macOS CI scope: validate-macos stays required, running the full suite for Mac-relevant changes, only changed test modules for test-only changes, and skipping otherwise (decision record, receipt, tests)

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: validate-macos stays required, but on a pull request it now runs
  the full macOS suite only when a macOS-relevant path changes, runs only the changed top-level test modules when
  nothing else relevant changed, and is skipped otherwise; the two macOS bootstrap jobs run on a pull request only in
  full mode, and push, schedule and dispatch runs stay full. This implements
  docs/decisions/2026-10-03-macos-ci-scope.md, adds its receipt, and updates the hardening tests and docs.
• Base commit: 6112d14d40f741855f0b961124d98939daaad00e (head ace6dd766; origin/main has since moved to
  b29036f05, which touches none of these paths except the shared manifests/evidence.json, and
  git merge-tree --write-tree HEAD origin/main is clean).
• Lane: lane:foundation.
• Owned paths touched:
  • .github/workflows/adoption-bootstrap.yml
  • tests/test_workflow_hardening.py, tests/test_adoption_bootstrap_macos.py (comments only)
  • docs/decisions/2026-10-03-macos-ci-scope.md (new), docs/decisions/2026-09-22-github-automation-closure.md
    (a dated note), docs/github-automation.md, adoption/platforms/macos-arm64.md
  • evidence/artifacts/macos-ci-scope-20261003/ (new receipt), .gitignore (one narrow exception for its .jsonl
    input)
  • manifests/evidence.json (registration only, the last commit)

How the three modes work:

Pull request changes	changes writes	validate-macos	bootstrap-macos, -brew
A path in MACOS_PATTERNS (the record's 89, §6.2), or any tests/ path that is not a top-level tests/test_*.py	macos=true	full suite	as before (bootstrap gate)
Only top-level tests/test_*.py modules (still present), plus unlisted paths	macos=false, macos_tests=<modules>	only those modules (scoped result, not a full-suite pass)	skipped
Neither	macos=false, macos_tests=	skipped by its job-level if: (reports success to the required check; recorded as untested)	skipped
changes cannot decide (missing SHA, failed git diff)	fail_safe: macos=true	full suite	as before
changes stops before writing macos	no macos output	full suite (!= 'false', never == 'true')	as before
changes fails after writing its outputs	whatever it wrote	full suite (needs.changes.result != 'success')	as its outputs say
The run is cancelled (a newer push)	—	cancelled, never skipped (record §1)	cancelled

In changed-tests mode, a selected module from which unittest loads no test case fails the step before any test runs,
and the step names it; a selection that loads tests but runs none also fails. Skipped tests are not failures; the step
summary gives their count.

Repair round at ace6dd766

For the Codex root's exact-head source review of 0eceddab (the FINDINGS / HOLD comment) and the review thread "Use
the retained simulation result". Commits: 27b7c8300 (content) and ace6dd766 (registry, last).

