Fix Six Findings From the Promotion PR's Fresh Review Pass

.agents/skills/dotnet-codestyle/references/conventions.md

@@ -129,7 +129,8 @@ public async Task<string> GetQuoteOfTheDayAsync(string category, CancellationTok
         throw new ArgumentException($"Unsupported category: {category}", nameof(category));
     }
 
-    await Task.Delay(0, cancellationToken);
+    cancellationToken.ThrowIfCancellationRequested();
+    await Task.Delay(1, cancellationToken);
     return $"Quote for {category}";
 }
 ```

.agents/skills/python-codestyle/references/testing.md

@@ -1,8 +1,8 @@
 # Python Testing Conventions
 
-This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest
-against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are
-in `references/profiles.md`.
+This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not
+use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`)
+are in `references/profiles.md`.
 
 Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation:
 `uv run pytest`.

.agents/skills/resync-a-repo/SKILL.md

@@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`,
 push to a protected branch and never a hand edit outside a pull request. Close the review loop,
 per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The
 maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and
-commit the report per `git-commit-conventions`, done means measured, not applied.
+commit the report once authorized, per `git-commit-conventions`, done means measured, not
+applied.

.agents/skills/skill-lifecycle/SKILL.md

@@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim
 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run.
 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses.
 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections.
-6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
+6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from.
 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says.
 

.agents/skills/standup-a-repo/SKILL.md

@@ -74,10 +74,12 @@ maintainer can supply what section 0A lists.
    inventing a shape.
 
 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub
-   repository agree before running anything else here, then apply with
-   `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an
-   operational repo) from the hub at `main` and check with the same command's `check` subcommand,
-   never from a hand-built or carried copy.
+   repository agree before running anything else here, then run
+   `repo-config/configure.sh check owner/repo release` (substitute `operational` for an
+   operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a
+   command failure. Review what it reports. Then run the same command's `apply` subcommand, which
+   idempotently reconciles the repo to the full committed configuration regardless of what `check`
+   reported, never from a hand-built or carried copy.
 
 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood
    up only when it passes for its type, or its residual deltas are tracked in

.claude-plugin/fleet-skills/.source-digest

@@ -1 +1 @@
-9bf75d7cd0da2253
+5ab0e6a26d537def

.claude-plugin/fleet-skills/skills/dotnet-codestyle/references/conventions.md

@@ -129,7 +129,8 @@ public async Task<string> GetQuoteOfTheDayAsync(string category, CancellationTok
         throw new ArgumentException($"Unsupported category: {category}", nameof(category));
     }
 
-    await Task.Delay(0, cancellationToken);
+    cancellationToken.ThrowIfCancellationRequested();
+    await Task.Delay(1, cancellationToken);
     return $"Quote for {category}";
 }
 ```

.claude-plugin/fleet-skills/skills/python-codestyle/references/testing.md

@@ -1,8 +1,8 @@
 # Python Testing Conventions
 
-This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest
-against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are
-in `references/profiles.md`.
+This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not
+use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`)
+are in `references/profiles.md`.
 
 Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation:
 `uv run pytest`.

.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md

@@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`,
 push to a protected branch and never a hand edit outside a pull request. Close the review loop,
 per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The
 maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and
-commit the report per `git-commit-conventions`, done means measured, not applied.
+commit the report once authorized, per `git-commit-conventions`, done means measured, not
+applied.

.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md

@@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim
 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run.
 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses.
 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections.
-6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
+6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from.
 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says.
 

.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md

@@ -74,10 +74,12 @@ maintainer can supply what section 0A lists.
    inventing a shape.
 
 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub
-   repository agree before running anything else here, then apply with
-   `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an
-   operational repo) from the hub at `main` and check with the same command's `check` subcommand,
-   never from a hand-built or carried copy.
+   repository agree before running anything else here, then run
+   `repo-config/configure.sh check owner/repo release` (substitute `operational` for an
+   operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a
+   command failure. Review what it reports. Then run the same command's `apply` subcommand, which
+   idempotently reconciles the repo to the full committed configuration regardless of what `check`
+   reported, never from a hand-built or carried copy.
 
 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood
    up only when it passes for its type, or its residual deltas are tracked in

.github/skills/dotnet-codestyle/references/conventions.md

@@ -129,7 +129,8 @@ public async Task<string> GetQuoteOfTheDayAsync(string category, CancellationTok
         throw new ArgumentException($"Unsupported category: {category}", nameof(category));
     }
 
