validate_work_item on the story returns valid: true. Every green signal agreed the story was fine.

Still-open decisions this re-plan did NOT settle

1. The controller's registered address and KvK number. Named in docs/decisions/legal-document-set.md §3 as open founder input and filed as its own proposed card (8.4.9). No card owned this before.
2. The three email aliases (privacy@ / security@ / legal@motir.co). MOTIR-2596 provisioned the mailbox and explicitly deferred the address SET to 8.4.1; 8.4.1 decided the set, and the console action is now its own proposed card (8.4.10).
3. Whether Spacemail belongs on the published subprocessor list — MOTIR-1160's own body raises it as a counsel call and this re-plan preserves it as one rather than resolving it.

A second defect found in the same pass, recorded here because it has the same root

MOTIR-1159's cookie inventory was short by eleven. The card enumerated four cookies; origin/main at 4f70366d6 sets fifteen — both 2FA cookies (merged in PR #2314 three hours before the measurement) and every OAuth CSRF/PKCE cookie for the five importer/connector flows, plus motir_pending_idea, which stores up to 2000 characters of visitor-typed text pre-authentication.

The no-banner conclusion survives the larger set, so nothing about the DECISION was wrong. But a Cookie Policy is a published enumeration, and the card would have shipped one missing eleven entries. Root cause shared with the defect above: a count written into a card body is a snapshot, and the product kept moving. The corrected MOTIR-1159 now points at the decision record's table rather than at its own prose.

Evidence

• validate_work_item on MOTIR-657, 2026-08-26: likely-over-gate-sizing on MOTIR-1158 (240 min), MOTIR-1159 (300 min), MOTIR-1160 (210 min).
• Card bodies and fields as read via get_work_item, 2026-08-26, quoted verbatim above.
• Cookie inventory measured on origin/main at 4f70366d6 (not a working tree): lib/auth/index.ts, lib/organizations/cookie.ts, lib/workspaces/middleware.ts, lib/i18n/actions.ts, lib/onboarding/pendingIdea.ts, and the five OAuth start routes under app/api/.
• The decision record this run produced: docs/decisions/legal-document-set.md, PR #2320.

Disposition

The plan is submitted and the three cards are commented and held at Blocked. This card needs no build work — it closes when plan cmtal3vdv0054i3phuw5zdwxh is approved or declined and the outcome is noted here.