gowalk-cicd 1.0.158 → 1.0.161

package/README.md

@@ -34,7 +34,7 @@ Ready task PRs build shipping binaries alongside validation; the protected merge
 binaries through the existing store upload paths. See [candidate artifact reuse](docs/CANDIDATE_ARTIFACTS.md)
 for identity checks, native dependency caches, version handling and adoption of custom workflows.
 
-Mobile delivery requires an explicit frozen release intent. After source, signing, account transport,
+Mobile delivery requires an explicit release intent. After source, signing, account transport,
 and integration readiness pass, run on the task branch:
 
 ```bash
@@ -48,12 +48,17 @@ Merge the exact validated candidate through the repository's protected PR. Only
 web, documentation and tooling landings do not trigger a store build. Backend and web retain
 their own workflows. Web compilation no longer starts just because a plugin version marker changed.
 
-The intent binds committed source and effective organization/repository variables, with repository
-precedence. A changed source input or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
-and Android directories are scoped to their own platform. Unknown inputs, embedded editors,
-assets, scripts, dependency locks and backend-generated resources remain in the conservative
-source fingerprint. Documents remain inputs because an app may bundle them. There is no blanket
-editor/backend exclusion from the input proof. These conservative hashes do not add push triggers.
+The CLI reads no GitHub variables. Its v2 manifest contains only `schema` and a `platforms`
+map: source hashes make each changed-source release declaration a file change, but never freeze
+admission. A push changing the intent admits the pushed tree for its declared platforms. Other
+events, including manual dispatch, admit only the tree of the last intent-changing commit.
+Candidate repairs included in the protected merge therefore need no re-freeze. A dispatch of a
+later landing still refuses. Existing v1 intents remain accepted.
+
+Upload and binary reuse identities use the checkout actually built plus its current build variables.
+Native iOS and Android directories are scoped to their platform. Unknown inputs, embedded editors,
+assets, scripts, dependency locks, documents and backend-generated resources remain in the
+conservative source fingerprint. These hashes add no push triggers and do not gate admission.
 
 The gate records each platform in GitHub deployment receipts, scoped to that input fingerprint.
 A confirmed upload is reused on subsequent attempts and emits `mobile_upload_reused` with the
@@ -67,8 +72,12 @@ receipt and read back its exact version with the account-pinned store tooling. R
 upload when necessary. After positive upload readback, reconcile the named GitHub deployment to
 `success` with description `uploaded`, retaining the provider evidence in the app task. Never clear
 an uncertain receipt based on elapsed time or a missing response. A terminal attempt that failed
-before the upload marker may retry. Rerun the whole workflow so admission and platform jobs share
-one run attempt; a failed-jobs-only rerun with an older admission receipt refuses.
+before the upload marker may retry. An earlier admission attempt of the same run, source and
+platform supports failed-job retries while preserving the required upload phase.
+
+`remedies.json` contains failure recovery guidance keyed by `schema`, `code` and `fixed_in`.
+Each `remedy` is at most 4 KB. `mobile_release_refused` emits
+`gowalk-cicd/mobile-release-refused.v1` with its fixed failure `code`; success notices carry no remedy.
 
 Mobile runs serialize without cancelling an in-flight upload. Manual dispatch obeys the same
 intent and receipts; it cannot silently rebuild an already-uploaded input. Feature-branch dispatch
@@ -1160,7 +1169,7 @@ on a verified task branch (under both `.github/actions/swift-app/` and
 | Candidates | Action updates and later version changes have separate verified receipts |
 | Failure mode | npm discovery remains optional; unconfirmed source preservation fails the job |
 
-The shipped `deploy.yml` watches only the frozen release intent. Adopting an action-directory
+The shipped `deploy.yml` watches only the release intent. Adopting an action-directory
 update on its own therefore does not launch another mobile upload. Review and adopt the template
 as well as the action directories to enable this behavior in an existing consumer.
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.158
+1.0.161

package/action/scripts/mobile_inputs.cjs

@@ -1,10 +1,10 @@
-/* Frozen mobile build inputs. Unknown source paths remain inputs, including embedded editors. */
+/* Release declarations and build identities. Unknown paths remain inputs, including embedded editors. */
 'use strict';
 const {execFileSync} = require('node:child_process');
 const {createHash} = require('node:crypto');
 const fs = require('node:fs');
 const INTENT = '.factory/releases/mobile.json';
-const SCHEMA = 'gowalk-cicd/mobile-release.v1';
+const SCHEMA = 'gowalk-cicd/mobile-release.v2';
 const git = (...args) => execFileSync('git', args, {encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']});
 const digest = value => createHash('sha256').update(value).digest('hex');
 
@@ -21,7 +21,7 @@ function input(name, platform) {
 
 // Named vars read by templates/deploy.yml, except the rotating Play ownership
 // lease: it authorizes provider access but never changes a build. Keep the list
-// checked against the template, and share the projection with the freeze CLI.
+// checked against the template. Configuration changes affect reuse, never release admission.
 const BUILD_VARIABLES = [
   'BACKEND_API_DOMAIN', 'BACKEND_APP_NAME', 'BACKEND_DEPLOY_HOST', 'BACKEND_HEALTH_PATH',
   'BACKEND_INGRESS_REQUIRED', 'BACKEND_PUBLIC_BASE_URL', 'BACKEND_PUBLIC_HEALTH_URL',
@@ -76,20 +76,15 @@ function iosPodsCommitted() {
   return PODS.every(path => tracked.has(path));
 }
 
-function create(platforms = ['ios', 'android'], variables = {}) {
+function create(platforms = ['ios', 'android']) {
   if (['main', 'master', ''].includes(git('branch', '--show-current').trim())) {
     throw Error('mobile_release_task_branch_required');
   }
   const dirty = git('status', '--porcelain', '-z', '--untracked-files=all').split('\0').filter(Boolean);
   if (dirty.some(row => row.slice(3) !== INTENT)) throw Error('mobile_release_source_not_committed');
-  // An intent is a freeze. Declaring a platform whose build inputs are missing
-  // spends the whole freeze on a job that cannot start: CI requires the
-  // committed lockfile and refuses Xcode-managed package downloads, so the iOS
-  // job fails in native preparation and the fix needs another intent. Across
-  // eight rebuild tasks on 2026-09-09 there were 35 Mobile Deploy runs and 3
-  // green conclusions, all three on the one repository committing this pair.