1. Per-module zero-test guarantee (root finding 1). The changed-tests step
   (.github/workflows/adoption-bootstrap.yml:995-1005) loads each selected module on its own with
   unittest.defaultTestLoader.loadTestsFromName before unittest runs, and fails naming the module when
   countTestCases() is 0; the exit code decides, so import-time output cannot fool it. The aggregate guard
   (:1013-1017) stays for a selection that loads tests but runs none.
   • Tests (tests/test_workflow_hardening.py, ChangedTestsStepRunTests):
     test_a_module_with_no_test_beside_a_module_with_tests_fails_naming_it (both orders: exit 1, the error names
     tests.test_zz_empty, unittest never starts) and test_a_module_with_no_test_fails_before_unittest_runs.
   • Negative control: test_control_without_the_per_module_guard_the_aggregate_check_passes_the_mixed_selection.
     With the guard line neutralized, which leaves 0eceddab's logic, tests.test_zz_pass tests.test_zz_empty
     exits 0 with "ran 1 tests".
   • test_a_selection_that_loads_tests_but_runs_none_fails_as_untested keeps the aggregate guard's own case with a
     real interpreter: a class that skips in setUpClass (Ran 0, OK (skipped=1), exit 0).
   • ValidateMacosModeTests pins the guard's text and its place before the run; its control drops either guard.
2. Failure fallback (root finding 2). The gate (:812) adds needs.changes.result != 'success', and the mode
   (:820) adds needs.changes.result == 'success' to its changed-tests branch. A changes job that does not
   succeed now runs the full job, whatever outputs it wrote.
   • Tests: ValidateMacosGateEvaluationTests evaluates both expressions with a test-local evaluator of the
     documented operator subset (!, ==, !=, &&, ||, parentheses, strings, property paths, cancelled();
     anything else raises). It covers 96 inputs (4 events × 4 changes results × 3 macos values × 2 module lists)
     against the record's §2 table, and includes
     test_a_changes_job_that_failed_after_writing_macos_false_runs_in_full. The oracle has its own test of the
     cited semantics.
   • Negative control: test_control_the_outputs_only_gate_and_mode_scope_or_skip_a_failed_changes_job. 0eceddab's
     gate and mode, byte-identical to git show 0eceddab:.github/workflows/adoption-bootstrap.yml, disagree with the
     table on exactly the 6 inputs (pull_request, failure|cancelled|skipped, macos=false, either module list). They
     give changed-tests with modules and a skip without.
   • Text pins: two more mutations in test_the_pre_fix_condition_text_fails_this_tests_own_assertions (the result
     term dropped from the gate, or from the mode).
   • Discrimination check, run once and not committed: with the new tests pointed at 0eceddab's workflow, 10
     gate/mode subtests and all 3 changed-tests cases fail.
3. Limits kept explicit (decision record). The status line lists this round's edits.
   • §5.4: EditedByPR establishes prioritization, not exclusive gating. pytorch@dd5cbc42 runs only the top 25% with
     target determination on, and its default leaves that off on macOS.
   • §6.2: the drift guard is textual; C6's closure was computed once.
   • §9: the fixed selector reads an unknown ordinary path as not Mac-relevant by design. The replay, simulation and
     classifications are owner reports. Failed-job output retention was not observed on a hosted run. Skips pass.
   • §6.5: the receipt bullet no longer claims the simulation code.
   • §6.7: control (f′), not run. §6.8: implementation notes. §11: disposition.
4. Review thread PRRT_kwDOUg_LrM6osJBK (P2). §3.5 (L396) and §5 (L501-504) now use sim_r2.json: (b2) with B+
   is 339.9 slot-hours and p90 1.7 min, and B+ saves 27.8 slot-hours, not 48. replay.py checks every simulated
   figure the record states against sim_r2.json (9 checks, all OK; compared, not re-run, since the simulation code
   was not retained). The (a-mac) and (b1) simulated figures are labelled as having no saved output.
5. Hot-file protocol. The six changed files are re-registered with host_receipts.register_file in the last
   commit. component_matrix.py --check and new_host_grand_list.py --check are unchanged. Against origin/main at
   b29036f05, git merge-tree --write-tree exits 0, and the registry is the only shared path. No merge commit was
   needed, so no patch-id comparison applies. Pushed fast-forward 0eceddab0..ace6dd766; git ls-remote reads
   ace6dd76663951526406446d65f2acbb4c6825b1.

SOTA sources

GitHub documentation (the load-bearing behavior), re-read 2026-10-03T21:09Z:

• Troubleshooting required status checks,
  https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks:
  "A job is skipped by a conditional | The job reports 'Success'"; "A workflow is skipped by path filtering ...
  Associated checks stay in a 'Pending' state and block merging"; "Use always() with needs for required checks
  that depend on other jobs".
• Status checks reference, https://docs.github.com/en/pull-requests/reference/status-checks: "A job that is skipped
  will report its status as 'Success'. It will not prevent a pull request from merging, even if it is a required
  check."
• Contexts reference, github/docs@2bd66de,
  content/actions/reference/workflows-and-actions/contexts.md:97, :100, :110: jobs.<job_id>.env may read
  needs; jobs.<job_id>.if may read needs and call cancelled(); jobs.<job_id>.steps.if may read env.
• Also cited by the record and not re-read here: control-jobs-with-conditions, re-run-workflows-and-jobs,
  events-that-trigger-workflows#pull_request, the macOS concurrency limit, managing-a-merge-queue.

