Marker identity no longer falls back silently: GITHUB_JOB/GITHUB_RUN_ID are
measured present and now REFUSE when absent, because the old nojob/norunid/1
defaults are REUSABLE and a stale marker there makes the guard PASS on a
dropped run. GITHUB_RUN_ATTEMPT is NOT measured (absent from the probe's
2.9MB log), so it warns and defaults rather than reddening every merge in the
repo over an assumption — these are required checks and over-strictness is not
free.
The delimiter ban now matches the raw `${{` OPENER, not a closed pair: an
unclosed opener triggers the same rewrite and evaded the 'absolute' rule. It
also covers `build`, whose Smoke + IPTV E2E step runs AFTER Build and push —
a drop there publishes a release candidate that was never booted and that
prod promotion then pulls. Its two payloads moved into env:, so the ban was
free. The record's claim that non-required jobs are 'a smaller cost' was
false for exactly that step.
Also: reject any marked step whose if: the guard protocol cannot model (it was
silently bucketed --always, which would redden a required context on a run
where the step is legitimately skipped); assert the guard's env VALUES, not
just its names; re-check anti-vacuity AFTER the skip gate narrows the set
(reproduced: --always empty + gate fired printed 'All 0 expected step(s)
executed' and exited 0); parametrise the gate tests over both jobs; correct the
migrations guard comment, which was copied verbatim from test's and named keys
migrations does not have.
Docs: restore the build-lane measurement, which a dirty-tree `git checkout -b`
had swept onto a probe branch, and add the positive control measured in the
same run (migrations: All 6 expected step(s) executed, job success). Corrected
the RUNNER_TEMP rationale — that #751 measurement was taken on a job with no
container: and does not transfer to these two.
Decisions-Edit: yes
Refs #756
timothy
b0ed61d3d5