@volter/twin-github 0.1.2 → 2.0.0

package/src/github-capabilities.ts

@@ -10,18 +10,25 @@
 // Data API, Repos/Orgs/Teams/Users, Gists, Search, Notifications, Packages, Pages, code
 // scanning, GraphQL, Apps/OAuth, Webhooks, plus the web UI screens. The twin currently
 // models the PR/Issue/Checks/Actions core (REST objects) + a UI mirror; everything else is
-// an honest `todo`. Two explicit out-of-scope carve-outs (outOfScope): real repo CODE/FILE
-// BYTES (git blob content — large+redundant; API objects are covered) and running real CI
+// an honest `todo`. Raw repo file BYTES are a filed todo (github.repos.blob_bytes); running real
+// CI compute is what the real root does, not an API.
 // COMPUTE (executing Actions — infra, not API; the run/job OBJECTS are covered and modeled).
-import { mkdtempSync, rmSync } from 'node:fs';
+import assert from 'node:assert/strict';
+import { serveHttp, twinResources, worldNow } from '@volter/world-core';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { gzipSync } from 'node:zlib';
 import { join } from 'node:path';
-import { checkCapabilities, uiDataCoupled, type CapabilityReport, type CapabilitySpec, verifyBoundary } from '@volter/twin-tooling';
+import { checkCapabilities, uiDataCoupled, type CapabilityReport, type CapabilitySpec, verifyBoundary } from '@volter/world-tooling';
 import { githubMirrorState } from './github-mirror-state.ts';
-import { applyGithubWrite, handleGithubRequest } from './github-twin.ts';
+import { applyGithubWrite, githubState, handleGithubRequest, totpCode, totpStep } from './github-twin.ts';
 import { handleGithubGitSmartHttp } from './github-git-http.ts';
+import { githubNpmRegistry } from './npm-registry.ts';
+import { githubAppInstallationFlow } from './screens/app-installation.tsx';
+import { githubAppManifestFlow } from './screens/app-manifest.tsx';
+import { githubSessionFlow } from './screens/session.tsx';
 import { createGithubTwinServer } from './github-server.ts';
-import { clearGithubWebhooks, registerGithubWebhook } from './github-events.ts';
 
 // ── git-plane helpers: spawn the REAL git CLI (async — verifies that also run the twin's
 // HTTP server must keep the event loop free; a spawnSync would deadlock the clone against
@@ -64,26 +71,130 @@ const ok = (status: number) => status >= 200 && status < 300;
 // GET returns the expected status (and optional body-shape check passes).
 const getOk = (path: string, shape?: (body: unknown) => boolean) => () =>
   withRoot(async (root) => {
-    const res = handleGithubRequest({ method: 'GET', path, root });
+    const res = await handleGithubRequest({ method: 'GET', path, root });
     return ok(res.status) && (shape ? shape(res.body) : true);
   });
 
 // ── shorthands ───────────────────────────────────────────────────────────────────────────
 const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
 const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
-const outOfScope = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], reason: string): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo', outOfScope: reason });
 
 const REPO = 'octo/demo';
+// A repository with history, created as a person creates one, and files pushed to its main branch: what GitHub reacts
+// to by registering workflows, scanning for secrets and reading dependency manifests. Answers the last commit's sha.
+const HISTORY_REPO = 'octocat/ci-demo';
+async function pushFiles(root: string, files: Record<string, string>): Promise<string> {
+  if ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}`, root })).status === 404) await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'ci-demo', auto_init: true }), root });
+  let sha = '';
+  for (const [file, text] of Object.entries(files)) {
+    const put = await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/${file}`, body: JSON.stringify({ message: `Add ${file}`, content: Buffer.from(text).toString('base64') }), root });
+    sha = (put.response.body as { commit?: { sha?: string } }).commit?.sha ?? sha;
+  }
+  return sha;
+}
+const workflowFile = (name: string, steps = ''): string => `name: ${name}\non: workflow_dispatch\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n${steps}      - run: npm test\n`;
+/** Another person's token, minted where GitHub's own settings page would. */
+const mintToken = async (root: string, login: string): Promise<string> => ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+/** A person signed in at github.com/login, as a browser is: the session cookie the sign-in sets (src/screens/session.tsx). */
+const signIn = async (root: string, login = 'octocat'): Promise<string> => {
+  await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/password`, body: JSON.stringify({ password: 'probe-password' }), root });
+  const res = await githubSessionFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/session', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ login, password: 'probe-password', return_to: '/' }).toString() }));
+  return (res?.headers.getSetCookie() ?? []).map((c) => c.split(';')[0]).join('; ');
+};
+/** A dispatched run of a pushed workflow, finished by the runner. Answers the run's id. */
+async function finishedRun(root: string, file: string): Promise<number> {
+  await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/${file}/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+  const id = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/workflows/${file}/runs`, root })).body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+  await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/complete`, body: JSON.stringify({ conclusion: 'success' }), root });
+  return id;
+}
+/** A code-scanning upload as a scanner makes it: SARIF, gzip-compressed and Base64-encoded. */
+const sarifOf = (results: Array<{ rule: string; level: string; uri: string; line: number }>): string => gzipSync(JSON.stringify({ version: '2.1.0', runs: [{ tool: { driver: { name: 'CodeQL', rules: results.map((r) => ({ id: r.rule })) } }, results: results.map((r) => ({ ruleId: r.rule, level: r.level, message: { text: r.rule }, locations: [{ physicalLocation: { artifactLocation: { uri: r.uri }, region: { startLine: r.line } } }] })) }] })).toString('base64');
+/** A CI provider's GitHub App installed on the repository's account (its organization made first when it is not the
+ *  World's user), and the installation token its check runs are written with: only an app writes check runs. */
+async function ciToken(root: string, repo: string): Promise<string> {
+  const owner = repo.split('/')[0]!;
+  if (owner !== 'octocat') await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: owner }), root, cookie: await signIn(root) });
+  await applyGithubWrite({ method: 'POST', path: '/_twin/apps', body: JSON.stringify({ slug: 'probe-ci', name: 'Probe CI', owner, permissions: { checks: 'write' }, events: ['check_suite'], setup_url: 'https://ci.probe/setup' }), root });
+  const installed = await githubAppInstallationFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/apps/probe-ci/installations/new', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie: await signIn(root) }, body: new URLSearchParams({ install: '1', target_login: owner, repository_selection: 'all' }).toString() }));
+  const installation = new URL(installed!.headers.get('location')!).searchParams.get('installation_id');
+  return ((await applyGithubWrite({ method: 'POST', path: `/app/installations/${installation}/access_tokens`, body: '{}', root, token: appJwt('probe-ci') })).response.body as { token: string }).token;
+}
+/** The JWT an app signs to speak for itself (semantics/apps.ts): its client ID, issued now, for nine minutes. */
+function appJwt(slug: string): string {
+  const now = Math.floor(Date.parse(worldNow()) / 1000);
+  const part = (o: unknown) => Buffer.from(JSON.stringify(o)).toString('base64url');
+  return [part({ alg: 'RS256', typ: 'JWT' }), part({ iss: `Iv1.${createHash('sha256').update(`app:${slug}`).digest('hex').slice(0, 16)}`, iat: now - 60, exp: now + 480 }), 'c2lnbmF0dXJl'].join('.');
+}
+/** A collaborator as GitHub makes one: invited to the repository, then accepting with their own sign-in. */
+async function collaborator(root: string, repo: string, login: string, permission: string): Promise<void> {
+  await applyGithubWrite({ method: 'PUT', path: `/repos/${repo}/collaborators/${login}`, body: JSON.stringify({ permission }), root });
+  await acceptInvitation(root, repo, login);
+}
+/** The invitee accepts their pending invitation to a repository; answers the accept's outcome. */
+async function acceptInvitation(root: string, repo: string, login: string): Promise<Awaited<ReturnType<typeof applyGithubWrite>> | undefined> {
+  const token = await mintToken(root, login);
+  const invites = (await handleGithubRequest({ method: 'GET', path: '/user/repository_invitations', root, token })).body as Array<{ id: number; repository: { full_name: string } }>;
+  const invite = invites.find((i) => i.repository.full_name === repo);
+  return invite ? applyGithubWrite({ method: 'PATCH', path: `/user/repository_invitations/${invite.id}`, root, token }) : undefined;
+}
+/** A person other than the World's user @mentions it in a new issue, which lands in its inbox. */
+async function mentionedIn(root: string, repo: string, title: string): Promise<void> {
+  const alice = await mintToken(root, 'alice');
+  await applyGithubWrite({ method: 'POST', path: `/repos/${repo}/issues`, body: JSON.stringify({ title, body: '@octocat can you look?' }), root, token: alice });
+}
 const isArr = (b: unknown): b is unknown[] => Array.isArray(b);
 
 // The real GitHub surface. Anything not here is still a gap (keep growing it). Entries with
-// verify() + expected:'done' are what we currently claim; everything else is todo/out-of-scope.
+// verify() + expected:'done' are what we currently claim; everything else is todo.
+
+/** The verifies below drive the twin the way @octokit/rest does — `request('METHOD /path', { data })`
+ *  resolving `{ status, headers, data }` and REJECTING with `.status` on a non-2xx — over plain fetch.
+ *  The real SDK stays test-only (github-sdk.integration.test.ts; architecture guardrail: a vendor
+ *  SDK is a devDependency and never enters a runtime file). */
+function octoClient({ baseUrl }: { baseUrl: string }) {
+  return {
+    async request(route: string, options?: Record<string, unknown>): Promise<{ status: number; headers: { link?: string }; data: any }> {
+      const sp = route.indexOf(' ');
+      const method = route.slice(0, sp); const path = route.slice(sp + 1);
+      // Octokit's parameter rule: `data` is the whole body when given; otherwise every parameter
+      // not consumed by the route IS the body (`request('POST /orgs/octo/repos', { name })`).
+      const body = options?.data !== undefined ? options.data : options && Object.keys(options).length ? options : undefined;
+      const res = await fetch(`${baseUrl}${path}`, {
+        method,
+        headers: { accept: 'application/vnd.github+json', ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
+        ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+      });
+      const text = await res.text();
+      let data: any; try { data = text ? JSON.parse(text) : undefined; } catch { data = text; }
+      const out = { status: res.status, headers: { ...(res.headers.get('link') ? { link: res.headers.get('link')! } : {}) }, data };
+      if (res.status >= 400) { const err = Object.assign(new Error(`HTTP ${res.status} ${method} ${path}`), { status: res.status, response: out }); throw err; }
+      return out;
+    },
+  };
+}
+
+/** The invitee accepts an organization invitation: signs in (a personal token) and PATCHes their membership active. */
+async function acceptInvite(root: string, org: string, login: string): Promise<string> {
+  const token = ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+  await applyGithubWrite({ method: 'PATCH', path: `/user/memberships/orgs/${org}`, body: JSON.stringify({ state: 'active' }), root, token });
+  return token;
+}
+
 export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   // ── Pull Requests ──────────────────────────────────────────────────────────────────────
   done('github.pulls.create', 'pulls', 'PRs: create (POST .../pulls → 201)', 'api', 'core', () =>
     withRoot(async (root) => {
       const res = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root });
-      return res.response.status === 201 && (res.response.body as { number?: number }).number === 1;
+      const pr = res.response.body as any;
+      const self = await handleGithubRequest({ method: 'GET', path: '/user', root });
+      const got = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      const listed = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls`, root });
+      return res.response.status === 201 && pr.number === 1
+        && pr.user?.login === (self.body as any).login && pr.user?.type === 'User'
+        && pr.base?.repo?.full_name === REPO && pr.node_id === `PR_${REPO}#1`
+        && (got.body as any).user?.login === pr.user.login && (got.body as any).node_id === pr.node_id
+        && (listed.body as any[])[0]?.base?.repo?.full_name === REPO && (listed.body as any[])[0]?.node_id === pr.node_id;
     })),
   done('github.pulls.head_sha_resolves', 'pulls', 'PRs: head.sha resolves to the head branch tip (not the branch name)', 'api', 'core', () =>
     withRoot(async (root) => {
@@ -107,10 +218,10 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'A', head: 'feat', base: 'main' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'B', head: 'fix', base: 'main' }), root });
       await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/2`, body: JSON.stringify({ state: 'closed' }), root });
-      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=open`, root });
-      const byHead = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?head=octo:feat`, root });
-      const closed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=closed`, root });
-      const all = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=all`, root });
+      const open = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=open`, root });
+      const byHead = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?head=octo:feat`, root });
+      const closed = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=closed`, root });
+      const all = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls?state=all`, root });
       return isArr(open.body) && open.body.length === 1 && (open.body[0] as { number?: number }).number === 1
         && isArr(byHead.body) && byHead.body.length === 1 && (byHead.body[0] as { number?: number }).number === 1
         && isArr(closed.body) && closed.body.length === 1 && (closed.body[0] as { number?: number }).number === 2
@@ -119,14 +230,14 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   done('github.pulls.get', 'pulls', 'PRs: get one (GET .../pulls/:n)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root });
-      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      const res = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
       return ok(res.status) && (res.body as { number?: number }).number === 1;
     })),
   done('github.pulls.list', 'pulls', 'PRs: list (GET .../pulls, paginated)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'A', head: 'a', base: 'main' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'B', head: 'b', base: 'main' }), root });
-      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls`, root });
+      const res = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls`, root });
       return ok(res.status) && isArr(res.body) && res.body.length === 2;
     })),
   done('github.pulls.edit', 'pulls', 'PRs: edit title/body/state (PATCH .../pulls/:n)', 'api', 'core', () =>
@@ -138,19 +249,39 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   done('github.pulls.merge', 'pulls', 'PRs: merge (PUT .../pulls/:n/merge → 200; optional exact-head sha precondition → 409 after a push)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'm', head: 'a', base: 'main' }), root });
-      const pr = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      const pr = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
       const head = (pr.body as { head?: { sha?: string } }).head?.sha;
       const stale = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ sha: `${head}-stale` }), root });
       const res = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ sha: head }), root });
-      const merged = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/merge`, root });
+      const merged = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/merge`, root });
       return stale.response.status === 409 && ok(res.response.status) && (res.response.body as { merged?: boolean }).merged === true && merged.status === 204;
     })),
-  done('github.pulls.reviews', 'pulls', 'PRs: reviews submit + list (APPROVE/COMMENT/REQUEST_CHANGES)', 'api', 'core', () =>
+  done('github.pulls.reviews', 'pulls', 'PRs: reviews submit + list + get ONE by its id (GET .../pulls/:n/reviews/:rid) (APPROVE/COMMENT/REQUEST_CHANGES)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'r', head: 'a', base: 'main' }), root });
-      const sub = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event: 'APPROVE', body: 'lgtm' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
-      return ok(sub.response.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
+      // The submit VERB and the stored STATE are different words on real GitHub, and the whole
+      // point of a review is which one it is: APPROVE→APPROVED, REQUEST_CHANGES→
+      // CHANGES_REQUESTED, COMMENT→COMMENTED. A twin that echoes the verb back serves
+      // `state: "APPROVE"`, which matches no merge gate, no `state === 'APPROVED'` branch and
+      // no GraphQL PullRequestReviewState value — an approval nobody can see.
+      const wants: Array<[string, string]> = [['APPROVE', 'APPROVED'], ['REQUEST_CHANGES', 'CHANGES_REQUESTED'], ['COMMENT', 'COMMENTED']];
+      for (const [event, state] of wants) {
+        const sub = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event, body: `said ${event}` }), root });
+        if (!(ok(sub.response.status) && (sub.response.body as { state?: string }).state === state)) return false;
+      }
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 3)) return false;
+      // The list is the same stored reviews the submits answered with — read back, not echoed.
+      const states = (list.body as Array<{ state?: string }>).map((r) => r.state);
+      if (!wants.every(([, state], i) => states[i] === state)) return false;
+      // A review has its own address, and it must answer with THAT review. The twin used to
+      // let `reviews/:rid` fall into the list branch, so asking for one review returned all
+      // three — a caller reading `body[0]` got whichever review happened to be first.
+      const rid = (list.body as Array<{ id?: number }>)[1]?.id;
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews/${rid}`, root });
+      if (!(ok(one.status) && (one.body as { id?: number; state?: string }).id === rid && (one.body as { state?: string }).state === 'CHANGES_REQUESTED')) return false;
+      // …and a review id nobody submitted is Not Found, not the list again.
+      return (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews/999999`, root })).status === 404;
     })),
   done('github.pulls.files_from_git_plane', 'pulls', 'PRs: files/changedFiles derive from the REAL git diff (base tip…head tip in the plane) when the PR carries no diff evidence — merge-gate scope classification reads actual paths, never 0', 'api', 'common', () =>
     withRoot(async (root) => {
@@ -168,7 +299,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const pr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'F', head: 'feat', base: 'main' }), root });
       if (pr.response.status !== 201) return false;
       // GET /pulls/:n/files answers the REAL one-file diff with status + counts.
-      const files = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
+      const files = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
       if (!(ok(files.status) && isArr(files.body) && files.body.length === 1)) return false;
       const f = files.body[0] as { filename?: string; status?: string; additions?: number };
       if (!(f.filename === 'scripts/gate.ts' && f.status === 'added' && f.additions === 1)) return false;
@@ -182,7 +313,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const advance = await mk('docs/onmain.md', 'later\n', base.commit, base.tree);
       const ff = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/git/refs/heads/main`, body: JSON.stringify({ sha: advance.commit }), root });
       if (ff.response.status !== 200) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
       if (!(ok(after.status) && isArr(after.body) && after.body.length === 1)) return false;
       return (after.body[0] as { filename?: string }).filename === 'scripts/gate.ts';
     })),
@@ -199,9 +330,9 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const shaB = 'b'.repeat(40);
       const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/git/refs/heads/feat`, body: JSON.stringify({ sha: shaB }), root });
       if (upd.response.status !== 200) return false;
-      const pr = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
+      const pr = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
       if ((pr.body as { head?: { sha?: string } }).head?.sha !== shaB) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
       const first = (list.body as Array<{ commit_id?: string }>)[0]!;
       if (first.commit_id !== shaA) return false; // pinned to the head it judged
       // A fresh review binds the NEW head; a caller-pinned commit_id is honored verbatim.
@@ -214,7 +345,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'c', head: 'a', base: 'main' }), root });
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 10, side: 'RIGHT' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
       if (!(c.response.status === 201 && ok(list.status) && isArr(list.body) && (list.body[0] as { path?: string }).path === 'a.ts')) return false;
       // The READ is how a seat finds a finding, and the REPLY is how it answers one: GitHub's
       // own reply route takes the comment id alone and inherits the root's diff anchor.
@@ -225,43 +356,167 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // a reply to a comment that isn't there is a 404, not a new thread
       const orphan = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments/99999/replies`, body: JSON.stringify({ body: 'nobody home' }), root });
       if (orphan.response.status !== 404) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
+      const after = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root }));
       return isArr(after.body) && after.body.length === 2 && (after.body[1] as { in_reply_to_id?: number }).in_reply_to_id === cid;
     })),
+  done('github.pulls.review_comment_get_edit_delete', 'pulls', 'PRs: one review comment by its own id — GET / PATCH / DELETE (204) at .../pulls/comments/:id', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/comments`, body: JSON.stringify({ body: 'nit', path: 'a.ts', line: 3, side: 'RIGHT' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      const cid = (c.response.body as { id?: number }).id;
+      const got = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}`, root });
+      // the per-comment door serves the SAME object as the thread list — diff anchoring included
+      if (!(ok(got.status) && (got.body as { body?: string }).body === 'nit' && (got.body as { path?: string }).path === 'a.ts')) return false;
+      const ed = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/comments/${cid}`, body: JSON.stringify({ body: 'nit, expanded' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      if (!(ok(ed.response.status) && (ed.response.body as { body?: string }).body === 'nit, expanded' && (ed.response.body as { path?: string }).path === 'a.ts')) return false;
+      const thread = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
+      if (!(isArr(thread.body) && thread.body.length === 1 && (thread.body[0] as { body?: string }).body === 'nit, expanded')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pulls/comments/${cid}`, root, occurredAt: '2026-04-04T00:00:00Z' });
+      if (del.response.status !== 204) return false;
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/comments`, root });
+      return isArr(after.body) && after.body.length === 0
+        && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/99999`, root })).status === 404;
+    })),
+  done('github.pulls.list_order', 'pulls', 'PRs: list default order (sort=created&direction=desc — newest first) + direction', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const nums = async (q: string): Promise<number[]> => ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls${q}`, root })).body as Array<{ number: number }>).map((p) => p.number);
+      const eq = (a: number[], b: number[]): boolean => a.length === b.length && a.every((x, i) => x === b[i]);
+      for (const h of ['a', 'b', 'c']) await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: h, head: h, base: 'main' }), root, occurredAt: `2026-04-0${['a', 'b', 'c'].indexOf(h) + 1}T00:00:00Z` });
+      // Real GitHub's default is NEWEST FIRST. A consumer that reads page one for "the latest
+      // pull requests" is handed the oldest by a twin that answers ascending — the number IS
+      // the creation order here (one monotonic per-repo counter), so this order is grounded.
+      return eq(await nums(''), [3, 2, 1]) && eq(await nums('?sort=created'), [3, 2, 1]) && eq(await nums('?direction=asc'), [1, 2, 3])
+        && eq(await nums('?state=all&direction=asc'), [1, 2, 3]);
+    })),
+  done('github.pulls.timeline', 'pulls', 'PRs: the timeline at the pull request\'s issue address (closed/reopened/merged/reviewed/commented)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      // A pull request IS an issue and answers at the issue address, so its timeline is served
+      // there. It was EMPTY: the timeline was built from the issue construct alone, and a pull
+      // request has no row in it. Everything asserted here is read out of stored state — the
+      // recorded open↔closed transitions, the merge write, the submitted review, the comment.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'tl', head: 'a', base: 'main' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'one nit' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/reviews`, body: JSON.stringify({ event: 'APPROVE', body: 'ship it' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      // closed, reopened, then merged — the story returns to a state it already held, which is
+      // the only shape that can tell a real history from one derived off the present state.
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ state: 'closed' }), root, occurredAt: '2026-04-04T00:00:00Z' });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ state: 'open' }), root, occurredAt: '2026-04-05T00:00:00Z' });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ merge_method: 'squash' }), root, occurredAt: '2026-04-06T00:00:00Z' });
+      const tl = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
+      if (!(ok(tl.status) && isArr(tl.body) && tl.body.length > 0)) return false;
+      const events = tl.body as Array<{ event?: string; state?: string; body?: string | null; commit_id?: string | null }>;
+      const names = events.map((e) => e.event);
+      for (const want of ['closed', 'reopened', 'merged', 'reviewed', 'commented']) if (!names.includes(want)) return false;
+      // Closed BEFORE reopened: order is the whole point of a history.
+      if (!(names.indexOf('closed') < names.indexOf('reopened'))) return false;
+      // The timeline's `reviewed` state is the SAME stored review the reviews API serves, lower
+      // -cased the way real GitHub's timeline spells it — not a second copy that could drift.
+      // Both doors are pinned to the VENDOR's word now: the caller submitted the verb APPROVE
+      // and GitHub records the state APPROVED, so the reviews API says APPROVED and the
+      // timeline says approved. (Cross-door agreement alone was satisfied while the twin
+      // echoed the raw verb through both; the literal states are what a merge gate reads.)
+      const apiState = ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root })).body as Array<{ state?: string }>)[0]?.state;
+      const tlState = events.find((e) => e.event === 'reviewed')?.state;
+      if (!(apiState === 'APPROVED' && tlState === 'approved' && tlState === apiState.toLowerCase())) return false;
+      if (events.find((e) => e.event === 'commented')?.body !== 'one nit') return false;
+      if (!events.find((e) => e.event === 'merged')?.commit_id) return false;
+      // `merged` is a typed issue event on real GitHub, so the events door carries it too.
+      const ev = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events`, root });
+      return isArr(ev.body) && (ev.body as Array<{ event?: string }>).some((e) => e.event === 'merged');
+    })),
+  todo('github.pulls.timeline_unmodeled', 'pulls', 'PRs: timeline entries this twin holds no state for — committed, head_ref_force_pushed/deleted/restored, review_requested/removed, ready_for_review, converted_to_draft, base_ref_changed, auto_merge_enabled/disabled. The twin records the CURRENT reviewer/draft/base values, never the transitions, so each of these would be a fabricated event rather than a remembered one', 'api', 'niche'),
+  todo('github.pulls.list_filters_unmodeled', 'pulls', 'PRs: list sort=updated|popularity|long-running. The PR construct carries no updated_at (declared deviation) and no reaction/comment count, so those three orders would be a guess; state/head/base, direction and sort=created are served', 'api', 'niche'),
+  done('github.pulls.read_requires_parent', 'pulls', 'PRs: a sub-resource READ or WRITE addressed at a pull request nobody opened is 404, never an empty list — and an ISSUE number is not a pull-request number, in either direction', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // The pulls half of write_requires_parent / issues.read_requires_parent. `200 []` for
+      // the reviews of pull request 4041 says the pull request is real and simply unreviewed,
+      // so a typo'd number, a stale link and a genuinely quiet pull request are one answer and
+      // the mistake never surfaces. GET .../pulls/4041 already 404'd, which made it worse: the
+      // object was missing and every one of its sub-resources was serene.
+      const subs = ['reviews', 'comments', 'files', 'commits', 'requested_reviewers', 'threads'];
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'an issue, not a pull request' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      // …and the issue picks up a comment, which is what materializes a counter SHELL row in
+      // the pull-request table for its number. That shell is why the test is `is_pull_request`
+      // and not "a row exists": before this, the shell made the whole pulls family answer for
+      // an issue — a merge on it even promoted the issue into a pull request.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'commented' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'a pull request', head: 'a', base: 'main' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      for (const s of subs) {
+        if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/4041/${s}`, root })).status !== 404) return false;
+        // An ISSUE number is not a pull-request number: every pull request is an issue, but
+        // the relationship does not run the other way, so this family refuses it.
+        if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/${s}`, root })).status !== 404) return false;
+        // The pull request that WAS opened answers 200 on every one of them.
+        if (!ok((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/2/${s}`, root })).status)) return false;
+      }
+      // The write doors owe the same answer, and these four looked the row up by id alone —
+      // so an issue with a comment could be merged, auto-merged, given reviewers and had its
+      // branch updated as a pull request.
+      const writes: Array<[string, string, string]> = [
+        ['PUT', 'merge', '{}'], ['PUT', 'auto-merge', '{}'],
+        ['POST', 'requested_reviewers', '{"reviewers":["alice"]}'], ['PUT', 'update-branch', '{}'],
+      ];
+      for (const [method, door, body] of writes) {
+        if ((await applyGithubWrite({ method, path: `/repos/${REPO}/pulls/1/${door}`, body, root, occurredAt: '2026-04-04T00:00:00Z' })).response.status !== 404) return false;
+        if ((await applyGithubWrite({ method, path: `/repos/${REPO}/pulls/4041/${door}`, body, root, occurredAt: '2026-04-04T00:00:00Z' })).response.status !== 404) return false;
+      }
+      // …and refusing left the issue an issue: nothing promoted it into the pulls family.
+      return (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root })).status === 404
+        && ok((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root })).status);
+    })),
   done('github.pulls.requested_reviewers', 'pulls', 'PRs: request/remove reviewers', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'rr', head: 'a', base: 'main' }), root });
       const add = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/1/requested_reviewers`, body: JSON.stringify({ reviewers: ['alice'] }), root });
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/requested_reviewers`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/requested_reviewers`, root });
       return add.response.status === 201 && ok(get.status) && (get.body as { users?: unknown[] }).users?.length === 1;
     })),
   done('github.pulls.files', 'pulls', 'PRs: files changed (per-file diff list)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'f', head: 'a', base: 'main', files: [{ filename: 'x.ts', additions: 3, deletions: 1 }] }), root });
-      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
+      const res = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/files`, root });
       return ok(res.status) && isArr(res.body) && (res.body[0] as { filename?: string }).filename === 'x.ts';
     })),
   done('github.pulls.commits', 'pulls', 'PRs: commits list (per-commit detail)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'cm', head: 'a', base: 'main', commits: [{ sha: 'deadbeef', message: 'init' }] }), root });
-      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/commits`, root });
+      const res = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/commits`, root });
       return ok(res.status) && isArr(res.body) && res.body.length === 1;
     })),
   done('github.pulls.labels_assignees_milestone', 'pulls', 'PRs: labels/assignees/milestone via PATCH', 'api', 'core', () =>
     withRoot(async (root) => {
+      // Names three subjects, asserts three (and the read-back agrees with the write).
+      type Pr = { labels?: Array<{ name?: string }>; assignees?: Array<{ login?: string }>; milestone?: { number?: number } | null };
+      const ms = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/milestones`, body: JSON.stringify({ title: 'v1' }), root });
+      const msNum = (ms.response.body as { number?: number }).number;
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'la', head: 'a', base: 'main' }), root });
-      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'] }), root });
-      return ok(res.response.status) && (res.response.body as { labels?: unknown[] }).labels?.length === 1;
+      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], milestone: msNum }), root });
+      const seen = (b: unknown) => `${((b as Pr).labels ?? []).map((l) => l.name).join(',')}|${((b as Pr).assignees ?? []).map((a) => a.login).join(',')}|${(b as Pr).milestone?.number ?? ''}`;
+      return ok(res.response.status) && seen(res.response.body) === `bug|bob|${msNum}`
+        && seen((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root })).body) === `bug|bob|${msNum}`;
     })),
-  done('github.pulls.draft', 'pulls', 'PRs: draft state + ready_for_review', 'api', 'common', () =>
+  done('github.pulls.draft', 'pulls', 'PRs: native GraphQL draft/ready transitions preserve the PR and block draft merges', 'api', 'common', () =>
     withRoot(async (root) => {
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'd', head: 'a', base: 'main', draft: true }), root });
       if ((c.response.body as { draft?: boolean }).draft !== true) return false;
       // a draft cannot merge → 405; ready_for_review (draft:false) then merges.
       const blocked = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
       if (blocked.response.status !== 405) return false;
-      const ready = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ draft: false }), root });
-      if ((ready.response.body as { draft?: boolean }).draft !== false) return false;
+      // GraphQL through the twin's own door, as a client sends it
+      const gql = async (query: string, variables: Record<string, unknown>) => (await applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root })).response.body as { data?: any; errors?: unknown[] };
+      const ready = await gql('mutation($input:MarkPullRequestReadyForReviewInput!){markPullRequestReadyForReview(input:$input){pullRequest{isDraft}}}', { input: { pullRequestId: `PR_${REPO}#1` } });
+      if (ready.errors || ready.data?.markPullRequestReadyForReview?.pullRequest?.isDraft !== false) return false;
+      const restDraft = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ draft: true }), root });
+      if ((restDraft.response.body as { draft?: boolean }).draft !== false) return false;
+      // the conversion announces pull_request converted_to_draft: a hook's delivery records it
+      const hook = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/hooks`, body: JSON.stringify({ events: ['pull_request'], config: { url: 'http://127.0.0.1:9/draft' } }), root })).response.body as { id: number };
+      const draft = await gql('mutation($input:ConvertPullRequestToDraftInput!){convertPullRequestToDraft(input:$input){pullRequest{id number isDraft}}}', { input: { pullRequestId: `PR_${REPO}#1` } });
+      const returned = draft.data?.convertPullRequestToDraft?.pullRequest;
+      const deliveries = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/hooks/${hook.id}/deliveries`, root })).body as Array<{ event?: string; action?: string }>;
+      if (draft.errors || returned?.id !== `PR_${REPO}#1` || returned?.number !== 1 || returned?.isDraft !== true || !deliveries.some((d) => d.event === 'pull_request' && d.action === 'converted_to_draft')) return false;
+      if (((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root })).body as { draft?: boolean }).draft !== true) return false;
+      if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root })).response.status !== 405) return false;
+      await gql('mutation($input:MarkPullRequestReadyForReviewInput!){markPullRequestReadyForReview(input:$input){pullRequest{isDraft}}}', { input: { pullRequestId: `PR_${REPO}#1` } });
       const merged = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: '{}', root });
       return merged.response.status === 200;
     })),
@@ -275,7 +530,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (reply.response.status !== 201) return false;
       const resolve = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/comments/${cid}/resolve`, body: '{}', root });
       if (!(ok(resolve.response.status) && (resolve.response.body as { resolved?: boolean }).resolved === true)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/threads`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/threads`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { is_resolved?: boolean }).is_resolved === true)) return false;
       const unresolve = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pulls/1/comments/${cid}/resolve`, root });
       return ok(unresolve.response.status) && (unresolve.response.body as { resolved?: boolean }).resolved === false;
@@ -291,18 +546,30 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const m = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/merge`, body: JSON.stringify({ merge_method: 'rebase' }), root });
       return m.response.status === 200 && (m.response.body as { merged?: boolean }).merged === true;
     })),
-  done('github.pulls.update_branch', 'pulls', 'PRs: update branch / mergeability + conflicts', 'api', 'common', () =>
-    withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'ub', head: 'a', base: 'main' }), root });
-      // a dirty PR reports mergeable:false; update-branch advances head + marks it clean.
-      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/1`, body: JSON.stringify({ mergeable_state: 'dirty' }), root });
-      const dirty = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
-      if ((dirty.body as { mergeable?: boolean | null }).mergeable !== false) return false;
-      const before = (dirty.body as { head?: { sha?: string } }).head?.sha;
-      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/update-branch`, body: '{}', root });
+  done('github.pulls.update_branch', 'pulls', 'PRs: mergeability from the branches\' history + update branch', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const R = HISTORY_REPO;
+      const put = (path: string, text: string, branch: string, sha?: string) => applyGithubWrite({ method: 'PUT', path: `/repos/${R}/contents/${path}`, body: JSON.stringify({ message: `edit ${path}`, content: Buffer.from(text).toString('base64'), branch, ...(sha ? { sha } : {}) }), root });
+      const shaOf = async (path: string, ref: string) => ((await handleGithubRequest({ method: 'GET', path: `/repos/${R}/contents/${path}?ref=${ref}`, root })).body as { sha: string }).sha;
+      await pushFiles(root, { 'notes.txt': 'line one\n' });
+      const base = ((await handleGithubRequest({ method: 'GET', path: `/repos/${R}/git/ref/heads/main`, root })).body as { object: { sha: string } }).object.sha;
+      for (const name of ['clash', 'extra']) await applyGithubWrite({ method: 'POST', path: `/repos/${R}/git/refs`, body: JSON.stringify({ ref: `refs/heads/${name}`, sha: base }), root });
+      // one branch changes the line main changes too; the other adds a file of its own
+      await put('notes.txt', 'line one, from the branch\n', 'clash', await shaOf('notes.txt', 'clash'));
+      await put('extra.txt', 'more\n', 'extra');
+      await put('notes.txt', 'line one, from main\n', 'main', await shaOf('notes.txt', 'main'));
+      await applyGithubWrite({ method: 'POST', path: `/repos/${R}/pulls`, body: JSON.stringify({ title: 'clash', head: 'clash', base: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${R}/pulls`, body: JSON.stringify({ title: 'extra', head: 'extra', base: 'main' }), root });
+      const dirty = await handleGithubRequest({ method: 'GET', path: `/repos/${R}/pulls/1`, root });
+      if ((dirty.body as { mergeable?: boolean | null }).mergeable !== false || (dirty.body as { mergeable_state?: string }).mergeable_state !== 'dirty') return false;
+      const cleanPr = await handleGithubRequest({ method: 'GET', path: `/repos/${R}/pulls/2`, root });
+      if ((cleanPr.body as { mergeable?: boolean }).mergeable !== true) return false;
+      // bringing the clean one up to date merges main into its branch
+      const before = (cleanPr.body as { head?: { sha?: string } }).head?.sha;
+      const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${R}/pulls/2/update-branch`, body: '{}', root });
       if (upd.response.status !== 202) return false;
-      const clean = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1`, root });
-      return (clean.body as { mergeable?: boolean }).mergeable === true && (clean.body as { mergeable_state?: string }).mergeable_state === 'clean' && (clean.body as { head?: { sha?: string } }).head?.sha !== before;
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${R}/pulls/2`, root });
+      return (after.body as { mergeable_state?: string }).mergeable_state === 'clean' && (after.body as { head?: { sha?: string } }).head?.sha !== before;
     })),
 
