@norskvideo/ctl-dev-kit 0.2.63 → 0.2.65

package/conventions/upgrade-latest.yml

@@ -1,567 +0,0 @@
-# Keep the product fresh against the Norsk "nightly" channel (RFC 0001 —
-# product version freshness). The {engine, studio image} pair comes from the
-# nightly entry of norsk-studio's channel manifest -- the pair studio TESTED
-# together -- never from the two channels separately. Version discovery of the
-# product's current pins anchors on manifest.seed.json
-# (the machine-writable source of truth for the launched {media, studio} image
-# pair — every product repo has one). Any npm pins on the same version string
-# (media build libraries, the @norskvideo/norsk-studio* family in whichever
-# tracked package.json actually depends on them) move in lockstep via a global
-# string-replace of old->new across every tracked file — which also updates the
-# version-pin guard test, no drift. A repo with no studio npm deps needs no
-# package.json `overrides` block at all. Also moves flake.nix's norsk-ctl pin
-# (ctlVersion + the per-platform hashes) to the `latest` channel. That pin is
-# not dev-only: every CI tier runs the norsk-ctl it names, so a product's result
-# belongs to a commit (ctl-pinned-in-repo.test.ts).
-#
-# Nightly cron + on demand. The bump runs the product's own gate (lint,
-# typecheck, unit tests), then ALWAYS opens (or updates) a PR on
-# upgrade-latest/nightly, as sync-ctl-packages does; it never pushes to main.
-# bot-prs merges the PR once checks, smoke, integration and the guides gate are
-# green on its head, so a bad Norsk nightly or norsk-ctl shows up as a red bot
-# PR and main stays green.
-#
-# History, because each step was a fix. It first committed straight to main and
-# let the push-triggered run be the verdict -- a RED `main` as the alarm, and
-# nobody watches a product repo's own `main`: playout sat red ~12h, then funke,
-# then probe, inside three days (fleet review 04c, class 8). Then it gated
-# first and landed on green. That kept lint/typecheck/unit failures off main,
-# but smoke, integration and the guides ran only after landing, so a bad
-# upstream release still reddened main in every repo that took it
-# (ci-workflows docs/dashboard/ci-fragility.md, problem 2 and proposal B).
-# Pinned for the class by conventions/gate-before-main.test.ts. The branch is
-# pushed with CI_DISPATCH_TOKEN (a PAT): a GITHUB_TOKEN push would fire none of
-# the PR's workflows (Actions' recursion guard).
-#
-# Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.yml) and
-# copied verbatim into each product repo; the check:drift gate fails CI if a copy
-# diverges. Only the `product:` value below is per-repo (set it to this repo's
-# dashboard key); everything else must match the dev-kit source. Never hand-edit
-# the copy — edit the dev-kit source and re-sync.
-name: upgrade-latest
-
-on:
-  schedule:
-    - cron: "17 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  bump:
-    runs-on: x64
-    outputs:
-      changed: ${{ steps.bump.outputs.changed }}
-      summary: ${{ steps.bump.outputs.summary }}
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: true
-
-      - name: Resolve the nightly channel and rewrite the coupled pins
-        id: bump
-        run: |
-          set -euo pipefail
-          reg="https://registry.npmjs.org"
-          changed=0
-
-          # NORSK-CTL: the version flake.nix's ctlVersion names is the daemon every
-          # CI tier runs (ctl-pinned-in-repo.test.ts) as well as the one the dev
-          # shell launches, so it moves here like the engine does and the bump
-          # PR's tiers are what test it (ci-workflows docs/dashboard/
-          # ci-fragility.md, proposal A). Resolved up front, with everything
-          # else, so a refusal rewrites nothing.
-          ctl_base="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
-          old_ctl="$( { grep -oE 'ctlVersion = "[^"]+"' flake.nix 2>/dev/null || true; } | head -1 | sed -E 's/.*"(.*)"/\1/')"
-          [ -n "$old_ctl" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl it names, so add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
-          new_ctl="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/latest")"
-          [ -n "$new_ctl" ] || { echo "::error::could not resolve norsk-ctl's latest channel"; exit 1; }
-
-          # Accumulate a COMPACT summary: only the components that actually moved
-          # get an entry, so a no-op nightly (old == new) posts nothing. Was: the
-          # full media + studio-lib + studio-image triple every night for every
-          # product, even when nothing changed — pure dashboard noise.
