ci: route same-repository PR proof through member-only admission - #604

…native capture tool and a drift test

Foreign readers of the report-sink stream (a worker-side TypeScript reader, job
rows) cannot run docker/pf_sink.py. docker/gen_sink_vectors.py writes one
versioned set of byte-exact streams. The Python vectors are produced by the
Python test fixtures that mirror the writer's framing, not captured from the C++
writer: a complete stream with a record of every kind (E, T, O, V, K, X, H) and
the trailer, two streams with a bad trailer (counts, sha256) and two truncated
streams (inside a record, at a line boundary), each with the expected result
recorded from the engine's own reader (the parse as JSON, the converter's
output, or the exact exception class and message). Their header carries
placeholders (empty run_id, engine "test"); the page lists the header fields a
real stream fills. docker/capture_native_sink_vector.py runs docker/run_json.py
on a built hand-written strategy library and a small bar file and saves the
stream exactly as the C++ writer wrote it, with the reader's parse and a
provenance record; the generator's --native-dir adds those files to the
manifest, which carries the wire version, the engine commit, the generator
command and every file's size and sha256.

tests/data/sink_vectors_v1/ holds the set. docker/run_json_sink_vectors_test.py
regenerates the Python vectors and compares them byte for byte with the
committed files, re-reads every committed stream with the reader and the
converter, and for the native files checks the manifest hashes, the reader's
parse and a real header. docs/pages/sink-vectors.md describes the files, what
the set does not cover, and how a foreign reader uses them.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Bring the branch up to date with main so its checks run on the current tree.
No conflicts; no file of the branch changed by the merge itself.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ith a doc-lint rule that holds it

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… tree builder reads

CiFileLoading.make_tree copies the actionlint config and tests/CMakeLists.txt
using self.CONFIG and self.CMAKE. test_second_workflow_files_are_discovered_by_the_ci_entrypoint
lends it an AppTokenEnvironments test that had neither attribute, so the
preflight-tests stage failed with AttributeError before any assertion ran.
The test now carries the same two class constants; no assertion changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Bring the branch up to date with main so its checks run on the current tree.
No conflicts; no file of the branch changed by the merge itself.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…in the number of bars

Strings and maps now live in the paged object store instead of the C++
heap, so their memory does not grow with the number of bars a script runs.

- ScriptString and the map image keep their bytes in store objects; split,
  concat and the map operations read and write through the store.
- Store transactions use a fixed pool of handles (four caller slots plus one
  cleanup slot). Running out throws TxPoolExhausted before any state
  changes; there is no heap fallback. Store::scope() joins an active
  transaction without taking a slot.
- The join hooks join_active_tx() and abandon_joined_tx() are public pure
  virtuals so forwarding wrappers can pass them on. begin_cleanup() is used
  only by the map destructors, and note_cleanup_skipped(CleanupSkip) records
  whether a cleanup was skipped because the transaction was rollback-only or
  because it failed.
- A store refuses the (limit+1)-th live object with
  scratch_capacity_exceeded. The limit is Shape::max_live_objects, default
  and ceiling 1,048,576, counted per store and rolled back with the
  transaction. The error reuses the cohort resource name for now; a
  dedicated name follows before the 1.8.0 tag.
- Tests cover string and map parity, rollback, nested destroy, split, the
  pool limits, the live-object cap and wrapper forwarding, plus 100k and 1m
  growth runs for strings, maps and prepared maps.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge; keeps the strict ruleset's up-to-date requirement.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Two conflicts, both in the source gate. The scanner change here retires the entry for the
trade-ledger iterator index (it no longer matches a site), so that entry stays removed while main's
new entry for the command scratch cache budget is kept. Main also added two entries that reuse the
ids this branch had given to the object-limit message and the map iterator temporary; those two
move to U1545 and U1546. The unreviewed ceiling becomes 1281 (1279 here plus main's 2), the
pending-flat-memory ceiling stays 185, and the pinned OPEN count becomes 1466, the number of
entries (1463 on the common base, plus 2 from main, plus 23 added and minus 22 removed here).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… drop the stale 180 s wording

test_selected_window_ownership_manifest_controls_shard_1of4 took 74 s on an idle
8-vCPU box while shards 2-4 took 41-50 s (the modulo split over sorted case ids
put the heaviest controls together). The four rows carry no explicit TIMEOUT
any more (#504 removed it) but the tree still described a 180 s budget and the
CMake guard still exempted the exact old statement.

