ci(preflight): the harmless-spelling fixture wraps the kernel command in a pinned action (ORG-ACTIONPINS, leg rj-20261024t152711-30330e) - #495

…comment, and lint it in preflight (ORG-ACTIONPINS) [replaces #495] (#508)

* ci: pin every third-party action in the engine workflows to a full commit SHA with a version comment (ORG-ACTIONPINS)

66 `uses:` lines changed in .github/workflows/*.yml and .github/actions/setup-live-curl/action.yml: 65 mutable tags
rewritten to `@<40-hex sha> # v<version>` and one bare SHA that lacked its comment. Each pin is the same major the file
used before; no step, job, permission, environment, secret or token mint changes (a before/after comparison of the
diff with the refs stripped is identical line for line). Resolved on 2026-10-24 22:48 with `git ls-remote --tags` on a
spot box; every tag is lightweight, so the tag's sha is the commit:

  actions/checkout v4                         11d5960a326750d5838078e36cf38b85af677262  v4.4.0
  actions/upload-artifact v4                  ea165f8d65b6e75b540449e92b4886f43607fa02  v4.6.2
  actions/setup-python v5                     a26af69be951a213d495a4c3e4e4022e16d87065  v5.6.0
  actions/cache, cache/save, cache/restore v4 0057852bfaa89a56745cba8c7296529d2fc39830  v4.3.0
  actions/create-github-app-token v1          d72941d797fd3113feb6b93fd0dec494b13a2547  v1.12.0
  cloudflare/wrangler-action v3               9acf94ace14e7dc412b076f2c5c20b8ce93c79cd  v3.15.0

The byte-pinned copies of the workflow text that scripts/ci_preflight.py, scripts/test_ci_preflight.py and
scripts/test_ci_release_gate.py compare against (the embedded probe workflow, the release and cache expectations,
the Wrangler deployment, test mutations and fixtures) are moved to the same pinned text so each still equals its
workflow. Two tests read the real workflows and composite action and require a 40-hex sha and a version comment on
every third-party reference.

No documentation or comment sentence is deleted or rewritten.

Lane: ci-fu-pins (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(preflight): refuse any third-party `uses:` that is not a 40-hex commit SHA with a same-line version comment; the lint accepts plain block-style YAML only (ORG-ACTIONPINS)

scripts/ci_preflight.py gains `action_pin_findings`: every `uses:` in .github/workflows/*.yml and every composite
.github/actions/**/action.yml (or .yaml) that is not a local `./` path or a `docker://` image must be
`owner/action[/path]@<40 lowercase hex> # v<version>` on the same line; quoted values, step and job-level `uses:`, remote
reusable workflows and a ref-less `uses:` are judged; the finding names file, line and the offending reference. The lint
is a regression guard for our own reviewed workflow files, so it does not parse arbitrary YAML: it accepts plain block-style
YAML and refuses, with a finding naming file, line, construct and source text, what it cannot follow: anchors, aliases, merge
keys, explicit keys, tags, non-empty flow mappings, quoted keys, backslash escapes in quoted values, quoted values that do not
end on their line, tab indentation, document markers, `uses` without a same-line scalar, unrecognised block lines, non-ASCII
whitespace in structural positions, and any non-LF line break (bare CR, NEL, LS, PS, VT, FF) or C0 control character in the
whole file. Allowed (surveyed on the real tree, twelve YAML files): plain block mappings and sequences, plain and quoted
scalar values, empty `{}` and `[]` as a whole plain value, non-empty flow sequences, block-scalar bodies including `- |`.
Quotes inside flow sequences count only at element start; delimiters of a refused flow collection are counted without quote
masking and the refusal region ends at the first outdent. The `${{ ... }}` scan is linear. The loaders read the bytes and
decode strict UTF-8 (a file that is not UTF-8 is a finding), so a bare CR is no longer erased before the refusal runs. The
documented limit for exotic YAML is in docs/ci.md. The lint was read by sol and argon over five rounds (every finding closed
or classified); the loader and the three promotion-guard tests that now also see the lint's quoted-key finding were fixed
from the lab legs.

Tests: 15 first-round and the later red-first tests (one per refused construct, each break character in a block-scalar body and
in a comment, the C0 controls, flow-quote variants, outdent resumption, loader tests on real files in a temp layout, a real-tree
zero-findings test, mutation controls for the refusal branch and the integration call). docs/ci.md describes the rule.

This commit is the squash of the lint rounds of the series; the pins commit before it rewrites the workflow files. Lanes:
ci-fu-pinlint, ci-fu-pins2/3/4/5 (Codex gpt-6.1-sol), ci-fu-pins6 and pins7 (Claude Sonnet 5.5 via claudock).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

…#481)

* test(ci): pin equivalence CTest row and prerequisite contract (CR-223-ROW)

* test(ci): require equivalence execution and corpus LFS provisioning

* test(ci): extend verifier partition and native row accounting

* ci(live): run corpus equivalence as a required CTest row (CR-223-ROW)

The corpus equivalence driver becomes a permanent runner CTest row, and the
runner-e2e equivalence exclusion leaves `ci_verify.py`.

Two sentences of `docs/ci.md` that dbd17b3 ("Live runner: normalized feed input
and per-action webhook routing (#320)") introduced are retired here because this
change makes them false, and the message names them so the doc-revert gate can
read the retirement:

- "The standalone corpus equivalence driver is not a runner CTest row; its
  harness unit tests remain in the engine-wide inventory." The driver is now the
  `native_live_equivalence_e2e` row in `runner/CMakeLists.txt`, and the same
  sentence's second clause (the harness unit tests staying in the engine-wide
  inventory) is kept verbatim in the replacement text.
- "It refuses label exclusions, missing runner compile commands, missing
  ASan/UBSan or frame-pointer flags, skipped/disabled tests, and, while
  `runner/transport.cpp` exists, a missing WebSocket row or transport skip even
  without `--require-websocket`." Its "skipped/disabled tests" clause is rewritten
  because a required runner e2e skip now fails outright; every other clause is
  kept in the replacement paragraph.

Restored on purpose: nothing. The rest of the diff only adds text.

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: fully qualify the two remote-tracking refs the promote-baseline ancestry check and the doc-reverts default base read (ORG-ACTIONPINS-CARD) [replaces #494] (#507)

* ci: fully qualify the two remote-tracking refs the promote-baseline ancestry check and the doc-reverts default base read (ORG-ACTIONPINS-CARD, LB-464 P3)

promote-baseline.yml tested `git merge-base --is-ancestor "$MERGE_SHA" "origin/$BASE_REF"`, and
check_doc_reverts.py default_base() resolved the bare names `origin/main` then `main`. A short name resolves through
git's ref-lookup order, so a tag called `origin/main` (or `main`) would win over the remote-tracking branch or the
local branch. Both now use the fully qualified names (`refs/remotes/origin/$BASE_REF`; `refs/remotes/origin/main`,
then `refs/heads/main`, same order and same fallback to the merged-pull-request walk). The exact-text pin in
scripts/ci_preflight.py is updated to the new command and stays as strict; the old short form is now a finding.

Red-first tests: the pin refuses the short command and accepts the qualified one; a repository where a TAG named
`origin/main` points at an unrelated commit and the real remote-tracking ref points elsewhere, and the same for a tag
named `main` with no remote-tracking ref, each returns the merge base of the real ref and not the tag's. Five controls
keep the order, the environment override, the local fallback, the merged-pull-request fallback and the no-base result.
The first-parent walk is untouched (the lab-host defect is a separate card).

The default_base docstring in scripts/check_doc_reverts.py is re-wrapped around the two renamed refs; the sentences it
carries come from 1e360bd and d093560 and keep their wording, only the ref names change.