+  // CI requires the committed CocoaPods pair for resolved Flutter iOS plugins.
   if (platforms.includes('ios') && !iosPodsCommitted()) throw Error('mobile_release_ios_pods_uncommitted');
-  const manifest = {schema: SCHEMA, configuration_sha256: configuration(variables),
+  const manifest = {schema: SCHEMA,
     platforms: Object.fromEntries(platforms.map(p => [p, fingerprint(p)]))};
   fs.mkdirSync('.factory/releases', {recursive: true});
   fs.writeFileSync(INTENT, JSON.stringify(manifest, null, 2) + '\n');
@@ -98,13 +93,24 @@ function create(platforms = ['ios', 'android'], variables = {}) {
 
 function read(variables = {}) {
   const manifest = JSON.parse(fs.readFileSync(INTENT, 'utf8'));
-  if (manifest.configuration_sha256 !== configuration(variables)) throw Error('mobile_release_configuration_changed');
-  if (manifest.schema !== SCHEMA || !manifest.platforms || !Object.keys(manifest.platforms).length ||
+  if (![SCHEMA, 'gowalk-cicd/mobile-release.v1'].includes(manifest.schema) ||
+      !manifest.platforms || !Object.keys(manifest.platforms).length ||
       Object.entries(manifest.platforms).some(([p, sha]) =>
         !['ios', 'android'].includes(p) || !/^[a-f0-9]{64}$/.test(sha))) throw Error('mobile_release_intent_invalid');
-  for (const [p, sha] of Object.entries(manifest.platforms)) {
-    if (fingerprint(p) !== sha) throw Error('mobile_release_intent_stale');
+  // Stored hashes make a later release declaration a file change, not an admission fence.
+  return {schema: manifest.schema, configuration_sha256: configuration(variables),
+    platforms: Object.fromEntries(Object.keys(manifest.platforms).map(p => [p, fingerprint(p)]))};
+}
+
+function admit() {
+  const latest = git('log', '--first-parent', '-1', '--format=%H', '--', INTENT).trim();
+  if (!latest) throw Error('mobile_release_intent_invalid');
+  const tree = git('rev-parse', 'HEAD^{tree}').trim();
+  const declared = git('rev-parse', `${latest}^{tree}`).trim();
+  const changed = git('diff-tree', '--root', '--diff-merges=first-parent', '--no-commit-id', '--name-only',
+    '-r', 'HEAD', '--', INTENT).trim();
+  if (!(process.env.GITHUB_EVENT_NAME === 'push' && changed) && tree !== declared) {
+    throw Error('mobile_release_intent_stale');
   }
-  return manifest;
 }
-module.exports = {INTENT, SCHEMA, BUILD_VARIABLES, buildVariables, input, fingerprint, create, read, configuration};
+module.exports = {INTENT, SCHEMA, BUILD_VARIABLES, buildVariables, input, fingerprint, create, read, configuration, admit};

package/action/scripts/mobile_release.cjs

@@ -38,6 +38,7 @@ async function reusable(record, expected) {
 
 async function admit(platforms = 'both') {
   if (!['both', 'ios', 'android'].includes(platforms)) throw Error('mobile_release_platform_invalid');
+  inputs.admit();
   const manifest = inputs.read(JSON.parse(process.env.MOBILE_RELEASE_VARIABLES || '{}'));
   if (process.env.MOBILE_CANDIDATE_BUILD === 'true') return candidatePlatforms(manifest, platforms);
   const selected = {};
@@ -115,7 +116,8 @@ async function main(args) {
 }
 if (require.main === module) main(process.argv.slice(2)).catch(error => {
   const code = /^mobile_release_[a-z0-9_]+$/.test(error.message) ? error.message : 'mobile_release_unavailable';
-  console.error(`::error title=mobile_release_refused::${code}`);
+  console.error('::error title=mobile_release_refused::' +
+    JSON.stringify({schema: 'gowalk-cicd/mobile-release-refused.v1', code}));
   process.exitCode = 1;
 });
 module.exports = {owner, reusable, admit, phase, candidatePlatforms};

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.158
+1.0.161

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.158
+1.0.161

package/bin/cli.mjs

@@ -62,7 +62,7 @@ What it writes:
   .github/workflows/deploy-web.yml - Flutter web release workflow when web/ exists
 
 Options:
-  release [ios|android|both]  Prepare a frozen mobile release intent on the task branch
+  release [ios|android|both]  Prepare a mobile release intent on the task branch
   --dry-run        Print what would happen without writing files
   -v, --version    Show version number
   -h, --help       Show this help message

package/docs/CONFIGURATION.md

@@ -76,12 +76,14 @@ inferred safe from a custom step name. Candidate misses never wait or reserve a
 
 Separate custom workflows remain app-owned. Recognized native dependency jobs
 receive optional lock/toolchain-keyed cache restore/save inside their existing job.
-Supported validation workflows use their existing PR trigger for `task/**` branches,
-keeping default-branch push checks and all job names, commands and custom checks.
-This requires a single app-owned validation workflow, a PR trigger covering the
-known default branch, and jobs without event-dependent behavior or custom GitHub scripts. Other workflows retain separate push/PR concurrency
-groups, so neither required check cancels the other. An upgrade also repairs the shared
-group emitted by 1.0.142–143. Separate platforms and repositories keep their existing parallelism.
+An app-owned workflow whose push trigger is a plain `branches` list admitting `task/**`
+validates each candidate on that push, which runs on the exact head: the installer deletes its
+duplicate `pull_request` trigger, and a trailing `!task/**` written by earlier releases, in one
+write. Job names, commands and custom checks are unchanged. A push with `branches-ignore`,
+`paths` or `paths-ignore`, or one that does not admit `task/**`, is left as it is; such
+workflows retain separate push/PR concurrency groups, so neither check cancels the other.
+An upgrade also repairs the shared group emitted by 1.0.142–143. Separate platforms and
+repositories keep their existing parallelism.
 
 `.gowalk-cicd.lock.json` records the template and generated-file digests. Commit it
 with the configuration and rendered workflows. It is migration state, not a CI job.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.158",
+  "version": "1.0.161",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
-    "CLAUDE.md",
+    "remedies.json",
     "docs/GRADLE_CACHE.md",
     "docs/CANDIDATE_ARTIFACTS.md",
     "docs/BACKEND_EDGE.md",

package/remedies.json

@@ -0,0 +1,32 @@
+[
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_phase_owner_mismatch",
+    "fixed_in": "1.0.126",
+    "remedy": "Inspect the release helper the workflow actually executes, including its immutable action snapshot. Before 1.0.126, a failed-jobs-only retry could retain an earlier admission attempt and refuse after rebuilding. If its receipt still says building, rerun the whole original workflow or adopt the released helper through a checked candidate. From 1.0.126 an earlier attempt of the same run, source and platform is supported, while begin-upload still requires building. A foreign run, source or platform remains refused. Preserve explicit task pins and app-specific inputs; never patch consumer ownership checks or relabel an ambiguous receipt."