- Shards are now assigned largest-first to the lightest shard, with a weight per
  case read from its AST (checker subprocess launches, through self helpers and
  literal loops). No measured seconds are stored. The partition stays exact,
  order independent and deterministic; --shard I/N validation and the
  "ran N tests as selected" fail-closed check are unchanged.
- The two 60 s subprocess deadlines inside the controls are removed.
- scripts/check_cr150_cmake_d.py no longer exempts the old six-row
  "TIMEOUT 180" statement, and its test now requires the refusal.
- docs/ci.md, tests/ownership/README.md and the CMake comment describe the
  balancing and no deadline.
- New rows: balance bound (max/min <= 5/4, violated by the old split) and an
  estimator row; the partition row now checks input-order independence.

Documentation sentences removed from docs/ci.md, all introduced by 375795a (the
change that split the ownership manifest controls into four CTest shards): the
sentence saying that change splits the controls into four CTest shards
(`test_selected_window_ownership_manifest_controls_shard_1of4` through the
fourth), the sentence saying it adds three public registered/run rows to every
engine profile in both fixture worlds and only raises the counts above the
pinned minimum floors, and the sentence saying the private-fixture and receipt
row populations stay the same. The replacement paragraph states the balanced
four-shard split and the unchanged row populations.

Measured on a throwaway 8-vCPU spot VM: shards 51/57/53/55 s after, 74/42/41/50 s
before.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…er-platform stream memory bound

The shared descriptor guard compares every status and descriptor flag at each
boundary and masks only Darwin's kernel-maintained "descriptor was written"
bit (FWASWRITTEN) under __APPLE__. A new test plants a real F_SETFL, F_SETFD
and close after a pipe write and requires the guard to reject each; two more
ctest rows run those planted modes through a small CMake driver that accepts
only exit status 1 together with the guard's own message.

The 64 MiB stream memory test keeps its 1 MiB bound everywhere except Darwin,
where it allows 2 MiB for the 16 KiB page size.

CHANGELOG notes the macOS report-sink limit is no longer listed (re-examined,
not re-measured). 1.8.0 is Linux only, so no CI job exercises the Darwin mask
or the Darwin bound.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Attribute exclusive opens and fork-descendant scratch files to their creating
process, keep unrelated co-tenants out of the witness, and report the offending
path with its PID or an explicit unattributable reason. Add three public Linux
CTest cases for exclusive open, inherited evidence, and diagnostics.

Carry the three rows through verifier floors and mock accounting. Preserve
documentation line counts and refresh the floor-table citations.

Documentation replacements from 3ea5a0d name the old wording:
"Their default runs now enter strict exclusion accounting"
"Verifier 8 + preflight 8 + command-after 8 + report 4 add 28 public rows; plain Debug-type runs enforce the increased registration floors."
"Release 938 with the overlay or 631 without it"
"The floor itself remains fixed at 631/334 absent or 938/365 present"
"The native PR registration floor is 1000"
"Both numbers are constants of the profile"
"The full-run release and kernel floors are the table's own numbers above"
"EXCLUDED_REGISTERED_MIN holds 904 for debug, 895 for sanitizers"
"The run floors in the table above"
The release and kernel table rows from 3ea5a0d use the new floors.

The population wording and table header from b97c409 are replaced:
"The registered column is why the absent floor is not the absent registration, and it is to be re-measured after the registration fix lands."
"registered (present / absent)"

The four citation edits retain the passages named by:
"The floors' numbers live in one place"
"Each profile counts the rows that"
"the minimum number of CTest rows"
"The profile carries a row floor"

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge; keeps the strict ruleset's up-to-date requirement.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…inal docs wrap

The App-token environment guard recognised only actions/create-github-app-token
by action name; a tibdex/github-app-token step fed from vars, inputs or a secret
whose name does not say "private key" passed without an environment. Both
actions are now recognised by name, with a refusal row and a removal control for
every ref and quoting form and every key source.

The docs paragraph about the deployment environments is shortened to its facts
(no internal card id) and the four neighbouring sentences keep their original
line wrapping, so the paragraph is a pure addition to docs/ci.md.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ed reviewer

Read back from the repository settings: both environments allow deployments only
from main and neither has a required reviewer, so the docs sentence no longer
claims an owner review for `release`.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Corrects four comments that no longer match the code they describe, and one
stale line number in a script comment:

- scripts/ci_verify.py: the selected-sink memory test is registered at its
  current line of tests/CMakeLists.txt.
- tests/test_scratch_create_pinned_text.cpp: the header names the files that
  produce the pinned create diagnostics instead of a release.
- src/source/pine_adapter.cpp: the placement table scans the retained
  placements and consults the historical minima for erased rows; it has no
  per-id index.
- include/pineforge/native_host.hpp: the live-order read comment no longer
  claims the reads allocate nothing, since a spilled row is read into a buffer.