Lane: ci-fu-shortrefs (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci(release): the permission-claim text guard also catches backslash-wrapped, bytes-decoded and fullwidth respellings (PROBE-FU) [replaces #493] (#506)

* ci(release): the permission-claim text guard also catches backslash-wrapped, bytes-decoded and fullwidth respellings (PROBE-FU, sol P2 1/2/4)

The guard in WorkflowPinTests.assert_ruleset_visibility_documentation fails when the gate source, docs/ci.md or
release.yml state that the App needs "administration: read". A read of the probe found three respellings it accepted:
a Markdown hard break written as a backslash before the newline, a bytes constant (b"administr\x61tion: re\x61d",
with or without .decode()), and fullwidth compatibility letters. The collapsed view now treats backslash-newline like
whitespace, bytes constants are decoded into the scanned strings, and every view is NFKC-normalised before case
folding. Three new tests (12 rows) each read the real artifacts, assert the unmodified baseline passes, mutate a copy
and require the specific permission-claim AssertionError; removing only the matching handling turns its rows red.

Not closed, by design: YAML double-quoted scalars with escapes in release.yml (sol P2 3) and runtime string
construction (sol P3); a static text guard cannot decide them, and the exact-output pins on the refusal text remain the
decisive protection. No existing assertion, control or forbidden pattern is changed. The rewritten `view` tuple is code,
not a documentation or comment sentence.

Lane: ci-fu-pfuguard (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the permission-claim guard scans the casefold-only views as well as the NFKC views (PROBE-FU round 2, sol R237 P2)

The first PROBE-FU commit normalised every scanned view with NFKC and replaced the casefold-only views. For an input
such as `Needs administration: read` followed by the trade mark sign, the old guard matched (the sign is a non-word
character after `read`), but after NFKC the text is `readtm` and the word boundary no longer matches, so the claim was
accepted: the change made the guard weaker for that input. Each text is now checked in four views (the two original
views casefolded, and both NFKC+casefolded), so normalisation can only add matches. A restoration control appends the
trade mark case to the gate source, docs/ci.md and the workflow text (direct and line-wrapped, six rows), and a removal
mutant drops the casefold-only scan and must break all six rows.

No existing assertion or control changes; no documentation or comment sentence is deleted or rewritten.

Lane: ci-fu-pfuguard2 (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* tests: drop the TIMEOUT 180 ctest property (owner's no-time-limit rule, P2-CM-F4) (#504)

* tests: drop the TIMEOUT 180 property from the six ownership manifest tests (P2-CM-F4)

One set_tests_properties call carried TIMEOUT 180 for test_selected_window_ownership_manifest,
the four test_selected_window_ownership_manifest_controls_shard_{1..4}of4 and
test_selected_window_ownership_d4. The owner's no-time-limit rule forbids a ctest
ceiling: under pool contention shard 1of4 (119 s normally) hit the 180 s ceiling on the
b250ceb merge-commit ci-post (#283). WORKING_DIRECTORY is kept; no test, label or
line count changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: pin every third-party action to a full commit SHA with a version comment, and lint it in preflight (ORG-ACTIONPINS) [replaces #495] (#508)

* ci: pin every third-party action in the engine workflows to a full commit SHA with a version comment (ORG-ACTIONPINS)

66 `uses:` lines changed in .github/workflows/*.yml and .github/actions/setup-live-curl/action.yml: 65 mutable tags
rewritten to `@<40-hex sha> # v<version>` and one bare SHA that lacked its comment. Each pin is the same major the file
used before; no step, job, permission, environment, secret or token mint changes (a before/after comparison of the
diff with the refs stripped is identical line for line). Resolved on 2026-10-24 22:48 with `git ls-remote --tags` on a
spot box; every tag is lightweight, so the tag's sha is the commit:

  actions/checkout v4                         11d5960a326750d5838078e36cf38b85af677262  v4.4.0
  actions/upload-artifact v4                  ea165f8d65b6e75b540449e92b4886f43607fa02  v4.6.2
  actions/setup-python v5                     a26af69be951a213d495a4c3e4e4022e16d87065  v5.6.0
  actions/cache, cache/save, cache/restore v4 0057852bfaa89a56745cba8c7296529d2fc39830  v4.3.0
  actions/create-github-app-token v1          d72941d797fd3113feb6b93fd0dec494b13a2547  v1.12.0
  cloudflare/wrangler-action v3               9acf94ace14e7dc412b076f2c5c20b8ce93c79cd  v3.15.0

The byte-pinned copies of the workflow text that scripts/ci_preflight.py, scripts/test_ci_preflight.py and
scripts/test_ci_release_gate.py compare against (the embedded probe workflow, the release and cache expectations,
the Wrangler deployment, test mutations and fixtures) are moved to the same pinned text so each still equals its
workflow. Two tests read the real workflows and composite action and require a 40-hex sha and a version comment on
every third-party reference.

No documentation or comment sentence is deleted or rewritten.

Lane: ci-fu-pins (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(preflight): refuse any third-party `uses:` that is not a 40-hex commit SHA with a same-line version comment; the lint accepts plain block-style YAML only (ORG-ACTIONPINS)

scripts/ci_preflight.py gains `action_pin_findings`: every `uses:` in .github/workflows/*.yml and every composite
.github/actions/**/action.yml (or .yaml) that is not a local `./` path or a `docker://` image must be
`owner/action[/path]@<40 lowercase hex> # v<version>` on the same line; quoted values, step and job-level `uses:`, remote
reusable workflows and a ref-less `uses:` are judged; the finding names file, line and the offending reference. The lint
is a regression guard for our own reviewed workflow files, so it does not parse arbitrary YAML: it accepts plain block-style
YAML and refuses, with a finding naming file, line, construct and source text, what it cannot follow: anchors, aliases, merge
keys, explicit keys, tags, non-empty flow mappings, quoted keys, backslash escapes in quoted values, quoted values that do not
end on their line, tab indentation, document markers, `uses` without a same-line scalar, unrecognised block lines, non-ASCII
whitespace in structural positions, and any non-LF line break (bare CR, NEL, LS, PS, VT, FF) or C0 control character in the
whole file. Allowed (surveyed on the real tree, twelve YAML files): plain block mappings and sequences, plain and quoted
scalar values, empty `{}` and `[]` as a whole plain value, non-empty flow sequences, block-scalar bodies including `- |`.
Quotes inside flow sequences count only at element start; delimiters of a refused flow collection are counted without quote
masking and the refusal region ends at the first outdent. The `${{ ... }}` scan is linear. The loaders read the bytes and
decode strict UTF-8 (a file that is not UTF-8 is a finding), so a bare CR is no longer erased before the refusal runs. The
documented limit for exotic YAML is in docs/ci.md. The lint was read by sol and argon over five rounds (every finding closed
or classified); the loader and the three promotion-guard tests that now also see the lint's quoted-key finding were fixed
from the lab legs.

Tests: 15 first-round and the later red-first tests (one per refused construct, each break character in a block-scalar body and
in a comment, the C0 controls, flow-quote variants, outdent resumption, loader tests on real files in a temp layout, a real-tree
zero-findings test, mutation controls for the refusal branch and the integration call). docs/ci.md describes the rule.

This commit is the squash of the lint rounds of the series; the pins commit before it rewrites the workflow files. Lanes:
ci-fu-pinlint, ci-fu-pins2/3/4/5 (Codex gpt-6.1-sol), ci-fu-pins6 and pins7 (Claude Sonnet 5.5 via claudock).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>
Co-authored-by: ci-cx <ci-cx@invalid>

* docs: release-notes backfill for 1.6.2, 1.6.3 and 1.7.0 (README Releases list, CHANGELOG sections) (CR-315)

The README Releases list stopped at v1.6.1 and the CHANGELOG had no 1.6.2 or 1.6.3
section (1.7.0 sat directly above 1.6.1). This adds, from the tags and the GitHub release
bodies only:

- README.md Releases: v1.7.0 (2026-10-25), v1.6.3 (2026-10-23), v1.6.2 (2026-10-21), each
  with its release link, the codegen it pairs with and the CHANGELOG anchor.
- CHANGELOG.md: "1.6.3 - 2026-10-23" (CI, release-gate and test-only; `git diff v1.6.2
  v1.6.3` under src/ include/ cmake/ docker/ runner/ shows only
  docker/run_failure_codes_diff.json) and "1.6.2 - 2026-10-21" (selected-window contract
  revision 1.3 with the EN-115 completeness proof, proportional annualisation for runs
  shorter than a day, CI changes; the maintainer-built linux-x86_64 archive and its SHA-256
  as the release body states them).