-          parts=()
-
-          # ONE TESTED PAIR, NOT TWO CHANNELS. The engine and the studio image are
-          # taken together from the nightly entry of norsk-studio's channel
-          # manifest: the pair studio's publish built and tested against each
-          # other (scripts/write-channel-manifest.sh in norsk-studio). Resolving
-          # them apart -- the engine off norsk-sdk's nightly dist-tag, the image
-          # off Docker Hub's nightly tag -- produced pairs nobody had tested
-          # whenever one channel moved without the other. On 2026-10-04 studio's
-          # nightly had been held by its test gate since 09-28 while the engine
-          # walked on to 10-02, a breaking SDK change landed in between, and
-          # commentary's audio mix produced nothing on the old-studio /
-          # new-engine pair it was pinned to (norsk task 112).
-          #
-          # Consequence, deliberately: when studio's nightly stalls, the engine
-          # stalls with it (or steps BACK to the pair), rather than running ahead
-          # untested. Unblocking studio's nightly is how products move forward.
-          #
-          # Everything is resolved and checked BEFORE anything is rewritten, so a
-          # refusal never leaves the engine moved and studio not.
-          manifest_url="https://s3.eu-west-1.amazonaws.com/norsk.video/channel-manifest.json"
-          pair="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$manifest_url" | jq -c '.channels.nightly // empty')"
-          [ -n "$pair" ] || { echo "::error::no nightly pair in $manifest_url"; exit 1; }
-          tag_re='^[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+$'
-          new_media="$(jq -r '(.norsk // "") | split(":") | .[1] // ""' <<<"$pair")"
-          new_studio_img="$(jq -r '(.studio // "") | split(":") | .[1] // ""' <<<"$pair")"
-          printf '%s' "$new_media" | grep -qE "$tag_re" || { echo "::error::the manifest's nightly norsk image is not a dated nightly tag: $pair"; exit 1; }
-          printf '%s' "$new_studio_img" | grep -qE "$tag_re" || { echo "::error::the manifest's nightly studio image is not a dated nightly tag: $pair"; exit 1; }
-          echo "nightly pair: norsk $new_media + studio $new_studio_img"
-
-          # MEDIA: the npm packages and the launched image are built from the SAME
-          # commit (their hash suffixes match), so the pair's engine version drives
-          # the whole family: overrides, sub-package deps, the manifest image ref,
-          # the version-pin test -- every occurrence EXCEPT the lockfile, which bun
-          # install regenerates.
-          old_media="$(jq -r '.latest.media | split(":")[1]' manifest.seed.json)"
-          # The rewrite below is a LITERAL replace of the value found in
-          # manifest.seed.json, so it only ever touches pins that already equal the
-          # seed. A pin that has drifted off it -- a hand edit, a merge, a
-          # half-finished run -- is invisible to this bump and to every later one,
-          # permanently, while the job still reports success. funke launched a
-          # 2026-09-30 engine against 2026-09-05 npm pins for a month that way;
-          # playout and probe sat two months back on 1.1.0-2026-08-02. The whole
-          # point of the family is that ONE version string drives it, so a
-          # divergent pin is a defect and the only thing missing was someone
-          # saying so.
-          #
-          # Not auto-rewritten: a pin held back on purpose is someone's decision,
-          # and silently moving it would be the same class of surprise in the
-          # other direction. Fail, name them, and let a human fix the pin or the
-          # intent. (Checked against the SEED, the family's current value: after
-          # the rewrite every seed-equal pin reads the pair's engine.)
-          stranded="$(git grep -hoE '"@norskvideo/norsk-(api|sdk|auto-manager|manager-sdk)"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
-            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u | grep -vxF "$old_media" | grep -vxF "$new_media" || true)"
-          if [ -n "$stranded" ]; then
-            echo "::error::npm norsk pins are stranded off the nightly channel: $(printf '%s' "$stranded" | tr '\n' ' ')"
-            echo "The media family (api, sdk, auto-manager, manager-sdk) and the launched image are built from the same"
-            echo "commit, so every pin must read $new_media. These do not, and because the rewrite above is a literal"
-            echo "replace of the seed value, no later bump can reach them either. Set them to $new_media."
