@@ -118,10 +118,11 @@ name: Board Snapshot
 #
 # ## Adopting this in a sibling repo
 #
-# Copy FOUR files, unchanged: `scripts/pm/board-snapshot.mjs`,
+# Copy FIVE files, unchanged: `scripts/pm/board-snapshot.mjs`,
 # `scripts/pm/check-half-states.mjs` (the archiver imports its proxy-re-exec plan
-# and its repo resolver), `scripts/invoked-as.mjs` (imported by both) and this
-# file. A repo that has already adopted the half-state patrol has the middle two.
+# and its repo resolver), `scripts/invoked-as.mjs` (imported by both),
+# `scripts/ci/board-snapshot-r2-upload.sh` (the R2 step runs it) and this
+# file. A repo that has already adopted the half-state patrol has the second and third.
 # ⛔ Do not shorten this list from memory — the imports decide it, not this
 # comment, and the patrol's own adopt list was wrong for months in exactly that
 # way, which installed a dead sweeper that failed before its first predicate.
@@ -392,132 +393,9 @@ jobs:
           AWS_REQUEST_CHECKSUM_CALCULATION: when_required
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
-        run: |
-          set -euo pipefail
-
-          if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ] \
-             || [ -z "${R2_ACCOUNT_ID:-}" ] || [ -z "${R2_BUCKET:-}" ]; then
-            echo "status=skipped — no R2 credentials configured in this repository" >> "$GITHUB_OUTPUT"
-            echo "::notice::R2 upload skipped: R2_ACCOUNT_ID, R2_BUCKET, R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY are not all set as repository secrets; this run is archived on the board-archive branch only."
-            exit 0
-          fi
-
-          endpoint="https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
-          mirror="s3://${R2_BUCKET}/objectstack/board/"
-
-          # The SOURCE is the snapshot directory, NOT the worktree root that
-          # contains it. The snapshot above is written to `archive/board`, so
-          # syncing `archive/` would map `archive/board/X` onto the `mirror`
-          # prefix as `objectstack/board/` + `board/X` — one segment deeper
-          # than the prefix on the line above says the mirror is, and visible
-          # only from the bucket side. Syncing `archive/board/` maps
-          # `archive/board/X` to `objectstack/board/X`, which is the layout a
-          # restore driven from the documented path looks for.
-          #
-          # `--delete` is kept and needs no migration step of its own: the
-          # stale `objectstack/board/board/` tree is inside this sync target
-          # and has no local counterpart, so the first run after this change
-          # removes it. ⛔ The target is never widened to `objectstack/` to
-          # achieve the same mapping — that would put `objectstack/snapshots/`
-          # inside a `--delete` target and eat the daily tarballs, the failure
-          # the comment above already warns about.
-          #
-          # No `.git` filter is needed here: `archive/` is a linked worktree,
-          # so its `.git` is a FILE at `archive/.git`, which is outside this
-          # source (filters match paths relative to the source directory).
-          #
-          # mtimes first: see "Only changed records are uploaded" above. The
-          # history is walked newest-first, so the first time a path appears
-          # is the last commit that touched it; a path whose newest commit
-          # deleted it has no file and is skipped. `-z` keeps every byte of a
-          # path intact. A truncated history errs in the safe direction only:
-          # its oldest commit looks like the one that created every file older
-          # than it, which stamps those files NEWER than their real last
-          # change, so they are uploaded again, and no stale object is ever
-          # skipped.
-          #
-          # The script is written to a file rather than fed through a heredoc
-          # inside the command substitution, which keeps bash's parser out of
-          # the backticks and quotes it contains.
-          cat > "$RUNNER_TEMP/archive-mtimes.cjs" <<'JS'
-          const { execFileSync } = require('node:child_process');
-          const { utimesSync } = require('node:fs');
-          const { join } = require('node:path');
-          const git = (...args) =>
-            execFileSync('git', ['-C', 'archive', ...args], { encoding: 'utf8', maxBuffer: 1 << 30 });
-          const log = git('log', '--no-renames', '--name-only', '-z', '--format=%x01%ct', 'HEAD', '--', 'board');
-          const seen = new Set();
-          let time = NaN;
-          let stamped = 0;
-          for (const token of log.split('\0')) {
-            if (token.startsWith('\x01')) { time = Number(token.slice(1)); continue; }
-            const path = token.replace(/^\n/, '');
-            if (!path || seen.has(path)) continue;
-            seen.add(path);
-            if (!Number.isInteger(time)) throw new Error(`no commit time read before ${path}`);
-            try {
-              utimesSync(join('archive', path), time, time);
-              stamped += 1;
-            } catch (e) {
-              if (e.code !== 'ENOENT') throw e;
-            }
-          }
-          const tracked = git('ls-files', '-z', '--', 'board').split('\0').filter(Boolean).length;
-          if (stamped !== tracked) throw new Error(`stamped ${stamped} file(s) but the archive tracks ${tracked}`);
-          const commits = git('rev-list', '--count', 'HEAD').trim();
-          console.log(`${stamped} file(s) stamped from ${commits} commit(s)`);
-          JS
-          if mtimes=$(node "$RUNNER_TEMP/archive-mtimes.cjs" 2>&1); then
-            # The last line only: the status line below goes into
-            # $GITHUB_OUTPUT, where a second line would break its format.
-            mtime_note="mtimes from history: ${mtimes##*$'\n'}"
-            echo "${mtime_note}"
-          else
-            printf '%s\n' "$mtimes" >&2
-            echo "::warning::Could not set the archive's mtimes from its git history (output above), so this sync re-uploads every object. The copy stays complete, but every file costs a Class A operation."
-            mtime_note="FULL re-upload, mtimes not restored"
-          fi
-
-          # No pipe between the command and `$?` — see the snapshot step.
-          set +e
-          aws s3 sync archive/board/ "$mirror" \
-            --endpoint-url "$endpoint" \
-            --delete --no-progress \
-            > "$RUNNER_TEMP/r2-sync.log" 2>&1
-          code=$?
-          set -e
-          if [ "$code" != "0" ]; then
-            cat "$RUNNER_TEMP/r2-sync.log" >&2
-            echo "status=FAILED — aws s3 sync exited $code" >> "$GITHUB_OUTPUT"
-            echo "::error::aws s3 sync to R2 exited $code. This run IS archived on board-archive; the out-of-GitHub copy is now behind and every later run will stay behind until this is fixed."
-            exit 1
-          fi
-          # One line per object moved. With the mtimes restored above, a run
-          # moves the records that changed since the last upload; a run that
-          # fell back (or the first one configured) moves the whole board, so
-          # the log is truncated here and the counts below are taken over all
-          # of it.
-          transfers=$(wc -l < "$RUNNER_TEMP/r2-sync.log")
-          head -n 50 "$RUNNER_TEMP/r2-sync.log"
-          if [ "$transfers" -gt 50 ]; then
-            echo "... and $((transfers - 50)) further transfer line(s), not printed."
-          fi
-          uploaded=$(grep -c '^upload:' "$RUNNER_TEMP/r2-sync.log" || true)
-          deleted=$(grep -c '^delete:' "$RUNNER_TEMP/r2-sync.log" || true)
-
-          day=$(date -u +%Y-%m-%d)
-          tarball="s3://${R2_BUCKET}/objectstack/snapshots/${day}.tar.gz"
-          if aws s3 ls "$tarball" --endpoint-url "$endpoint" > /dev/null 2>&1; then
-            tarred="already written for ${day}"
-          else
-            tar -czf "$RUNNER_TEMP/${day}.tar.gz" --exclude=.git -C archive .
-            aws s3 cp "$RUNNER_TEMP/${day}.tar.gz" "$tarball" \
-              --endpoint-url "$endpoint" --no-progress
-            tarred="written for ${day}"
-          fi
-
-          echo "status=synced ${uploaded} object(s), deleted ${deleted} (${mtime_note}); daily tarball ${tarred}" >> "$GITHUB_OUTPUT"
-          echo "R2: synced ${uploaded} object(s), deleted ${deleted} (${mtime_note}); daily tarball ${tarred}"
+        # The body lives in scripts/ci/board-snapshot-r2-upload.sh (#26086); its
+        # offline self-test is scripts/ci/board-snapshot-r2-upload.selftest.sh.
+        run: bash scripts/ci/board-snapshot-r2-upload.sh
 
       - name: Publish the run to the summary
         if: always()
 
@@ -3473,6 +3473,38 @@ jobs:
           node scripts/ci/scheduled-full-run.mjs --self-test
           node scripts/ci/scheduled-full-run.mjs --check-concurrency
 
+      # Workflow step bodies that moved out of inline `run:` / `github-script`
+      # blocks into scripts/ci/ (#26086). Each step fires only on an event no
+      # pull request produces (a red scheduled run, a red nightly on main), so
+      # its module's --self-test is the one place it runs before it fires.
+      # Offline doubles; sub-second each. A collector, so one red self-test
+      # does not hide the others (#10814).
+      - name: Moved workflow step bodies self-test
+        id: moved-workflow-step-bodies-self-test
+        continue-on-error: true
+        run: |
+          failed=""
+          run_self_test() {
+            echo "-- $*"
+            if "$@"; then
+              echo "PASS  $*"
+            else
+              echo "FAIL  $*"
+              failed="${failed}  $*"$'\n'
+            fi
+            return 0
+          }
+          run_self_test node scripts/ci/scheduled-full-run-card.mjs --self-test
+          run_self_test node scripts/ci/nightly-tiers-card.mjs --self-test
+          run_self_test bash scripts/ci/board-snapshot-r2-upload.selftest.sh
+          if [ -n "$failed" ]; then
+            echo ""
+            echo "Moved workflow step bodies self-tests — the following FAILED:"
+            printf "%s" "$failed"
+            exit 1
+          fi
+          echo "Moved workflow step bodies self-tests — all three ran and passed"
+
       # Gate-family selection self-test (#16496). The "Select the gate families
       # this run pays for" step at the top of this job is a thin call into
       # scripts/ci/select-gate-families.sh, and its `merge_group` branch cannot
 
@@ -161,127 +161,10 @@ jobs:
           retries: 3
           retry-exempt-status-codes: 400,401,404,422
           script: |
-            const mod = await import(`${process.env.GITHUB_WORKSPACE}/scripts/ci/scheduled-full-run.mjs`);
-            const { owner, repo } = context.repo;
-            const run = context.payload.workflow_run;
-
-            const identity = mod.cardIdentity(run.name);
-            const runUrl = run.html_url;
-
-            // The previous GREEN scheduled run of THIS workflow. `status:
-            // 'success'` is the filter that matters: a cancelled or a red
-            // earlier run is not a point the tree was known good at, so a range
-            // measured from one would name commits that were already suspect.
-            let previousGreen = null;
-            let commits = [];
-            let compareUrl = null;
-            let commitsTruncated = false;
-            let rangeNote = null;
-            try {
-              const previous = await github.rest.actions.listWorkflowRuns({
-                owner, repo,
-                workflow_id: run.workflow_id,
-                event: 'schedule',
-                branch: 'main',
-                status: 'success',
-                per_page: 1,
-              });
-              const hit = previous.data.workflow_runs?.[0];
-              if (hit) previousGreen = { run_id: hit.id, head_sha: hit.head_sha };
-              else rangeNote = 'No previous GREEN `schedule` run of this workflow is in the API window — either this is the first one, or every scheduled run in the window was red.';
-            } catch (error) {
-              rangeNote = `The previous-green lookup failed (${error.message}).`;
-            }
-
-            if (previousGreen) {
-              try {
-                const cmp = await github.rest.repos.compareCommitsWithBasehead({
-                  owner, repo,
-                  basehead: `${previousGreen.head_sha}...${run.head_sha}`,
-                });
-                commits = (cmp.data.commits ?? []).map((c) => ({
-                  sha: c.sha,
-                  title: String(c.commit?.message ?? '').split('\n')[0],
-                }));
-                compareUrl = cmp.data.html_url ?? null;
-                // The compare endpoint caps at 250 commits. Saying so beats
-                // presenting a truncated list as the whole hour.
-                commitsTruncated = (cmp.data.total_commits ?? commits.length) > commits.length;
-              } catch (error) {
-                // ⛔ Do NOT fall through to "nothing landed": that string is the
-                // FLAKE reading, and a failed lookup is not evidence of an
-                // empty range. Drop the range entirely and say why.
-                previousGreen = null;
-                rangeNote = `The commit range could not be read (${error.message}).`;
-              }
-            }
-
-            const body = mod.renderBody({
-              identity,
-              runUrl,
-              headSha: run.head_sha,
-              conclusion: run.conclusion,
-              sweptAt: new Date().toISOString(),
-              previousGreen,
-              commits,
-              compareUrl,
-              commitsTruncated,
-              rangeNote,
-            });
-
-            // The DECISION is the module's, driven offline by its self-test
-            // against a mutable board (one red run files one card; the next
-            // refreshes it and files no second; a refresh of a card whose
-            // every blocker is a closed LOCAL card moves `pm:blocked` to
-            // `pm:queue`). What is left here is thin callbacks over the API.
-            const outcome = await mod.fileOrRefreshCard({
-              identity,
-              body,
-              ownerRepo: `${owner}/${repo}`,
-              perPage: 100,
-              maxPages: 10,
-              listPage: async (page) => {
-                const res = await github.rest.issues.listForRepo({
-                  owner, repo, state: 'open', sort: 'created', direction: 'asc', per_page: 100, page,
-                });
-                return res.data;
-              },
-              updateIssue: async ({ number, body: b }) => {
-                await github.rest.issues.update({ owner, repo, issue_number: number, body: b });
-              },
-              createIssue: async ({ title, body: b, labels }) => {
-                // Additive on create; ⛔ nothing here ever replaces a whole
-                // label set (`check:whole-set-label-write` refuses that verb).
-                const res = await github.rest.issues.create({ owner, repo, title, body: b, labels });
-                return { number: res.data.number };
-              },
-              // Read only for a card carrying `pm:blocked`.
-              listComments: async ({ number, page, perPage }) => {
-                const res = await github.rest.issues.listComments({
-                  owner, repo, issue_number: number, per_page: perPage, page,
-                });
-                return res.data;
-              },
-              getIssue: async ({ repo: target, number }) => {
-                const [targetOwner, targetRepo] = target.split('/');
-                const res = await github.rest.issues.get({ owner: targetOwner, repo: targetRepo, issue_number: number });
-                return { state: res.data.state, closed_at: res.data.closed_at };
-              },
-              // The swap: an additive POST and ONE remove by name.
-              addLabels: async ({ number, labels }) => {
-                await github.rest.issues.addLabels({ owner, repo, issue_number: number, labels });
-              },
-              removeLabel: async ({ number, name }) => {
-                await github.rest.issues.removeLabel({ owner, repo, issue_number: number, name });
-              },
-            });
-
-            core.info(`${outcome.action} ${identity.marker} card #${outcome.number} (${body.length} chars)`);
-            if (outcome.block) core.info(`block: ${outcome.blockSummary}`);
-            const moved = outcome.block === 'expired' ? ' (every blocker closed: pm:blocked moved to pm:queue)' : '';
-            core.notice(`${run.name} is red on the scheduled full run — card #${outcome.number} ${outcome.action}${moved}.`);
-            core.setOutput('action', outcome.action);
-            core.setOutput('number', String(outcome.number));
+            // The body lives in scripts/ci/scheduled-full-run-card.mjs (#26086), driven
+            // offline by its --self-test; this step hands it the same github/context/core.
+            const { fileCardStep } = await import(`${process.env.GITHUB_WORKSPACE}/scripts/ci/scheduled-full-run-card.mjs`);
+            await fileCardStep({ github, context, core });
 
       - name: Publish the verdict to the run summary
         # always(): when the step above threw — a refused scan, a rate limit —