Additions only (0 lines removed), so no sentence is replaced and no citation moves; the
engine README and CHANGELOG carry no file:line citations.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: fully qualify the two remote-tracking refs the promote-baseline ancestry check and the doc-reverts default base read (ORG-ACTIONPINS-CARD) [replaces #494] (#507)

* ci: fully qualify the two remote-tracking refs the promote-baseline ancestry check and the doc-reverts default base read (ORG-ACTIONPINS-CARD, LB-464 P3)

promote-baseline.yml tested `git merge-base --is-ancestor "$MERGE_SHA" "origin/$BASE_REF"`, and
check_doc_reverts.py default_base() resolved the bare names `origin/main` then `main`. A short name resolves through
git's ref-lookup order, so a tag called `origin/main` (or `main`) would win over the remote-tracking branch or the
local branch. Both now use the fully qualified names (`refs/remotes/origin/$BASE_REF`; `refs/remotes/origin/main`,
then `refs/heads/main`, same order and same fallback to the merged-pull-request walk). The exact-text pin in
scripts/ci_preflight.py is updated to the new command and stays as strict; the old short form is now a finding.

Red-first tests: the pin refuses the short command and accepts the qualified one; a repository where a TAG named
`origin/main` points at an unrelated commit and the real remote-tracking ref points elsewhere, and the same for a tag
named `main` with no remote-tracking ref, each returns the merge base of the real ref and not the tag's. Five controls
keep the order, the environment override, the local fallback, the merged-pull-request fallback and the no-base result.
The first-parent walk is untouched (the lab-host defect is a separate card).

The default_base docstring in scripts/check_doc_reverts.py is re-wrapped around the two renamed refs; the sentences it
carries come from 1e360bd31 and d0935605c and keep their wording, only the ref names change.

Lane: ci-fu-shortrefs (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci(release): the permission-claim text guard also catches backslash-wrapped, bytes-decoded and fullwidth respellings (PROBE-FU) [replaces #493] (#506)

* ci(release): the permission-claim text guard also catches backslash-wrapped, bytes-decoded and fullwidth respellings (PROBE-FU, sol P2 1/2/4)

The guard in WorkflowPinTests.assert_ruleset_visibility_documentation fails when the gate source, docs/ci.md or
release.yml state that the App needs "administration: read". A read of the probe found three respellings it accepted:
a Markdown hard break written as a backslash before the newline, a bytes constant (b"administr\x61tion: re\x61d",
with or without .decode()), and fullwidth compatibility letters. The collapsed view now treats backslash-newline like
whitespace, bytes constants are decoded into the scanned strings, and every view is NFKC-normalised before case
folding. Three new tests (12 rows) each read the real artifacts, assert the unmodified baseline passes, mutate a copy
and require the specific permission-claim AssertionError; removing only the matching handling turns its rows red.

Not closed, by design: YAML double-quoted scalars with escapes in release.yml (sol P2 3) and runtime string
construction (sol P3); a static text guard cannot decide them, and the exact-output pins on the refusal text remain the
decisive protection. No existing assertion, control or forbidden pattern is changed. The rewritten `view` tuple is code,
not a documentation or comment sentence.

Lane: ci-fu-pfuguard (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the permission-claim guard scans the casefold-only views as well as the NFKC views (PROBE-FU round 2, sol R237 P2)

The first PROBE-FU commit normalised every scanned view with NFKC and replaced the casefold-only views. For an input
such as `Needs administration: read` followed by the trade mark sign, the old guard matched (the sign is a non-word
character after `read`), but after NFKC the text is `readtm` and the word boundary no longer matches, so the claim was
accepted: the change made the guard weaker for that input. Each text is now checked in four views (the two original
views casefolded, and both NFKC+casefolded), so normalisation can only add matches. A restoration control appends the
trade mark case to the gate source, docs/ci.md and the workflow text (direct and line-wrapped, six rows), and a removal
mutant drops the casefold-only scan and must break all six rows.

No existing assertion or control changes; no documentation or comment sentence is deleted or rewritten.

Lane: ci-fu-pfuguard2 (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* tests: drop the TIMEOUT 180 ctest property (owner's no-time-limit rule, P2-CM-F4) (#504)

* tests: drop the TIMEOUT 180 property from the six ownership manifest tests (P2-CM-F4)

One set_tests_properties call carried TIMEOUT 180 for test_selected_window_ownership_manifest,
the four test_selected_window_ownership_manifest_controls_shard_{1..4}of4 and
test_selected_window_ownership_d4. The owner's no-time-limit rule forbids a ctest
ceiling: under pool contention shard 1of4 (119 s normally) hit the 180 s ceiling on the
b250ceba merge-commit ci-post (#283). WORKING_DIRECTORY is kept; no test, label or
line count changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: release ruleset probe lists every branch ruleset (measurement only, gate unchanged) [replaces #489] (#505)

* ci(release): the ruleset probe lists every branch ruleset as visible or hidden, even when the gate verdict is a refusal (CR-245 F1 measurement)

The one dispatch of release-ruleset-probe.yml from main (run 40083495967) refused on the first branch ruleset
of the inventory, the organization ruleset `default` (13094758): "returned missing or invalid bypass_actors
(token cannot see this ruleset's bypass_actors)". The verdict reader stops at the first failure, so the run
did not say whether the release App token can see bypass_actors on the repository ruleset that is the real
barrier (21476386), nor on any other. The probe now first prints one line per branch ruleset of the
includes_parents inventory (id, name, source_type, source, enforcement, updated_at, bypass_actors visible
with the actor count or hidden, applies to main, has a pull_request rule), then runs the unchanged verdict:
success prints the existing success lines; a refusal prints the same ::error:: text on stderr and exits 1,
but stdout now carries the listing. A detail read that fails is reported on its own row and the listing
continues. The listing is a measurement: `gate`, `_release_bump` and `_require_release_rulesets` are
untouched, every gate test and the existing source mutants are kept, and the probe's verdict replay over every
existing ruleset fixture still compares verdict and refusal text byte for byte. The workflow
release-ruleset-probe.yml is not changed. The listing reads each branch ruleset detail independently of the
verdict read (two reads per detail in the probe), which docs/ci.md now says.

Red-first rows: the real situation (org ruleset hidden, repository ruleset visible: both listed, the org one
hidden, refusal unchanged), both hidden, one detail read failing, all visible with a valid barrier, the
read-only call list, and a source mutant that drops the listing.

Rewrites named for the doc-reverts check, all introduced by 9c18d41 (#488, "ci(release): read-only ruleset
probe for the release gate (CR-245 F1)"): docs/ci.md "Success prints the barrier id/name and one compact
inventory line with enforcement, source and bypass visibility."; docs/ci.md "Refusal exits 1 with empty stdout
and the reader's `::error::` diagnostic; API/response failures name the endpoint."; docs/ci.md "Two hidden
rulesets need two dispatches: the first refusal names only the first hidden ruleset; make its `bypass_actors`
visible before dispatching again to identify the second." (replaced: all hidden rulesets are listed in one
dispatch); the probe docstring "Read exactly the bump's ruleset evidence, with the same refusal policy."; two
test comments ("The reader report's complete [] inventory fails on main without an endpoint." and "The
runtime assertions already hold there; the prose does not."). The module docstring sentence "Each
endpoint/page is read at most once; failures refuse without retry or sleep." (ad1ebac, #479) is scoped to the
gate's reads.

Lane: ci-fu-cr488m (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe listing bounds its inventory=ERROR row to 240 characters like the detail-error rows (CR-245 F1 measurement, sol P2)

The new stdout listing printed the whole exception text on an `inventory=ERROR` row, while the per-ruleset
`detail=ERROR` rows truncate it to 240 characters; a `gh` transport error with 300 characters of stderr was
echoed in full. The row now applies the same bound ([:240], still !r-escaped). Four rows assert the exact bounded
line (an inventory transport error, a repository transport error, a default-branch rejection with a long repository
argument, an invalid summary with a long field) together with the unchanged stderr, exit code 1 and API call list
of the verdict; each has a mutation control that removes only the bound and must fail. The verdict functions are
untouched and the verdict's own stderr is not bounded. No documentation sentence is changed (none described a length
limit).

