docs(747): row 1's merge was refused, so 1c re-attempts it rather than re-merging

Round 5 returned two Low findings and declared the change mergeable. Both fixed: "1c is row 1 re-merged" was literally false - row 1's ordinary merge was REFUSED with 405, which the table two lines below states, so nothing was merged there to re-merge. 1c re-attempts the same ordinary merge after posting the context. The mechanics field already worded this precisely; the body was the looser of the two. Also joined the 52-col orphan this session's own edit left in ci.actions-credential-scoping, and rewrapped the paragraph the fix lengthened. Refs: #747 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-28 18:19:23 +02:00
parent d8c20e70c9
commit ab00c6bfb8
2 changed files with 7 additions and 7 deletions
@@ -149,8 +149,8 @@ remaining items either: the `v1.25.4` scope enum, the `reqRepoWriter` gate and t
 all stay 1.25.4-dated. Only the 403 needs a scoped PAT minted against the live instance; the scope enum
 and the `reqRepoWriter` gate were established by reading Gitea's source at the version tag (see
 "Measured vs inferred" above), so re-running those needs only a source read at `v1.27.1`. #747 did
-neither. What #747 did settle elsewhere is the merge-path half — see
-`release.main-direct-push-disabled` for the measured
+neither. What #747 did settle elsewhere is the merge-path half — see `release.main-direct-push-disabled`
+for the measured
 `block_admin_merge_override` semantics and for why `enable_bypass_allowlist` is not a substitute.

 **Surviving routes — this record is not a mitigation for any of them.** `RENOVATE_TOKEN` is a
@@ -34,11 +34,11 @@ cite `enable_push: false` alone as the reason the gate holds.
 **The admin-override half is measurable without touching `main` (#747).** It was set on source
 attestation because probing it appears to require merging an unreviewed PR into `main`. It does not: a
 scratch BASE branch carries its own protection rule, so the whole experiment is disposable. Measured
-2026-08-28. Rows 1 and 1c are the SAME base and the SAME PR — 1c is row 1 re-merged after posting its
-context, which is what makes it a control. The other three rows are SEPARATE scratch bases, each with
-its own rule, head branch and PR: they differ by construction, not by mutating one rule in place (arm A
-merged, so its PR could not be re-used). Every row had one probe-named required context that was never
-posted, except 1c.
+2026-08-28. Rows 1 and 1c are the SAME base and the SAME PR — 1c is the same ordinary merge
+re-attempted after posting its context, which is what makes it a control. The other three rows are
+SEPARATE scratch bases, each with its own rule, head branch and PR: they differ by construction,
+not by mutating one rule in place (arm A merged, so its PR could not be re-used). Every row had
+one probe-named required context that was never posted, except 1c.

 | # | base (PR) | `block_admin_merge_override` | `enable_bypass_allowlist` | merge | result |
 |---|---|---|---|---|---|