Round four returned MERGEABLE with seven LOW/NIT items. All seven are fixed rather than shipped,
because three of them are the same defect class this branch has been closing all along.
THREE MORE PROOFS RE-IMPLEMENTED THE COMPARISON THEY NAMED. The previous commit extracted
`duplicate_row_faults` and `env_shadow_faults` for exactly this reason and left the set-equality and
Kind comparisons inline, so `test_MUTATION_a_guard_job_with_its_row_DELETED_is_reported`,
`…_a_PHANTOM_row_is_reported` and `…_a_row_whose_KIND_disagrees_is_reported` still rebuilt
`declared - listed` and the Kind check themselves. Review demonstrated it by flattening the live
assertion and watching the file stay green at 50 passed.
`coverage_faults(declared, listed) -> (missing, phantom)` and `kind_faults(roles, listed)` are now
named detectors that the live checks and all three proofs call, and each proof gained a negative
control. Witnessed after the change:
coverage_faults disarmed -> deleted-row proof REDDENED, phantom-row proof REDDENED
kind_faults disarmed -> kind-disagreement proof REDDENED
Worth recording that the system was never fail-open here: the manifest harness already caught the
same disarm ("the named test still PASSED with the clause mutated"). The in-file proofs were weaker
than their names, not absent.
THE ENV-MERGE EVIDENCE WAS STEP-SCOPE USED FOR A JOB-SCOPE CLAIM. `build`'s Smoke step shows the
runner LAYERS step-level `env:` over workflow-level, and what this branch newly relies on is
job-level layering. Measured: on origin/main no job anywhere declared both a job-level `env:` and a
consumed workflow-level var, so the job scope had no in-repo witness. The gap is now named, with
the exposure bounded — the two publish jobs are `if: github.event_name != 'pull_request'`, so PR CI
cannot exercise it and a non-layering runner would fail loudly on the first push to `main` trying to
publish `":<sha>"`, not silently.
Four wording fixes, each measured:
* the record still enumerated "exactly three jobs are `none`" while three other sites say a list
in prose is a second copy that rots — the fourth site now agrees with them.
* "the remaining `docker-build.yml` jobs" over-scoped: six remain after `test`/`migrations`, and
the table has four, because `toolchain-preflight` and `scan` carry the mark/assert protocol
voluntarily without being in the enforced scope. Said so.
* "on every push to `main`" ignored the Smoke step's own `docs_only` gate.
* `docs/ci-cd.md`'s excluded-token list omitted `tar`, which the source comment includes; and the
`scan` Proof cell disclosed the two pytest files' `NONE` but not the cited script row's, two
cells from a sibling that discloses it — so that row now states it claims no proof at all.
Suite: 1178 passed, 2 skipped (the production-log guard deselected; it is the shared-$HOME flake,
green in isolation — #809/#822). ruff 0.12.11 clean over all 47 tracked files; decisions-validate
OK; doc-narrative 0 warnings.
Refs #786
Refs #789
timothy
1ab50236c3