No code changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… path it pins

The header named two producing files; the test also pins the id-pair scratch
file and the successor-roots create. It now lists all four scratch paths by
what they are, and drops a stale note about an unobserved prediction. Comment
text only.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…labels

Reword published documentation that carried internal task and card labels so each
passage says what the thing is. Lines that only changed a label keep their meaning.

Sentences replaced or dropped, named by the commit that introduced each:
- 91353de: "Read-only census for CR-150 L22u / A6 and A5-WIDER." and
  "All eight vectors use the three-term verdict;" (arena-bound pages), and the two
  passages of cr150-contracts.md that cite the external design lane's work files
  and its revision 6 amendment.
- d093560: the paragraph of native-refactor-progress.md that quotes the supervisor
  cap and the decision that stopped the R5 performance wave.
- a77fb73: "R4-D L1 advanced BacktestEngine, NativeStrategyHost, and the private
  consumer to engine_script_run_v17;" (abi-stability.md).
- 44bb687: "R5 L4 adds NativeRunSpec::margin, folded only when it is set;" and
  "R5 L5 adds calculation, max_recalculations_per_point and open_ba..." (abi-stability.md).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ds instead of internal tracking labels

Replace internal task, card and work-lane labels in source comments, docstrings,
workflow comments and human-readable progress lines of test programs with plain
descriptions. About 620 text lines in 285 files; no identifier, file name, CTest
selector, CMake fence, assertion or data file is renamed or edited.

Files whose exact bytes are pinned or whose text is data stay unchanged: the
frozen run_json fixture (its digest is asserted), fixture sources hashed by the
heap census, the ci/ gate data, the broker-state waiver list, the ownership probe
notes, the heap census report heading and the run-failure label passed to
note_run_failure. Printed lines that changed are listed in the pull request; each
old text was searched across the engine and the other repositories and nothing
reads them.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…table bytes

check_kernel_residuals.py fed the whole debug-stripped kernel archive to
`strings -a`, so instruction bytes in a text section could spell a forbidden
name by chance (four code bytes were reported on a macOS Release object). The
`strings` surface is now built per archive member from section payloads:
executable sections, sections without file bytes and an explicit list of
debug/linker metadata sections are skipped, every other section (including
unfamiliar names) is scanned. `nm -C` still reads the whole archive.

Duplicate member names in the archive are an InfrastructureError, because
`ar p <name>` cannot select a later member with the same name. A truncated or
unrecognised object structure is an InfrastructureError as well; there is no
fallback to scanning the whole object and no object or offset exception.

Tests: hand-built ELF and Mach-O byte fixtures (thin, fat and fat64, 32 and
64 bit, both byte orders, ELF extended section counts) show that planted code
bytes are ignored while the same word in a data section, an unknown section or
a symbol is still flagged. The macOS fixtures are synthetic, not compiler
output; 1.8.0 is Linux only.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…aragraph adds

Two preflight tests pin docs/ci.md to an exact line count (the post-fleet docs
test and the documented slow-row count test). The environment paragraph is now a
pure addition of one blank and one paragraph line, so both pins read 2016 instead
of 2014. Nothing else in either test changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ps no longer overflow int

The key that buckets equity points into months, (year * 12 + month), was
computed in int. For timestamps far from the epoch (INT64_MIN milliseconds is
about year -292 million) the product overflowed, which is undefined behaviour,
and the libc fallback for seconds beyond +-2^40 could fail and leave an
unfilled calendar. The key is now std::int64_t end to end: the UTC helper, the
memo, the monthly walk and the fold in metrics_fold.hpp. The UTC key always
uses the civil-date arithmetic, which is exact over the whole millisecond
range, and never calls gmtime_r; the chart-timezone key widens the year before
it adds 1900 and multiplies. A local-time lookup that libc cannot answer now
raises the existing report_result_invalid refusal instead of returning a key
read from a zeroed structure. Keys for in-range timestamps are unchanged.

tests/test_utc_month_key_arithmetic.cpp checks the key against an independent
Gregorian day count written in the test, at INT64_MIN, INT64_MIN + 1,
+-2^41 s, INT64_MAX, around the arithmetic span edges, and over a sweep of
month boundaries and leap days.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The two-line comment above the EXPORT_NAME property moved the line from 173 to 174.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The release entrypoint forwarded the report-sink descriptor (PINEFORGE_REPORT_SINK_FD) but no run
id, so run_json.py always received its default `--run-id ""` and the sink header said
`run_id: ""`: a hosting caller could not bind a sink to its run. The entrypoint now forwards
PINEFORGE_RUN_ID the same way it forwards the descriptor: a set value, including an empty one, is
passed on verbatim and run_json.py validates it (UTF-8 text without NUL; it adds no length or
character limit, so a caller that needs a non-empty id refuses an empty one itself); unset
forwards nothing, so the empty default and the old argument list stay byte for byte.

