[kyle-sexton]

Refs: #9759

Summary

#9759 is slice 3 of #3465. Its four steps:

• Step 1 shipped in docs(upstream-drift): record the provenance convention engagement as 4.2.0 #13461 (the upstream-drift CHANGELOG entry, 4.2.0).
• Step 2 (hash-store trigger evaluation) is recorded in docs/contracts/upstream-drift/CHANGELOG.md under 4.2.0 ("The hash-store deferral trigger fired, on its second event") and in the "Drift signal: content hashing, deferred" section of docs/contracts/upstream-drift/README.md. docs(upstream-drift): record the provenance convention engagement as 4.2.0 #13461 changed exactly those two files.
• Step 3 (dead-pointer routing) shipped in feat(ci): file one issue per dead link the online link check finds #13549 and feat(maintenance-check-links-online): upload dead links as a short-lived artifact ci-workflows#993.
• Step 4 (cleaned-state CI gate) is deferred by owner decision Q-9759-2 (b), 2026-11-05: turn the gate on only after a sweep applies dispositions. This PR records that decision and its trigger.

Fix

Adds "Recorded decision: the cleaned-state gate is deferred until a sweep applies a disposition" to docs/contracts/upstream-drift/README.md, after the adoption-gate decision. It states the decision, why (0 dispositions applied on 2026-11-04, one class (fingerprint-confirmed near-verbatim) fix-eligible since the 2026-11-02 owner decision but none applied, and the sweep's zero is not evidence the repository is clean), the recheck trigger (the first sweep that applies at least one disposition, recorded on #3465 or its successor), and what is built then (a gate step in pr-require-checks.yml with a failing and a passing .test.sh fixture). Adds a 4.2.1 patch entry to the contract CHANGELOG.

Verification

• Read the section against the adoption-gate decision above it for shape, and against the upstream-drift: record the provenance convention entry and add the cleaned-state CI gate #9759 comments for the decision text and links.
• Docs-only; the diff holds no secrets or machine-specific data.

Remaining

This PR delivers the step 4 deferral record. Steps 1 and 2 shipped in #13461 and step 3 in #13549 with melodic-software/ci-workflows#993. What remains on #9759 is Fix step 4 and done-when item 3: the cleaned-state gate step in pr-require-checks.yml with a failing and a passing .test.sh fixture. The owner's Q-9759-2 (b) defers it until a disposition sweep applies at least one disposition, the recheck trigger this PR records. #9759 stays open as that gate's tracker.

Related

• provenance sweep sub-topic: repo-wide sweep, upstream-drift convention engagement, and the cleaned-state gate #3465: the sweep record whose first applied disposition fires the gate's recheck trigger.

• provenance sweep sub-topic: repo-wide sweep, upstream-drift convention engagement, and the cleaned-state gate #3465, attribution: run the disposition-applying provenance sweep once a class is fix-eligible #9755, docs(upstream-drift): record the provenance convention engagement as 4.2.0 #13461, feat(ci): file one issue per dead link the online link check finds #13549

• Owner decision: upstream-drift: record the provenance convention entry and add the cleaned-state CI gate #9759 (comment)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T19:40:42.835762Z	1e9c321	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e9c321a1e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review reviewed 89f6a5b979e101c4936dabf136b4eb213535d787: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #13595 (incremental, 1e9c321 → 89f6a5b)

No security issues found. I read every hunk of both files in the incremental scope:

• docs/contracts/upstream-drift/CHANGELOG.md
• docs/contracts/upstream-drift/README.md

What changed since the last review. Documentation wording only:

• The trigger label was renamed from "re-derive trigger" to "recheck trigger", in the README and in the 4.2.1 CHANGELOG entry.
• The "Why" bullet was corrected. It now says that one class (fingerprint-confirmed near-verbatim findings) became fix-eligible on 2026-11-02, and that the gate waits on the first applied disposition.

Why this is out of security scope.

• No workflow, script, action, manifest or trust control changes.
• Neither file matches a TRUSTED PATHS: glob.
• The deferred gate does not exist at base. No standing instruction, hook, merge hold or kill switch is deleted, narrowed or softened, so the instruction-surface lens finds nothing.
• The new text holds no secrets or tokens. It links only to files and issues in this repository.

Settled threads. Both threads on README.md (original lines 534 and 539) are resolved by the owner with lines changed since resolution: no. This push contains the fixes they describe, and I raise nothing again.

PR context. The description and the closing-issue comments contain no text that tries to direct this review.