Lane: ci-fu-cr488n (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: pin every third-party action to a full commit SHA with a version comment, and lint it in preflight (ORG-ACTIONPINS) [replaces #495] (#508)

* ci: pin every third-party action in the engine workflows to a full commit SHA with a version comment (ORG-ACTIONPINS)

66 `uses:` lines changed in .github/workflows/*.yml and .github/actions/setup-live-curl/action.yml: 65 mutable tags
rewritten to `@<40-hex sha> # v<version>` and one bare SHA that lacked its comment. Each pin is the same major the file
used before; no step, job, permission, environment, secret or token mint changes (a before/after comparison of the
diff with the refs stripped is identical line for line). Resolved on 2026-10-24 22:48 with `git ls-remote --tags` on a
spot box; every tag is lightweight, so the tag's sha is the commit:

  actions/checkout v4                         11d5960a326750d5838078e36cf38b85af677262  v4.4.0
  actions/upload-artifact v4                  ea165f8d65b6e75b540449e92b4886f43607fa02  v4.6.2
  actions/setup-python v5                     a26af69be951a213d495a4c3e4e4022e16d87065  v5.6.0
  actions/cache, cache/save, cache/restore v4 0057852bfaa89a56745cba8c7296529d2fc39830  v4.3.0
  actions/create-github-app-token v1          d72941d797fd3113feb6b93fd0dec494b13a2547  v1.12.0
  cloudflare/wrangler-action v3               9acf94ace14e7dc412b076f2c5c20b8ce93c79cd  v3.15.0

The byte-pinned copies of the workflow text that scripts/ci_preflight.py, scripts/test_ci_preflight.py and
scripts/test_ci_release_gate.py compare against (the embedded probe workflow, the release and cache expectations,
the Wrangler deployment, test mutations and fixtures) are moved to the same pinned text so each still equals its
workflow. Two tests read the real workflows and composite action and require a 40-hex sha and a version comment on
every third-party reference.

No documentation or comment sentence is deleted or rewritten.

Lane: ci-fu-pins (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(preflight): refuse any third-party `uses:` that is not a 40-hex commit SHA with a same-line version comment; the lint accepts plain block-style YAML only (ORG-ACTIONPINS)

scripts/ci_preflight.py gains `action_pin_findings`: every `uses:` in .github/workflows/*.yml and every composite
.github/actions/**/action.yml (or .yaml) that is not a local `./` path or a `docker://` image must be
`owner/action[/path]@<40 lowercase hex> # v<version>` on the same line; quoted values, step and job-level `uses:`, remote
reusable workflows and a ref-less `uses:` are judged; the finding names file, line and the offending reference. The lint
is a regression guard for our own reviewed workflow files, so it does not parse arbitrary YAML: it accepts plain block-style
YAML and refuses, with a finding naming file, line, construct and source text, what it cannot follow: anchors, aliases, merge
keys, explicit keys, tags, non-empty flow mappings, quoted keys, backslash escapes in quoted values, quoted values that do not
end on their line, tab indentation, document markers, `uses` without a same-line scalar, unrecognised block lines, non-ASCII
whitespace in structural positions, and any non-LF line break (bare CR, NEL, LS, PS, VT, FF) or C0 control character in the
whole file. Allowed (surveyed on the real tree, twelve YAML files): plain block mappings and sequences, plain and quoted
scalar values, empty `{}` and `[]` as a whole plain value, non-empty flow sequences, block-scalar bodies including `- |`.
Quotes inside flow sequences count only at element start; delimiters of a refused flow collection are counted without quote
masking and the refusal region ends at the first outdent. The `${{ ... }}` scan is linear. The loaders read the bytes and
decode strict UTF-8 (a file that is not UTF-8 is a finding), so a bare CR is no longer erased before the refusal runs. The
documented limit for exotic YAML is in docs/ci.md. The lint was read by sol and argon over five rounds (every finding closed
or classified); the loader and the three promotion-guard tests that now also see the lint's quoted-key finding were fixed
from the lab legs.

Tests: 15 first-round and the later red-first tests (one per refused construct, each break character in a block-scalar body and
in a comment, the C0 controls, flow-quote variants, outdent resumption, loader tests on real files in a temp layout, a real-tree
zero-findings test, mutation controls for the refusal branch and the integration call). docs/ci.md describes the rule.

This commit is the squash of the lint rounds of the series; the pins commit before it rewrites the workflow files. Lanes:
ci-fu-pinlint, ci-fu-pins2/3/4/5 (Codex gpt-6.1-sol), ci-fu-pins6 and pins7 (Claude Sonnet 5.5 via claudock).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: ci-cx <ci-cx@invalid>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: CR-150/C4 source allocation-bound gate over the engine and generated C++ (scoped site identities, fail-closed bounded admission) (#469)

* ci: CR-150/C4 source allocation-bound gate over the engine and generated C++

The gate reads ci/cr150-source-bounds.yaml, resolves each entry against the
tree, and fails closed when it cannot judge. Exit 0 = no new unbounded site
(PASS(bounded) count + OPEN listing); --strict exits 1 while any OPEN entry
remains. Two ci_preflight stages run it in warnings and strict mode.

* ci: the CR-150 source-bounds manifest (seed data and ceilings)

1287 lines emitted by --emit-seed: every scanned site with its state, each
OPEN entry (pending-flat-memory, unreviewed) listed and capped by ceilings so
a new OPEN site needs a reviewed ceiling increase.

* ci: pin scoped CR-150 site identities and prove the bound gate both ways

The four docs/ci.md sentences that 48fb19d introduced (the index comparison,
the exit-1 site conditions, the exit-2 manifest conditions, and how to add a
bound) are replaced here by the scoped-site-identity text: the same rules now
speak per (file, symbol) site identity rather than per manifest group. Naming
them here is what check_doc_reverts.py requires of a commit that drops them.

* ci: close the CR-150 source-gate review findings (P0-P3)

P0: the site inventory's file and symbol fields accept placeholder-like
identifiers again (two real rows carry the symbol `none`); the spelling field
still refuses empty and placeholder values.

P1: bounded admission decides locality from a recognized function body,
crossing only statement blocks. Decorated classes, templates, attributed
structs, nested types after an access label, unknown scopes and linkage
blocks are barriers, and `extern` in the declaration's statement is refused.

P2: `%:define` (the C++17 digraph for `#`) is read as a directive, so a
macro cannot bypass the macro refusal.

P3: a macro definition of a name guarded bounded admission uses
(`push_back`, `emplace_back`, `size`, the entry symbol, the bound) is refused
in every scanned file, not only the entry's own file.

Tests cover each finding both ways (admit and refuse), including the
inventory `none` row and a negative control that proves the gate still stays
green on the unmodified tree.

* ci: close the delta read's N1-N4 on the CR-150 source gate

- _directives joins translation-phase splices before lexing, so `%\` + `:define`
  and every `\`-continued spelling are read as the directive they are (N1, N2).
- bounded_issues refuses a trailing backslash or a <% / %> brace digraph in the
  entry and the fixed input file: alternate spellings are outside guarded
  bounded admission rather than silently unscoped (N1, N4).
- macro_names now covers every identifier lexed from the entry and fixed input,
  not five names, and the define regex admits a comment swallowed without a
  separating space, so `#define/**/push_back`, `#define if(c)` and
  `#define static extern` are all refused (N2, N3).
- _text refuses an empty file/symbol even where a placeholder is allowed, so a
  blank inventory field exits 2 (malformed) instead of 1 (stale site) (N6).

Tests: spliced digraph, brace digraph in entry and fixed input, commented and
spliced defines, keyword/type macro rewrites, and blank inventory fields; each
pins the refusal and that no PASS(bounded) survives.

Co-Authored-By: Claude Code <[email protected]>

* ci: close the delta read 2's fail-open inputs on the CR-150 source gate

Guarded bounded admission now refuses, on raw text rather than a lexed
view, every spelling where a lexer and a compiler can disagree: line
splices (including whitespace, FF and VT before the newline) inside
comments and literals, raw string literals and their prefixed forms, NUL,
BOM, non-ASCII text and brace digraphs. A define naming a proof-file
identifier is refused in every scanned file after splice joining,
regardless of lexical context, and blank inventory scope members are now
malformed (exit 2) instead of an ordinary finding.

