fix(935): pin the run: key in the wiring test, drop a dangling record key, reword a stale runner claim

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

docs/decisions/records/ci/jq-accepted-version-set.md

@@ -60,8 +60,7 @@ floor rises, with the fleet evidence in hand.
   version assertion there would turn any runner jq change into a repo-wide merge deadlock.
   `test_review_verdict_never_pins_a_jq_version` holds that.
 - *Firing the tripwire blocks merges.* `.claude/hooks/pretooluse-merge-consent.sh` reads the combined
-  commit status and denies on anything not `success`/`skipped` (`ci.advisory-red-blocks-the-merge-gate`,
-  #598), and `script-tests` is a Gitea Actions job folded into it. Only the
+  commit status and denies on anything not `success`/`skipped` (ersatztv#598), and `script-tests` is a Gitea Actions job folded into it. Only the
   `merge_when_checks_succeed` path, which defers to Gitea's required checks, is spared. This is the
   cost of the tripwire, accepted because the remedy is a one-line edit to `--expect`, and the
   2026-10-28 firing is that cost being paid.

scripts/tests/test_jq_preflight.py

@@ -380,7 +380,7 @@ def test_script_tests_pins_the_jq_version():
     assert "jq-preflight.sh --expect" in pr_checks, "script-tests must pin the jq version — that pin is the tripwire"
     # Exactly the accepted set until server-management#1080 settles one version (#935): not 1.6 alone
     # (red on a 1.7 runner), not a wider set (a 1.8 runner must stay red).
-    assert re.search(rf"jq-preflight\.sh --expect {re.escape(ACCEPTED)}\s*$", pr_checks, re.M), (
+    assert re.search(rf"^\s*run: \./scripts/jq-preflight\.sh --expect {re.escape(ACCEPTED)}\s*$", pr_checks, re.M), (
         f"script-tests must run --expect {ACCEPTED}"
     )
 

scripts/tests/test_pr_changed_files.py

@@ -3345,8 +3345,8 @@ def test_count_pr_mutations_uses_NO_jq_e(tmp_path):
 
     The function's own comment states the rule and the reason: `jq -e` reports the truthiness of its
     LAST OUTPUT, and over empty input jq 1.6 exits 0 where >= 1.7 exits 4 — the divergence that
-    already took this workflow's enforced gate down once (ersatztv#647), on a runner that still ships
-    1.6. Every tally here is therefore read with `jq -r` and range-checked in shell.
+    already took this workflow's enforced gate down once (ersatztv#647), on a runner that may report
+    1.6 (the floor). Every tally here is therefore read with `jq -r` and range-checked in shell.
 
     This exists because the rule was BROKEN one commit after it was quoted (ersatztv#803 added a
     row-validation guard using `jq -e`, three lines below the comment forbidding it) and nothing