+  },
+  {
+    "schema": "gowalk-cicd/play-owner.v1",
+    "code": "play_owner_busy",
+    "fixed_in": "1.0.132",
+    "remedy": "Read the package edit owner's current state through supported tooling and preserve unrelated work. The 1.0.132 package includes the 1.0.131 repair that records Android upload intent inside the acquired Play owner: adopt its action and workflow together, using mobileReleaseIntentScript instead of a separate Record Android upload intent step. A new owner refusal then leaves the release receipt building. Older workflows may already have marked uploading even though no provider call was attempted. That existing ambiguity still needs exact provider readback and supported recovery with the retained binary; neither elapsed time nor an owner refusal permits clearing the marker."
+  },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_upload_phase_unconfirmed",
+    "fixed_in": "1.0.132",
+    "remedy": "Read the original run, attempt and deployment receipt before retrying. A completed uploaded receipt is reused with its original evidence; finish its metadata and submission work. An uploading receipt is ambiguous even when a later owner refusal reports no provider attempt. Adopt the 1.0.132 action and workflow together to place future Android intent writes inside acquired Play ownership. For an existing receipt, prove the exact provider build/version or use supported retained-binary recovery; never relabel it building by hand or clear ownership on elapsed time."
+  },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_http_500",
+    "fixed_in": "1.0.147",
+    "remedy": "A GitHub receipt POST can persist uploading and still return HTTP 500 before the uploader executes; this proves neither an Apple upload nor a capacity limit. From 1.0.147 the helper reconciles its uniquely marked write by bounded readback without replaying the POST. Preserve the original run, attempt, binary and receipt if it still fails. recover_upload_intent.cjs owner/repo deployment-id plan|live restores an iOS intent only after fresh proof that its exact failed HTTP 500 intent step preceded an explicitly skipped uploader. Inspect the plan and live readback, then retry the original failed job. An executed uploader or uncertain evidence keeps the guard closed."
+  },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_intent_stale",
+    "fixed_in": "1.0.160",
+    "remedy": "From 1.0.160 a push changing .factory/releases/mobile.json admits the pushed tree for its declared platforms; upload and binary reuse keys come from the built tree and current build variables. Other events, including workflow_dispatch and newer-head retries, require the built tree to equal the last intent-changing commit's tree. Prepare and commit a new release intent on a task branch, land it through the required candidate checks, and follow that deployment. A dispatch of later source cannot substitute for the approved release. Legacy v1 intents are accepted; their stored source/configuration hashes no longer gate admission."
+  }
+]

package/src/config/validation-events.mjs

@@ -1,56 +1,38 @@
-// Keep required push/PR checks independent; avoid duplicate factory pushes only for supported PR validation.
-import { execFileSync } from 'node:child_process';
+// A task/** push already validates the exact candidate head, so a duplicate PR trigger is deleted.
 const REF = '${{ github.ref }}';
 const COALESCED = '${{ github.event.pull_request.head.repo.full_name == github.repository'
   + ' && github.event.pull_request.head.ref || github.ref_name }}';
+const FACTORY_EXCLUSION = '!task/**';
 
-export function defaultBranch(root) {
-  try {
-    return execFileSync('git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'],
-      { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-      .trim().replace(/^refs\/remotes\/origin\//, '');
-  } catch { return ''; }
+// Repair the shared push/PR group emitted by 1.0.142–143.
+function normalizeGroup(doc, concurrency) {
+  if (concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
+  const group = concurrency.group.replace(COALESCED, REF);
+  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
+  if (group === concurrency.group || !group.includes(REF) || !recognized) return false;
+  doc.setIn(['concurrency', 'group'], group);
+  return true;
 }
 
-function coversCandidates(event, branch, jobs) {
-  if (!branch || (event !== null && (typeof event !== 'object' || Array.isArray(event)))) return false;
-  const filters = event || {};
-  if (Object.keys(filters).some(key => !['branches', 'types'].includes(key))) return false;
-  if (filters.types && (!Array.isArray(filters.types)
-      || !['opened', 'synchronize', 'reopened'].every(type => filters.types.includes(type)))) return false;
-  if (filters.branches && (!Array.isArray(filters.branches) || !filters.branches.includes(branch)
-      || filters.branches.some(value => typeof value !== 'string' || /[!*?\[\]+]/.test(value)))) return false;
-  // Event-dependent app commands and job conditions need their own reviewed migration.
-  return !/github\.(event|ref)|GITHUB_(EVENT|REF)|actions\/github-script@/.test(JSON.stringify(jobs));
+// Only a plain branch list whose last pattern for task refs admits them all; anything else is left alone.
+function candidateBranches(push) {
+  if (!push || typeof push !== 'object' || Array.isArray(push)) return null;
+  if (['branches-ignore', 'paths', 'paths-ignore'].some(key => Object.hasOwn(push, key))) return null;
+  const values = push.branches;
+  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return null;
+  const branches = values.at(-1) === FACTORY_EXCLUSION ? values.slice(0, -1) : values;
+  const admitted = branches.findLastIndex(value => value === 'task/**' || value === '**');
+  if (admitted < 0 || branches.slice(admitted + 1).some(value => value.startsWith('!'))) return null;
+  return branches;
 }
 
-function excludeFactoryPush(doc, push) {
-  if (push !== null && (typeof push !== 'object' || Array.isArray(push))) return false;
-  const filters = push || {};
-  const field = Object.hasOwn(filters, 'branches') ? 'branches' : 'branches-ignore';
-  if (!Object.hasOwn(filters, field) && ('tags' in filters || 'tags-ignore' in filters)) return false;
-  const values = filters[field] || [];
-  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return false;
-  if ('branches' in filters && 'branches-ignore' in filters) return false;
-  const exclusion = field === 'branches' ? '!task/**' : 'task/**';
-  if (values.at(-1) === exclusion) return false;
-  doc.setIn(['on', 'push'], doc.createNode({ ...filters, [field]: [...values, exclusion] }));
-  return true;
-}
-
-export function upgradeEvents(doc, value, branch) {
+export function upgradeEvents(doc, value) {
   const events = value.on;
-  const concurrency = value.concurrency;
-  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
-      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
-  const original = concurrency.group;
-  const group = original.replace(COALESCED, REF);
-  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
-  if (!group.includes(REF) || !recognized) return false;
-  let changed = group !== original;
-  if (changed) doc.setIn(['concurrency', 'group'], group);
-  if (coversCandidates(events.pull_request, branch, value.jobs)) {
-    changed = excludeFactoryPush(doc, events.push) || changed;
-  }
-  return changed;
+  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')) return false;
+  const grouped = normalizeGroup(doc, value.concurrency);
+  const branches = candidateBranches(events.push);
+  if (!branches) return grouped;
+  if (branches.length < events.push.branches.length) doc.deleteIn(['on', 'push', 'branches', branches.length]);
+  doc.deleteIn(['on', 'pull_request']);
+  return true;
 }

package/src/config/validation.mjs

@@ -3,7 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readYaml, MigrationRepair } from './yaml.mjs';
 import { upgradeReuse } from './validation-reuse.mjs';
-import { defaultBranch, upgradeEvents } from './validation-events.mjs';
+import { upgradeEvents } from './validation-events.mjs';
 const CACHE = 'caa296126883cff596d87d8935842f9db880ef25';
 const PREFIX = '.github/actions/swift-app/scripts/';
 
@@ -54,12 +54,10 @@ export function planValidation(root, managed) {
   if (!existsSync(directory)) return [];
   const writes = [];
   const files = readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file));
-  // Another app-owned workflow may depend on this workflow's push evidence.