Header entries under include/ are refused bounded admission: a consumer's
prior includes and build flags are not proven, so the form cannot be
enforced from the proof files alone.

Rewords the one admission sentence added by c989d59dab in docs/ci.md
(replacing its "in the participating source and fixed-input files"
wording) to state the same rule the code now enforces.

Co-Authored-By: Claude Code <[email protected]>

* ci: skip suite jobs on draft PRs; the gate fails on drafts (LB-387) (#466)

* ci: skip the PR suite on draft PRs (LB-387)

Skip preflight, build, sanitizers, kernel-only, native-live, and corpus-parity-subset for drafts; start full runs on ready_for_review.

Update ci_preflight.py trigger/condition pins and matching test_ci_preflight.py pin references, preserving check logic. Keep authz, dependencies, runners, time limits, and build-gate unchanged.

* ci: re-run on converted_to_draft and split the CI group by draft state (LB-387)

Round B of the final read of #466: add converted_to_draft to the pull_request
types so a ready run is followed by a failing draft aggregate when the PR is
converted, and key the concurrency group on the draft flag so a stale draft
re-run cannot cancel the full ready run. Exact pins plus one red control per
change in test_ci_preflight.py.

Lane: ci-draft-fix1 (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: run both ctest label-exclusion tests; refuse duplicate test names (CR-146) (#407)

* ci: run both ctest label-exclusion tests; refuse duplicate test names (CR-146)

* ci: close the evasions of the duplicate-test-name check (CR-146 review round)

Both reads of #407 found the check fail-open: a method redefined inside an if/try/with block of
the class body, a repeated class name, suites that CMake registers outside scripts/ and docker/
(tests/, tests/ownership/, benchmarks/tests/, *_self_test.py), and an empty inspection
population (missing root, empty directory, zero test names) all returned success. The check now
traverses scope-preserving blocks, refuses duplicate class bindings and duplicate module-level
tests, scans the registered Python test inventory, and refuses an empty population; preflight
pins the --root; the diagnostic tests assert the complete location instead of a line prefix.
Regression tests with the readers' counterexamples; the repository tree itself must still pass
(see the lane report for how that was read from the tree).

Lane: ci-m407 fix (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: the duplicate-name check ignores warnings from the files it parses (CR-146 round 3)

The widened scan parses scripts/check_native_c_api_surface.py, whose docstring raises a SyntaxWarning
(invalid escape sequence); the warning leaked into the checker's output and the repository test
`test_repository_inventory_has_no_duplicate_bindings` (empty output expected) failed in preflight. The
parse now suppresses warnings from the scanned source while a real SyntaxError still fails the check.
Red tests: a clean file and a file with a real duplicate, each with an invalid-escape docstring, under
warnings set to `always` and to `error`; the repository assertion is unchanged.

Lane: ci-fu-m407r2 (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: HaoLiangWen <[email protected]>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci(release): narrow release-bump exemption in the release gate (CR-245, G13, v2) (#486)

* ci(release): accept a release-bump commit on main when the release App pushed it (CR-245, round 1)

The release workflow pushes a version-bump commit to main; no PR head has that tree, so the next
release run refused at phase 1. The gate now also accepts main's head when it is a bump commit that
(a) every push-event run of the sha on main records as pushed by the release App
(actor and triggering_actor both pineforge-app[bot], at least one run, all pages read, a run by any
other actor refuses), (b) has a single parent that itself passes phase 1 (a bump on a bump or a merge
commit refuses), and (c) touches exactly the files the workflow writes and stages, VERSION and
docker/run_failure_codes_diff.json, as modifications with unchanged mode 100644 and nothing else.
Red-first tests through gate() with the injected API for the accepted path and each refusal, a mutation
control per condition, preflight pins and docs. Commit metadata is not used for identity: it is
forgeable. Round 2 adds the branch-ruleset check that makes the App the only possible pusher.

Lane: ci-fu-cr245b (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the bump exemption also requires that only the release App can push to main (CR-245, round 2)

The actor check of round 1 is only as strong as the guarantee that nobody else can produce a push
run as the release App. The gate now reads the repository's branch rulesets at gate time and
requires that the cumulative bypass of every ACTIVE ruleset that applies to main and carries a
pull_request or required_status_checks rule is exactly the release App (Integration 4105147, bypass
mode always). It refuses when no push-blocking ruleset applies to main, when one is disabled or
evaluate-only, when another actor or a pull-request-only bypass appears, when bypass_actors is not
returned, when an inventory or detail response is malformed or incomplete (every page is read and
linked), when an applicable ref pattern is not understood, and on any API error. No ruleset id or name
is hard-coded. The gate relies on the App installation permission `administration: read`; release.yml,
docs/ci.md and the preflight pins say so, so removing the permission is a visible breaking change.
Nineteen ruleset tests and thirteen source mutation controls; preflight workflow mutations for the
gate token wiring. Rounds 1 and 2 land together.

Lane: ci-fu-cr245c (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the bump exemption needs one active pull_request ruleset restricted to the release App; Actions pagination honours Link (CR-245, round 3)

Replaces the round-2 barrier of a8b1276 ("the bump exemption also requires that only the release App can
push to main"): it removes the round-2 bypass-intersection sentences and the status-only acceptance that
a8b1276 added to docs/ci.md, and rewrites its tests.

Fresh sol read of the round-2 head: intersecting bypass descriptors across rulesets does not prove an
App-only barrier (a person who holds a role and a team bypasses two rulesets whose lists share only the
App entry), and a required_status_checks rule alone is not a push barrier. The condition is now: at least
one ACTIVE branch ruleset applies to main, carries a pull_request rule, and its OWN bypass list is exactly
the release App (Integration 4105147, bypass mode always); other rulesets, such as the broad default one,
no longer matter. required_status_checks no longer counts. The Actions workflow-runs reader also proves
completeness with the Link header (an advertised unread next page refuses), as the rulesets reader
already did. The round-2 tests that encoded the intersection and the status-only acceptance are
rewritten (status-only now refuses) and new red rows cover overlapping role/team principals, a hybrid
PR/status pair, a valid barrier beside broader rulesets, a second bypass actor, a non-always mode and
the unread-page input; docs, preflight pins and the release.yml comment follow the new wording.

Two refusal-text expectations in test_ci_release_gate.py were wrong, not the gate: the pagination row
lacked "returned" and the empty-payload row doubled it. Both now assert the text the gate emits.

A second fresh sol read found that the HTTP page check and the JSON page check counted different
populations: one HTTP body could carry several JSON documents, so a valid page followed by a headerless
document still returned the green bump verdict (for the runs reader and the rulesets reader alike). Each
framed HTTP body must now be exactly one JSON document, checked before the pages are joined and before the
Link relations are trusted; extra or trailing data, an empty body and a partially headerless response
refuse with the endpoint named. New red rows cover the runs example, the rulesets analogue, an extra
document on page 2, trailing garbage, partially missing headers, an empty body with a next Link and the
PR/status bodies; two new full-source mutants remove the check and must go green on the mutant only.

Lane: ci-fu-cr245d, ci-fu-cr245e and ci-fu-cr245f (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci: promote-baseline preflight rejects workflow-level defaults/env (#482 follow-up) (#483)

* ci: reject workflow-level defaults and env in the promote-baseline pin (SEC846 follow-up)

Post-merge read of #482: the preflight pinned only the promote-guard job block, so
a workflow-level defaults.run.shell or an env carrying a secret passed the checker
while changing how the guard runs. ci_workflow_findings now rejects both, and the
guard's own defaults, with specific findings; tests cover each reported input, the
quoted and empty variants, and the unmodified workflow.