   // ── Issues ─────────────────────────────────────────────────────────────────────────────
@@ -314,57 +581,223 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   done('github.issues.get_list', 'issues', 'Issues: get + list', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'i1' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues`, root });
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       return ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status);
     })),
+  done('github.issues.list_filters', 'issues', 'Issues: list filters (state default open, labels, assignee, since, sort/direction)', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const nums = async (q: string) => ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues${q}`, root })).body as Array<{ number: number }>).map((i) => i.number);
+      const eq = (a: number[], b: number[]) => a.length === b.length && a.every((x, i) => x === b[i]);
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'f1', labels: ['bug'], assignees: ['ann'] }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'f2' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/2`, body: JSON.stringify({ state: 'closed' }), root, occurredAt: '2026-04-05T00:00:00Z' });
+      // The DEFAULT is open — a closed issue in the unfiltered list is the bug that misleads.
+      return eq(await nums(''), [1]) && eq(await nums('?state=closed'), [2]) && eq(await nums('?state=all'), [2, 1])
+        && eq(await nums('?state=all&labels=bug'), [1]) && eq(await nums('?state=all&assignee=ann'), [1])
+        && eq(await nums('?state=all&assignee=none'), [2]) && eq(await nums('?state=all&since=2026-04-04T00:00:00Z'), [2])
+        && eq(await nums('?state=all&sort=created&direction=asc'), [1, 2])
+        // sort=comments orders by the count the issue actually carries — two comments on #2,
+        // none on #1 — which is only answerable because the count is derived from the comment
+        // store rather than hardcoded 0.
+        && (await (async () => {
+          await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/2/comments`, body: JSON.stringify({ body: 'a' }), root, occurredAt: '2026-04-06T00:00:00Z' });
+          await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/2/comments`, body: JSON.stringify({ body: 'b' }), root, occurredAt: '2026-04-07T00:00:00Z' });
+          return eq(await nums('?state=all&sort=comments'), [2, 1]) && eq(await nums('?state=all&sort=comments&direction=asc'), [1, 2]);
+        })());
+    })),
+  todo('github.issues.list_filters_unmodeled', 'issues', 'Issues: list filters creator/mentioned (the issue author and body mentions are unmodeled — declared deviation issue.user). sort=comments IS served: the issue carries its real comment count', 'api', 'niche'),
   done('github.issues.edit_state', 'issues', 'Issues: edit + close/reopen (state)', 'api', 'core', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'e' }), root });
       const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed' }), root });
       return ok(res.response.status) && (res.response.body as { state?: string }).state === 'closed';
     })),
-  done('github.issues.comments', 'issues', 'Issues: comments create + list', 'api', 'core', () =>
-    withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'c' }), root });
-      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'me too' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/comments`, root });
-      return c.response.status === 201 && ok(list.status) && isArr(list.body) && list.body.length === 1;
-    })),
-  done('github.issues.labels_assignees_milestone', 'issues', 'Issues: labels/assignees/milestone', 'api', 'core', () =>
-    withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'la' }), root });
-      const res = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['p1'], assignees: ['ann'] }), root });
-      return ok(res.response.status) && (res.response.body as { assignees?: unknown[] }).assignees?.length === 1;
+  done('github.issues.comments', 'issues', 'Issues: comments create + list, and the issue\'s own `comments` count', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'c' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      const count = async (): Promise<unknown> => ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root })).body as { comments?: number }).comments;
+      // Before any comment: the honest zero, which is also what a hardcoded 0 would say — so
+      // the assertion that matters is the one AFTER the write.
+      if (await count() !== 0) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'me too' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/comments`, root });
+      if (!(c.response.status === 201 && ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
+      // The count and the list are one answer: an issue whose thread has a comment may not
+      // read `comments: 0` — every consumer that decides whether to open a thread reads it.
+      if (await count() !== 1) return false;
+      const cid = (c.response.body as { id?: number }).id;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/comments/${cid}`, root, occurredAt: '2026-04-03T00:00:00Z' });
+      return del.response.status === 204 && await count() === 0;
+    })),
+  done('github.issues.comment_get_edit_delete', 'issues', 'Issues: one comment by its own id — GET / PATCH (body + updated_at) / DELETE (204) at .../issues/comments/:id', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // The per-comment door and the thread list must serve ONE object: an edit through the
+      // door has to be what the list shows, and a delete has to empty the list. Two doors that
+      // disagree about the same comment is the defect this asserts against.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'c' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'first draft' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      const cid = (c.response.body as { id?: number }).id;
+      const got = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/${cid}`, root });
+      if (!(ok(got.status) && (got.body as { body?: string }).body === 'first draft')) return false;
+      const ed = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/comments/${cid}`, body: JSON.stringify({ body: 'second draft' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      const edited = ed.response.body as { body?: string; created_at?: string; updated_at?: string };
+      if (!(ok(ed.response.status) && edited.body === 'second draft' && edited.updated_at === '2026-04-03T00:00:00Z' && edited.created_at === '2026-04-02T00:00:00Z')) return false;
+      // the THREAD shows the edit, and shows exactly one comment (an edit is not a second comment)
+      const thread = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/comments`, root });
+      if (!(isArr(thread.body) && thread.body.length === 1 && (thread.body[0] as { body?: string }).body === 'second draft')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/comments/${cid}`, root, occurredAt: '2026-04-04T00:00:00Z' });
+      if (del.response.status !== 204) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/${cid}`, root })).status !== 404) return false;
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/comments`, root });
+      return isArr(after.body) && after.body.length === 0
+        && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/99999`, root })).status === 404;
+    })),
+  done('github.issues.write_requires_parent', 'issues', 'Issues/PRs: a sub-resource write addressed at an id nobody minted is 404, never a success against nothing', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // The worst failure shape a twin has: 201 for a comment on an issue that does not exist,
+      // whose object is then unreachable from every read door. Every write whose PATH names a
+      // parent has to refuse when the parent is absent.
+      const refuses = async (method: string, path: string, body: unknown) =>
+        (await applyGithubWrite({ method, path, body: JSON.stringify(body), root })).response.status === 404;
+      return await refuses('POST', `/repos/${REPO}/issues/77/comments`, { body: 'x' })
+        && await refuses('POST', `/repos/${REPO}/pulls/77/comments`, { body: 'x', path: 'a.ts', line: 1 })
+        && await refuses('POST', `/repos/${REPO}/pulls/77/reviews`, { event: 'APPROVE' })
+        && await refuses('POST', `/repos/${REPO}/issues/77/reactions`, { content: '+1' })
+        && await refuses('POST', `/repos/${REPO}/issues/comments/77/reactions`, { content: '+1' })
+        && await refuses('PATCH', `/repos/${REPO}/pulls/77`, { title: 'x' })
+        && await refuses('POST', `/repos/${REPO}/issues/77/labels`, { labels: ['bug'] })
+        && await refuses('PUT', `/repos/${REPO}/issues/77/lock`, { lock_reason: 'spam' })
+        && await refuses('POST', `/repos/${REPO}/issues/77/sub_issues`, { sub_issue_id: 78 })
+        // …while a TOP-LEVEL create in an empty world is supposed to succeed: it names no parent.
+        && (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'top-level' }), root })).response.status === 201;
+    })),
+  done('github.issues.read_requires_parent', 'issues', 'Issues/PRs: a sub-resource READ addressed at an issue nobody filed is 404, never an empty list — and every one of those doors answers for a pull request number, which IS an issue', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // The read half of write_requires_parent, and the same lie told the other way round:
+      // `200 []` for the timeline of issue 4041 says the issue is real and simply quiet, so a
+      // typo'd number, a dead link and a genuinely empty issue are one answer and nothing ever
+      // surfaces the mistake. GET .../issues/4041 itself already 404'd, which made it worse —
+      // the object was missing and its sub-resources were serene.
+      const subs = ['timeline', 'events', 'comments', 'labels', 'reactions', 'sub_issues'];
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'filed' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'a pull request', head: 'a', base: 'main' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      for (const s of subs) {
+        if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/4041/${s}`, root })).status !== 404) return false;
+        // The issue that WAS filed answers 200 on every one of them…
+        if (!ok((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/${s}`, root })).status)) return false;
+        // …and so does the pull request, at its issue address: a pull request IS an issue, and
+        // `labels` used to be the one door in this family that forgot it and 404'd a real PR.
+        if (!ok((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/2/${s}`, root })).status)) return false;
+      }
+      return true;
+    })),
+  done('github.issues.pull_requests_are_issues', 'issues', 'Issues: the list/get include pull requests (each carrying the `pull_request` key), and GET .../pulls returns only pull requests', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // The relationship is ONE-DIRECTIONAL and the twin used to have it backwards: an issue
+      // that had been commented on appeared in GET .../pulls, and no pull request appeared in
+      // GET .../issues. Both directions are asserted here so neither can drift back.
+      type Row = { number?: number; pull_request?: unknown };
+      const rows = (b: unknown) => (b as Row[]) ?? [];
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'an issue' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'a comment on it' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'a pull request', head: 'feat', base: 'main' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      const pulls = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls`, root });
+      if (!(isArr(pulls.body) && rows(pulls.body).length === 1 && rows(pulls.body)[0]!.number === 2)) return false;
+      const issues = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues`, root });
+      const got = rows(issues.body);
+      if (got.length !== 2) return false;
+      if (got.filter((i) => i.pull_request).map((i) => i.number).join(',') !== '2') return false;
+      if (got.filter((i) => !i.pull_request).map((i) => i.number).join(',') !== '1') return false;
+      // …and the pull request answers at its ISSUE address too, still carrying the key.
+      const asIssue = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/2`, root });
+      return ok(asIssue.status) && !!(asIssue.body as Row).pull_request;
+    })),
+  done('github.issues.labels_assignees_milestone', 'issues', 'Issues: labels/assignees/milestone — on create, on PATCH, and via the .../labels sub-resource', 'api', 'core', () =>
+    withRoot(async (root) => {
+      // Three subjects named, three subjects asserted, on every door that writes them. The
+      // old verify PATCHed and checked assignees.length alone — which is how a create that
+      // dropped all three, and an unserved .../labels route, both survived a green claim.
+      type Iss = { labels?: Array<{ name?: string }>; assignees?: Array<{ login?: string }>; milestone?: { number?: number } | null };
+      const names = (b: unknown) => ((b as Iss).labels ?? []).map((l) => l.name).join(',');
+      const logins = (b: unknown) => ((b as Iss).assignees ?? []).map((a) => a.login).join(',');
+      const ms = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/milestones`, body: JSON.stringify({ title: 'v1' }), root });
+      const msNum = (ms.response.body as { number?: number }).number;
+      // CREATE carries the trio.
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'la', labels: ['p1'], assignees: ['ann'], milestone: msNum }), root });
+      if (c.response.status !== 201) return false;
+      if (!(names(c.response.body) === 'p1' && logins(c.response.body) === 'ann' && (c.response.body as Iss).milestone?.number === msNum)) return false;
+      // …and the read agrees with the create response.
+      const got = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      if (!(names(got.body) === 'p1' && logins(got.body) === 'ann' && (got.body as Iss).milestone?.number === msNum)) return false;
+      // PATCH REPLACES all three (milestone: null clears it).
+      const patched = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['p2', 'bug'], assignees: ['bob'], milestone: null }), root });
+      if (!ok(patched.response.status)) return false;
+      if (!(names(patched.response.body) === 'p2,bug' && logins(patched.response.body) === 'bob' && (patched.response.body as Iss).milestone === null)) return false;
+      // The labels sub-resource: add (union) → list → remove one → remove all.
+      const add = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/labels`, body: JSON.stringify({ labels: ['p2', 'p3'] }), root });
+      if (!(ok(add.response.status) && isArr(add.response.body) && add.response.body.map((l) => (l as { name?: string }).name).join(',') === 'p2,bug,p3')) return false;
+      const listed = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/labels`, root });
+      if (!(ok(listed.status) && isArr(listed.body) && listed.body.length === 3)) return false;
+      const one = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/labels/bug`, root });
+      if (!(ok(one.response.status) && isArr(one.response.body) && one.response.body.map((l) => (l as { name?: string }).name).join(',') === 'p2,p3')) return false;
+      // a label that is not on the issue → 404, and the sub-resource writes the SAME field
+      // the issue object reads (one model, two doors).
+      if ((await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/labels/nope`, root })).response.status !== 404) return false;
+      if (names((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root })).body) !== 'p2,p3') return false;
+      const all = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/labels`, root });
+      return all.response.status === 204 && names((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root })).body) === '';
     })),
   done('github.issues.timeline_crossref', 'issues', 'Issues: timeline/events (cross-reference links)', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'link' }), root });
       await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ _twin_linked: [{ type: 'pull_request', number: 2 }] }), root });
-      const res = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
+      const res = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
       return ok(res.status) && isArr(res.body) && res.body.length === 1;
     })),
-  done('github.issues.state_reasons', 'issues', 'Issues: state reasons (completed/not_planned/duplicate)', 'api', 'common', () =>
-    withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'sr' }), root });
-      const r = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed', state_reason: 'not_planned' }), root });
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
-      return ok(r.response.status) && (r.response.body as { state_reason?: string }).state_reason === 'not_planned' && (get.body as { state?: string }).state === 'closed';
+  done('github.issues.state_reasons', 'issues', 'Issues: state reasons (completed/not_planned/duplicate, and reopened on reopen)', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const sr = async (): Promise<{ state?: string; state_reason?: string | null }> => (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root })).body as { state?: string; state_reason?: string | null };
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'sr' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      const r = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed', state_reason: 'not_planned' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      if (!(ok(r.response.status) && (r.response.body as { state_reason?: string }).state_reason === 'not_planned' && (await sr()).state === 'closed')) return false;
+      // Closing is only half of it. REOPEN, and the reason must move with the state: real
+      // GitHub sets state_reason to `reopened`. Asserting only the close leaves the twin free
+      // to serve an issue that reads "open, and not_planned" — a contradiction, and the exact
+      // shape of the defect this verify now covers.
+      const back = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'open' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      if (!(ok(back.response.status) && (back.response.body as { state_reason?: string }).state_reason === 'reopened')) return false;
+      if (!((await sr()).state === 'open' && (await sr()).state_reason === 'reopened')) return false;
+      // An explicit reason still wins over the default, in either direction.
+      const dup = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed', state_reason: 'duplicate' }), root, occurredAt: '2026-04-04T00:00:00Z' });
+      if (!(ok(dup.response.status) && (await sr()).state_reason === 'duplicate')) return false;
+      // And the DEFAULT close — no reason given, which is what nearly every close is — is
+      // `completed` on real GitHub, the matching half of the reopen rule above. Left null, a
+      // consumer that tells done from abandoned by completed-vs-not_planned sees neither.
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'plain close' }), root, occurredAt: '2026-04-05T00:00:00Z' });
+      const plain = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/2`, body: JSON.stringify({ state: 'closed' }), root, occurredAt: '2026-04-06T00:00:00Z' });
+      if (!(ok(plain.response.status) && (plain.response.body as { state_reason?: string }).state_reason === 'completed')) return false;
+      const two = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/2`, root })).body as { state?: string; state_reason?: string | null };
+      // Only the TRANSITION defaults: re-stating `closed` on an already-closed issue must not
+      // overwrite the reason it was closed for.
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'closed' }), root, occurredAt: '2026-04-07T00:00:00Z' });
+      return two.state === 'closed' && two.state_reason === 'completed' && (await sr()).state_reason === 'duplicate';
     })),
   done('github.issues.types', 'issues', 'Issues: issue types (org-level)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // a missing name 422s; create → listed; duplicate name 422s; edit; delete → gone.
-      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: '{}', root })).response.status !== 422) return false;
-      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug', color: 'red', description: 'A defect' }), root });
-      if (!(c.response.status === 201 && (c.response.body as { name?: string }).name === 'Bug')) return false;
-      const id = (c.response.body as { id?: number }).id!;
+      // name and is_enabled are required (422 without); create → listed; duplicate name 422s; a PUT
+      // replaces it; delete → gone.
       if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug' }), root })).response.status !== 422) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug', is_enabled: true, color: 'red', description: 'A defect' }), root });
+      if (!(c.response.status === 200 && (c.response.body as { name?: string }).name === 'Bug')) return false;
+      const id = (c.response.body as { id?: number }).id!;
+      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/issue-types`, body: JSON.stringify({ name: 'Bug', is_enabled: true }), root })).response.status !== 422) return false;
+      const list = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/issue-types/${id}`, body: JSON.stringify({ description: 'updated' }), root });
+      const e = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/issue-types/${id}`, body: JSON.stringify({ name: 'Bug', is_enabled: true, description: 'updated' }), root });
       if ((e.response.body as { description?: string }).description !== 'updated') return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/issue-types/${id}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/issue-types`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 0;
     })),
   done('github.issues.subissues', 'issues', 'Issues: sub-issues (parent/child hierarchy)', 'api', 'common', () =>
@@ -373,10 +806,10 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'child' }), root });
       const add = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/sub_issues`, body: JSON.stringify({ sub_issue_number: 2 }), root });
       if (add.response.status !== 201) return false;
-      const subs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
+      const subs = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
       if (!(ok(subs.status) && isArr(subs.body) && subs.body.length === 1 && (subs.body[0] as { number?: number }).number === 2)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/sub_issue`, body: JSON.stringify({ sub_issue_number: 2 }), root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/sub_issues`, root });
       return ok(del.response.status) && isArr(after.body) && after.body.length === 0;
     })),
   done('github.issues.reactions', 'issues', 'Issues/comments: reactions (emoji)', 'api', 'common', () =>
@@ -387,12 +820,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (bad.response.status !== 422) return false;
       const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/reactions`, body: JSON.stringify({ content: 'heart' }), root });
       if (r.response.status !== 201) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/reactions`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/reactions`, root });
       // comment reactions too: create a comment, react to it.
       const cm = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/comments`, body: JSON.stringify({ body: 'hi' }), root });
       const cid = (cm.response.body as { id?: number }).id!;
       const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/comments/${cid}/reactions`, body: JSON.stringify({ content: 'rocket' }), root });
-      const clist = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/${cid}/reactions`, root });
+      const clist = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/comments/${cid}/reactions`, root });
       return ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { content?: string }).content === 'heart'
         && cr.response.status === 201 && isArr(clist.body) && clist.body.length === 1;
     })),
@@ -401,10 +834,10 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'lock' }), root });
       const lock = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/1/lock`, body: JSON.stringify({ lock_reason: 'off-topic' }), root });
       if (lock.response.status !== 204) return false;
-      const locked = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const locked = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       if (!((locked.body as { locked?: boolean }).locked === true && (locked.body as { active_lock_reason?: string }).active_lock_reason === 'off-topic')) return false;
       const unlock = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/lock`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       return unlock.response.status === 204 && (after.body as { locked?: boolean }).locked === false;
     })),
   done('github.issues.transfer', 'issues', 'Issues: transfer to another repo', 'api', 'niche', () =>
@@ -416,9 +849,9 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const t = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues/1/transfer`, body: JSON.stringify({ new_repository: 'octo/other' }), root });
       if (!(t.response.status === 201 && (t.response.body as { title?: string }).title === 'moves')) return false;
       const newNum = (t.response.body as { number?: number }).number!;
-      const moved = handleGithubRequest({ method: 'GET', path: `/repos/octo/other/issues/${newNum}`, root });
+      const moved = await handleGithubRequest({ method: 'GET', path: `/repos/octo/other/issues/${newNum}`, root });
       if (!(ok(moved.status) && (moved.body as { title?: string }).title === 'moves')) return false;
-      const src = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const src = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       return (src.body as { state?: string }).state === 'closed' && (src.body as { state_reason?: string }).state_reason === 'transferred';
     })),
   done('github.issues.pin', 'issues', 'Issues: pin/unpin', 'api', 'niche', () =>
@@ -428,20 +861,30 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/99/pin`, body: '{}', root })).response.status !== 404) return false;
       const pin = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/issues/1/pin`, body: '{}', root });
       if (pin.response.status !== 204) return false;
-      const pinned = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const pinned = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       if ((pinned.body as { pinned?: boolean }).pinned !== true) return false;
       const unpin = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/issues/1/pin`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1`, root });
       return unpin.response.status === 204 && (after.body as { pinned?: boolean }).pinned === false;
     })),
   done('github.issues.full_timeline', 'issues', 'Issues: full timeline events (labeled/assigned/renamed/…)', 'api', 'common', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'tl' }), root });
-      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], state: 'closed', state_reason: 'completed' }), root });
-      const tl = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'tl' }), root, occurredAt: '2026-04-01T00:00:00Z' });
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], state: 'closed', state_reason: 'completed' }), root, occurredAt: '2026-04-02T00:00:00Z' });
+      // …then REOPEN it. Closing and reopening are the two most consequential things that
+      // happen to an issue and the only ones that leave no trace in the present state: a
+      // timeline derived from `state` alone loses both and still reads complete.
+      await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ state: 'open' }), root, occurredAt: '2026-04-03T00:00:00Z' });
+      const tl = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/timeline`, root });
       if (!(ok(tl.status) && isArr(tl.body))) return false;
-      const events = (tl.body as Array<{ event?: string }>).map((e) => e.event);
-      return events.includes('labeled') && events.includes('assigned') && events.includes('closed');
+      const events = (tl.body as Array<{ event?: string; state_reason?: string | null }>);
+      const names = events.map((e) => e.event);
+      if (!(names.includes('labeled') && names.includes('assigned') && names.includes('closed') && names.includes('reopened'))) return false;
+      if (events.find((e) => e.event === 'closed')?.state_reason !== 'completed') return false;
+      // the typed events endpoint is built from the same history, so it carries them too
+      const ev = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/events`, root });
+      const evNames = (ev.body as Array<{ event?: string }>).map((e) => e.event);
+      return isArr(ev.body) && evNames.includes('closed') && evNames.includes('reopened');
     })),
 
   // ── Labels / Milestones ──────────────────────────────────────────────────────────────────
@@ -449,9 +892,18 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/milestones`, body: JSON.stringify({ title: 'v1' }), root });
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/milestones/1`, body: JSON.stringify({ state: 'closed' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/milestones`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/milestones`, root });
       return c.response.status === 201 && ok(e.response.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
     })),
+  done('github.milestones.counts', 'fields', 'Milestones: open_issues and closed_issues count the issues and pull requests in the milestone', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'plan' }), root });
+      const ms = (await applyGithubWrite({ method: 'POST', path: '/repos/octocat/plan/milestones', body: JSON.stringify({ title: '1.0' }), root })).response.body as { number: number };
+      for (const title of ['a', 'b', 'c']) await applyGithubWrite({ method: 'POST', path: '/repos/octocat/plan/issues', body: JSON.stringify({ title, milestone: ms.number }), root });
+      await applyGithubWrite({ method: 'PATCH', path: '/repos/octocat/plan/issues/2', body: JSON.stringify({ state: 'closed' }), root });
+      const got = (await handleGithubRequest({ method: 'GET', path: `/repos/octocat/plan/milestones/${ms.number}`, root })).body as { open_issues: number; closed_issues: number };
+      return got.open_issues === 2 && got.closed_issues === 1;
+    })),
   done('github.labels.crud', 'fields', 'Labels: repo label CRUD (color/description)', 'api', 'core', () =>
     withRoot(async (root) => {
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/labels`, body: JSON.stringify({ name: 'bug', color: 'd73a4a', description: 'Something broken' }), root });
@@ -461,102 +913,131 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (dup.response.status !== 422) return false;
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/labels/bug`, body: JSON.stringify({ new_name: 'defect', color: '000000' }), root });
       if (!(ok(e.response.status) && (e.response.body as { name?: string }).name === 'defect')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels`, root });
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status))) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/labels/defect`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/labels/defect`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
 
+  done('github.labels.defaults', 'fields', 'Labels: a new repository has GitHub\'s default labels (bug, documentation, …, wontfix), marked default', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'fresh' }), root });
+      const labels = (await handleGithubRequest({ method: 'GET', path: '/repos/octocat/fresh/labels', root })).body as Array<{ name: string; default: boolean }>;
+      const dup = await applyGithubWrite({ method: 'POST', path: '/repos/octocat/fresh/labels', body: JSON.stringify({ name: 'bug' }), root });
+      return labels.length === 9 && labels.every((l) => l.default) && labels.some((l) => l.name === 'good first issue') && dup.response.status === 422;
+    })),
   // ── Commit statuses + Checks ─────────────────────────────────────────────────────────────
   done('github.statuses.create_combined', 'checks', 'Commit statuses: create + combined + list', 'api', 'core', () =>
     withRoot(async (root) => {
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/statuses/abc123`, body: JSON.stringify({ state: 'success', context: 'ci' }), root });
-      const combined = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/status`, root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/statuses`, root });
+      const combined = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/status`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/statuses`, root });
       return c.response.status === 201 && ok(combined.status) && ok(list.status) && isArr(list.body) && list.body.length === 1;
     })),
-  done('github.checks.runs', 'checks', 'Check runs: create + list for a ref', 'api', 'core', () =>
-    withRoot(async (root) => {
-      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'sha9', conclusion: 'success' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/sha9/check-runs`, root });
+  done('github.pulls.from_fork', 'pulls', 'PRs: a pull request from a fork (head owner:branch) reads the fork\'s branch, follows pushes to it, and merges its commits into the base', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const ada = await mintToken(root, 'ada');
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/forks`, body: '{}', root, token: ada });
+      const fork = 'ada/ci-demo';
+      const write = async (text: string) => ((await applyGithubWrite({ method: 'PUT', path: `/repos/${fork}/contents/b.txt`, body: JSON.stringify({ message: 'b', content: Buffer.from(text).toString('base64'), ...(text === 'b2\n' ? { sha: ((await handleGithubRequest({ method: 'GET', path: `/repos/${fork}/contents/b.txt`, root, token: ada })).body as { sha: string }).sha } : {}) }), root, token: ada })).response.body as { commit: { sha: string } }).commit.sha;
+      const first = await write('b\n');
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'grace:main', base: 'main' }), root, token: ada })).response.status !== 422) return false;
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'ada:main', base: 'main' }), root, token: ada })).response.body as { number: number; head: { label: string; sha: string; repo?: { full_name: string } } };
+      if (pr.head.label !== 'ada:main' || pr.head.repo?.full_name !== fork || pr.head.sha !== first) return false;
+      const second = await write('b2\n');
+      const now = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}`, root })).body as { head: { sha: string }; commits: number };
+      const merged = await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root });
+      const commit = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/git/commits/${(merged.response.body as { sha: string }).sha}`, root })).body as { tree: { sha: string } };
+      const tree = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/git/trees/${commit.tree.sha}`, root })).body as { tree: Array<{ path: string }> };
+      return now.head.sha === second && now.commits === 2 && merged.response.status === 200 && tree.tree.some((e) => e.path === 'b.txt');
+    })),
+  done('github.checks.runs', 'checks', 'Check runs: an installed app creates them (a person\'s token is refused) + list for a ref', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const token = await ciToken(root, REPO);
+      const byPerson = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'sha9', conclusion: 'success' }), root });
+      if (byPerson.response.status !== 403) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'sha9', conclusion: 'success' }), root, token });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/sha9/check-runs`, root });
       return c.response.status === 201 && ok(list.status) && (list.body as { total_count?: number }).total_count === 1;
     })),
   done('github.checks.suites', 'checks', 'Check suites: list/get/rerequest + GET .../check-runs/:id', 'api', 'common', () =>
     withRoot(async (root) => {
-      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'shaS', conclusion: 'success' }), root });
+      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'build', head_sha: 'shaS', conclusion: 'success' }), root, token: await ciToken(root, REPO) });
       const runId = (cr.response.body as { id?: number }).id!;
       const suiteId = (cr.response.body as { check_suite?: { id?: number } }).check_suite?.id!;
       // GET a single check run; list/get the suite; suite rolls up to success; rerequest 201s.
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${runId}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${runId}`, root });
       if (!(ok(one.status) && (one.body as { id?: number }).id === runId)) return false;
-      const suites = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/shaS/check-suites`, root });
+      const suites = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/shaS/check-suites`, root });
       if (!(ok(suites.status) && (suites.body as { total_count?: number }).total_count === 1)) return false;
-      const suite = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-suites/${suiteId}`, root });
+      const suite = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-suites/${suiteId}`, root });
       if (!(ok(suite.status) && (suite.body as { conclusion?: string }).conclusion === 'success')) return false;
       const re = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-suites/${suiteId}/rerequest`, body: '{}', root });
       return re.response.status === 201;
     })),
   done('github.checks.annotations', 'checks', 'Check runs: annotations + output details', 'api', 'common', () =>
     withRoot(async (root) => {
-      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'lint', head_sha: 'shaA', status: 'in_progress' }), root });
+      const token = await ciToken(root, REPO);
+      const cr = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'lint', head_sha: 'shaA', status: 'in_progress' }), root, token });
       const id = (cr.response.body as { id?: number }).id!;
-      const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/check-runs/${id}`, body: JSON.stringify({ conclusion: 'failure', output: { title: 'Lint', summary: '1 issue', annotations: [{ path: 'a.ts', start_line: 3, end_line: 3, annotation_level: 'warning', message: 'unused var' }] } }), root });
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/check-runs/${id}`, body: JSON.stringify({ conclusion: 'failure', output: { title: 'Lint', summary: '1 issue', annotations: [{ path: 'a.ts', start_line: 3, end_line: 3, annotation_level: 'warning', message: 'unused var' }] } }), root, token });
       if (!(ok(upd.response.status) && (upd.response.body as { output?: { annotations_count?: number } }).output?.annotations_count === 1)) return false;
-      const anns = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${id}/annotations`, root });
+      const anns = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/check-runs/${id}/annotations`, root });
       return ok(anns.status) && isArr(anns.body) && anns.body.length === 1 && (anns.body[0] as { annotation_level?: string }).annotation_level === 'warning';
     })),
 
