A2 follow-ups: legality-drift fence (run-actor done), qagent relay role, successor-claim escalation, queue pagination

[SSFSKIM]

Follow-ups from A2 (PR #50, spec v1.2.8). Items that survived the branch's five-round review loop as deliberate deferrals, in rough priority order:

1. Legality-table drift fence (headline: run-actor in-review → done). gh LEGAL and A1 LEGAL_ROWS disagree on 13+ edges, and PR feat(review-loop): retire confident-ready — confident verdicts merge; wave cap 4 #48 widened it: the gh review worker now closes with a run-actor in-review → done, which A1 refuses for leaf tickets (epic-guard, src/transitions.js:119) — so an API-bound review worker cannot write its final edge. Needs a canon ruling (mirrored in arkho#7's flow-back comment). A drift fence needs either a DB read (banned in the integration tier) or a service-source comparison (couples the plugin to a checkout) — pick at ruling time.
2. gh-path board-answer.sh QAGENT role fallback — the gh relay leg resolves a resumed session's role from the registry meta and falls back to implementer; a qagent's park answered through gh mode resumes with the wrong protocol orientation. (API mode stamps role: QAGENT in the meta.)
3. claim_successor that never succeeds never escalates — the resume phase's successor claim has no 3-cycle counter of its own; a ticket whose successor claim persistently fails (e.g. lane cap) churns without an env-issue. Decide whether to fold into the existing escalation counter.
4. Queue pagination assumption — _sweep_api.sh reads /queue/* unpaginated; fine at current board sizes, breaks silently past the server's page cap. Pin the contract with arkho or add cursor-follow.
5. Bootstrap-prompt comparison fence — the two rendered worker bootstraps (gh vs API dispatch) are authored separately and never compared; the transcript drill already caught two-authors drift in the smaller relay prompt. Cheap partial fence: compare the rendered texts directly, no gh dispatcher needed.
6. Drill cosmetics — integration drill assertions use grep -qF substrings on numeric ids (anchor them) and raw ticket ids in the argv comparator (normalize) — safe today on fresh scratch DBs, wrong-reason passes if a drill grows past ten runs.

Context: .doperpowers/sdd/2026-08-09-a2-board-adapter/ (session workspace, gitignored) holds the full ledger and per-round reports on the machine that ran A2.

[SSFSKIM]

Merge-reconciliation note (PR #49 × A2): the dispatch-time worktree bootstrap (WORKTREE_BOOTSTRAP_CMD, PR #49) runs only where the dispatcher creates the worktree — the gh PR path and the integration path. The API claim path spawns in the shared clone and the worker owns its own checkout choreography (SKILL.md api-mode protocol), so api-mode reviewers currently get no environment bootstrap. If api-mode boards need dependency installs before review, the bootstrap hook needs an api-path answer (worker-side, most likely — the dispatcher cannot know the PR's base at claim time).