@volter/twin-github 0.1.0

package/src/github-capabilities.ts

@@ -0,0 +1,2144 @@
+// GitHub capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the target), authored
+// TOP-DOWN from what GitHub actually does — NOT from what this twin has built. This is the
+// honest denominator: most entries start as `todo` and coverage reads LOW until the twin
+// truly reaches 100% of GitHub. `verify()` (required to count as done) is ground truth;
+// `expected: 'done'` only on capabilities we genuinely claim, so a broken one surfaces as a
+// regression. Grow this toward GitHub's *full* surface every cycle — a missing entry is a
+// hidden gap, and a high % against a thin list is a misleading metric (the bug this fixes).
+//
+// GitHub is enormous: PRs, Issues, Actions, Checks, Projects v2, Discussions, Releases, Git
+// Data API, Repos/Orgs/Teams/Users, Gists, Search, Notifications, Packages, Pages, code
+// scanning, GraphQL, Apps/OAuth, Webhooks, plus the web UI screens. The twin currently
+// models the PR/Issue/Checks/Actions core (REST objects) + a UI mirror; everything else is
+// an honest `todo`. Two explicit out-of-scope carve-outs (outOfScope): real repo CODE/FILE
+// BYTES (git blob content — large+redundant; API objects are covered) and running real CI
+// COMPUTE (executing Actions — infra, not API; the run/job OBJECTS are covered and modeled).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkCapabilities, uiDataCoupled, type CapabilityReport, type CapabilitySpec } from '@volter/twin-tooling';
+import { githubMirrorState } from './github-mirror-ui.ts';
+import { applyGithubWrite, handleGithubRequest } from './github-twin.ts';
+
+// ── API predicate: run a real verify() against a fresh temp root (mkdtemp), exercising the
+// twin's handleGithubRequest (GET) + applyGithubWrite (POST/PATCH/PUT). Each verify creates
+// its OWN isolated root so order never matters and nothing leaks between checks. Catch-parity
+// with the other packs (see stripe-capabilities.ts's withRoot): a throwing verify reads as an
+// honest false (todo/regression in the capability report), never a harness crash. Exported
+// (unlike the other packs' private withRoot) so github-capabilities.test.ts can prove the
+// catch behavior directly, independent of checkCapabilities' own outer try/catch.
+export async function withRoot(fn: (root: string) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'gh-cap-'));
+  try {
+    return await fn(root);
+  } catch {
+    return false;
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+const ok = (status: number) => status >= 200 && status < 300;
+// GET returns the expected status (and optional body-shape check passes).
+const getOk = (path: string, shape?: (body: unknown) => boolean) => () =>
+  withRoot(async (root) => {
+    const res = handleGithubRequest({ method: 'GET', path, root });
+    return ok(res.status) && (shape ? shape(res.body) : true);
+  });
+
+// ── shorthands ───────────────────────────────────────────────────────────────────────────
+const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
+const outOfScope = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], reason: string): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo', outOfScope: reason });
+
+const REPO = 'octo/demo';
+const isArr = (b: unknown): b is unknown[] => Array.isArray(b);
+
+// The real GitHub surface. Anything not here is still a gap (keep growing it). Entries with
+// verify() + expected:'done' are what we currently claim; everything else is todo/out-of-scope.
+export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
+  // ── Pull Requests ──────────────────────────────────────────────────────────────────────
+  done('github.pulls.create', 'pulls', 'PRs: create (POST .../pulls → 201)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const res = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root });
+      return res.response.status === 201 && (res.response.body as { number?: number }).number === 1;
+    })),
+  done('github.pulls.head_sha_resolves', 'pulls', 'PRs: head.sha resolves to the head branch tip (not the branch name)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // Register the head branch's tip (as `git push` + a git-ref create would), then open a PR
+      // with head=<branch>. Real GitHub reports PR.head.sha as the 40-hex branch tip — assert the
+      // twin resolves it, so statuses posted on the pushed sha line up with the PR's head.
+      const sha = 'a'.repeat(40);
+      const mk = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha }), root });
+      if (mk.response.status !== 201) return false;
+      const pr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root });
+      const head = (pr.response.body as { head?: { sha?: string; ref?: string; label?: string } }).head;
+      // head.sha resolves to the tip; head.ref keeps the branch; head.label is owner:ref.
+      if (head?.sha !== sha || head?.ref !== 'feat' || head?.label !== 'octo:feat') return false;
+      // A literal sha head stays as-is; an unregistered branch falls back to the literal value.
+      const direct = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR2', head: 'b'.repeat(40), base: 'main' }), root });
+      return (direct.response.body as { head?: { sha?: string } }).head?.sha === 'b'.repeat(40);
+    })),
+  done('github.pulls.list_filters', 'pulls', 'PRs: list filters (state / head / base query params)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // open PR on feat→main, plus a second on fix→main that we then close.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'A', head: 'feat', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'B', head: 'fix', base: 'main' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/2`, body: JSON.stringify({ state: 'closed' }), root });
+      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=open`, root });
+      const byHead = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?head=octo:feat`, root });
+      const closed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=closed`, root });
+      const all = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=all`, root });
+      return isArr(open.body) && open.body.length === 1 && (open.body[0] as { number?: number }).number === 1
+        && isArr(byHead.body) && byHead.body.length === 1 && (byHead.body[0] as { number?: number }).number === 1
+        && isArr(closed.body) && closed.body.length === 1 && (closed.body[0] as { number?: number }).number === 2
+        && isArr(all.body) && all.body.length === 2;
+    })),
+  done('github.pulls.get', 'pulls', 'PRs: get one (GET .../pulls/:n)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root });
+      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      return ok(res.status) && (res.body as { number?: number }).number === 1;
+    })),
+  done('github.pulls.list', 'pulls', 'PRs: list (GET .../pulls, paginated)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'A', head: 'a', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'B', head: 'b', base: 'main' }), root });
+      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls`, root });
+      return ok(res.status) && isArr(res.body) && res.body.length === 2;
+    })),
+  done('github.pulls.edit', 'pulls', 'PRs: edit title/body/state (PATCH .../pulls/:n)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'old', head: 'a', base: 'main' }), root });
+      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ title: 'new' }), root });
+      return ok(res.response.status) && (res.response.body as { title?: string }).title === 'new';
+    })),
+  done('github.pulls.merge', 'pulls', 'PRs: merge (PUT .../pulls/:n/merge → 200 merged)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'm', head: 'a', base: 'main' }), root });
+      const res = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
+      const merged = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/merge`, root });
+      return ok(res.response.status) && (res.response.body as { merged?: boolean }).merged === true && merged.status === 204;
+    })),
+  done('github.pulls.reviews', 'pulls', 'PRs: reviews submit + list (APPROVE/COMMENT/REQUEST_CHANGES)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'r', head: 'a', base: 'main' }), root });
+      const sub = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event: 'APPROVE', body: 'lgtm' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      return ok(sub.response.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
+    })),
+  done('github.pulls.review_comments', 'pulls', 'PRs: diff-anchored review comments (path/line/side)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'c', head: 'a', base: 'main' }), root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 10, side: 'RIGHT' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
+      return c.response.status === 201 && ok(list.status) && isArr(list.body) && (list.body[0] as { path?: string }).path === 'a.ts';
+    })),
+  done('github.pulls.requested_reviewers', 'pulls', 'PRs: request/remove reviewers', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'rr', head: 'a', base: 'main' }), root });
+      const add = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/requested_reviewers`, body: JSON.stringify({ reviewers: ['alice'] }), root });
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/requested_reviewers`, root });
+      return add.response.status === 201 && ok(get.status) && (get.body as { users?: unknown[] }).users?.length === 1;
+    })),
+  done('github.pulls.files', 'pulls', 'PRs: files changed (per-file diff list)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'f', head: 'a', base: 'main', files: [{ filename: 'x.ts', additions: 3, deletions: 1 }] }), root });
+      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
+      return ok(res.status) && isArr(res.body) && (res.body[0] as { filename?: string }).filename === 'x.ts';
+    })),
+  done('github.pulls.commits', 'pulls', 'PRs: commits list (per-commit detail)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'cm', head: 'a', base: 'main', commits: [{ sha: 'deadbeef', message: 'init' }] }), root });
+      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/commits`, root });
+      return ok(res.status) && isArr(res.body) && res.body.length === 1;
+    })),
+  done('github.pulls.labels_assignees_milestone', 'pulls', 'PRs: labels/assignees/milestone via PATCH', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'la', head: 'a', base: 'main' }), root });
+      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'] }), root });
+      return ok(res.response.status) && (res.response.body as { labels?: unknown[] }).labels?.length === 1;
+    })),
+  done('github.pulls.draft', 'pulls', 'PRs: draft state + ready_for_review', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'd', head: 'a', base: 'main', draft: true }), root });
+      if ((c.response.body as { draft?: boolean }).draft !== true) return false;
+      // a draft cannot merge → 405; ready_for_review (draft:false) then merges.
+      const blocked = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
+      if (blocked.response.status !== 405) return false;
+      const ready = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ draft: false }), root });
+      if ((ready.response.body as { draft?: boolean }).draft !== false) return false;
+      const merged = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
+      return merged.response.status === 200;
+    })),
+  done('github.pulls.review_threads', 'pulls', 'PRs: review threads (resolve/unresolve, replies)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'rt', head: 'a', base: 'main' }), root });
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 1, side: 'RIGHT' }), root });
+      const cid = (cm.response.body as { id?: number }).id!;
+      // a threaded reply attaches to the root review comment; resolve then unresolve the thread.
+      const reply = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'fixed', in_reply_to: cid }), root });
+      if (reply.response.status !== 201) return false;
+      const resolve = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/comments/${cid}/resolve`, body: '{}', root });
+      if (!(ok(resolve.response.status) && (resolve.response.body as { resolved?: boolean }).resolved === true)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/threads`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { is_resolved?: boolean }).is_resolved === true)) return false;
+      const unresolve = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pulls/1/comments/${cid}/resolve`, root });
+      return ok(unresolve.response.status) && (unresolve.response.body as { resolved?: boolean }).resolved === false;
+    })),
+  done('github.pulls.merge_methods', 'pulls', 'PRs: merge methods (squash/rebase) + auto-merge', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'mm', head: 'a', base: 'main' }), root });
+      // enable auto-merge (squash) → PR.auto_merge reflects the method; invalid method 422s.
+      const am = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/auto-merge`, body: JSON.stringify({ merge_method: 'squash' }), root });
+      if ((am.response.body as { auto_merge?: { merge_method?: string } }).auto_merge?.merge_method !== 'squash') return false;
+      const bad = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ merge_method: 'nope' }), root });
+      if (bad.response.status !== 422) return false;
+      const m = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ merge_method: 'rebase' }), root });
+      return m.response.status === 200 && (m.response.body as { merged?: boolean }).merged === true;
+    })),
+  done('github.pulls.update_branch', 'pulls', 'PRs: update branch / mergeability + conflicts', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'ub', head: 'a', base: 'main' }), root });
+      // a dirty PR reports mergeable:false; update-branch advances head + marks it clean.
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ mergeable_state: 'dirty' }), root });
+      const dirty = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      if ((dirty.body as { mergeable?: boolean | null }).mergeable !== false) return false;
+      const before = (dirty.body as { head?: { sha?: string } }).head?.sha;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/update-branch`, body: '{}', root });
+      if (upd.response.status !== 202) return false;
+      const clean = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      return (clean.body as { mergeable?: boolean }).mergeable === true && (clean.body as { mergeable_state?: string }).mergeable_state === 'clean' && (clean.body as { head?: { sha?: string } }).head?.sha !== before;
+    })),
+
+  // ── Issues ─────────────────────────────────────────────────────────────────────────────
+  done('github.issues.create', 'issues', 'Issues: create (POST .../issues → 201)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const res = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'bug' }), root });
+      return res.response.status === 201 && (res.response.body as { number?: number }).number === 1;
+    })),
+  done('github.issues.get_list', 'issues', 'Issues: get + list', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'i1' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues`, root });
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status);
+    })),
+  done('github.issues.edit_state', 'issues', 'Issues: edit + close/reopen (state)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'e' }), root });
+      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed' }), root });
+      return ok(res.response.status) && (res.response.body as { state?: string }).state === 'closed';
+    })),
+  done('github.issues.comments', 'issues', 'Issues: comments create + list', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'c' }), root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'me too' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/comments`, root });
+      return c.response.status === 201 && ok(list.status) && isArr(list.body) && list.body.length === 1;
+    })),
+  done('github.issues.labels_assignees_milestone', 'issues', 'Issues: labels/assignees/milestone', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'la' }), root });
+      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['p1'], assignees: ['ann'] }), root });
+      return ok(res.response.status) && (res.response.body as { assignees?: unknown[] }).assignees?.length === 1;
+    })),
+  done('github.issues.timeline_crossref', 'issues', 'Issues: timeline/events (cross-reference links)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'link' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ _twin_linked: [{ type: 'pull_request', number: 2 }] }), root });
+      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
+      return ok(res.status) && isArr(res.body) && res.body.length === 1;
+    })),
+  done('github.issues.state_reasons', 'issues', 'Issues: state reasons (completed/not_planned/duplicate)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'sr' }), root });
+      const r = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed', state_reason: 'not_planned' }), root });
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      return ok(r.response.status) && (r.response.body as { state_reason?: string }).state_reason === 'not_planned' && (get.body as { state?: string }).state === 'closed';
+    })),
+  done('github.issues.types', 'issues', 'Issues: issue types (org-level)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // a missing name 422s; create → listed; duplicate name 422s; edit; delete → gone.
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: '{}', root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug', color: 'red', description: 'A defect' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { name?: string }).name === 'Bug')) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug' }), root })).response.status !== 422) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/issue-types/${id}`, body: JSON.stringify({ description: 'updated' }), root });
+      if ((e.response.body as { description?: string }).description !== 'updated') return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/issue-types/${id}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 0;
+    })),
+  done('github.issues.subissues', 'issues', 'Issues: sub-issues (parent/child hierarchy)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'parent' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'child' }), root });
+      const add = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/sub_issues`, body: JSON.stringify({ sub_issue_number: 2 }), root });
+      if (add.response.status !== 201) return false;
+      const subs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
+      if (!(ok(subs.status) && isArr(subs.body) && subs.body.length === 1 && (subs.body[0] as { number?: number }).number === 2)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/sub_issue`, body: JSON.stringify({ sub_issue_number: 2 }), root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
+      return ok(del.response.status) && isArr(after.body) && after.body.length === 0;
+    })),
+  done('github.issues.reactions', 'issues', 'Issues/comments: reactions (emoji)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'react' }), root });
+      // invalid content → 422; a valid one → 201 and appears in the list.
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/reactions`, body: JSON.stringify({ content: 'nope' }), root });
+      if (bad.response.status !== 422) return false;
+      const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/reactions`, body: JSON.stringify({ content: 'heart' }), root });
+      if (r.response.status !== 201) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/reactions`, root });
+      // comment reactions too: create a comment, react to it.
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'hi' }), root });
+      const cid = (cm.response.body as { id?: number }).id!;
+      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/comments/${cid}/reactions`, body: JSON.stringify({ content: 'rocket' }), root });
+      const clist = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/${cid}/reactions`, root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { content?: string }).content === 'heart'
+        && cr.response.status === 201 && isArr(clist.body) && clist.body.length === 1;
+    })),
+  done('github.issues.lock', 'issues', 'Issues: lock/unlock conversation', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'lock' }), root });
+      const lock = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/1/lock`, body: JSON.stringify({ lock_reason: 'off-topic' }), root });
+      if (lock.response.status !== 204) return false;
+      const locked = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      if (!((locked.body as { locked?: boolean }).locked === true && (locked.body as { active_lock_reason?: string }).active_lock_reason === 'off-topic')) return false;
+      const unlock = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/lock`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      return unlock.response.status === 204 && (after.body as { locked?: boolean }).locked === false;
+    })),
+  done('github.issues.transfer', 'issues', 'Issues: transfer to another repo', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'moves', body: 'context' }), root });
+      // transfer to a sibling repo → 201 NEW issue carrying title; source closes as transferred.