   // ── Actions ──────────────────────────────────────────────────────────────────────────────
-  done('github.actions.workflows', 'actions', 'Actions: register + list/get workflows', 'api', 'niche', () =>
+  done('github.actions.workflows', 'actions', 'Actions: a pushed workflow file registers; list/get workflows', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const reg = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/workflows`, root });
-      return ok(reg.response.status) && ok(list.status) && (list.body as { total_count?: number }).total_count === 1;
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/workflows`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/workflows/ci.yml`, root });
+      return ok(list.status) && (list.body as { total_count?: number }).total_count === 1 && (one.body as { name?: string }).name === 'CI';
     })),
   done('github.actions.dispatch_runs', 'actions', 'Actions: dispatch workflow → queued run; list runs', 'api', 'niche', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
-      const d = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
-      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      const d = await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root });
       return d.response.status === 204 && ok(runs.status) && (runs.body as { total_count?: number }).total_count === 1;
     })),
   done('github.actions.run_jobs', 'actions', 'Actions: run jobs + get run + rerun/cancel transitions', 'api', 'niche', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
-      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root });
       const runId = (runs.body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
-      const jobs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}/jobs`, root });
-      const cancel = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/runs/${runId}/cancel`, body: '{}', root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}`, root });
+      const jobs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${runId}/jobs`, root });
+      const cancel = await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/runs/${runId}/cancel`, body: '{}', root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${runId}`, root });
       return ok(jobs.status) && (jobs.body as { total_count?: number }).total_count === 1 && cancel.response.status === 202 && (after.body as { conclusion?: string }).conclusion === 'cancelled';
     })),
   done('github.actions.logs', 'actions', 'Actions: download run logs (302 redirect to signed URL)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/ci.yml`, body: JSON.stringify({ name: 'CI', path: '.github/workflows/ci.yml' }), root });
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
-      const runs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs`, root });
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root });
       const runId = (runs.body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
       // a real run's logs 302-redirect to a download URL; an unknown run → 404.
-      const logs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/${runId}/logs`, root });
+      const logs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${runId}/logs`, root });
       if (!(logs.status === 302 && typeof (logs.body as { location?: string }).location === 'string')) return false;
-      return handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/runs/999999/logs`, root }).status === 404;
-    })),
-  done('github.actions.artifacts', 'actions', 'Actions: artifacts register/list/get/delete (metadata)', 'api', 'niche', () =>
-    withRoot(async (root) => {
-      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/artifacts`, body: '{}', root });
-      if (bad.response.status !== 422) return false;
-      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/artifacts`, body: JSON.stringify({ name: 'build-output', size_in_bytes: 2048, run_id: 5 }), root });
-      if (!(c.response.status === 201 && (c.response.body as { name?: string }).name === 'build-output')) return false;
-      const id = (c.response.body as { id?: number }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts`, root });
-      if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
-      if (!(ok(one.status) && (one.body as { size_in_bytes?: number }).size_in_bytes === 2048)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/artifacts/${id}`, root });
+      return (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/999999/logs`, root })).status === 404;
+    })),
+  done('github.actions.artifacts', 'actions', 'Actions: what a finished run uploaded: artifacts list/get/delete (metadata)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/build.yml': workflowFile('Build', '      - uses: actions/upload-artifact@v4\n        with:\n          name: build-output\n          path: dist/\n') });
+      const run = await finishedRun(root, 'build.yml');
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/artifacts`, root });
+      const artifacts = (list.body as { total_count?: number; artifacts?: Array<{ id: number; name: string; workflow_run?: { id?: number } }> });
+      if (!(ok(list.status) && artifacts.total_count === 1 && artifacts.artifacts![0]!.name === 'build-output' && artifacts.artifacts![0]!.workflow_run?.id === run)) return false;
+      const id = artifacts.artifacts![0]!.id;
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/artifacts/${id}`, root });
+      if (!(ok(one.status) && (one.body as { name?: string }).name === 'build-output')) return false;
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${HISTORY_REPO}/actions/artifacts/${id}`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/artifacts/${id}`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
   done('github.actions.secrets', 'actions', 'Actions: secrets (repo + org; value never returned)', 'api', 'niche', () =>
@@ -566,18 +1047,18 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (c.response.status !== 201) return false;
       const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/secrets/API_KEY`, body: JSON.stringify({ encrypted_value: 'yyy', key_id: '1' }), root });
       if (upd.response.status !== 204) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets`, root });
       const secrets = (list.body as { secrets?: Array<Record<string, unknown>> }).secrets ?? [];
       if (!(ok(list.status) && secrets.length === 1 && secrets[0]!.name === 'API_KEY' && !('value' in secrets[0]!))) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root });
       if (!(ok(get.status) && (get.body as { name?: string }).name === 'API_KEY')) return false;
       // org-scope secret is a separate namespace.
       const org = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/actions/secrets/ORG_TOKEN`, body: JSON.stringify({ encrypted_value: 'z' }), root });
       if (org.response.status !== 201) return false;
-      const orgList = handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/secrets`, root });
+      const orgList = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/secrets`, root });
       if (!(ok(orgList.status) && (orgList.body as { total_count?: number }).total_count === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/secrets/API_KEY`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/secrets/API_KEY`, root })).status === 404;
     })),
   done('github.actions.variables', 'actions', 'Actions: variables (repo + org; value returned)', 'api', 'niche', () =>
     withRoot(async (root) => {
@@ -588,32 +1069,30 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // duplicate → 409.
       const dup = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/variables`, body: JSON.stringify({ name: 'NODE_ENV', value: 'x' }), root });
       if (dup.response.status !== 409) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
       if (!(ok(get.status) && (get.body as { value?: string }).value === 'production')) return false;
       // PATCH the value; re-read reflects it.
       const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/actions/variables/NODE_ENV`, body: JSON.stringify({ value: 'staging' }), root });
       if (upd.response.status !== 204) return false;
-      const get2 = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
+      const get2 = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
       if ((get2.body as { value?: string }).value !== 'staging') return false;
       // org-scope variable.
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/actions/variables`, body: JSON.stringify({ name: 'REGION', value: 'us' }), root });
-      const orgGet = handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/variables/REGION`, root });
+      const orgGet = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/actions/variables/REGION`, root });
       if ((orgGet.body as { value?: string }).value !== 'us') return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/variables/NODE_ENV`, root })).status === 404;
     })),
-  done('github.actions.caches', 'actions', 'Actions: caches list/delete', 'api', 'niche', () =>
+  done('github.actions.caches', 'actions', 'Actions: the caches a finished run saved: list/delete', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const bad = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: '{}', root });
-      if (bad.response.status !== 422) return false;
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: JSON.stringify({ key: 'node-modules-abc', ref: 'refs/heads/main', size_in_bytes: 1024 }), root });
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/caches`, body: JSON.stringify({ key: 'node-modules-def', size_in_bytes: 2048 }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/caches`, root });
+      await pushFiles(root, { '.github/workflows/build.yml': workflowFile('Build', '      - uses: actions/cache@v4\n        with:\n          key: node-modules-abc\n      - uses: actions/cache@v4\n        with:\n          key: node-modules-def\n') });
+      await finishedRun(root, 'build.yml');
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/caches`, root });
       if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 2)) return false;
       // delete by key → removes one; list shrinks.
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/actions/caches?key=node-modules-abc`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${HISTORY_REPO}/actions/caches?key=node-modules-abc`, root });
       if (!(del.response.status === 200 && (del.response.body as { total_count?: number }).total_count === 1)) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/actions/caches`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/caches`, root });
       return (after.body as { total_count?: number }).total_count === 1;
     })),
   done('github.actions.environments', 'actions', 'Actions: deployment environments (alias of environments.crud)', 'api', 'niche', () =>
@@ -621,11 +1100,9 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // environments are reachable under the repo; create + list round-trips.
       const c = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/environments/staging`, body: JSON.stringify({ wait_timer: 5 }), root });
       if (c.response.status !== 200) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
       return ok(list.status) && (list.body as { total_count?: number }).total_count === 1 && (list.body as { environments?: Array<{ name?: string }> }).environments?.[0]?.name === 'staging';
     })),
-  outOfScope('github.actions.compute', 'actions', 'Actions: real CI COMPUTE (executing the workflow)', 'api', 'niche',
-    'Out of scope: running real CI compute is infra, not API. The run/job OBJECTS (queued/rerun/cancel) are modeled (covered).'),
 
   // ── Repos / settings / branches ──────────────────────────────────────────────────────────
   done('github.repos.crud', 'repos', 'Repos: create/get/update/delete + settings', 'api', 'common', () =>
@@ -634,41 +1111,42 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(c.response.status === 201 && (c.response.body as { full_name?: string }).full_name === 'octo/demo')) return false;
       const dup = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       if (dup.response.status !== 422) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
       if (!(ok(get.status) && (get.body as { private?: boolean }).private === true)) return false;
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/octo/demo`, body: JSON.stringify({ description: 'updated', has_wiki: false }), root });
       if (!(ok(e.response.status) && (e.response.body as { description?: string }).description === 'updated')) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
   done('github.repos.branches', 'repos', 'Repos: branches list/get + default branch', 'api', 'common', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', default_branch: 'main' }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches`, root });
+      // auto_init makes the initial commit, so the default branch exists
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', default_branch: 'main', auto_init: true }), root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { name?: string }).name === 'main')) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
       return ok(one.status) && (one.body as { name?: string }).name === 'main' && typeof (one.body as { commit?: { sha?: string } }).commit?.sha === 'string';
     })),
   done('github.repos.branch_protection', 'repos', 'Repos: branch protection rules + rulesets', 'api', 'niche', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', auto_init: true }), root });
       // Real GitHub 422s a protection PUT missing any of the four required (nullable) keys.
       const partial = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/branches/main/protection`, body: JSON.stringify({ required_status_checks: null }), root });
       if (partial.response.status !== 422) return false;
       const p = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/branches/main/protection`, body: JSON.stringify({ required_status_checks: null, enforce_admins: false, required_pull_request_reviews: null, restrictions: null }), root });
       if (!(ok(p.response.status) && (p.response.body as { enabled?: boolean }).enabled === true)) return false;
-      const b = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      const b = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
       if ((b.body as { protected?: boolean }).protected !== true) return false;
       const d = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/branches/main/protection`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
       return d.response.status === 204 && (after.body as { protected?: boolean }).protected === false;
     })),
   done('github.repos.branch_protection_required_checks', 'repos', 'Repos: branch protection PERSISTS its config — required-check contexts, strict, enforce_admins — and serves it back (the merge-gate read path)', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       // GET protection on an unprotected branch → GitHub's 404 "Branch not protected".
-      const bare = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
+      const bare = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
       if (!(bare.status === 404 && (bare.body as { message?: string }).message === 'Branch not protected')) return false;
       // PUT the twin-sdlc-shaped config: four required contexts + enforce_admins.
       const put = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/branches/main/protection`, body: JSON.stringify({
@@ -679,69 +1157,258 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(ok(put.response.status) && putBody.required_status_checks?.contexts?.length === 4 && putBody.enforce_admins?.enabled === true)) return false;
       // The BRANCH summary carries the persisted contexts + the real enforcement_level
       // semantics (everyone == enforce_admins) — exactly what review-prerequisites.ts reads.
-      const branch = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      const branch = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
       const prot = (branch.body as { protection?: { required_status_checks?: { contexts?: string[]; enforcement_level?: string } } }).protection;
       if (!(prot?.required_status_checks?.contexts?.includes('agent-review') && prot.required_status_checks.enforcement_level === 'everyone')) return false;
       // Sub-resource reads + PATCH round-trip; enforce_admins DELETE flips the level.
-      const rsc = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection/required_status_checks`, root });
+      const rsc = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection/required_status_checks`, root });
       if (!(ok(rsc.status) && (rsc.body as { contexts?: string[] }).contexts?.length === 4 && (rsc.body as { strict?: boolean }).strict === false)) return false;
       const patched = await applyGithubWrite({ method: 'PATCH', path: `/repos/octo/demo/branches/main/protection/required_status_checks`, body: JSON.stringify({ strict: true, contexts: ['test'] }), root });
       if (!(ok(patched.response.status) && (patched.response.body as { strict?: boolean }).strict === true && (patched.response.body as { contexts?: string[] }).contexts?.length === 1)) return false;
       const dropAdmins = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/branches/main/protection/enforce_admins`, root });
       if (dropAdmins.response.status !== 204) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
       const lvl = (after.body as { protection?: { required_status_checks?: { enforcement_level?: string } } }).protection?.required_status_checks?.enforcement_level;
       if (lvl !== 'non_admins') return false;
       // Protection SURVIVES a branch delete→re-create (real GitHub: classic protection is a
       // repo-level pattern rule — deleting `main` and re-pushing it comes back protected).
-      const mainSha = (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root }).body as { commit?: { sha?: string } }).commit?.sha ?? 'a'.repeat(40);
+      const mainSha = ((await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root })).body as { commit?: { sha?: string } }).commit?.sha ?? 'a'.repeat(40);
       await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/git/refs`, body: JSON.stringify({ ref: 'refs/heads/main', sha: mainSha }), root });
       const delRef = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/git/refs/heads/main`, root });
       if (delRef.response.status !== 204) return false;
       const recreate = await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/git/refs`, body: JSON.stringify({ ref: 'refs/heads/main', sha: 'b'.repeat(40) }), root });
       if (recreate.response.status !== 201) return false;
-      const survived = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
+      const survived = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
       if (!(ok(survived.status) && ((survived.body as { required_status_checks?: { contexts?: string[] } }).required_status_checks?.contexts?.length === 1))) return false;
       // DELETE protection → the summary reads off again (and protection GET 404s).
       await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/branches/main/protection`, root });
-      const off = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
+      const off = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main/protection`, root });
       return off.status === 404;
     })),
-  todo('github.repos.protection_required_reviews_enforced', 'repos', 'Repos: required_pull_request_reviews ENFORCED on merge (config persists; merge does not yet refuse on it)', 'api', 'niche'),
-  done('github.repos.collaborators', 'repos', 'Repos: collaborators + permissions', 'api', 'common', () =>
+  done('github.repos.protection_required_reviews_enforced', 'repos', 'Repos: required_pull_request_reviews enforced on merge: approvals from reviewers with write access, admins exempt unless enforce_admins', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const ada = await mintToken(root, 'ada');
+      await collaborator(root, HISTORY_REPO, 'ada', 'push');
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/branches/main/protection`, body: JSON.stringify({ required_status_checks: null, enforce_admins: false, required_pull_request_reviews: { required_approving_review_count: 1 }, restrictions: null }), root });
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/b', sha: main }), root, token: ada });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'b', content: Buffer.from('b\n').toString('base64'), branch: 'b' }), root, token: ada });
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'b', base: 'main' }), root, token: ada })).response.body as { number: number };
+      const merge = (token?: string) => applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root, ...(token ? { token } : {}) });
+      const refused = await merge(ada);
+      if (refused.response.status !== 405 || (refused.response.body as { message: string }).message !== 'At least 1 approving review is required by reviewers with write access.') return false;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/reviews`, body: JSON.stringify({ event: 'APPROVE' }), root });
+      return (await merge(ada)).response.status === 200;
+    })),
+  done('github.repos.transfer', 'repos', 'Repos: transfer to an organization the admin belongs to: issues, pull requests, releases, workflows and history move under the new name, keeping their ids; a non-admin is refused', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      const issue = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/issues`, body: JSON.stringify({ title: 'moves' }), root })).response.body as { id: number; number: number };
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'new-home' }), root, cookie: await signIn(root) });
+      const bob = await mintToken(root, 'bob');
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/transfer`, body: JSON.stringify({ new_owner: 'new-home' }), root, token: bob })).response.status !== 403) return false;
+      const moved = await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/transfer`, body: JSON.stringify({ new_owner: 'new-home' }), root });
+      if (moved.response.status !== 202 || (moved.response.body as { full_name: string }).full_name !== 'new-home/ci-demo') return false;
+      const got = (await handleGithubRequest({ method: 'GET', path: `/repos/new-home/ci-demo/issues/${issue.number}`, root })).body as { id: number; title: string };
+      const workflows = (await handleGithubRequest({ method: 'GET', path: '/repos/new-home/ci-demo/actions/workflows', root })).body as { total_count: number };
+      await applyGithubWrite({ method: 'PUT', path: '/repos/new-home/ci-demo/contents/.github/workflows/ci.yml', body: JSON.stringify({ message: 'edit', content: Buffer.from(workflowFile('CI', '      - run: npm run lint\n')).toString('base64'), sha: ((await handleGithubRequest({ method: 'GET', path: '/repos/new-home/ci-demo/contents/.github/workflows/ci.yml', root })).body as { sha: string }).sha }), root });
+      const after = (await handleGithubRequest({ method: 'GET', path: '/repos/new-home/ci-demo/actions/workflows', root })).body as { total_count: number };
+      return got.id === issue.id && got.title === 'moves' && workflows.total_count === 1 && after.total_count === 1
+        && (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}`, root })).status !== 200;
+    })),
+  done('github.repos.transfer_leaves_installations', 'repos', 'Repos: a transferred repository leaves the previous owner\'s app installations that selected it, and each app gets installation_repositories removed', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      await applyGithubWrite({ method: 'POST', path: '/_twin/apps', body: JSON.stringify({ slug: 'repo-bot', name: 'Repo Bot', owner: 'octocat', permissions: { contents: 'read' }, events: [], hook_attributes: { url: 'http://127.0.0.1:9/hook' } }), root });
+      await githubAppInstallationFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/apps/repo-bot/installations/new', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie: await signIn(root) }, body: new URLSearchParams({ install: '1', repository_selection: 'selected', repositories: 'ci-demo' }).toString() }));
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'new-home' }), root, cookie: await signIn(root) });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/transfer`, body: JSON.stringify({ new_owner: 'new-home' }), root });
+      const deliveries = (await handleGithubRequest({ method: 'GET', path: '/app/hook/deliveries', root, token: appJwt('repo-bot') })).body as Array<{ id: number; event: string; action: string | null }>;
+      const left = deliveries.find((d) => d.event === 'installation_repositories' && d.action === 'removed');
+      const detail = left && (await handleGithubRequest({ method: 'GET', path: `/app/hook/deliveries/${left.id}`, root, token: appJwt('repo-bot') })).body as { request: { payload: { repositories_removed: Array<{ full_name: string }> } } };
+      return !!detail && detail.request.payload.repositories_removed[0]?.full_name === HISTORY_REPO;
+    })),
+  done('github.repos.collaborators', 'repos', 'Repos: collaborators (invited, then accepted) + permissions', 'api', 'common', () =>
     withRoot(async (root) => {
       const add = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'maintain' }), root });
-      if (add.response.status !== 201) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators`, root });
+      if (add.response.status !== 201 || (add.response.body as { invitee?: { login?: string } }).invitee?.login !== 'alice') return false;
+      // an invitee is not a collaborator until they accept
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root })).status !== 404) return false;
+      if ((await acceptInvitation(root, REPO, 'alice'))?.response.status !== 204) return false;
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const perm = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice/permission`, root });
-      if ((perm.body as { permission?: string }).permission !== 'maintain') return false;
-      const check = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
+      const perm = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice/permission`, root });
+      if ((perm.body as { permission?: string }).permission !== 'write' || (perm.body as { role_name?: string }).role_name !== 'maintain') return false;
+      const check = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
       if (check.status !== 204) return false;
       const rm = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/collaborators/alice`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/collaborators/alice`, root });
       return rm.response.status === 204 && gone.status === 404;
     })),
-  done('github.repos.webhooks', 'repos', 'Repos: webhook config CRUD', 'api', 'common', () =>
+  done('github.repos.webhooks', 'repos', 'Repos: native webhook config CRUD, validation and signing-secret update semantics', 'api', 'common', () =>
     withRoot(async (root) => {
-      const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/hooks`, body: JSON.stringify({ events: ['push', 'pull_request'], config: { url: 'https://e.x/hook', content_type: 'json' } }), root });
-      if (!(c.response.status === 201 && (c.response.body as { events?: string[] }).events?.length === 2)) return false;
-      const id = (c.response.body as { id?: number }).id!;
-      const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/hooks/${id}`, body: JSON.stringify({ active: false }), root });
-      if (!(ok(e.response.status) && (e.response.body as { active?: boolean }).active === false)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/hooks`, root });
-      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/hooks/${id}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/hooks/${id}`, root });
-      return del.response.status === 204 && gone.status === 404;
+      const { createHmac } = await import('node:crypto');
+      const secret = 'config-capability-only-secret';
+      const received: Array<{ headers: Headers; body: string }> = [];
+      const sink = await serveHttp({ port: 0, async fetch(request) { received.push({ headers: request.headers, body: await request.text() }); return new Response(null, { status: 204 }); } });
+      const server = await createGithubTwinServer({ root });
+      const sdk = octoClient({ baseUrl: `http://127.0.0.1:${server.port}` });
+      const api = (method: string, path: string, body?: Record<string, unknown>) => sdk.request(`${method} ${path}`, body === undefined ? undefined : { data: body });
+      const signed = () => { const d = received.at(-1)!; assert.equal(d.headers.get('x-hub-signature-256'), `sha256=${createHmac('sha256', secret).update(d.body).digest('hex')}`); };
+      try {
+        await api('POST', '/orgs/octo/repos', { name: 'demo' });
+        const url = `http://127.0.0.1:${sink.port}/hook`;
+        const hook = (await api('POST', `/repos/${REPO}/hooks`, { events: ['push', 'pull_request'], config: { url, secret } })).data as any;
+        const path = `/repos/${REPO}/hooks/${hook.id}`;
+        await assert.rejects(api('POST', `/repos/${REPO}/hooks`, { events: ['pull_request'], config: { url, secret } }), { status: 422 });
+        const disjoint = (await api('POST', `/repos/${REPO}/hooks`, { events: ['issue_comment'], config: { url, secret } })).data as any;
+        await assert.rejects(api('PATCH', `/repos/${REPO}/hooks/${disjoint.id}`, { add_events: ['push'], config: { secret } }), { status: 422 });
+        assert.deepEqual(((await api('GET', `/repos/${REPO}/hooks/${disjoint.id}`)).data as any).events, ['issue_comment']);
+        await api('DELETE', `/repos/${REPO}/hooks/${disjoint.id}`);
+        const concurrent = await Promise.allSettled([0, 1].map(() => api('POST', `/repos/${REPO}/hooks`, { events: ['*'], config: { url: `${url}/concurrent`, secret } })));
+        assert.equal(concurrent.filter(r => r.status === 'fulfilled').length, 1, 'duplicate admission shares the kernel write lock');
+        const admitted = concurrent.find(r => r.status === 'fulfilled') as PromiseFulfilledResult<any>;
+        await assert.rejects(api('PATCH', `/repos/${REPO}/hooks/${admitted.value.data.id}/config`, { url }), { status: 422 });
+        await api('DELETE', `/repos/${REPO}/hooks/${admitted.value.data.id}`);
+        // Independent native handlers share the filesystem-backed state. Concurrent PATCH
+        // must validate the resulting config and derive add_events under the same lock.
+        const armPath = join(root, 'hook-patch-arm');
+        const reachedPath = join(root, 'hook-patch-reached');
+        const releasePath = join(root, 'hook-patch-release');
+        // Scheduling only: stop before the outermost lock, let the other native writer
+        // finish, then delegate every store operation to the real filesystem implementation.
+        const childSource = `
+          import { createGithubTwinServer } from ${JSON.stringify(new URL('./github-server.ts', import.meta.url).href)};
+          import { FsWorldStore, setActiveWorldStore } from '@volter/world-core';
+          import { existsSync, unlinkSync, writeFileSync } from 'node:fs';
+          import { join } from 'node:path';
+          const root = process.argv[1];
+          class ScheduledStore extends FsWorldStore {
+            withLock(path, fn, opts) {
+              const arm = join(root, 'hook-patch-arm');
+              if (process.argv[2] === '0' && path.endsWith('/branch-ancestry.lock') && existsSync(arm) && /decideAndAppendAction|applyTwinWriteAtomic/.test(new Error().stack ?? '')) {
+                unlinkSync(arm);
+                writeFileSync(join(root, 'hook-patch-reached'), 'reached');
+                const until = Date.now() + 5000;
+                while (!existsSync(join(root, 'hook-patch-release'))) {
+                  if (Date.now() >= until) throw new Error('Native PATCH scheduling barrier timed out');
+                  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+                }
+              }
+              return super.withLock(path, fn, opts);
+            }
+          }
+          setActiveWorldStore(new ScheduledStore());
+          const server = await createGithubTwinServer({ root }); console.log(server.port);
+        `;
+        const children: ReturnType<typeof Bun.spawn>[] = [];
+        const clients: ReturnType<typeof octoClient>[] = [];
+        try {
+          for (let i = 0; i < 2; i++) {
+            const child = Bun.spawn(['bun', '--eval', childSource, root, String(i)], { stdout: 'pipe', stderr: 'ignore', env: process.env });
+            children.push(child);
+            const reader = (child.stdout as ReadableStream<Uint8Array>).getReader();
+            const first = await reader.read(); reader.releaseLock();
+            const port = Number(new TextDecoder().decode(first.value).trim());
+            assert.ok(Number.isInteger(port) && port > 0);
+            clients.push(octoClient({ baseUrl: `http://127.0.0.1:${port}` }));
+          }
+          const a = (await api('POST', `/repos/${REPO}/hooks`, { events: ['push'], config: { url: `${url}/race-a`, secret } })).data as any;
+          const b = (await api('POST', `/repos/${REPO}/hooks`, { events: ['issues'], config: { url: `${url}/race-b`, secret } })).data as any;
+          const racePath = `/repos/${REPO}/hooks/${a.id}`;
+          const interleave = async (pausedBody: Record<string, unknown>, competingPath: string, competingBody: Record<string, unknown>) => {
+            for (const path of [armPath, reachedPath, releasePath]) rmSync(path, { force: true });
+            writeFileSync(armPath, 'armed');
+            const pending = clients[0]!.request(`PATCH ${racePath}`, { data: pausedBody }).then(
+              (response: { status: number }) => ({ status: response.status }),
+              (error: { status: number }) => ({ status: error.status }),
+            );
+            try {
+              const until = Date.now() + 5000;
+              while (!existsSync(reachedPath)) {
+                assert.ok(Date.now() < until, 'child must reach the pre-lock scheduling barrier');
+                await new Promise(resolve => setTimeout(resolve, 10));
+              }
+              assert.equal((await clients[1]!.request(`PATCH ${competingPath}`, { data: competingBody })).status, 200);
+            } finally { writeFileSync(releasePath, 'released'); }
+            return pending;
+          };
+          assert.equal((await interleave({ add_events: ['issues'], config: { secret } }, racePath, { add_events: ['issue_comment'], config: { secret } })).status, 200);
+          assert.deepEqual(((await api('GET', racePath)).data as any).events.sort(), ['push', 'issues', 'issue_comment'].sort(), 'relative events use state after the competing write');
+          await api('PATCH', racePath, { events: ['push'], config: { url: `${url}/race-a`, secret } });
+          assert.equal((await interleave({ events: ['issues'], config: { secret } }, `${racePath}/config`, { url: `${url}/race-b` })).status, 422, 'duplicate validation uses the competing writer’s current URL');
+          const afterConflict = (await api('GET', racePath)).data as any;
+          assert.equal(afterConflict.config.url, `${url}/race-b`); assert.deepEqual(afterConflict.events, ['push']);
+
+          for (let round = 0; round < 12; round++) {
+            await api('PATCH', racePath, { events: ['push'], config: { url: `${url}/race-a`, secret } });
+            const attempted = await Promise.allSettled([
+              clients[0]!.request(`PATCH ${racePath}/config`, { data: { url: `${url}/race-b` } }),
+              clients[1]!.request(`PATCH ${racePath}`, { data: { events: ['issues'], config: { secret } } }),
+            ]);
+            assert.equal(attempted.filter(r => r.status === 'fulfilled').length, 1, 'concurrent config and events cannot produce a duplicate');
+            const rejected = attempted.find(r => r.status === 'rejected') as PromiseRejectedResult;
+            assert.equal(rejected.reason.status, 422);
+            const stored = (await api('GET', racePath)).data as any;
+            assert.ok(!(stored.config.url === `${url}/race-b` && stored.events.includes('issues')));
+          }
+          await api('PATCH', racePath, { events: ['push'], config: { url: `${url}/race-a`, secret } });
+          for (const pair of [['issues', 'issue_comment'], ['pull_request', 'pull_request_review'], ['create', 'delete'], ['release', 'fork']]) {
+            const writes = await Promise.all(pair.map((event, index) => clients[index]!.request(`PATCH ${racePath}`, { data: { add_events: [event], config: { secret } } })));
+            assert.ok(writes.every((w: { status: number }) => w.status === 200));
+            const stored = (await api('GET', racePath)).data as any;
+            assert.ok(pair.every(event => stored.events.includes(event)), 'relative event additions retain both concurrent updates');
+          }
+          await api('DELETE', racePath); await api('DELETE', `/repos/${REPO}/hooks/${b.id}`);
+        } finally {
+          for (const child of children) child.kill();
+          await Promise.all(children.map(child => child.exited));
+        }
+
+        assert.equal(hook.config.content_type, 'form');
+        assert.ok(!JSON.stringify(hook).includes(secret));
+        await api('POST', `${path}/pings`);
+        const form = received.at(-1)!;
+        assert.equal(form.headers.get('content-type'), 'application/x-www-form-urlencoded');
+        assert.ok(JSON.parse(new URLSearchParams(form.body).get('payload')!).hook_id === hook.id);
+        signed();
+        const config = (await api('PATCH', `${path}/config`, { content_type: 'json' })).data as any;
+        assert.equal(config.secret, '********');
+        await api('POST', `${path}/pings`); signed();
+        assert.equal(received.at(-1)!.headers.get('content-type'), 'application/json');
+        const edited = (await api('PATCH', path, { active: false, add_events: ['issue_comment'], remove_events: ['push'] })).data as any;
+        assert.equal(edited.active, false);
+        assert.deepEqual(edited.events, ['pull_request', 'issue_comment']);
+        await api('POST', `${path}/pings`);
+        assert.equal(received.at(-1)!.headers.get('x-hub-signature-256'), null, 'full-hook PATCH omission removes secret');
+        await api('PATCH', `${path}/config`, { secret });
+        await api('POST', `${path}/pings`); signed();
+        await api('PATCH', `${path}/config`, { secret: '' });
+        await api('POST', `${path}/pings`);
+        assert.equal(received.at(-1)!.headers.get('x-hub-signature-256'), null, 'explicit empty clears secret');
+        for (const invalid of [{ config: { url: 'file:///tmp/not-a-hook' } }, { config: { url, content_type: 'xml' } }, { config: { url, secret: 42 } }, { name: 'other', config: { url } }, { events: 'push', config: { url } }, { events: [3], config: { url } }, { active: 'true', config: { url } }]) {
+          await assert.rejects(api('POST', `/repos/${REPO}/hooks`, invalid), { status: 422 });
+        }
+        await assert.rejects(api('POST', `/repos/${REPO}/hooks`, { config: { url, insecure_ssl: '1' } }), { status: 501 });
+        await assert.rejects(api('PATCH', `${path}/config`, { insecure_ssl: 1 }), { status: 501 });
+        await assert.rejects(api('PATCH', `${path}/config`, { insecure_ssl: 'invalid' }), { status: 422 });
+        assert.equal(((await api('GET', `/repos/${REPO}/hooks`)).data as any[]).length, 1, 'invalid creates never store hooks');
+        for (const route of [path, `${path}/config`, '/twin/store/mirror']) assert.ok(!JSON.stringify((await api('GET', route)).data).includes(secret));
+        await assert.rejects(api('DELETE', `${path}/config`), { status: 404 });
+        await assert.rejects(api('PATCH', `${path}/config/extra`, { secret }), { status: 404 });
+        assert.equal((await api('DELETE', path)).status, 204);
+        await assert.rejects(api('GET', path), { status: 404 });
+        return true;
+      } finally { server.stop(); sink.stop(true); }
     })),
   done('github.repos.topics', 'repos', 'Repos: topics', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       const set = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/topics`, body: JSON.stringify({ names: ['ai', 'twin'] }), root });
       if (!(ok(set.response.status) && (set.response.body as { names?: string[] }).names?.length === 2)) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/topics`, root });
-      const onRepo = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/topics`, root });
+      const onRepo = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo`, root });
       return ok(get.status) && (get.body as { names?: string[] }).names?.includes('twin') === true && (onRepo.body as { topics?: string[] }).topics?.length === 2;
     })),
   done('github.repos.forks', 'repos', 'Repos: forks list/create', 'api', 'common', () =>
@@ -749,7 +1416,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       const f = await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/forks`, body: JSON.stringify({ organization: 'me' }), root });
       if (!(f.response.status === 202 && (f.response.body as { fork?: boolean }).fork === true && (f.response.body as { full_name?: string }).full_name === 'me/demo')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/forks`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/forks`, root });
       return ok(list.status) && isArr(list.body) && list.body.length === 1;
     })),
   done('github.repos.contents', 'repos', 'Repos: contents API (get/put/delete file objects)', 'api', 'common', () =>
@@ -757,16 +1424,15 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const content = Buffer.from('hello world').toString('base64');
       const put = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'add', content }), root });
       if (!(put.response.status === 201 && (put.response.body as { content?: { path?: string } }).content?.path === 'README.md')) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
       if (!(ok(get.status) && (get.body as { content?: string }).content === content && (get.body as { encoding?: string }).encoding === 'base64')) return false;
       const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'upd', content: Buffer.from('v2').toString('base64') }), root });
       if (upd.response.status !== 200) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/contents/README.md`, body: JSON.stringify({ message: 'rm' }), root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contents/README.md`, root });
       return ok(del.response.status) && gone.status === 404;
     })),
-  outOfScope('github.repos.blob_bytes', 'repos', 'Repos: raw file/blob BYTES (git object contents)', 'api', 'niche',
-    'Out of scope: actual repository code/file contents are large + redundant; the metadata/API objects are modeled; the bytes are out of scope.'),
+  todo('github.repos.blob_bytes', 'repos', 'Repos: serve raw file/blob BYTES (git object contents) for stored files, not only the metadata objects', 'api', 'niche'),
 