-  const branch = files.length === 1 ? defaultBranch(root) : '';
   for (const file of files) {
     const source = readFileSync(join(directory, file), 'utf8');
     const { doc, value } = readYaml(source, file);
-    const events = upgradeEvents(doc, value, branch);
+    const events = upgradeEvents(doc, value);
     const reused = upgradeReuse(doc, value, file);
     const cached = upgradeCaches(doc, doc.toJS({ maxAliasCount: 100 }), file);
     if (cached || events || reused) {

package/src/install.mjs

@@ -167,7 +167,7 @@ function printSummary() {
   console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
   console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');
   console.log('  Existing checkout credentials remain a backward-compatible fallback.');
-  console.log('  Validate committed task source, run gowalk-cicd release, and merge its frozen intent through a PR.');
+  console.log('  Validate committed task source, run gowalk-cicd release, and merge its intent through a PR.');
   console.log('');
   console.log('Re-run this installer anytime to update the vendored action:');
   console.log('  npx --yes gowalk-cicd');

package/src/release.mjs

@@ -1,36 +1,6 @@
-// Freeze committed source and the repository variables the workflow will actually read.
-import {execFileSync} from 'node:child_process';
+// Declare the platforms ready to ship from committed task source; no remote configuration read.
 import inputs from '../action/scripts/mobile_inputs.cjs';
 
-export function variables(repository, execute) {
-  const info = JSON.parse(execute('gh', ['api', `repos/${repository}`]));
-  if (info.full_name !== repository || !['User', 'Organization'].includes(info.owner?.type)) {
-    throw Error('mobile_release_repository_unverified');
-  }
-  const scopes = info.owner.type === 'Organization' ? ['organization-variables', 'variables'] : ['variables'];
-  const result = {};
-  for (const scope of scopes) {
-    const pages = JSON.parse(execute('gh', ['api', `repos/${repository}/actions/${scope}?per_page=100`,
-      '--paginate', '--slurp']));
-    if (!Array.isArray(pages) || !pages.length || pages.some(page => !Array.isArray(page?.variables))) {
-      throw Error('mobile_release_configuration_unverified');
-    }
-    for (const row of pages.flatMap(page => page.variables)) {
-      if (!row || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(row.name) || typeof row.value !== 'string') {
-        throw Error('mobile_release_configuration_unverified');
-      }
-      result[row.name] = row.value;
-    }
-  }
-  return inputs.buildVariables(result);
-}
-
 export function release(platform) {
-  const execute = (command, args) => execFileSync(command, args, {
-    encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 60000,
-  }).trim();
-  const remote = execute('git', ['remote', 'get-url', 'origin']);
-  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(remote);
-  if (!match) throw Error('mobile_release_repository_unverified');
-  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables(match[1], execute));
+  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform]);
 }

package/templates/deploy.yml

@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   release:
-    name: Admit frozen mobile release
+    name: Admit mobile release
     if: ${{ github.ref_name == github.event.repository.default_branch || inputs.candidate-build }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
@@ -32,6 +32,8 @@ jobs:
       android: ${{ steps.intent.outputs.android }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
       - name: Verify release intent and prior upload receipts
         id: intent
         env:

package/CLAUDE.md

@@ -1,476 +0,0 @@
-# gowalk-cicd — Development Guide
-
-## Purpose
-
-npm package that distributes iOS TestFlight, Android Google Play, and Flutter
-web release workflows.
-Consumer runs `npx gowalk-cicd` and gets:
-
-- `.github/actions/swift-app/` — vendored composite action
-- `.github/actions/android-app/` — vendored Android action (Flutter or Gradle)
-- `.github/workflows/deploy.yml` — dual-platform workflow
-- `.github/workflows/deploy-web.yml` — Flutter web release artifact workflow
-  (only when `web/index.html` exists)
-
-Re-running the installer updates it. `gowalk-cicd release [ios|android|both]` creates the
-explicit source-and-configuration intent; it does not build or upload. Keep this surface small.
-
-## Structure
-
-```
-gowalk-cicd/                     ← repo root IS the gowalk-cicd package
-├── action/                      ← iOS action — canonical source of truth
-│   ├── action.yml
-│   └── scripts/*.py
-├── android-action/              ← Android action — canonical source of truth
-│   ├── action.yml               ← branches on project kind (flutter | gradle)
-│   └── scripts/*.py
-├── bin/cli.mjs                  ← CLI entrypoint (parses flags, calls runInstall)
-├── src/install.mjs              ← copy logic, gitignore-check, summary print
-├── templates/deploy.yml         ← managed dual-platform workflow template
-├── templates/deploy-web.yml     ← Flutter web workflow copied conditionally
-├── backend-action/              ← backend deploy action + remote host script
-├── templates/deploy-backend.yml ← backend workflow copied when compose exists
-├── scripts/auto-version.mjs     ← patch-bump-from-npm used by the publish workflow
-├── .github/workflows/publish.yml ← auto-publish to npm on push to main
-├── README.md                    ← consumer docs
-├── CLAUDE.md                    ← this file (for AI agents)
-└── package.json
-```
-
-## Key invariant: action directories are canonical sources
-
-The composite actions under `action/` and `android-action/` are the source of
-truth. Edit them directly here; consumer copies are generated by the installer.
-
-There is no upstream copy to sync from. This package was split out of the
-daemux-plugins monorepo, where `action/` used to be a vendored mirror of
-`.github/actions/ios-native-testflight/` refreshed by a `sync-action.mjs`
-step. That relationship no longer applies — the sync script and the
-vendoring concept are gone.
-
-## Publishing
-
-Auto-publish on every push to `main` (the entire repo IS the package). The
-workflow (`.github/workflows/publish.yml`) serializes version selection through
-publication; PR checks use separate cancellable groups. This prevents concurrent
-main runs from choosing the same npm patch version. The workflow:
-
-1. Runs `scripts/auto-version.mjs .` which queries npm for the current
-   published version of `gowalk-cicd` and bumps the patch. A first publish
-   keeps the seed version from `package.json`.
-2. Stamps the new version into both action directories (consumed by the
-   consumer-side autoupdate check) before publishing.
-3. Runs `npm publish --access public` using npm Trusted Publishing. The new
-   package name requires one bootstrap publish via `NPM_TOKEN` before npm can
-   attach the `publish.yml` trusted-publisher relationship; the workflow
-   supplies that token as a fallback and uses OIDC after trust is configured.
