[self-reflection] Lessons from merged PRs (2026-03-29 to 2026-04-28)

[github-actions]

Self-Reflection Report

Branch self-reflection/2026-04-28 has been pushed with proposed updates to .github/copilot-instructions.md.

Note: GitHub Actions token lacks PR creation permissions. Please create a PR from the branch manually, or grant the pull-requests: write permission to the workflow.

Scan Window

2026-03-29 to 2026-04-28 — 12 merged PRs scanned

6 Lessons Extracted

#	Source	Category	Summary
1	#180	node-js-pitfall	toLocaleLowerCase() violates replay determinism due to locale-dependent behavior
2	#198	bug-pattern	JavaScript falsy checks silently drop empty protobuf string fields
3	#195, #181	bug-pattern	Serialization of user-provided data must happen inside executor try-catch
4	#179	design-constraint	Entity execution must be tracked in _pendingWorkItems for graceful shutdown
5	#164	bug-pattern	First yield validation now hardened (updates existing documented TODO)
6	#199	testing-insight	Test client must serialize data identically to production client

5 PRs Skipped

• fix: upgrade @azure/identity to resolve msal-browser vulnerability (MVS-2026-vmmw-f85q) #216 — Dependency bump (lockfile only)
• feat: add self-reflection agent, js-fact-checking and simulation skills #184 — Meta/docs infrastructure (no SDK lessons)
• fix: Preserve original URL parsing error cause in getHostAddress() #194 — Below quality threshold (minor convention)
• fix: Cancel pending timer handles when purging orchestration instances #197, fix: Sub-orchestration watcher uses unintended 30s default timeout in InMemoryOrchestrationBackend #156 — Narrow in-memory backend fixes (low reuse value)

To create the PR

gh pr create --head self-reflection/2026-04-28 --base main \
  --title "[self-reflection] Update copilot instructions with lessons from merged PRs" \
  --label copilot-finds