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/transfer`, body: JSON.stringify({ new_repository: 'nope' }), root });
+      if (bad.response.status !== 422) return false;
+      const t = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/transfer`, body: JSON.stringify({ new_repository: 'octo/other' }), root });
+      if (!(t.response.status === 201 && (t.response.body as { title?: string }).title === 'moves')) return false;
+      const newNum = (t.response.body as { number?: number }).number!;
+      const moved = handleGithubRequest({ method: 'GET', path: `/repos/octo/other/issues/${newNum}`, root });
+      if (!(ok(moved.status) && (moved.body as { title?: string }).title === 'moves')) return false;
+      const src = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      return (src.body as { state?: string }).state === 'closed' && (src.body as { state_reason?: string }).state_reason === 'transferred';
+    })),
+  done('github.issues.pin', 'issues', 'Issues: pin/unpin', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'important' }), root });
+      // pinning a missing issue → 404; a real one → 204 and the flag round-trips.
+      if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/99/pin`, body: '{}', root })).response.status !== 404) return false;
+      const pin = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/1/pin`, body: '{}', root });
+      if (pin.response.status !== 204) return false;
+      const pinned = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      if ((pinned.body as { pinned?: boolean }).pinned !== true) return false;
+      const unpin = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/pin`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      return unpin.response.status === 204 && (after.body as { pinned?: boolean }).pinned === false;
+    })),
+  done('github.issues.full_timeline', 'issues', 'Issues: full timeline events (labeled/assigned/renamed/…)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'tl' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], state: 'closed', state_reason: 'completed' }), root });
+      const tl = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
+      if (!(ok(tl.status) && isArr(tl.body))) return false;
+      const events = (tl.body as Array<{ event?: string }>).map((e) => e.event);
+      return events.includes('labeled') && events.includes('assigned') && events.includes('closed');
+    })),
+
+  // ── Labels / Milestones ──────────────────────────────────────────────────────────────────
+  done('github.milestones.crud', 'fields', 'Milestones: create/edit/get/list', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/milestones`, body: JSON.stringify({ title: 'v1' }), root });
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/milestones/1`, body: JSON.stringify({ state: 'closed' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/milestones`, root });
+      return c.response.status === 201 && ok(e.response.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
+    })),
+  done('github.labels.crud', 'fields', 'Labels: repo label CRUD (color/description)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/labels`, body: JSON.stringify({ name: 'bug', color: 'd73a4a', description: 'Something broken' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { color?: string }).color === 'd73a4a')) return false;
+      // duplicate name → 422; edit color + rename; get/list; delete then 404.
+      const dup = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/labels`, body: JSON.stringify({ name: 'bug' }), root });
+      if (dup.response.status !== 422) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/labels/bug`, body: JSON.stringify({ new_name: 'defect', color: '000000' }), root });
+      if (!(ok(e.response.status) && (e.response.body as { name?: string }).name === 'defect')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels`, root });
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status))) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/labels/defect`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+
+  // ── Commit statuses + Checks ─────────────────────────────────────────────────────────────
+  done('github.statuses.create_combined', 'checks', 'Commit statuses: create + combined + list', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/statuses/abc123`, body: JSON.stringify({ state: 'success', context: 'ci' }), root });
+      const combined = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/status`, root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/statuses`, root });
+      return c.response.status === 201 && ok(combined.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
+    })),
+  done('github.checks.runs', 'checks', 'Check runs: create + list for a ref', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'sha9', conclusion: 'success' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/sha9/check-runs`, root });
+      return c.response.status === 201 && ok(list.status) && (list.body as { total_count?: number }).total_count === 1;
+    })),
+  done('github.checks.suites', 'checks', 'Check suites: list/get/rerequest + GET .../check-runs/:id', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'shaS', conclusion: 'success' }), root });
+      const runId = (cr.response.body as { id?: number }).id!;
+      const suiteId = (cr.response.body as { check_suite?: { id?: number } }).check_suite?.id!;
+      // GET a single check run; list/get the suite; suite rolls up to success; rerequest 201s.
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${runId}`, root });
+      if (!(ok(one.status) && (one.body as { id?: number }).id === runId)) return false;
+      const suites = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/shaS/check-suites`, root });
+      if (!(ok(suites.status) && (suites.body as { total_count?: number }).total_count === 1)) return false;
+      const suite = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-suites/${suiteId}`, root });
+      if (!(ok(suite.status) && (suite.body as { conclusion?: string }).conclusion === 'success')) return false;
+      const re = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-suites/${suiteId}/rerequest`, body: '{}', root });
+      return re.response.status === 201;
+    })),
+  done('github.checks.annotations', 'checks', 'Check runs: annotations + output details', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'lint', head_sha: 'shaA', status: 'in_progress' }), root });
+      const id = (cr.response.body as { id?: number }).id!;
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/check-runs/${id}`, body: JSON.stringify({ conclusion: 'failure', output: { title: 'Lint', summary: '1 issue', annotations: [{ path: 'a.ts', start_line: 3, end_line: 3, annotation_level: 'warning', message: 'unused var' }] } }), root });
+      if (!(ok(upd.response.status) && (upd.response.body as { output?: { annotations_count?: number } }).output?.annotations_count === 1)) return false;
+      const anns = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${id}/annotations`, root });
+      return ok(anns.status) && isArr(anns.body) && anns.body.length === 1 && (anns.body[0] as { annotation_level?: string }).annotation_level === 'warning';
+    })),
+
+  // ── Actions ──────────────────────────────────────────────────────────────────────────────
+  done('github.actions.workflows', 'actions', 'Actions: register + list/get workflows', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const reg = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/workflows`, root });
+      return ok(reg.response.status) && ok(list.status) && (list.body as { total_count?: number }).total_count === 1;
+    })),
+  done('github.actions.dispatch_runs', 'actions', 'Actions: dispatch workflow → queued run; list runs', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
+      const d = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      return d.response.status === 204 && ok(runs.status) && (runs.body as { total_count?: number }).total_count === 1;
+    })),
+  done('github.actions.run_jobs', 'actions', 'Actions: run jobs + get run + rerun/cancel transitions', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      const runId = (runs.body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+      const jobs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}/jobs`, root });
+      const cancel = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/runs/${runId}/cancel`, body: '{}', root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}`, root });
+      return ok(jobs.status) && (jobs.body as { total_count?: number }).total_count === 1 && cancel.response.status === 202 && (after.body as { conclusion?: string }).conclusion === 'cancelled';
+    })),
+  done('github.actions.logs', 'actions', 'Actions: download run logs (302 redirect to signed URL)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      const runId = (runs.body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+      // a real run's logs 302-redirect to a download URL; an unknown run → 404.
+      const logs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}/logs`, root });
+      if (!(logs.status === 302 && typeof (logs.body as { location?: string }).location === 'string')) return false;
+      return handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/999999/logs`, root }).status === 404;
+    })),
+  done('github.actions.artifacts', 'actions', 'Actions: artifacts register/list/get/delete (metadata)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/artifacts`, body: '{}', root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/artifacts`, body: JSON.stringify({ name: 'build-output', size_in_bytes: 2048, run_id: 5 }), root });
+      if (!(c.response.status === 201 && (c.response.body as { name?: string }).name === 'build-output')) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts`, root });
+      if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
+      if (!(ok(one.status) && (one.body as { size_in_bytes?: number }).size_in_bytes === 2048)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.actions.secrets', 'actions', 'Actions: secrets (repo + org; value never returned)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // PUT a repo secret → 201 (first time); the value is NOT stored/returned (only name).
+      const c = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/secrets/API_KEY`, body: JSON.stringify({ encrypted_value: 'xxx', key_id: '1' }), root });
+      if (c.response.status !== 201) return false;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/secrets/API_KEY`, body: JSON.stringify({ encrypted_value: 'yyy', key_id: '1' }), root });
+      if (upd.response.status !== 204) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets`, root });
+      const secrets = (list.body as { secrets?: Array<Record<string, unknown>> }).secrets ?? [];
+      if (!(ok(list.status) && secrets.length === 1 && secrets[0]!.name === 'API_KEY' && !('value' in secrets[0]!))) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root });
+      if (!(ok(get.status) && (get.body as { name?: string }).name === 'API_KEY')) return false;
+      // org-scope secret is a separate namespace.
+      const org = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/actions/secrets/ORG_TOKEN`, body: JSON.stringify({ encrypted_value: 'z' }), root });
+      if (org.response.status !== 201) return false;
+      const orgList = handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/secrets`, root });
+      if (!(ok(orgList.status) && (orgList.body as { total_count?: number }).total_count === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/secrets/API_KEY`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root }).status === 404;
+    })),
+  done('github.actions.variables', 'actions', 'Actions: variables (repo + org; value returned)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/variables`, body: JSON.stringify({ name: 'X' }), root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/variables`, body: JSON.stringify({ name: 'NODE_ENV', value: 'production' }), root });
+      if (c.response.status !== 201) return false;
+      // duplicate → 409.
+      const dup = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/variables`, body: JSON.stringify({ name: 'NODE_ENV', value: 'x' }), root });
+      if (dup.response.status !== 409) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
+      if (!(ok(get.status) && (get.body as { value?: string }).value === 'production')) return false;
+      // PATCH the value; re-read reflects it.
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/actions/variables/NODE_ENV`, body: JSON.stringify({ value: 'staging' }), root });
+      if (upd.response.status !== 204) return false;
+      const get2 = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
+      if ((get2.body as { value?: string }).value !== 'staging') return false;
+      // org-scope variable.
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/actions/variables`, body: JSON.stringify({ name: 'REGION', value: 'us' }), root });
+      const orgGet = handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/variables/REGION`, root });
+      if ((orgGet.body as { value?: string }).value !== 'us') return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root }).status === 404;
+    })),
+  done('github.actions.caches', 'actions', 'Actions: caches list/delete', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: '{}', root });
+      if (bad.response.status !== 422) return false;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: JSON.stringify({ key: 'node-modules-abc', ref: 'refs/heads/main', size_in_bytes: 1024 }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: JSON.stringify({ key: 'node-modules-def', size_in_bytes: 2048 }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/caches`, root });
+      if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 2)) return false;
+      // delete by key → removes one; list shrinks.
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/caches?key=node-modules-abc`, root });
+      if (!(del.response.status === 200 && (del.response.body as { total_count?: number }).total_count === 1)) return false;
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/caches`, root });
+      return (after.body as { total_count?: number }).total_count === 1;
+    })),
+  done('github.actions.environments', 'actions', 'Actions: deployment environments (alias of environments.crud)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // environments are reachable under the repo; create + list round-trips.
+      const c = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/environments/staging`, body: JSON.stringify({ wait_timer: 5 }), root });
+      if (c.response.status !== 200) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
+      return ok(list.status) && (list.body as { total_count?: number }).total_count === 1 && (list.body as { environments?: Array<{ name?: string }> }).environments?.[0]?.name === 'staging';
+    })),
+  outOfScope('github.actions.compute', 'actions', 'Actions: real CI COMPUTE (executing the workflow)', 'api', 'niche',
+    'Out of scope: running real CI compute is infra, not API. The run/job OBJECTS (queued/rerun/cancel) are modeled (covered).'),
+
+  // ── Repos / settings / branches ──────────────────────────────────────────────────────────
+  done('github.repos.crud', 'repos', 'Repos: create/get/update/delete + settings', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', description: 'a repo', private: true }), root });
+      if (!(c.response.status === 201 && (c.response.body as { full_name?: string }).full_name === 'octo/demo')) return false;
+      const dup = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      if (dup.response.status !== 422) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      if (!(ok(get.status) && (get.body as { private?: boolean }).private === true)) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/octo/demo`, body: JSON.stringify({ description: 'updated', has_wiki: false }), root });
+      if (!(ok(e.response.status) && (e.response.body as { description?: string }).description === 'updated')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.repos.branches', 'repos', 'Repos: branches list/get + default branch', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', default_branch: 'main' }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { name?: string }).name === 'main')) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      return ok(one.status) && (one.body as { name?: string }).name === 'main' && typeof (one.body as { commit?: { sha?: string } }).commit?.sha === 'string';
+    })),
+  done('github.repos.branch_protection', 'repos', 'Repos: branch protection rules + rulesets', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      const p = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/branches/main/protection`, body: JSON.stringify({ required_status_checks: null }), root });
+      if (!(ok(p.response.status) && (p.response.body as { enabled?: boolean }).enabled === true)) return false;
+      const b = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      if ((b.body as { protected?: boolean }).protected !== true) return false;
+      const d = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/branches/main/protection`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      return d.response.status === 204 && (after.body as { protected?: boolean }).protected === false;
+    })),
+  done('github.repos.collaborators', 'repos', 'Repos: collaborators + permissions', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const add = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'maintain' }), root });
+      if (add.response.status !== 201) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const perm = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice/permission`, root });
+      if ((perm.body as { permission?: string }).permission !== 'maintain') return false;
+      const check = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
+      if (check.status !== 204) return false;
+      const rm = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/collaborators/alice`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
+      return rm.response.status === 204 && gone.status === 404;
+    })),
+  done('github.repos.webhooks', 'repos', 'Repos: webhook config CRUD', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/hooks`, body: JSON.stringify({ events: ['push', 'pull_request'], config: { url: 'https://e.x/hook', content_type: 'json' } }), root });
+      if (!(c.response.status === 201 && (c.response.body as { events?: string[] }).events?.length === 2)) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/hooks/${id}`, body: JSON.stringify({ active: false }), root });
+      if (!(ok(e.response.status) && (e.response.body as { active?: boolean }).active === false)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/hooks`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/hooks/${id}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/hooks/${id}`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.repos.topics', 'repos', 'Repos: topics', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      const set = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/topics`, body: JSON.stringify({ names: ['ai', 'twin'] }), root });
+      if (!(ok(set.response.status) && (set.response.body as { names?: string[] }).names?.length === 2)) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/topics`, root });
+      const onRepo = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      return ok(get.status) && (get.body as { names?: string[] }).names?.includes('twin') === true && (onRepo.body as { topics?: string[] }).topics?.length === 2;
+    })),
+  done('github.repos.forks', 'repos', 'Repos: forks list/create', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      const f = await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/forks`, body: JSON.stringify({ organization: 'me' }), root });
+      if (!(f.response.status === 202 && (f.response.body as { fork?: boolean }).fork === true && (f.response.body as { full_name?: string }).full_name === 'me/demo')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/forks`, root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 1;
+    })),
+  done('github.repos.contents', 'repos', 'Repos: contents API (get/put/delete file objects)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const content = Buffer.from('hello world').toString('base64');
+      const put = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'add', content }), root });
+      if (!(put.response.status === 201 && (put.response.body as { content?: { path?: string } }).content?.path === 'README.md')) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
+      if (!(ok(get.status) && (get.body as { content?: string }).content === content && (get.body as { encoding?: string }).encoding === 'base64')) return false;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'upd', content: Buffer.from('v2').toString('base64') }), root });
+      if (upd.response.status !== 200) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'rm' }), root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
+      return ok(del.response.status) && gone.status === 404;
+    })),
+  outOfScope('github.repos.blob_bytes', 'repos', 'Repos: raw file/blob BYTES (git object contents)', 'api', 'niche',
+    'Out of scope: actual repository code/file contents are large + redundant; the metadata/API objects are modeled; the bytes are out of scope.'),
+
+  // ── Git Data API ─────────────────────────────────────────────────────────────────────────
+  done('github.git.refs', 'git', 'Git Data: refs (create/get/update/delete branches+tags)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const sha = 'a'.repeat(40);
+      // missing sha → 422; non-refs/ prefix → 422.
+      const noSha = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat' }), root });
+      if (noSha.response.status !== 422) return false;
+      const badPrefix = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'heads/feat', sha }), root });
+      if (badPrefix.response.status !== 422) return false;
+      // create a branch ref → 201 with ref+object.sha; duplicate → 422.
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha }), root });
+      if (!(c.response.status === 201 && (c.response.body as { ref?: string }).ref === 'refs/heads/feat' && (c.response.body as { object?: { sha?: string } }).object?.sha === sha)) return false;
+      const dup = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha }), root });
+      if (dup.response.status !== 422) return false;
+      // get one via .../git/ref/:ref; update its sha (PATCH); delete (DELETE) then 404.
