ci: fix the root causes of main's red checks (stacked on #147)

.cicd-hygiene-allow

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: MPL-2.0
+# Paths the estate Code Hygiene Gate (hyperpolymath/cicd-suite
+# code-hygiene-check) does not scan for debt markers. One git pathspec per
+# line. Every entry names a file whose marker words are data, not debt;
+# real debt is linked as MARKER(#issue) instead (see #148, #149).
+#
+# The maintenance runner IS a debt-marker scanner: its --skip-todo help text
+# and its rg pattern spell the markers it looks for.
+panel-clades/scripts/maintenance/run-maintenance.sh
+# Asserts that tagTypeLabel maps the "Todo"/"Fixme" voice-tag kinds to the
+# display labels "TODO"/"FIXME"; the words are the expected output.
+tests/voicetag_engine_test.js

.claude/CLAUDE.md

@@ -3,6 +3,15 @@
 
 ## Build Commands
 
+> **Stale:** #108 removed `deno.json`, so the `deno task` commands in this file
+> no longer run, and #107 replaced the ReScript sources with stubs. The Deno
+> and pcc gates were removed from CI; the frontend is being ported to
+> AffineScript (owner decision 2026-10-14, no ReScript restore), tracked in
+> #148, which re-adds those gates. There is no JS manifest in the repo yet; a
+> Bun `package.json` + `bun.lock` is the replacement (see Critical Rules).
+> The Rust desktop shell needs `--features gossamer` (Zig 0.15.2 + GTK 3 +
+> WebKitGTK 4.1).
+
 ```bash
 # Compile ReScript modules
 npx rescript build
@@ -72,7 +81,7 @@ deno task test:coverage
 
 - **NEVER use Tauri** — project migrated to Gossamer. All backend refs use `src-gossamer/`
 - **NEVER use TypeScript** — AffineScript only (ReScript is also banned; RS/TS/JS → AffineScript → typed-wasm)
-- **NEVER use npm/bun** — Deno only (npm used only for ReScript compiler)
+- **JS runtime: Bun** (estate primary, owner 2026-10-14), then pnpm, then npm. Deno is retired estate-wide (2026-09-22): add no new Deno tooling. npm is still how the ReScript compiler is fetched until AffineScript replaces it.
 - **Panels, not panes** — PanLL uses "panels" terminology
 - **TEA pattern only** — no MVC, no Redux, no hooks. Model -> Msg -> Update -> View
 - **All state in Model.model** — no global mutable state
@@ -109,3 +118,10 @@ declaration is superseded. NOTE for agents: the **Palimpsest Plaza** panel
 references PMPL as a *feature subject* — a PMPL-adoption/compliance hub. Those
 PMPL strings are intentional product content, NOT this repo's licence; do not
 sweep them.)
+
+## Asking the owner
+
+Put every question that needs the owner's decision through the selector
+(the AskUserQuestion tool), not as prose at the end of a report. Batch up to
+four per call, offer concrete options with the recommended one first, and say
+what each option would cause.

.github/workflows/actions.lock

@@ -0,0 +1,168 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/build-validation.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@v1'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.12.1'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.38.2'
+    '.github/workflows/dogfood-gate.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'hyperpolymath/deed-ecosystem@main'
+        - 'hyperpolymath/k9-ecosystem@main'
+    '.github/workflows/e2e.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'goto-bus-stop/setup-zig@v2.2.1'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/governance.yml':
+        - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3'
+    '.github/workflows/hypatia-scan.yml':
+        - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/label-triage.yml': []
+    '.github/workflows/labels.yml': []
+    '.github/workflows/main-estate-audit.yml':
+        - 'hyperpolymath/cicd-suite@4f5404281dd7092fa77cc18daec7237c4f1ee4ac'
+    '.github/workflows/mirror.yml':
+        - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3'
+    '.github/workflows/push-email-notify.yml':
+        - 'hyperpolymath/smtp-notify-action@v0.5.0'
+    '.github/workflows/rust-ci.yml':
+        - 'hyperpolymath/standards@412a7031577112b31ee287cc6060179d638d6500'
+    '.github/workflows/scorecard.yml':
+        - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3'
+    '.github/workflows/secret-scanner.yml':
+        - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3'
+dependencies:
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
+        owner_id: 1940490
+        repo_id: 260749683
+    'github/codeql-action@v4.38.2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
+        owner_id: 9919
+        repo_id: 259445878
+    'goto-bus-stop/setup-zig@v2.2.1':
+        ref: 'v2.2.1'
+        commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
+        owner_id: 1006268
+        repo_id: 212984112
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
+        owner_id: 75048950
+        repo_id: 623796603
+    'hyperpolymath/cicd-suite@1aa6bfb657f8240db089a8eef1ad4a7ac198bcf0':
+        ref: '1aa6bfb657f8240db089a8eef1ad4a7ac198bcf0'
+        commit: 'sha1-1aa6bfb657f8240db089a8eef1ad4a7ac198bcf0'
+        owner_id: 6759885
+        repo_id: 1326697643
+        uses:
+            - 'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a'
+            - 'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb'
+    'hyperpolymath/cicd-suite@4f5404281dd7092fa77cc18daec7237c4f1ee4ac':
+        ref: '4f5404281dd7092fa77cc18daec7237c4f1ee4ac'