   // ── Git Data API ─────────────────────────────────────────────────────────────────────────
   done('github.git.refs', 'git', 'Git Data: refs (create/get/update/delete branches+tags)', 'api', 'niche', () =>
@@ -783,15 +1449,15 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const dup = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha }), root });
       if (dup.response.status !== 422) return false;
       // get one via .../git/ref/:ref; update its sha (PATCH); delete (DELETE) then 404.
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
       if (!(ok(get.status) && (get.body as { object?: { sha?: string } }).object?.sha === sha)) return false;
       const sha2 = 'b'.repeat(40);
       const upd = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/git/refs/heads/feat`, body: JSON.stringify({ sha: sha2 }), root });
       if (!(upd.response.status === 200 && (upd.response.body as { object?: { sha?: string } }).object?.sha === sha2)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/heads`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/heads`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/git/refs/heads/feat`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
       if (!(del.response.status === 204 && gone.status === 404)) return false;
       // Dirty-state pin (§9): delete → RE-CREATE must resurrect, not stay tombstoned forever
       // (the delete→re-push flow; a permanent tombstone once made recreated refs invisible
@@ -800,7 +1466,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const sha3 = 'c'.repeat(40);
       const again = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha: sha3 }), root });
       if (again.response.status !== 201) return false;
-      const back = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
+      const back = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/ref/heads/feat`, root });
       return ok(back.status) && (back.body as { object?: { sha?: string } }).object?.sha === sha3;
     })),
   done('github.git.commits', 'git', 'Git Data: commit objects (get/create; REAL git shas)', 'api', 'niche', () =>
@@ -817,7 +1483,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const sha = (c.response.body as { sha?: string }).sha!;
       // The sha is a REAL git object id (the plane stored a real commit object under it).
       if (!/^[0-9a-f]{40}$/.test(sha)) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/commits/${sha}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/commits/${sha}`, root });
       const b = get.body as { tree?: { sha?: string }; parents?: unknown[]; author?: { name?: string } };
       return ok(get.status) && b.tree?.sha === tree && b.parents?.length === 1 && b.author?.name === 'Ann';
     })),
@@ -829,7 +1495,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/trees`, body: JSON.stringify({ tree: [{ path: 'a.ts', mode: '100644', type: 'blob', sha: blobSha }] }), root });
       if (c.response.status !== 201) return false;
       const sha = (c.response.body as { sha?: string }).sha!;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/trees/${sha}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/trees/${sha}`, root });
       const entries = (get.body as { tree?: Array<{ path?: string; type?: string }> }).tree ?? [];
       return ok(get.status) && entries.length === 1 && entries[0]!.path === 'a.ts' && entries[0]!.type === 'blob';
     })),
@@ -841,7 +1507,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/blobs`, body: JSON.stringify({ content, encoding: 'base64' }), root });
       if (c.response.status !== 201) return false;
       const sha = (c.response.body as { sha?: string }).sha!;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/blobs/${sha}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/blobs/${sha}`, root });
       const b = get.body as { content?: string; encoding?: string; size?: number };
       return ok(get.status) && b.content === content && b.encoding === 'base64' && b.size === Buffer.from('hello blob').length;
     })),
@@ -853,7 +1519,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/tags`, body: JSON.stringify({ tag: 'v1.0.0', message: 'release', object: objSha, type: 'commit', tagger: { name: 'Ann' } }), root });
       if (!(c.response.status === 201 && (c.response.body as { tag?: string }).tag === 'v1.0.0')) return false;
       const sha = (c.response.body as { sha?: string }).sha!;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/tags/${sha}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/tags/${sha}`, root });
       const b = get.body as { object?: { sha?: string; type?: string }; message?: string };
       if (!(ok(get.status) && b.object?.sha === objSha && b.message === 'release')) return false;
       // creating a refs/tags ref pointing at the annotated tag → object.type 'tag'.
@@ -899,16 +1565,16 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const { tmpdir: osTmp } = await import('node:os');
       const { join: j } = await import('node:path');
       const work = mkTmp(j(osTmp(), 'gh-cap-git-'));
-      const server = createGithubTwinServer({ root });
+      const server = await createGithubTwinServer({ root });
       const deliveries: Array<Record<string, unknown>> = [];
-      const hook = Bun.serve({ port: 0, async fetch(req) { deliveries.push({ event: req.headers.get('x-github-event'), ...(await req.json() as Record<string, unknown>) }); return new Response('ok'); } });
-      clearGithubWebhooks();
-      registerGithubWebhook(`http://127.0.0.1:${hook.port}/hook`);
+      const hook = await serveHttp({ port: 0, async fetch(req) { deliveries.push({ event: req.headers.get('x-github-event'), ...(await req.json() as Record<string, unknown>) }); return new Response('ok'); } });
       try {
         const base = `http://127.0.0.1:${server.port}`;
         // Creating the repo over REST initializes its REAL bare repo; the clone sees it empty.
         const created = await fetch(`${base}/orgs/octo/repos`, { method: 'POST', body: JSON.stringify({ name: 'demo' }) });
         if (created.status !== 201) return false;
+        const registered = await fetch(`${base}/repos/octo/demo/hooks`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'web', events: ['push'], config: { url: `http://127.0.0.1:${hook.port}/hook`, content_type: 'json' } }) });
+        if (registered.status !== 201) return false;
         if ((await gitc(work, 'clone', `${base}/octo/demo.git`, 'c1')).code !== 0) return false;
         const c1 = j(work, 'c1');
         writeTmp(j(c1, 'a.txt'), 'clone-push\n');
@@ -917,17 +1583,17 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
         if ((await gitc(c1, 'push', 'origin', 'HEAD:refs/heads/main')).code !== 0) return false;
         const tip = (await gitc(c1, 'rev-parse', 'HEAD')).stdout;
         // REST agreement: ref, commit object (plane fallback), branch tip — all the PUSHED sha.
-        const ref = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/git/ref/heads/main`, root });
+        const ref = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/git/ref/heads/main`, root });
         if (!(ok(ref.status) && (ref.body as { object?: { sha?: string } }).object?.sha === tip)) return false;
-        const commit = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/git/commits/${tip}`, root });
+        const commit = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/git/commits/${tip}`, root });
         if (!(ok(commit.status) && (commit.body as { message?: string }).message === 'first')) return false;
-        const branch = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
+        const branch = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/branches/main`, root });
         if (!(ok(branch.status) && (branch.body as { commit?: { sha?: string } }).commit?.sha === tip)) return false;
         // The push rode the EXISTING webhook pipeline: a `push` delivery with ref/before/after.
         const push = deliveries.find((d) => d.event === 'push' && d.ref === 'refs/heads/main');
         return push !== undefined && push.before === '0'.repeat(40) && push.after === tip;
       } finally {
-        server.stop(); hook.stop(true); clearGithubWebhooks(); rmTmp(work, { recursive: true, force: true });
+        server.stop(); hook.stop(true); rmTmp(work, { recursive: true, force: true });
       }
     })),
   done('github.git.rest_authored_chain_fetchable', 'git', 'Git Data REST ↔ protocol agreement: a REST blob→tree→commit→ref chain is fetchable by real git; a dangling ref is NOT advertised', 'api', 'core', () =>
@@ -936,7 +1602,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const { tmpdir: osTmp } = await import('node:os');
       const { join: j } = await import('node:path');
       const work = mkTmp(j(osTmp(), 'gh-cap-chain-'));
-      const server = createGithubTwinServer({ root });
+      const server = await createGithubTwinServer({ root });
       try {
         const base = `http://127.0.0.1:${server.port}`;
         await fetch(`${base}/orgs/octo/repos`, { method: 'POST', body: JSON.stringify({ name: 'demo' }) });
@@ -980,7 +1646,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const { tmpdir: osTmp } = await import('node:os');
       const { join: j } = await import('node:path');
       const work = mkTmp(j(osTmp(), 'gh-cap-sync-'));
-      const server = createGithubTwinServer({ root });
+      const server = await createGithubTwinServer({ root });
       try {
         const base = `http://127.0.0.1:${server.port}`;
         await fetch(`${base}/orgs/octo/repos`, { method: 'POST', body: JSON.stringify({ name: 'demo' }) });
@@ -1002,14 +1668,57 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
         if ((await gitc(c1, 'push', 'origin', 'HEAD:refs/heads/topic')).code !== 0) return false;
         const tip2 = (await gitc(c1, 'rev-parse', 'HEAD')).stdout;
         if (tip1 === tip2) return false;
-        const after = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/pulls/${n}`, root });
+        const after = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/pulls/${n}`, root });
         return ok(after.status) && (after.body as { head?: { sha?: string } }).head?.sha === tip2;
       } finally {
         server.stop(); rmTmp(work, { recursive: true, force: true });
       }
     })),
   todo('github.git.protected_branch_push_rules', 'git', 'Git smart-HTTP: receive-pack enforces branch protection (force-push/deletion refusal on protected branches)', 'api', 'niche'),
-  todo('github.repos.contents_backed_by_git_plane', 'repos', 'Repos: the contents API (PUT/DELETE .../contents/:path) writes REAL git objects + moves the branch ref — today it is still a disconnected side-store the git plane never sees', 'api', 'common'),
+  done('github.repos.contents_backed_by_git_plane', 'repos', 'Repos: Contents edits update Git objects and branch refs, preserving other branches and historical reads', 'api', 'common', () =>
+    withRoot(async root => {
+      const write = async (method: string, path: string, body: unknown) => (await applyGithubWrite({ method, path, body: JSON.stringify(body), root })).response;
+      const read = async (path: string) => { const r = await handleGithubRequest({ method: 'GET', path, root }); return { ...r, body: r.body as { content?: string; object?: { sha?: string } } }; };
+      await write('POST', '/orgs/octo/repos', { name: 'contents-proof' });
+      const path = '/repos/octo/contents-proof';
+      const first = await write('PUT', `${path}/contents/a.txt`, { message: 'base', content: Buffer.from('base').toString('base64') });
+      const start = first.body as { content?: { sha: string }; commit?: { sha: string } };
+      if (first.status !== 201 || !start.content?.sha || !start.commit?.sha) return false;
+      if ((await write('POST', `${path}/git/refs`, { ref: 'refs/heads/topic', sha: start.commit.sha })).status !== 201) return false;
+      const committer = { name: 'Committer', email: 'committer@example.test', date: '2025-02-03T04:05:06Z' };
+      const edit = await write('PUT', `${path}/contents/a.txt`, { branch: 'topic', message: 'edit', committer, sha: start.content.sha, content: Buffer.from('topic').toString('base64') });
+      const changed = edit.body as { content?: { sha: string }; commit?: { sha: string } };
+      if (edit.status !== 200 || !changed.content?.sha || !changed.commit?.sha || changed.commit.sha === start.commit.sha) return false;
+      for (const ref of ['main', start.commit.sha]) if ((await read(`${path}/contents/a.txt?ref=${ref}`)).body?.content !== Buffer.from('base').toString('base64')) return false;
+      if ((await read(`${path}/git/ref/heads/topic`)).body?.object?.sha !== changed.commit.sha) return false;
+      const server = await createGithubTwinServer({ root }); const work = mkdtempSync(join(tmpdir(), 'gh-contents-proof-'));
+      try {
+        if ((await gitc(work, 'clone', '-q', `http://127.0.0.1:${server.port}/octo/contents-proof.git`, 'clone')).code !== 0) return false;
+        if ((await gitc(join(work, 'clone'), 'show', 'origin/topic:a.txt')).stdout !== 'topic') return false;
+        if ((await gitc(join(work, 'clone'), 'show', 'HEAD:a.txt')).stdout !== 'base') return false;
+        const identity = (await gitc(join(work, 'clone'), 'show', '-s', '--format=%an|%ae|%aI|%cn|%ce|%cI', changed.commit.sha)).stdout.replaceAll('+00:00', 'Z');
+        assert.equal(identity, 'Committer|committer@example.test|2025-02-03T04:05:06Z|Committer|committer@example.test|2025-02-03T04:05:06Z', 'Contents commit identity and date defaults');
+        const pr = await write('POST', `${path}/pulls`, { head: 'topic', base: 'main', title: 'Contents proof' });
+        assert.equal(pr.status, 201);
+        const continuation = await applyGithubWrite({ method: 'PUT', path: `${path}/contents/extra.txt`, body: JSON.stringify({ branch: 'topic', message: 'continue PR', content: 'eA==' }), root });
+        const continuationSha = (continuation.response.body as { commit: { sha: string } }).commit.sha;
+        assert.equal(continuation.response.status, 201);
+        assert.ok(continuation.webhooks?.some(e => e.event === 'push' && e.ref === 'refs/heads/topic' && e.before === changed.commit!.sha && e.after === continuationSha), 'Contents push ref/before/after');
+        assert.ok(continuation.webhooks?.some(e => e.event === 'pull_request' && e.action === 'synchronize' && e.number === (pr.body as { number: number }).number), 'Contents PR synchronize');
+        if ((await write('PUT', `${path}/contents/a.txt`, { branch: 'topic', message: 'stale', sha: start.content.sha, content: 'YmFk' })).status !== 409) return false;
+        if ((await write('DELETE', `${path}/contents/a.txt`, { branch: 'topic', message: 'delete', sha: changed.content.sha })).status !== 200) return false;
+        if ((await read(`${path}/contents/a.txt?ref=topic`)).status !== 404 || (await read(`${path}/contents/a.txt?ref=${changed.commit.sha}`)).body?.content !== Buffer.from('topic').toString('base64')) return false;
+        assert.equal((await write('PUT', `${path}/contents/a.txt`, { branch: 'topic', message: 'recreate', content: 'cmVjcmVhdGVk' })).status, 201);
+        assert.ok(githubState(root).contents.some(f => f.repository === 'octo/contents-proof' && f.branch === 'topic' && f.path === 'a.txt' && f.content_b64 === 'cmVjcmVhdGVk'), 'Contents recreation clears mirror tombstone');
+        const tree = await write('POST', `${path}/git/trees`, { tree: [{ path: 'submodule', mode: '160000', type: 'commit', sha: start.commit.sha }] });
+        const gitlink = await write('POST', `${path}/git/commits`, { message: 'gitlink', tree: (tree.body as { sha: string }).sha, parents: [start.commit.sha] });
+        const gitlinkSha = (gitlink.body as { sha: string }).sha;
+        assert.equal((await write('PATCH', `${path}/git/refs/heads/main`, { sha: gitlinkSha })).status, 200);
+        for (const p of ['submodule', 'submodule/child.txt']) assert.equal((await write('PUT', `${path}/contents/${p}`, { message: 'collision', content: 'eQ==' })).status, 422, `Contents submodule collision: ${p}`);
+        assert.equal((await read(`${path}/git/ref/heads/main`)).body?.object?.sha, gitlinkSha, 'Contents refusal preserves ref');
+        return true;
+      } finally { server.stop(); rmSync(work, { recursive: true, force: true }); }
+    })),
   todo('github.git.trees_recursive_param', 'git', 'Git Data: GET .../git/trees/:sha?recursive=1 (full recursive listing)', 'api', 'niche'),
   todo('github.git.shallow_partial_clone', 'git', 'Git smart-HTTP: shallow (--depth) + partial (--filter) clones asserted end-to-end (upload-pack supports them natively; unasserted)', 'api', 'niche'),
   todo('github.git.lfs', 'git', 'Git LFS: the batch API + object storage', 'api', 'niche'),
@@ -1023,43 +1732,54 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const id = (c.response.body as { id?: number; tag_name?: string }).id!;
       if ((c.response.body as { html_url?: string }).html_url?.includes('releases/tag/v1.0.0') !== true) return false;
       // GET one, by id, asserting tag_name/name round-trip.
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
       if (!(ok(one.status) && (one.body as { tag_name?: string }).tag_name === 'v1.0.0' && (one.body as { name?: string }).name === 'First')) return false;
       // GET latest (published) + GET by tag.
-      const latest = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/latest`, root });
-      const byTag = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/tags/v1.0.0`, root });
+      const latest = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/latest`, root });
+      const byTag = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/tags/v1.0.0`, root });
       if (!(ok(latest.status) && (latest.body as { tag_name?: string }).tag_name === 'v1.0.0' && ok(byTag.status) && (byTag.body as { id?: number }).id === id)) return false;
       // PATCH (edit name) round-trips; list returns the release; DELETE 204s then 404s.
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/releases/${id}`, body: JSON.stringify({ name: 'Renamed' }), root });
       if (!(ok(e.response.status) && (e.response.body as { name?: string }).name === 'Renamed')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/releases/${id}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${id}`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
-  done('github.releases.assets', 'releases', 'Releases: assets register/list/get (metadata; bytes out of scope)', 'api', 'common', () =>
+  done('github.releases.assets', 'releases', 'Releases: an asset uploaded as its raw bytes with its Content-Type to the release\'s upload_url on uploads.github.com (the API host 404s; a second of one name refused); list/get', 'api', 'common', () =>
     withRoot(async (root) => {
       const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v2', name: 'Two' }), root });
       const relId = (r.response.body as { id?: number }).id!;
-      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases/${relId}/assets`, body: JSON.stringify({ name: 'app.zip', content_type: 'application/zip', size: 1024 }), root });
-      if (!(a.response.status === 201 && (a.response.body as { name?: string }).name === 'app.zip' && (a.response.body as { size?: number }).size === 1024)) return false;
+      const a = await applyGithubWrite({ method: 'POST', path: `https://uploads.github.com/repos/${REPO}/releases/${relId}/assets?name=app.zip`, body: 'z'.repeat(1024), contentType: 'application/zip', root });
+      if (!(a.response.status === 201 && (a.response.body as { name?: string }).name === 'app.zip' && (a.response.body as { size?: number }).size === 1024 && (a.response.body as { content_type?: string }).content_type === 'application/zip')) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: `https://uploads.github.com/repos/${REPO}/releases/${relId}/assets?name=app.zip`, body: 'z', contentType: 'application/zip', root })).response.status !== 422) return false;
+      // the upload is served on the release's upload_url host, not the API's
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases/${relId}/assets?name=app2.zip`, body: 'z', contentType: 'application/zip', root })).response.status !== 404) return false;
+      if ((r.response.body as { upload_url?: string }).upload_url !== `https://uploads.github.com/repos/${REPO}/releases/${relId}/assets{?name,label}`) return false;
       const assetId = (a.response.body as { id?: number }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}/assets`, root });
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/assets/${assetId}`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}/assets`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/assets/${assetId}`, root });
       // The asset rides on the release object too (assets:[...]).
-      const rel = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}`, root });
+      const rel = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/releases/${relId}`, root });
       return ok(list.status) && isArr(list.body) && list.body.length === 1 && ok(one.status) && (one.body as { name?: string }).name === 'app.zip'
         && ok(rel.status) && ((rel.body as { assets?: unknown[] }).assets?.length === 1);
     })),
+  done('github.repos.license_template', 'repos', 'Repos: license_template commits the license GitHub serves, its year and holder filled', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'licensed', license_template: 'mit' }), root, occurredAt: '2026-01-05T09:00:00Z' });
+      const file = await handleGithubRequest({ method: 'GET', path: '/repos/octocat/licensed/contents/LICENSE', root });
+      const text = Buffer.from(String((file.body as { content?: string }).content ?? ''), 'base64').toString();
+      return ok(file.status) && text.startsWith('The MIT License (MIT)\n\nCopyright (c) 2026 ') && !text.includes('[year]') && !text.includes('[fullname]') && text.includes('Permission is hereby granted');
+    })),
   done('github.tags.list', 'releases', 'Tags: list (GET /tags) + git refs (GET /git/refs/tags)', 'api', 'common', () =>
     withRoot(async (root) => {
       // A published release creates its tag; a draft does NOT (real GitHub behavior).
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v3.0.0', name: 'Three' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v4.0.0-draft', name: 'Draft', draft: true }), root });
-      const tags = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/tags`, root });
+      const tags = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/tags`, root });
       if (!(ok(tags.status) && isArr(tags.body) && tags.body.length === 1 && (tags.body[0] as { name?: string }).name === 'v3.0.0')) return false;
-      const ref = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/tags/v3.0.0`, root });
+      const ref = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/git/refs/tags/v3.0.0`, root });
       return ok(ref.status) && (ref.body as { ref?: string }).ref === 'refs/tags/v3.0.0' && (ref.body as { object?: { type?: string } }).object?.type === 'commit';
     })),
 
@@ -1067,73 +1787,73 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   done('github.projects.crud', 'projects', 'Projects v2: project CRUD', 'api', 'niche', () =>
     withRoot(async (root) => {
       // missing title 422s; create → 201 with number 1; get by number; PATCH closes; DELETE → gone.
-      if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: '{}', root })).response.status !== 422) return false;
-      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'Roadmap', short_description: 'Q3' }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/_twin/orgs/octo/projectsV2`, body: '{}', root })).response.status !== 422) return false;
+      const c = await applyGithubWrite({ method: 'POST', path: `/_twin/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'Roadmap', short_description: 'Q3' }), root });
       if (!(c.response.status === 201 && (c.response.body as { number?: number }).number === 1)) return false;
       const pid = (c.response.body as { id?: number }).id!;
-      const byNum = handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2/1`, root });
+      const byNum = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2/1`, root });
       if (!(ok(byNum.status) && (byNum.body as { title?: string }).title === 'Roadmap')) return false;
-      const e = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}`, body: JSON.stringify({ closed: true, title: 'Done' }), root });
+      const e = await applyGithubWrite({ method: 'PATCH', path: `/_twin/projectsV2/${pid}`, body: JSON.stringify({ closed: true, title: 'Done' }), root });
       if (!(ok(e.response.status) && (e.response.body as { closed?: boolean }).closed === true && (e.response.body as { title?: string }).title === 'Done')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/projectsV2`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/_twin/projectsV2/${pid}`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
   done('github.projects.items', 'projects', 'Projects v2: items add/remove + field values', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/_twin/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
       const pid = (c.response.body as { id?: number }).id!;
       // a draft item needs a title (422 without); add → 201; a status field value sets via PATCH.
-      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: '{}', root })).response.status !== 422) return false;
-      const add = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Ship it' }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/items`, body: '{}', root })).response.status !== 422) return false;
+      const add = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Ship it' }), root });
       if (!(add.response.status === 201 && (add.response.body as { content_type?: string }).content_type === 'DraftIssue')) return false;
       const iid = (add.response.body as { id?: number }).id!;
-      const linked = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'Issue', content_id: 42, content_repository: 'octo/demo' }), root });
+      const linked = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'Issue', content_id: 42, content_repository: 'octo/demo' }), root });
       if (linked.response.status !== 201) return false;
-      const setv = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${iid}`, body: JSON.stringify({ field_id: 'status', value: 'In Progress' }), root });
+      const setv = await applyGithubWrite({ method: 'PATCH', path: `/_twin/projectsV2/${pid}/items/${iid}`, body: JSON.stringify({ field_id: 'status', value: 'In Progress' }), root });
       if (!(ok(setv.response.status) && (setv.response.body as { field_values?: Record<string, unknown> }).field_values?.status === 'In Progress')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/items`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/items`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/items/${iid}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/items`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/_twin/projectsV2/${pid}/items/${iid}`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/items`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
     })),
   done('github.projects.fields', 'projects', 'Projects v2: custom fields (status/iteration/single-select)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/_twin/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
       const pid = (c.response.body as { id?: number }).id!;
       // missing data_type 422s; an invalid type 422s; single-select carries options; iteration carries config.
-      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X' }), root })).response.status !== 422) return false;
-      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X', data_type: 'nope' }), root })).response.status !== 422) return false;
-      const ss = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done', color: 'GREEN' }] }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'X', data_type: 'nope' }), root })).response.status !== 422) return false;
+      const ss = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done', color: 'GREEN' }] }), root });
       if (!(ss.response.status === 201 && (ss.response.body as { options?: unknown[] }).options?.length === 2)) return false;
-      const it = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Sprint', data_type: 'iteration', iterations: [{ title: 'S1', duration: 14 }] }), root });
+      const it = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Sprint', data_type: 'iteration', iterations: [{ title: 'S1', duration: 14 }] }), root });
       if (!(it.response.status === 201 && (((it.response.body as { configuration?: { iterations?: unknown[] } }).configuration?.iterations?.length) === 1))) return false;
       const fid = (ss.response.body as { id?: number }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/fields`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/fields`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/fields/${fid}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/fields`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/_twin/projectsV2/${pid}/fields/${fid}`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/fields`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
     })),
   done('github.projects.views', 'projects', 'Projects v2: views (board/table/roadmap)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
+      const c = await applyGithubWrite({ method: 'POST', path: `/_twin/orgs/octo/projectsV2`, body: JSON.stringify({ title: 'P' }), root });
       const pid = (c.response.body as { id?: number }).id!;
       // an invalid layout 422s; board/table/roadmap each create; PATCH relayouts; DELETE removes.
-      if ((await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'V', layout: 'pie' }), root })).response.status !== 422) return false;
-      const board = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
+      if ((await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'V', layout: 'pie' }), root })).response.status !== 422) return false;
+      const board = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
       if (!(board.response.status === 201 && (board.response.body as { number?: number }).number === 1 && (board.response.body as { layout?: string }).layout === 'board')) return false;
-      const table = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Table', layout: 'table' }), root });
+      const table = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Table', layout: 'table' }), root });
       if (table.response.status !== 201) return false;
-      const upd = await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/views/1`, body: JSON.stringify({ layout: 'roadmap' }), root });
+      const upd = await applyGithubWrite({ method: 'PATCH', path: `/_twin/projectsV2/${pid}/views/1`, body: JSON.stringify({ layout: 'roadmap' }), root });
       if (!(ok(upd.response.status) && (upd.response.body as { layout?: string }).layout === 'roadmap')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/views`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/views`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
-      const del = await applyGithubWrite({ method: 'DELETE', path: `/projectsV2/${pid}/views/2`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/projectsV2/${pid}/views`, root });
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/_twin/projectsV2/${pid}/views/2`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/_twin/projectsV2/${pid}/views`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
     })),
 
@@ -1153,20 +1873,20 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const badCat = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'x', category: 'nope' }), root });
       if (noTitle.response.status !== 422 || badCat.response.status !== 422) return false;
       // GET one + list round-trips title/category.
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions`, root });
       if (!(ok(one.status) && (one.body as { title?: string }).title === 'Welcome' && isArr(list.body) && list.body.length === 1)) return false;
       // edit (title + close) round-trips; delete 204s then 404s.
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/discussions/1`, body: JSON.stringify({ title: 'Renamed', state: 'closed' }), root });
       if (!(ok(e.response.status) && (e.response.body as { title?: string; state?: string }).title === 'Renamed' && (e.response.body as { state?: string }).state === 'closed')) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/discussions/1`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
   done('github.discussions.categories', 'discussions', 'Discussions: categories (seeded defaults + custom + answerable Q&A)', 'api', 'niche', () =>
     withRoot(async (root) => {
       // the repo's category list seeds GitHub's defaults; Q&A is the answerable one.
-      const cats = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
+      const cats = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
       if (!(ok(cats.status) && isArr(cats.body))) return false;
       const qa = (cats.body as Array<{ slug?: string; is_answerable?: boolean }>).find((c) => c.slug === 'q-a');
       const general = (cats.body as Array<{ slug?: string; is_answerable?: boolean }>).find((c) => c.slug === 'general');
@@ -1174,7 +1894,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // a custom category is creatable + appears in the list with its slug.
       const made = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/categories`, body: JSON.stringify({ name: 'Polls', is_answerable: false }), root });
       if (!(made.response.status === 201 && (made.response.body as { slug?: string }).slug === 'polls')) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/categories`, root });
       return isArr(after.body) && (after.body as Array<{ slug?: string }>).some((c) => c.slug === 'polls');
     })),
   done('github.discussions.comments', 'discussions', 'Discussions: comments + threaded replies', 'api', 'niche', () =>
@@ -1190,8 +1910,8 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const reply = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions/1/comments`, body: JSON.stringify({ body: 'thanks', parent_id: cid }), root });
       if (!(reply.response.status === 201 && (reply.response.body as { parent_id?: number }).parent_id === cid)) return false;
       // list returns both, and the discussion's comment count reflects them.
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1/comments`, root });
-      const disc = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1/comments`, root });
+      const disc = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
       return ok(list.status) && isArr(list.body) && list.body.length === 2 && (disc.body as { comments?: number }).comments === 2;
     })),
   done('github.discussions.answers', 'discussions', 'Discussions: mark/unmark accepted answer (Q&A only)', 'api', 'niche', () =>
@@ -1203,11 +1923,11 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // mark → comment.is_answer true + the discussion points at it.
       const mark = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/discussions/1/comments/${cid}/answer`, body: '{}', root });
       if (!(ok(mark.response.status) && (mark.response.body as { is_answer?: boolean }).is_answer === true)) return false;
-      const disc = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const disc = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
       if ((disc.body as { answer_comment_id?: number }).answer_comment_id !== cid) return false;
       // unmark clears both.
       const unmark = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/discussions/1/comments/${cid}/answer`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/discussions/1`, root });
       if (!(ok(unmark.response.status) && (unmark.response.body as { is_answer?: boolean }).is_answer === false && (after.body as { answer_comment_id?: number | null }).answer_comment_id === null)) return false;
       // a NON-answerable (General) discussion rejects an answer mark → 422 (vendor-faithful).
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/discussions`, body: JSON.stringify({ title: 'chat', category: 'general' }), root });
@@ -1219,17 +1939,29 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   // ── Orgs / Teams / Members / Users ───────────────────────────────────────────────────────
   done('github.orgs.crud', 'orgs', 'Orgs: get/update + members', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // an unknown org 404s; PATCH auto-vivifies + round-trips the profile fields.
-      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root }).status !== 404) return false;
+      // an unknown org 404s (a PATCH too); created on github.com, a PATCH round-trips the profile fields.
+      if ((await handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root })).status !== 404) return false;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo`, body: JSON.stringify({ description: 'x' }), root })).response.status !== 404) return false;
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'octo', name: 'Octo' }), root, cookie: await signIn(root) });
       const upd = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo`, body: JSON.stringify({ description: 'The Octo org', billing_email: 'pay@octo.dev' }), root });
       if (!(ok(upd.response.status) && (upd.response.body as { description?: string }).description === 'The Octo org')) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/orgs/octo`, root });
       if (!(ok(get.status) && (get.body as { type?: string }).type === 'Organization' && (get.body as { description?: string }).description === 'The Octo org')) return false;
-      // members: invite via membership, then the member appears + the 204 membership check passes.
+      // members: an invitation is pending until accepted; then the member appears + the 204 membership check passes.
       await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/alice`, body: JSON.stringify({ role: 'admin' }), root });
-      const members = handleGithubRequest({ method: 'GET', path: `/orgs/octo/members`, root });
-      return ok(members.status) && isArr(members.body) && members.body.length === 1 && (members.body[0] as { login?: string }).login === 'alice'
-        && handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/alice`, root }).status === 204;
+      if ((await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/alice`, root })).status !== 404) return false;
+      await acceptInvite(root, 'octo', 'alice');
+      const members = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members?role=admin`, root });
+      if (!(ok(members.status) && isArr(members.body) && members.body.some((u) => (u as { login?: string }).login === 'alice')
+        && (await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/alice`, root })).status === 204)) return false;
+      // role filters the list as GitHub does; an unknown role is a validation error, on read and on write.
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/bob`, body: JSON.stringify({ role: 'member' }), root });
+      await acceptInvite(root, 'octo', 'bob');
+      // octocat created the org on github.com and is its first admin
+      const logins = async (q: string) => ((await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members${q}`, root })).body as { login: string }[]).map((u) => u.login).sort().join(',');
+      return await logins('?role=admin') === 'alice,octocat' && await logins('?role=member') === 'bob' && await logins('?role=all') === 'alice,bob,octocat'
+        && (await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members?role=owner`, root })).status === 422
+        && (await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/carol`, body: JSON.stringify({ role: 'owner' }), root })).response.status === 422;
     })),
   done('github.orgs.membership', 'orgs', 'Orgs: membership (invite/role/remove) + outside collaborators', 'api', 'niche', () =>
     withRoot(async (root) => {
@@ -1238,20 +1970,20 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(ok(inv.response.status) && (inv.response.body as { role?: string }).role === 'member')) return false;
       const promote = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/bob`, body: JSON.stringify({ role: 'admin' }), root });
       if ((promote.response.body as { role?: string }).role !== 'admin') return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo/memberships/bob`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/memberships/bob`, root });
       if ((get.body as { role?: string }).role !== 'admin') return false;
       // remove → member gone (404 check + delete idempotency: second delete 404s).
       const rm = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/members/bob`, root });
       if (rm.response.status !== 204) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/bob`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/orgs/octo/members/bob`, root })).status !== 404) return false;
       if ((await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/members/bob`, root })).response.status !== 404) return false;
       // outside collaborators: add → listed → remove → gone.
       const oc = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/outside_collaborators/carol`, body: '{}', root });
       if (oc.response.status !== 204) return false;
-      const ocList = handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
+      const ocList = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
       if (!(isArr(ocList.body) && ocList.body.length === 1 && (ocList.body[0] as { login?: string }).login === 'carol')) return false;
       const ocRm = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/outside_collaborators/carol`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/outside_collaborators`, root });
       return ocRm.response.status === 204 && isArr(after.body) && after.body.length === 0;
     })),
   done('github.orgs.repos', 'orgs', 'Orgs: list org repositories', 'api', 'common', () =>
@@ -1260,9 +1992,9 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'sec', private: true }), root });
       await applyGithubWrite({ method: 'POST', path: `/orgs/other/repos`, body: JSON.stringify({ name: 'x' }), root });
       // list scopes to the org (not the unrelated 'other/x'); ?type=private filters.
-      const all = handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos`, root });
+      const all = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos`, root });
       if (!(ok(all.status) && isArr(all.body) && all.body.length === 2 && (all.body as Array<{ full_name?: string }>).every((r) => r.full_name!.startsWith('octo/')))) return false;
-      const priv = handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos?type=private`, root });
+      const priv = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/repos?type=private`, root });
       return isArr(priv.body) && priv.body.length === 1 && (priv.body[0] as { name?: string }).name === 'sec';
     })),
   done('github.orgs.webhooks', 'orgs', 'Orgs: org-level webhooks CRUD', 'api', 'niche', () =>
@@ -1274,10 +2006,10 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const id = (c.response.body as { id?: number }).id!;
       const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/hooks/${id}`, body: JSON.stringify({ active: false }), root });
       if (!(ok(e.response.status) && (e.response.body as { active?: boolean }).active === false)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/hooks/${id}`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks/${id}`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/orgs/octo/hooks/${id}`, root })).status === 404;
     })),
   done('github.teams.crud', 'orgs', 'Teams: CRUD + membership + repo access', 'api', 'niche', () =>
     withRoot(async (root) => {
@@ -1286,25 +2018,27 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(c.response.status === 201 && (c.response.body as { slug?: string }).slug === 'core-team')) return false;
       // duplicate name (same slug) → 422.
       if ((await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams`, body: JSON.stringify({ name: 'core-team' }), root })).response.status !== 422) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root });
       if (!(ok(get.status) && (get.body as { privacy?: string }).privacy === 'closed')) return false;
       const e = await applyGithubWrite({ method: 'PATCH', path: `/orgs/octo/teams/core-team`, body: JSON.stringify({ description: 'the core team' }), root });
       if ((e.response.body as { description?: string }).description !== 'the core team') return false;
-      // membership: add maintainer → appears in members + membership get shows role.
+      // membership: add maintainer → pending until dana joins the organization she is invited to, then a member
       const m = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/teams/core-team/memberships/dana`, body: JSON.stringify({ role: 'maintainer' }), root });
-      if ((m.response.body as { role?: string }).role !== 'maintainer') return false;
-      const mem = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/members`, root });
+      if ((m.response.body as { role?: string; state?: string }).role !== 'maintainer' || (m.response.body as { state?: string }).state !== 'pending') return false;
+      if (((await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/members`, root })).body as unknown[]).length !== 0) return false;
+      await applyGithubWrite({ method: 'PATCH', path: '/user/memberships/orgs/octo', body: JSON.stringify({ state: 'active' }), root, token: await mintToken(root, 'dana') });
+      const mem = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/members`, root });
       if (!(isArr(mem.body) && mem.body.length === 1 && (mem.body[0] as { login?: string }).login === 'dana')) return false;
       // repo access: grant push → 204 check passes + repo appears in team repos.
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'svc' }), root });
       const g = await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/teams/core-team/repos/octo/svc`, body: JSON.stringify({ permission: 'push' }), root });
       if (g.response.status !== 204) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos/octo/svc`, root }).status !== 204) return false;
-      const repos = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos`, root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos/octo/svc`, root })).status !== 204) return false;
+      const repos = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team/repos`, root });
       if (!(isArr(repos.body) && repos.body.length === 1 && (repos.body[0] as { full_name?: string }).full_name === 'octo/svc')) return false;
       // delete team → 404 thereafter.
       const del = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/core-team`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/core-team`, root })).status === 404;
     })),
   done('github.teams.discussions', 'orgs', 'Teams: team discussions + comments', 'api', 'niche', () =>
     withRoot(async (root) => {
@@ -1318,39 +2052,39 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // comments: create → per-discussion number 1; edit; list; delete → list shrinks.
       const c = await applyGithubWrite({ method: 'POST', path: `/orgs/octo/teams/eng/discussions/1/comments`, body: JSON.stringify({ body: '+1' }), root });
       if (!(c.response.status === 201 && (c.response.body as { number?: number }).number === 1)) return false;
-      const cl = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
+      const cl = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
       if (!(isArr(cl.body) && cl.body.length === 1 && (cl.body[0] as { body?: string }).body === '+1')) return false;
       const cdel = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/eng/discussions/1/comments/1`, root });
       if (cdel.response.status !== 204) return false;
-      const cl2 = handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
+      const cl2 = await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1/comments`, root });
       if (!(isArr(cl2.body) && cl2.body.length === 0)) return false;
       // delete the discussion → 404 thereafter (and its comments orphan-pruned).
       const ddel = await applyGithubWrite({ method: 'DELETE', path: `/orgs/octo/teams/eng/discussions/1`, root });
-      return ddel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1`, root }).status === 404;
+      return ddel.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/orgs/octo/teams/eng/discussions/1`, root })).status === 404;
     })),
   done('github.users.profile', 'users', 'Users: get profile + authenticated user', 'api', 'common', () =>
     withRoot(async (root) => {
-      const u = handleGithubRequest({ method: 'GET', path: `/users/octocat`, root });
+      const u = await handleGithubRequest({ method: 'GET', path: `/users/octocat`, root });
       if (!(ok(u.status) && (u.body as { login?: string }).login === 'octocat' && typeof (u.body as { id?: number }).id === 'number')) return false;
-      const me = handleGithubRequest({ method: 'GET', path: `/user`, root });
+      const me = await handleGithubRequest({ method: 'GET', path: `/user`, root });
       return ok(me.status) && (me.body as { login?: string }).login === 'octocat';
     })),
   done('github.users.followers', 'users', 'Users: followers/following', 'api', 'niche', () =>
     withRoot(async (root) => {
       // not following → 404 check; follow → 204 check + appears in /user/following.
-      if (handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root })).status !== 404) return false;
       const f = await applyGithubWrite({ method: 'PUT', path: `/user/following/ann`, body: '{}', root });
       if (f.response.status !== 204) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status !== 204) return false;
-      const following = handleGithubRequest({ method: 'GET', path: `/user/following`, root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root })).status !== 204) return false;
+      const following = await handleGithubRequest({ method: 'GET', path: `/user/following`, root });
       if (!(isArr(following.body) && following.body.length === 1 && (following.body[0] as { login?: string }).login === 'ann')) return false;
       // ann's followers now include octocat (the only modeled actor).
-      const followers = handleGithubRequest({ method: 'GET', path: `/users/ann/followers`, root });
+      const followers = await handleGithubRequest({ method: 'GET', path: `/users/ann/followers`, root });
       if (!(isArr(followers.body) && followers.body.length === 1 && (followers.body[0] as { login?: string }).login === 'octocat')) return false;
       // unfollow → check 404 again + list empties.
       const uf = await applyGithubWrite({ method: 'DELETE', path: `/user/following/ann`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/user/following`, root });
-      return uf.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root }).status === 404 && isArr(after.body) && after.body.length === 0;
+      const after = await handleGithubRequest({ method: 'GET', path: `/user/following`, root });
+      return uf.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/user/following/ann`, root })).status === 404 && isArr(after.body) && after.body.length === 0;
     })),
 