-            exit 1
-          fi
-
-          # STUDIO: the studio npm packages and the studio image are built from
-          # DIFFERENT commits -- their hash suffixes never match -- so the image
-          # comes from the pair and the build libraries from npm's nightly. The
-          # libraries must belong to the same pair: their norsk-sdk dependency has
-          # to name the pair's engine, and their version line the image's. A
-          # mismatch means the channels are inconsistent (studio published npm
-          # without updating the manifest, or the reverse); refuse rather than pin
-          # a combination nobody tested. (Studio's publish installs the SDK it
-          # builds against as a DEV dependency -- `npm install --save-dev
-          # @norskvideo/norsk-sdk@<channel>` -- so that is where the pairing lives.)
-          #
-          # The old npm pin is discovered from the repo's REAL studio deps: any
-          # exact nightly on a @norskvideo/norsk-studio* package in a tracked
-          # package.json (deps, devDeps, or overrides -- wherever it lives). A
-          # repo with none skips the lib entirely. Distinct pins disagreeing
-          # across files abort rather than half-rewrite.
-          old_studio_lib="$(git grep -hoE '"@norskvideo/norsk-studio[^"]*"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
-            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u || true)"
-          if [ "$(printf '%s' "$old_studio_lib" | grep -c .)" -gt 1 ]; then
-            echo "studio npm pins disagree across package.json files:"; echo "$old_studio_lib"; exit 1
-          fi
-          old_studio_img="$(jq -r '.latest.studio | split(":")[1]' manifest.seed.json)"
-          new_studio_lib=""
-          if [ -n "$old_studio_lib" ]; then
-            studio_doc="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-studio")"
-            new_studio_lib="$(jq -r '."dist-tags".nightly // empty' <<<"$studio_doc")"
-            [ -n "$new_studio_lib" ] || { echo "could not resolve norsk-studio npm nightly"; exit 1; }
-            lib_sdk="$(jq -r --arg v "$new_studio_lib" \
-              '.versions[$v] | ((.devDependencies // {}) + (.peerDependencies // {}) + (.dependencies // {}))["@norskvideo/norsk-sdk"] // empty' <<<"$studio_doc")"
-            lib_sdk="${lib_sdk#^}"; lib_sdk="${lib_sdk#~}"
-            if [ "$lib_sdk" != "$new_media" ]; then
-              echo "::error::norsk-studio npm nightly $new_studio_lib was built against norsk-sdk ${lib_sdk:-<none declared>}, not the tested pair's engine $new_media."
-              echo "The npm channel and the channel manifest disagree; not pinning a combination nobody tested."
-              exit 1
-            fi
-            if [ "${new_studio_lib%%-*}" != "${new_studio_img%%-*}" ]; then
-              echo "::error::norsk-studio npm nightly $new_studio_lib is on a different version line from the pair's image $new_studio_img."
-              exit 1
-            fi
-          fi
-
-          echo "media:        $old_media -> $new_media"
-          echo "studio lib:   ${old_studio_lib:-<no npm pins>} -> ${new_studio_lib:-<unchanged>}"
-          echo "studio image: $old_studio_img -> $new_studio_img"
-          if [ "$old_media" != "$new_media" ]; then
-            git grep -lF "$old_media" -- . ':!bun.lock' | xargs -r sed -i "s|$old_media|$new_media|g"
-            changed=1
-            parts+=("media \`$new_media\`")
-          fi
-          # Rewrite the image ref FIRST, then the bare library version -- so even
-          # when the two coincide, the image ref has already moved and the
-          # bare-version rewrite only touches the npm pins.
-          if [ "$old_studio_img" != "$new_studio_img" ]; then
-            git grep -lF "norskvideo/norsk-studio:$old_studio_img" -- . ':!bun.lock' \
-              | xargs -r sed -i "s|norskvideo/norsk-studio:$old_studio_img|norskvideo/norsk-studio:$new_studio_img|g"
-            # And the tag on its own: a product can carry it unprefixed (onair2026's
-            # committed template input has `"studioTag": "<tag>"`), which the
-            # prefixed rewrite never reached -- the engine moved, studio did not,
-            # and the repo's own pin test went red (2026-10-04). Safe because the
-            # image tag and the npm library version are different strings; if
-            # they ever coincide, the bare rewrite would also hit the lib pins, so
-            # it is skipped and the lib rewrite below owns that string.
