In a HOT class, findings decay in DAYS - the staging->filing window must be short; a class-disclosure that NAMES your target = decay

Banked: 2026-07-15, cycle321 (pre-filing re-verify of the live pile).

What decayed and why

Staged ~07-09..07-14; re-verified 07-15: - Amazon Q x3 DECAYED: Wiz "GhostApproval" (07-09) NAMED Amazon Q Developer for the class + AWS started a path-canonicalization bug-bash (07-09) on the exact surface. Staged before 07-09, decayed by 07-15. The residual sinks are still technically unpatched, but (a) the class is now publicly attributed to Amazon Q specifically, and (b) the vendor is actively bug-bashing that surface = high dup / mid-fix risk. - continue x2 EOL (Cursor acquisition, cycle320). - Forgejo x7 + cline x1 = still fileable (unnamed, unpatched, alive).

The lessons

1. In a HOT/actively-swept class, the staging->filing window must be SHORT (days, not weeks). GhostApproval/OX/SymJack/acquisitions moved the AI-agent landscape within a single week. A finding staged and left unfiled for a week decays. When you find something in a hot class, file (or hand to the operator to file) IMMEDIATELY.
2. A class-disclosure that NAMES your specific TARGET = decay, even if your specific sink is unpatched. GhostApproval naming "Amazon Q Developer" decayed our incomplete-fix residuals (elevated dup + triager "known-class" pushback), independent of whether the exact sink shipped a fix.
3. A vendor bug-bash BRANCH on your exact surface = mid-fix decay. 1.73.0-path-canonicalization-bugbash on requiresPathAcceptance = AWS is about to close the residuals = racing a fix.
4. Conversely, an UNNAMED target in a publicized class is still fileable (cline: not named by Wiz/Adversa, no fix) - but pre-write the "known-class/by-design" counter (unnamed + unpatched + concrete PoC).
5. The pre-filing re-verify is ESSENTIAL, not optional - across cycle320/321 it caught 1 EOL (continue) + 3 decays (Amazon Q) out of 13, shrinking the clean pile to 8. Filing without it = filing dups/EOL/mid-fix.

Net

Clean fast-file pile = Forgejo x7 (file TODAY - Gitea CVEs public, port sprint imminent) + cline x1 (w/ counter). Amazon Q = operator-judgment. continue/roo = EOL. The compounding meta-lesson: our OWN findings are perishable in a hot space; velocity from find->file is the constraint, not find-rate.