   // ── Gists ────────────────────────────────────────────────────────────────────────────────
@@ -1359,14 +2093,14 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/gists`, body: JSON.stringify({ description: 'snip', public: true, files: { 'a.ts': { content: 'export const a=1' } } }), root });
       if (c.response.status !== 201) return false;
       const id = (c.response.body as { id?: string }).id!;
-      const get = handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
       if (!(ok(get.status) && (get.body as { files?: Record<string, unknown> }).files?.['a.ts'])) return false;
       const e = await applyGithubWrite({ method: 'PATCH', path: `/gists/${id}`, body: JSON.stringify({ description: 'renamed' }), root });
       if (!(ok(e.response.status) && (e.response.body as { description?: string }).description === 'renamed')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/gists`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/gists`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/gists/${id}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/gists/${id}`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
 
@@ -1375,56 +2109,56 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'fix login bug' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'add login', head: 'a', base: 'main' }), root });
-      const all = handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login')}`, root });
+      const all = await handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login')}`, root });
       if (!(ok(all.status) && (all.body as { total_count?: number }).total_count === 2)) return false;
-      const prsOnly = handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login is:pr')}`, root });
+      const prsOnly = await handleGithubRequest({ method: 'GET', path: `/search/issues?q=${encodeURIComponent('login is:pr')}`, root });
       const items = (prsOnly.body as { items?: Array<{ pull_request?: unknown }> }).items ?? [];
       return (prsOnly.body as { total_count?: number }).total_count === 1 && items.every((i) => 'pull_request' in i);
     })),
   done('github.search.code', 'search', 'Search: code', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/src/util.ts`, body: JSON.stringify({ message: 'm', content: Buffer.from('x').toString('base64') }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/search/code?q=${encodeURIComponent('util')}`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/search/code?q=${encodeURIComponent('util')}`, root });
       return ok(r.status) && (r.body as { total_count?: number }).total_count === 1 && ((r.body as { items?: Array<{ path?: string }> }).items?.[0]?.path === 'src/util.ts');
     })),
   done('github.search.repos', 'search', 'Search: repos', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'searchme', description: 'a findable repo' }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/search/repositories?q=${encodeURIComponent('searchme')}`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/search/repositories?q=${encodeURIComponent('searchme')}`, root });
       return ok(r.status) && (r.body as { total_count?: number }).total_count === 1;
     })),
   done('github.search.users', 'search', 'Search: users', 'api', 'common', () =>
     withRoot(async (root) => {
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'push' }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/search/users?q=${encodeURIComponent('alice')}`, root });
+      await collaborator(root, REPO, 'alice', 'push');
+      const r = await handleGithubRequest({ method: 'GET', path: `/search/users?q=${encodeURIComponent('alice')}`, root });
       return ok(r.status) && (r.body as { total_count?: number }).total_count === 1 && ((r.body as { items?: Array<{ login?: string }> }).items?.[0]?.login === 'alice');
     })),
   done('github.search.commits', 'search', 'Search: commits', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main', commits: [{ sha: 'abcd', message: 'initial commit' }] }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/search/commits?q=${encodeURIComponent('initial')}`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/search/commits?q=${encodeURIComponent('initial')}`, root });
       return ok(r.status) && (r.body as { total_count?: number }).total_count === 1;
     })),
 
   // ── Notifications ────────────────────────────────────────────────────────────────────────
-  done('github.notifications.list', 'notifications', 'Notifications: list/mark-read + thread subscriptions', 'api', 'common', () =>
+  done('github.notifications.list', 'notifications', 'Notifications: an @mention lands in the inbox; list/mark-read', 'api', 'common', () =>
     withRoot(async (root) => {
-      const n = await applyGithubWrite({ method: 'POST', path: `/notifications`, body: JSON.stringify({ repository: REPO, subject_title: 'New PR', subject_type: 'PullRequest', reason: 'review_requested' }), root });
-      if (n.response.status !== 201) return false;
-      const id = (n.response.body as { id?: string }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: `/notifications`, root });
-      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { unread?: boolean }).unread === true)) return false;
+      await pushFiles(root, {});
+      await mentionedIn(root, HISTORY_REPO, 'New PR');
+      const list = await handleGithubRequest({ method: 'GET', path: `/notifications`, root });
+      if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { unread?: boolean; reason?: string }).unread === true && (list.body[0] as { reason?: string }).reason === 'mention')) return false;
+      const id = (list.body[0] as { id: string }).id;
       const read = await applyGithubWrite({ method: 'PATCH', path: `/notifications/threads/${id}`, body: '{}', root });
       if (read.response.status !== 205) return false;
-      const after = handleGithubRequest({ method: 'GET', path: `/notifications`, root });
-      const allList = handleGithubRequest({ method: 'GET', path: `/notifications?all=true`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/notifications`, root });
+      const allList = await handleGithubRequest({ method: 'GET', path: `/notifications?all=true`, root });
       return isArr(after.body) && after.body.length === 0 && isArr(allList.body) && allList.body.length === 1;
     })),
 
   // ── Platform meta endpoints (stateless reference catalogs) ───────────────────────────────
   done('github.meta.rate_limit', 'meta', 'Rate limit: GET /rate_limit envelope (resources + rate)', 'api', 'core', () =>
     withRoot(async (root) => {
-      const r = handleGithubRequest({ method: 'GET', path: `/rate_limit`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/rate_limit`, root });
       const b = r.body as { resources?: { core?: { limit?: number; remaining?: number } }; rate?: { limit?: number } };
       return ok(r.status) && b.resources?.core?.limit === 5000 && b.resources?.core?.remaining === 5000 && b.rate?.limit === 5000;
     })),
@@ -1439,31 +2173,31 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     })),
   done('github.meta.gitignore', 'meta', 'gitignore templates: list + GET one (name/source)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const list = handleGithubRequest({ method: 'GET', path: `/gitignore/templates`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/gitignore/templates`, root });
       if (!(ok(list.status) && isArr(list.body) && (list.body as string[]).includes('Node'))) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Node`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Node`, root });
       const b = one.body as { name?: string; source?: string };
       if (!(ok(one.status) && b.name === 'Node' && typeof b.source === 'string' && b.source.length > 0)) return false;
-      return handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Nope`, root }).status === 404;
+      return (await handleGithubRequest({ method: 'GET', path: `/gitignore/templates/Nope`, root })).status === 404;
     })),
   done('github.meta.licenses', 'meta', 'Licenses: list + GET one (key/spdx_id)', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const list = handleGithubRequest({ method: 'GET', path: `/licenses`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/licenses`, root });
       if (!(ok(list.status) && isArr(list.body) && (list.body as Array<{ key?: string }>).some((l) => l.key === 'mit'))) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/licenses/mit`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/licenses/mit`, root });
       const b = one.body as { spdx_id?: string; key?: string };
       if (!(ok(one.status) && b.key === 'mit' && b.spdx_id === 'MIT')) return false;
-      return handleGithubRequest({ method: 'GET', path: `/licenses/nope`, root }).status === 404;
+      return (await handleGithubRequest({ method: 'GET', path: `/licenses/nope`, root })).status === 404;
     })),
   done('github.meta.emojis', 'meta', 'Emojis: GET /emojis name→asset-url map', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const r = handleGithubRequest({ method: 'GET', path: `/emojis`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/emojis`, root });
       const b = r.body as Record<string, string>;
       return ok(r.status) && typeof b['+1'] === 'string' && b['rocket']!.startsWith('https://');
     })),
   done('github.meta.service_meta', 'meta', 'Meta: GET /meta service metadata envelope', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const r = handleGithubRequest({ method: 'GET', path: `/meta`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/meta`, root });
       const b = r.body as { verifiable_password_authentication?: boolean; hooks?: unknown[] };
       return ok(r.status) && typeof b.verifiable_password_authentication === 'boolean' && Array.isArray(b.hooks);
     })),
@@ -1473,73 +2207,82 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       // not starred yet → 404 on the membership check.
-      if (handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root })).status !== 404) return false;
       const star = await applyGithubWrite({ method: 'PUT', path: `/user/starred/octo/demo`, root });
       if (!(star.response.status === 204 && star.webhook?.event === 'star' && star.webhook.action === 'created')) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status !== 204) return false;
-      const gz = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/stargazers`, root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root })).status !== 204) return false;
+      const gz = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/stargazers`, root });
       if (!(ok(gz.status) && isArr(gz.body) && gz.body.length === 1 && (gz.body[0] as { login?: string }).login === 'octocat')) return false;
-      const mine = handleGithubRequest({ method: 'GET', path: `/user/starred`, root });
+      const mine = await handleGithubRequest({ method: 'GET', path: `/user/starred`, root });
       if (!(ok(mine.status) && isArr(mine.body) && mine.body.length === 1)) return false;
       const un = await applyGithubWrite({ method: 'DELETE', path: `/user/starred/octo/demo`, root });
-      return un.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root }).status === 404;
+      return un.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/user/starred/octo/demo`, root })).status === 404;
     })),
   done('github.activity.watching', 'activity', 'Watching: PUT/DELETE/GET .../subscription + subscribers', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       // not watching yet → 404.
-      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root })).status !== 404) return false;
       const w = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/subscription`, root });
       const wb = w.response.body as { subscribed?: boolean };
       if (!(ok(w.response.status) && wb.subscribed === true)) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root });
       if (!(ok(get.status) && (get.body as { subscribed?: boolean }).subscribed === true)) return false;
-      const subs = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscribers`, root });
+      const subs = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscribers`, root });
       if (!(ok(subs.status) && isArr(subs.body) && subs.body.length === 1)) return false;
       const un = await applyGithubWrite({ method: 'DELETE', path: `/repos/octo/demo/subscription`, root });
-      return un.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root }).status === 404;
+      return un.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/subscription`, root })).status === 404;
     })),
   done('github.activity.feeds', 'activity', 'Activity: feeds + received/public events streams', 'api', 'niche', () =>
     withRoot(async (root) => {
       // GET /feeds returns the feed-URL catalog (with timeline + _links). The event streams
       // (public timeline, per-user events, received_events) are DERIVED from modeled objects:
       // a merged PR + an issue produce PullRequestEvent + IssuesEvent in the stream.
-      const feeds = handleGithubRequest({ method: 'GET', path: '/feeds', root });
+      const feeds = await handleGithubRequest({ method: 'GET', path: '/feeds', root });
       if (!(ok(feeds.status) && typeof (feeds.body as { timeline_url?: string }).timeline_url === 'string' && (feeds.body as { _links?: object })._links)) return false;
       await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main' }), root });
       await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/pulls/1/merge`, body: '{}', root });
       await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/issues`, body: JSON.stringify({ title: 'i' }), root });
-      const pub = handleGithubRequest({ method: 'GET', path: '/events', root });
+      const pub = await handleGithubRequest({ method: 'GET', path: '/events', root });
       if (!(ok(pub.status) && isArr(pub.body) && pub.body.length === 2)) return false;
       const types = new Set((pub.body as Array<{ type?: string }>).map((e) => e.type));
       if (!(types.has('PullRequestEvent') && types.has('IssuesEvent'))) return false;
       // octo OWNS octo/demo → its received_events stream carries both; an unknown user's is empty.
-      const received = handleGithubRequest({ method: 'GET', path: '/users/octo/received_events', root });
-      const userEv = handleGithubRequest({ method: 'GET', path: '/users/octo/events', root });
-      const empty = handleGithubRequest({ method: 'GET', path: '/users/nobody/events', root });
-      const repoEv = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/events', root });
-      return ok(received.status) && isArr(received.body) && received.body.length === 2
+      const received = await handleGithubRequest({ method: 'GET', path: '/users/octo/received_events', root });
+      const userEv = await handleGithubRequest({ method: 'GET', path: '/users/octo/events', root });
+      const empty = await handleGithubRequest({ method: 'GET', path: '/users/nobody/events', root });
+      const repoEv = await handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/events', root });
+      if (!(ok(received.status) && isArr(received.body) && received.body.length === 2
         && ok(userEv.status) && isArr(userEv.body) && userEv.body.length === 2
         && ok(empty.status) && isArr(empty.body) && empty.body.length === 0
-        && ok(repoEv.status) && isArr(repoEv.body) && repoEv.body.length === 2;
+        && ok(repoEv.status) && isArr(repoEv.body) && repoEv.body.length === 2)) return false;
+      // Commenting on the ISSUE materializes a counter shell in the PR store — it is not a
+      // pull request, and it may not fire a PullRequestEvent. The stream reads the same
+      // pull-request marker `GET .../pulls` does; two doors onto one world, one answer.
+      await applyGithubWrite({ method: 'POST', path: `/repos/octo/demo/issues/2/comments`, body: JSON.stringify({ body: 'me too' }), root });
+      const after = await handleGithubRequest({ method: 'GET', path: '/events', root });
+      const prEvents = (after.body as Array<{ type?: string; payload?: { number?: number } }>).filter((e) => e.type === 'PullRequestEvent');
+      return isArr(after.body) && after.body.length === 3 && prEvents.length === 1 && prEvents[0]!.payload?.number === 1;
     })),
   done('github.activity.notifications_repo', 'activity', 'Activity: per-repo notifications + thread subscriptions', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // Seed two notifications in different repos; the per-repo inbox returns only that repo's.
-      const n = await applyGithubWrite({ method: 'POST', path: '/notifications', body: JSON.stringify({ repository: 'octo/a', subject_title: 'PR in a', subject_type: 'PullRequest' }), root });
-      await applyGithubWrite({ method: 'POST', path: '/notifications', body: JSON.stringify({ repository: 'octo/b', subject_title: 'Issue in b', subject_type: 'Issue' }), root });
-      const nid = (n.response.body as { id?: string }).id!;
-      const inbox = handleGithubRequest({ method: 'GET', path: '/repos/octo/a/notifications', root });
-      if (!(ok(inbox.status) && isArr(inbox.body) && inbox.body.length === 1 && (inbox.body[0] as { repository?: { full_name?: string } }).repository?.full_name === 'octo/a')) return false;
-      // thread subscription: a subscribed thread reads subscribed:true; DELETE clears it (and
-      // marks the thread read, so it drops out of the unread per-repo inbox).
-      const sub = handleGithubRequest({ method: 'GET', path: `/notifications/threads/${nid}/subscription`, root });
+      // mentions in two repositories; the per-repo inbox returns only that repo's thread
+      await pushFiles(root, {});
+      await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'other', auto_init: true }), root });
+      await mentionedIn(root, HISTORY_REPO, 'PR in ci-demo');
+      await mentionedIn(root, 'octocat/other', 'Issue in other');
+      const inbox = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/notifications`, root });
+      if (!(ok(inbox.status) && isArr(inbox.body) && inbox.body.length === 1 && (inbox.body[0] as { repository?: { full_name?: string } }).repository?.full_name === HISTORY_REPO)) return false;
+      const nid = (inbox.body[0] as { id: string }).id;
+      // a mentioned person is subscribed; ignoring mutes the thread and takes it out of the inbox; unsubscribing clears it
+      const sub = await handleGithubRequest({ method: 'GET', path: `/notifications/threads/${nid}/subscription`, root });
       if (!(ok(sub.status) && (sub.body as { subscribed?: boolean }).subscribed === true)) return false;
       const ignore = await applyGithubWrite({ method: 'PUT', path: `/notifications/threads/${nid}/subscription`, body: JSON.stringify({ ignored: true }), root });
       if (!(ok(ignore.response.status) && (ignore.response.body as { ignored?: boolean }).ignored === true)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/notifications/threads/${nid}/subscription`, root });
-      const after = handleGithubRequest({ method: 'GET', path: '/repos/octo/a/notifications', root });
-      return del.response.status === 204 && ok(after.status) && isArr(after.body) && after.body.length === 0;
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/notifications`, root });
+      const cleared = await handleGithubRequest({ method: 'GET', path: `/notifications/threads/${nid}/subscription`, root });
+      return del.response.status === 204 && ok(after.status) && isArr(after.body) && after.body.length === 0 && (cleared.body as { subscribed?: boolean }).subscribed === false;
     })),
 
   // ── Repo metadata (derived read endpoints) ───────────────────────────────────────────────
@@ -1547,21 +2290,21 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/src/a.ts`, body: JSON.stringify({ message: 'm', content: Buffer.from('x'.repeat(40)).toString('base64') }), root });
       await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/main.py`, body: JSON.stringify({ message: 'm', content: Buffer.from('y'.repeat(10)).toString('base64') }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/languages`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/languages`, root });
       const b = r.body as Record<string, number>;
       return ok(r.status) && b.TypeScript === 40 && b.Python === 10;
     })),
   done('github.repos.contributors', 'repos', 'Repos: contributors (GET .../contributors, commit-author tallies)', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'a', base: 'main', commits: [{ sha: 'a1', message: 'c1', author_name: 'alice' }, { sha: 'a2', message: 'c2', author_name: 'alice' }, { sha: 'b1', message: 'c3', author_name: 'bob' }] }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contributors`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/contributors`, root });
       const arr = r.body as Array<{ login?: string; contributions?: number }>;
       return ok(r.status) && arr.length === 2 && arr[0]!.login === 'alice' && arr[0]!.contributions === 2 && arr[1]!.login === 'bob';
     })),
   done('github.repos.compare', 'repos', 'Repos: compare commits (GET .../compare/:base...:head)', 'api', 'common', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'p', head: 'feat-sha', base: 'main', commits: [{ sha: 'c1', message: 'one' }], files: [{ filename: 'x.ts', additions: 2, deletions: 0 }] }), root });
-      const r = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/compare/main...feat-sha`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/compare/main...feat-sha`, root });
       const b = r.body as { total_commits?: number; commits?: unknown[]; files?: Array<{ filename?: string }>; status?: string };
       return ok(r.status) && b.total_commits === 1 && b.status === 'ahead' && (b.files?.[0]?.filename === 'x.ts');
     })),
@@ -1572,27 +2315,27 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/commits/abc123/comments`, body: JSON.stringify({ body: 'nice fix', path: 'a.ts', line: 5 }), root });
       if (!(c.response.status === 201 && (c.response.body as { commit_id?: string }).commit_id === 'abc123' && (c.response.body as { path?: string }).path === 'a.ts')) return false;
       const id = (c.response.body as { id?: number }).id!;
-      const onCommit = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/comments`, root });
+      const onCommit = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/abc123/comments`, root });
       if (!(ok(onCommit.status) && isArr(onCommit.body) && onCommit.body.length === 1)) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root });
       if (!(ok(one.status) && (one.body as { body?: string }).body === 'nice fix')) return false;
       // edit body; delete → repo-wide list empties.
       const e = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/comments/${id}`, body: JSON.stringify({ body: 'edited' }), root });
       if ((e.response.body as { body?: string }).body !== 'edited') return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/comments/${id}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 0
-        && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root }).status === 404;
+        && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/comments/${id}`, root })).status === 404;
     })),
   done('github.repos.readme', 'repos', 'Repos: GET .../readme (rendered + raw)', 'api', 'niche', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
       // no README yet → 404; write README.md then it returns the base64 content object.
-      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root })).status !== 404) return false;
       const b64 = Buffer.from('# Demo\nhello').toString('base64');
       const put = await applyGithubWrite({ method: 'PUT', path: `/repos/octo/demo/contents/README.md`, body: JSON.stringify({ message: 'add readme', content: b64 }), root });
       if (put.response.status !== 201) return false;
-      const r = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root });
+      const r = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/readme`, root });
       return ok(r.status) && (r.body as { name?: string }).name === 'README.md' && (r.body as { encoding?: string }).encoding === 'base64'
         && Buffer.from(String((r.body as { content?: string }).content ?? ''), 'base64').toString() === '# Demo\nhello';
     })),
@@ -1600,14 +2343,14 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (root) => {
       // traffic on a missing repo → 404; on a real repo → vendor-shaped zero-history payloads
       // (per-account traffic is not observable offline — honestly empty, never fabricated).
-      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root })).status !== 404) return false;
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
-      const views = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root });
+      const views = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/views`, root });
       if (!(ok(views.status) && (views.body as { count?: number }).count === 0 && isArr((views.body as { views?: unknown[] }).views))) return false;
-      const clones = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/clones`, root });
+      const clones = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/clones`, root });
       if (!(ok(clones.status) && isArr((clones.body as { clones?: unknown[] }).clones))) return false;
-      const refs = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/referrers`, root });
-      const paths = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/paths`, root });
+      const refs = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/referrers`, root });
+      const paths = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/traffic/popular/paths`, root });
       return ok(refs.status) && isArr(refs.body) && ok(paths.status) && isArr(paths.body);
     })),
   done('github.repos.deploy_keys', 'repos', 'Repos: deploy keys CRUD', 'api', 'niche', () =>
@@ -1618,12 +2361,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/keys`, body: JSON.stringify({ title: 'deploy', key: 'ssh-ed25519 AAAA', read_only: false }), root });
       if (!(c.response.status === 201 && (c.response.body as { read_only?: boolean }).read_only === false)) return false;
       const id = (c.response.body as { id?: number }).id!;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root });
       if (!(ok(one.status) && (one.body as { title?: string }).title === 'deploy')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/keys/${id}`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/keys/${id}`, root })).status === 404;
     })),
   done('github.repos.autolinks', 'repos', 'Repos: autolink references CRUD', 'api', 'niche', () =>
     withRoot(async (root) => {
@@ -1632,21 +2375,21 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const c = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/autolinks`, body: JSON.stringify({ key_prefix: 'TICKET-', url_template: 'https://jira/<num>', is_alphanumeric: false }), root });
       if (!(c.response.status === 201 && (c.response.body as { is_alphanumeric?: boolean }).is_alphanumeric === false)) return false;
       const id = (c.response.body as { id?: number }).id!;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root });
       if (!(ok(one.status) && (one.body as { key_prefix?: string }).key_prefix === 'TICKET-')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/autolinks/${id}`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/autolinks/${id}`, root })).status === 404;
     })),
   done('github.repos.tarball', 'repos', 'Repos: tar/zipball archive download', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // archive of a missing repo → 404; a real repo → 302 redirect to codeload (bytes out of scope).
-      if (handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root }).status !== 404) return false;
+      // archive of a missing repo → 404; a real repo → 302 redirect to codeload (serving the bytes is a todo).
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root })).status !== 404) return false;
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo', default_branch: 'main' }), root });
-      const tar = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root });
+      const tar = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/tarball`, root });
       if (!(tar.status === 302 && String((tar.body as { location?: string }).location).includes('legacy.tar.gz'))) return false;
-      const zip = handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/zipball/v1.0.0`, root });
+      const zip = await handleGithubRequest({ method: 'GET', path: `/repos/octo/demo/zipball/v1.0.0`, root });
       return zip.status === 302 && String((zip.body as { location?: string }).location).includes('legacy.zip/v1.0.0');
     })),
   done('github.repos.rulesets', 'repos', 'Repos: rulesets (the newer branch/tag rule engine)', 'api', 'niche', () =>
@@ -1658,12 +2401,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const id = (c.response.body as { id?: number }).id!;
       const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/rulesets/${id}`, body: JSON.stringify({ enforcement: 'disabled' }), root });
       if (!(ok(upd.response.status) && (upd.response.body as { enforcement?: string }).enforcement === 'disabled')) return false;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root });
       if (!(ok(one.status) && (one.body as { name?: string }).name === 'main-protection')) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/rulesets/${id}`, root });
-      return del.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root }).status === 404;
+      return del.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${id}`, root })).status === 404;
     })),
 
   // ── Deployments / Environments ───────────────────────────────────────────────────────────
@@ -1676,11 +2419,11 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(c.response.status === 201 && (c.response.body as { environment?: string }).environment === 'production')) return false;
       const id = (c.response.body as { id?: number }).id!;
       // get one + list (newest-first) + ?environment filter.
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}`, root });
       if (!(ok(one.status) && (one.body as { id?: number }).id === id)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const filtered = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments?environment=staging`, root });
+      const filtered = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments?environment=staging`, root });
       if (!(isArr(filtered.body) && filtered.body.length === 0)) return false;
       // statuses: invalid state → 422; status on a missing deployment → 404.
       const badState = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'nope' }), root });
@@ -1690,7 +2433,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const s1 = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'in_progress' }), root });
       const s2 = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${id}/statuses`, body: JSON.stringify({ state: 'success', environment_url: 'https://app.x' }), root });
       if (!(s1.response.status === 201 && s2.response.status === 201)) return false;
-      const statuses = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}/statuses`, root });
+      const statuses = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/deployments/${id}/statuses`, root });
       // newest-first → the latest (success) leads.
       return ok(statuses.status) && isArr(statuses.body) && statuses.body.length === 2 && (statuses.body[0] as { state?: string }).state === 'success';
     })),
@@ -1701,11 +2444,11 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if (!(c.response.status === 200 && (c.response.body as { name?: string }).name === 'production')) return false;
       const rules = (c.response.body as { protection_rules?: Array<{ type?: string }> }).protection_rules ?? [];
       if (!(rules.some((r) => r.type === 'wait_timer') && rules.some((r) => r.type === 'required_reviewers'))) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments`, root });
       if (!(ok(get.status) && ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/environments/production`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/environments/production`, root });
       return del.response.status === 204 && gone.status === 404;
     })),
 
@@ -1718,12 +2461,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const a1 = await applyGithubWrite({ method: 'POST', path: `/user/emails`, body: JSON.stringify({ emails: ['me@x.io'] }), root });
       if (!(a1.response.status === 201 && isArr(a1.response.body) && (a1.response.body[0] as { primary?: boolean }).primary === true)) return false;
       await applyGithubWrite({ method: 'POST', path: `/user/emails`, body: JSON.stringify({ emails: ['alt@x.io'] }), root });
-      const list = handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 2)) return false;
-      const pub = handleGithubRequest({ method: 'GET', path: `/user/public_emails`, root });
+      const pub = await handleGithubRequest({ method: 'GET', path: `/user/public_emails`, root });
       if (!(ok(pub.status) && isArr(pub.body) && pub.body.length === 1 && (pub.body[0] as { email?: string }).email === 'me@x.io')) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/user/emails`, body: JSON.stringify({ emails: ['alt@x.io'] }), root });
-      const after = handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/user/emails`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 1;
     })),
   done('github.user.keys', 'users', 'User: SSH + GPG keys CRUD', 'api', 'niche', () =>
@@ -1733,38 +2476,38 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const ssh = await applyGithubWrite({ method: 'POST', path: `/user/keys`, body: JSON.stringify({ title: 'laptop', key: 'ssh-ed25519 AAAA' }), root });
       if (!(ssh.response.status === 201 && (ssh.response.body as { title?: string }).title === 'laptop')) return false;
       const sid = (ssh.response.body as { id?: number }).id!;
-      if (!(ok(handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root }).status))) return false;
-      const sshList = handleGithubRequest({ method: 'GET', path: `/user/keys`, root });
+      if (!(ok((await handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root })).status))) return false;
+      const sshList = await handleGithubRequest({ method: 'GET', path: `/user/keys`, root });
       if (!(isArr(sshList.body) && sshList.body.length === 1)) return false;
       const sdel = await applyGithubWrite({ method: 'DELETE', path: `/user/keys/${sid}`, root });
-      if (!(sdel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root }).status === 404)) return false;
+      if (!(sdel.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/user/keys/${sid}`, root })).status === 404)) return false;
       if ((await applyGithubWrite({ method: 'POST', path: `/user/gpg_keys`, body: '{}', root })).response.status !== 422) return false;
       const gpg = await applyGithubWrite({ method: 'POST', path: `/user/gpg_keys`, body: JSON.stringify({ armored_public_key: '-----BEGIN PGP-----\nabc\n-----END PGP-----' }), root });
       if (!(gpg.response.status === 201 && typeof (gpg.response.body as { key_id?: string }).key_id === 'string')) return false;
       const gid = (gpg.response.body as { id?: number }).id!;
-      const gpgList = handleGithubRequest({ method: 'GET', path: `/user/gpg_keys`, root });
+      const gpgList = await handleGithubRequest({ method: 'GET', path: `/user/gpg_keys`, root });
       if (!(isArr(gpgList.body) && gpgList.body.length === 1)) return false;
       const gdel = await applyGithubWrite({ method: 'DELETE', path: `/user/gpg_keys/${gid}`, root });
-      return gdel.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/gpg_keys/${gid}`, root }).status === 404;
+      return gdel.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/user/gpg_keys/${gid}`, root })).status === 404;
     })),
   done('github.user.update', 'users', 'User: PATCH /user (update authenticated profile)', 'api', 'niche', () =>
     withRoot(async (root) => {
       const r = await applyGithubWrite({ method: 'PATCH', path: `/user`, body: JSON.stringify({ name: 'Octo Cat', bio: 'builder', company: '@octo' }), root });
       if (!(ok(r.response.status) && (r.response.body as { name?: string }).name === 'Octo Cat' && (r.response.body as { bio?: string }).bio === 'builder')) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/user`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/user`, root });
       return ok(get.status) && (get.body as { name?: string }).name === 'Octo Cat' && (get.body as { company?: string }).company === '@octo' && (get.body as { login?: string }).login === 'octocat';
     })),
   done('github.user.blocking', 'users', 'User: block/unblock users', 'api', 'niche', () =>
     withRoot(async (root) => {
       // not blocked → check 404; block → 204; appears in list + check 204; unblock → check 404.
-      if (handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root })).status !== 404) return false;
       const b = await applyGithubWrite({ method: 'PUT', path: `/user/blocks/spammer`, body: '{}', root });
       if (b.response.status !== 204) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status !== 204) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/user/blocks`, root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root })).status !== 204) return false;
+      const list = await handleGithubRequest({ method: 'GET', path: `/user/blocks`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { login?: string }).login === 'spammer')) return false;
       const u = await applyGithubWrite({ method: 'DELETE', path: `/user/blocks/spammer`, root });
-      return u.response.status === 204 && handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root }).status === 404;
+      return u.response.status === 204 && (await handleGithubRequest({ method: 'GET', path: `/user/blocks/spammer`, root })).status === 404;
     })),
 
   // ── Issues (remaining surface) ───────────────────────────────────────────────────────────
@@ -1773,23 +2516,23 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'ev' }), root });
       await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/issues/1`, body: JSON.stringify({ labels: ['bug'], assignees: ['bob'], state: 'closed', state_reason: 'completed' }), root });
       // per-issue typed events carry numeric ids; repo-wide list aggregates them; get-by-id works.
-      const perIssue = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/events`, root });
+      const perIssue = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/1/events`, root });
       if (!(ok(perIssue.status) && isArr(perIssue.body) && perIssue.body.length >= 3)) return false;
-      const repoWide = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events`, root });
+      const repoWide = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events`, root });
       if (!(ok(repoWide.status) && isArr(repoWide.body) && repoWide.body.length >= 3 && (repoWide.body[0] as { issue?: { number?: number } }).issue?.number === 1)) return false;
       const eid = (perIssue.body[0] as { id?: number }).id!;
-      const one = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/${eid}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/${eid}`, root });
       if (!(ok(one.status) && (one.body as { id?: number }).id === eid && typeof (one.body as { event?: string }).event === 'string')) return false;
-      return handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/999999`, root }).status === 404;
+      return (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/events/999999`, root })).status === 404;
     })),
   done('github.issues.assignees_check', 'issues', 'Issues: assignable users list + check', 'api', 'niche', () =>
     withRoot(async (root) => {
       await applyGithubWrite({ method: 'POST', path: `/orgs/octo/repos`, body: JSON.stringify({ name: 'demo' }), root });
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/alice`, body: JSON.stringify({ permission: 'push' }), root });
+      await collaborator(root, REPO, 'alice', 'push');
       // an assignable collaborator → check 204; a non-collaborator → 404; the list includes alice.
-      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/alice`, root }).status !== 204) return false;
-      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/nobody`, root }).status !== 404) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees`, root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/alice`, root })).status !== 204) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees/nobody`, root })).status !== 404) return false;
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/assignees`, root });
       return ok(list.status) && isArr(list.body) && list.body.some((u) => (u as { login?: string }).login === 'alice');
     })),
 