Tests: argv rows beside the descriptor rows (unset keeps the old argv; a value, a quoted
multi-byte value and the empty value are forwarded exactly once; flag order with the descriptor)
and a real-process row that runs the real run_json.py against a real native strategy and reads
`run_id` from the sink header the engine wrote (unset and empty give "", a supplied id comes
back). The README table, the changelog and the entrypoint header describe the variable; the
citations that follow the inserted line move by one.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…main

The native order ABI check compares this file with the frozen base commit and
fails when a single byte differs. The wording pass changed one comment line
in it; restore main's bytes so the file stays pinned. The comment is cleaned
together with the pin in a later joint change.

…indings reports them

With environment bindings on the credentialed jobs, the App-token environment
finding for promote-guard arrives after the runner findings (which main's light
job move added) and the action-pin lint, not first. The expected list is built
in that order; every finding is still required, none is dropped.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

A hosted admission workflow (gke-pr.yml, the only pull_request_target file)
admits same-repository pull requests from members and runs the PR proof legs
on bare gke-<size>-<arch> pods from the immutable admitted head; ci.yml keeps
authz only. The admission preflight is repaired as follows.

Derive the admission linter command from its existing single-prologue
constant, restore ci.yml's canon authz job verbatim, point the fixture-floor
documentation test at the full-profile Verify workflow, and reject embedded
bare CR characters while accepting normal CRLF. Add specific regression and
mutation controls without changing the reported parser-differential row.

Convert only the four gke-pr.yml runs-on blocks to bare scale-set scalars,
keeping their existing 8/32/16/8 CPU sizes and amd64 architecture. Both
admission and general runner checks pin the raw scalar; the refusal tests
cover mappings, arrays, self-hosted arrays, expressions and other wrong
scalar forms. Other workflows retain their current pins.

docs/ci.md replaces the sentence introduced by 0212cab because admission now
classifies the immutable compare list before scheduling proof. Its replacing
sentence is "Preflight and the proof jobs start as soon after admission has
classified the compare list and chosen the verifier tier."

docs/ci.md replaces the twelve sentences introduced by 065ef1d because cache
restore/save and optional cold-mode guidance no longer describe these jobs.
The replacing sentences are "Every trusted post and PR proof job is a cold
proof by construction." and "Post profiles build cold, so their results do
not depend on objects written by a pull request." The earlier cache-log and
ASan diagnoses are historical; this change establishes no runtime fix.

docs/ci.md replaces the four sentences introduced by 0983770 because the
workflow compiler cache is now local to a cold job. The replacing sentence
is "Pass --ccache when ccache is installed; it is an empty local directory
on the GKE proof and trusted post jobs."

docs/ci.md replaces the sentence introduced by 0d76a09 with current registry
ownership rather than claiming a new timing measurement. The replacing
sentence is "The registered rows remain pinned in tests/CMakeLists.txt; the
post profiles execute their full population on the verification hosts."

docs/ci.md replaces the four sentences introduced by 133f571 because PR
classification now uses the payload-bound compare list and a second read,
not a first-parent checkout diff. The replacing sentence is "The base tree's
copy judges the list, so a PR cannot change the classifier that admits it."
The replacing timing cell says "Seconds after the second compare read and
job-result checks."

docs/ci.md replaces the twelve sentences introduced by 21ba62b because
admission, preflight and the hosted result now own the former changes/build
aggregate policy. The replacing sentences are "After successful admission,
preflight always runs for an allowed PR." and "The hosted result job
requires admission and preflight success, accepts a skipped proof group
only for the two classified classes, and applies a one-way code-extension
veto."

docs/ci.md replaces the twenty-six sentences introduced by 3a0d150 because
PR proof work moved to the main-defined admission workflow and both PR and
trusted post jobs now build cold. The replacing sentences are "The only job
of ci.yml is authz; PR proof work lives in gke-pr.", "PR proof legs build
cold; trusted post workflows also build cold and contain no Actions cache
restore or save.", and "gke-pr inlines the corpus subset for ordinary code
PRs and skips it only after the base classifier proves docs-only or
GitHub-only." The opening trigger table and hosted result replace the
former PR matrix and build-gate descriptions.