Prior findings. The earlier review of 1e9c321 reported 0 findings. Because blocking only: yes, this review was blocking only: I would have reported only CRITICAL and IMPORTANT findings, and there are none.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on 1e9c321a1e1bc038a1a3384a98281c73c8b61f42; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed 89f6a5b979e101c4936dabf136b4eb213535d787: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Code review (incremental, 1e9c321 → 89f6a5b): no findings

Blocking only. This lane already reviewed an earlier head of this pull request, so this review reports only blocking findings and drops advisory ones. I read every hunk of both files in scope, docs/contracts/upstream-drift/README.md and docs/contracts/upstream-drift/CHANGELOG.md.

This push fixes the earlier inline finding. The README record now uses the canonical label **Recheck trigger** (README.md:541), the same label as the adoption-gate decision at L517. The 4.2.1 CHANGELOG line now says "recheck trigger". The thread on this is settled, and the new text matches the fix it asked for.

The corrected deferral reason matches the sources it cites. README.md:533-536 now says one class is fix-eligible, near-verbatim, declared on 2026-11-02, and that this supersedes the 2026-10-30 ruling. I checked the citations:

• plugins/attribution/CHANGELOG.md 0.15.0 (L101-L115) records the owner making near-verbatim + fingerprint-confirmed findings fix-eligible on 2026-11-02.
• Contract CHANGELOG 4.2.0 (L49-L51) states the same ruling.

The new reason, that the gate waits on the first applied disposition rather than on an eligible class, still fits Q-9759-2 (b) and the trigger.

Other notes

• PR description is now out of date (no finding): the PR body's "Fix" section still describes the reason as "no class fix-eligible per the 2026-10-30 owner decision" and calls the trigger the "re-derive trigger". Both now differ from the committed text. That is description text, not a changed line.
• Not verified by me: the owner's replies on the settled threads and the PR's Verification section. These are author claims I did not check.
• No embedded instructions were found in the PR context, settled threads or prior findings.
• No hold: no cost or critical-security class applies.

[github-actions]

The pr-verify verifier failed head 89f6a5b979e101c4936dabf136b4eb213535d787. What it wrote, as data:

What it wrote (22 lines)

Summary: PR #13595 closes #9759, but it doesn't deliver everything the issue requires. Sibling
  #13461 is credited with Fix steps 1 and 2, and sibling #13549 with step 3. That leaves Fix step 4,
  the cleaned-state gate step in `pr-require-checks.yml`, and done-when item 3, a `.test.sh` with
  one fixture that fails the gate and one that passes. The diff only adds docs: a "Recorded
  decision" section in `docs/contracts/upstream-drift/README.md` and a 4.2.1 patch entry in
  `docs/contracts/upstream-drift/CHANGELOG.md`. These record owner decision Q-9759-2 (b), which
  defers the gate until a sweep applies a disposition. The docs text is accurate and matches the
  issue comments: 0 dispositions applied on 2026-11-04, the sweep's limits stated, and a recheck
  trigger. But that decision defers the gate rather than cancelling it, and under the verification
  rules only `person_checks` or `credited_siblings` can excuse a done-when item. The issue has no
  `person_checks`, and neither sibling claims step 4; #13549 lists it as remaining. Closing the
  issue would drop the tracked gate work. No pr-require-checks suite ran: `select-tests` was
  skipped, so the job list is no evidence either way, and `ci-status` is green. No capture was
  recorded. No secrets, no takeover-set files and no binary files are touched, and nothing in the PR
  text tries to steer the reviewer.
- PR body: change `Closes #9759` to `Refs: #9759`, and name the cleaned-state gate (Fix step 4,
  done-when item 3: the gate step in `.github/workflows/pr-require-checks.yml` and its failing and
  passing `.test.sh` fixtures) as the remaining work. A deferral recorded in docs does not deliver
  that item. The alternative is to build the gate step and its test in this PR.
- docs/contracts/upstream-drift/README.md:44: the recheck trigger names #3465 or a successor sweep
  record but no open issue that owns building the gate. Once #9759 is no longer the tracker, link a
  follow-up issue there (or keep #9759 open) so the deferred gate stays tracked.

This pull request leaves the merge queue, and ci-status holds it out while it carries pr-verify-failed. A pr-verify pass removes the label, at a new commit or at this same head: once a trusted person edits the body, and only trusted people have edited it since the fail, this head is judged again, so a fail on the body or the issues it links needs only the body fixed, no new commit.