+        commit: 'sha1-4f5404281dd7092fa77cc18daec7237c4f1ee4ac'
+        owner_id: 6759885
+        repo_id: 1326697643
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'hyperpolymath/cicd-suite@1aa6bfb657f8240db089a8eef1ad4a7ac198bcf0'
+    'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a':
+        ref: 'main'
+        commit: 'sha1-f9d999b60cb5f383679ea19912bcdc49c944973a'
+        owner_id: 6759885
+        repo_id: 1275649586
+    'hyperpolymath/deed-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
+        owner_id: 6759885
+        repo_id: 1275649586
+    'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb':
+        ref: 'main'
+        commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb'
+        owner_id: 6759885
+        repo_id: 1275650185
+    'hyperpolymath/k9-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-20f6be5b5a14a48680b236955b5c4ad9033d00d4'
+        owner_id: 6759885
+        repo_id: 1275650185
+    'hyperpolymath/smtp-notify-action@v0.5.0':
+        ref: 'v0.5.0'
+        commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
+        owner_id: 6759885
+        repo_id: 1352485172
+    'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3':
+        ref: '092dedada188f56c5915f74a5fd40aac093742c3'
+        commit: 'sha1-092dedada188f56c5915f74a5fd40aac093742c3'
+        owner_id: 6759885
+        repo_id: 1116521501
+    'hyperpolymath/standards@412a7031577112b31ee287cc6060179d638d6500':
+        ref: '412a7031577112b31ee287cc6060179d638d6500'
+        commit: 'sha1-412a7031577112b31ee287cc6060179d638d6500'
+        owner_id: 6759885
+        repo_id: 1116521501
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
+    'swatinem/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
+        owner_id: 580492
+        repo_id: 298565987

.github/workflows/boj-build.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: BoJ Server Build Trigger
 on:
@@ -7,9 +8,10 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        uses: actions/checkout@v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/workflows/build-validation.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Build Validation
 
@@ -12,57 +13,38 @@
   contents: read
 
 jobs:
+  # The ReScript build, the Deno test gate and the pcc panel-wiring gate were
+  # removed (owner decision; #137, #148). #107 deleted the ReScript frontend
+  # they built and tested, #108 deleted deno.json, and pcc scans .res files,
+  # so none of them could pass or fail on anything real. They come back
+  # against the AffineScript frontend under #148.
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
-      - name: Setup Deno
-        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@v1
         with:
-          deno-version: "2.x"
-
-      - name: Install Linux dependencies for Gossamer
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libgtk-3-dev \
-            libwebkit2gtk-4.1-dev \
-            libayatana-appindicator3-dev \
-            librsvg2-dev \
-            patchelf
-
-      - name: Warm Deno cache (npm + jsr specifiers)
-        run: deno install
-
-      - name: ReScript build gate
-        run: deno task res:build
-
-      - name: Deno test gate
-        run: deno task test
+          toolchain: stable
 
+      # Default features build the GTK/WebKit-free library only; the desktop
+      # shell (`--features gossamer`) is built by E2E's Rust job.
       - name: Rust cargo check gate
-        run: cargo check
+        run: cargo check --locked
 
       - name: Rust test gate
-        run: cargo test --lib -- --test-threads=1
-
-      - name: Setup Rust toolchain for PCC
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-        with:
-          toolchain: stable
+        run: cargo test --locked --lib -- --test-threads=1
 
       - name: Build Panel Contract Compiler
-        run: cargo build --release --manifest-path tools/pcc/Cargo.toml
-
-      - name: Panel wiring verification gate
-        run: ./tools/pcc/target/release/panll panel verify --repo-root .
+        run: cargo build --locked --release --manifest-path tools/pcc/Cargo.toml
 
-  # panel-clades grades ABI: PanelClades.ABI.Grades typechecks against
+  # panel-clades ABI: every PanelClades.ABI module typechecks against
   # typed-wasm's grade kernel at its pin, and the expected rejections are
   # refused.  Idris2 publishes no binaries, so 0.8.0 is built from source,
   # fetched by the commit its v0.8.0 tag names (a tag can move; the SHA
@@ -76,7 +58,7 @@
       IDRIS2_COMMIT: 15a3e4e70843f7a34100f6470c04b791330788df  # v0.8.0
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
@@ -100,5 +82,5 @@
             || { tail -60 "$RUNNER_TEMP/idris2-install.log"; exit 1; }
           echo "$HOME/.idris2/bin" >> "$GITHUB_PATH"
 
-      - name: panel-clades grades ABI
+      - name: panel-clades ABI
         run: bash panel-clades/scripts/check-abi.sh

.github/workflows/casket-pages.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
 
@@ -19,24 +20,25 @@
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2
+        uses: haskell-actions/setup@v2.12.1
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -80,10 +82,10 @@
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
 
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
 
@@ -92,8 +94,9 @@
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@v5.0.1