@@ -1803,11 +2546,11 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, body: JSON.stringify({ content: 'nope' }), root })).response.status !== 422) return false;
       const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, body: JSON.stringify({ content: 'rocket' }), root });
       if (r.response.status !== 201) return false;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { content?: string }).content === 'rocket')) return false;
       const rid = (r.response.body as { id?: number }).id!;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pulls/comments/${cid}/reactions/${rid}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/comments/${cid}/reactions`, root });
       return del.response.status === 204 && isArr(after.body) && after.body.length === 0;
     })),
   done('github.pulls.review_dismiss', 'pulls', 'PRs: dismiss a review + update a review body', 'api', 'niche', () =>
@@ -1819,12 +2562,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}/dismissals`, body: '{}', root })).response.status !== 422) return false;
       const dm = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}/dismissals`, body: JSON.stringify({ message: 'stale' }), root });
       if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'DISMISSED' && dm.webhook?.action === 'dismissed')) return false;
-      const listed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      const listed = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
       if (!(ok(listed.status) && isArr(listed.body) && (listed.body[0] as { state?: string }).state === 'DISMISSED')) return false;
       // update the review body (PUT .../reviews/:rid); 422 without a body; read-back reflects it.
       if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}`, body: '{}', root })).response.status !== 422) return false;
       const up = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/${rid}`, body: JSON.stringify({ body: 'edited note' }), root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root });
       // a dismiss on an unknown review id 404s.
       const missing = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/1/reviews/9999/dismissals`, body: JSON.stringify({ message: 'x' }), root });
       return ok(up.response.status) && (after.body as Array<{ body?: string }>)[0]?.body === 'edited note' && missing.response.status === 404;
@@ -1833,122 +2576,134 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   // ── Packages / Pages ─────────────────────────────────────────────────────────────────────
   done('github.packages.list', 'packages', 'Packages: list/get/delete versions', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // seed a package + two versions, list/get, delete one version then the package.
-      const c = await applyGithubWrite({ method: 'POST', path: '/user/packages/npm/my-lib', body: JSON.stringify({ visibility: 'public', versions: ['1.0.0', '1.1.0'] }), root });
-      if (!(c.response.status === 201 && (c.response.body as { version_count?: number }).version_count === 2)) return false;
-      const list = handleGithubRequest({ method: 'GET', path: '/user/packages?package_type=npm', root });
+      // npm publish two versions to GitHub Packages, list/get, delete one version then the package.
+      const doc = { name: '@octocat/my-lib', versions: { '1.0.0': { version: '1.0.0' }, '1.1.0': { version: '1.1.0' } } };
+      const published = await githubNpmRegistry({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://npm.pkg.github.com/@octocat/my-lib', { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify(doc) }));
+      const pkg = await handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib', root });
+      if (!(published?.status === 201 && (pkg.body as { version_count?: number }).version_count === 2)) return false;
+      const list = await handleGithubRequest({ method: 'GET', path: '/user/packages?package_type=npm', root });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1 && (list.body[0] as { name?: string }).name === 'my-lib')) return false;
-      const versions = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
+      const versions = await handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
       if (!(ok(versions.status) && isArr(versions.body) && versions.body.length === 2)) return false;
       const vid = (versions.body as Array<{ id?: number }>)[0]!.id!;
-      const one = handleGithubRequest({ method: 'GET', path: `/user/packages/npm/my-lib/versions/${vid}`, root });
+      const one = await handleGithubRequest({ method: 'GET', path: `/user/packages/npm/my-lib/versions/${vid}`, root });
       if (!(ok(one.status) && (one.body as { id?: number }).id === vid)) return false;
       const delV = await applyGithubWrite({ method: 'DELETE', path: `/user/packages/npm/my-lib/versions/${vid}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
+      const after = await handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib/versions', root });
       if (!(delV.response.status === 204 && isArr(after.body) && after.body.length === 1)) return false;
       const delP = await applyGithubWrite({ method: 'DELETE', path: '/user/packages/npm/my-lib', root });
-      const gone = handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib', root });
+      const gone = await handleGithubRequest({ method: 'GET', path: '/user/packages/npm/my-lib', root });
       // a delete of an unknown package 404s.
       const missing = await applyGithubWrite({ method: 'DELETE', path: '/user/packages/npm/nope', root });
       return delP.response.status === 204 && gone.status === 404 && missing.response.status === 404;
     })),
-  done('github.pages.get', 'pages', 'Pages: site config + builds', 'api', 'niche', () =>
+  done('github.pages.get', 'pages', 'Pages: site config + builds; none for a repository that does not exist', 'api', 'niche', () =>
     withRoot(async (root) => {
-      // no site → 404; create (POST) → 201 building; update source (PUT) → 204; request a build.
-      if (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root }).status !== 404) return false;
+      // no repository → no site; no site → 404; create (POST) → 201 building; update source (PUT) → 204; request a build.
+      if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages`, body: '{}', root })).response.status !== 404) return false;
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: REPO.split('/')[0] }), root, cookie: await signIn(root) });
+      await applyGithubWrite({ method: 'POST', path: `/orgs/${REPO.split('/')[0]}/repos`, body: JSON.stringify({ name: REPO.split('/')[1] }), root });
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root })).status !== 404) return false;
       const create = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages`, body: JSON.stringify({ source: { branch: 'gh-pages', path: '/' } }), root });
       if (!(create.response.status === 201 && (create.response.body as { source?: { branch?: string } }).source?.branch === 'gh-pages')) return false;
       // creating twice 409s.
       if ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages`, body: '{}', root })).response.status !== 409) return false;
       const upd = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pages`, body: JSON.stringify({ cname: 'docs.example.com', source: { branch: 'main', path: '/docs' } }), root });
       if (upd.response.status !== 204) return false;
-      const site = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
+      const site = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
       if (!(ok(site.status) && (site.body as { cname?: string }).cname === 'docs.example.com' && (site.body as { source?: { path?: string } }).source?.path === '/docs')) return false;
       const build = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pages/builds`, body: '{}', root });
       if (build.response.status !== 202) return false;
-      const builds = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds`, root });
-      const latest = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds/latest`, root });
+      const builds = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds`, root });
+      const latest = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages/builds/latest`, root });
       const del = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/pages`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pages`, root });
       return ok(builds.status) && isArr(builds.body) && builds.body.length === 1 && ok(latest.status) && (latest.body as { status?: string }).status === 'built' && del.response.status === 204 && gone.status === 404;
     })),
   done('github.codespaces.crud', 'codespaces', 'Codespaces: list/create/start/stop/delete', 'api', 'niche', () =>
     withRoot(async (root) => {
       // create requires a repo (422 without); create → 201 Available; stop → Shutdown; start →
-      // Available; delete → 202 then gone. (The VM COMPUTE is out-of-scope; the RESOURCE
+      // Available; delete → 202 then gone. (The VM COMPUTE is what the real root does; the RESOURCE
       // lifecycle/state machine IS modeled and verified here.)
       if ((await applyGithubWrite({ method: 'POST', path: '/user/codespaces', body: '{}', root })).response.status !== 422) return false;
       const c = await applyGithubWrite({ method: 'POST', path: '/user/codespaces', body: JSON.stringify({ repository: REPO, machine: 'standardLinux32gb', ref: 'feature' }), root });
       if (!(c.response.status === 201 && (c.response.body as { state?: string }).state === 'Available')) return false;
       const name = (c.response.body as { name?: string }).name!;
-      const list = handleGithubRequest({ method: 'GET', path: '/user/codespaces', root });
+      const list = await handleGithubRequest({ method: 'GET', path: '/user/codespaces', root });
       if (!(ok(list.status) && (list.body as { total_count?: number }).total_count === 1)) return false;
       const stop = await applyGithubWrite({ method: 'POST', path: `/user/codespaces/${name}/stop`, body: '{}', root });
       if (!(ok(stop.response.status) && (stop.response.body as { state?: string }).state === 'Shutdown')) return false;
       const start = await applyGithubWrite({ method: 'POST', path: `/user/codespaces/${name}/start`, body: '{}', root });
       if (!(ok(start.response.status) && (start.response.body as { state?: string }).state === 'Available')) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
       if (!(ok(get.status) && (get.body as { git_status?: { ref?: string } }).git_status?.ref === 'feature')) return false;
       const del = await applyGithubWrite({ method: 'DELETE', path: `/user/codespaces/${name}`, root });
-      const gone = handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
+      const gone = await handleGithubRequest({ method: 'GET', path: `/user/codespaces/${name}`, root });
       return del.response.status === 202 && gone.status === 404;
     })),
 
   // ── Security (code scanning / dependabot / secret scanning) ──────────────────────────────
-  // The alert RESOURCES + their state machines (open→dismissed/fixed/resolved) are modeled as
-  // kernel-folded CRUD + state transitions; the actual SCAN that generates them is infra the
-  // offline twin can't run (a simulator seeds the alert objects, like the rest of the twin).
-  done('github.security.code_scanning', 'security', 'Code scanning: alerts + analyses', 'api', 'niche', () =>
-    withRoot(async (root) => {
-      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/code-scanning/alerts`, body: JSON.stringify({ rule_id: 'js/sql-injection', rule_severity: 'error' }), root });
-      if (!(a.response.status === 201 && (a.response.body as { number?: number }).number === 1 && (a.response.body as { state?: string }).state === 'open')) return false;
-      const n = (a.response.body as { number?: number }).number!;
+  // GitHub raises the alerts itself, from what is pushed and what a scanner uploads; their state
+  // machines (open→dismissed/fixed/resolved) are what a person moves.
+  done('github.security.code_scanning', 'security', 'Code scanning: an uploaded analysis opens alerts; alerts + analyses', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const sha = await pushFiles(root, { 'src/q.js': 'db.query(`SELECT * FROM t WHERE id = ${id}`);\n' });
+      const up = await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/code-scanning/sarifs`, body: JSON.stringify({ commit_sha: sha, ref: 'refs/heads/main', sarif: sarifOf([{ rule: 'js/sql-injection', level: 'error', uri: 'src/q.js', line: 1 }]) }), root });
+      if (up.response.status !== 202) return false;
+      const opened = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/code-scanning/alerts/1`, root });
+      if (!(ok(opened.status) && (opened.body as { state?: string }).state === 'open')) return false;
+      const n = 1;
       // dismiss requires a valid reason (422 without / invalid); dismissing reads back dismissed.
-      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
-      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'bogus' }), root })).response.status !== 422) return false;
-      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'false positive' }), root });
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'bogus' }), root })).response.status !== 422) return false;
+      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/code-scanning/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'false positive' }), root });
       if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'dismissed' && (dm.response.body as { dismissed_reason?: string }).dismissed_reason === 'false positive')) return false;
       // filter by state; the dismissed alert is excluded from ?state=open.
-      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/alerts?state=open`, root });
+      const open = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/code-scanning/alerts?state=open`, root });
       if (!(ok(open.status) && isArr(open.body) && open.body.length === 0)) return false;
-      // analyses: create → list → delete.
-      const an = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/code-scanning/analyses`, body: JSON.stringify({ ref: 'refs/heads/main', results_count: 3, rules_count: 50 }), root });
-      if (!(an.response.status === 201 && (an.response.body as { results_count?: number }).results_count === 3)) return false;
-      const aid = (an.response.body as { id?: number }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/analyses`, root });
-      const delA = await applyGithubWrite({ method: 'DELETE', path: `/repos/${REPO}/code-scanning/analyses/${aid}`, root });
-      const after = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/code-scanning/analyses`, root });
+      // the upload made one analysis: list → delete.
+      const list = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/code-scanning/analyses`, root });
+      const aid = isArr(list.body) ? (list.body[0] as { id?: number }).id : undefined;
+      const delA = await applyGithubWrite({ method: 'DELETE', path: `/repos/${HISTORY_REPO}/code-scanning/analyses/${aid}`, root });
+      const after = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/code-scanning/analyses`, root });
       // an unknown alert PATCH 404s.
-      const missing = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/code-scanning/alerts/999`, body: JSON.stringify({ state: 'open' }), root });
+      const missing = await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/code-scanning/alerts/999`, body: JSON.stringify({ state: 'open' }), root });
       return ok(list.status) && isArr(list.body) && list.body.length === 1 && delA.response.status === 200 && isArr(after.body) && after.body.length === 0 && missing.response.status === 404;
     })),
-  done('github.security.dependabot', 'security', 'Dependabot: alerts + security updates', 'api', 'niche', () =>
-    withRoot(async (root) => {
-      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/dependabot/alerts`, body: JSON.stringify({ package_name: 'lodash', ecosystem: 'npm', severity: 'critical', ghsa_id: 'GHSA-x' }), root });
-      if (!(a.response.status === 201 && (a.response.body as { state?: string }).state === 'open' && (a.response.body as { security_advisory?: { ghsa_id?: string } }).security_advisory?.ghsa_id === 'GHSA-x')) return false;
-      const n = (a.response.body as { number?: number }).number!;
-      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
-      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'tolerable_risk' }), root });
+  done('github.security.dependabot', 'security', 'Dependabot: alerts turned on (vulnerability-alerts) read the manifests, and a vulnerable dependency pushed opens an alert; alerts + dismissals', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'package.json': JSON.stringify({ name: 'demo', dependencies: { minimist: '1.2.0' } }) });
+      // off until turned on, which reads the default branch's manifests at once
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/vulnerability-alerts`, root })).status !== 404) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts`, root })).status !== 403) return false;
+      if ((await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/vulnerability-alerts`, root })).response.status !== 204) return false;
+      if ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/vulnerability-alerts`, root })).status !== 204) return false;
+      const a = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts/1`, root });
+      if (!(ok(a.status) && (a.body as { state?: string }).state === 'open' && (a.body as { security_advisory?: { ghsa_id?: string } }).security_advisory?.ghsa_id === 'GHSA-xvch-5gv4-984h')) return false;
+      const n = 1;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed' }), root })).response.status !== 422) return false;
+      const dm = await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'dismissed', dismissed_reason: 'tolerable_risk' }), root });
       if (!(ok(dm.response.status) && (dm.response.body as { state?: string }).state === 'dismissed')) return false;
       // reopen → state open + dismissal cleared.
-      const re = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'open' }), root });
+      const re = await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/dependabot/alerts/${n}`, body: JSON.stringify({ state: 'open' }), root });
       if (!(ok(re.response.status) && (re.response.body as { state?: string }).state === 'open' && (re.response.body as { dismissed_reason?: unknown }).dismissed_reason === null)) return false;
-      const dismissed = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/dependabot/alerts?state=dismissed`, root });
-      const get = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/dependabot/alerts/${n}`, root });
-      return ok(dismissed.status) && isArr(dismissed.body) && dismissed.body.length === 0 && ok(get.status) && (get.body as { severity?: unknown; security_vulnerability?: { severity?: string } }).security_vulnerability?.severity === 'critical';
+      const dismissed = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts?state=dismissed`, root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts/${n}`, root });
+      return ok(dismissed.status) && isArr(dismissed.body) && dismissed.body.length === 0 && ok(get.status) && (get.body as { security_vulnerability?: { severity?: string } }).security_vulnerability?.severity === 'critical';
     })),
-  done('github.security.secret_scanning', 'security', 'Secret scanning: alerts', 'api', 'niche', () =>
+  done('github.security.secret_scanning', 'security', 'Secret scanning: a pushed secret opens an alert; alerts + locations', 'api', 'niche', () =>
     withRoot(async (root) => {
-      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/secret-scanning/alerts`, body: JSON.stringify({ secret_type: 'github_pat' }), root });
-      if (!(a.response.status === 201 && (a.response.body as { state?: string }).state === 'open')) return false;
-      const n = (a.response.body as { number?: number }).number!;
+      await pushFiles(root, { '.env': 'GITHUB_TOKEN=ghp_Demo01234567890123456789abcdefghijkl\n' });
+      const a = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts/1`, root });
+      if (!(ok(a.status) && (a.body as { state?: string }).state === 'open')) return false;
+      const n = 1;
       // resolving requires a valid resolution (422 without/invalid); resolved reads back resolved.
-      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved' }), root })).response.status !== 422) return false;
-      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'bogus' }), root })).response.status !== 422) return false;
-      const rs = await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'revoked' }), root });
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved' }), root })).response.status !== 422) return false;
+      if ((await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'bogus' }), root })).response.status !== 422) return false;
+      const rs = await applyGithubWrite({ method: 'PATCH', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts/${n}`, body: JSON.stringify({ state: 'resolved', resolution: 'revoked' }), root });
       if (!(ok(rs.response.status) && (rs.response.body as { state?: string }).state === 'resolved' && (rs.response.body as { resolution?: string }).resolution === 'revoked')) return false;
-      const locs = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/secret-scanning/alerts/${n}/locations`, root });
-      const open = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/secret-scanning/alerts?state=open`, root });
+      const locs = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts/${n}/locations`, root });
+      const open = await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/secret-scanning/alerts?state=open`, root });
       return ok(locs.status) && isArr(locs.body) && locs.body.length === 1 && ok(open.status) && isArr(open.body) && open.body.length === 0;
     })),
 