Repair round, re-read 2026-10-03 at fixed commits:

• github/docs@2bd66de, content/actions/reference/workflows-and-actions/:
  contexts.md:777-779 (needs.<job_id>.outputs, and needs.<job_id>.result with success, failure, cancelled
  or skipped); expressions.md:30 (falsy values), :52-68 (operators; strings compare ignoring case), :322 (a
  status check function replaces the default success()).
• actions/runner@d7bc179,
  src/Sdk/DTExpressions2/Expressions2/Sdk/Operators/And.cs:33-49 and Or.cs:33-49: && and || return an
  operand's value, which the cond && 'changed-tests' || 'full' mode relies on.
• python/cpython@f6650f9, Lib/unittest/: loader.py:203-208 (named modules merged
  into one suite), runner.py:254-256 (one aggregate "Ran N tests" line), main.py:283-288 (exit status 5 only
  when no test ran and none was skipped), suite.py:117-119 and :241-243 (a class that skips in setUpClass runs
  no test).
• pytorch/pytorch@dd5cbc4: tools/testing/target_determination/heuristics/edited_by_pr.py:29-37
  (edited test files get the top score); test/run_test.py:1698-1712 (the --enable-td default, off on macOS) and
  :2452-2458 (the top 25% with target determination, else all tests).

The decision and its precedents:

• The decision record, docs/decisions/2026-10-03-macos-ci-scope.md (from the draft with sha256
  3a5eba0772ed82cf86e0688809788241f676e79072333a0416b75f3371e2b83f), and its receipt
  evidence/artifacts/macos-ci-scope-20261003/.
• Prioritizing the tests a change edits: PyTorch EditedByPR (pinned above). It is prioritization, not exclusive
  gating, and the record says so (§5.4). Memon et al., "Taming Google-Scale Continuous Testing", ICSE-SEIP 2017
  (pre-submit affected targets, post-submit runs, culprit rollback).
• Change-based gating of platform jobs on pull requests, as the record cites: python/cpython@83b40d06
  (Tools/build/compute-changes.py), denoland/deno@b4f08f12 (ci.ts:253-254, :558-591), astral-sh/uv@46b84fd0,
  astral-sh/ruff@127e77ef, rust-lang/rust@db8f076d.

Linters, at the versions the repository pins:

• kjanat/actionlint v1.17.0, actionlint_1.17.0_linux_amd64.tar.gz, sha256
  620abd485a12b6ab1125b844a876414e1d5bd2af8a3125b27f82b01d0d9d6e5a (.github/workflows/validate.yml:89-92).
• koalaman/shellcheck v0.11.0 (manifests/stack.json), asset shellcheck-v0.11.0.linux.x86_64.tar.xz, verified
  against GitHub's asset digest sha256:8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198. Its SC2129
  is why the output writes are grouped, as .github/workflows/catalog-freshness.yml:114 already does.
• zizmor 1.30.1 (the repository's offline strict pass).

Evidence-class table

Claim	Evidence class	Command / receipt
The changes script gives full for a listed path, changed-tests for top-level test modules only, skip for neither or a deletion only, and full on a missing or unknown SHA; each guard has a mutation control	local_integration	ChangesModeComputationTests (bash against scratch git repositories)
validate-macos's gate and mode give the record's mode for all 96 event × changes result × output inputs, and a changes job that failed after writing macos=false runs in full; 0eceddab's outputs-only expressions disagree on exactly those 6 inputs	local_integration (a test-local evaluator of the documented operator subset, not GitHub's evaluator)	ValidateMacosGateEvaluationTests
The changed-tests step passes a scoped run; it fails a failing selection, a module with no test (alone or beside one with tests, before unittest runs), a selection that loads tests but runs none, and an empty or malformed selection; without the per-module guard the mixed selection passes; the aggregate guard is what fails a "Ran 0 tests" exit 0	local_integration	ChangedTestsStepRunTests
Gate text (with the result terms), B+, fail-safe outputs, step guards, PATTERNS equal to the push paths, MACOS_PATTERNS coverage and drift guard (27 files: 21 listed, 6 excluded), the D11 push-path pin	local_integration	tests.test_workflow_hardening (109 tests)
A job skipped by its own if: reports success to a required check	source_review	the GitHub docs above; hosted control (b) of the record's §6.7 has not run
The shipped 89-pattern list reproduces the record's tables (B0, B′, (a-mac), (a-all), (b2); D1; 30-run table; main exposure; coverage), and the record's simulated figures equal sim_r2.json	local_integration (artifact measurement over historical API reads; the simulation is compared, not re-run)	evidence/artifacts/macos-ci-scope-20261003/replay.py, exit 0, replay-output.txt
The workflow lints clean	local_integration	actionlint 1.17.0 with shellcheck 0.11.0; zizmor 1.30.1 offline
Behavior on GitHub-hosted runners (all three modes, required-check reporting, macOS bash, whether a failed job keeps its outputs)	not yet observed	this PR's own run is control (a); controls (b) to (g) and (f′) are pending