-
-Manual publish (from repo root):
-
-```bash
-npm publish --access public
-```
-
-## Testing locally
-
-From a scratch directory:
-
-```bash
-mkdir /tmp/scratch && cd /tmp/scratch && git init
-node /path/to/gowalk-cicd/bin/cli.mjs --dry-run
-```
-
-Or install into a real app repo after `npm install` in this source checkout
-(updates action directories and renders workflows from `.gowalk-cicd.yml`):
-
-```bash
-cd ~/path/to/app-project
-node /path/to/gowalk-cicd/bin/cli.mjs
-```
-
-## Conventions
-
-- Prefer Node built-ins. `yaml` parses and edits app configuration/workflows during installation;
-  `update-notifier` supplies the optional update banner. Neither adds an app CI job.
-- `.gowalk-cicd.yml` owns app settings and workflow extensions. The generated workflow digests
-  and template baselines live in `.gowalk-cicd.lock.json`. Plan all migrations before any writes;
-  never overwrite a conflicting app customization. See `docs/CONFIGURATION.md`.
-  Refresh `templates/history.json.gz` with `node scripts/build-workflow-history.mjs` when templates change.
-- Never hardcode paths — use `fileURLToPath(import.meta.url)` and derive
-  from `__dirname`.
-- Keep the CLI surface minimal: `--dry-run`, `-v`, `-h`. Resist adding flags.
-- `.gitignore` in the consumer repo is git-tracked. Never auto-edit it.
-  Detect and warn, tell the user to remove lines manually.
-- Never repeat an `env:` key in another case (`NO_PROXY` beside `no_proxy`): GitHub
-  compares env keys case-insensitively and rejects the whole workflow or action file.
-  `test/env-keys.test.mjs` scans the templates and actions. Where a step genuinely needs
-  both spellings of a variable, set them inside the step's own child process, never in YAML.
-- Composite action steps cannot use workflow-only `timeout-minutes`. Native cache restores
-  retain their segment timeout and the caller's job deadline; workflow-level cache steps
-  can retain their two-minute step limits. `test/composite-timeouts.test.mjs` guards this schema boundary.
-- Store API calls belong in GitHub Actions. Local tests may build/sign but must
-  never connect to App Store Connect or Google Play.
-- **GitHub Actions reaches Apple and Google directly, and must never be given a store
-  proxy.** The account-pinned residential exit exists so that the panel and the runner
-  Macs are not the hosts contacting the stores; a GitHub-hosted runner is neither.
-  No workflow, action or helper here may read `APPLE_STORE_PROXY_URL`,
-  `GOOGLE_STORE_PROXY_URL`, or set `HTTP(S)_PROXY` for a build tool — the job-wide
-  transport this replaced billed every SDK, pub, Gradle and CocoaPods byte to a metered
-  residential exit. Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
-  It retains provider IDs/local SHA-256 and verifies matching IPA identity before resume.
-  Finalization sends `uploaded:true` as Apple's documented BuildUpload flow does; the
-  IPA endpoint rejected the optional SHA_256 checksum attribute despite the generic
-  schema advertising it. Completed-file reuse requires the content-derived filename
-  and size; any checksum returned by Apple is verified against the local file.
-- Signing material should use encrypted Actions secrets. `deploy.yml`
-  materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
-  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
-  `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
-  and Play service account into an ephemeral runner checkout.
-  Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
-  files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
-  Signing preparation never issues a distribution certificate on a cache miss: the ephemeral
-  job cannot retain its new private key. Require a supplied usable identity, preserve failed
-  material for reconciliation and report `apple_signing_identity_required` without provider writes.
-  Version source staged before signing is preserved separately with its original index bytes.
-- App Group identifiers come from each archive target's entitlements. `app_groups.py`
-  checks exact values in cached and fresh profiles; a fresh mismatch fails before profile
-  installation with `apple_app_groups_required`. Register/assign groups through the scoped
-  Apple account console before retrying CI. Never invent an ASC group operation, infer an
-  identifier from the bundle name, or accept a wildcard/unrelated group as a matching grant.
-- Never revoke a distribution certificate automatically, including legacy caches.
-  `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
-  A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`
-  emits fixed reason/code evidence in `apple_certificate_rejected`; raw provider details stay private.
-  Certificate creation sends the complete PEM CSR in `csrContent`, including its framing and newlines.
-- Keep preinstalled Android SDK/NDKs. Gradle tests/builds, SDK downloads, pub, analysis,
-  localization and Flutter bootstrap all run with the job's own environment and reach their
-  providers directly. Do not reintroduce a relay, a wrapper shell or a proxy variable for
-  them: those existed only to force traffic through an account exit CI no longer uses.
-- `android-action/flutter-setup/` owns Flutter setup. It forwards the official action's
-  inputs/cache identities while isolating restore/save from provider transport. Its step-local
-  `NODE_OPTIONS` preloader (`android-action/scripts/cache_*.cjs`) also protects CocoaPods cache
-  steps and verifies the exact pinned Actions cache entrypoint bytes and HTTPS
-  GitHub cache/Azure blob destinations before the cache process runs. Unknown code or
-  origins refuse. The preloader stays scoped to that one process: never export it through
-  `GITHUB_ENV`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
-  older consumer autoupdate changes the action directory. The installer delivers this development
-  tooling for native iOS repositories too; it does not require an Android app.
-- Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
-  It allows four attempts within 60 seconds for manifests or 20 minutes for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
-  Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
-  manifest's SHA-256 enters action outputs. A transient origin refusal (408, 429, 500, 502, 503,
-  504) shares that retry budget. Authentication/certificate refusals remain terminal.
-  `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
-  Archive progress emits retained byte counts every minute and safe results after each attempt;
-  the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
-  With SDK caching enabled, failed archive transfers preserve public bytes in a job-owned,
-  digest-scoped directory. Separate optional cache restore/save steps retain them between runs;
-  they never expose partial bytes as an installed SDK. Successful or corrupt completed archives
-  are removed from that partial cache. Full SDK cache identities stay unchanged.
-- Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
-  the existing proxied build command. This is not a font or integration offline guarantee;
-  preserve app-authored font declarations, bootstrap configuration and other build inputs.
-- Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
-  SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
-  A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its
-  errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
-  to hide an optional cache failure. Do not alter cache keys or disable caches as part of
-  this timeout handling.
-- Flutter SDK caching restores first and saves immediately after successful setup, before
-  consumer tests/builds can fail and suppress a combined cache action's success-only post hook.
-  Save only on a cache miss with caching enabled, a real successful install and verified cache
-  scope. Preserve resolved keys/paths and the official pinned restore/save programs. Failed or
-  dry-run setup never publishes an SDK cache; pub dependency caching retains its job-end behavior.