-            if [ "$old_studio_img" != "$old_studio_lib" ]; then
-              # `|| true`: after the prefixed rewrite most repos have no bare
-              # occurrence left, and git grep exits 1 on no match (pipefail).
-              { git grep -lF "$old_studio_img" -- . ':!bun.lock' || true; } | xargs -r sed -i "s|$old_studio_img|$new_studio_img|g"
-            fi
-            changed=1
-          fi
-          if [ -n "$new_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
-            git grep -lF "$old_studio_lib" -- . ':!bun.lock' | xargs -r sed -i "s|$old_studio_lib|$new_studio_lib|g"
-            changed=1
-          fi
-          # One studio entry, not two -- the launched image tag is the runtime-
-          # relevant one; only fall back to the lib tag if the image held but the
-          # library advanced.
-          if [ "$old_studio_img" != "$new_studio_img" ]; then
-            parts+=("studio \`$new_studio_img\`")
-          elif [ -n "$new_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
-            parts+=("studio-lib \`$new_studio_lib\`")
-          fi
-
-          # --- norsk-ctl pin (flake.nix) ------------------------------------
-          # ctlVersion, plus the per-platform hash of each platform the flake
-          # fetches the daemon for. A Studio product's flake fetches all four; an
-          # sdk-app's fetches none and carries the version alone. Mirrors
-          # packages/dev-kit/build/refresh-ctl-pin.sh in the ctl monorepo.
-          if [ "$old_ctl" != "$new_ctl" ]; then
-            declare -A ctlplat=([x86_64-linux]=linux-x64 [aarch64-linux]=linux-arm64 [aarch64-darwin]=darwin-arm64 [x86_64-darwin]=darwin-x64)
-            for sys in "${!ctlplat[@]}"; do
-              p="${ctlplat[$sys]}"
-              grep -qF "plat = \"$p\";" flake.nix || continue
-              hex="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/$new_ctl/norsk-ctl-$new_ctl-$p.sha256" | awk '{print $1}')"
-              [ -n "$hex" ] || { echo "no sha256 sidecar for $p"; exit 1; }
-              sri="$(nix hash convert --hash-algo sha256 --to sri "$hex")"
-              perl -0pi -e "s{(plat = \"$p\";\\s*hash = \")[^\"]*(\")}{\${1}$sri\${2}}" flake.nix
-            done
-            perl -0pi -e "s{(ctlVersion = \")[^\"]*(\")}{\${1}$new_ctl\${2}}" flake.nix
-            echo "ctl: $old_ctl -> $new_ctl"
-            changed=1
-            parts+=("norsk-ctl \`$new_ctl\`")
-          fi
-
-          # Join the moved components; empty when nothing changed (the dashboard
-          # then shows a clean green "nightly" cell with no detail).
-          summary=""
-          if [ ${#parts[@]} -gt 0 ]; then
-            summary="$(printf '%s, ' "${parts[@]}")"
-            summary="${summary%, }"
-          fi
-          {
-            echo "changed=$changed"
-            echo "summary=$summary"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Refresh the lockfile against the new pins
-        if: steps.bump.outputs.changed == '1'
-        # Per INSTALL ROOT: the rewrites above walk every tracked package.json,
-        # and a manifest outside the root workspace list owns a lockfile a
-        # root-only install never regenerates. See lockfile-reinstall.test.ts.
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            for lock in $(git ls-files "*bun.lock"); do
-              (cd "$(dirname "$lock")" && bun install)
-            done
-          '
-
-      - name: Run the product gate against the bumped pins
-        id: gate
-        if: steps.bump.outputs.changed == '1'
-        # continue-on-error so a red gate can open a PR below instead of failing
-        # the workflow -- which is why the steps after it read `outcome` and not
-        # `conclusion` (continue-on-error rewrites conclusion to success).
-        continue-on-error: true
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            bun run lint
-            bun run typecheck
-            bun run test:unit
-          '
-
-      # The bump's only way to main is this PR. bot-prs merges it once every tier
-      # that runs on a bot PR -- checks, smoke, integration and build-image's
-      # guides gate, wherever this repo has them -- is green on its head
-      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
-      # green gate kept lint, typecheck and unit failures off main, but the tiers
-      # that break on an upstream change ran only after landing, so a bad
-      # upstream release still turned main red in every repo that took it. The
-      # gate above still runs: its verdict heads the PR body, and a red one
-      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
-      # the tiers, and a draft could never become ready again by PATCH.