Local commands run

Repair round, at nice -n 19 with TMPDIR=/var/tmp/c5-macos, one module per run, on the committed tree at
ace6dd766 unless noted.

$ python3 -m unittest tests.test_workflow_hardening
exit 0: Ran 109 tests in 4.541s / OK (skipped=2)   # PyYAML absent; the hash-frozen list is empty
$ uv run --no-project --with pyyaml==6.0.3 python3 -m unittest tests.test_workflow_hardening
exit 0: Ran 109 tests in 4.728s / OK (skipped=1)   # the YAML parser cross-check executes
$ python3 -m unittest tests.test_adoption_bootstrap_macos
exit 0: Ran 161 tests in 40.427s / OK (skipped=32)
$ python3 -m unittest tests.test_shell_parser_ci           # at 27b7c8300's content (the registry commit changes neither input)
exit 0: Ran 37 tests in 2.527s / OK (skipped=1)
$ python3 -m unittest tests.test_workflow_security_coverage  # same
exit 0: Ran 10 tests in 0.686s / OK
$ python3 -m unittest tests.test_codex_broker_reaper        # same
exit 0: Ran 60 tests in 6.220s / OK
$ python3 -m unittest tests.test_landscape_sweep_skills     # same
exit 0: Ran 110 tests in 7.248s / OK (skipped=40)
$ python3 -m unittest tests.test_adoption_bootstrap         # same
exit 0: Ran 80 tests in 15.458s / OK
$ python3 -m unittest tests.test_adoption_docs_consistency
exit 0: Ran 39 tests in 13.055s / OK (skipped=1)
$ actionlint -color .github/workflows/adoption-bootstrap.yml   # kjanat 1.17.0 and shellcheck 0.11.0, sha256-verified, deleted afterwards
exit 0, no output (repo-wide `actionlint -color`, as validate.yml runs it: exit 0, no output)
$ zizmor --offline --no-config --no-ignores --no-progress --persona regular --strict-collection --format json .github/workflows/adoption-bootstrap.yml
exit 0, 0 findings (the same over `.`: exit 0, 0 findings)
$ python3 scripts/validate.py
exit 0: {"components": 69, "hashed_files": 9589, "profiles": 4, "receipts": 193, "status": "passed"}
$ python3 evidence/artifacts/macos-ci-scope-20261003/replay.py
exit 0 (4 s): 41 OK, PASS: 0 mismatch(es); its output is the committed replay-output.txt
$ python3 scripts/host_receipts.py validate; component_matrix.py --check; new_host_grand_list.py --check; build_ecosystem.py --check; validate_foundation.py --root . --json; validate_catalogs.py; landscape.py --root .; validate_convergence.py --all-recorded --root . --json; build_verdicts.py --check
exit 0 each
$ python3 scripts/validate.py --scan-file <each of the 6 changed files>; gitleaks dir <copies of the same files> --config .gitleaks.toml --redact
exit 0: {"scanned_files": 6, "status": "passed"}; no leaks found (the pre-commit gitleaks hook also passed both commits)

Also at ace6dd766: tests.test_github_automation_practice (exit 0, Ran 8, OK) and tests.test_adoption_launchd
(exit 0, Ran 70, OK (skipped=1)). Not re-run: tests.test_gitleaks_config (37 OK in the first round, 87 s). Its
history scan now also covers this round's two commits; the scans above cover their content, and validate.yml's
secret-scan job runs the module with the pinned gitleaks on this head (.github/workflows/validate.yml:363-372).