-- Exact `flutter-version` inputs may reuse previously resolved public release metadata before SDK
-  cache lookup. Metadata is scoped to platform, origin, channel, architecture and full version;
-  URL/pin/schema/release fields are checked before reuse. Blank, wildcard and version-file inputs
-  resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
-  account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
-- Gradle caches use checksum-pinned restore/save actions, each optional and bounded to two minutes.
-  Native Pods/Bundler caches use the committed locks and selected Ruby/Xcode/architecture in the existing job.
-  Preserve setup-java's complete keys, inputs and absolute paths; restore the same OS/architecture prefix.
-  Failed releases save distinct partial keys unless cancelled; completed keys require success. Builds remain required.
-  Only pinned cache entrypoints get cache transport; see [cache behavior](docs/GRADLE_CACHE.md) before adoption.
-- GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
-  `mobile-candidate.yml` builds only trusted ready task PRs, using the existing release workflow in
-  candidate mode. Candidate mode cannot publish or mutate a marketing-version slot. Main promotes
-  only verified matching binaries with current credentials and retains the original build/symbol identity;
-  a miss uses the normal build without waiting. Preserve successful sibling artifacts across reruns.
-  See `docs/CANDIDATE_ARTIFACTS.md`; never turn this optimization into a new factory stage or resource reservation.
-  It reuses the cache transport's approved HTTPS request guard inside the official
-  `upload-artifact` process. Unknown programs/origins refuse; artifact failures remain job failures.
-  The iOS action reads this helper from its immutable `SWIFT_APP_ACTION` snapshot. Its shared
-  `cache_scope.cjs` and `artifact_env.cjs` copies match the Android distribution byte for byte,
-  enforced by `test/artifact-wiring.test.mjs`; update both when changing that common guard.
-  Update existing consumer workflow artifact steps as well as action directories on adoption.
-- Backend layout selection belongs in `backend-action/layout.cjs`, reused by the installer and both
-  workflow entrypoints. Support the four standard Compose names without source renames. Multiple
-  matches require explicit existing `backend-dir`/`compose-file` configuration before writes or SSH.
-  Keep the chosen basename through transfer and remote `COMPOSE_FILE`; stale host files must not win
-  Docker's implicit filename precedence. Root source directories remain unsupported. Cover isolated
-  consumer installs, action validation/transfer and remote command selection in focused tests.
-- Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
-  secret. The action writes it to host-side `.runtime.env` with mode 0600 and
-  supplies it to Compose after the generated `.env`; never print its content.
-  Backend failures emit `backend_deploy_failed` with the fixed runner/host phase and exit code.
-  Its message uses the exact schema/phase/exit envelope documented in README, without JSON braces
-  that multiline secret masking can erase. Never reconstruct masked fields or include arbitrary text.
-  Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
-  signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
-  Timeout and cancellation retain the existing bounded sanitized diagnostic after owned-child cleanup;
-  preserve the failure code, install deadline and retry fences.
-  Within the bounded capture, retain the CocoaPods primary exception alongside the tail when a long
-  stack or secondary issue-search failure hides it. Redact before selecting the bounded excerpt.
-- The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
-  new app before GitHub registers `deploy-backend.yml` on the default branch.
-  Default-branch deploys continue through the separate backend workflow.
-- Mobile pushes exclude durable `.factory/progress` records and the separately deployed
-  backend/server/Compose paths, backend action, docs, marketing, account-recovery scripts,
-  tests and the standard validation/web workflows. Backend action changes trigger only backend
-  deployment; its package version marker alone does not. A mixed commit with any native/shared input still builds;
-  explicit workflow dispatch remains available. Keep backend deployment's own path filters
-  intact, and do not broadly exclude assets, root build settings or unknown app layouts.
-- Domain-backed backend deploys fail closed on certificate issuance and the
-  public HTTPS health probe. The probe requires a completed 2xx response with normal TLS
-  verification; a redirect, including one to the same URL, is not healthy. Each attempt
-  has bounded connection/total time and retains only curl exit and HTTP status diagnostics.
-  `select_certbot_account.sh` chooses one existing
-  Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
-  non-interactive; legacy v1 account directories are not valid candidates.
-  `ensure_certificate.sh` preserves failed inventory status and retries only Certbot's
-  explicit lock-busy response (six attempts, 75 seconds total backoff). Every retry reads
-  inventory before issuance; absence needs recognized complete SAN records or Certbot's explicit
-  no-certificate sentinel. Empty/malformed output and arbitrary errors never mean absence. Raw command
-  output stays in an owned private temporary directory removed on exit. Do not remove
-  Certbot locks, stop other processes, force renewal or bypass the public HTTPS health gate.
-  Docker port changes update only the managed nginx upstream, preserving existing TLS directives.
-  Existing certificate inventory is followed by domain-scoped `certbot install`, so a legacy
-  HTTP-only vhost also recovers without reissuance. Installation shares the bounded lock-only retry.
-- Optional backend edge delivery keeps `api-domain` as infrastructure and verifies the separate
-  `public-health-url` against exact health JSON `build_sha`. `public-base-url` supplies
-  `BACKEND_PUBLIC_BASE_URL` to Compose interpolation; app services consume it for generated URLs.
-  `ingress-required` requires a private `ingress-token` before deployment. Protect only the distinct
-  `backend-<app>-edge.conf`; preserve a legacy vhost's TLS/public access and update both managed
-  ports. A missing token/settings cannot downgrade an already protected app. Keep tokens in private
-  stdin/file transport, strip the ingress header before app forwarding, and validate real nginx in
-  focused tests. Managed locations forward WebSocket upgrades with a domain-scoped Connection map
-  and disable response buffering; verify a real frame exchange and a first SSE event before upstream
-  completion. Preserve legacy deployments that have not opted in and existing failure phases.
-  Remote helpers support Python 3.8 and newer; avoid newer syntax and standard-library APIs.
-  Run the edge suite with `python3.8 -m unittest discover -s backend-action -p 'test_edge*.py'`;
-  CI repeats it with Python 3.8, including the real nginx checks, before publication.
-- The Android action serves two build systems. `android_config.project_kind()`
-  is the only place that decides which; every downstream step branches on the
-  `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
-  because a Flutter app also carries `android/settings.gradle`.
-- Both Android release compilers run through `android_build_diagnostics.py`.
-  It retains at most 64 KiB of private child output and publishes
-  only fixed signal names, phase and exit status in `android_build_failed`. An empty signal
-  list is unclassified, never a guessed cause; matching signals are observations, not a retry
-  decision. Minute progress notices replace raw compiler output. Preserve the actual exit,
-  command arguments, signing and symbol checks.
-- Offline delivery preflight recognizes compiled single-size icons through `delivery_icons.py`.
-  Require matching 1024 `Icon Image` and `MultiSized Image` index records per declared device idiom;
-  do not treat an arbitrary 1024 image as coverage or weaken missing-family checks.
-- iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
-  preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
-  bundle's application target and resolve paths from that target's source root; never take
-  the first dependency plist or stop reading Xcode output early. The encryption step reuses
-  the validated source path. Missing/ambiguous source plists fail; positively generated
-  plists retain the existing build-setting version path. Queries disable signing and package
-  updates, retain inherited proxies, and never enable provisioning network operations.
-- Native Xcode validation and archives first check the selected project/workspace graph with
-  `native_dependency_guard.py ROOT --container PATH`. Xcode-managed Swift packages remain refused:
-  they resolve outside the committed lockfile the guard exists to enforce. The same app session preserves
-  source and uses the vendor's official CocoaPods distribution or verified local XCFrameworks.
-  `native_pods.py` installs a committed, unchanged `Podfile.lock` with `pod install --deployment`,
-  then checks the completed workspace. No Podfile means no dependency download at all.
-  Initial local lock resolution may use the
-  explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
-  These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
-  `native_bundle.py` honors the selected project's committed Gemfile/lock, falling back to
-  the repository root; missing gems install with a frozen bundle.
-  Both Flutter configuration and the Pods helper use that bundle in their child process,
-  preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
-  action helper together; action-only updates cannot repair earlier custom configuration steps.
-  Flutter `--config-only` can query Xcode and install Pods before returning. In the workflow,
-  generate Flutter inputs with `pub get`, run the locked `native_pods.py` preparation and
-  completed graph guard, then configure the release with its existing obfuscation/define flags.
-  The graph guard still applies when there is no Podfile. Preserve this order in custom CI.
-- Locked Pod installation retries once only when its own attempt reports curl 18 and a partial-transfer
-  symptom. Both attempts share the existing 900-second budget and recheck Podfile, Podfile.lock and
-  selected Ruby bundle inputs. TLS/auth/permission, checksum, version and deployment errors never retry.
-  The assigned relay, deployment flags and completed-workspace guard remain mandatory; caches are retained.
-  `native_pods_retry` publishes only the fixed attempt/reason, and success reports `pod_attempts`.
-- Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
-  has no equivalent, so `set_gradle_version()` rewrites the literal in the
-  checkout the way the iOS action patches the pbxproj. Never commit that edit.
-  The rewrite is best-effort — a module that computes its versionCode has no
-  literal to rewrite — so the Gradle build additionally applies the resolved
-  values through the Variant API (`scripts/version_override.init.gradle`,
-  passed as `--init-script`). That override, not the rewrite, is what makes the
-  number authoritative. Do NOT reach for `-Pandroid.injected.version.code`:
-  those properties were removed in AGP 7.3 and are silently ignored by every
-  AGP 8.x app in the fleet.
-- Dart obfuscation is mandatory for Flutter apps and has no opt-out — do not
-  add an input, repo variable or config key for it. Both Flutter release
-  builds carry `--obfuscate --split-debug-info`: `flutter build appbundle` in
-  `android-action/action.yml`, and the `flutter build ios --config-only` call
-  in `templates/deploy.yml`, which is where the iOS build is obfuscated
-  (`--config-only` writes `DART_OBFUSCATION` / `SPLIT_DEBUG_INFO` into
-  `ios/Flutter/Generated.xcconfig`; the Flutter build phase inside the
-  `xcodebuild archive` reads them). The flags are one feature: `--obfuscate`
-  refuses to run without `--split-debug-info`, and the symbol files it writes
-  are the only way to read a stack trace from that build, so they are always
-  retained as an artifact (`android-symbols-*`, `ios-symbols-*`) and a build
-  that wrote none fails. Symbols are written under `RUNNER_TEMP`, never into
-  the checkout, so nothing that commits the working tree can pick them up.
-  Native Gradle, Swift and Flutter web builds are untouched (web has no such
-  flag). Wiring is pinned by `android-action/scripts/test_flutter_obfuscation.py`
-  and `test/install.test.mjs`.
-- Whatever an obfuscation flag needs to be safe must travel in the same file
-  as the flag. The consumer-side autoupdate re-vendors the action directories
-  but can never push `deploy.yml`, so "new action + old workflow" is the
-  fleet's normal state. That is why the Android action uploads
-  `android-symbols-*` itself instead of leaving it to the workflow, and why
-  the iOS flags and the `ios-symbols-*` step sit together in `deploy.yml`.
-  The iOS retain step runs on `!cancelled()` because the swift-app action keeps
-  going after the TestFlight upload (metadata, "What's New"): a failure there
-  must not discard the symbols of a build that is already live. Symbol
-  artifacts carry no `retention-days` so the repository's setting governs and
-  can be raised to cover a release's life.
-- Firebase Crashlytics traffic leaves the runner directly, like every other provider
-  request in CI. Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
-  archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
-  are deferred; mixed/unidentified upload phases refuse the archive for repair.
-  CI retains the archive's dSYMs as a ZIP with UUIDs, source SHA and SHA-256, then
-  emits `firebase_symbols_pending` (`gowalk-cicd/firebase-symbols-pending.v1`).
-  The app session downloads that exact artifact and uploads it through its
-  account-pinned Firebase console, reading processing back before completing the
-  delivery request. This requires no human handoff. A green CI run alone is not
-  evidence that the deferred symbols reached Firebase. Android retains its Dart
-  symbols and uploads them before the store bundle.
-- Crashlytics buildtools bootstrap runs before Flutter compilation. `crashlytics_bootstrap.py`
-  pins the official JAR version, byte size and SHA-256, admits only verified dependency-cache
-  bytes, and bounds GET recovery to three attempts within three minutes. Java receives
-  that verified file through `CRASHLYTICS_LOCAL_JAR`; changing the Firebase CLI pin must check
-  its JAR version/override contract. TLS, authorization and checksum errors never retry.
-  `firebase_symbols_bootstrap_failed` carries fixed typed evidence, never private curl output.
-- Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
-  transport, inventory reads and cleanup of that known edit; never replay an ambiguous
-  `edits.insert`. Edit creation retries at most three times only for typed connection-timeout
-  or typed connection failure evidence that no provider request was sent. TLS verification
-  failures, provider responses and lost origin responses do not authorize a retry.
-  Only an explicit package-404 allows first-release defaults; failed
-  inventory is not an empty account. The action exposes `play-api-ready` so current
-  workflows skip the redundant postbuild check. Error annotations carry safe
-  phase/category evidence and any cleanup edit ID without raw provider exceptions.
-- The iOS action reads every script and prompt from the snapshot it takes of
-  itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
-  from `${{ github.action_path }}` after that step. The plugin self-update
-  (`autoupdate_check.sh`) runs right after the snapshot and preserves its own source candidate,
-  before the version/signing/archive steps, so a red deploy still receives the
-  release that fixes it. `autoupdate_stage.py` installs and preserves that update in one
-  task-owned detached worktree, then removes it. The active build's HEAD, index, dirty files
-  and action manifests stay unchanged: GitHub reparses local composites for post hooks using
-  cached step IDs, so a script snapshot alone cannot protect a changed manifest's step count.
-  `test_action_step_order.py` pins both. A new script reference in
-  `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
-- Delivery dependencies may remain after a green job; each is a typed
-  check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
-  schema>`), never prose in a `::warning::`: `play_review_pending`
-  (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
-  unsubmitted) and `store_version_locked` (`action/action.yml`, the
-  `TESTFLIGHT_ONLY` decision of `manage_marketing_version.py`: an App Store
-  version is under review, so the build shipped to TestFlight under that
-  version and metadata was skipped), and `firebase_symbols_pending` (the dSYM
-  archive awaits the session's proxied console upload). The README lists the schemas; add a
-  field by bumping the version.
-- `android-action/play-upload/` verifies unchanged SHA/checksum-pinned official uploader
-  bytes before running Node24. It classifies immediate private child output, never live
-  GitHub annotations: expired/deleted retries normally; only the exact cannot-auto-submit
-  refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
-  The existing signed AAB, track/status/rollout and notes survive one bounded retry;
-  only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
-  Each attempt also emits brace-free `play_upload_diagnostic` with fixed observed progress,
-  process outcome and error signals from bounded private stdout/stderr line buffers.
-  Preserve the v1 upload result and retry rules; diagnostics never authorize replay or prove
-  an operation completed. See README for the independent diagnostic schema and field vocabulary.
-- The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
-  `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
-  gets 17 and native Gradle gets 21, except that a positively-detected Kotlin
-  Gradle plugin below 1.9.20 drops to 17 (older kapt cannot run under JDK 21).
-  Detection logic belongs in that script, where it is unit-tested — not inline
-  in the workflow template, where nothing can test it.
-
-- CI-generated source is preserved by `source_maintenance.py` on a deterministic
-  `task/ci-maintenance-*` branch, with remote parent/tree/SHA readback. It never changes
-  the build HEAD, rebases a dirty checkout, force-pushes or pushes to the default branch.
-  Only managed action/version source is accepted; credential-shaped staging refuses.
-  `source_maintenance_pending` identifies the exact source for the same app session's
-  checked PR. Unconfirmed preservation is a job failure; a receipt is not a completed merge.
-- Play preflight, version inventory and the pinned uploader share the panel's package edit owner.
-  The binding's nonsecret `principal_sha256` must match the selected service account's
-  `client_email` fingerprint before provider work. A mismatch requires supported CI-secret
-  provisioning; never accept the account ID or a caller-supplied fingerprint alone.
-  `APP_ROBOT_PLAY_EDIT_BINDING` is panel-provisioned repository data; workflows pass it as
-  `PLAY_EDIT_BINDING` with the repo-local GitHub token and `contents:write`/`actions:read`.
-  `play-upload/owner_run.cjs` protects Python entrypoints; `run.cjs` holds the same owner across
-  its permitted upload retry. An active owner gets a single 60-second acquisition wait budget;
-  each retry revalidates the record, cancellation interrupts the wait, and an expired budget
-  never clears an owner. Missing/retired bindings and unknown write outcomes still refuse;
-  only exact terminal run/attempt/source proof permits CI-owner recovery.
-  Both entrypoints emit brace-free `play_edit_owner` errors with fixed codes and optional child
-  exit evidence, preserving the existing upload receipt and refusal. Never reconstruct masked text.
-  Other packages stay parallel. The GitHub coordination request is fixed-origin.
-  Update workflow wiring as well as action directories.
-
-- Mobile Deploy watches `.factory/releases/mobile.json`, produced from committed task source and
-  the named build-variable allow-list shared by freeze and runtime in `mobile_inputs.cjs`.
-  The list follows `templates/deploy.yml`; rotating Play ownership leases stay excluded.
-  Unknown inputs and embedded editors remain in its source proof; native trees
-  are platform-scoped. Backend/web deployments remain independent. Confirmed store uploads are
-  recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
-  An uncertain upload never starts another binary automatically. Preserve its signed artifact,
-  complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
-  `action/scripts/recover_upload_intent.cjs owner/repo deployment-id plan|live` repairs only
-  an iOS intent whose exact terminal run has one failed HTTP 500 intent step and an explicitly
-  skipped uploader in the complete GitHub job log. It refuses later run attempts and changed
-  evidence, appends a read-back building receipt, and never uploads or calls Apple. Retry the
-  original failed job afterward; preserve the recovery proof separately.
-  The local Android workflow supplies `mobileReleaseIntentScript` to the upload wrapper instead
-  of marking `uploading` before acquiring Play ownership. A refused owner leaves the release
-  record at `building`; the wrapper records intent inside its acquired lease before provider
-  dispatch. Adopt both the action and workflow wiring; action-only updates preserve older
-  workflows' intent handling. Never clear an existing `uploading` marker on an owner refusal.
-  Actions without `MOBILE_RELEASE_DEPLOYMENT_ID` preserve legacy consumer behavior. All new
-  receipt helper reads are fixed-origin GitHub requests; Apple/Google still use their assigned exits.
-
-## Scoped backend diagnosis
-
-Backend network preparation and `operation: network-diagnostics` follow `docs/BACKEND_NETWORKS.md`.
-Keep allocation inside verified existing daemon pool bases, preserve all existing and authored networks,
-and hold the host allocation lock only through creation/readback. Never restart/reconfigure Docker,
-prune networks, or invent a free private range. Remote modules and source facts remain Python 3.8 compatible.
-Tests include the explicit CI-only six-project Docker coexistence proof; ordinary local tests contact no daemon.
-
-The existing backend action accepts `operation: identity-diagnostics` with a UTC `diagnostic-since`
-from the last24hours and exact `diagnostic-service` (default`api`). It performs no deploy, rsync,
-Compose mutation or environment read. `identity_diagnostics.py` uses the existing CI SSH binding,
-selects exactly one running container by Compose project/service, rechecks both labels and reads
-at most1000recent log lines within a1MiB/30second bound. Raw output stays on the host; only the
-fixed `firebase_identity_refused` stage/reason allowlist leaves it. No match means no observed
-label, not successful authentication. Dispatch this action through the app's existing backend
-workflow after a protected package release/adoption; never run hand-SSH or expose raw logs.
-
-The diagnostic reader accepts the product-independent standard WARNING logger envelope, discards its
-logger name and rejects trailing fields. Structured remote failure codes survive exit1; SSH transport,
-read bounds and scope refusals have a closed vocabulary. Unknown exceptions remain unclassified.
-
-The same validated envelope is retained in the dedicated `backend-identity-diagnostics-<job>-<attempt>`
-artifact on success and classified reader failure. Download `result.json` from that exact run;
-GitHub secret masking can alter structural braces in logs. The artifact contains only schema,
-ok, fixed failure and fixed stage/reason records. Raw host output, configuration and identities
-never enter it. Its pinned upload uses the same process-scoped artifact transport as mobile actions.