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
+      if (!(ok(get.status) && (get.body as { object?: { sha?: string } }).object?.sha === sha)) return false;
+      const sha2 = 'b'.repeat(40);
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/git/refs/heads/feat`, body: JSON.stringify({ sha: sha2 }), root });
+      if (!(upd.response.status === 200 && (upd.response.body as { object?: { sha?: string } }).object?.sha === sha2)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/heads`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/git/refs/heads/feat`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.git.commits', 'git', 'Git Data: commit objects (get/create)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const tree = 't'.repeat(40);
+      // missing required fields → 422.
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/commits`, body: JSON.stringify({ message: 'x' }), root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/commits`, body: JSON.stringify({ message: 'init', tree, parents: ['p'.repeat(40)], author: { name: 'Ann', email: 'a@x' } }), root });
+      if (!(c.response.status === 201 && (c.response.body as { message?: string }).message === 'init')) return false;
+      const sha = (c.response.body as { sha?: string }).sha!;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/commits/${sha}`, root });
+      const b = get.body as { tree?: { sha?: string }; parents?: unknown[]; author?: { name?: string } };
+      return ok(get.status) && b.tree?.sha === tree && b.parents?.length === 1 && b.author?.name === 'Ann';
+    })),
+  done('github.git.trees', 'git', 'Git Data: trees (get/create)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const blobSha = 'd'.repeat(40);
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/trees`, body: '{}', root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/trees`, body: JSON.stringify({ tree: [{ path: 'a.ts', mode: '100644', type: 'blob', sha: blobSha }] }), root });
+      if (c.response.status !== 201) return false;
+      const sha = (c.response.body as { sha?: string }).sha!;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/trees/${sha}`, root });
+      const entries = (get.body as { tree?: Array<{ path?: string; type?: string }> }).tree ?? [];
+      return ok(get.status) && entries.length === 1 && entries[0]!.path === 'a.ts' && entries[0]!.type === 'blob';
+    })),
+  done('github.git.blobs', 'git', 'Git Data: blob objects (create/get)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const content = Buffer.from('hello blob').toString('base64');
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/blobs`, body: '{}', root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/blobs`, body: JSON.stringify({ content, encoding: 'base64' }), root });
+      if (c.response.status !== 201) return false;
+      const sha = (c.response.body as { sha?: string }).sha!;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/blobs/${sha}`, root });
+      const b = get.body as { content?: string; encoding?: string; size?: number };
+      return ok(get.status) && b.content === content && b.encoding === 'base64' && b.size === Buffer.from('hello blob').length;
+    })),
+  done('github.git.tags', 'git', 'Git Data: annotated tags', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const objSha = 'c'.repeat(40);
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/tags`, body: JSON.stringify({ tag: 'v1' }), root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/tags`, body: JSON.stringify({ tag: 'v1.0.0', message: 'release', object: objSha, type: 'commit', tagger: { name: 'Ann' } }), root });
+      if (!(c.response.status === 201 && (c.response.body as { tag?: string }).tag === 'v1.0.0')) return false;
+      const sha = (c.response.body as { sha?: string }).sha!;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/tags/${sha}`, root });
+      const b = get.body as { object?: { sha?: string; type?: string }; message?: string };
+      if (!(ok(get.status) && b.object?.sha === objSha && b.message === 'release')) return false;
+      // creating a refs/tags ref pointing at the annotated tag → object.type 'tag'.
+      const ref = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/tags/v1.0.0', sha }), root });
+      return ref.response.status === 201 && (ref.response.body as { object?: { type?: string } }).object?.type === 'tag';
+    })),
+
+  // ── Releases / Tags ──────────────────────────────────────────────────────────────────────
+  done('github.releases.crud', 'releases', 'Releases: create/edit/list/get + latest + by-tag', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v1.0.0', name: 'First', body: 'notes' }), root });
+      if (c.response.status !== 201) return false;
+      const id = (c.response.body as { id?: number; tag_name?: string }).id!;
+      if ((c.response.body as { html_url?: string }).html_url?.includes('releases/tag/v1.0.0') !== true) return false;
+      // GET one, by id, asserting tag_name/name round-trip.
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
+      if (!(ok(one.status) && (one.body as { tag_name?: string }).tag_name === 'v1.0.0' && (one.body as { name?: string }).name === 'First')) return false;
+      // GET latest (published) + GET by tag.
+      const latest = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/latest`, root });
+      const byTag = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/tags/v1.0.0`, root });
+      if (!(ok(latest.status) && (latest.body as { tag_name?: string }).tag_name === 'v1.0.0' && ok(byTag.status) && (byTag.body as { id?: number }).id === id)) return false;
+      // PATCH (edit name) round-trips; list returns the release; DELETE 204s then 404s.
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/releases/${id}`, body: JSON.stringify({ name: 'Renamed' }), root });
+      if (!(ok(e.response.status) && (e.response.body as { name?: string }).name === 'Renamed')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/releases/${id}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.releases.assets', 'releases', 'Releases: assets register/list/get (metadata; bytes out of scope)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v2', name: 'Two' }), root });
+      const relId = (r.response.body as { id?: number }).id!;
+      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases/${relId}/assets`, body: JSON.stringify({ name: 'app.zip', content_type: 'application/zip', size: 1024 }), root });
+      if (!(a.response.status === 201 && (a.response.body as { name?: string }).name === 'app.zip' && (a.response.body as { size?: number }).size === 1024)) return false;
+      const assetId = (a.response.body as { id?: number }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}/assets`, root });
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/assets/${assetId}`, root });
+      // The asset rides on the release object too (assets:[...]).
+      const rel = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}`, root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status) && (one.body as { name?: string }).name === 'app.zip'
+        && ok(rel.status) && ((rel.body as { assets?: unknown[] }).assets?.length === 1);
+    })),
+  done('github.tags.list', 'releases', 'Tags: list (GET /tags) + git refs (GET /git/refs/tags)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      // A published release creates its tag; a draft does NOT (real GitHub behavior).
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v3.0.0', name: 'Three' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v4.0.0-draft', name: 'Draft', draft: true }), root });
+      const tags = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/tags`, root });
+      if (!(ok(tags.status) && isArr(tags.body) && tags.body.length === 1 && (tags.body[0] as { name?: string }).name === 'v3.0.0')) return false;
+      const ref = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/tags/v3.0.0`, root });
+      return ok(ref.status) && (ref.body as { ref?: string }).ref === 'refs/tags/v3.0.0' && (ref.body as { object?: { type?: string } }).object?.type === 'commit';
+    })),
+
+  // ── Projects v2 (modeled as stateful CRUD over the kernel; GraphQL graph not modeled) ──────
+  done('github.projects.crud', 'projects', 'Projects v2: project CRUD', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // missing title 422s; create → 201 with number 1; get by number; PATCH closes; DELETE → gone.
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: '{}', root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'Roadmap', short_description: 'Q3' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { number?: number }).number === 1)) return false;
+      const pid = (c.response.body as { id?: number }).id!;
+      const byNum = handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2/1`, root });
+      if (!(ok(byNum.status) && (byNum.body as { title?: string }).title === 'Roadmap')) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}`, body: JSON.stringify({ closed: true, title: 'Done' }), root });
+      if (!(ok(e.response.status) && (e.response.body as { closed?: boolean }).closed === true && (e.response.body as { title?: string }).title === 'Done')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.projects.items', 'projects', 'Projects v2: items add/remove + field values', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const pid = (c.response.body as { id?: number }).id!;
+      // a draft item needs a title (422 without); add → 201; a status field value sets via PATCH.
+      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: '{}', root })).response.status !== 422) return false;
+      const add = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Ship it' }), root });
+      if (!(add.response.status === 201 && (add.response.body as { content_type?: string }).content_type === 'DraftIssue')) return false;
+      const iid = (add.response.body as { id?: number }).id!;
+      const linked = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'Issue', content_id: 42, content_repository: 'octo/demo' }), root });
+      if (linked.response.status !== 201) return false;
+      const setv = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${iid}`, body: JSON.stringify({ field_id: 'status', value: 'In Progress' }), root });
+      if (!(ok(setv.response.status) && (setv.response.body as { field_values?: Record<string, unknown> }).field_values?.status === 'In Progress')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/items`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/items/${iid}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/items`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
+    })),
+  done('github.projects.fields', 'projects', 'Projects v2: custom fields (status/iteration/single-select)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const pid = (c.response.body as { id?: number }).id!;
+      // missing data_type 422s; an invalid type 422s; single-select carries options; iteration carries config.
+      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X', data_type: 'nope' }), root })).response.status !== 422) return false;
+      const ss = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done', color: 'GREEN' }] }), root });
+      if (!(ss.response.status === 201 && (ss.response.body as { options?: unknown[] }).options?.length === 2)) return false;
+      const it = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Sprint', data_type: 'iteration', iterations: [{ title: 'S1', duration: 14 }] }), root });
+      if (!(it.response.status === 201 && (((it.response.body as { configuration?: { iterations?: unknown[] } }).configuration?.iterations?.length) === 1))) return false;
+      const fid = (ss.response.body as { id?: number }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/fields`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/fields/${fid}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/fields`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
+    })),
+  done('github.projects.views', 'projects', 'Projects v2: views (board/table/roadmap)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const pid = (c.response.body as { id?: number }).id!;
+      // an invalid layout 422s; board/table/roadmap each create; PATCH relayouts; DELETE removes.
+      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'V', layout: 'pie' }), root })).response.status !== 422) return false;
+      const board = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
+      if (!(board.response.status === 201 && (board.response.body as { number?: number }).number === 1 && (board.response.body as { layout?: string }).layout === 'board')) return false;
+      const table = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Table', layout: 'table' }), root });
+      if (table.response.status !== 201) return false;
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/views/1`, body: JSON.stringify({ layout: 'roadmap' }), root });
+      if (!(ok(upd.response.status) && (upd.response.body as { layout?: string }).layout === 'roadmap')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/views`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/views/2`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/views`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
+    })),
+
+  // ── Discussions (whole product: discussions + categories + comments/replies + answers +
+  //    a UI view). Modeled over the twin's REST handler (real GitHub Discussions are GraphQL
+  //    — a declared deviation), consistent with the rest of the twin. LOCAL constructs. ─────
+  done('github.discussions.crud', 'discussions', 'Discussions: create/list/get/edit/delete', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // create → 201 with number + html_url + resolved category.
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'Welcome', body: 'hi', category: 'general' }), root });
+      if (c.response.status !== 201) return false;
+      const n = (c.response.body as { number?: number; category?: { slug?: string }; html_url?: string }).number!;
+      if (n !== 1 || (c.response.body as { category?: { slug?: string } }).category?.slug !== 'general') return false;
+      if (!(c.response.body as { html_url?: string }).html_url?.includes('/discussions/1')) return false;
+      // missing title → 422; unknown category → 422 (vendor-faithful validation).
+      const noTitle = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ category: 'general' }), root });
+      const badCat = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'x', category: 'nope' }), root });
+      if (noTitle.response.status !== 422 || badCat.response.status !== 422) return false;
+      // GET one + list round-trips title/category.
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions`, root });
+      if (!(ok(one.status) && (one.body as { title?: string }).title === 'Welcome' && isArr(list.body) && list.body.length === 1)) return false;
+      // edit (title + close) round-trips; delete 204s then 404s.
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/discussions/1`, body: JSON.stringify({ title: 'Renamed', state: 'closed' }), root });
+      if (!(ok(e.response.status) && (e.response.body as { title?: string; state?: string }).title === 'Renamed' && (e.response.body as { state?: string }).state === 'closed')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/discussions/1`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.discussions.categories', 'discussions', 'Discussions: categories (seeded defaults + custom + answerable Q&A)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // the repo's category list seeds GitHub's defaults; Q&A is the answerable one.
+      const cats = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
+      if (!(ok(cats.status) && isArr(cats.body))) return false;
+      const qa = (cats.body as Array<{ slug?: string; is_answerable?: boolean }>).find((c) => c.slug === 'q-a');
+      const general = (cats.body as Array<{ slug?: string; is_answerable?: boolean }>).find((c) => c.slug === 'general');
+      if (!(qa?.is_answerable === true && general?.is_answerable === false && (cats.body as unknown[]).length >= 5)) return false;
+      // a custom category is creatable + appears in the list with its slug.
+      const made = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/categories`, body: JSON.stringify({ name: 'Polls', is_answerable: false }), root });
+      if (!(made.response.status === 201 && (made.response.body as { slug?: string }).slug === 'polls')) return false;
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
+      return isArr(after.body) && (after.body as Array<{ slug?: string }>).some((c) => c.slug === 'polls');
+    })),
+  done('github.discussions.comments', 'discussions', 'Discussions: comments + threaded replies', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'Q', body: '?', category: 'q-a' }), root });
+      // top-level comment → 201; missing body → 422.
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: JSON.stringify({ body: 'an answer' }), root });
+      if (cm.response.status !== 201) return false;
+      const cid = (cm.response.body as { id?: number }).id!;
+      const noBody = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: '{}', root });
+      if (noBody.response.status !== 422) return false;
+      // a threaded reply pins to its parent via parent_id.
+      const reply = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: JSON.stringify({ body: 'thanks', parent_id: cid }), root });
+      if (!(reply.response.status === 201 && (reply.response.body as { parent_id?: number }).parent_id === cid)) return false;
+      // list returns both, and the discussion's comment count reflects them.
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1/comments`, root });
+      const disc = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 2 && (disc.body as { comments?: number }).comments === 2;
+    })),
+  done('github.discussions.answers', 'discussions', 'Discussions: mark/unmark accepted answer (Q&A only)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // a Q&A (answerable) discussion + a comment.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'Q', body: '?', category: 'q-a' }), root });
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: JSON.stringify({ body: 'this is the answer' }), root });
+      const cid = (cm.response.body as { id?: number }).id!;
+      // mark → comment.is_answer true + the discussion points at it.
+      const mark = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/discussions/1/comments/${cid}/answer`, body: '{}', root });
+      if (!(ok(mark.response.status) && (mark.response.body as { is_answer?: boolean }).is_answer === true)) return false;
+      const disc = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      if ((disc.body as { answer_comment_id?: number }).answer_comment_id !== cid) return false;
+      // unmark clears both.
+      const unmark = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/discussions/1/comments/${cid}/answer`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      if (!(ok(unmark.response.status) && (unmark.response.body as { is_answer?: boolean }).is_answer === false && (after.body as { answer_comment_id?: number | null }).answer_comment_id === null)) return false;
+      // a NON-answerable (General) discussion rejects an answer mark → 422 (vendor-faithful).
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'chat', category: 'general' }), root });
+      const cm2 = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/2/comments`, body: JSON.stringify({ body: 'hi' }), root });
+      const bad = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/discussions/2/comments/${(cm2.response.body as { id?: number }).id}/answer`, body: '{}', root });
+      return bad.response.status === 422;
+    })),
+
+  // ── Orgs / Teams / Members / Users ───────────────────────────────────────────────────────
+  done('github.orgs.crud', 'orgs', 'Orgs: get/update + members', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // an unknown org 404s; PATCH auto-vivifies + round-trips the profile fields.
+      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root }).status !== 404) return false;
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo`, body: JSON.stringify({ description: 'The Octo org', billing_email: 'pay@octo.dev' }), root });
+      if (!(ok(upd.response.status) && (upd.response.body as { description?: string }).description === 'The Octo org')) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root });
+      if (!(ok(get.status) && (get.body as { type?: string }).type === 'Organization' && (get.body as { description?: string }).description === 'The Octo org')) return false;
+      // members: invite via membership, then the member appears + the 204 membership check passes.
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/alice`, body: JSON.stringify({ role: 'admin' }), root });
+      const members = handleGithubRequest({ method: 'GET', path: `/orgs/octo/members`, root });
+      return ok(members.status) && isArr(members.body) && members.body.length === 1 && (members.body[0] as { login?: string }).login === 'alice'
+        && handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/alice`, root }).status === 204;
+    })),
+  done('github.orgs.membership', 'orgs', 'Orgs: membership (invite/role/remove) + outside collaborators', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // invite → role round-trips via GET memberships/:login; PATCH-style re-PUT changes role.