Not available on this host: a bash 3.2 binary (BASH32_BINARY), so the 3.2 compatibility of the changes script and
of the changed-tests step rests on construction and on this PR's own macOS run.

Decision record

docs/decisions/2026-10-03-macos-ci-scope.md. Where the implementation goes beyond the record's §6.1 sketch is its
§6.8. The first round added: macos written last; grouped output writes (SC2129); an empty-selection guard;
LC_ALL=C for the module regex; a safe spelling of paths in the step summary; the drift-guard expression; actionlint
1.17.0. The repair round added the changes result in the gate and mode, and the per-module zero-test guard. T1 stays
a process rule (§8.1): the record names no in-repository mechanism, so nothing automates it. One figure does not
reproduce from the record's own saved outputs, and its §10 says so: "52 of 1,211" (51 among pull-request runs; 52
counts one workflow_dispatch run). The decision does not rest on it. The simulated (b2) with B+ figures now are the
saved ones (339.9 slot-hours, p90 1.7 min).

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Integration notes

• manifests/evidence.json was registered against the base's copy plus this branch's rows. At merge, follow the
  hot-file protocol (docs/lanes.md): take main's copy and re-register the 33 files git diff --name-only --diff-filter=AM origin/main...HEAD lists, then component_matrix.py --write, new_host_grand_list.py --write and
  validate.py. The textual merge against b29036f05 is clean today; the merged registry was not validated here.
• After merge, each open pull request needs a new pull_request event (a push, or close and reopen) to get the new
  workflow; a re-run reuses the old SHA and workflow file (record §6.6).
• Owner decisions, not made here: cancelling queued pull-request runs by recorded ID (§6.6), and PR Record the macOS full-suite coverage decision, the CI measurements and five anti-patterns #632's
  Decision and Alternatives (superseded in part by this record).
• Pending: the record's hosted controls (b) to (g) and (f′) on throwaway pull requests, and the 24-hour and 7-day
  re-measurements (§6.6, §6.7).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). No action was added or re-pinned.
• New/changed workflows declare top-level permissions: contents: read
  (or a narrower, explicitly justified addition). Unchanged.
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T22:08:06.761898Z	0ecedda	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0eceddab0c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

FINDINGS / HOLD for #677 head 0eceddab0cec33d8ff4f55233a097093cf4e5ac1. This is an exact-head source review; no hosted control or native fixture was executed by root.

1. The per-module zero-test guarantee is not implemented. The decision says a selected module with zero tests fails. The oracle invokes all selected modules together and rejects only an aggregate zero count. Pinned CPython combines named suites and prints aggregate testsRun. An otherwise passing nonempty module alongside an empty module therefore escapes this guard. The existing single-empty-module fixture does not cover that mixed selection. Please enforce the declared per-module contract and retain a mixed-selection check, or narrow the decision and acceptance claim explicitly.

2. Failure fallback needs its own result condition or a narrower claim. The decision promises full validation if changes fails. The job gate and mode inspect outputs without needs.changes.result; outputs are written before the final summary write. For a failed changes job with populated macos=false, a nonempty module list selects changed-tests and an empty list skips the job. Empty outputs correctly select full mode. GitHub documents outputs and result separately. This is a conditional source counterexample; failed-job output retention was not exercised on a hosted run here. Qualify that case or use the dependency result for the stated fail-safe guarantee. !cancelled() already overrides the implicit success condition under official status semantics; that is not the defect.

Root independently rehashed all 42 present owned head/base bodies and 15 pinned primary originals against their Git identities and checked all 33 owned payload registry bindings; all non-files registry fields remain exact. The frozen packet distinguishes 34 exact PR-owned paths from 110 raw main-to-head paths carrying foreign branch differences. Prospective merge preservation remains unqualified; raw gaps are not proof of eventual deletion.

The fixed selector intentionally skips unknown well-formed unlisted paths. Its textual drift guard is not dependency-graph discovery. The cited PyTorch EditedByPR establishes prioritization, not exclusive test gating. Keep those limits explicit. Retained historical replay, simulation and model outcomes remain owner reports, including the unretained simulation code; they are not new root executions or native upstream acceptance.

