chore(metrics): code-health dashboard 2026-09-21

[trinity-ability]

Summary

• Weekly /code-health scan for src/backend/ (hotspot score = 90-day git churn × radon cyclomatic complexity).
• client_portal/service.py overtakes agent_service/crud.py as the Fix: Add missing Docker labels to system agent container #1 hotspot (9464 vs 5852), driven mostly by churn nearly doubling since the 2026-09-07 baseline.
• routers/settings.py (previously the Feature/vector log retention #3 hotspot) dropped out of the ranking after being split into a routers/settings/ package — the exact refactor the last report suggested.
• All other tracked metrics (size violations >800 lines, stale TODOs, high fan-out files, circular imports) are flat within the ±10% noise band.
• Data-integrity note (see report): the local checkout this scan started from was 156 commits behind origin/dev — three prior weekly runs (2026-09-08/14/21) had committed locally but never reached origin because dev is a GitHub-protected branch. This run re-cut a fresh branch from the current origin/dev tip and re-ran the full scan from scratch so the numbers reflect real, complete history.

Dashboard-only — no GitHub issues filed. /groom's Debt Health section is the human gate that converts findings into type-refactor tickets.

Test plan

• docs/metrics/code-health-baseline.json and docs/metrics/code-health-latest.md are the only files changed.
• Verified via git log --oneline origin/dev..HEAD that only the dashboard commit is on this branch.
• Report cross-checked against radon, wc -l, and git log --since="90 days ago" output for the top hotspots.

🤖 Generated with Claude Code

[github-actions]

⚠️ Nightly unit-suite found regressions when this PR is merged into dev (1 of 3 seeds).

Regression details (head_sha: `78c4a5303399acd0a7e9a80b0ab63e5f95bdf8c2`)

Seed 12345

Backend unit-suite regression diff

Per-XML totals

Side	Path	Total	Pass	Fail	Error	Skip
base	junit-base-pr2923-12345.xml	16743	16709	2	1	31
head	junit-head-pr2923-12345.xml	16743	16709	2	1	31

❌ New failures introduced by HEAD (2)

Tests failing under HEAD that did not fail under BASE in any seed:

• [E] test_subprocess_pgroup.TestDrainReaderThreads::test_unwinds_reader_stuck_on_grandchild_pipe
• [F] test_subprocess_pgroup.TestDrainReaderThreads::test_unwinds_reader_stuck_on_grandchild_pipe

🟢 Failures fixed by HEAD (2)

• [E] test_subprocess_pgroup.TestDrainReaderThreads::test_buffered_data_preserved_after_grandchild_kill
• [F] test_subprocess_pgroup.TestDrainReaderThreads::test_buffered_data_preserved_after_grandchild_kill

Legend: [F] = assertion failure, [E] = collection or fixture error.
Identity = (classname, name, kind); union taken across all input XMLs.

Reproduce locally: git merge dev && ( cd tests && python -m pytest unit/ -m "not slow" -p randomly --randomly-seed=12345 )

[vybe]

merge-train: batch validated on train/20260921-1418 (#2934).