Lane: ci-fu-eng482 (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* test: expect the pinned-guard finding in main's current wording (engine #483 after the main merge)

After main (#470) landed, the checker's finding for a changed promote-guard block reads "must start
with the pinned read-only promote-guard"; this PR's new test_promotion_guard_rejects_job_defaults
still expected the earlier "credential-free" wording in its three subtests, so preflight failed. The
expected list is now the exact list the checker emits (the job-level defaults finding, then the
pinned-guard finding); the assertion stays an exact ordered equality. Checker unchanged.

Lane: ci-fu-eng483b (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* ci(release): read-only ruleset probe for the release gate (CR-245 F1) (#488)

* ci(release): accept a release-bump commit on main when the release App pushed it (CR-245, round 1)

The release workflow pushes a version-bump commit to main; no PR head has that tree, so the next
release run refused at phase 1. The gate now also accepts main's head when it is a bump commit that
(a) every push-event run of the sha on main records as pushed by the release App
(actor and triggering_actor both pineforge-app[bot], at least one run, all pages read, a run by any
other actor refuses), (b) has a single parent that itself passes phase 1 (a bump on a bump or a merge
commit refuses), and (c) touches exactly the files the workflow writes and stages, VERSION and
docker/run_failure_codes_diff.json, as modifications with unchanged mode 100644 and nothing else.
Red-first tests through gate() with the injected API for the accepted path and each refusal, a mutation
control per condition, preflight pins and docs. Commit metadata is not used for identity: it is
forgeable. Round 2 adds the branch-ruleset check that makes the App the only possible pusher.

Lane: ci-fu-cr245b (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the bump exemption also requires that only the release App can push to main (CR-245, round 2)

The actor check of round 1 is only as strong as the guarantee that nobody else can produce a push
run as the release App. The gate now reads the repository's branch rulesets at gate time and
requires that the cumulative bypass of every ACTIVE ruleset that applies to main and carries a
pull_request or required_status_checks rule is exactly the release App (Integration 4105147, bypass
mode always). It refuses when no push-blocking ruleset applies to main, when one is disabled or
evaluate-only, when another actor or a pull-request-only bypass appears, when bypass_actors is not
returned, when an inventory or detail response is malformed or incomplete (every page is read and
linked), when an applicable ref pattern is not understood, and on any API error. No ruleset id or name
is hard-coded. The gate relies on the App installation permission `administration: read`; release.yml,
docs/ci.md and the preflight pins say so, so removing the permission is a visible breaking change.
Nineteen ruleset tests and thirteen source mutation controls; preflight workflow mutations for the
gate token wiring. Rounds 1 and 2 land together.

Lane: ci-fu-cr245c (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the bump exemption needs one active pull_request ruleset restricted to the release App; Actions pagination honours Link (CR-245, round 3)

Replaces the round-2 barrier of a8b1276 ("the bump exemption also requires that only the release App can
push to main"): it removes the round-2 bypass-intersection sentences and the status-only acceptance that
a8b1276 added to docs/ci.md, and rewrites its tests.

Fresh sol read of the round-2 head: intersecting bypass descriptors across rulesets does not prove an
App-only barrier (a person who holds a role and a team bypasses two rulesets whose lists share only the
App entry), and a required_status_checks rule alone is not a push barrier. The condition is now: at least
one ACTIVE branch ruleset applies to main, carries a pull_request rule, and its OWN bypass list is exactly
the release App (Integration 4105147, bypass mode always); other rulesets, such as the broad default one,
no longer matter. required_status_checks no longer counts. The Actions workflow-runs reader also proves
completeness with the Link header (an advertised unread next page refuses), as the rulesets reader
already did. The round-2 tests that encoded the intersection and the status-only acceptance are
rewritten (status-only now refuses) and new red rows cover overlapping role/team principals, a hybrid
PR/status pair, a valid barrier beside broader rulesets, a second bypass actor, a non-always mode and
the unread-page input; docs, preflight pins and the release.yml comment follow the new wording.

Two refusal-text expectations in test_ci_release_gate.py were wrong, not the gate: the pagination row
lacked "returned" and the empty-payload row doubled it. Both now assert the text the gate emits.

A second fresh sol read found that the HTTP page check and the JSON page check counted different
populations: one HTTP body could carry several JSON documents, so a valid page followed by a headerless
document still returned the green bump verdict (for the runs reader and the rulesets reader alike). Each
framed HTTP body must now be exactly one JSON document, checked before the pages are joined and before the
Link relations are trusted; extra or trailing data, an empty body and a partially headerless response
refuse with the endpoint named. New red rows cover the runs example, the rulesets analogue, an extra
document on page 2, trailing garbage, partially missing headers, an empty body with a next Link and the
PR/status bodies; two new full-source mutants remove the check and must go green on the mutant only.

Lane: ci-fu-cr245d, ci-fu-cr245e and ci-fu-cr245f (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): a read-only probe of the bump's ruleset barrier, run once with the release App token (CR-245 F1)

REV finding F1 on the CR-245 release-bump exemption (#486): the gate validates bypass_actors and ref patterns
of EVERY branch ruleset in the includes_parents inventory before it decides which one is the barrier. GitHub
returns bypass_actors only to a caller with write access to the ruleset, so if the release App token cannot see
them on a ruleset (for example the organization ruleset), every release bump is refused. A dry_run of release.yml
cannot test this: the ruleset reads happen only for a sha with no merged pull request.

New subcommand `ci_release_gate.py rulesets-probe --repo OWNER/REPO` runs ONLY the ruleset reader the bump uses
(no sha, ref, git, commit or run reads; GET requests for the repository, the ruleset inventory and the ruleset
details), prints the barrier ruleset and one line per branch ruleset saying whether its bypass_actors were
visible, and refuses with the same error text as `gate`. The gate's verdicts are unchanged: the reader now also
returns the evidence it already validated.

New workflow release-ruleset-probe.yml (workflow_dispatch only, contents: read) mints the App token with the
same action, secrets and scope as release.yml, checks out without persisting credentials, and runs only the
probe with that token. docs/ci.md says how to read its output.

Tests: a token that cannot see bypass_actors is refused with the ruleset named; a visible green barrier is
accepted with the exact two lines and only ruleset reads; the probe equals the real reader on every existing
ruleset fixture; a source mutant that skips the reader goes green only on the mutant; workflow and preflight
pins, each with mutation controls. The preflight and its tests pin the new workflow and runner label.

Lane: ci-fu-cr486p (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the ruleset probe gets the canon authz job; stop claiming which App permission exposes bypass_actors (CR-245 F1, round 2)

Fresh sol + argon reads of the probe commit 6adae66f2:

- P1 (both): test_gcp_sites_reject_cross_class_routes asserted 29 routed GCP sites; the probe workflow adds
  one, and the authz job it now carries adds another, so the derived count is 31 (ci 5, ci-post 8, native 3,
  corpus 3, subset 2, docs 2, docs-post 2, release 3 + prebuilt matrix site, promotion 1, probe 2). The
  PF_CI_LABELS subset stays 15.
- P2 (sol): release-ruleset-probe.yml had no authz job. It now has the canonical authz job, the probe job
  needs it and carries the canonical step guards; the preflight pin and its mutation controls refuse a probe
  workflow without authz or without the dependency. The App-token mint step is unchanged and still
  byte-identical to release.yml's (the probe must use the same token path as the bump).
- P2 (sol): docs/ci.md, the release.yml comment (comment lines only) and the binding release-gate test stated
  as fact that the App permission administration: read exposes bypass_actors. That is not verified: GitHub's
  documentation says bypass_actors is returned only to a caller with write access to the ruleset, and what an
  installation token sees on an inherited organization ruleset is exactly what the probe measures. All three
  now say what is true (the gate needs bypass_actors visible on every branch ruleset in the inventory; if the
  release App token cannot see them the bump is refused; the probe reports whether it can), and the test pins
  that wording, so it fails if the unsupported claim comes back.
- P3 (sol): docs/ci.md said every probe refusal names an endpoint; only API/response failures do. Narrowed.