Repairs belong to the Claude owner. No root workflow/manifest edit, hosted dispatch, test execution, merge, active client/configuration read or credential/auth access occurred. The root parser's initial dictionary assumption for a list-shaped source map failed; the corrected type-aware verifier checked the exact retained bodies successfully, and the processing failure is preserved.

[seathatflowsinourveins]

SOURCE ACCEPT WITH LIMITS — exact head ace6dd76663951526406446d65f2acbb4c6825b1, replacing my findings on 0eceddab0cec33d8ff4f55233a097093cf4e5ac1 in #677 (comment).

The two source findings close:

1. Every selected module now receives a loadTestsFromName(...).countTestCases() preflight; a zero-case module fails independently of a nonempty module and its order. The combined run retains its aggregate zero-tests guard. This guarantees positive loaded-case count per selected module, with skipped tests allowed; it does not guarantee positive executed-case count for every module. Workflow at this head, declared skip/count scope, CPython recursive loaded-case count at f6650f9.
2. An uncancelled failed changes job explicitly selects macOS and cannot enter changed-tests mode even when a retained output is false; mode falls back to full. This closes the unsuccessful-needs/output interaction in the source. Job condition, mode expression, runner short-circuit operand semantics at d7bc179.

I independently checked all 34 owned payloads, 33 registrations, six commit originals and all 20 pinned upstream originals, including the five newly acquired references. Full foreign preservation is exact against both the prior reviewed head and actual construction base 6112d14d40f741855f0b961124d98939daaad00e: 10,257 Git tuples and 9,556 ordered full evidence rows, plus non-file state. Acquisition handles all closed successfully; this was source inspection, with no fixture, upstream test or hosted control rerun.

Well-formed unlisted paths intentionally skip; this is a fixed textual selector, not a dependency graph. Historical replay, prior failure and warning evidence remain historical. The hosted failed-changes control and prospective merge acceptance remain unverified. The inherited differences against observed main b29036f05905f75df934603eb8f1d2248a01c543 are not attributed to this repair; source acceptance does not certify that prospective merged tree or runtime acceptance.

[seathatflowsinourveins]

Actual merged-source carry ACCEPT WITH LIMITS — landing e0c329ae98efb6ac5e11a49220b69ec6eddbb658, reviewed head ace6dd76663951526406446d65f2acbb4c6825b1, sole parent 7d0174168d478d8e3a01602db2138905b6130f8a. GitHub reports #677 merged at 2026-10-04T00:35:21Z.

Root independently rehashed all 182 frozen bindings and 112 original streams from 56 native commands0, reconstructed all three complete Git trees against their full commit originals, and rederived the actual 34-path roster. All 33 payload modes/types/OIDs and full registration rows match the ACE source verdict.

All 10,269 ordered foreign Git tuples and 9,563 ordered foreign full registration rows remain exact against the prior main. All 9,570 prior registration positions survive projection; the 26 new rows belong to the reviewed payload. Every non-files field, all 193 receipts and all 29 convergence records remain exact. Root explicitly joined every map membership to its complete captured tree: 76 present body joins, including all three registries, plus 26 verified absent prior scopes; zero mismatches.

Frozen manifest113099B/SHA256 60a17275ad39c4cdf591c23eb5d6599fac1ea0a4b5eb99f6038b08552194274d. This is an actual landing observation, extending the earlier prospective source review. The positive LOADED per-module case remains a source case; it was not executed per module here. Skip behavior and the uncancelled full fallback retain their original reviewed scope. This establishes no fresh hosted CI, destination installation, model run, role qualification or GPU acceptance.

One root processing failure is retained: the absent-scope schema omits body_map_claimed_membership; the initial observer incorrectly required the key and exited1 with KeyError. The bounded repair accepts omitted/null claims only for a path independently absent from the complete tree; the rerun exited0. No gate, source payload, registry or upstream test changed. Object derivation follows Git v2.43.0 commit 564d0252ca632e0264ed670534a51d18a689ef5d, Documentation/git-cat-file.txt and Documentation/git-ls-tree.txt, with explicit source-map joins supplementing the frozen root observer.