-    await Task.Delay(0, cancellationToken);
+    cancellationToken.ThrowIfCancellationRequested();
+    await Task.Delay(1, cancellationToken);
     return $"Quote for {category}";
 }
 ```

.github/skills/python-codestyle/references/testing.md

@@ -1,8 +1,8 @@
 # Python Testing Conventions
 
-This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest
-against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are
-in `references/profiles.md`.
+This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not
+use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`)
+are in `references/profiles.md`.
 
 Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation:
 `uv run pytest`.

.github/skills/resync-a-repo/SKILL.md

@@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`,
 push to a protected branch and never a hand edit outside a pull request. Close the review loop,
 per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The
 maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and
-commit the report per `git-commit-conventions`, done means measured, not applied.
+commit the report once authorized, per `git-commit-conventions`, done means measured, not
+applied.

.github/skills/skill-lifecycle/SKILL.md

@@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim
 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run.
 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses.
 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections.
-6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
+6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself.
 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from.
 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says.
 

.github/skills/standup-a-repo/SKILL.md

@@ -74,10 +74,12 @@ maintainer can supply what section 0A lists.
    inventing a shape.
 
 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub
-   repository agree before running anything else here, then apply with
-   `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an
-   operational repo) from the hub at `main` and check with the same command's `check` subcommand,
-   never from a hand-built or carried copy.
+   repository agree before running anything else here, then run
+   `repo-config/configure.sh check owner/repo release` (substitute `operational` for an
+   operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a
+   command failure. Review what it reports. Then run the same command's `apply` subcommand, which
+   idempotently reconciles the repo to the full committed configuration regardless of what `check`
+   reported, never from a hand-built or carried copy.
 
 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood
    up only when it passes for its type, or its residual deltas are tracked in

reports/divergences.md

@@ -10,7 +10,7 @@ Generated by `python3 spec/fidelity_honesty.py --report` - do not hand-edit. Cur
 
 ### investigate
 
-- **pyproject.toml** (manifest gap, carried by Financial-Modeling, aiopurpleair, homeassistant-purpleair) (tracking: ptr727/ProjectTemplate#669) - The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows carriers (ptr727/ProjectTemplate#669), so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.
+- **pyproject.toml** (manifest gap, carried by Financial-Modeling, aiopurpleair, homeassistant-purpleair) (tracking: ptr727/ProjectTemplate#669) - The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows the carriers. The decision is tracked in ptr727/ProjectTemplate#669, so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.
 
 ### retire
 

spec/divergences.json

@@ -20,7 +20,7 @@
         { "path": "scripts/README.md", "disposition": "accepted", "reason": "A path collision rather than a carry. KiCadLibrary's copy documents its own KiCad tooling (common.py, verify_library.py, build_library.py) beside the scripts it describes, and shares nothing with the hub's fleet-gate documentation. Verified by reading it on 2026-08-10. scripts/ is a generic path, so a repo with its own tooling directory matches this check without carrying anything of the hub's.", "tracking": null },
         { "path": ".github/actionlint.yaml", "disposition": "accepted", "reason": "A path collision rather than a carry. HomeAutomation-Config's own copy declares self-hosted-runner labels (homelab, ubuntu-24.04) for its self-hosted CI runner, entirely different content from the hub's own file at this path, which configures $/ self-reference ignore rules for the hub's own workflows. Verified by reading both copies on 2026-08-25.", "tracking": null },
         { "path": ".github/actions/validate/action.yml", "disposition": "accepted", "reason": "A path collision rather than a carry. HomeAutomation-Config's own copy overrides the interface-workflow validate hook, per RESYNC.md 'Apply, in This Order' item 4, 'Interface workflows': 'Honor the named contract... rather than copying bytes. The body is the repository's own.' It runs its CloudInit/ nested Python project through uv/ruff/pyright/pytest. The hub's own file at this same path is a different override, its own registry/spec self-test suite. A repo declaring its own .github/actions/validate/action.yml is the documented, intended override mechanism, not drift to reconcile. Verified by reading both copies on 2026-08-25.", "tracking": null },
-        { "path": "pyproject.toml", "disposition": "investigate", "reason": "The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows carriers (ptr727/ProjectTemplate#669), so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.", "tracking": "ptr727/ProjectTemplate#669" },
+        { "path": "pyproject.toml", "disposition": "investigate", "reason": "The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows the carriers. The decision is tracked in ptr727/ProjectTemplate#669, so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.", "tracking": "ptr727/ProjectTemplate#669" },
         { "path": ".github/workflows/get-version-task.yml", "disposition": "retire", "reason": "The task is hub-hosted rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\", so it is no manifest entry and a downstream copy is retired rather than re-vendored. Every copy is the hub's own NBGV logic with nothing per-repo in it beyond the action pins Dependabot already owns. The carriers, read from the fleet on 2026-08-15, are ESPHome-NonRoot, NxWitness, PhotoCleaner, PlexCleaner, VSCode-Server-DotNetCore, KiCadLibrary, aiopurpleair, and homeassistant-purpleair. Delete the copy and reach the hub task by pin as each repo is next visited, per docs/reusable-workflows.md \"Adopting the Pure Functions\".", "tracking": null },
         { "path": ".github/workflows/publish-plan-task.yml", "disposition": "retire", "reason": "The task is hub-hosted rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\", so it is no manifest entry and a downstream copy is retired rather than re-vendored. The carriers, read from the fleet on 2026-08-15, are ESPHome-NonRoot, NxWitness, and Utilities, and all three carry a strict subset of the canonical, missing the -E in set -Eeuo pipefail and the ::warning:: branch for an unrecognized actor pushing to main (WORKFLOW.md D8.4). Delete the copy and reach the hub task by pin as each repo is next visited, per docs/reusable-workflows.md \"Adopting the Pure Functions\".", "tracking": null },
         { "path": ".github/workflows/validate-task.yml", "disposition": "retire", "reason": "The file is hub-hosted as a workflow_call task rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\" and docs/reusable-workflows.md \"Stage 2: The Gates\". The fleet doc-lint block, the language lint, the prose gate, and the repo gate move into the hub task, and a repo's own domain checks move into its own .github/actions/validate/action.yml hook instead, so a downstream copy is retired rather than re-vendored. The thirteen repos carrying a copy as of 2026-08-16 were PhotoCleaner, PlexCleaner, LanguageTags, Utilities, MediaTools, AudioCleaner, aiopurpleair, Financial-Modeling, Blog, ESPHome-NonRoot, NxWitness, VSCode-Server-DotNetCore, and HomeAutomation-Config, and the live current carrier list above may have moved on since. Delete the copy and adopt the caller stub in docs/reusable-workflows.md \"Adopting the Gates\" as each repo is next visited.", "tracking": null },