@@ -1958,6 +2713,10 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const gql = (query: string, variables?: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root });
       // seed a repo + PR + issue via REST, then read them back through GraphQL (SAME projection).
       await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo', private: true }), root });
+      // the repo has a git plane, so the PR's head branch must exist there first (a missing head is GitHub's 422)
+      const main = ((await handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/branches', root })).body as Array<{ name: string; commit: { sha: string } }>).find((b) => b.name === 'main');
+      if (!main) return false;
+      await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/git/refs', body: JSON.stringify({ ref: 'refs/heads/a', sha: main.commit.sha }), root });
       await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/pulls', body: JSON.stringify({ title: 'Add X', head: 'a', base: 'main' }), root });
       await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/issues', body: JSON.stringify({ title: 'A bug' }), root });
       // viewer
@@ -1974,7 +2733,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       // appears in the REST issue-comments list (consistency across surfaces).
       const mut = await gql('mutation($s:ID!,$b:String!){ addComment(input:{subjectId:$s,body:$b}){ commentEdge { node { id body } } } }', { s: 'I_octo/demo#2', b: 'from graphql' });
       if ((mut.response.body as any).data?.addComment?.commentEdge?.node?.body !== 'from graphql') return false;
-      const restComments = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/issues/2/comments', root });
+      const restComments = await handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/issues/2/comments', root });
       if (!(ok(restComments.status) && isArr(restComments.body) && restComments.body.length === 1 && (restComments.body[0] as { body?: string }).body === 'from graphql')) return false;
       // HONESTY: an UNMODELED field raises a typed GraphQL error (not a fabricated value).
       const bad = await gql('query { repository(owner:"octo",name:"demo"){ stargazerCount } }');
@@ -2002,6 +2761,60 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const p = (await gql(pq, { o: 'octo', n: 'demo' })).response.body as any;
       return p.data?.repository?.pullRequests?.totalCount === 0 && !p.errors;
     })),
+  done('github.graphql.create_discussion', 'api', 'GraphQL discussion category lookup and createDiscussion, with persisted replies and repository-scoped category validation', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const gql = async (query: string, variables?: Record<string, unknown>) => (await applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root, occurredAt: '2026-02-03T04:05:06.000Z' })).response.body as any;
+      for (const name of ['demo', 'other']) await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name }), root });
+      const categories = 'query($name:String!,$first:Int!,$after:String){ repository(owner:"octo",name:$name){ id discussionCategories(first:$first,after:$after){ nodes { id name slug isAnswerable } pageInfo { hasNextPage endCursor } } } }';
+      const repo = (await gql(categories, { name: 'demo', first: 100 })).data?.repository;
+      const cat = repo?.discussionCategories?.nodes?.find((c: any) => c.slug === 'general');
+      if (!cat?.id || cat.name !== 'General' || cat.isAnswerable !== false) return false;
+      const first = (await gql(categories, { name: 'demo', first: 1 })).data?.repository?.discussionCategories;
+      const next = (await gql(categories, { name: 'demo', first: 1, after: first?.pageInfo?.endCursor })).data?.repository?.discussionCategories;
+      if (first?.nodes?.length !== 1 || first.pageInfo.hasNextPage !== true || next?.nodes?.length !== 1 || next.nodes[0].id === first.nodes[0].id) return false;
+      const mutation = 'mutation($input:CreateDiscussionInput!){ createDiscussion(input:$input){ clientMutationId discussion { id number title body createdAt category { id slug } } } }';
+      const input = { repositoryId: repo.id, categoryId: cat.id, title: 'Usage tips', body: 'Try the help command', clientMutationId: 'request-7' };
+      const made = (await gql(mutation, { input })).data?.createDiscussion;
+      const d = made?.discussion;
+      assert.equal(d?.createdAt, '2026-02-03T04:05:06.000Z', 'GraphQL creation keeps the World instant');
+      assert.equal(githubState(root).discussions[0]?.created_at, d.createdAt, 'stored creation keeps the same World instant');
+      if (made?.clientMutationId !== 'request-7' || !d?.id || d.title !== input.title || d.body !== input.body || d.category?.id !== cat.id) return false;
+      const read = () => gql('query { repository(owner:"octo",name:"demo"){ discussions(first:100){ nodes { id title body category { id slug } comments { nodes { body } } } } } }');
+      const stored = (await read()).data?.repository?.discussions?.nodes?.find((x: any) => x.id === d.id);
+      if (stored?.body !== input.body || stored?.category?.id !== cat.id) return false;
+      const reply = await gql('mutation($d:ID!,$b:String!){ addDiscussionComment(input:{discussionId:$d,body:$b}){ comment { body } } }', { d: d.id, b: 'Thanks for the tip' });
+      if (reply.data?.addDiscussionComment?.comment?.body !== 'Thanks for the tip' || !(await read()).data?.repository?.discussions?.nodes?.[0]?.comments?.nodes?.some((c: any) => c.body === 'Thanks for the tip')) return false;
+      for (const changed of [{ categoryId: 'bad' }, { repositoryId: 'R_octo/other' }, { repositoryId: 'R_octo/missing' }, { title: null }, { body: undefined }, { title: 42 }, { clientMutationId: 42 }, { unsupportedInput: 'bad' }]) {
+        if (!(await gql(mutation, { input: { ...input, ...changed } })).errors?.length) return false;
+      }
+      for (const invalid of [mutation.replace('number title', 'unsupportedField number title'), mutation.replace('number title', 'name number title'), mutation.replace('category { id slug }', 'category { unsupportedField }'), mutation.replace('category { id slug }', 'category { emoji }')]) {
+        assert.ok((await gql(invalid, { input })).errors?.length, 'unknown selection refuses before mutation');
+        assert.equal(githubState(root).discussions.length, 1, 'unknown selection never stores a discussion');
+      }
+      assert.ok((await gql(categories, { name: 'missing', first: 100 })).errors?.length, 'missing repository does not invent categories');
+      const inline = 'mutation($r:ID!,$c:ID!,$t:String!,$b:String!){ createDiscussion(input:{repositoryId:$r,categoryId:$c,title:$t,body:$b}){ discussion { title body } } }';
+      for (const [t, b] of [[null, 'body'], ['title', 42]]) {
+        assert.ok((await gql(inline, { r: repo.id, c: cat.id, t, b })).errors?.length, 'inline input preserves variable types');
+        assert.equal(githubState(root).discussions.length, 1, 'invalid typed variable never writes');
+      }
+      const text = 'A "quoted" tip\nwith a second line';
+      const literal = await gql(`mutation { createDiscussion(input:{repositoryId:${JSON.stringify(repo.id)},categoryId:${JSON.stringify(cat.id)},title:"Quoted",body:${JSON.stringify(text)}}){ discussion { body } } }`);
+      assert.equal(literal.data?.createDiscussion?.discussion?.body, text, 'GraphQL string escapes round-trip');
+      if ((await read()).data?.repository?.discussions?.nodes?.length !== 2) return false;
+      // Real transport proves the mutation reaches the server's existing webhook pipeline.
+      const deliveries: Array<{ event: string | null; body: any }> = [];
+      const hook = Bun.serve({ hostname: '127.0.0.1', port: 0, async fetch(req) { deliveries.push({ event: req.headers.get('x-github-event'), body: await req.json() }); return new Response('ok'); } });
+      const server = await createGithubTwinServer({ root });
+      try {
+        const registered = await fetch(`http://127.0.0.1:${server.port}/repos/octo/demo/hooks`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'web', events: ['discussion'], config: { url: `http://127.0.0.1:${hook.port}/hook`, content_type: 'json' } }) });
+        assert.equal(registered.status, 201);
+        const response = await fetch(`http://127.0.0.1:${server.port}/graphql`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ query: mutation, variables: { input: { ...input, title: 'Webhook discussion' } } }) });
+        const result = await response.json() as any;
+        assert.equal(result.data?.createDiscussion?.discussion?.title, 'Webhook discussion');
+        assert.ok(deliveries.some((d) => d.event === 'discussion' && d.body.action === 'created' && d.body.repository?.full_name === 'octo/demo' && d.body.number === result.data.createDiscussion.discussion.number), 'GraphQL creation delivers the discussion webhook');
+        return true;
+      } finally { server.stop(); hook.stop(true); }
+    })),
   done('github.graphql.create_pull_request', 'api', 'GraphQL createPullRequest mutation + pullRequests(headRefName,states) connection (gh pr create/view/list)', 'api', 'niche', () =>
     withRoot(async (root) => {
       const gql = (query: string, variables?: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root });
@@ -2012,7 +2825,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const m = (await gql(mutation, { input: { repositoryId: 'R_octo/demo', baseRefName: 'main', headRefName: 'feat', title: 'Add X', body: 'B', draft: false } })).response.body as any;
       if (m.data?.createPullRequest?.pullRequest?.id !== 'PR_octo/demo#1') return false;
       // the PR is now real on the REST surface too (cross-surface consistency).
-      const rest = handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/pulls/1', root });
+      const rest = await handleGithubRequest({ method: 'GET', path: '/repos/octo/demo/pulls/1', root });
       if (!(ok(rest.status) && (rest.body as any).head?.ref === 'feat')) return false;
       // pullRequests(headRefName, states) filters: matching branch returns the node; a miss is empty.
       const byBranch = 'query($o:String!,$n:String!,$h:String!,$s:[PullRequestState!]){ repository(owner:$o,name:$n){ pullRequests(headRefName:$h, states:$s, first:30, orderBy:{field:CREATED_AT,direction:DESC}){ totalCount nodes { number headRefName baseRefName url state } pageInfo { hasNextPage } } } }';
@@ -2022,32 +2835,148 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const miss = (await gql(byBranch, { o: 'octo', n: 'demo', h: 'nope', s: ['OPEN'] })).response.body as any;
       return miss.data?.repository?.pullRequests?.totalCount === 0 && !miss.errors;
     })),
-  done('github.apps.installations', 'api', 'GitHub Apps: installations + installation tokens', 'api', 'niche', () =>
-    withRoot(async (root) => {
-      // seed an installation (twin construct — real installs can't be observed offline), list,
-      // get one, then mint an installation access token bound to its permissions.
-      const inst = await applyGithubWrite({ method: 'POST', path: '/app/installations', body: JSON.stringify({ account_login: 'octo-org', app_id: 7, app_slug: 'ci-bot', permissions: { contents: 'read', issues: 'write' }, events: ['push'] }), root });
-      if (!(inst.response.status === 201 && (inst.response.body as { account?: { login?: string } }).account?.login === 'octo-org')) return false;
-      const id = (inst.response.body as { id?: number }).id!;
-      const list = handleGithubRequest({ method: 'GET', path: '/app/installations', root });
+  done('github.apps.installations', 'api', 'GitHub Apps: installed on their page, installations + installation tokens', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // register an app (twin door: GitHub's settings UI has no API), install it on its page
+      // (src/screens/app-installation.tsx) for one repository, then list, get one, and mint a token.
+      if ((await applyGithubWrite({ method: 'POST', path: '/_twin/apps', body: JSON.stringify({ slug: 'ci-bot', name: 'CI Bot', permissions: { contents: 'read', issues: 'write' }, events: ['push'], setup_url: 'http://app.local/setup' }), root })).response.status !== 201) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'demo' }), root })).response.status !== 201) return false;
+      const cookie = await signIn(root);
+      const page = await handleGithubRequest({ method: 'GET', path: '/apps/ci-bot/installations/new', root, cookie });
+      if (!(page.status === 200 && typeof page.body === 'string' && page.body.includes('Install CI Bot') && page.body.includes('Only select repositories'))) return false;
+      const { createGithubTwinFetch } = await import('./github-server.ts');
+      const inst = await createGithubTwinFetch({ root })(new Request('https://github.com/apps/ci-bot/installations/new', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie }, body: 'install=1&target_login=octocat&repository_selection=selected&repositories=demo&state=s1' }));
+      const back = new URL(inst.headers.get('location') ?? 'http://x/');
+      if (!(inst.status === 302 && back.origin === 'http://app.local' && back.searchParams.get('setup_action') === 'install' && back.searchParams.get('state') === 's1')) return false;
+      const id = Number(back.searchParams.get('installation_id'));
+      const list = await handleGithubRequest({ method: 'GET', path: '/app/installations', root, token: appJwt('ci-bot') });
       if (!(ok(list.status) && isArr(list.body) && list.body.length === 1)) return false;
-      const get = handleGithubRequest({ method: 'GET', path: `/app/installations/${id}`, root });
-      if (!(ok(get.status) && (get.body as { app_slug?: string }).app_slug === 'ci-bot')) return false;
-      const tok = await applyGithubWrite({ method: 'POST', path: `/app/installations/${id}/access_tokens`, body: JSON.stringify({ permissions: { contents: 'read' } }), root });
+      const get = await handleGithubRequest({ method: 'GET', path: `/app/installations/${id}`, root, token: appJwt('ci-bot') });
+      if (!(ok(get.status) && (get.body as { app_slug?: string }).app_slug === 'ci-bot' && (get.body as { repository_selection?: string }).repository_selection === 'selected')) return false;
+      const tok = await applyGithubWrite({ method: 'POST', path: `/app/installations/${id}/access_tokens`, body: JSON.stringify({ permissions: { contents: 'read' } }), root, token: appJwt('ci-bot') });
       if (!(tok.response.status === 201 && typeof (tok.response.body as { token?: string }).token === 'string' && (tok.response.body as { token?: string }).token!.startsWith('ghs_') && (tok.response.body as { permissions?: { contents?: string } }).permissions?.contents === 'read')) return false;
       // a token for an unknown installation 404s.
-      const missing = await applyGithubWrite({ method: 'POST', path: '/app/installations/9999/access_tokens', body: '{}', root });
+      const missing = await applyGithubWrite({ method: 'POST', path: '/app/installations/9999/access_tokens', body: '{}', root, token: appJwt('ci-bot') });
       return missing.response.status === 404;
     })),
-  done('github.oauth.flow', 'auth', 'OAuth app authorization + token scopes', 'api', 'niche', () =>
-    withRoot(async (root) => {
-      // The API half of the OAuth flow: exchange a code for a token bound to scopes, then a
-      // scope-gated call returns 401 (no token), 403 (missing scope), 200 (has scope); revoke.
-      // The hosted CONSENT SCREEN (a browser UI, not an API) is out-of-scope (carved below).
-      if ((await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid' }), root })).response.status !== 422) return false;
-      const ex = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid', code: 'abc', scope: 'repo read:org' }), root });
-      if (!(ok(ex.response.status) && (ex.response.body as { token_type?: string }).token_type === 'bearer' && (ex.response.body as { scope?: string }).scope === 'repo,read:org')) return false;
-      const token = (ex.response.body as { access_token?: string }).access_token!;
+  done('github.apps.jwt', 'apps', 'Apps: the app speaks for itself with a JWT of its client ID: GET /app, its webhook deliveries (naming their installation), and deleting an installation; no JWT, no answer', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/_twin/apps', body: JSON.stringify({ slug: 'jwt-bot', name: 'JWT Bot', owner: 'octocat', permissions: { contents: 'read' }, events: [], hook_attributes: { url: 'http://127.0.0.1:9/hook' } }), root });
+      const installed = await githubAppInstallationFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/apps/jwt-bot/installations/new', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie: await signIn(root) }, body: new URLSearchParams({ install: '1' }).toString() }));
+      if (installed?.status !== 302) return false;
+      const id = ((await handleGithubRequest({ method: 'GET', path: '/app/installations', root, token: appJwt('jwt-bot') })).body as { id: number }[])[0]!.id;
+      if ((await handleGithubRequest({ method: 'GET', path: '/app', root })).status !== 401) return false;
+      const me = (await handleGithubRequest({ method: 'GET', path: '/app', root, token: appJwt('jwt-bot') })).body as { slug: string };
+      const deliveries = (await handleGithubRequest({ method: 'GET', path: '/app/hook/deliveries', root, token: appJwt('jwt-bot') })).body as Array<{ id: number; event: string; installation_id: number | null }>;
+      const one = (await handleGithubRequest({ method: 'GET', path: `/app/hook/deliveries/${deliveries[0]!.id}`, root, token: appJwt('jwt-bot') })).body as { request: { payload: { installation: { id: number } } } };
+      const del = await applyGithubWrite({ method: 'DELETE', path: `/app/installations/${id}`, root, token: appJwt('jwt-bot') });
+      const left = (await handleGithubRequest({ method: 'GET', path: '/app/installations', root, token: appJwt('jwt-bot') })).body as unknown[];
+      return me.slug === 'jwt-bot' && deliveries[0]!.event === 'installation' && deliveries[0]!.installation_id === id && one.request.payload.installation.id === id && del.response.status === 204 && left.length === 0;
+    })),
+  done('github.apps.installation_events', 'apps', 'Apps: an app installed on a repository gets the repository\'s events it subscribes to on its own webhook, with the installation\'s id', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      await applyGithubWrite({ method: 'POST', path: '/_twin/apps', body: JSON.stringify({ slug: 'pr-bot', name: 'PR Bot', owner: 'octocat', permissions: { checks: 'write', pull_requests: 'read' }, events: ['pull_request'], hook_attributes: { url: 'http://127.0.0.1:9/hook' } }), root });
+      await githubAppInstallationFlow({ root, now: () => '2026-01-01T00:00:00.000Z' })(new Request('https://github.com/apps/pr-bot/installations/new', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie: await signIn(root) }, body: new URLSearchParams({ install: '1', repository_selection: 'selected', repositories: 'ci-demo' }).toString() }));
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/b', sha: main }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'b', content: Buffer.from('b\n').toString('base64'), branch: 'b' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'b', base: 'main' }), root });
+      const installation = ((await handleGithubRequest({ method: 'GET', path: '/app/installations', root, token: appJwt('pr-bot') })).body as { id: number }[])[0]!.id;
+      const deliveries = (await handleGithubRequest({ method: 'GET', path: '/app/hook/deliveries', root, token: appJwt('pr-bot') })).body as Array<{ id: number; event: string; action: string | null; installation_id: number | null }>;
+      const pr = deliveries.find((d) => d.event === 'pull_request' && d.action === 'opened');
+      return !!pr && pr.installation_id === installation;
+    })),
+  done('github.apps.manifest', 'apps', 'Apps: registered from a manifest posted to an organization\'s new-app page; the code GitHub redirects back with converts once into the app\'s id, PEM and secrets', 'ui', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'octo' }), root, cookie: await signIn(root) });
+      const manifest = JSON.stringify({ name: 'Octo Linter', url: 'https://lint.example', redirect_url: 'https://lint.example/done', hook_attributes: { url: 'http://127.0.0.1:9/hook' }, default_permissions: { checks: 'write' }, default_events: ['pull_request'] });
+      const page = githubAppManifestFlow({ root, now: () => '2026-01-01T00:00:00.000Z' });
+      const cookie = await signIn(root);
+      const post = (body: Record<string, string>) => page(new Request('https://github.com/organizations/octo/settings/apps/new?state=s1', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', cookie }, body: new URLSearchParams(body).toString() }));
+      const shown = await post({ manifest });
+      if (shown?.status !== 200 || !(await shown.text()).includes('Create GitHub App for')) return false;
+      const made = await post({ manifest, create: '1' });
+      const back = new URL(made?.headers.get('location') ?? 'http://x/');
+      if (made?.status !== 302 || back.origin + back.pathname !== 'https://lint.example/done' || back.searchParams.get('state') !== 's1') return false;
+      const code = back.searchParams.get('code')!;
+      const app = await applyGithubWrite({ method: 'POST', path: `/app-manifests/${code}/conversions`, body: '{}', root });
+      const body = app.response.body as { slug: string; owner: { login: string; type: string }; pem: string; webhook_secret: string; client_secret: string };
+      const again = await applyGithubWrite({ method: 'POST', path: `/app-manifests/${code}/conversions`, body: '{}', root });
+      return app.response.status === 201 && body.slug === 'octo-linter' && body.owner.login === 'octo' && body.owner.type === 'Organization' && body.pem.startsWith('-----BEGIN RSA PRIVATE KEY-----')
+        && typeof body.webhook_secret === 'string' && typeof body.client_secret === 'string' && again.response.status === 404;
+    })),
+  done('github.discussions.category_by_slug', 'discussions', 'Discussions: GraphQL Repository.discussionCategory(slug:) finds one category (null for no such slug)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await applyGithubWrite({ method: 'POST', path: '/user/repos', body: JSON.stringify({ name: 'talk', has_discussions: true }), root });
+      const q = async (slug: string) => (await applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query: `query { repository(owner: "octocat", name: "talk") { id discussionCategory(slug: "${slug}") { id name isAnswerable } } }` }), root })).response;
+      const qa = ((await q('q-a')).body as { data: { repository: { id: string; discussionCategory: { name: string; isAnswerable: boolean } | null } } }).data.repository;
+      const none = ((await q('nope')).body as { data: { repository: { discussionCategory: unknown } } }).data.repository.discussionCategory;
+      return qa.discussionCategory?.name === 'Q&A' && qa.discussionCategory.isAnswerable && typeof qa.id === 'string' && none === null;
+    })),
+  done('github.projects.collaborators', 'projects', 'Projects: a person is granted a role on an organization project (GraphQL updateProjectV2Collaborators), found by Query.user', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await mintToken(root, 'ada');
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'octo' }), root, cookie: await signIn(root) });
+      const gql = async (query: string, variables: Record<string, unknown> = {}) => (await applyGithubWrite({ method: 'POST', path: '/graphql', body: JSON.stringify({ query, variables }), root })).response.body as { data: any; errors?: unknown[] };
+      const ids = (await gql('query { organization(login: "octo") { id } user(login: "ada") { id } }')).data;
+      const pid = (await gql('mutation($o: ID!) { createProjectV2(input: {ownerId: $o, title: "Board"}) { projectV2 { id } } }', { o: ids.organization.id })).data.createProjectV2.projectV2.id;
+      const granted = (await gql(`mutation { updateProjectV2Collaborators(input: { projectId: "${pid}", collaborators: [{ userId: "${ids.user.id}", role: WRITER }] }) { collaborators { nodes { ... on User { login } } } } }`)).data;
+      const nobody = await gql('query { user(login: "nobody") { id } }');
+      return granted.updateProjectV2Collaborators.collaborators.nodes[0]?.login === 'ada' && (nobody.errors?.length ?? 0) === 1;
+    })),
+  done('github.session.two_factor', 'auth', 'Sign-in: a person with two-factor authentication gives the code their TOTP app shows after the password; a new organization is its signed-in creator\'s', 'ui', 'niche', () =>
+    withRoot(async (root) => {
+      // the new-organization page sends a visitor not signed in to the sign-in
+      const { createGithubTwinFetch } = await import('./github-server.ts');
+      const visitor = await createGithubTwinFetch({ root })(new Request('https://github.com/_twin/orgs', { method: 'POST', body: JSON.stringify({ login: 'octo' }) }));
+      if (!(visitor.status === 302 && visitor.headers.get('location') === '/login?return_to=%2Faccount%2Forganizations%2Fnew')) return false;
+      await applyGithubWrite({ method: 'POST', path: '/_twin/users/mona/password', body: JSON.stringify({ password: 'probe-password' }), root });
+      const secret = ((await applyGithubWrite({ method: 'POST', path: '/_twin/users/mona/two-factor', body: '{}', root })).response.body as { secret: string }).secret;
+      if (!/^[A-Z2-7]{32}$/.test(secret)) return false;
+      const at = '2026-01-01T00:00:00.000Z';
+      const flow = githubSessionFlow({ root, now: () => at });
+      const form = (path: string, body: Record<string, string>, cookie?: string) => flow(new Request(`https://github.com${path}`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', ...(cookie ? { cookie } : {}) }, body: new URLSearchParams(body).toString() }));
+      const cookies = (res: Response | undefined) => (res?.headers.getSetCookie() ?? []).map((c) => c.split(';')[0]).join('; ');
+      // the right password sets no session: GitHub asks for the second factor
+      const first = await form('/session', { login: 'mona', password: 'probe-password', return_to: '/account/organizations/new' });
+      if (!(first?.status === 302 && first.headers.get('location') === '/sessions/two-factor/app' && !cookies(first).includes('user_session'))) return false;
+      const pending = cookies(first);
+      const page = await flow(new Request('https://github.com/sessions/two-factor/app', { headers: { cookie: pending } }));
+      if (!(page?.status === 200 && (await page.text()).includes('name="app_otp"'))) return false;
+      // a wrong code shows GitHub's message; the code the app shows signs her in and returns her
+      const wrong = await form('/sessions/two-factor', { app_otp: '000000' === totpCode(secret, totpStep(at)) ? '111111' : '000000' }, pending);
+      if (!(wrong?.status === 200 && (await wrong.text()).includes('Two-factor authentication failed.'))) return false;
+      // her authenticator app (the twin's door) shows a six-digit code for the World clock's now
+      if (!/^\d{6}$/.test(((await handleGithubRequest({ method: 'GET', path: '/_twin/users/mona/totp', root })).body as { code: string }).code)) return false;
+      const signed = await form('/sessions/two-factor', { app_otp: totpCode(secret, totpStep(at)) }, pending);
+      if (!(signed?.status === 302 && signed.headers.get('location') === '/account/organizations/new' && cookies(signed).includes('user_session='))) return false;
+      // the same code is never taken twice
+      const again = cookies(await form('/session', { login: 'mona', password: 'probe-password', return_to: '/' }));
+      if (!(await (await form('/sessions/two-factor', { app_otp: totpCode(secret, totpStep(at)) }, again))!.text()).includes('Two-factor authentication failed.')) return false;
+      const cookie = cookies(signed).split('; ').filter((c) => c.startsWith('user_session=')).join('; ');
+      if ((await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'octo' }), root, cookie })).response.status !== 201) return false;
+      return ((await handleGithubRequest({ method: 'GET', path: '/orgs/octo/members?role=admin', root })).body as { login: string }[]).some((u) => u.login === 'mona');
+    })),
+  done('github.oauth.flow', 'auth', 'OAuth web flow: consent, code exchange, token scopes', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // The OAuth web flow (src/screens/oauth.tsx): the user's consent issues a code bound to the scopes they
+      // saw, the application exchanges it once for a token (GitHub's default answer is form-encoded), and a
+      // made-up or reused code is bad_verification_code.
+      const consent = { client_id: 'cid', redirect_uri: 'http://app.local/callback', scope: 'repo read:org', state: 's1' };
+      const cookie = await signIn(root);
+      const page = await handleGithubRequest({ method: 'GET', path: `/login/oauth/authorize?${new URLSearchParams(consent)}`, root, cookie });
+      if (!(page.status === 200 && typeof page.body === 'string' && page.body.includes('Authorize octocat'))) return false;
+      if ((await applyGithubWrite({ method: 'POST', path: '/login/oauth/authorize', body: JSON.stringify({ ...consent, authorize: '1' }), root, cookie })).response.status !== 302) return false;
+      const code = String(twinResources('github', root).find((r) => r.type === 'oauth_code')?.code ?? '');
+      const made = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid', code: 'abc' }), root });
+      if (new URLSearchParams(String(made.response.body)).get('error') !== 'bad_verification_code') return false;
+      const ex = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid', code }), root });
+      const granted = new URLSearchParams(String(ex.response.body));
+      if (!(ok(ex.response.status) && granted.get('token_type') === 'bearer' && granted.get('scope') === 'read:org,repo')) return false;
+      const token = granted.get('access_token')!;
+      const again = await applyGithubWrite({ method: 'POST', path: '/login/oauth/access_token', body: JSON.stringify({ client_id: 'cid', code }), root });
+      if (new URLSearchParams(String(again.response.body)).get('error') !== 'bad_verification_code') return false;
       // no token → 401; valid token lacking scope → 403; with scope → 200.
       if ((await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token: 'bad', required_scope: 'repo' }), root })).response.status !== 401) return false;
       if ((await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token, required_scope: 'admin:org' }), root })).response.status !== 403) return false;
@@ -2058,6 +2987,274 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const afterRevoke = await applyGithubWrite({ method: 'POST', path: '/_twin/oauth/call', body: JSON.stringify({ token, required_scope: 'repo' }), root });
       return rev.response.status === 204 && afterRevoke.response.status === 401;
     })),
+  done('github.orgs.two_factor_requirement', 'orgs', 'Orgs: the two-factor requirement, reported to owners only', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // GitHub sets it in its settings UI (the twin's construct stands in) and reports it only to the org's owners.
+      await applyGithubWrite({ method: 'POST', path: '/_twin/orgs', body: JSON.stringify({ login: 'octo', name: 'Octo' }), root, cookie: await signIn(root) });
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/alice`, body: JSON.stringify({ role: 'admin' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/octo/memberships/bob`, body: JSON.stringify({ role: 'member' }), root });
+      const [alice, bob] = [await acceptInvite(root, 'octo', 'alice'), await acceptInvite(root, 'octo', 'bob')];
+      const seen = async (token?: string) => ((await handleGithubRequest({ method: 'GET', path: '/orgs/octo', root, ...(token ? { token } : {}) })).body as { two_factor_requirement_enabled?: boolean }).two_factor_requirement_enabled;
+      if (await seen(alice) !== false) return false;
+      if ((await applyGithubWrite({ method: 'PUT', path: '/_twin/orgs/octo/two-factor-requirement', body: JSON.stringify({ enabled: 'yes' }), root })).response.status !== 422) return false;
+      await applyGithubWrite({ method: 'PUT', path: '/_twin/orgs/octo/two-factor-requirement', body: JSON.stringify({ enabled: true }), root });
+      return await seen(alice) === true && await seen(bob) === undefined && await seen() === undefined;
+    })),
+  done('github.actions.environment_approvals', 'actions', 'Actions: a run\'s gated environment reviewed by its required reviewer, and who started the run', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const mint = async (login: string) => ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+      const [alice, bob] = [await mint('alice'), await mint('bob')];
+      await pushFiles(root, { '.github/workflows/deploy.yml': workflowFile('Deploy') });
+      const env = (await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/environments/production`, body: JSON.stringify({ reviewers: [{ type: 'User', reviewer: { login: 'bob' } }] }), root })).response.body as { id: number };
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/deploy.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root, token: alice });
+      const run = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root })).body as { workflow_runs: { id: number; actor?: { login?: string } | null }[] }).workflow_runs[0]!;
+      const review = (token: string, state = 'approved') => applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/runs/${run.id}/pending_deployments`, body: JSON.stringify({ environment_ids: [env.id], state, comment: 'ship it' }), root, token });
+      if (run.actor?.login !== 'alice' || (await review(alice)).response.status !== 403 || (await review(bob, 'maybe')).response.status !== 422) return false;
+      if ((await review(bob)).response.status !== 200) return false;
+      const approvals = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${run.id}/approvals`, root })).body as { state: string; user: { login: string }; environments: { name: string }[] }[];
+      return approvals.length === 1 && approvals[0]!.state === 'approved' && approvals[0]!.user.login === 'bob' && approvals[0]!.environments[0]!.name === 'production';
+    })),
+  done('github.actions.runner_completes_run', 'actions', 'Actions: the runner finishes a run (success or failure), never a run whose gated environment was rejected', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const mint = async (login: string) => ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+      const bob = await mint('bob');
+      await pushFiles(root, { '.github/workflows/deploy.yml': workflowFile('Deploy') });
+      const env = (await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/environments/production`, body: JSON.stringify({ reviewers: [{ type: 'User', reviewer: { login: 'bob' } }] }), root })).response.body as { id: number };
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/deploy.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/deploy.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const runs = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root })).body as { workflow_runs: { id: number }[] }).workflow_runs;
+      const [a, b] = runs.map((r) => r.id);
+      const complete = (id: number, conclusion: string) => applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/complete`, body: JSON.stringify({ conclusion }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/runs/${b}/pending_deployments`, body: JSON.stringify({ environment_ids: [env.id], state: 'rejected', comment: 'no' }), root, token: bob });
+      if ((await complete(a!, 'maybe')).response.status !== 422 || (await complete(b!, 'success')).response.status !== 409) return false;
+      if ((await complete(a!, 'success')).response.status !== 200 || (await complete(a!, 'failure')).response.status !== 409) return false;
+      const run = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${a}`, root })).body as { status: string; conclusion: string };
+      return run.status === 'completed' && run.conclusion === 'success';
+    })),
+  done('github.actions.pull_request_runs', 'actions', 'Actions: a pull request runs the workflows that listen for pull_request, one job per job of the file; a first-time contributor\'s run from a fork waits in action_required until someone with write access approves it', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/ci.yml': 'name: CI\non: [push, pull_request]\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm test\n' });
+      const ada = await mintToken(root, 'ada');
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/forks`, body: '{}', root, token: ada });
+      await applyGithubWrite({ method: 'PUT', path: '/repos/ada/ci-demo/contents/b.txt', body: JSON.stringify({ message: 'b', content: Buffer.from('b\n').toString('base64') }), root, token: ada });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'ada:main', base: 'main' }), root, token: ada });
+      const runs = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs?event=pull_request`, root })).body as { workflow_runs: Array<{ id: number; status: string; conclusion: string | null }> }).workflow_runs;
+      if (runs.length !== 1 || runs[0]!.status !== 'completed' || runs[0]!.conclusion !== 'action_required') return false;
+      const approve = (token?: string) => applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/runs/${runs[0]!.id}/approve`, body: '{}', root, ...(token ? { token } : {}) });
+      if ((await approve(ada)).response.status !== 403 || (await approve()).response.status !== 201 || (await approve()).response.status !== 403) return false;
+      const jobs = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${runs[0]!.id}/jobs`, root })).body as { jobs: Array<{ name: string; status: string }> };
+      return jobs.jobs.length === 1 && jobs.jobs[0]!.name === 'test' && jobs.jobs[0]!.status === 'queued';
+    })),
+  done('github.actions.check_runs', 'actions', 'Actions: each job reports a check run on its commit, named for the job, under the GitHub Actions suite, which meets a branch protection\'s required check once the job succeeds', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/ci.yml': workflowFile('CI') });
+      const id = await finishedRun(root, 'ci.yml');
+      const run = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${id}`, root })).body as { head_sha: string; check_suite_url: string };
+      const checks = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/commits/${run.head_sha}/check-runs`, root })).body as { check_runs: Array<{ name: string; conclusion: string; app: { slug: string } | null; check_suite: { id: number } }> };
+      const job = checks.check_runs.find((c) => c.name === 'build');
+      return !!job && job.conclusion === 'success' && job.app?.slug === 'github-actions' && run.check_suite_url.endsWith(`/check-suites/${job.check_suite.id}`);
+    })),
+  done('github.pulls.closing_keywords', 'pulls', 'PRs: a pull request merged into the default branch closes the issues its body or commits link with a closing keyword', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      for (const title of ['one', 'two', 'three']) await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/issues`, body: JSON.stringify({ title }), root });
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/fix', sha: main }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'Add b\n\nFixes #2', content: Buffer.from('b\n').toString('base64'), branch: 'fix' }), root });
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'fix', base: 'main', body: 'Closes #1, mentions #3' }), root })).response.body as { number: number };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root });
+      const state = async (n: number) => ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/issues/${n}`, root })).body as { state: string }).state;
+      return (await state(1)) === 'closed' && (await state(2)) === 'closed' && (await state(3)) === 'open';
+    })),
+  done('github.issues.closed_by_commit', 'issues', 'Issues: a commit pushed to the default branch closes the issues its message links with a closing keyword; one on another branch does not', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      for (const title of ['one', 'two']) await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/issues`, body: JSON.stringify({ title }), root });
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/side', sha: main }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/c.txt`, body: JSON.stringify({ message: 'c\n\nFixes #2', content: Buffer.from('c\n').toString('base64'), branch: 'side' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'b\n\nCloses #1', content: Buffer.from('b\n').toString('base64') }), root });
+      const state = async (n: number) => ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/issues/${n}`, root })).body as { state: string }).state;
+      return (await state(1)) === 'closed' && (await state(2)) === 'open';
+    })),
+  done('github.pulls.merge_is_a_push', 'pulls', 'PRs: a merge moves the base branch as a push does: Dependabot re-reads the manifests it changed', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'package.json': JSON.stringify({ name: 'demo', dependencies: { minimist: '1.2.5' } }) });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/vulnerability-alerts`, root });
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/bump', sha: main }), root });
+      const file = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/contents/package.json?ref=bump`, root })).body as { sha: string };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/package.json`, body: JSON.stringify({ message: 'Bump minimist', content: Buffer.from(JSON.stringify({ name: 'demo', dependencies: { minimist: '1.2.8' } })).toString('base64'), sha: file.sha, branch: 'bump' }), root });
+      const open = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts`, root })).body as Array<{ state: string }>)[0]?.state;
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'Bump', head: 'bump', base: 'main' }), root })).response.body as { number: number };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root });
+      const after = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/dependabot/alerts`, root })).body as Array<{ state: string }>)[0]?.state;
+      return open === 'open' && after === 'fixed';
+    })),
+  done('github.actions.push_filters', 'actions', 'Actions: a pushed tag runs the workflows whose push filters take it; branch and tag filters decide which refs a push workflow runs for', 'api', 'common', () =>
+    withRoot(async (root) => {
+      const sha = await pushFiles(root, {
+        '.github/workflows/release.yml': "name: Release\non:\n  push:\n    tags:\n      - 'v*'\njobs:\n  publish:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm pack\n",
+        '.github/workflows/ci.yml': 'name: CI\non:\n  push:\n    branches: [main]\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm test\n',
+      });
+      const runs = async (q = '') => ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs${q}`, root })).body as { workflow_runs: Array<{ name: string }> }).workflow_runs;
+      if ((await runs()).some((r) => r.name === 'Release')) return false;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/tags/v1.0.0', sha }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/tags/nightly', sha }), root });
+      const tagged = await runs('?branch=v1.0.0');
+      return tagged.length === 1 && tagged[0]!.name === 'Release' && (await runs('?branch=nightly')).length === 0;
+    })),
+  done('github.actions.github_token', 'actions', 'Actions: the runner picks up a queued run and its job gets a GITHUB_TOKEN with the workflow\'s permissions, acting as github-actions[bot], until the run finishes', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/ci.yml': 'name: CI\non: workflow_dispatch\npermissions:\n  contents: write\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm test\n' });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/ci.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const id = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root })).body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+      const start = await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/start`, body: '{}', root });
+      const { token, permissions } = start.response.body as { token: string; permissions: Record<string, string> };
+      if (permissions.contents !== 'write' || (await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/start`, body: '{}', root })).response.status !== 409) return false;
+      const run = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${id}`, root })).body as { status: string };
+      const issue = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/issues`, body: JSON.stringify({ title: 'from CI' }), root, token })).response.body as { user?: { login: string } };
+      return run.status === 'in_progress' && issue.user?.login === 'github-actions[bot]';
+    })),
+  done('github.releases.author', 'releases', 'Releases: a release names its author and an asset its uploader, a person or an app\'s bot', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const ada = await mintToken(root, 'ada');
+      await collaborator(root, HISTORY_REPO, 'ada', 'push');
+      const rel = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/releases`, body: JSON.stringify({ tag_name: 'v1' }), root, token: ada })).response.body as { id: number; author: { login: string } | null };
+      const asset = (await applyGithubWrite({ method: 'POST', path: `https://uploads.github.com/repos/${HISTORY_REPO}/releases/${rel.id}/assets?name=a.tgz`, body: 'a', contentType: 'application/gzip', root })).response.body as { uploader: { login: string } | null };
+      return rel.author?.login === 'ada' && asset.uploader?.login === 'octocat';
+    })),
+  done('github.pulls.merge_moves_branch', 'pulls', 'PRs: after a merge the base branch and its ref name the merge commit', 'api', 'core', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/b', sha: main }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'b', content: Buffer.from('b\n').toString('base64'), branch: 'b' }), root });
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'b', head: 'b', base: 'main' }), root })).response.body as { number: number };
+      const merged = (await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root })).response.body as { sha: string };
+      const branch = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      const ref = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/git/ref/heads/main`, root })).body as { object: { sha: string } }).object.sha;
+      return branch === merged.sha && ref === merged.sha;
+    })),
+  done('github.releases.generated_notes', 'releases', 'Releases: generated release notes list the pull requests merged since the previous release and the new contributors, from generate-notes or generate_release_notes', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const ada = await mintToken(root, 'ada');
+      await collaborator(root, HISTORY_REPO, 'ada', 'push');
+      const main = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/branches/main`, root })).body as { commit: { sha: string } }).commit.sha;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/b', sha: main }), root, token: ada });
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/contents/b.txt`, body: JSON.stringify({ message: 'b', content: Buffer.from('b\n').toString('base64'), branch: 'b' }), root, token: ada });
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pulls`, body: JSON.stringify({ title: 'Add b', head: 'b', base: 'main' }), root, token: ada })).response.body as { number: number };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${HISTORY_REPO}/pulls/${pr.number}/merge`, body: JSON.stringify({ merge_method: 'squash' }), root });
+      const notes = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/releases/generate-notes`, body: JSON.stringify({ tag_name: 'v1.0.0', target_commitish: 'main' }), root })).response.body as { name: string; body: string };
+      const rel = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/releases`, body: JSON.stringify({ tag_name: 'v1.0.0', generate_release_notes: true }), root })).response.body as { name: string; body: string };
+      const next = (await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/releases/generate-notes`, body: JSON.stringify({ tag_name: 'v1.1.0', target_commitish: 'main' }), root })).response.body as { body: string };
+      return notes.name === 'v1.0.0' && notes.body.includes(`* Add b by @ada in https://github.com/${HISTORY_REPO}/pull/${pr.number}`) && notes.body.includes('@ada made their first contribution')
+        && rel.body === notes.body && rel.name === 'v1.0.0' && !next.body.includes('Add b') && next.body.includes('compare/v1.0.0...v1.1.0');
+    })),
+  done('github.actions.run_artifacts', 'actions', 'Actions: a run\'s artifacts are uploaded while it runs, and listed for the run (by name too)', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { '.github/workflows/build.yml': workflowFile('Build', '      - uses: actions/upload-artifact@v4\n        with:\n          name: dist\n') });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/build.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const id = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root })).body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+      const list = async () => ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${id}/artifacts?name=dist`, root })).body as { total_count: number }).total_count;
+      if ((await list()) !== 0) return false;
+      await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/start`, body: '{}', root });
+      if ((await list()) !== 1) return false;
+      await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/complete`, body: JSON.stringify({ conclusion: 'success' }), root });
+      return (await list()) === 1;
+    })),
+  done('github.pages.deployments', 'pages', 'Pages: a workflow deploys its uploaded artifact with the run\'s GITHUB_TOKEN (pages: write); the deployment succeeds and the site is built', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const wf = "name: Pages\non: workflow_dispatch\npermissions:\n  pages: write\n  id-token: write\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/upload-pages-artifact@v3\n        with:\n          path: '.'\n      - uses: actions/deploy-pages@v4\n";
+      const sha = await pushFiles(root, { 'index.html': '<h1>hi</h1>', '.github/workflows/pages.yml': wf });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pages`, body: JSON.stringify({ build_type: 'workflow' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/pages.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      const id = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs`, root })).body as { workflow_runs: { id: number }[] }).workflow_runs[0]!.id;
+      const token = ((await applyGithubWrite({ method: 'POST', path: `/_twin/repos/${HISTORY_REPO}/actions/runs/${id}/start`, body: '{}', root })).response.body as { token: string }).token;
+      const artifact = ((await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/actions/runs/${id}/artifacts`, root, token })).body as { artifacts: { id: number; name: string }[] }).artifacts[0]!;
+      const deploy = (body: Record<string, unknown>) => applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/pages/deployments`, body: JSON.stringify(body), root, token });
+      if ((await deploy({ artifact_id: artifact.id, pages_build_version: sha })).response.status !== 422) return false;
+      const d = await deploy({ artifact_id: artifact.id, pages_build_version: sha, oidc_token: 'oidc' });
+      const status = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/pages/deployments/${(d.response.body as { id: number }).id}`, root })).body as { status: string };
+      const site = (await handleGithubRequest({ method: 'GET', path: `/repos/${HISTORY_REPO}/pages`, root })).body as { status: string };
+      return artifact.name === 'github-pages' && d.response.status === 200 && status.status === 'succeed' && site.status === 'built';
+    })),
+  done('github.repos.sync_fork', 'repos', 'Repos: a fork\'s branch synced with its upstream (merge-upstream): fast-forwarded, or none when it is not behind', 'api', 'common', () =>
+    withRoot(async (root) => {
+      await pushFiles(root, { 'a.txt': 'a\n' });
+      const ada = await mintToken(root, 'ada');
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/forks`, body: '{}', root, token: ada });
+      const tip = await pushFiles(root, { 'b.txt': 'b\n' });
+      const sync = async () => (await applyGithubWrite({ method: 'POST', path: '/repos/ada/ci-demo/merge-upstream', body: JSON.stringify({ branch: 'main' }), root, token: ada })).response.body as { merge_type: string };
+      const first = await sync();
+      const branch = ((await handleGithubRequest({ method: 'GET', path: '/repos/ada/ci-demo/branches/main', root })).body as { commit: { sha: string } }).commit.sha;
+      return first.merge_type === 'fast-forward' && branch === tip && (await sync()).merge_type === 'none';
+    })),
+  done('github.pulls.merge_attribution', 'pulls', 'PRs: created_at, merged_by, and a merge commit authored by the person who merged and committed by GitHub', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const mint = async (login: string) => ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+      const [alice, bob] = [await mint('alice'), await mint('bob')];
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root, token: alice, occurredAt: '2026-06-01T10:00:00Z' })).response.body as { number: number; created_at?: string };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/${pr.number}/merge`, body: '{}', root, token: bob, occurredAt: '2026-06-01T11:00:00Z' });
+      const got = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/${pr.number}`, root })).body as { created_at?: string; merged_by?: { login?: string } | null };
+      return pr.created_at === '2026-06-01T10:00:00Z' && got.created_at === '2026-06-01T10:00:00Z' && got.merged_by?.login === 'bob';
+    })),
+  done('github.repos.ruleset_enforcement', 'repos', 'Repos: a ruleset\'s required review refuses an unapproved merge, lets a listed bypass actor through, and logs each evaluation as a rule suite', 'api', 'core', () =>
+    withRoot(async (root) => {
+      const org = REPO.split('/')[0]!;
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/${org}/memberships/alice`, body: JSON.stringify({ role: 'admin' }), root });
+      await applyGithubWrite({ method: 'PUT', path: `/orgs/${org}/memberships/bob`, body: JSON.stringify({ role: 'member' }), root });
+      const [alice, bob] = [await acceptInvite(root, org, 'alice'), await acceptInvite(root, org, 'bob')];
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/rulesets`, body: JSON.stringify({ name: 'main', target: 'branch', enforcement: 'active', conditions: { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+        bypass_actors: [{ actor_id: 1, actor_type: 'OrganizationAdmin', bypass_mode: 'always' }], rules: [{ type: 'pull_request', parameters: { required_approving_review_count: 1 } }] }), root });
+      const open = async (token: string) => ((await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root, token })).response.body as { number: number }).number;
+      const merge = (n: number, token: string) => applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/${n}/merge`, body: '{}', root, token });
+      const one = await open(bob);
+      if ((await merge(one, bob)).response.status !== 405) return false;
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/${one}/reviews`, body: JSON.stringify({ event: 'APPROVE' }), root, token: alice });
+      if ((await merge(one, bob)).response.status !== 200) return false;
+      const two = await open(alice);
+      if ((await merge(two, alice)).response.status !== 200) return false;
+      const suites = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/rule-suites?time_period=month&rule_suite_result=all`, root })).body as { result: string; actor_name: string }[];
+      return suites.map((x) => `${x.result}:${x.actor_name}`).join(',') === 'bypass:alice,pass:bob,fail:bob';
+    })),
+  done('github.repos.ruleset_history', 'repos', 'Repos: a ruleset\'s versions with who wrote each and the ruleset as it stood, and GET /user/:account_id naming them', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      const alice = ((await applyGithubWrite({ method: 'POST', path: '/_twin/users/alice/tokens', body: '{}', root })).response.body as { token: string }).token;
+      const made = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/rulesets`, body: JSON.stringify({ name: 'main', target: 'branch', enforcement: 'active', bypass_actors: [{ actor_id: 1, actor_type: 'OrganizationAdmin', bypass_mode: 'always' }], rules: [] }), root, token: alice })).response.body as { id: number };
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/rulesets/${made.id}`, body: JSON.stringify({ bypass_actors: [] }), root, token: alice });
+      const history = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${made.id}/history`, root })).body as { version_id: number; actor: { id: number } }[];
+      const first = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/rulesets/${made.id}/history/1`, root })).body as { state: { bypass_actors: unknown[] } };
+      const who = (await handleGithubRequest({ method: 'GET', path: `/user/${history[0]!.actor.id}`, root })).body as { login?: string };
+      return history.length === 2 && history[0]!.version_id === 2 && first.state.bypass_actors.length === 1 && who.login === 'alice';
+    })),
+  done('github.auth.personal-tokens', 'auth', 'Personal access tokens: writes and GET /user belong to the token\'s user', 'api', 'niche', () =>
+    withRoot(async (root) => {
+      // GitHub mints personal tokens in its settings UI; the twin's construct mints one per user. A request carrying
+      // it is that user's: the pull request they open and the review they submit name them, and GET /user does.
+      const mint = async (login: string) => ((await applyGithubWrite({ method: 'POST', path: `/_twin/users/${login}/tokens`, body: '{}', root })).response.body as { token: string }).token;
+      const [alice, bob] = [await mint('alice'), await mint('bob')];
+      if ((await applyGithubWrite({ method: 'POST', path: '/_twin/users/not a login/tokens', body: '{}', root })).response.status !== 422) return false;
+      if (((await handleGithubRequest({ method: 'GET', path: '/user', root, token: alice })).body as { login?: string }).login !== 'alice') return false;
+      const pr = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'PR', head: 'feat', base: 'main' }), root, token: alice })).response.body as { number: number; user?: { login?: string }; head?: { sha?: string } };
+      const review = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/${pr.number}/reviews`, body: JSON.stringify({ event: 'APPROVE' }), root, token: bob })).response.body as { user?: { login?: string } };
+      // an unknown token keeps the twin's default identities
+      const other = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls/${pr.number}/reviews`, body: JSON.stringify({ event: 'COMMENT', body: 'x' }), root, token: 'twin-fake-github-token' })).response.body as { user?: { login?: string } };
+      // the pull request is found from its head commit
+      const byCommit = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/${pr.head?.sha}/pulls`, root });
+      if (!(pr.user?.login === 'alice' && review.user?.login === 'bob' && other.user?.login === 'octocat'
+        && ok(byCommit.status) && (byCommit.body as { number: number; user?: { login?: string } }[]).some((p) => p.number === pr.number && p.user?.login === 'alice'))) return false;
+      // once merged into the default branch, the commit answers with its merged pull request
+      if (!ok((await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/pulls/${pr.number}/merge`, body: '{}', root, token: bob })).response.status)) return false;
+      const merged = (await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/commits/${pr.head?.sha}/pulls`, root })).body as { number: number; merged_at?: string | null }[];
+      if (!merged.some((p) => p.number === pr.number && !!p.merged_at)) return false;
+      // a deployment and its status name who created them
+      const dep = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments`, body: JSON.stringify({ ref: 'main', environment: 'production' }), root, token: alice })).response.body as { id: number; creator?: { login?: string } | null };
+      const st = (await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/deployments/${dep.id}/statuses`, body: JSON.stringify({ state: 'success' }), root, token: bob })).response.body as { creator?: { login?: string } | null };
+      return dep.creator?.login === 'alice' && st.creator?.login === 'bob';
+    })),
 
   // ── Next honest gaps (top-down GitHub surface NOT yet modeled — keeps the denominator
   //    honest; a high % against a thin list would be misleading). Each is a real product
@@ -2070,7 +3267,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'bug' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/git/refs`, body: JSON.stringify({ ref: 'refs/heads/feat', sha: shaA }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'Fix', head: 'feat', base: 'main', body: 'Closes #1' }), root });
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'test', head_sha: shaA, status: 'completed', conclusion: 'success' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/check-runs`, body: JSON.stringify({ name: 'test', head_sha: shaA, status: 'completed', conclusion: 'success' }), root, token: await ciToken(root, REPO) });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/statuses/${shaA}`, body: JSON.stringify({ state: 'pending', context: 'agent-review' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/statuses/${shaA}`, body: JSON.stringify({ state: 'success', context: 'agent-review' }), root });
       await applyGithubWrite({ method: 'PATCH', path: `/repos/${REPO}/pulls/2`, body: JSON.stringify({ labels: ['human-required'] }), root });
@@ -2142,11 +3339,152 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   todo('github.apps.webhook_config', 'api', 'GitHub Apps: app webhook config + deliveries + manifest conversion', 'api', 'niche'),
 