docs/ci.md replaces the two sentences introduced by 3ea5a0d because shared
Actions compiler-cache keys and shard-1 publication were removed. The
replacing sentences are "Native diagnostic artifacts carry the shard index;
compiler and curl installations have no Actions cache." and "Trusted post
workflows and PR proof legs build cold; no trusted job restores an Actions
cache."

docs/ci.md replaces the two table entries introduced by 6c95d82 because the
opening table now separates admission from full post verification. The
replacing ci-post.yml proof-jobs row says "Complete Release, Debug, native,
kernel and parity profiles"; the later full-check and arm64 paragraphs
retain the architecture detail.

docs/ci.md replaces the three sentences introduced by 91353de with the
admission/post trigger map, while retaining the later precise exclusion
clarification: "The verifier's Debug-type default excludes slow from Debug
and sanitizer runs on every event, including non-PR events; Release, kernel
and native retain every row." Complete profiles still mean the verifier's
current profile contract, including those Debug-type defaults.

docs/ci.md replaces the table entry introduced by b0f4341 because ci.yml
now retains only hosted authz. Its replacing ci.yml row says "authz:
hosted ubuntu-24.04; no proof legs", with gke-pr.yml listed separately for
hosted admission/result and the GKE proof jobs.

docs/ci.md replaces the two sentences introduced by c85a40b because
main-defined pull_request_target admission is distinct from direct
pull_request routing. The replacing routing sentence says "Verification
jobs keep literal runner pins at the workflow boundary: GKE PR admit is
hosted, while PR preflight, proof legs and parity use gke-runners;
credentialed post work keeps its protected fleet." The event refusal now
says "pull_request workflows cannot name GKE routing." The protected
runner group still selects the admission scale sets, now named by bare
scalars.

docs/ci.md replaces the sentence introduced by d093560 because the subset
fetches and verifies its feed directly instead of restoring corpus/data.
The replacing sentence is "The subset job checks the submodule out with
GIT_LFS_SKIP_SMUDGE=1, fetches the ~176 MB feed directly and checks every
byte against the sha256 in the corpus's own Git-LFS pointer before running
the probes."

docs/ci.md replaces the three sentences introduced by eed6598 because the
hosted result now judges the admitted proof group rather than the former
selected build matrix. The replacing sentences are "The hosted result job
requires admission and preflight success, accepts a skipped proof group
only for the two classified classes, and applies a one-way code-extension
veto." and "Failed, cancelled, missing or unexpected jobs remain red."

docs/ci.md replaces the sentence introduced by 482b000 ("PR build/preflight
and parity subset use the pf-gcp-pr fleet; post preflight/parity use bare GKE
scale-set names; ...") because PR proof legs now run only in the admission
workflow on bare gke-<size>-<arch> scale-set names and ci.yml keeps authz
alone. The replacing sentences are in the opening trigger table and the
"Verification jobs keep literal runner pins" paragraph.

The quoted-key expectation in test_harmless_spellings_are_not_findings visits
ci-post.yml before docs.yml, the order the checker reports them in.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… a site

The reviewed site inventory still listed the assignment of index_ in the
cohort view iterator of native_order.hpp. On the combined tree the scanner
no longer reports that site, so the source-bounds gate stopped on it as
stale. The scope text of that record was last rewritten for the
native_order_v8 namespace rename (aab50fb); the gate passes on that
commit alone and fails only on the combination.

Remove that one record. The gate then reports no findings and its own
tests pass. The scanner's emission for this tree differs from the committed
inventory only in the spacing of one spelling (std::string in
src/detail/o1_store.cpp), which the gate does not distinguish; that record
is left as it is.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit, including CHANGELOG.md.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit, including CHANGELOG.md.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit. The branch also carries the one-record fix to the reviewed
source-site inventory (the record for the cohort view iterator's index member
in native_order.hpp, which the scanner no longer reports).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. No conflict, no
hand edit, including CHANGELOG.md. The run id line in docker/entrypoint.sh
is byte for byte the member's.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the member's branch onto the stack so far. Two conflicts,
both resolved by keeping the member's side of the lines it rewrote:

- docs/ci.md: the opening sentence of the trigger map is the member's one
  sentence; the paragraph it replaces is the one main reworded.
- scripts/ci_preflight.py: the member's gke-pr.yml checks, trusted cache
  checks and authz-only check replace the pull-request pipeline check call
  (the member removes it), and the app token environment check from the
  promotion-guard member stays, first, exactly once.

The resolved ci_preflight.py differs from the member's file by exactly the
promotion-guard member's own 80 changed lines.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>