Handbook: hash adoption/manifest.json without its release pointer (unblocks the v2026.10.05.x re-pin)

[seathatflowsinourveins]

Scope

• What this PR changes: scripts/build_new_wsl_handbook.py now hashes adoption/manifest.json without its release pointer (source.release_tag, source.release_commit, updated_at). It uses scripts/release_due.py's comparable_manifest, so a re-pin no longer changes the generated handbook, which is a new-machine file.
• Why: the v2026.10.05 re-pin (Point new machines at the attested release v2026.10.05.1 #720) failed CI validate run 37266900705, with a stale handbook. Regenerating the handbook in Point new machines at the attested release v2026.10.05.1 #720 makes release_due.py --strict-if-repinned report content_changed, so no re-pin could pass both checks.
• Next: after this lands, release v2026.10.05.1 is cut on main and Point new machines at the attested release v2026.10.05.1 #720 re-pins to it, changing only the pointer.
• Base commit: f946c6d4c
• Lane: lane:foundation
• Owned paths touched: scripts/build_new_wsl_handbook.py, tests/test_new_wsl_handbook.py, the regenerated docs/new-wsl-handbook.{md,json}, evidence/artifacts/new-wsl-handbook-20261001/receipt.json (outputs, generator hash, dated regeneration entry), and manifests/evidence.json (registry, last commit).

SOTA sources

• Reproducible Builds, "Timestamps" (https://reproducible-builds.org/docs/timestamps/, "Timestamps are best avoided"). A generated artifact should not embed build metadata that changes when its content does not. The release pointer is that kind of metadata for the handbook.
• The in-repository normalization this follows: scripts/release_due.py comparable_manifest() at f946c6d4c. It defines the manifest comparison without source.release_tag, source.release_commit and updated_at, and is reused here, not re-implemented.

Evidence-class table

Claim	Evidence class	Command / receipt
A re-pin leaves the handbook current	local_integration	Simulated re-pin, with the pointer fields changed in the worktree: build_new_wsl_handbook.py --check exit 0 (restored afterwards)
The digest ignores the pointer but tracks content	synthetic	tests.test_new_wsl_handbook test_a_re_pin_leaves_the_adoption_manifest_digest_unchanged
Outputs and receipt are current	local_integration	--check exit 0; validate exit 0; validate_convergence --all-recorded exit 0

Local commands run

$ python3 scripts/build_new_wsl_handbook.py --check
exit 0
$ python3 -m unittest tests.test_new_wsl_handbook tests.test_release_pin_contents tests.test_adoption_docs_consistency
OK (skipped=1)
$ python3 scripts/validate.py      (after the registry commit)
exit 0
$ python3 scripts/validate_convergence.py --all-recorded
exit 0

Decision record

None. This is a defect fix in a generator; the cause and the regeneration are recorded in the receipt's regenerations entry. Overturn condition: if the handbook ever needs to show which release it was built for, it should project the pointer as its own labelled field, never inside the input hash.

Checklist

• No workflow or Actions change.
• No secrets; no new required secret.
• No paid surface.
• Peer-owned files and worktrees preserved.

Claude-built. A GPT cross-family read is requested before landing.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 8bc73280e23497c76495359f0181166ae04bbd36. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at this exact head, with no P1 item.

Observed main f946c6d4ca988a17b6fa4392ecb488909f147883. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main f946c6d4ca988a17b6fa4392ecb488909f147883 head 8bc73280e23497c76495359f0181166ae04bbd36 base f946c6d4ca988a17b6fa4392ecb488909f147883 merged-tree 4b6b14d52b7cce827856432a1642ea35daf8bab7 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 6, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 5, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10093 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 4b6b14d52b7cce827856432a1642ea35daf8bab7)

Required checks at this head: 7 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 77d7516d81a94b1cb0e77a7b6c910c28c8104dc9 (parent f946c6d4ca988a17b6fa4392ecb488909f147883), tree 4b6b14d52b7cce827856432a1642ea35daf8bab7. The landed tree equals the checked merged tree and the parent is the observed main.