Names the docs/ci.md sentences this commit removes or rewrites, all introduced by a8b1276 ("ci(release): the
bump exemption also requires that only the release App can push to main"), as a deliberate revert of their
unverified claim:
  "The gate relies on the release App permission `administration: read` to read `bypass_actors`."
  "The App installation has that permission and `contents: write`; the workflow-level `contents: write`
  setting scopes GITHUB_TOKEN and does not grant App permissions."
  "Tokens without administration access may receive a ruleset response with `bypass_actors` omitted; a
  missing field refuses, and the guard never assumes an unreadable list is empty or App-only."
  "Removing this App permission makes every release-bump exemption refuse."
They are replaced by the verified wording above; the guard behaviour (a missing bypass_actors field refuses)
is unchanged.

Open decision, not changed here: the probe and release.yml use the tag references
actions/create-github-app-token@v1 and actions/checkout@v4 where the CI canon wants full-SHA pins; the probe
keeps the same mint as the bump on purpose.

Lane: ci-fu-cr486q (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the probe's hidden-bypass_actors refusal states what was observed, not a permission; dispatch from main (CR-245 F1, round 3)

REV (Opus + sol, static) on the probe: NO-GO, small.

P1: the refusal text printed exactly when a ruleset's bypass_actors is hidden, which is the probe's decisive
output, ended "(App requires administration: read)". That is the permission claim round 2 removed from the
docs, the release.yml comment and the binding test; it was introduced by a8b12768f ("the bump exemption also
requires that only the release App can push to main") as a fifth place and it is unverified (GitHub's
documentation says bypass_actors is returned only to a caller with write access to the ruleset). The text is
now "(token cannot see this ruleset's bypass_actors)", the two assertions that pinned the old text pin the
new exact text, and the absence guard now scans the WHOLE source of ci_release_gate.py (strings and code, not
only comment lines) for the forbidden phrases in every spelling, with restoration controls that reinsert the
old refusal text and seven spelling variants.

F4: docs/ci.md says the one-time dispatch must run from main with main's copy of the workflow, lists the
probe on the isolated pf-gcp-main fleet, and scopes the FLEET-POST=A routing sentence (authz on pf-gcp-pr,
the probe job on pf-gcp-main). F2: comments in ci_preflight.py, its tests and release-ruleset-probe.yml
claimed a pin binds the authz header byte for byte; for this workflow the pin binds the normalised executable
lines (comments and blank lines removed), and the comments now say so. F3: the display branch for a hidden
ruleset is unreachable (the reader refuses first); kept, and docs/ci.md says two hidden rulesets need two
dispatches because the first refusal names only the first.

Rewrites that replace earlier sentences (named for the doc-reverts check):
  docs/ci.md "FLEET-POST=A splits routing at the file boundary: PR jobs use" (introduced by 3a0d150);
  docs/ci.md "Release and promotion use the isolated release fleet: `release`, `notify-hub`, Linux x64"
  (opening from 833f7ac, second line from 3a0d150);
  docs/ci.md "Dispatch **Release ruleset probe** (`release-ruleset-probe.yml`) once to check" (6adae66);
  ci_preflight.py "The canon header is text, not a decoded array" (a8089b2) and "Canon authz keeps its space
  after the comma" (1d5dfd6); the "GCP fleet (owner #1050): non-release jobs on pf-gcp-pr; release-class jobs
  only on pf-gcp-main" copies in the probe workflow, ci_preflight.py and test_ci_preflight.py (1d5dfd6).
Not changed here: the tag-pinned actions (repo-wide card) and the dispatch exposure of the App secrets
(separate L6 card).

Lane: ci-fu-cr486r (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the permission-claim absence guard also sees concatenated string literals, quoted and line-wrapped claims (CR-245 F1, round 3b)

Fresh sol and argon reads of the round-3 commit 5ce34fc50: the whole-source guard
assert_ruleset_visibility_documentation only removed backticks and folded case before matching the forbidden
phrases, so a claim that Python joins from adjacent string literals ("App " "requires administration:" " read"),
a claim in single or double quotes ('administration': 'read'), or a claim wrapped over two comment lines still
passed. The guard now also scans the string constants of the Python source (folding adjacent literals, constant
additions and the literal parts of f-strings through ast) and a normalised view of every text with comment
markers, quotes, backticks, line breaks and runs of whitespace collapsed, in addition to the existing
contiguous scan. The forbidden patterns are unchanged and the three real texts (the gate source, docs/ci.md,
release.yml) still pass. Seventeen restoration controls (concatenated literals, f-string and + variants, quoted
and wrapped-comment variants) were added: each fails against the old guard and is rejected by the new one;
every existing control is kept.

Test-only change: scripts/test_ci_release_gate.py.

Lane: ci-fu-cr486s (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the ruleset probe job runs on pf-gcp-post; pf-gcp-main admits only allowlisted workflows (CR-245 F1)

The org runner group pf-gcp-main (id 9) is restricted to workflows on an allow-list that does not name
release-ruleset-probe.yml, so a dispatch of the probe on ["self-hosted","pf-gcp-main"] would queue forever.
The allow-list is the owner's org security setting and is not widened; the one-time probe uses the
unrestricted pf-gcp-post group (the canon fleet for engine post-merge and manual jobs) instead. Everything
else is unchanged: workflow_dispatch from main, the App-token mint byte-identical to release.yml's,
contents: read, persist-credentials: false, the authz job on pf-gcp-pr, the probe command, release.yml.

Changes: the probe job's runs-on (workflow file and the whole-file template RELEASE_RULESETS_PROBE_WORKFLOW),
RELEASE_JOB_RUNNERS['release-ruleset-probe.yml'] = {'authz': PR_RUNNER, 'probe': POST_RUNNER} (the per-job
map already accepts a non-release label), the fleet tests (the helper now recognises a post override; the
probe on pf-gcp-main or pf-gcp-pr is refused with the specific finding; the post label is accepted; the
site counts stay 31 and 15, derived from the workflow files), and docs/ci.md with one added sentence saying
why. Red-first rows and deletion controls for the new doc sentences.

Rewrites that replace earlier text (named for the doc-reverts check), all introduced by 5ce34fc50
("the probe's hidden-bypass_actors refusal states what was observed...", round 3 of the probe):
  docs/ci.md "The manual `release-ruleset-probe.yml` workflow runs `authz` on" ... "and `probe` on
  `["self-hosted","pf-gcp-main"]`." (only the probe's label changes);
  docs/ci.md "Release, promotion and the release ruleset probe use the isolated release fleet:"
  (the probe leaves the pf-gcp-main list; release, notify-hub, Linux x64 prebuilt and promote stay);
  the comment "# authz uses pf-gcp-pr; the App-token probe uses pf-gcp-main." in the workflow, in
  ci_preflight.py and in test_ci_preflight.py (now pf-gcp-post), which also touches the comment lines of
  6adae66f and 1d5dfd66 that 5ce34fc50 had rewritten.

Also named for the doc-reverts check: the docs/ci.md sentence "`release`, `notify-hub`, Linux x64 `prebuilt`,
baseline `promote` and `release-ruleset-probe.yml`'s `probe` job use `["self-hosted","pf-gcp-main"]`." (the
second half of the sentence above) was introduced by 49a55b5 ("Merge main (a2bb907b0485, the squash of #483)
into the ruleset probe branch", which carried the round-3 probe text) and is rewritten here on purpose: the
probe job leaves the pf-gcp-main list because that group admits only allowlisted workflows.

Lane: ci-fu-cr486t (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci(release): the ruleset probe refuses any dispatch ref other than main before it mints the App token; the runner refusal no longer calls the post fleet isolated (CR-245 F1)

Fresh sol read of the pf-gcp-post move (065826e98): moving the probe job to the unrestricted pf-gcp-post group
removed the only thing that kept it on main, the restricted pf-gcp-main group's workflow and ref allow-list.
A workflow_dispatch with ref=refs/heads/<topic> would run that branch's copy of the workflow, pass authz (which
accepts any workflow_dispatch), mint the release App token and run the branch's script; neither the workflow
nor the probe checked GITHUB_REF. The CI canon requires manual dispatch to satisfy the same ref restriction and
to refuse an unsupported ref before checkout or repository-code execution.