+      const inv = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/bob`, body: JSON.stringify({ role: 'member' }), root });
+      if (!(ok(inv.response.status) && (inv.response.body as { role?: string }).role === 'member')) return false;
+      const promote = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/bob`, body: JSON.stringify({ role: 'admin' }), root });
+      if ((promote.response.body as { role?: string }).role !== 'admin') return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo/memberships/bob`, root });
+      if ((get.body as { role?: string }).role !== 'admin') return false;
+      // remove → member gone (404 check + delete idempotency: second delete 404s).
+      const rm = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/members/bob`, root });
+      if (rm.response.status !== 204) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/bob`, root }).status !== 404) return false;
+      if ((await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/members/bob`, root })).response.status !== 404) return false;
+      // outside collaborators: add → listed → remove → gone.
+      const oc = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/outside_collaborators/carol`, body: '{}', root });
+      if (oc.response.status !== 204) return false;
+      const ocList = handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
+      if (!(isArr(ocList.body) && ocList.body.length === 1 && (ocList.body[0] as { login?: string }).login === 'carol')) return false;
+      const ocRm = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/outside_collaborators/carol`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
+      return ocRm.response.status === 204 && isArr(after.body) && after.body.length === 0;
+    })),
+  done('github.orgs.repos', 'orgs', 'Orgs: list org repositories', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'pub' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'sec', private: true }), root });
+      await applyGithubWrite({ method: 'POST', path: `/orgs/other/repos`, body: JSON.stringify({ name: 'x' }), root });
+      // list scopes to the org (not the unrelated 'other/x'); ?type=private filters.
+      const all = handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos`, root });
+      if (!(ok(all.status) && isArr(all.body) && all.body.length === 2 && (all.body as Array<{ full_name?: string }>).every((r) => r.full_name!.startsWith('octo/')))) return false;
+      const priv = handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos?type=private`, root });
+      return isArr(priv.body) && priv.body.length === 1 && (priv.body[0] as { name?: string }).name === 'sec';
+    })),
+  done('github.orgs.webhooks', 'orgs', 'Orgs: org-level webhooks CRUD', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // a config.url is required (422 without it); create → edit active → list → delete → 404.
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/hooks`, body: JSON.stringify({ events: ['push'] }), root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/hooks`, body: JSON.stringify({ events: ['push', 'repository'], config: { url: 'https://e.x/h', content_type: 'json' } }), root });
+      if (!(c.response.status === 201 && (c.response.body as { events?: string[] }).events?.length === 2)) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/hooks/${id}`, body: JSON.stringify({ active: false }), root });
+      if (!(ok(e.response.status) && (e.response.body as { active?: boolean }).active === false)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/hooks/${id}`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks/${id}`, root }).status === 404;
+    })),
+  done('github.teams.crud', 'orgs', 'Teams: CRUD + membership + repo access', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // create → slug derived from name; get by slug; PATCH description; membership; repo grant.
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams`, body: JSON.stringify({ name: 'Core Team', privacy: 'closed' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { slug?: string }).slug === 'core-team')) return false;
+      // duplicate name (same slug) → 422.
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams`, body: JSON.stringify({ name: 'core-team' }), root })).response.status !== 422) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root });
+      if (!(ok(get.status) && (get.body as { privacy?: string }).privacy === 'closed')) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/teams/core-team`, body: JSON.stringify({ description: 'the core team' }), root });
+      if ((e.response.body as { description?: string }).description !== 'the core team') return false;
+      // membership: add maintainer → appears in members + membership get shows role.
+      const m = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/teams/core-team/memberships/dana`, body: JSON.stringify({ role: 'maintainer' }), root });
+      if ((m.response.body as { role?: string }).role !== 'maintainer') return false;
+      const mem = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/members`, root });
+      if (!(isArr(mem.body) && mem.body.length === 1 && (mem.body[0] as { login?: string }).login === 'dana')) return false;
+      // repo access: grant push → 204 check passes + repo appears in team repos.
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'svc' }), root });
+      const g = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/teams/core-team/repos/octo/svc`, body: JSON.stringify({ permission: 'push' }), root });
+      if (g.response.status !== 204) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos/octo/svc`, root }).status !== 204) return false;
+      const repos = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos`, root });
+      if (!(isArr(repos.body) && repos.body.length === 1 && (repos.body[0] as { full_name?: string }).full_name === 'octo/svc')) return false;
+      // delete team → 404 thereafter.
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/core-team`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root }).status === 404;
+    })),
+  done('github.teams.discussions', 'orgs', 'Teams: team discussions + comments', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams`, body: JSON.stringify({ name: 'eng' }), root });
+      // a missing title 422s; create → per-team number 1; edit body; pin.
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams/eng/discussions`, body: '{}', root })).response.status !== 422) return false;
+      const d = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams/eng/discussions`, body: JSON.stringify({ title: 'Roadmap', body: 'Q3 plan' }), root });
+      if (!(d.response.status === 201 && (d.response.body as { number?: number }).number === 1)) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/teams/eng/discussions/1`, body: JSON.stringify({ pinned: true }), root });
+      if ((e.response.body as { pinned?: boolean }).pinned !== true) return false;
+      // comments: create → per-discussion number 1; edit; list; delete → list shrinks.
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams/eng/discussions/1/comments`, body: JSON.stringify({ body: '+1' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { number?: number }).number === 1)) return false;
+      const cl = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
+      if (!(isArr(cl.body) && cl.body.length === 1 && (cl.body[0] as { body?: string }).body === '+1')) return false;
+      const cdel = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/eng/discussions/1/comments/1`, root });
+      if (cdel.response.status !== 204) return false;
+      const cl2 = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
+      if (!(isArr(cl2.body) && cl2.body.length === 0)) return false;
+      // delete the discussion → 404 thereafter (and its comments orphan-pruned).
+      const ddel = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/eng/discussions/1`, root });
+      return ddel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1`, root }).status === 404;
+    })),
+  done('github.users.profile', 'users', 'Users: get profile + authenticated user', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const u = handleGithubRequest({ method: 'GET', path: `/users/octocat`, root });
+      if (!(ok(u.status) && (u.body as { login?: string }).login === 'octocat' && typeof (u.body as { id?: number }).id === 'number')) return false;
+      const me = handleGithubRequest({ method: 'GET', path: `/user`, root });
+      return ok(me.status) && (me.body as { login?: string }).login === 'octocat';
+    })),
+  done('github.users.followers', 'users', 'Users: followers/following', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // not following → 404 check; follow → 204 check + appears in /user/following.
+      if (handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status !== 404) return false;
+      const f = await applyGithubWrite({ method: 'PUT', path: `/user/following/ann`, body: '{}', root });
+      if (f.response.status !== 204) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status !== 204) return false;
+      const following = handleGithubRequest({ method: 'GET', path: `/user/following`, root });
+      if (!(isArr(following.body) && following.body.length === 1 && (following.body[0] as { login?: string }).login === 'ann')) return false;
+      // ann's followers now include octocat (the only modeled actor).
+      const followers = handleGithubRequest({ method: 'GET', path: `/users/ann/followers`, root });
+      if (!(isArr(followers.body) && followers.body.length === 1 && (followers.body[0] as { login?: string }).login === 'octocat')) return false;
+      // unfollow → check 404 again + list empties.
+      const uf = await applyGithubWrite({ method: 'DELETE', path: `/user/following/ann`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/user/following`, root });
+      return uf.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status === 404 && isArr(after.body) && after.body.length === 0;
+    })),
+
+  // ── Gists ────────────────────────────────────────────────────────────────────────────────
+  done('github.gists.crud', 'gists', 'Gists: create/edit/list/get + comments', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/gists`, body: JSON.stringify({ description: 'snip', public: true, files: { 'a.ts': { content: 'export const a=1' } } }), root });
+      if (c.response.status !== 201) return false;
+      const id = (c.response.body as { id?: string }).id!;
+      const get = handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
+      if (!(ok(get.status) && (get.body as { files?: Record<string, unknown> }).files?.['a.ts'])) return false;
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/gists/${id}`, body: JSON.stringify({ description: 'renamed' }), root });
+      if (!(ok(e.response.status) && (e.response.body as { description?: string }).description === 'renamed')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/gists`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/gists/${id}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+
+  // ── Search ───────────────────────────────────────────────────────────────────────────────
+  done('github.search.issues', 'search', 'Search: issues/PRs', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'fix login bug' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'add login', head: 'a', base: 'main' }), root });
+      const all = handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login')}`, root });
+      if (!(ok(all.status) && (all.body as { total_count?: number }).total_count === 2)) return false;
+      const prsOnly = handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login is:pr')}`, root });
+      const items = (prsOnly.body as { items?: Array<{ pull_request?: unknown }> }).items ?? [];
+      return (prsOnly.body as { total_count?: number }).total_count === 1 && items.every((i) => 'pull_request' in i);
+    })),
+  done('github.search.code', 'search', 'Search: code', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/src/util.ts`, body: JSON.stringify({ message: 'm', content: Buffer.from('x').toString('base64') }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/search/code?q=${encodeURIComponent('util')}`, root });
+      return ok(r.status) && (r.body as { total_count?: number }).total_count === 1 && ((r.body as { items?: Array<{ path?: string }> }).items?.[0]?.path === 'src/util.ts');
+    })),
+  done('github.search.repos', 'search', 'Search: repos', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'searchme', description: 'a findable repo' }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/search/repositories?q=${encodeURIComponent('searchme')}`, root });
+      return ok(r.status) && (r.body as { total_count?: number }).total_count === 1;
+    })),
+  done('github.search.users', 'search', 'Search: users', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'push' }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/search/users?q=${encodeURIComponent('alice')}`, root });
+      return ok(r.status) && (r.body as { total_count?: number }).total_count === 1 && ((r.body as { items?: Array<{ login?: string }> }).items?.[0]?.login === 'alice');
+    })),
+  done('github.search.commits', 'search', 'Search: commits', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main', commits: [{ sha: 'abcd', message: 'initial commit' }] }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/search/commits?q=${encodeURIComponent('initial')}`, root });
+      return ok(r.status) && (r.body as { total_count?: number }).total_count === 1;
+    })),
+
+  // ── Notifications ────────────────────────────────────────────────────────────────────────
+  done('github.notifications.list', 'notifications', 'Notifications: list/mark-read + thread subscriptions', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const n = await applyGithubWrite({ method: 'POST', path: `/notifications`, body: JSON.stringify({ repository: REPO, subject_title: 'New PR', subject_type: 'PullRequest', reason: 'review_requested' }), root });
+      if (n.response.status !== 201) return false;
+      const id = (n.response.body as { id?: string }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: `/notifications`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { unread?: boolean }).unread === true)) return false;
+      const read = await applyGithubWrite({ method: 'PATCH', path: `/notifications/threads/${id}`, body: '{}', root });
+      if (read.response.status !== 205) return false;
+      const after = handleGithubRequest({ method: 'GET', path: `/notifications`, root });
+      const allList = handleGithubRequest({ method: 'GET', path: `/notifications?all=true`, root });
+      return isArr(after.body) && after.body.length === 0 && isArr(allList.body) && allList.body.length === 1;
+    })),
+
+  // ── Platform meta endpoints (stateless reference catalogs) ───────────────────────────────
+  done('github.meta.rate_limit', 'meta', 'Rate limit: GET /rate_limit envelope (resources + rate)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const r = handleGithubRequest({ method: 'GET', path: `/rate_limit`, root });
+      const b = r.body as { resources?: { core?: { limit?: number; remaining?: number } }; rate?: { limit?: number } };
+      return ok(r.status) && b.resources?.core?.limit === 5000 && b.resources?.core?.remaining === 5000 && b.rate?.limit === 5000;
+    })),
+  done('github.meta.markdown', 'meta', 'Markdown: POST /markdown → rendered GFM HTML', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const r = await applyGithubWrite({ method: 'POST', path: `/markdown`, body: JSON.stringify({ text: '# Title\n**b** `c` [x](http://e.x)' }), root });
+      const html = String(r.response.body ?? '');
+      if (!(ok(r.response.status) && html.includes('<h1>Title</h1>') && html.includes('<strong>b</strong>') && html.includes('<code>c</code>') && html.includes('<a href="http://e.x">x</a>'))) return false;
+      // missing required `text` → 422 like GitHub.
+      const bad = await applyGithubWrite({ method: 'POST', path: `/markdown`, body: '{}', root });
+      return bad.response.status === 422;
+    })),
+  done('github.meta.gitignore', 'meta', 'gitignore templates: list + GET one (name/source)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const list = handleGithubRequest({ method: 'GET', path: `/gitignore/templates`, root });
+      if (!(ok(list.status) && isArr(list.body) && (list.body as string[]).includes('Node'))) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Node`, root });
+      const b = one.body as { name?: string; source?: string };
+      if (!(ok(one.status) && b.name === 'Node' && typeof b.source === 'string' && b.source.length > 0)) return false;
+      return handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Nope`, root }).status === 404;
+    })),
+  done('github.meta.licenses', 'meta', 'Licenses: list + GET one (key/spdx_id)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const list = handleGithubRequest({ method: 'GET', path: `/licenses`, root });
+      if (!(ok(list.status) && isArr(list.body) && (list.body as Array<{ key?: string }>).some((l) => l.key === 'mit'))) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/licenses/mit`, root });
+      const b = one.body as { spdx_id?: string; key?: string };
+      if (!(ok(one.status) && b.key === 'mit' && b.spdx_id === 'MIT')) return false;
+      return handleGithubRequest({ method: 'GET', path: `/licenses/nope`, root }).status === 404;
+    })),
+  done('github.meta.emojis', 'meta', 'Emojis: GET /emojis name→asset-url map', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const r = handleGithubRequest({ method: 'GET', path: `/emojis`, root });
+      const b = r.body as Record<string, string>;
+      return ok(r.status) && typeof b['+1'] === 'string' && b['rocket']!.startsWith('https://');
+    })),
+  done('github.meta.service_meta', 'meta', 'Meta: GET /meta service metadata envelope', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const r = handleGithubRequest({ method: 'GET', path: `/meta`, root });
+      const b = r.body as { verifiable_password_authentication?: boolean; hooks?: unknown[] };
+      return ok(r.status) && typeof b.verifiable_password_authentication === 'boolean' && Array.isArray(b.hooks);
+    })),
+
+  // ── Activity (starring / watching) ───────────────────────────────────────────────────────
+  done('github.activity.starring', 'activity', 'Starring: PUT/DELETE /user/starred/:o/:r + stargazers + check', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      // not starred yet → 404 on the membership check.
+      if (handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status !== 404) return false;
+      const star = await applyGithubWrite({ method: 'PUT', path: `/user/starred/octo/demo`, root });
+      if (!(star.response.status === 204 && star.webhook?.event === 'star' && star.webhook.action === 'created')) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status !== 204) return false;
+      const gz = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/stargazers`, root });
+      if (!(ok(gz.status) && isArr(gz.body) && gz.body.length === 1 && (gz.body[0] as { login?: string }).login === 'octocat')) return false;
+      const mine = handleGithubRequest({ method: 'GET', path: `/user/starred`, root });
+      if (!(ok(mine.status) && isArr(mine.body) && mine.body.length === 1)) return false;
+      const un = await applyGithubWrite({ method: 'DELETE', path: `/user/starred/octo/demo`, root });
+      return un.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status === 404;
+    })),
+  done('github.activity.watching', 'activity', 'Watching: PUT/DELETE/GET .../subscription + subscribers', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      // not watching yet → 404.
+      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root }).status !== 404) return false;
+      const w = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/subscription`, root });
+      const wb = w.response.body as { subscribed?: boolean };
+      if (!(ok(w.response.status) && wb.subscribed === true)) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root });
+      if (!(ok(get.status) && (get.body as { subscribed?: boolean }).subscribed === true)) return false;
+      const subs = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscribers`, root });
+      if (!(ok(subs.status) && isArr(subs.body) && subs.body.length === 1)) return false;
+      const un = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/subscription`, root });
+      return un.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root }).status === 404;
+    })),
+  done('github.activity.feeds', 'activity', 'Activity: feeds + received/public events streams', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // GET /feeds returns the feed-URL catalog (with timeline + _links). The event streams
+      // (public timeline, per-user events, received_events) are DERIVED from modeled objects:
+      // a merged PR + an issue produce PullRequestEvent + IssuesEvent in the stream.
+      const feeds = handleGithubRequest({ method: 'GET', path: '/feeds', root });
+      if (!(ok(feeds.status) && typeof (feeds.body as { timeline_url?: string }).timeline_url === 'string' && (feeds.body as { _links?: object })._links)) return false;
+      await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/pulls/1/merge`, body: '{}', root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/issues`, body: JSON.stringify({ title: 'i' }), root });
+      const pub = handleGithubRequest({ method: 'GET', path: '/events', root });
+      if (!(ok(pub.status) && isArr(pub.body) && pub.body.length === 2)) return false;
+      const types = new Set((pub.body as Array<{ type?: string }>).map((e) => e.type));
+      if (!(types.has('PullRequestEvent') && types.has('IssuesEvent'))) return false;
+      // octo OWNS octo/demo → its received_events stream carries both; an unknown user's is empty.
+      const received = handleGithubRequest({ method: 'GET', path: '/users/octo/received_events', root });
+      const userEv = handleGithubRequest({ method: 'GET', path: '/users/octo/events', root });
+      const empty = handleGithubRequest({ method: 'GET', path: '/users/nobody/events', root });
+      const repoEv = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/events', root });
+      return ok(received.status) && isArr(received.body) && received.body.length === 2
+        && ok(userEv.status) && isArr(userEv.body) && userEv.body.length === 2
+        && ok(empty.status) && isArr(empty.body) && empty.body.length === 0
+        && ok(repoEv.status) && isArr(repoEv.body) && repoEv.body.length === 2;
+    })),
+  done('github.activity.notifications_repo', 'activity', 'Activity: per-repo notifications + thread subscriptions', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // Seed two notifications in different repos; the per-repo inbox returns only that repo's.
+      const n = await applyGithubWrite({ method: 'POST', path: '/notifications', body: JSON.stringify({ repository: 'octo/a', subject_title: 'PR in a', subject_type: 'PullRequest' }), root });
+      await applyGithubWrite({ method: 'POST', path: '/notifications', body: JSON.stringify({ repository: 'octo/b', subject_title: 'Issue in b', subject_type: 'Issue' }), root });
+      const nid = (n.response.body as { id?: string }).id!;
+      const inbox = handleGithubRequest({ method: 'GET', path: '/repos/octo/a/notifications', root });
+      if (!(ok(inbox.status) && isArr(inbox.body) && inbox.body.length === 1 && (inbox.body[0] as { repository?: { full_name?: string } }).repository?.full_name === 'octo/a')) return false;
+      // thread subscription: a subscribed thread reads subscribed:true; DELETE clears it (and
+      // marks the thread read, so it drops out of the unread per-repo inbox).
+      const sub = handleGithubRequest({ method: 'GET', path: `/notifications/threads/${nid}/subscription`, root });
+      if (!(ok(sub.status) && (sub.body as { subscribed?: boolean }).subscribed === true)) return false;
+      const ignore = await applyGithubWrite({ method: 'PUT', path: `/notifications/threads/${nid}/subscription`, body: JSON.stringify({ ignored: true }), root });
+      if (!(ok(ignore.response.status) && (ignore.response.body as { ignored?: boolean }).ignored === true)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/notifications/threads/${nid}/subscription`, root });
+      const after = handleGithubRequest({ method: 'GET', path: '/repos/octo/a/notifications', root });
+      return del.response.status === 204 && ok(after.status) && isArr(after.body) && after.body.length === 0;
+    })),
+
+  // ── Repo metadata (derived read endpoints) ───────────────────────────────────────────────
+  done('github.repos.languages', 'repos', 'Repos: language byte-breakdown (GET .../languages)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/src/a.ts`, body: JSON.stringify({ message: 'm', content: Buffer.from('x'.repeat(40)).toString('base64') }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/main.py`, body: JSON.stringify({ message: 'm', content: Buffer.from('y'.repeat(10)).toString('base64') }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/languages`, root });
+      const b = r.body as Record<string, number>;
+      return ok(r.status) && b.TypeScript === 40 && b.Python === 10;
+    })),
+  done('github.repos.contributors', 'repos', 'Repos: contributors (GET .../contributors, commit-author tallies)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main', commits: [{ sha: 'a1', message: 'c1', author_name: 'alice' }, { sha: 'a2', message: 'c2', author_name: 'alice' }, { sha: 'b1', message: 'c3', author_name: 'bob' }] }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contributors`, root });
+      const arr = r.body as Array<{ login?: string; contributions?: number }>;
+      return ok(r.status) && arr.length === 2 && arr[0]!.login === 'alice' && arr[0]!.contributions === 2 && arr[1]!.login === 'bob';
+    })),
+  done('github.repos.compare', 'repos', 'Repos: compare commits (GET .../compare/:base...:head)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'feat-sha', base: 'main', commits: [{ sha: 'c1', message: 'one' }], files: [{ filename: 'x.ts', additions: 2, deletions: 0 }] }), root });
+      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/compare/main...feat-sha`, root });
+      const b = r.body as { total_commits?: number; commits?: unknown[]; files?: Array<{ filename?: string }>; status?: string };
+      return ok(r.status) && b.total_commits === 1 && b.status === 'ahead' && (b.files?.[0]?.filename === 'x.ts');
+    })),
+  done('github.repos.commit_comments', 'repos', 'Repos: commit comments (on a commit sha)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // a missing body 422s; create on a sha → listed under the commit + the repo-wide list.
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/commits/abc123/comments`, body: '{}', root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/commits/abc123/comments`, body: JSON.stringify({ body: 'nice fix', path: 'a.ts', line: 5 }), root });
+      if (!(c.response.status === 201 && (c.response.body as { commit_id?: string }).commit_id === 'abc123' && (c.response.body as { path?: string }).path === 'a.ts')) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const onCommit = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/comments`, root });
+      if (!(ok(onCommit.status) && isArr(onCommit.body) && onCommit.body.length === 1)) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root });
+      if (!(ok(one.status) && (one.body as { body?: string }).body === 'nice fix')) return false;
+      // edit body; delete → repo-wide list empties.
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/comments/${id}`, body: JSON.stringify({ body: 'edited' }), root });
+      if ((e.response.body as { body?: string }).body !== 'edited') return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/comments/${id}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 0
+        && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root }).status === 404;
+    })),
+  done('github.repos.readme', 'repos', 'Repos: GET .../readme (rendered + raw)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      // no README yet → 404; write README.md then it returns the base64 content object.
+      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root }).status !== 404) return false;
+      const b64 = Buffer.from('# Demo\nhello').toString('base64');
+      const put = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/contents/README.md`, body: JSON.stringify({ message: 'add readme', content: b64 }), root });
+      if (put.response.status !== 201) return false;
+      const r = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root });
+      return ok(r.status) && (r.body as { name?: string }).name === 'README.md' && (r.body as { encoding?: string }).encoding === 'base64'
+        && Buffer.from(String((r.body as { content?: string }).content ?? ''), 'base64').toString() === '# Demo\nhello';
+    })),
+  done('github.repos.traffic', 'repos', 'Repos: traffic (views/clones/referrers/paths)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // traffic on a missing repo → 404; on a real repo → vendor-shaped zero-history payloads
+      // (per-account traffic is not observable offline — honestly empty, never fabricated).
+      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root }).status !== 404) return false;
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      const views = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root });
+      if (!(ok(views.status) && (views.body as { count?: number }).count === 0 && isArr((views.body as { views?: unknown[] }).views))) return false;
+      const clones = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/clones`, root });
+      if (!(ok(clones.status) && isArr((clones.body as { clones?: unknown[] }).clones))) return false;
+      const refs = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/referrers`, root });
+      const paths = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/paths`, root });
+      return ok(refs.status) && isArr(refs.body) && ok(paths.status) && isArr(paths.body);
+    })),
+  done('github.repos.deploy_keys', 'repos', 'Repos: deploy keys CRUD', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      // missing key 422s; create → 201; get/list; delete → 404.
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/keys`, body: JSON.stringify({ title: 'ci' }), root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/keys`, body: JSON.stringify({ title: 'deploy', key: 'ssh-ed25519 AAAA', read_only: false }), root });
+      if (!(c.response.status === 201 && (c.response.body as { read_only?: boolean }).read_only === false)) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root });
+      if (!(ok(one.status) && (one.body as { title?: string }).title === 'deploy')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/keys/${id}`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root }).status === 404;
+    })),
+  done('github.repos.autolinks', 'repos', 'Repos: autolink references CRUD', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/autolinks`, body: JSON.stringify({ key_prefix: 'TICKET-' }), root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/autolinks`, body: JSON.stringify({ key_prefix: 'TICKET-', url_template: 'https://jira/<num>', is_alphanumeric: false }), root });
+      if (!(c.response.status === 201 && (c.response.body as { is_alphanumeric?: boolean }).is_alphanumeric === false)) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root });
+      if (!(ok(one.status) && (one.body as { key_prefix?: string }).key_prefix === 'TICKET-')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/autolinks/${id}`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root }).status === 404;
+    })),
+  done('github.repos.tarball', 'repos', 'Repos: tar/zipball archive download', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // archive of a missing repo → 404; a real repo → 302 redirect to codeload (bytes out of scope).
+      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root }).status !== 404) return false;
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', default_branch: 'main' }), root });
+      const tar = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root });
+      if (!(tar.status === 302 && String((tar.body as { location?: string }).location).includes('legacy.tar.gz'))) return false;
+      const zip = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/zipball/v1.0.0`, root });
+      return zip.status === 302 && String((zip.body as { location?: string }).location).includes('legacy.zip/v1.0.0');
+    })),
+  done('github.repos.rulesets', 'repos', 'Repos: rulesets (the newer branch/tag rule engine)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/rulesets`, body: JSON.stringify({ target: 'branch' }), root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/rulesets`, body: JSON.stringify({ name: 'main-protection', target: 'branch', enforcement: 'active', rules: [{ type: 'pull_request' }] }), root });
+      if (!(c.response.status === 201 && (c.response.body as { enforcement?: string }).enforcement === 'active' && ((c.response.body as { rules?: unknown[] }).rules?.length === 1))) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/rulesets/${id}`, body: JSON.stringify({ enforcement: 'disabled' }), root });
+      if (!(ok(upd.response.status) && (upd.response.body as { enforcement?: string }).enforcement === 'disabled')) return false;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root });
+      if (!(ok(one.status) && (one.body as { name?: string }).name === 'main-protection')) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/rulesets/${id}`, root });
+      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root }).status === 404;
+    })),
+
+  // ── Deployments / Environments ───────────────────────────────────────────────────────────
+  done('github.deployments.crud', 'deployments', 'Deployments: create/list + deployment statuses', 'api', 'common', () =>
+    withRoot(async (root) => {
+      // create → 201 with id + environment; missing ref → 422.
+      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments`, body: '{}', root });
+      if (bad.response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments`, body: JSON.stringify({ ref: 'main', environment: 'production', description: 'deploy' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { environment?: string }).environment === 'production')) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      // get one + list (newest-first) + ?environment filter.
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}`, root });
+      if (!(ok(one.status) && (one.body as { id?: number }).id === id)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const filtered = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments?environment=staging`, root });
+      if (!(isArr(filtered.body) && filtered.body.length === 0)) return false;
+      // statuses: invalid state → 422; status on a missing deployment → 404.
+      const badState = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'nope' }), root });
+      if (badState.response.status !== 422) return false;
+      const noDep = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/999/statuses`, body: JSON.stringify({ state: 'success' }), root });
+      if (noDep.response.status !== 404) return false;
+      const s1 = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'in_progress' }), root });
+      const s2 = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'success', environment_url: 'https://app.x' }), root });
+      if (!(s1.response.status === 201 && s2.response.status === 201)) return false;
+      const statuses = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}/statuses`, root });
+      // newest-first → the latest (success) leads.
+      return ok(statuses.status) && isArr(statuses.body) && statuses.body.length === 2 && (statuses.body[0] as { state?: string }).state === 'success';
+    })),
+  done('github.environments.crud', 'deployments', 'Environments: CRUD + protection rules', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // create-or-update (PUT) → 200 with the env + protection rules from wait_timer/reviewers.
+      const c = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/environments/production`, body: JSON.stringify({ wait_timer: 30, reviewers: [{ type: 'User', reviewer: { login: 'alice', type: 'User' } }] }), root });
+      if (!(c.response.status === 200 && (c.response.body as { name?: string }).name === 'production')) return false;
+      const rules = (c.response.body as { protection_rules?: Array<{ type?: string }> }).protection_rules ?? [];
+      if (!(rules.some((r) => r.type === 'wait_timer') && rules.some((r) => r.type === 'required_reviewers'))) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
+      if (!(ok(get.status) && ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/environments/production`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
+      return del.response.status === 204 && gone.status === 404;
+    })),
+
+  // ── User account (the authenticated user) ────────────────────────────────────────────────
+  done('github.user.emails', 'users', 'User: emails (list/add/delete) + visibility', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // empty add 422s; first add becomes primary+public; second is private; public_emails filters;
+      // delete removes one.
+      if ((await applyGithubWrite({ method: 'POST', path: `/user/emails`, body: '{}', root })).response.status !== 422) return false;
+      const a1 = await applyGithubWrite({ method: 'POST', path: `/user/emails`, body: JSON.stringify({ emails: ['me@x.io'] }), root });
+      if (!(a1.response.status === 201 && isArr(a1.response.body) && (a1.response.body[0] as { primary?: boolean }).primary === true)) return false;
+      await applyGithubWrite({ method: 'POST', path: `/user/emails`, body: JSON.stringify({ emails: ['alt@x.io'] }), root });
+      const list = handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
+      const pub = handleGithubRequest({ method: 'GET', path: `/user/public_emails`, root });
+      if (!(ok(pub.status) && isArr(pub.body) && pub.body.length === 1 && (pub.body[0] as { email?: string }).email === 'me@x.io')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/user/emails`, body: JSON.stringify({ emails: ['alt@x.io'] }), root });
+      const after = handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
+    })),
+  done('github.user.keys', 'users', 'User: SSH + GPG keys CRUD', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // SSH: missing key 422s; create → 201; get/list; delete → 404. GPG: armored key required.
+      if ((await applyGithubWrite({ method: 'POST', path: `/user/keys`, body: JSON.stringify({ title: 'x' }), root })).response.status !== 422) return false;
+      const ssh = await applyGithubWrite({ method: 'POST', path: `/user/keys`, body: JSON.stringify({ title: 'laptop', key: 'ssh-ed25519 AAAA' }), root });
+      if (!(ssh.response.status === 201 && (ssh.response.body as { title?: string }).title === 'laptop')) return false;
+      const sid = (ssh.response.body as { id?: number }).id!;
+      if (!(ok(handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root }).status))) return false;
+      const sshList = handleGithubRequest({ method: 'GET', path: `/user/keys`, root });
+      if (!(isArr(sshList.body) && sshList.body.length === 1)) return false;
+      const sdel = await applyGithubWrite({ method: 'DELETE', path: `/user/keys/${sid}`, root });
+      if (!(sdel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root }).status === 404)) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: `/user/gpg_keys`, body: '{}', root })).response.status !== 422) return false;
+      const gpg = await applyGithubWrite({ method: 'POST', path: `/user/gpg_keys`, body: JSON.stringify({ armored_public_key: '-----BEGIN PGP-----\nabc\n-----END PGP-----' }), root });
+      if (!(gpg.response.status === 201 && typeof (gpg.response.body as { key_id?: string }).key_id === 'string')) return false;
+      const gid = (gpg.response.body as { id?: number }).id!;
+      const gpgList = handleGithubRequest({ method: 'GET', path: `/user/gpg_keys`, root });
+      if (!(isArr(gpgList.body) && gpgList.body.length === 1)) return false;
+      const gdel = await applyGithubWrite({ method: 'DELETE', path: `/user/gpg_keys/${gid}`, root });
+      return gdel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/gpg_keys/${gid}`, root }).status === 404;
+    })),
+  done('github.user.update', 'users', 'User: PATCH /user (update authenticated profile)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const r = await applyGithubWrite({ method: 'PATCH', path: `/user`, body: JSON.stringify({ name: 'Octo Cat', bio: 'builder', company: '@octo' }), root });
+      if (!(ok(r.response.status) && (r.response.body as { name?: string }).name === 'Octo Cat' && (r.response.body as { bio?: string }).bio === 'builder')) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/user`, root });
+      return ok(get.status) && (get.body as { name?: string }).name === 'Octo Cat' && (get.body as { company?: string }).company === '@octo' && (get.body as { login?: string }).login === 'octocat';
+    })),
+  done('github.user.blocking', 'users', 'User: block/unblock users', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // not blocked → check 404; block → 204; appears in list + check 204; unblock → check 404.
+      if (handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status !== 404) return false;
+      const b = await applyGithubWrite({ method: 'PUT', path: `/user/blocks/spammer`, body: '{}', root });
+      if (b.response.status !== 204) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status !== 204) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/user/blocks`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { login?: string }).login === 'spammer')) return false;
+      const u = await applyGithubWrite({ method: 'DELETE', path: `/user/blocks/spammer`, root });
+      return u.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status === 404;
+    })),
+
+  // ── Issues (remaining surface) ───────────────────────────────────────────────────────────
+  done('github.issues.events', 'issues', 'Issues: events list (the typed issue-events endpoint)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'ev' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], state: 'closed', state_reason: 'completed' }), root });
+      // per-issue typed events carry numeric ids; repo-wide list aggregates them; get-by-id works.
+      const perIssue = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/events`, root });
+      if (!(ok(perIssue.status) && isArr(perIssue.body) && perIssue.body.length >= 3)) return false;
+      const repoWide = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events`, root });
+      if (!(ok(repoWide.status) && isArr(repoWide.body) && repoWide.body.length >= 3 && (repoWide.body[0] as { issue?: { number?: number } }).issue?.number === 1)) return false;
+      const eid = (perIssue.body[0] as { id?: number }).id!;
+      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/${eid}`, root });
+      if (!(ok(one.status) && (one.body as { id?: number }).id === eid && typeof (one.body as { event?: string }).event === 'string')) return false;
+      return handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/999999`, root }).status === 404;
+    })),
+  done('github.issues.assignees_check', 'issues', 'Issues: assignable users list + check', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'push' }), root });
+      // an assignable collaborator → check 204; a non-collaborator → 404; the list includes alice.
+      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/alice`, root }).status !== 204) return false;
+      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/nobody`, root }).status !== 404) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees`, root });
+      return ok(list.status) && isArr(list.body) && list.body.some((u) => (u as { login?: string }).login === 'alice');
+    })),
+
+  // ── Pulls (remaining surface) ────────────────────────────────────────────────────────────
+  done('github.pulls.review_comment_reactions', 'pulls', 'PRs: reactions on review comments', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main' }), root });
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 1, side: 'RIGHT' }), root });
+      const cid = (cm.response.body as { id?: number }).id!;
+      // invalid content 422s; a valid reaction on the REVIEW comment → 201 and lists; delete → gone.
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, body: JSON.stringify({ content: 'nope' }), root })).response.status !== 422) return false;
+      const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, body: JSON.stringify({ content: 'rocket' }), root });
+      if (r.response.status !== 201) return false;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { content?: string }).content === 'rocket')) return false;
+      const rid = (r.response.body as { id?: number }).id!;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pulls/comments/${cid}/reactions/${rid}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
+      return del.response.status === 204 && isArr(after.body) && after.body.length === 0;
+    })),
+  done('github.pulls.review_dismiss', 'pulls', 'PRs: dismiss a review + update a review body', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'r', head: 'a', base: 'main' }), root });
+      const sub = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event: 'CHANGES_REQUESTED', body: 'please fix' }), root });
+      const rid = (sub.response.body as { id?: number }).id!;
+      // dismiss requires a message (422 without); after dismiss the review reads back DISMISSED.
+      if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}/dismissals`, body: '{}', root })).response.status !== 422) return false;
+      const dm = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}/dismissals`, body: JSON.stringify({ message: 'stale' }), root });
+      if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'DISMISSED' && dm.webhook?.action === 'dismissed')) return false;
+      const listed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      if (!(ok(listed.status) && isArr(listed.body) && (listed.body[0] as { state?: string }).state === 'DISMISSED')) return false;
+      // update the review body (PUT .../reviews/:rid); 422 without a body; read-back reflects it.
+      if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}`, body: '{}', root })).response.status !== 422) return false;
+      const up = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}`, body: JSON.stringify({ body: 'edited note' }), root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      // a dismiss on an unknown review id 404s.
+      const missing = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/9999/dismissals`, body: JSON.stringify({ message: 'x' }), root });
+      return ok(up.response.status) && (after.body as Array<{ body?: string }>)[0]?.body === 'edited note' && missing.response.status === 404;
+    })),
+
+  // ── Packages / Pages ─────────────────────────────────────────────────────────────────────
+  done('github.packages.list', 'packages', 'Packages: list/get/delete versions', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // seed a package + two versions, list/get, delete one version then the package.
+      const c = await applyGithubWrite({ method: 'POST', path: '/user/packages/npm/my-lib', body: JSON.stringify({ visibility: 'public', versions: ['1.0.0', '1.1.0'] }), root });
+      if (!(c.response.status === 201 && (c.response.body as { version_count?: number }).version_count === 2)) return false;
+      const list = handleGithubRequest({ method: 'GET', path: '/user/packages?package_type=npm', root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { name?: string }).name === 'my-lib')) return false;
+      const versions = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
+      if (!(ok(versions.status) && isArr(versions.body) && versions.body.length === 2)) return false;
+      const vid = (versions.body as Array<{ id?: number }>)[0]!.id!;
+      const one = handleGithubRequest({ method: 'GET', path: `/user/packages/npm/my-lib/versions/${vid}`, root });
+      if (!(ok(one.status) && (one.body as { id?: number }).id === vid)) return false;
+      const delV = await applyGithubWrite({ method: 'DELETE', path: `/user/packages/npm/my-lib/versions/${vid}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
+      if (!(delV.response.status === 204 && isArr(after.body) && after.body.length === 1)) return false;
+      const delP = await applyGithubWrite({ method: 'DELETE', path: '/user/packages/npm/my-lib', root });
+      const gone = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib', root });
+      // a delete of an unknown package 404s.
+      const missing = await applyGithubWrite({ method: 'DELETE', path: '/user/packages/npm/nope', root });
+      return delP.response.status === 204 && gone.status === 404 && missing.response.status === 404;
+    })),
+  done('github.pages.get', 'pages', 'Pages: site config + builds', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // no site → 404; create (POST) → 201 building; update source (PUT) → 204; request a build.
+      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root }).status !== 404) return false;
+      const create = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages`, body: JSON.stringify({ source: { branch: 'gh-pages', path: '/' } }), root });
+      if (!(create.response.status === 201 && (create.response.body as { source?: { branch?: string } }).source?.branch === 'gh-pages')) return false;
+      // creating twice 409s.
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages`, body: '{}', root })).response.status !== 409) return false;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pages`, body: JSON.stringify({ cname: 'docs.example.com', source: { branch: 'main', path: '/docs' } }), root });
+      if (upd.response.status !== 204) return false;
+      const site = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
+      if (!(ok(site.status) && (site.body as { cname?: string }).cname === 'docs.example.com' && (site.body as { source?: { path?: string } }).source?.path === '/docs')) return false;
+      const build = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages/builds`, body: '{}', root });
+      if (build.response.status !== 202) return false;
+      const builds = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds`, root });
+      const latest = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds/latest`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pages`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
+      return ok(builds.status) && isArr(builds.body) && builds.body.length === 1 && ok(latest.status) && (latest.body as { status?: string }).status === 'built' && del.response.status === 204 && gone.status === 404;
+    })),
+  done('github.codespaces.crud', 'codespaces', 'Codespaces: list/create/start/stop/delete', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // create requires a repo (422 without); create → 201 Available; stop → Shutdown; start →
+      // Available; delete → 202 then gone. (The VM COMPUTE is out-of-scope; the RESOURCE
+      // lifecycle/state machine IS modeled and verified here.)
+      if ((await applyGithubWrite({ method: 'POST', path: '/user/codespaces', body: '{}', root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: '/user/codespaces', body: JSON.stringify({ repository: REPO, machine: 'standardLinux32gb', ref: 'feature' }), root });
+      if (!(c.response.status === 201 && (c.response.body as { state?: string }).state === 'Available')) return false;
+      const name = (c.response.body as { name?: string }).name!;
+      const list = handleGithubRequest({ method: 'GET', path: '/user/codespaces', root });
+      if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
+      const stop = await applyGithubWrite({ method: 'POST', path: `/user/codespaces/${name}/stop`, body: '{}', root });
+      if (!(ok(stop.response.status) && (stop.response.body as { state?: string }).state === 'Shutdown')) return false;
+      const start = await applyGithubWrite({ method: 'POST', path: `/user/codespaces/${name}/start`, body: '{}', root });
+      if (!(ok(start.response.status) && (start.response.body as { state?: string }).state === 'Available')) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
+      if (!(ok(get.status) && (get.body as { git_status?: { ref?: string } }).git_status?.ref === 'feature')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/user/codespaces/${name}`, root });
+      const gone = handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
+      return del.response.status === 202 && gone.status === 404;
+    })),
+
+  // ── Security (code scanning / dependabot / secret scanning) ──────────────────────────────
+  // The alert RESOURCES + their state machines (open→dismissed/fixed/resolved) are modeled as
+  // kernel-folded CRUD + state transitions; the actual SCAN that generates them is infra the
+  // offline twin can't run (a simulator seeds the alert objects, like the rest of the twin).
+  done('github.security.code_scanning', 'security', 'Code scanning: alerts + analyses', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/code-scanning/alerts`, body: JSON.stringify({ rule_id: 'js/sql-injection', rule_severity: 'error' }), root });
+      if (!(a.response.status === 201 && (a.response.body as { number?: number }).number === 1 && (a.response.body as { state?: string }).state === 'open')) return false;
+      const n = (a.response.body as { number?: number }).number!;
+      // dismiss requires a valid reason (422 without / invalid); dismissing reads back dismissed.
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'bogus' }), root })).response.status !== 422) return false;
+      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'false positive' }), root });
+      if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'dismissed' && (dm.response.body as { dismissed_reason?: string }).dismissed_reason === 'false positive')) return false;
+      // filter by state; the dismissed alert is excluded from ?state=open.
+      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/alerts?state=open`, root });
+      if (!(ok(open.status) && isArr(open.body) && open.body.length === 0)) return false;
+      // analyses: create → list → delete.
+      const an = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/code-scanning/analyses`, body: JSON.stringify({ ref: 'refs/heads/main', results_count: 3, rules_count: 50 }), root });
+      if (!(an.response.status === 201 && (an.response.body as { results_count?: number }).results_count === 3)) return false;
+      const aid = (an.response.body as { id?: number }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/analyses`, root });
+      const delA = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/code-scanning/analyses/${aid}`, root });
+      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/analyses`, root });
+      // an unknown alert PATCH 404s.
+      const missing = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/999`, body: JSON.stringify({ state: 'open' }), root });
+      return ok(list.status) && isArr(list.body) && list.body.length === 1 && delA.response.status === 200 && isArr(after.body) && after.body.length === 0 && missing.response.status === 404;
+    })),
+  done('github.security.dependabot', 'security', 'Dependabot: alerts + security updates', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/dependabot/alerts`, body: JSON.stringify({ package_name: 'lodash', ecosystem: 'npm', severity: 'critical', ghsa_id: 'GHSA-x' }), root });
+      if (!(a.response.status === 201 && (a.response.body as { state?: string }).state === 'open' && (a.response.body as { security_advisory?: { ghsa_id?: string } }).security_advisory?.ghsa_id === 'GHSA-x')) return false;
+      const n = (a.response.body as { number?: number }).number!;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
+      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'tolerable_risk' }), root });
+      if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'dismissed')) return false;
+      // reopen → state open + dismissal cleared.
+      const re = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'open' }), root });
+      if (!(ok(re.response.status) && (re.response.body as { state?: string }).state === 'open' && (re.response.body as { dismissed_reason?: unknown }).dismissed_reason === null)) return false;
+      const dismissed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/dependabot/alerts?state=dismissed`, root });
+      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/dependabot/alerts/${n}`, root });
+      return ok(dismissed.status) && isArr(dismissed.body) && dismissed.body.length === 0 && ok(get.status) && (get.body as { severity?: unknown; security_vulnerability?: { severity?: string } }).security_vulnerability?.severity === 'critical';
+    })),
+  done('github.security.secret_scanning', 'security', 'Secret scanning: alerts', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/secret-scanning/alerts`, body: JSON.stringify({ secret_type: 'github_pat' }), root });
+      if (!(a.response.status === 201 && (a.response.body as { state?: string }).state === 'open')) return false;
+      const n = (a.response.body as { number?: number }).number!;
+      // resolving requires a valid resolution (422 without/invalid); resolved reads back resolved.
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'bogus' }), root })).response.status !== 422) return false;
+      const rs = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'revoked' }), root });
+      if (!(ok(rs.response.status) && (rs.response.body as { state?: string }).state === 'resolved' && (rs.response.body as { resolution?: string }).resolution === 'revoked')) return false;
+      const locs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/secret-scanning/alerts/${n}/locations`, root });
+      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/secret-scanning/alerts?state=open`, root });
+      return ok(locs.status) && isArr(locs.body) && locs.body.length === 1 && ok(open.status) && isArr(open.body) && open.body.length === 0;
+    })),
+
+  // ── GraphQL / Apps / OAuth ───────────────────────────────────────────────────────────────
+  done('github.graphql.api', 'api', 'GraphQL API (v4) — faithful SUBSET (viewer/repository/node + addComment) over the same projection; unmodeled fields error honestly', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const gql = (query: string, variables?: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root });
+      // seed a repo + PR + issue via REST, then read them back through GraphQL (SAME projection).
+      await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo', private: true }), root });
+      await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/pulls', body: JSON.stringify({ title: 'Add X', head: 'a', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/issues', body: JSON.stringify({ title: 'A bug' }), root });
+      // viewer
+      const v = await gql('query { viewer { login name } }');
+      if ((v.response.body as any).data?.viewer?.login !== 'octocat') return false;
+      // repository(owner,name){ pullRequests/issues totalCount+nodes } — reflects seeded state.
+      const r = await gql('query($o:String!,$n:String!){ repository(owner:$o,name:$n){ nameWithOwner isPrivate pullRequests(first:10){ totalCount nodes { number title state } } issues(first:10){ totalCount nodes { number title } } } }', { o: 'octo', n: 'demo' });
+      const repo = (r.response.body as any).data?.repository;
+      if (!(repo?.nameWithOwner === 'octo/demo' && repo.isPrivate === true && repo.pullRequests.totalCount === 1 && repo.pullRequests.nodes[0].title === 'Add X' && repo.pullRequests.nodes[0].state === 'OPEN' && repo.issues.totalCount === 1)) return false;
+      // node(id) by global id
+      const n = await gql('query($id:ID!){ node(id:$id){ ... on PullRequest { number title } } }', { id: 'PR_octo/demo#1' });
+      if ((n.response.body as any).data?.node?.number !== 1) return false;
+      // addComment mutation maps onto the SAME write path the REST twin uses; the comment then
+      // appears in the REST issue-comments list (consistency across surfaces).
+      const mut = await gql('mutation($s:ID!,$b:String!){ addComment(input:{subjectId:$s,body:$b}){ commentEdge { node { id body } } } }', { s: 'I_octo/demo#2', b: 'from graphql' });
+      if ((mut.response.body as any).data?.addComment?.commentEdge?.node?.body !== 'from graphql') return false;
+      const restComments = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/issues/2/comments', root });
+      if (!(ok(restComments.status) && isArr(restComments.body) && restComments.body.length === 1 && (restComments.body[0] as { body?: string }).body === 'from graphql')) return false;
+      // HONESTY: an UNMODELED field raises a typed GraphQL error (not a fabricated value).
+      const bad = await gql('query { repository(owner:"octo",name:"demo"){ stargazerCount } }');
+      const errs = (bad.response.body as any).errors;
+      if (!(Array.isArray(errs) && errs.length && errs[0].type === 'undefinedField')) return false;
+      // an unknown node id resolves to a NOT_FOUND error (honest).
+      const nf = await gql('query { node(id:"PR_octo/demo#999"){ ... on PullRequest { number } } }');
+      return (nf.response.body as any).errors?.[0]?.type === 'NOT_FOUND';
+    })),
+  done('github.graphql.repository_info', 'api', 'GraphQL RepositoryInfo (the repo fragment gh CLI sends: id/owner/defaultBranchRef/viewerPermission/merge flags), incl. object-arg parsing', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const gql = (query: string, variables?: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root });
+      await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo', description: 'd' }), root });
+      // The exact RepositoryInfo shape gh pr create sends: a `repo` fragment spread + parent + merge
+      // flags. Asserts the gh-CLI fields resolve from the SAME repo projection REST serves.
+      const q = `fragment repo on Repository { id name owner { login } hasIssuesEnabled description hasWikiEnabled viewerPermission defaultBranchRef { name } }
+        query RepositoryInfo($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { ...repo parent { ...repo } mergeCommitAllowed rebaseMergeAllowed squashMergeAllowed } }`;
+      const r = (await gql(q, { owner: 'octo', name: 'demo' })).response.body as any;
+      const repo = r.data?.repository;
+      if (!(repo?.id === 'R_octo/demo' && repo.owner?.login === 'octo' && repo.defaultBranchRef?.name === 'main'
+        && repo.viewerPermission === 'ADMIN' && repo.squashMergeAllowed === true && repo.parent === null)) return false;
+      // Object args (orderBy:{field:…}) must not be mis-parsed as a selection set — pullRequests
+      // with an orderBy object resolves rather than erroring on a phantom `field`.
+      const pq = `query($o:String!,$n:String!){ repository(owner:$o,name:$n){ pullRequests(first:30, orderBy:{ field: CREATED_AT, direction: DESC }){ totalCount nodes { number } } } }`;
+      const p = (await gql(pq, { o: 'octo', n: 'demo' })).response.body as any;
+      return p.data?.repository?.pullRequests?.totalCount === 0 && !p.errors;
+    })),
+  done('github.graphql.create_pull_request', 'api', 'GraphQL createPullRequest mutation + pullRequests(headRefName,states) connection (gh pr create/view/list)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const gql = (query: string, variables?: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root });
+      await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo' }), root });
+      await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/git/refs', body: JSON.stringify({ ref: 'refs/heads/feat', sha: 'a'.repeat(40) }), root });
+      // createPullRequest maps onto the SAME REST create path; returns the new PR node id+url.
+      const mutation = 'mutation($input: CreatePullRequestInput!){ createPullRequest(input:$input){ pullRequest { id url } } }';
+      const m = (await gql(mutation, { input: { repositoryId: 'R_octo/demo', baseRefName: 'main', headRefName: 'feat', title: 'Add X', body: 'B', draft: false } })).response.body as any;
+      if (m.data?.createPullRequest?.pullRequest?.id !== 'PR_octo/demo#1') return false;
+      // the PR is now real on the REST surface too (cross-surface consistency).
+      const rest = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/pulls/1', root });
+      if (!(ok(rest.status) && (rest.body as any).head?.ref === 'feat')) return false;
+      // pullRequests(headRefName, states) filters: matching branch returns the node; a miss is empty.
+      const byBranch = 'query($o:String!,$n:String!,$h:String!,$s:[PullRequestState!]){ repository(owner:$o,name:$n){ pullRequests(headRefName:$h, states:$s, first:30, orderBy:{field:CREATED_AT,direction:DESC}){ totalCount nodes { number headRefName baseRefName url state } pageInfo { hasNextPage } } } }';
+      const hit = (await gql(byBranch, { o: 'octo', n: 'demo', h: 'feat', s: ['OPEN'] })).response.body as any;
+      const node = hit.data?.repository?.pullRequests?.nodes?.[0];
+      if (!(hit.data?.repository?.pullRequests?.totalCount === 1 && node?.headRefName === 'feat' && node?.baseRefName === 'main' && node?.number === 1)) return false;
+      const miss = (await gql(byBranch, { o: 'octo', n: 'demo', h: 'nope', s: ['OPEN'] })).response.body as any;
+      return miss.data?.repository?.pullRequests?.totalCount === 0 && !miss.errors;
+    })),
+  done('github.apps.installations', 'api', 'GitHub Apps: installations + installation tokens', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // seed an installation (twin construct — real installs can't be observed offline), list,
+      // get one, then mint an installation access token bound to its permissions.
+      const inst = await applyGithubWrite({ method: 'POST', path: '/app/installations', body: JSON.stringify({ account_login: 'octo-org', app_id: 7, app_slug: 'ci-bot', permissions: { contents: 'read', issues: 'write' }, events: ['push'] }), root });
+      if (!(inst.response.status === 201 && (inst.response.body as { account?: { login?: string } }).account?.login === 'octo-org')) return false;
+      const id = (inst.response.body as { id?: number }).id!;
+      const list = handleGithubRequest({ method: 'GET', path: '/app/installations', root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      const get = handleGithubRequest({ method: 'GET', path: `/app/installations/${id}`, root });
+      if (!(ok(get.status) && (get.body as { app_slug?: string }).app_slug === 'ci-bot')) return false;
+      const tok = await applyGithubWrite({ method: 'POST', path: `/app/installations/${id}/access_tokens`, body: JSON.stringify({ permissions: { contents: 'read' } }), root });
+      if (!(tok.response.status === 201 && typeof (tok.response.body as { token?: string }).token === 'string' && (tok.response.body as { token?: string }).token!.startsWith('ghs_') && (tok.response.body as { permissions?: { contents?: string } }).permissions?.contents === 'read')) return false;
+      // a token for an unknown installation 404s.
+      const missing = await applyGithubWrite({ method: 'POST', path: '/app/installations/9999/access_tokens', body: '{}', root });
+      return missing.response.status === 404;
+    })),
+  done('github.oauth.flow', 'auth', 'OAuth app authorization + token scopes', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // The API half of the OAuth flow: exchange a code for a token bound to scopes, then a
+      // scope-gated call returns 401 (no token), 403 (missing scope), 200 (has scope); revoke.
+      // The hosted CONSENT SCREEN (a browser UI, not an API) is out-of-scope (carved below).
+      if ((await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid' }), root })).response.status !== 422) return false;
+      const ex = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid', code: 'abc', scope: 'repo read:org' }), root });
+      if (!(ok(ex.response.status) && (ex.response.body as { token_type?: string }).token_type === 'bearer' && (ex.response.body as { scope?: string }).scope === 'repo,read:org')) return false;
+      const token = (ex.response.body as { access_token?: string }).access_token!;
+      // no token → 401; valid token lacking scope → 403; with scope → 200.
+      if ((await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token: 'bad', required_scope: 'repo' }), root })).response.status !== 401) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token, required_scope: 'admin:org' }), root })).response.status !== 403) return false;
+      const okCall = await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token, required_scope: 'repo' }), root });
+      if (!(ok(okCall.response.status) && (okCall.response.body as { ok?: boolean }).ok === true)) return false;
+      // revoke the token → a subsequent gated call 401s.
+      const rev = await applyGithubWrite({ method: 'DELETE', path: '/applications/token', body: JSON.stringify({ access_token: token }), root });
+      const afterRevoke = await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token, required_scope: 'repo' }), root });
+      return rev.response.status === 204 && afterRevoke.response.status === 401;
+    })),
+
+  // ── Next honest gaps (top-down GitHub surface NOT yet modeled — keeps the denominator
+  //    honest; a high % against a thin list would be misleading). Each is a real product
+  //    area still to close in a future cycle. ─────────────────────────────────────────────────
+  todo('github.graphql.connections', 'api', 'GraphQL: cursor pagination (pageInfo/edges + after) on connections', 'api', 'niche'),
+  todo('github.graphql.search', 'api', 'GraphQL: the search() connection (typed SearchResultItem nodes)', 'api', 'niche'),
+  todo('github.security.advisories', 'security', 'Repository security advisories (GHSA drafts + CVE request + credits)', 'api', 'niche'),
+  todo('github.dependency_graph.sbom', 'security', 'Dependency graph: SBOM export + dependency review (compare base...head)', 'api', 'niche'),
+  todo('github.codespaces.machines_secrets', 'codespaces', 'Codespaces: machine types + user secrets + repo defaults', 'api', 'niche'),
+  todo('github.pages.deployments', 'pages', 'Pages: build-type:workflow deployments (create/cancel/status)', 'api', 'niche'),
+  todo('github.activity.starring_feed', 'activity', 'Activity: per-user public timeline ATOM feed + organization feed', 'api', 'niche'),
+  todo('github.apps.webhook_config', 'api', 'GitHub Apps: app webhook config + deliveries + manifest conversion', 'api', 'niche'),
+
+  // ── Webhooks (event delivery) ────────────────────────────────────────────────────────────
+  done('github.webhooks.core_events', 'webhooks', 'Webhooks: core write events (pull_request/issues/comment/review)', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'w', head: 'a', base: 'main' }), root });
+      const b = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'w' }), root });
+      return a.webhook?.event === 'pull_request' && a.webhook.action === 'opened' && b.webhook?.event === 'issues' && b.webhook.action === 'opened';
+    })),
+  done('github.webhooks.full_events', 'webhooks', 'Webhooks: full event-type coverage (push/release/check_run/workflow_run/…)', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      // Writes across many resources each emit the matching webhook envelope (event+action),
+      // mirroring the spread of events real GitHub fires beyond the PR/issue core.
+      const checks: Array<[string, string]> = [];
+      const rel = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v1' }), root });
+      checks.push([rel.webhook?.event ?? '', rel.webhook?.action ?? '']);
+      const repo = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'wh' }), root });
+      checks.push([repo.webhook?.event ?? '', repo.webhook?.action ?? '']);
+      const fork = await applyGithubWrite({ method: 'POST', path: `/repos/octo/wh/forks`, body: JSON.stringify({ organization: 'me' }), root });
+      checks.push([fork.webhook?.event ?? '', fork.webhook?.action ?? '']);
+      const mem = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/bob`, body: JSON.stringify({ permission: 'push' }), root });
+      checks.push([mem.webhook?.event ?? '', mem.webhook?.action ?? '']);
+      const push = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/f.txt`, body: JSON.stringify({ message: 'm', content: 'eA==' }), root });
+      checks.push([push.webhook?.event ?? '', '']);
+      const expected: Record<string, string> = { release: 'published', repository: 'created', fork: 'created', member: 'added', push: '' };
+      return checks.every(([e, a]) => e in expected && (expected[e] === '' || expected[e] === a)) && new Set(checks.map((c) => c[0])).size === 5;
+    })),
+  done('github.webhooks.delivery', 'webhooks', 'Webhooks: deliveries log + redelivery + signatures', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const { clearGithubWebhooks, registerGithubWebhook, emitGithubEvent, listGithubDeliveries, redeliverGithubDelivery, signGithubPayload } = await import('./github-events.ts');
+      clearGithubWebhooks();
+      registerGithubWebhook('https://e.x/hook', 's3cr3t');
+      const captured: Array<{ headers: Record<string, string>; body: string }> = [];
+      const deliver = (_url: string, headerEvent: string, payload: unknown, headers: Record<string, string>) => { captured.push({ headers, body: JSON.stringify(payload) }); };
+      await emitGithubEvent({ event: 'pull_request', action: 'opened', repository: REPO, number: 1 }, { deliver });
+      // a delivery is logged with an id + signature; the signature verifies against the secret.
+      const deliveries = listGithubDeliveries();
+      if (deliveries.length !== 1) return false;
+      const d = deliveries[0]!;
+      if (d.event !== 'pull_request' || typeof d.id !== 'string') return false;
+      const expectedSig = signGithubPayload('s3cr3t', d.payloadJson);
+      if (captured[0]?.headers['x-hub-signature-256'] !== expectedSig) return false;
+      // redelivery replays the SAME payload to the endpoint (a second captured delivery).
+      const re = await redeliverGithubDelivery(d.id, { deliver });
+      clearGithubWebhooks();
+      return re === true && captured.length === 2 && captured[1]!.body === captured[0]!.body;
+    })),
+
+  // ── Connector (pull/push) ────────────────────────────────────────────────────────────────
+  done('github.connector.pull', 'connector', 'Connector: pull full repo graph (PRs/issues/checks/actions)', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const { syncGithubFromReal } = await import('./github-connector.ts');
+      // A fake octokit-like executor returns observed PRs + issues; the connector folds them
+      // into the twin offline (the SOLE credentialed boundary is the injected executor).
+      const execute = {
+        async request(route: string, params: Record<string, unknown> = {}) {
+          if (route === 'GET /repos/{owner}/{repo}/pulls') return { status: 200, data: [{ number: 5, title: 'Real title', body: 'Real body', state: 'open', base: { ref: 'main' }, head: { sha: 'deadbeef' }, changed_files: 7, commits: 3 }] };
+          if (route === 'GET /repos/{owner}/{repo}/issues') return { status: 200, data: [{ number: 9, title: 'Bug', body: 'broke', state: 'open' }] };
+          if (route.endsWith('/reviews') && route.startsWith('GET')) return { status: 200, data: [{ id: 1, state: 'APPROVED', body: 'LGTM' }] };
+          if (route.endsWith('/comments') && route.startsWith('GET')) return { status: 200, data: [] };
+          return { status: 404, data: { message: 'not found' } };
+        },
+      };
+      const res = await syncGithubFromReal(execute, { owner: 'octo', repo: 'demo', root, occurredAt: '2026-01-01T00:00:00Z' });
+      if (res.observed < 2 || res.issues !== 1) return false;
+      // Read the folded PR + issue back through the twin with their REAL content.
+      const pr = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/5`, root });
+      const iss = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/9`, root });
+      return ok(pr.status) && (pr.body as { title?: string }).title === 'Real title'
+        && ok(iss.status) && (iss.body as { title?: string }).title === 'Bug';
+    })),
+  done('github.connector.push', 'connector', 'Connector: push reconcile (apply desired-state writes)', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const { pushPendingGithubActions } = await import('./github-connector.ts');
+      // Author LOCAL writes in the twin (a PR + an issue), then push them to the real vendor
+      // via a fake executor — the connector maps each pending action to its REST call.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'push me', head: 'a', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'push issue' }), root });
+      const calls: string[] = [];
+      const execute = {
+        async request(route: string) {
+          calls.push(route);
+          if (route === 'POST /repos/{owner}/{repo}/pulls') return { status: 201, data: { number: 42 } };
+          if (route === 'POST /repos/{owner}/{repo}/issues') return { status: 201, data: { number: 77 } };
+          return { status: 201, data: { id: 1 } };
+        },
+      };
+      const res = await pushPendingGithubActions(execute, { root, occurredAt: '2026-01-02T00:00:00Z' });
+      return res.pushed >= 2 && calls.includes('POST /repos/{owner}/{repo}/pulls') && calls.includes('POST /repos/{owner}/{repo}/issues');
+    })),
+
+  // ── UI screens (the real GitHub web app) ─────────────────────────────────────────────────
+  // PR list table: seed a PR whose head resolves to a REAL branch tip + a commit status
+  // on that sha — the fetched row's ciStatus must reflect it (moves with real CI state).
+  done('github.ui.pr_table', 'ui', 'PR list table (per-repo, state/CI) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const sha = 'd'.repeat(40);
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/pt-probe', sha }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR Table Probe', head: 'pt-probe', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/statuses/${sha}`, body: JSON.stringify({ state: 'success', context: 'ci' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => (m.github as any).pullRequests.some((p: any) => p.title === 'PR Table Probe' && p.ciStatus === 'success'),
+  })),
+  // PR conversation: seed a review, a requested reviewer, and a diff-anchored review
+  // comment — assert all three counts/lists show up on the fetched PR.
+  done('github.ui.pr_conversation', 'ui', 'PR conversation/detail (reviews, comments, reviewers) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'Conversation Probe', head: 'convo', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event: 'APPROVE', body: 'lgtm' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/requested_reviewers`, body: JSON.stringify({ reviewers: ['carol'] }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 1, side: 'RIGHT' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const pr = (m.github as any).pullRequests.find((p: any) => p.title === 'Conversation Probe');
+      return !!pr && pr.reviewCount === 1 && pr.reviewCommentsCount === 1 && (pr.requestedReviewers as string[]).includes('carol');
+    },
+  })),
+  // Issues list: seed an issue with a distinct label + assignee — both must appear on
+  // the fetched row (the list's badges + assignee avatars are not static chrome).
+  done('github.ui.issues_view', 'ui', 'Issues list view (per-repo) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'Issues View Probe' }), root });
+      const n = (c.response.body as { number?: number }).number;
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/${n}`, body: JSON.stringify({ labels: ['triage'], assignees: ['dave'] }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const i = (m.github as any).issues.find((x: any) => x.title === 'Issues View Probe');
+      return !!i && (i.labels as Array<{ name: string }>).some((l) => l.name === 'triage') && (i.assignees as string[]).includes('dave');
+    },
+  })),
+  // Actions runs view: register a workflow + dispatch it (real run + job) — assert the
+  // fetched run's workflowName resolves + it carries the real jobCount.
+  done('github.ui.actions_view', 'ui', 'Actions runs view (runs + jobs + status badges) (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/probe.yml`, body: JSON.stringify({ name: 'Probe CI', path: '.github/workflows/probe.yml' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/probe.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => (m.github as any).runs.some((r: any) => r.workflowName === 'Probe CI' && r.jobCount === 1),
+  })),
+  // Repo chrome (tabs + per-repo counters): seed a PR + an issue in ONE repo — the
+  // "All repositories" pill total AND that repo's own tab count must both move with
+  // the seeded objects (proves the chrome's counts read real state, not a static shell).
+  done('github.ui.repo_chrome', 'ui', 'Repo chrome (tabs: Code/PRs/Issues/Actions/…) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'Chrome Probe PR', head: 'chrome', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'Chrome Probe Issue' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const g = m.github as any;
+      const repoPrs = g.pullRequests.filter((p: any) => p.repo === REPO);
+      return repoPrs.length === 1 && g.pullRequests.length === repoPrs.length && g.issues.some((i: any) => i.title === 'Chrome Probe Issue' && i.repo === REPO);
+    },
+  })),
+  // PR Files-changed diff: seed a file with a real unified-diff PATCH — assert the
+  // fetched file carries the exact seeded patch text (the diff hunk the view renders).
+  done('github.ui.pr_files_diff', 'ui', 'PR Files-changed diff view (rendered hunks) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: (root) => applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'Diff Probe', head: 'diffprobe', base: 'main', files: [{ filename: 'diff-probe.ts', additions: 2, deletions: 1, patch: '@@ -1,1 +1,2 @@\n-old\n+new\n+line2' }] }), root }),
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => (m.github as any).files.some((f: any) => f.filename === 'diff-probe.ts' && String(f.patch).includes('+new')),
+  })),
+  // Issue detail: seed a comment + a label/assignee/close (a REAL derived timeline) —
+  // assert the fetched issue's comments + timeline both carry the seeded activity.
+  done('github.ui.issue_detail', 'ui', 'Issue detail page (timeline + comments) (data-coupled)', 'ui', 'core', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'Detail Probe' }), root });
+      const n = (c.response.body as { number?: number }).number;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/${n}/comments`, body: JSON.stringify({ body: 'Issue detail probe comment' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/${n}`, body: JSON.stringify({ labels: ['bug'], state: 'closed', state_reason: 'completed' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const i = (m.github as any).issues.find((x: any) => x.title === 'Detail Probe');
+      return !!i && i.comments.some((c: any) => c.body === 'Issue detail probe comment') && (i.timeline as Array<{ event: string }>).some((t) => t.event === 'labeled') && (i.timeline as Array<{ event: string }>).some((t) => t.event === 'closed');
+    },
+  })),
+  // Projects v2 board (converged onto the SHARED tooling uiDataCoupled — was the local
+  // bundle-marker-grep + assert helper; the marker-grep half is dropped, the real
+  // data-coupled seed/assert half is kept verbatim): seed a project + a single-select
+  // Status field + two items, set each item's Status value, so the board's columns +
+  // card counts are driven by the modeled item state.
+  done('github.ui.project_board', 'ui', 'Projects v2 board view (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: '/orgs/octo/projectsV2', body: JSON.stringify({ title: 'Roadmap' }), root });
+      const pid = (c.response.body as { id?: number }).id!;
+      await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done' }] }), root });
+      await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
+      const i1 = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task A' }), root });
+      const i2 = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task B' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${(i1.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Todo' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${(i2.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Done' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const board = (m.github as any).projectBoards?.[0];
+      if (!board || board.itemCount !== 2 || board.columns.length !== 2) return false;
+      const todo = board.columns.find((c: any) => c.name === 'Todo');
+      const doneCol = board.columns.find((c: any) => c.name === 'Done');
+      // counts MOVE with the seeded items: exactly one card in each column, none unstatused.
+      return todo?.cards.length === 1 && todo.cards[0].title === 'Task A' && doneCol?.cards.length === 1 && doneCol.cards[0].title === 'Task B' && board.noStatus.cards.length === 0;
+    },
+  })),
+  // Discussions screen: seed a Q&A discussion + a comment marked as the accepted
+  // answer — assert the fetched discussion carries the answer flag + category.
+  done('github.ui.discussions', 'ui', 'Discussions screen (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'Discussion Probe', body: '?', category: 'q-a' }), root });
+      const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: JSON.stringify({ body: 'Discussion probe answer' }), root });
+      const cid = (cm.response.body as { id?: number }).id;
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/discussions/1/comments/${cid}/answer`, body: '{}', root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const d = (m.github as any).discussions.find((x: any) => x.title === 'Discussion Probe');
+      return !!d && d.categorySlug === 'q-a' && d.isAnswered === true && d.comments.some((c: any) => c.body === 'Discussion probe answer' && c.isAnswer === true);
+    },
+  })),
+  // Releases page: seed a release with a distinct asset — assert both the release's
+  // fields AND the asset catalog entry appear on the fetched row.
+  done('github.ui.releases', 'ui', 'Releases page (releases list + asset catalog) (data-coupled)', 'ui', 'common', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v-probe', name: 'Release Probe', body: 'notes' }), root });
+      const id = (r.response.body as { id?: number }).id;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases/${id}/assets`, body: JSON.stringify({ name: 'probe.zip', content_type: 'application/zip', size: 2048 }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const r = (m.github as any).releases.find((x: any) => x.tagName === 'v-probe');
+      return !!r && r.name === 'Release Probe' && r.assets.some((a: any) => a.name === 'probe.zip' && a.size === 2048);
+    },
+  })),
+  // Code/file browser: seed a real committed file at a distinct path — assert it
+  // appears in the fetched repo contents (the directory tree the browser renders).
+  done('github.ui.code_browser', 'ui', 'Code/file browser tree (data-coupled)', 'ui', 'common', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: (root) => applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/src/probe.ts`, body: JSON.stringify({ message: 'add probe file', content: Buffer.from('export const probe = 1;').toString('base64') }), root }),
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => (m.github as any).contents.some((c: any) => c.path === 'src/probe.ts' && c.repo === REPO),
+  })),
+  // Insights/Pulse/Contributors (converged onto the SHARED tooling uiDataCoupled — same
+  // note as project_board above): seed a merged PR (two commits by alice) + an open
+  // issue + a closed issue, so Pulse counts + the contributor leaderboard are derived
+  // from real objects.
+  done('github.ui.insights', 'ui', 'Insights/Pulse/Contributors (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'feat', head: 'a', base: 'main', commits: [{ sha: 'a'.repeat(40), message: 'c1', author_name: 'alice' }, { sha: 'b'.repeat(40), message: 'c2', author_name: 'alice' }] }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'open one' }), root });
+      const closed = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'close me' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/${(closed.response.body as { number?: number }).number}`, body: JSON.stringify({ state: 'closed' }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const ins = (m.github as any).insights?.find((x: any) => x.repo === REPO);
+      if (!ins) return false;
+      // Pulse counts MOVE with the seeded activity; alice leads the contributor board with 2 commits.
+      return ins.pulse.mergedPrs === 1 && ins.pulse.openedIssues === 1 && ins.pulse.closedIssues === 1
+        && ins.contributors[0]?.login === 'alice' && ins.contributors[0]?.commits === 2;
+    },
+  })),
+  // Repo/org settings screens (converged onto the SHARED tooling uiDataCoupled — same
+  // note as above): seed a repo + a collaborator + a webhook, so the Settings screen's
+  // rows + counts are driven by the modeled repo config / collaborators / webhooks.
+  done('github.ui.settings', 'ui', 'Repo/org settings screens (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo', private: true }), root });
+      await applyGithubWrite({ method: 'PUT', path: '/repos/octo/demo/collaborators/bob', body: JSON.stringify({ permission: 'push' }), root });
+      await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/hooks', body: JSON.stringify({ config: { url: 'https://e.x/h' }, events: ['push'] }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const s = (m.github as any).settings?.find((x: any) => x.repo === 'octo/demo');
+      if (!s) return false;
+      // counts MOVE with the seeded objects: one collaborator (bob/push), one webhook, private flag set.
+      return s.general.private === true && s.collaborators.length === 1 && s.collaborators[0].login === 'bob' && s.collaborators[0].permission === 'push'
+        && s.webhooks.length === 1 && s.webhooks[0].events.includes('push');
+    },
+  })),
+  // Global search: the search screen filters client-side over the SAME pullRequests/
+  // issues/contents the mirror fetches — seed one of each with a shared distinctive
+  // term and assert all three surface in the fetched payload the search view scans.
+  done('github.ui.search', 'ui', 'Global search results screen (data-coupled)', 'ui', 'common', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'Zephyrus search term', head: 'searchpr', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'Zephyrus search term issue' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/zephyrus-search-term.ts`, body: JSON.stringify({ message: 'm', content: Buffer.from('x').toString('base64') }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const g = m.github as any;
+      return g.pullRequests.some((p: any) => String(p.title).includes('Zephyrus search term'))
+        && g.issues.some((i: any) => String(i.title).includes('Zephyrus search term'))
+        && g.contents.some((c: any) => String(c.path).includes('zephyrus-search-term'));
+    },
+  })),
+  // Notifications inbox: seed a real notification thread — assert it appears unread
+  // with the seeded subject title (an unseeded root has zero notification threads).
+  done('github.ui.notifications', 'ui', 'Notifications inbox screen (data-coupled)', 'ui', 'common', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: (root) => applyGithubWrite({ method: 'POST', path: `/notifications`, body: JSON.stringify({ repository: REPO, subject_title: 'Notification Probe', subject_type: 'PullRequest', reason: 'review_requested' }), root }),
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => (m.github as any).notifications.some((n: any) => n.title === 'Notification Probe' && n.unread === true),
+  })),
+  // Deployments/Environments: seed a deployment + a status transition + an
+  // environment's protection rule — assert the fetched row carries the LATEST state.
+  done('github.ui.deployments', 'ui', 'Deployments/Environments screen (deployments list + state + environments) (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
+    withRoot,
+    seed: async (root) => {
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments`, body: JSON.stringify({ ref: 'main', environment: 'deploy-probe', description: 'probe deploy' }), root });
+      const id = (c.response.body as { id?: number }).id;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'success', environment_url: 'https://probe.x' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/environments/deploy-probe`, body: JSON.stringify({ wait_timer: 5 }), root });
+    },
+    fetch: async (root) => githubMirrorState(root),
+    assert: (m) => {
+      const g = m.github as any;
+      const d = g.deployments.find((x: any) => x.environment === 'deploy-probe');
+      const e = g.environments.find((x: any) => x.name === 'deploy-probe');
+      return !!d && d.state === 'success' && d.environmentUrl === 'https://probe.x' && !!e && e.protected === true;
+    },
+  })),
+  // ── Pull-surface coverage audit gaps (TWIN-46 / G2) — filed as manifest todos so
+  // scripts/seed-conformance-issues.ts (A1) turns them into real backlog work. See
+  // pull-audit.json (repo root) for the per-pack pull-vs-read-surface evidence.
+  todo('github.connector.pull_pr_files', 'connector', 'Connector: pull PR files (per-file diff list) from the real vendor', 'connector', 'core'),
+  todo('github.connector.pull_repo_metadata', 'connector', 'Connector: pull repo metadata/settings (GET /repos/:owner/:repo) from the real vendor', 'connector', 'common'),
+
+  // ── Missing-area sweep (TWIN-87 / F1) ────────────────────────────────────────────────────
+  // These whole vendor product areas had NO manifest entry of any status before this pass —
+  // not todo'd, not carved out — so they never surfaced in checkCapabilities gaps and the
+  // coverage denominator structurally couldn't include them. Filed as honest todos (all
+  // genuinely buildable; none is an impossibility warranting outOfScope). See GITHUB_AREAS
+  // below + github-capabilities.test.ts's area-census meta-test, which is what makes a future
+  // whole-area omission fail the gate instead of waiting for another review pass.
+  todo('github.copilot.seats', 'copilot', 'Copilot: manage Business/Enterprise seat assignments (list/add/remove billed seats)', 'api', 'niche'),
+  todo('github.copilot.usage', 'copilot', 'Copilot: usage/metrics API (org-level Copilot usage breakdown)', 'api', 'niche'),
+  todo('github.billing.actions_usage', 'billing', 'Billing: Actions minutes usage (org/enterprise billing API)', 'api', 'niche'),
+  todo('github.billing.packages_storage', 'billing', 'Billing: shared storage/packages billing usage', 'api', 'niche'),
+  todo('github.migrations.org_export', 'migrations', 'Migrations: start + poll an org migration (data export archive)', 'api', 'niche'),
+  todo('github.migrations.repo_import', 'migrations', 'Migrations: source import status (GitHub Importer API)', 'api', 'niche'),
+  todo('github.actions.runners_crud', 'actions', 'Actions: self-hosted runners CRUD (repo/org) + registration/removal tokens', 'api', 'niche'),
+  todo('github.actions.runner_groups', 'actions', 'Actions: runner groups (org) CRUD + repo/runner assignment', 'api', 'niche'),
+  todo('github.interactions.limits', 'interactions', 'Interactions: repo/org temporary interaction limits (collaborators-only restriction)', 'api', 'niche'),
+  todo('github.marketplace.listing', 'marketplace', 'Marketplace: listing plans for a GitHub App', 'api', 'niche'),
+  todo('github.marketplace.purchase_webhook', 'marketplace', 'Marketplace: purchase/change/cancellation webhook event shapes', 'api', 'niche'),
+  todo('github.scim.provisioning', 'scim', 'SCIM: enterprise/org user + group provisioning (SCIM 2.0 endpoints)', 'api', 'niche'),
+
+];
+
+// TWIN-87 committed area census — the vendor's top-level API product areas (docs nav /
+// OpenAPI tags), authored top-down independent of what a manifest entry happens to already
+// exist for. github-capabilities.test.ts's area-census meta-test (assertAreaCensus) fails the
+// gate if a declared area has zero manifest entries and no named exclusion, OR if a manifest
+// entry's `area` drifts outside this list — so a whole missing area (Copilot/billing/
+// migrations/runners/interactions/marketplace/SCIM were the concrete F1 leak) can never again
+// hide invisibly behind a denominator that structurally couldn't include it.
+export const GITHUB_AREAS = [
+  'actions', 'activity', 'api', 'auth', 'billing', 'checks', 'codespaces', 'connector',
+  'copilot', 'deployments', 'discussions', 'fields', 'gists', 'git', 'interactions', 'issues',
+  'marketplace', 'meta', 'migrations', 'notifications', 'orgs', 'packages', 'pages', 'projects',
+  'pulls', 'releases', 'repos', 'scim', 'search', 'security', 'ui', 'users', 'webhooks',
+] as const;
+
+export function githubCapabilities(): Promise<CapabilityReport> {
+  return checkCapabilities('github', GITHUB_CAPABILITIES);
+}