   // ── Webhooks (event delivery) ────────────────────────────────────────────────────────────
-  done('github.webhooks.core_events', 'webhooks', 'Webhooks: core write events (pull_request/issues/comment/review)', 'connector', 'common', () =>
-    withRoot(async (root) => {
-      const a = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'w', head: 'a', base: 'main' }), root });
-      const b = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'w' }), root });
-      return a.webhook?.event === 'pull_request' && a.webhook.action === 'opened' && b.webhook?.event === 'issues' && b.webhook.action === 'opened';
+  done('github.webhooks.core_events', 'webhooks', 'Webhooks: native PR, issue, comment and review source snapshots', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const received: Array<{ event: string | null; payload: any }> = [];
+      let pausePush: (() => Promise<void>) | undefined;
+      let releasePush = () => {};
+      const sink = await serveHttp({ port: 0, async fetch(request) {
+        const event = request.headers.get('x-github-event');
+        received.push({ event, payload: await request.json() });
+        if (event === 'push' && pausePush) { const pause = pausePush; pausePush = undefined; await pause(); }
+        return new Response(null, { status: 204 });
+      } });
+      const server = await createGithubTwinServer({ root });
+      const sdk = octoClient({ baseUrl: `http://127.0.0.1:${server.port}` });
+      const api = async (method: string, path: string, body?: Record<string, unknown>): Promise<any> => (await sdk.request(`${method} ${path}`, body === undefined ? undefined : { data: body })).data;
+      const event = (kind: string, action: string): any => {
+        const found = received.filter(d => d.event === kind && d.payload.action === action).at(-1);
+        assert.ok(found, `${kind}:${action} must reach native HTTP receiver`);
+        assert.equal(found.payload.repository.full_name, REPO);
+        return found.payload;
+      };
+      try {
+        await api('POST', '/orgs/octo/repos', { name: 'demo' });
+        await api('POST', `/repos/${REPO}/hooks`, { events: ['push', 'pull_request', 'issues', 'issue_comment', 'pull_request_review', 'pull_request_review_comment'], config: { url: `http://127.0.0.1:${sink.port}/github`, content_type: 'json' } });
+        const initial = await api('PUT', `/repos/${REPO}/contents/a.ts`, { message: 'initial', content: Buffer.from('one\n').toString('base64') });
+        await api('POST', `/repos/${REPO}/git/refs`, { ref: 'refs/heads/topic', sha: initial.commit.sha });
+        const changed = await api('PUT', `/repos/${REPO}/contents/a.ts`, { branch: 'topic', message: 'topic', sha: initial.content.sha, content: Buffer.from('two\n').toString('base64') });
+        const pr = await api('POST', `/repos/${REPO}/pulls`, { title: 'Native source', head: 'topic', base: 'main', draft: true });
+        const pullPath = `/repos/${REPO}/pulls/${pr.number}`;
+        const opened = event('pull_request', 'opened').pull_request;
+        assert.equal(opened.number, pr.number); assert.equal(opened.head.sha, changed.commit.sha); assert.equal(opened.user.login, 'octocat');
+        assert.equal(opened.html_url, pr.html_url); assert.equal(opened.draft, true);
+        assert.ok(Number.isSafeInteger(opened.id) && opened.id > 0); assert.equal(opened.id, pr.id);
+        assert.ok(typeof opened.updated_at === 'string' && Number.isFinite(Date.parse(opened.updated_at)));
+        assert.equal(event('pull_request', 'opened').sender.login, 'octocat');
+        await api('PATCH', pullPath, { title: 'Changed title' });
+        assert.equal(event('pull_request', 'edited').pull_request.title, 'Changed title');
+        await api('POST', '/graphql', { query: 'mutation($id:ID!){markPullRequestReadyForReview(input:{pullRequestId:$id}){pullRequest{isDraft}}}', variables: { id: pr.node_id } });
+        await collaborator(root, REPO, 'reviewer', 'push');
+        await api('POST', `${pullPath}/requested_reviewers`, { reviewers: ['reviewer'] });
+        assert.equal(event('pull_request', 'review_requested').pull_request.requested_reviewers[0].login, 'reviewer');
+        await api('DELETE', `${pullPath}/requested_reviewers`, { reviewers: ['reviewer'] });
+        assert.deepEqual(event('pull_request', 'review_request_removed').pull_request.requested_reviewers, []);
+        const review = await api('POST', `${pullPath}/reviews`, { body: 'Review source', event: 'APPROVE' });
+        assert.deepEqual(event('pull_request_review', 'submitted').review, { ...review, state: 'approved' });
+        assert.equal(review.state, 'APPROVED', 'REST review state remains native uppercase');
+        assert.equal(review.user.login, 'octocat'); assert.equal(review.commit_id, changed.commit.sha); assert.ok(review.submitted_at);
+        await api('PUT', `${pullPath}/reviews/${review.id}`, { body: 'Edited review' });
+        assert.equal(event('pull_request_review', 'edited').review.body, 'Edited review');
+        await api('PUT', `${pullPath}/reviews/${review.id}/dismissals`, { message: 'Withdrawn' });
+        assert.equal(event('pull_request_review', 'dismissed').review.state, 'dismissed');
+        assert.equal(event('pull_request_review', 'dismissed').sender.login, 'octocat');
+        const inline = await api('POST', `${pullPath}/comments`, { body: 'Inline source', path: 'a.ts', line: 1, side: 'RIGHT', commit_id: initial.commit.sha });
+        assert.deepEqual(event('pull_request_review_comment', 'created').comment, inline);
+        assert.equal(inline.commit_id, initial.commit.sha, 'inline source targets ancestor A while the PR head is B');
+        assert.equal(inline.user.login, 'octocat'); assert.ok(inline.updated_at); assert.ok(inline.html_url);
+        const reply = await api('POST', `${pullPath}/comments/${inline.id}/replies`, { body: 'Reply source' });
+        assert.deepEqual(event('pull_request_review_comment', 'created').comment, reply); assert.equal(reply.in_reply_to_id, inline.id); assert.equal(reply.commit_id, initial.commit.sha);
+        const batch = await api('POST', `${pullPath}/reviews`, { event: 'COMMENT', commit_id: initial.commit.sha, comments: [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'Batch on ancestor' }] });
+        const batchComment = (await api('GET', `${pullPath}/comments`)).find((comment: any) => comment.pull_request_review_id === batch.id);
+        assert.equal(batchComment.commit_id, initial.commit.sha);
+        assert.equal(event('pull_request_review', 'submitted').review.id, batch.id);
+        assert.equal(event('pull_request_review', 'submitted').review.commit_id, initial.commit.sha);
+        const edited = await api('PATCH', `/repos/${REPO}/pulls/comments/${inline.id}`, { body: 'Edited inline' });
+        assert.deepEqual(event('pull_request_review_comment', 'edited').comment, edited);
+        await api('DELETE', `/repos/${REPO}/pulls/comments/${inline.id}`);
+        assert.deepEqual(event('pull_request_review_comment', 'deleted').comment, edited);
+        const comment = await api('POST', `/repos/${REPO}/issues/${pr.number}/comments`, { body: 'Ordinary source' });
+        assert.equal(comment.user.login, 'octocat');
+        assert.equal(event('issue_comment', 'created').comment.user.login, 'octocat');
+        assert.equal(event('issue_comment', 'created').sender.login, 'octocat');
+        assert.deepEqual(event('issue_comment', 'created').comment, comment);
+        assert.equal(event('issue_comment', 'created').issue.pull_request.url, pr.url);
+        assert.equal(event('issue_comment', 'created').pull_request, undefined, 'ordinary comment retains issue classification');
+        const commentEdit = await api('PATCH', `/repos/${REPO}/issues/comments/${comment.id}`, { body: 'Edited ordinary' });
+        assert.deepEqual(event('issue_comment', 'edited').comment, commentEdit);
+        await api('DELETE', `/repos/${REPO}/issues/comments/${comment.id}`);
+        assert.deepEqual(event('issue_comment', 'deleted').comment, commentEdit);
+        const issue = await api('POST', `/repos/${REPO}/issues`, { title: 'Not a PR' });
+        assert.deepEqual(event('issues', 'opened').issue, issue);
+        await api('POST', `/repos/${REPO}/issues/${issue.number}/comments`, { body: 'Issue source' });
+        assert.equal(event('issue_comment', 'created').issue.pull_request, undefined);
+        await api('POST', '/graphql', { query: 'mutation($id:ID!){convertPullRequestToDraft(input:{pullRequestId:$id}){pullRequest{isDraft}}}', variables: { id: pr.node_id } });
+        await api('POST', '/graphql', { query: 'mutation($id:ID!){r:markPullRequestReadyForReview(input:{pullRequestId:$id}){pullRequest{isDraft}} d:convertPullRequestToDraft(input:{pullRequestId:$id}){pullRequest{isDraft}}}', variables: { id: pr.node_id } });
+        assert.equal(event('pull_request', 'ready_for_review').pull_request.draft, false);
+        assert.equal(event('pull_request', 'converted_to_draft').pull_request.draft, true);
+        let pushArrived!: () => void;
+        const arrived = new Promise<void>(resolve => { pushArrived = resolve; });
+        const held = new Promise<void>(resolve => { releasePush = resolve; });
+        pausePush = () => { pushArrived(); return held; };
+        const beforeDelayed = received.length;
+        const firstWrite = api('PUT', `/repos/${REPO}/contents/a.ts`, { branch: 'topic', message: 'delayed A', sha: changed.content.sha, content: Buffer.from('three\n').toString('base64') });
+        await arrived;
+        const atA = await api('GET', `${pullPath}`);
+        const fileAtA = await api('GET', `/repos/${REPO}/contents/a.ts?ref=topic`);
+        const secondWrite = await api('PUT', `/repos/${REPO}/contents/a.ts`, { branch: 'topic', message: 'later B', sha: fileAtA.sha, content: Buffer.from('four\n').toString('base64') });
+        releasePush();
+        const firstResult = await firstWrite;
+        assert.equal(firstResult.commit.sha, atA.head.sha);
+        const syncs = received.slice(beforeDelayed).filter(d => d.event === 'pull_request' && d.payload.action === 'synchronize').map(d => d.payload.pull_request);
+        assert.equal(syncs.length, 2);
+        assert.deepEqual(syncs.map(p => p.head.sha).sort(), [firstResult.commit.sha, secondWrite.commit.sha].sort(), 'delayed callback must not substitute the later head');
+        assert.equal(syncs.find(p => p.head.sha === firstResult.commit.sha).updated_at, atA.updated_at);
+        await api('POST', '/graphql', { query: 'mutation($id:ID!){markPullRequestReadyForReview(input:{pullRequestId:$id}){pullRequest{isDraft}}}', variables: { id: pr.node_id } });
+        const merged = await api('PUT', `${pullPath}/merge`, { merge_method: 'merge' });
+        assert.equal(event('pull_request', 'closed').pull_request.merged, true);
+        assert.equal(event('pull_request', 'closed').pull_request.merge_commit_sha, merged.sha);
+        // Import through the real connector contract, then address the served native IDs.
+        // This distinguishes vendor-origin subjects from locally created comment:<id> rows.
+        const { syncGithubFromReal } = await import('./github-connector.ts');
+        const importedPr = 77;
+        const createdAt = '2026-03-01T09:00:00Z';
+        const vendorUpdatedAt = '2026-03-02T10:00:00Z';
+        const executor = { async request(route: string, params: Record<string, unknown> = {}) {
+          if (route === 'GET /repos/{owner}/{repo}/pulls') return { status: 200, data: params.state === 'closed' ? [] : [{ number: importedPr, title: 'Imported source', state: 'open', head: { sha: initial.commit.sha, ref: 'imported' }, base: { ref: 'main' }, updated_at: vendorUpdatedAt, user: { login: 'upstream-author', type: 'User' } }] };
+          if (route === 'GET /repos/{owner}/{repo}/issues') return { status: 200, data: [] };
+          if (route === 'GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews') return { status: 200, data: [{ id: 901, state: 'COMMENTED', body: 'Imported review', submitted_at: createdAt, commit_id: initial.commit.sha, user: { login: 'review-author', type: 'User' } }] };
+          if (route === 'GET /repos/{owner}/{repo}/pulls/{pull_number}/comments') return { status: 200, data: [{ id: 902, pull_request_review_id: 901, path: 'a.ts', line: 1, body: 'Imported inline', created_at: createdAt, commit_id: initial.commit.sha, user: { login: 'inline-author', type: 'User' } }] };
+          if (route === 'GET /repos/{owner}/{repo}/issues/{issue_number}/comments') return { status: 200, data: [{ id: 903, body: 'Imported ordinary', created_at: createdAt, updated_at: vendorUpdatedAt, user: { login: 'comment-author', type: 'User' } }] };
+          return { status: 404, data: { message: 'Not Found' } };
+        } };
+        await syncGithubFromReal(executor, { owner: 'octo', repo: 'demo', root, state: 'all', occurredAt: '2026-03-03T00:00:00Z' });
+        for (const kind of ['ordinary', 'inline'] as const) {
+          const listPath = kind === 'ordinary' ? `/repos/${REPO}/issues/${importedPr}/comments` : `/repos/${REPO}/pulls/${importedPr}/comments`;
+          const comments = await api('GET', listPath);
+          assert.equal(comments.length, 1);
+          const original = comments[0];
+          const originalAuthor = kind === 'ordinary' ? 'comment-author' : 'inline-author';
+          assert.equal(original.user.login, originalAuthor);
+          if (kind === 'ordinary') { assert.equal(original.created_at, createdAt); assert.equal(original.updated_at, vendorUpdatedAt); }
+          const itemPath = `/repos/${REPO}/${kind === 'ordinary' ? 'issues' : 'pulls'}/comments/${original.id}`;
+          const eventKind = kind === 'ordinary' ? 'issue_comment' : 'pull_request_review_comment';
+          const changed = await api('PATCH', itemPath, { body: `Edited imported ${kind}` });
+          assert.equal(changed.id, original.id); assert.equal(changed.body, `Edited imported ${kind}`); assert.equal(changed.user.login, originalAuthor);
+          assert.equal(changed.created_at, original.created_at); assert.notEqual(changed.updated_at, original.updated_at);
+          assert.deepEqual(await api('GET', itemPath), changed);
+          assert.deepEqual(await api('GET', listPath), [changed], 'edit updates the imported subject rather than duplicating it');
+          assert.deepEqual(event(eventKind, 'edited').comment, changed);
+          assert.equal(event(eventKind, 'edited').sender.login, 'octocat');
+          await api('DELETE', itemPath);
+          assert.deepEqual(event(eventKind, 'deleted').comment, changed);
+          assert.equal(event(eventKind, 'deleted').sender.login, 'octocat');
+          await assert.rejects(api('GET', itemPath), { status: 404 });
+          assert.deepEqual(await api('GET', listPath), [], 'delete tombstones the imported subject');
+        }
+        return true;
+      } finally { releasePush(); server.stop(); sink.stop(true); }
     })),
   done('github.webhooks.full_events', 'webhooks', 'Webhooks: full event-type coverage (push/release/check_run/workflow_run/…)', 'connector', 'common', () =>
     withRoot(async (root) => {
@@ -2159,32 +3497,133 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       checks.push([repo.webhook?.event ?? '', repo.webhook?.action ?? '']);
       const fork = await applyGithubWrite({ method: 'POST', path: `/repos/octo/wh/forks`, body: JSON.stringify({ organization: 'me' }), root });
       checks.push([fork.webhook?.event ?? '', fork.webhook?.action ?? '']);
-      const mem = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/bob`, body: JSON.stringify({ permission: 'push' }), root });
+      // a collaborator is added when they accept the invitation
+      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/collaborators/bob`, body: JSON.stringify({ permission: 'push' }), root });
+      const mem = (await acceptInvitation(root, REPO, 'bob'))!;
       checks.push([mem.webhook?.event ?? '', mem.webhook?.action ?? '']);
       const push = await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/contents/f.txt`, body: JSON.stringify({ message: 'm', content: 'eA==' }), root });
       checks.push([push.webhook?.event ?? '', '']);
       const expected: Record<string, string> = { release: 'published', repository: 'created', fork: 'created', member: 'added', push: '' };
       return checks.every(([e, a]) => e in expected && (expected[e] === '' || expected[e] === a)) && new Set(checks.map((c) => c[0])).size === 5;
     })),
-  done('github.webhooks.delivery', 'webhooks', 'Webhooks: deliveries log + redelivery + signatures', 'connector', 'common', () =>
-    withRoot(async (root) => {
-      const { clearGithubWebhooks, registerGithubWebhook, emitGithubEvent, listGithubDeliveries, redeliverGithubDelivery, signGithubPayload } = await import('./github-events.ts');
-      clearGithubWebhooks();
-      registerGithubWebhook('https://e.x/hook', 's3cr3t');
-      const captured: Array<{ headers: Record<string, string>; body: string }> = [];
-      const deliver = (_url: string, headerEvent: string, payload: unknown, headers: Record<string, string>) => { captured.push({ headers, body: JSON.stringify(payload) }); };
-      await emitGithubEvent({ event: 'pull_request', action: 'opened', repository: REPO, number: 1 }, { deliver });
-      // a delivery is logged with an id + signature; the signature verifies against the secret.
-      const deliveries = listGithubDeliveries();
-      if (deliveries.length !== 1) return false;
-      const d = deliveries[0]!;
-      if (d.event !== 'pull_request' || typeof d.id !== 'string') return false;
-      const expectedSig = signGithubPayload('s3cr3t', d.payloadJson);
-      if (captured[0]?.headers['x-hub-signature-256'] !== expectedSig) return false;
-      // redelivery replays the SAME payload to the endpoint (a second captured delivery).
-      const re = await redeliverGithubDelivery(d.id, { deliver });
-      clearGithubWebhooks();
-      return re === true && captured.length === 2 && captured[1]!.body === captured[0]!.body;
+  done('github.webhooks.delivery', 'webhooks', 'Webhooks: signed delivery, durable replay, recipient scoping and truthful failures', 'connector', 'common', () =>
+    withRoot(async (root) => {
+      const { createHmac } = await import('node:crypto');
+      const secret = 'capability-only-hook-secret';
+      const captured: Array<{ headers: Headers; body: string }> = [];
+      let sinkStatus = 204;
+      const sink = await serveHttp({ port: 0, async fetch(request) {
+        captured.push({ headers: request.headers, body: await request.text() });
+        return new Response(null, { status: sinkStatus });
+      } });
+      let server = await createGithubTwinServer({ root });
+      let sdk = octoClient({ baseUrl: `http://127.0.0.1:${server.port}` });
+      const api = (method: string, path: string, body?: Record<string, unknown>) => sdk.request(`${method} ${path}`, body === undefined ? undefined : { data: body });
+      try {
+        await api('POST', '/orgs/octo/repos', { name: 'demo' });
+        const hook = (await api('POST', `/repos/${REPO}/hooks`, { events: ['pull_request'], config: { url: `http://127.0.0.1:${sink.port}/github`, content_type: 'json', secret } })).data as any;
+        assert.ok(!JSON.stringify(hook).includes(secret), 'native hook response masks signing material');
+        const pull = (await api('POST', `/repos/${REPO}/pulls`, { title: 'Native source', head: 'a'.repeat(40), base: 'main', draft: true })).data as any;
+        const path = `/repos/${REPO}/hooks/${hook.id}/deliveries`;
+        const original = ((await api('GET', path)).data as any[]).find(d => d.event === 'pull_request');
+        assert.ok(original, 'native write reaches native persisted hook');
+        assert.equal(original.status_code, 204);
+        assert.equal(original.status, 'OK');
+        const first = captured.find(d => d.headers.get('x-github-event') === 'pull_request')!;
+        assert.ok(first, 'real HTTP receiver received native write');
+        assert.equal(first.headers.get('x-hub-signature-256'), `sha256=${createHmac('sha256', secret).update(first.body).digest('hex')}`);
+        const payload = JSON.parse(first.body);
+        assert.equal(payload.pull_request.number, pull.number);
+        assert.equal(payload.pull_request.head.sha, pull.head.sha);
+        assert.equal(payload.pull_request.user.login, 'octocat');
+        assert.equal(payload.pull_request.draft, true);
+        // A fresh server has no registration side channel. Stored hook and delivery suffice.
+        server.stop(); server = await createGithubTwinServer({ root });
+        sdk = octoClient({ baseUrl: `http://127.0.0.1:${server.port}` });
+        const detail = (await api('GET', `${path}/${original.id}`)).data as any;
+        assert.deepEqual(detail.request.payload, payload);
+        assert.equal((await api('POST', `${path}/${original.id}/attempts`)).status, 202);
+        const replay = captured.at(-1)!;
+        assert.equal(replay.body, first.body);
+        assert.equal(replay.headers.get('x-github-delivery'), first.headers.get('x-github-delivery'));
+        assert.equal(replay.headers.get('x-hub-signature-256'), first.headers.get('x-hub-signature-256'));
+        const replayRecord = ((await api('GET', path)).data as any[])[0]!;
+        assert.equal(replayRecord.redelivery, true);
+        assert.notEqual(replayRecord.id, original.id);
+        assert.equal(replayRecord.guid, original.guid);
+        // Filtering must exclude actual HTTP delivery, not merely hide delivery rows.
+        let before = captured.length;
+        await api('POST', `/repos/${REPO}/issues`, { title: 'Unsubscribed event' });
+        await api('POST', '/orgs/octo/repos', { name: 'other' });
+        await api('POST', '/repos/octo/other/pulls', { title: 'Other repository', head: 'b'.repeat(40), base: 'main' });
+        assert.equal(captured.length, before, 'event and repository subscriptions exclude delivery');
+        const hookPath = `/repos/${REPO}/hooks/${hook.id}`;
+        const second = (await api('POST', `/repos/${REPO}/hooks`, { active: false, events: ['pull_request'], config: { url: `http://127.0.0.1:${sink.port}/other-hook`, content_type: 'json' } })).data as any;
+        for (const method of ['GET', 'POST']) {
+          const suffix = method === 'POST' ? '/attempts' : '';
+          await assert.rejects(api(method, `/repos/${REPO}/hooks/${second.id}/deliveries/${original.id}${suffix}`), { status: 404 });
+        }
+        assert.equal(await withRoot(async (otherRoot) => {
+          const otherServer = await createGithubTwinServer({ root: otherRoot });
+          const other = octoClient({ baseUrl: `http://127.0.0.1:${otherServer.port}` });
+          try {
+            await other.request('POST /orgs/octo/repos', { name: 'demo' });
+            const h = (await other.request(`POST /repos/${REPO}/hooks`, { config: { url: `http://127.0.0.1:${sink.port}/other-world`, content_type: 'json' } })).data as any;
+            await assert.rejects(other.request(`GET /repos/${REPO}/hooks/${h.id}/deliveries/${original.id}`), { status: 404 });
+            await assert.rejects(other.request(`POST /repos/${REPO}/hooks/${h.id}/deliveries/${original.id}/attempts`), { status: 404 });
+            return true;
+          } finally { otherServer.stop(); }
+        }), true, 'a World cannot read or replay another World delivery');
+        before = captured.length;
+        await api('PATCH', hookPath, { active: false, config: { secret } });
+        await api('PATCH', `/repos/${REPO}/pulls/${pull.number}`, { title: 'Inactive sink' });
+        assert.equal(captured.length, before, 'inactive persisted hooks exclude delivery');
+        await api('PATCH', hookPath, { active: true, config: { secret } });
+        sinkStatus = 503;
+        assert.equal((await api('PATCH', `/repos/${REPO}/pulls/${pull.number}`, { title: 'Receiver refuses' })).status, 200);
+        let latest = ((await api('GET', path)).data as any[])[0]!;
+        assert.equal(latest.status_code, 503); assert.notEqual(latest.status, 'OK');
+        const mirror = await createGithubTwinServer({ root, readOnly: true });
+        try {
+          const ro = octoClient({ baseUrl: `http://127.0.0.1:${mirror.port}` });
+          before = captured.length;
+          assert.equal((await ro.request(`GET ${path}/${original.id}`)).status, 200);
+          for (const target of [`${path}/${original.id}/attempts`, `${hookPath}/pings`]) await assert.rejects(ro.request(`POST ${target}`), { status: 403 });
+          assert.equal(captured.length, before, 'mirror cannot send a replay or ping');
+        } finally { mirror.stop(); }
+        const unavailable = await serveHttp({ port: 0, fetch: () => new Response(null) });
+        const unavailableUrl = `http://127.0.0.1:${unavailable.port}/closed-receiver`;
+        unavailable.stop(true);
+        await api('PATCH', `${hookPath}/config`, { url: unavailableUrl });
+        assert.equal((await api('PATCH', `/repos/${REPO}/pulls/${pull.number}`, { title: 'Transport refuses' })).status, 200);
+        latest = ((await api('GET', path)).data as any[])[0]!;
+        assert.equal(latest.status_code, 0); assert.notEqual(latest.status, 'OK');
+        // GitHub REST 2026-03-10 classifies status by HTTP range, and cursors exclude
+        // the already-returned delivery. Octokit 22.0.1 consumes the native response.
+        const successes = (await api('GET', `${path}?status=success`)).data as any[];
+        const failures = (await api('GET', `${path}?status=failure`)).data as any[];
+        assert.ok(successes.length > 0 && successes.every(d => d.status_code >= 200 && d.status_code <= 399));
+        assert.ok(failures.some(d => d.status_code === 503) && failures.every(d => d.status_code >= 400 && d.status_code <= 599));
+        assert.ok(!failures.some(d => d.id === latest.id), 'transport failures are outside HTTP-status filters');
+        await assert.rejects(api('GET', `${path}?status=other`), { status: 422 });
+        const firstPage = await api('GET', `${path}?per_page=1`);
+        const firstRow = (firstPage.data as any[])[0]!;
+        assert.equal((firstPage.data as any[]).length, 1);
+        assert.equal(firstRow.id, latest.id);
+        assert.ok(firstPage.headers.link?.includes('rel="next"'));
+        const nextPage = (await api('GET', `${path}?per_page=1&cursor=${firstRow.id}`)).data as any[];
+        assert.equal(nextPage.length, 1); assert.ok(nextPage[0].id < firstRow.id);
+        await api('PATCH', `${hookPath}/config`, { url: `http://127.0.0.1:${sink.port}/github` });
+        before = captured.length;
+        await api('DELETE', hookPath);
+        await api('PATCH', `/repos/${REPO}/pulls/${pull.number}`, { title: 'Deleted hook' });
+        assert.equal(captured.length, before, 'deleted hooks do not receive actual HTTP calls');
+        await assert.rejects(api('GET', path), { status: 404 });
+        assert.equal(githubState(root).webhooks.find(h => h.id === hook.id), undefined);
+        // The other remaining hook is inactive. No recipient or successful delivery is fabricated.
+        assert.equal(((await api('GET', `/repos/${REPO}/hooks/${second.id}/deliveries`)).data as any[]).filter(d => d.event !== 'ping').length, 0);
+        return true;
+      } finally { server.stop(); sink.stop(true); }
     })),
 
   // ── Connector (pull/push) ────────────────────────────────────────────────────────────────
@@ -2205,8 +3644,8 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       const res = await syncGithubFromReal(execute, { owner: 'octo', repo: 'demo', root, occurredAt: '2026-01-01T00:00:00Z' });
       if (res.observed < 2 || res.issues !== 1) return false;
       // Read the folded PR + issue back through the twin with their REAL content.
-      const pr = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/5`, root });
-      const iss = handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/9`, root });
+      const pr = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/5`, root });
+      const iss = await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/issues/9`, root });
       return ok(pr.status) && (pr.body as { title?: string }).title === 'Real title'
         && ok(iss.status) && (iss.body as { title?: string }).title === 'Bug';
     })),
@@ -2300,21 +3739,19 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     })),
   done('github.connector.push', 'connector', 'Connector: push reconcile (apply desired-state writes)', 'connector', 'common', () =>
     withRoot(async (root) => {
-      const { pushPendingGithubActions } = await import('./github-connector.ts');
+      const { performGithubAction } = await import('./github-connector.ts');
+      const { performEntries, writeRoot } = await import('@volter/world-core');
       // Author LOCAL writes in the twin (a PR + an issue), then push them to the real vendor
       // via a fake executor — the connector maps each pending action to its REST call.
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/pulls`, body: JSON.stringify({ title: 'push me', head: 'a', base: 'main' }), root });
       await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/issues`, body: JSON.stringify({ title: 'push issue' }), root });
       const calls: string[] = [];
-      const execute = {
-        async request(route: string) {
-          calls.push(route);
-          if (route === 'POST /repos/{owner}/{repo}/pulls') return { status: 201, data: { number: 42 } };
-          if (route === 'POST /repos/{owner}/{repo}/issues') return { status: 201, data: { number: 77 } };
-          return { status: 201, data: { id: 1 } };
-        },
-      };
-      const res = await pushPendingGithubActions(execute, { root, occurredAt: '2026-01-02T00:00:00Z' });
+      writeRoot('github', { url: 'https://api.github.test', deploy: 'hold', credential: join(root, '.volter/credentials/github.json') } as never, root);
+      const res = await performEntries({ service: 'github', root, checks: [], adapters: { perform: performGithubAction }, execute: async request => {
+        const suffix = request.path.endsWith('/issues') ? 'issues' : 'pulls';
+        calls.push(`POST /repos/{owner}/{repo}/${suffix}`);
+        return { status: 201, headers: {}, body: JSON.stringify({ number: suffix === 'issues' ? 77 : 42 }) };
+      }});
       return res.pushed >= 2 && calls.includes('POST /repos/{owner}/{repo}/pulls') && calls.includes('POST /repos/{owner}/{repo}/issues');
     })),
 
@@ -2349,7 +3786,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     // "Review count 1" over a reviews page answering two.
     fetch: async (root) => ({
       ...githubMirrorState(root),
-      served: (handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root }).body as unknown[]).length,
+      served: ((await handleGithubRequest({ method: 'GET', path: `/repos/${REPO}/pulls/1/reviews`, root })).body as unknown[]).length,
     }),
     assert: (m) => {
       const pr = (m.github as any).pullRequests.find((p: any) => p.title === 'Conversation Probe');
@@ -2372,13 +3809,13 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
       return !!i && (i.labels as Array<{ name: string }>).some((l) => l.name === 'triage') && (i.assignees as string[]).includes('dave');
     },
   })),
-  // Actions runs view: register a workflow + dispatch it (real run + job) — assert the
+  // Actions runs view: push a workflow + dispatch it (real run + job) — assert the
   // fetched run's workflowName resolves + it carries the real jobCount.
   done('github.ui.actions_view', 'ui', 'Actions runs view (runs + jobs + status badges) (data-coupled)', 'ui', 'niche', uiDataCoupled<string, Record<string, unknown>>({
     withRoot,
     seed: async (root) => {
-      await applyGithubWrite({ method: 'PUT', path: `/repos/${REPO}/actions/workflows/probe.yml`, body: JSON.stringify({ name: 'Probe CI', path: '.github/workflows/probe.yml' }), root });
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/actions/workflows/probe.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
+      await pushFiles(root, { '.github/workflows/probe.yml': workflowFile('Probe CI') });
+      await applyGithubWrite({ method: 'POST', path: `/repos/${HISTORY_REPO}/actions/workflows/probe.yml/dispatches`, body: JSON.stringify({ ref: 'main' }), root });
     },
     fetch: async (root) => githubMirrorState(root),
     assert: (m) => (m.github as any).runs.some((r: any) => r.workflowName === 'Probe CI' && r.jobCount === 1),
@@ -2433,12 +3870,12 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     seed: async (root) => {
       const c = await applyGithubWrite({ method: 'POST', path: '/orgs/octo/projectsV2', body: JSON.stringify({ title: 'Roadmap' }), root });
       const pid = (c.response.body as { id?: number }).id!;
-      await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done' }] }), root });
-      await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
-      const i1 = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task A' }), root });
-      const i2 = await applyGithubWrite({ method: 'POST', path: `/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task B' }), root });
-      await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${(i1.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Todo' }), root });
-      await applyGithubWrite({ method: 'PATCH', path: `/projectsV2/${pid}/items/${(i2.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Done' }), root });
+      await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/fields`, body: JSON.stringify({ name: 'Status', data_type: 'single_select', single_select_options: [{ name: 'Todo' }, { name: 'Done' }] }), root });
+      await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/views`, body: JSON.stringify({ name: 'Board', layout: 'board' }), root });
+      const i1 = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task A' }), root });
+      const i2 = await applyGithubWrite({ method: 'POST', path: `/_twin/projectsV2/${pid}/items`, body: JSON.stringify({ content_type: 'DraftIssue', title: 'Task B' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/_twin/projectsV2/${pid}/items/${(i1.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Todo' }), root });
+      await applyGithubWrite({ method: 'PATCH', path: `/_twin/projectsV2/${pid}/items/${(i2.response.body as { id?: number }).id}`, body: JSON.stringify({ field_id: 'Status', value: 'Done' }), root });
     },
     fetch: async (root) => githubMirrorState(root),
     assert: (m) => {
@@ -2473,7 +3910,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     seed: async (root) => {
       const r = await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases`, body: JSON.stringify({ tag_name: 'v-probe', name: 'Release Probe', body: 'notes' }), root });
       const id = (r.response.body as { id?: number }).id;
-      await applyGithubWrite({ method: 'POST', path: `/repos/${REPO}/releases/${id}/assets`, body: JSON.stringify({ name: 'probe.zip', content_type: 'application/zip', size: 2048 }), root });
+      await applyGithubWrite({ method: 'POST', path: `https://uploads.github.com/repos/${REPO}/releases/${id}/assets?name=probe.zip`, body: 'z'.repeat(2048), contentType: 'application/zip', root });
     },
     fetch: async (root) => githubMirrorState(root),
     assert: (m) => {
@@ -2518,7 +3955,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
     withRoot,
     seed: async (root) => {
       await applyGithubWrite({ method: 'POST', path: '/orgs/octo/repos', body: JSON.stringify({ name: 'demo', private: true }), root });
-      await applyGithubWrite({ method: 'PUT', path: '/repos/octo/demo/collaborators/bob', body: JSON.stringify({ permission: 'push' }), root });
+      await collaborator(root, 'octo/demo', 'bob', 'push');
       await applyGithubWrite({ method: 'POST', path: '/repos/octo/demo/hooks', body: JSON.stringify({ config: { url: 'https://e.x/h' }, events: ['push'] }), root });
     },
     fetch: async (root) => githubMirrorState(root),
@@ -2548,11 +3985,11 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
         && g.contents.some((c: any) => String(c.path).includes('zephyrus-search-term'));
     },
   })),
-  // Notifications inbox: seed a real notification thread — assert it appears unread
+  // Notifications inbox: an @mention makes a real notification thread — assert it appears unread
   // with the seeded subject title (an unseeded root has zero notification threads).
   done('github.ui.notifications', 'ui', 'Notifications inbox screen (data-coupled)', 'ui', 'common', uiDataCoupled<string, Record<string, unknown>>({
     withRoot,
-    seed: (root) => applyGithubWrite({ method: 'POST', path: `/notifications`, body: JSON.stringify({ repository: REPO, subject_title: 'Notification Probe', subject_type: 'PullRequest', reason: 'review_requested' }), root }),
+    seed: async (root) => { await pushFiles(root, {}); await mentionedIn(root, HISTORY_REPO, 'Notification Probe'); },
     fetch: async (root) => githubMirrorState(root),
     assert: (m) => (m.github as any).notifications.some((n: any) => n.title === 'Notification Probe' && n.unread === true),
   })),
@@ -2584,7 +4021,7 @@ export const GITHUB_CAPABILITIES: CapabilitySpec[] = [
   // These whole vendor product areas had NO manifest entry of any status before this pass —
   // not todo'd, not carved out — so they never surfaced in checkCapabilities gaps and the
   // coverage denominator structurally couldn't include them. Filed as honest todos (all
-  // genuinely buildable; none is an impossibility warranting outOfScope). See GITHUB_AREAS
+  // genuinely buildable; none is anything but a todo). See GITHUB_AREAS
   // below + github-capabilities.test.ts's area-census meta-test, which is what makes a future
   // whole-area omission fail the gate instead of waiting for another review pass.
   todo('github.copilot.seats', 'copilot', 'Copilot: manage Business/Enterprise seat assignments (list/add/remove billed seats)', 'api', 'niche'),