The probe job now starts with a step that has no secrets and no token: [ "$REF" = refs/heads/main ] || fail,
modelled on promote-baseline.yml's own ref refusal, before the App-token mint and before checkout. The
whole-file template and release_rulesets_probe_workflow_findings require that step first and refuse a probe
workflow that lacks it, has it after the mint or checkout, in the authz job only, compares another ref, or
neutralises its exit (|| true, continue-on-error, if:); 13 mutation rows plus an ordering control and a
behavioural dispatch control (a topic ref exits 1 before the mint boundary). The App-token mint step is still
byte-identical to release.yml's. docs/ci.md says the dispatch must run from main and the workflow itself
refuses any other ref. The guard lives in the workflow file, so it stops mistakes, not a writer who edits the
file on their own branch; the lock against that is the environment work (CR-304) that keeps the App secrets
away from non-main refs.

The per-job runner checker's refusal printed " (isolated release)" for a probe pinned to pf-gcp-post; the post
fleet is shared. The suffix is now derived from the pinned label (none for the PR fleet, " (post fleet)" for
the post fleet, " (isolated release)" only for the release label) and the pins that expected the old suffix
(test_gcp_sites_pin_probe_to_the_dispatch_fleet, test_release_ruleset_probe_refuses_release_and_pr_fleets)
expect the new one.

Rewrites named for the doc-reverts check: the suffix expression and its test expectations came from
1d5dfd6 and 065826e98; the pf-gcp-post routing and allow-list sentences of 065826e98 and the main-copy
dispatch wording of 5ce34fc50 are kept; the generic probe refusal of 6adae66f is kept verbatim. No prose
sentence or comment is deleted.

Lane: ci-fu-cr486u (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* test(live): serialize startup replay webhook deliveries (#463)

* test(live): serialize startup replay webhook deliveries

* test(live): assert the delivery order of the startup replay webhooks

Both reads of #463 found that nothing asserted the order the serialisation exists to
preserve: receipts_by_sequence() returns a dict whose equality ignores order. Adds an
ordered raw-byte comparison of the received payloads against the ledger ordinals for
the initial delivery and the redelivery, with a reversal control that calls the same
check, and a comment that --max-attempts is ignored on the routed path.

Lane: ci-m463 fix (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

* CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925de1

One squash-equivalent commit: parent = engine main 9eff925de1 (#463), tree = the CR-150 picks line merged with that main (docs/ci.md the only conflict: the line's clarification paragraph and main's two baseline-promotion paragraphs are adjacent additions, both kept). The squash body at the merge carries this message verbatim.

The 40 documentation sentences below were deleted by commits of the line and are intended: they are the superseded wording of the pages the final 1.7.0 text replaces. scripts/check_doc_reverts.py reads this message for them.

Format per line: file | introducer short sha | start of the deleted sentence. Introducers: dbf56ed (docs/design/arena-bound.md 22), 03b2406 (docs/ci.md 7), c7e6bcb (docs/pages/scratch-tables.md 5), 1fa26e7 (scratch-tables.md 3), b4a3f76 (scratch-tables.md 1), 00dec17 (docs/scratch-store.md 1), 2688775 (docs/pages/abi-stability.md 1).

docs/pages/abi-stability.md | 2688775 | "The engine validates/attaches the inherited fixed-fd-5 arena or returns the handle's typed `report_sink_failed`/`arena_backing`."
docs/pages/scratch-tables.md | 1fa26e7 | 'A jailed arena must be a sealed memfd with at least `F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL`, and the jailed admission (`strategy_require_report_sc'
docs/pages/scratch-tables.md | 1fa26e7 | 'Where sealed memfds do not exist (not Linux) the admission accepts the arena the host supplies.'
docs/pages/scratch-tables.md | 1fa26e7 | 'With `PF_SCRATCH_ARENA_FD` set, only exactly `"1"` enables it; unset or exactly `"0"` preserves the unjailed backing rules, and every other value (inc'
docs/pages/scratch-tables.md | b4a3f76 | 'A jailed arena must be a sealed memfd with at least `F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL`; ordinary files, sealing-disabled memfds and unsupport'
docs/pages/scratch-tables.md | c7e6bcb | 'The engine never changes process signal disposition.'
docs/scratch-store.md | 00dec17 | 'Below it the drain is held to 4,096 B for every population up to 8,191, where the resident journal events own the definitions the spilled book rows ne'
docs/design/arena-bound.md | dbf56ed | 'L18 sibling footer evidence described below; absent from this base'
docs/design/arena-bound.md | dbf56ed | '`erased_minima_` `include/pineforge/source/pine_adapter.hpp:N`;'
docs/design/arena-bound.md | dbf56ed | '`remember_erased` `src/source/pine_adapter.cpp:N`'
docs/design/arena-bound.md | dbf56ed | '`consumed_partial_exit_cycles_` `include/pineforge/source/pine_adapter.hpp:N`;'
docs/design/arena-bound.md | dbf56ed | '`src/source/pine_adapter.cpp:N`'
docs/design/arena-bound.md | dbf56ed | 'The exact external file:line evidence is recorded in the lane report; these sources must be merged and their local anchors refreshed before claiming c'
docs/design/arena-bound.md | dbf56ed | 'Summing all eleven peaks gives:'
docs/design/arena-bound.md | dbf56ed | 'There are eleven persistent regions and up to three extra replacement indexes.'
docs/design/arena-bound.md | dbf56ed | 'Each independently rounded region wastes less than C.'
docs/design/arena-bound.md | dbf56ed | 'Summing independent peaks and adding fourteen complete chunks is conservative even when their real peak times differ.'
docs/design/arena-bound.md | dbf56ed | 'This covers chunk fragmentation, not unlisted stores or a missing population proof.'
docs/design/arena-bound.md | dbf56ed | 'At L=64 the position term is **94*T**; each placement data term is **104*D+168*Q**; consumed-cycle data is **169*Q**; the root term is **16*R**.'
docs/design/arena-bound.md | dbf56ed | "The contract's eleven coefficients agree with the inspected code and L19l-A/C reports."
docs/design/arena-bound.md | dbf56ed | 'No numeric correction to those coefficients was needed. “72..104 bytes/key” in the L19l-C steady-state explanation does not include the rehash overlap'
docs/design/arena-bound.md | dbf56ed | 'Each of two placement data files'
docs/design/arena-bound.md | dbf56ed | 'Each of two placement index peaks'
docs/design/arena-bound.md | dbf56ed | 'Eleven contributions in the table above, including both two-file rows.'
docs/design/arena-bound.md | dbf56ed | 'D=32,Q=1,L=1,E=1; both 128-slot rehash peaks are 3072;'
docs/design/arena-bound.md | dbf56ed | 'No production header declaration is changed.'
docs/design/arena-bound.md | dbf56ed | 'Linux linker wrappers reject write/pwrite/ftruncate on unlinked regular scratch files, while allowing the named report sink.'
docs/design/arena-bound.md | dbf56ed | 'The current base still has those owning-port dependencies.'
docs/design/arena-bound.md | dbf56ed | 'It must not be reported as corpus proof until they land.'
docs/pages/scratch-tables.md | c7e6bcb | 'The report sink stays **OFF**.'
docs/pages/scratch-tables.md | c7e6bcb | 'The host neither constructs a temporary sink nor uses the sink verification/transposition/staging files; it uses ordinary report arrays and the in-mem'
docs/pages/scratch-tables.md | c7e6bcb | 'Optional recorded outputs use the ordinary retained-output reader.'
docs/pages/scratch-tables.md | c7e6bcb | 'Keep the report sink OFF and use the ordinary report route.'
docs/ci.md | 03b2406 | 'Push this prepared migration only after both CORE-TOP gates: laneboss posts **"pf-ci-release live"** and the owner answers **REL-HOSTED**.'
docs/ci.md | 03b2406 | 'Until then a job on that label with no runners only waits, and nothing is pushed.'
docs/ci.md | 03b2406 | 'Each job using these two CI fragments uses the expression verbatim and sets its matching array as a job-level **string** `PF_CI_LABELS`, merged into a'
docs/ci.md | 03b2406 | 'The pre-job hook for those CI fragments also requires the matching `PF_CI_LABELS` string.'
docs/ci.md | 03b2406 | 'It pins the hosted PR deployment job in `docs.ym…