-      - name: Open (or update) the bump PR
-        if: steps.bump.outputs.changed == '1'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          GATE: ${{ steps.gate.outcome }}
-          # Through env, never pasted into the script: the summary wraps each
-          # version in backticks, and inside a double-quoted shell string those
-          # ran as commands ("1.3.1-...: command not found"), dropping every
-          # version from the commit message and PR body.
-          SUMMARY: ${{ steps.bump.outputs.summary }}
-        run: |
-          set -euo pipefail
-          branch="upgrade-latest/nightly"
-          prefix="upgrade-latest/"
-          title="Bump Norsk nightly + ctl pins to latest channel"
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
-          # An older PR of this bot's family is obsolete once this one is open:
-          # left open they piled up (nine were closed by hand on 2026-10-03).
-          # Best-effort: a failure here must not fail the bump.
-          close_superseded() {
-            local keep="$1" n
-            auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
-                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
-                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
-                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
-              echo "closed superseded PR #$n"
-            done
-          }
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$branch"
-          git add -A
-          git commit -m "chore: bump Norsk nightly + ctl pins to latest channel
-
-          ${SUMMARY}
-
-          Coupled Norsk pins (npm overrides + manifest.seed.json image tags +
-          version-pin guard test) moved together via a global version-string
-          replace; lockfile regenerated. flake.nix norsk-ctl pin (version + the
-          per-platform hashes), which CI runs, moved to the latest channel."
-          # One branch per bump, force-pushed from today's main -- but only when
-          # its tree changed. A red bump PR left standing is rebuilt by every run
-          # of this bot, and pushing the same tree again would re-run every slow
-          # tier on it for nothing.
-          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
-            echo "$branch already holds this bump; not re-pushing it"
-          else
-            git push -f origin "$branch"
-          fi
-          if [ "$GATE" = "success" ]; then
-            verdict="Gate green: lint, typecheck and unit tests pass on the bumped pins."
-          else
-            verdict="**Gate red**: lint, typecheck or unit tests fail on the bumped pins. That usually means the new Norsk nightly is bad, or genuinely changed something the product depends on. Fix it on this branch, or close this PR to skip the bump -- the next nightly run reopens it against whatever the channel holds then."
-          fi
-          body="$(printf '%s\n' \
-            "Automated nightly pin bump: the Norsk nightly channel and norsk-ctl latest moved, and the coupled pins came with them." \
-            "" \
-            "    ${SUMMARY}" \
-            "" \
-            "$verdict" \
-            "" \
-            "bot-prs merges this once checks, smoke, integration and the guides gate" \
-            "(build-image) have all passed on its head, wherever this repo runs them." \
-            "Until then main does not move; a red tier keeps it open and reports it on" \
-            "the product dashboard.")"
-          # gh is not on the self-hosted runner PATH (it lives only inside
-          # `nix develop`, and this step runs outside it), so create/update the PR
-          # straight against the REST API with the same PAT that pushed the branch.
-          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
-          # which is the whole point: the bump is judged before it lands.
-          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
-          if [ -n "$existing" ]; then
-            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
-            number="$existing"
-            echo "updated PR #$number"
-          else
-            number="$(curl "${curl_api[@]}" -X POST "$api" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
-                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
-            echo "opened PR #$number"
-          fi
-          close_superseded "$number" || true
-
-      - name: Report "already fresh"
-        if: steps.bump.outputs.changed != '1'
-        run: echo "Nightly pins already current — nothing to bump."
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi
-
-  # Report the nightly bump result to the aggregated product CI dashboard
-  # (id3as/ci-workflows). !cancelled() so a failed bump shows a sad pony (a
-  # cancelled/superseded run must not false-red the board); the summary rides
-  # along as the cell detail.
-  notify:
-    needs: bump
-    if: ${{ !cancelled() }}
-    runs-on: x64
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          clean: true
-      - id: meta
-        run: |
-          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
-            echo "state=failure" >> "$GITHUB_OUTPUT"
-          else
-            echo "state=success" >> "$GITHUB_OUTPUT"
-          fi
-      - uses: ./.github/actions/ci-status-dispatch
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          product: __PRODUCT__
-          pipeline: nightly
-          status: ${{ steps.meta.outputs.state }}
-          detail: ${{ needs.bump.outputs.summary }}
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi