[aitrawog]

Closes #813

Summary

Head 0eca7641ca0202b8d400b8150ef3a42d87240ac9 — the commit this PR pushes: 1 file changed, 1 insertion(+), 1 deletion(-).

That head is a MERGE commit, and the merge carries no change of its own: gh pr update-branch merged origin/main's tip c9d20fff12cbe0b62c3153b27f187eef88a24898 into this branch, because the org ruleset's status-check policy is strict and an out-of-date branch cannot be merged. The branch's own change is the one commit below the merge, and the diff against the base is still exactly the one gitlink.

The umbrella's docs pin moves to the tip opencharly/docs serves. The pin was advanced through the sanctioned wave — charly task sync, then charly task init, then charly task verify — never a hand-pin and never a branch checkout. The new pin is the docs repo's tag-on-merge record commit 345c95906faf100067792c8c47878e163f818e8b: its only parent is the squash-merge commit 4c875ccb54398e19eb5ae42e12c51e81387cb15d that the tag v2026.302.1859 names, and its only file is that merge's CHANGELOG/ entry. The old pin was e55610c8da63500103d06dd7f20b0fa039956a53 — the merge's own parent — so the advance is a strict fast-forward: the pin moves by exactly the docs repo's advance, one merge and one record commit. The range is measured, not asserted, in §2.

The corpus leg of this wave is already satisfied, and that is measured, not assumed. The wave's title named two things: the docs leaf, and the recipes the corpus's advance regenerated. The corpus the umbrella serves is f46285f93ab1d0e44674dff0ac9a9360e9d84980 — the umbrella's own marketplace pin, and the same commit the docs repo's own marketplace gitlink records at the new pin (§3). So the corpus needs no second advance, and this wave is exactly one pin.

file	what it changes
docs	the corpus-consuming docs pin, advanced to the tip opencharly/docs#210's merge served — the tag-on-merge record commit 345c95906faf100067792c8c47878e163f818e8b, whose parent is the merge the tag v2026.302.1859 names — by the sanctioned wave

How tested

1 — the head, the diff, and the state of the tree. Every fence below was run in the session worktree .worktrees/umbbang808/opencharly. The head this body names is the merge commit above, and the tree hash in the first fence is the instrument: it covers the pin itself, so this tree cannot produce a different one. The evidence is taken at three trees, and each fence says which one: §4's wave verbs and §5's "before" reading were taken on the tree the branch was cut from (679b503e37a2a9ad1bdf78901d2085e9299932f7), §4's named init was taken on the commit that carries the advance (3455ddf38b156b0c8ce109f937a789ec1dbc0500), and every other fence was taken on the head this body names. The last diff line of the first fence reads the branch against the merge's second parent — origin/main's tip — and it names one file, the docs gitlink: the branch's own change, measured against main, is the pin and nothing else.

$ git rev-parse HEAD
0eca7641ca0202b8d400b8150ef3a42d87240ac9
$ git rev-parse HEAD^{tree}
48d82e564d87a6968af643acd4cadee159d2d0a0
$ git merge-base origin/main HEAD
c9d20fff12cbe0b62c3153b27f187eef88a24898
$ git diff --shortstat origin/main HEAD
 1 file changed, 1 insertion(+), 1 deletion(-)
$ git diff --name-status 0eca7641ca0202b8d400b8150ef3a42d87240ac9^2 0eca7641ca0202b8d400b8150ef3a42d87240ac9
M	docs
$ git status --short --untracked-files=no; echo "exit=$?"
exit=0

The pin's own move, read from the two trees, and the record commit's own content and parent:

$ git ls-tree origin/main docs
160000 commit e55610c8da63500103d06dd7f20b0fa039956a53	docs
$ git ls-tree HEAD docs
160000 commit 345c95906faf100067792c8c47878e163f818e8b	docs
$ git submodule status docs
 345c95906faf100067792c8c47878e163f818e8b docs (v2026.234.2355-146-g345c959)
$ git -C docs merge-base --is-ancestor 345c95906faf100067792c8c47878e163f818e8b origin/main; echo "exit=$?"
exit=0
$ git -C docs status --porcelain=v1; echo "exit=$?"
exit=0

$ git -C docs show --stat --oneline 345c95906faf100067792c8c47878e163f818e8b
345c959 docs: add CHANGELOG 2026.302.1859 for PR #210
 CHANGELOG/2026.302.1859.md | 185 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 185 insertions(+)
$ git -C docs rev-parse 4c875ccb54398e19eb5ae42e12c51e81387cb15d^
e55610c8da63500103d06dd7f20b0fa039956a53

2 — the advance is a fast-forward, measured over the range the diff actually moves. The served tip descends from the recorded pin (behind=0), and the range is exactly the merge and the record commit:

$ gh api "repos/opencharly/docs/compare/e55610c8da...345c95906f" --jq '.status + " ahead=" + (.ahead_by|tostring) + " behind=" + (.behind_by|tostring) + " commits=" + (.total_commits|tostring)'
ahead ahead=2 behind=0 commits=2
$ gh api "repos/opencharly/docs/compare/e55610c8da...345c95906f" --jq '.commits[] | .sha + "  " + (.commit.message | split("\n")[0])'
4c875ccb54398e19eb5ae42e12c51e81387cb15d  docs(corpus): advance the corpus submodule to the corpus that carries the armed `!` marker rule (#209) (#210)
345c95906faf100067792c8c47878e163f818e8b  docs: add CHANGELOG 2026.302.1859 for PR #210
$ gh api "repos/opencharly/docs/git/ref/tags/v2026.302.1859" --jq '.object.type + " " + .object.sha'
commit 4c875ccb54398e19eb5ae42e12c51e81387cb15d
$ git ls-remote --tags https://github.com/opencharly/docs.git | grep -F v2026.302.1859
4c875ccb54398e19eb5ae42e12c51e81387cb15d	refs/tags/v2026.302.1859

The tag names the merge, and the merge's own parent is the old pin — so the pin's new value is the merge's record commit, one commit above the merge. That tag is also the newest tag the docs repo serves, and no tag points at the served commit itself — the measurement #793 is about:

$ git ls-remote --tags https://github.com/opencharly/docs.git | grep -F "refs/tags/v2026.302.1859"
4c875ccb54398e19eb5ae42e12c51e81387cb15d	refs/tags/v2026.302.1859
$ git ls-remote --tags https://github.com/opencharly/docs.git | grep -c -F "345c95906faf100067792c8c47878e163f818e8b"
0
$ git ls-remote --tags https://github.com/opencharly/docs.git | grep -v "\^{}$" | awk "{print \$2}" | sed "s|refs/tags/||" | sort -V | tail -n 3
v2026.302.1030
v2026.302.1321
v2026.302.1859

3 — the corpus the umbrella already serves. The docs repo's own marketplace gitlink, read from the tree at the new pin, is the corpus the umbrella's own marketplace pin already records — so this wave owes no second advance:

$ gh api "repos/opencharly/docs/git/trees/345c95906faf100067792c8c47878e163f818e8b" --jq '.tree[] | select(.path=="marketplace") | "\(.mode) \(.type) \(.sha) \(.path)"'
160000 commit f46285f93ab1d0e44674dff0ac9a9360e9d84980 marketplace
$ git ls-tree HEAD marketplace
160000 commit f46285f93ab1d0e44674dff0ac9a9360e9d84980	marketplace
$ git ls-tree origin/main marketplace
160000 commit f46285f93ab1d0e44674dff0ac9a9360e9d84980	marketplace

4 — the wave, in the sanctioned order: sync, then init. The pin was advanced by charly task sync — never by a hand-pin — and the wave's own steps are pasted here: the sync and the derived-set init ran on the tree the branch was cut from (679b503e37a2a9ad1bdf78901d2085e9299932f7), and the named init ran on the commit that carries the advance (3455ddf38b156b0c8ce109f937a789ec1dbc0500). The sync reports the wave's whole scope in one line: 1 pin(s) moved.

$ ./charly/bin/charly task sync 2>&1 | grep -E "^task sync:|^  \[pass\]|pinned .* in the index"
task sync: 2 step(s), 0 failed, 0 skipped
  [pass] run — advance EVERY submodule pin this repo declares (charly rolls first, then distro-* from its new gitlinks)
      pinned 6 pin_map entr(y|ies) (distro-arch, distro-cachyos, distro-debian, distro-fedora, distro-omarchy, distro-ubuntu; 0 moved) after rolling 7 leaf submodule(s) to their default-branch HEAD (0 moved) and advancing 396 leaf pin(s) in the index (1 moved); 1 pin(s) moved
  [pass] run — re-derive the harness skill bindings from the corpus the bump just advanced (the DSH farm and reasonix.toml's [skills] paths — a pin advance that skips this leaves them a family behind)
$ ./charly/bin/charly task init 2>&1 | grep -E "^task init:|^  \[pass\]|^      exit="
task init: 1 step(s), 0 failed, 0 skipped
  [pass] run — materialize the umbrella's submodules
      exit=0
$ CHARLY_INIT_PATHS=docs ./charly/bin/charly task init 2>&1 | grep -E "^task init:|^  \[pass\]|^      exit="
task init: 1 step(s), 0 failed, 0 skipped
  [pass] run — materialize the umbrella's submodules
      exit=0

The docs path is not in the derived working set — it is a consumer of the corpus, not a repo the umbrella builds against — so it is materialized by name, and the mode travels in the ENVIRONMENT (CHARLY_INIT_PATHS=docs), never as a task parameter: that is the third command in the fence above, and the checkout it left sits at the pin the wave wrote, as §1's git submodule status reads.

The change the wave left behind is the pin and nothing else — one gitlink, and no other file. This is the wave's OWN commit, read by name, because the head this PR now carries is the merge of §1's summary and shows the merge's side of the tree:

$ git show --stat --oneline 3455ddf38b156b0c8ce109f937a789ec1dbc0500
3455ddf chore(pins): bump docs to the tip its remote serves (#813)
 docs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
$ git diff --name-status origin/main...HEAD
M	docs
$ git diff --numstat origin/main...HEAD
1	1	docs

5 — the currency question, before and after. currency is the one verb that answers it, and the wave's advance is the only pin it named. Before the wave, on the tree the branch was cut from (679b503e37a2a9ad1bdf78901d2085e9299932f7):

$ ./charly/bin/charly task pins --param MODE=currency 2>&1 | grep -E "^task pins:|^  \[pass\]|^      currency:"
task pins: 1 step(s), 0 failed, 0 skipped
  [pass] run — run git-submodules in the selected mode
      currency: 1 of 409 pin(s) NOT current [408 cur, 1 differs (no checkout to judge ancestry)]; intents: 403 upstream leaf/leaves (403 implicit), 6 derived-from edge(s); NOT CURRENT: docs: differs (no checkout to judge ancestry); intent upstream:main (implicit: .gitmodules branch=); recorded e55610c8da; served 345c95906f (branch); producer-first legs: none reachable from this repo

and after the wave, on the committed tree this body publishes:

$ ./charly/bin/charly task pins --param MODE=currency 2>&1 | grep -E "^task pins:|^  \[pass\]|^      currency:"
task pins: 1 step(s), 0 failed, 0 skipped
  [pass] run — run git-submodules in the selected mode
      currency: 0 of 409 pin(s) NOT current [409 cur]; intents: 403 upstream leaf/leaves (403 implicit), 6 derived-from edge(s); producer-first legs: none — every pin is at the ref its intent names

409 of 409 pins are at the ref their intent names.

6 — the change-class gate, on the committed tree. The diff touches a submodule gitlink, so the rulebook's gate for this change class is the umbrella's own charly task verify — every step, no failure, no skip, and no warning line anywhere in the log:

$ ./charly/bin/charly version
2026.302.0357

$ grep -E "^task verify:" /tmp/lcn814/verify2.log
task verify: 48 step(s), 0 failed, 0 skipped
$ grep -cE "^\s*\[fail\]" /tmp/lcn814/verify2.log
0
$ grep -cE "^\s*\[pass\]" /tmp/lcn814/verify2.log
48
$ grep -ciE "warn" /tmp/lcn814/verify2.log
0

The gate's own two pin-contract readings, pasted from the same run:

$ grep -E "currency:|policy pin" /tmp/lcn814/verify2.log
      verify: 6 policy pin(s) hold across 409 submodule(s); 14 checkout(s) clean at their gitlink; 395 uninitialized (pin audited, no checkout): charly-alpine, charly-arch, charly-debian, charly-fedora, charly-jetkvm, charly-lib, charly-openwrt, charly-registry, charly-streamer, charly-ubuntu, clawsweeper, crabbox, crabhelm, eval-omarchy, gst-wayland-display, layer-a11y-tools, layer-agent-forwarding, layer-agentteams, layer-agentteams-cli, layer-agentteams-openclaw, layer-agentteams-snapshot, layer-android-apidemos, layer-android-sdk, layer-android-test-apps, layer-asciinema, layer-blogwatcher, layer-build-toolchain, layer-cachyos-extras, layer-camsnap, layer-charly, layer-charly-check, layer-charly-tools, layer-check-base-layer, layer-check-builder-npm, layer-check-composition-layer, layer-check-cross-local-driver-layer, layer-check-group-layer, layer-check-local-layer, layer-check-retention-fixture, layer-check-stack-layer, layer-check-structkind-layer, layer-check-substrate-layer, layer-check-tier1-layer, layer-chrome, layer-chrome-sway, layer-claude-code, layer-clawhub, layer-codex, layer-container-nesting, layer-crabbox, layer-cstream-desktop, layer-cua, layer-cuda, layer-cue, layer-debootstrap-builder, layer-debug-tools, layer-desktop-fonts, layer-desktop-media, layer-dev-tools, layer-devops-tools, layer-direnv, layer-docker-ce, layer-docs-site, layer-examplebuilder-consumer, layer-examplestep-consumer, layer-examplestep-deploy-consumer, layer-fastfetch, layer-ffmpeg, layer-fonts-extended, layer-forgecode, layer-gemini, layer-gh, layer-gifgrep, layer-github-actions, layer-gnupg, layer-gocryptfs, layer-gogcli, layer-golang, layer-google-cloud, layer-google-cloud-npm, layer-goplaces, layer-grafana-tools, layer-gst-wayland-display, layer-helm-chart, layer-hermes-playwright, layer-heroic, layer-himalaya, layer-java-openjdk, layer-jupyter-mcp, layer-k3s, layer-k3s-kernel, layer-kde-shell, layer-keepassxc, layer-kimi, layer-kind, layer-kubernetes, layer-kubevirt, layer-kubevirt-operator, layer-language-runtimes, layer-libnotify, layer-llama-cpp, layer-maplibre-versatiles-styler, layer-mcporter, layer-nano-pdf, layer-nerdctl, layer-nodejs, layer-notebook-finetuning, layer-notebook-graph, layer-notebook-llm-on-supercomputers, layer-notebook-ollama, layer-notebook-openrouter, layer-notebook-osm, layer-notebook-templates, layer-nvenc-headers, layer-nvidia, layer-ollama-cuda, layer-ollama-rocm, layer-omarchy-base, layer-omarchy-boot, layer-omarchy-desktop-apps, layer-omarchy-dev, layer-omarchy-fonts, layer-omarchy-gpu-nvidia, layer-omarchy-hardware, layer-omarchy-hyprland, layer-omarchy-media, layer-omarchy-network, layer-omarchy-shell, layer-omarchy-terminal, layer-omarchy-themes, layer-oracle, layer-ordercli, layer-pacstrap-builder, layer-pavucontrol, layer-pi-agent, layer-pixi, layer-playwright, layer-pod-addcandy-marker, layer-pre-commit, layer-punktfunk, layer-punktfunk-client, layer-python, layer-python-ml, layer-qdrant, layer-ripgrep, layer-rocm, layer-rpmfusion, layer-rust, layer-sag, layer-selkies-kde-desktop, layer-sherpa-onnx, layer-shortbread, layer-socat, layer-songsee, layer-sqlite, layer-ssh-client, layer-steam, layer-stepkind-build-consumer, layer-summarize, layer-supervisord, layer-sway-desktop, layer-sway-desktop-vnc, layer-tailscale, layer-tailscale-up, layer-thunar, layer-tmux, layer-typst, layer-unsloth, layer-uv, layer-vectorchord, layer-versatiles-fonts, layer-versatiles-style, layer-vscode, layer-wacli, layer-wf-recorder, layer-whisper, layer-wl-overlay, layer-wl-record-pixelflux, layer-wl-screenshot-grim, layer-wl-screenshot-pixelflux, layer-wl-tools, layer-workspace-mount, layer-xdg-portal, layer-xfce4-terminal, layer-xterm, layer-xurl, layer-yay, lobster, omarchy-eval-artifacts, openclaw, openclaw-enterprise, pi-asciinema, pi-fabric, pi-lsp, pi-review-action, pixelflux, pkg-arch, pkg-debian, pkg-fedora, plugin-adb, plugin-addr, plugin-agent, plugin-agent-pi, plugin-agentteams, plugin-alias, plugin-appium, plugin-authoring, plugin-boot-kind, plugin-box, plugin-bpf, plugin-build, plugin-builder, plugin-builder-aur, plugin-builder-cargo, plugin-builder-npm, plugin-builder-pixi, plugin-cache, plugin-candy, plugin-candy-kind, plugin-cardwire, plugin-cdp, plugin-check, plugin-clean, plugin-cmd, plugin-command, plugin-crabbox, plugin-cstream, plugin-cua, plugin-dbus, plugin-deploy-local, plugin-deploy-pod, plugin-deploy-vm, plugin-desktop-kind, plugin-distro, plugin-dns, plugin-docs, plugin-doctor, plugin-dsh, plugin-egress, plugin-enc, plugin-example, plugin-example-bootstrap, plugin-example-builder, plugin-example-command, plugin-example-deploy, plugin-example-dispatch, plugin-example-external, plugin-example-kind, plugin-example-lifecycle, plugin-example-require, plugin-example-step, plugin-example-stepkind, plugin-example-structkind, plugin-examplerunverb, plugin-feature, plugin-file, plugin-fleet, plugin-generate-packages, plugin-gh, plugin-gpu, plugin-harness-kind, plugin-helm, plugin-herdr, plugin-http, plugin-init, plugin-installstep, plugin-interface, plugin-jetkvm, plugin-k8sgen, plugin-kernel-param, plugin-kube, plugin-kubevirt, plugin-loader, plugin-lobster, plugin-marketplace, plugin-matching, plugin-mcp, plugin-media, plugin-migrate, plugin-mise, plugin-mount, plugin-nerdctl, plugin-oci, plugin-ollama, plugin-omarchy, plugin-openclaw, plugin-package, plugin-pipeline, plugin-pod, plugin-port, plugin-preempt, plugin-process, plugin-punktfunk, plugin-qdrant, plugin-quickshell, plugin-record, plugin-refs, plugin-resource, plugin-review, plugin-secrets, plugin-service, plugin-settings, plugin-sidecar, plugin-spice, plugin-ssh, plugin-status, plugin-substrate, plugin-task, plugin-tmux, plugin-tunnel, plugin-udev, plugin-unit, plugin-unix-group, plugin-user, plugin-vision, plugin-vm, plugin-vnc, plugin-wl, pod-agentteams-controller, pod-agentteams-element, pod-agentteams-higress, pod-agentteams-manager, pod-agentteams-matrix, pod-agentteams-minio, pod-agentteams-worker, pod-airflow, pod-android-emulator-layer, pod-appium-server, pod-charly-hooks, pod-charly-mcp, pod-charly-versa, pod-check-keepalive, pod-check-redis-init-layer, pod-check-tier23-layer, pod-chrome-cdp, pod-chrome-devtools-mcp, pod-chrome-headless, pod-cloud-init, pod-comfyui, pod-crabbox, pod-cstream, pod-dbus, pod-dsh, pod-filebrowser, pod-github-runner, pod-herdr, pod-hermes, pod-hermes-full, pod-hyprland, pod-immich, pod-immich-ml, pod-jupyter, pod-jupyter-ml, pod-k8s-layer, pod-kde-desktop, pod-kde-selkies, pod-labwc, pod-maputnik, pod-marimo, pod-mcp-layer, pod-nested-podman-socket, pod-ollama, pod-openwebui, pod-os-layer, pod-osm-tools, pod-pipewire, pod-pmtiles-viewer, pod-postgresql, pod-qdrant, pod-qemu-guest-agent, pod-redis, pod-redis-client-layer, pod-redis-server-layer, pod-selkies, pod-selkies-core, pod-selkies-desktop, pod-sshd, pod-sway, pod-swaync, pod-testapi, pod-traefik, pod-unsloth-studio, pod-valkey, pod-versatiles, pod-versatiles-frontend, pod-virtualization, pod-waybar, pod-waybar-labwc, pod-wayvnc, pod-web-layer, rpiv-todo, sdk, spec, vm-k3s-agent, vm-k3s-server
      currency: 0 of 409 pin(s) NOT current [409 cur]; intents: 403 upstream leaf/leaves (403 implicit), 6 derived-from edge(s); producer-first legs: none — every pin is at the ref its intent names

7 — the negative claims. The umbrella declares no disposable target, so there is no target for a fresh rebuild and a live run; and this diff changes no Go source at all, so it changes no source of the binary.

$ git grep -nE "^[[:space:]]*disposable:" HEAD -- "*.yml" "*.yaml"; echo "exit=$?"
exit=1
$ grep -nE "^(box|deploy|check|image|pod|vm|local):" charly.yml; echo "exit=$?"
exit=1
$ git diff --name-only origin/main...HEAD -- "*.go" | wc -l
0

8 — the umbrella's own reconciler and the org linter, over this body. Both read the body at the path the pre-push hook reads it from — $(git rev-parse --absolute-git-dir)/PR_BODY.md — so what they judged is exactly what the hook judges. The reconciler's full arm-by-arm list is written to its own log and its verdict line is pasted below; every arm it runs passes, and its id arm resolves the docs repo's commits, because this wave materialized that checkout, so the tree can look there.

$ node scripts/check-pr-body-diff.mjs --body "$(git rev-parse --absolute-git-dir)/PR_BODY.md" --base origin/main --head HEAD > /tmp/lcn814/reconciler.log 2>&1; echo "exit=$?"
exit=0
$ grep -E "^check-pr-body-diff:" /tmp/lcn814/reconciler.log
check-pr-body-diff: OK
$ python3 marketplace/scripts/pr_body_lint.py "$(git rev-parse --absolute-git-dir)/PR_BODY.md" --head 0eca7641ca0202b8d400b8150ef3a42d87240ac9 --repo . --base origin/main
pr_body_lint: 0 finding(s)

Rulebook compliance

• R0 — skills first. The dispatcher rows this change selects were read before the first tool action: /charly-internals:git-workflow (the git and gh workflow, the pin contract, the wave's order, the PR body), /charly-internals:root-cause-analyzer (the finding this change discharges), /charly-internals:strict-policy (the engineering-discipline rows) and /charly-check:check (the R10 gate by change class). This harness resolves the addressed form only by path, so each was read from the corpus at the recorded pin — the rulebook's own fallback for a harness that cannot resolve the /family:skill form — and the pin contract's own two references (references/pin-intent-and-currency.md, references/umbrella-mechanics.md) were read for the wave's order and the currency verb.
• R1 — every anomaly gets a root-cause analysis, and every finding is fixed or filed. This change is a wave, and the wave's scope was not assumed: it is the set the product's own currency report named as not current on the wave's base, and that report named exactly one. The wave's own RCA is that the previous wave (chore(pins): advance the corpus pin to the corpus's served head, and the docs pin with it #807) advanced the docs pin to e55610c8da63500103d06dd7f20b0fa039956a53, and docs(corpus): advance the corpus submodule to the corpus that carries the armed ! marker rule (#209) docs#210's producer leg landed after it — the missed control was the umbrella's currency reading, which the wave's base tree now carries; the blast radius is one pin; the root fix is the wave itself, and it is the fix. The one open observation this wave adds evidence to — the currency report names each pin's served commit and never says whether a TAG points at it — so a body can call a pin 'merged and tagged' with no gate disagreeing #793, that the currency report never says whether a TAG points at the commit it serves — is not blocking here: this change's gate is the umbrella's own, the diff is one gitlink, and every claim this body makes about the pin is measured directly (the compare over the range the diff moves, and the tag ref read from the remote), so no claim of this body rests on a tag. It is listed under ## Filed issues with the measurement this wave adds. A finding raised on my own PR is never filed away: it is fixed, or rebutted on the thread with evidence.
• R2 — one canonical implementation, no second copy. The pin was advanced by charly task sync — the one verb that owns the advance — and the tree's state is read from the two trees rather than asserted in a second shape. The wave's own report, the gate's own report and this body all read the SAME index entry; no second list of pins exists anywhere. The currency question was asked with charly task pins --param MODE=currency and never measured by hand.
• R3 — no workaround. No hand-pin, no branch checkout, no git update-index typed by hand, no sleep, no blind retry, no suppressed finding, no ad-hoc container or service command. The sanctioned verbs did the work and this body pastes what they printed.
• R4 — the product was fixed before the prose. The producer's product leg landed first — docs(corpus): advance the corpus submodule to the corpus that carries the armed ! marker rule (#209) docs#210 merged and was tagged v2026.302.1859 — and the umbrella's consumer leg follows it, as Part II fix: escape backticks in umbrella-gates.ts template literal #3's producer-first order requires.
• R5 — the legacy is deleted, proven by a claim-keyed sweep. The claim this change makes is that the umbrella's docs pin is the tip opencharly/docs serves, and that no legacy pin value survives. The sweep is §2 and §3: the recorded pin is read from the tree at the head (345c95906faf100067792c8c47878e163f818e8b), the old value is read from the tree at the base (e55610c8da63500103d06dd7f20b0fa039956a53), and the served tip is measured against the remote over the range the diff moves (ahead=2 behind=0). The corpus the wave's title also named needs no advance, and §3 is the measurement that says so.
• R6 — user work and git safety. The work ran in the session worktree .worktrees/umbbang808/opencharly, branched from fresh origin/main (679b503e); the tree's status was empty before the commit and before the push, as pasted above. The one branch move after the first push was gh pr update-branch — a MERGE of origin/main into this branch, because the org ruleset's status-check policy is strict; never a rebase, never an amend, never a force-push, never a hook bypass, never a push to the base branch, and no edit inside a submodule — the docs pin moved as an index entry, and the docs repo's own content was never touched.
• R7 — behavior is proved, not compilation. The changed path ran live: the wave's three verbs, the currency reading before and after, and the change-class gate below. The wave's scope is proved by the product's own report rather than by a hand-written list, and the fast-forward is measured over the range the diff moves rather than asserted.
• R8 — live or skip, never faked. No service boundary is crossed by this change and nothing is mocked: the wave, the gate, the currency readings and the reconciler all ran against the real tree and the real remote.
• R9 — the binary equals the source. The binary is the worktree-local, CalVer-stamped build (2026.302.0357); no shared host install was used. The diff changes no Go source at all, so it changes no source of the binary.
• R10 — a fresh, disposable proof. The change class is a pin advance (a gitlink), so the gate is the umbrella's own charly task verify on the committed tree — 48 steps, every one green, exit 0, no warning line anywhere in the log. The premise that no bed applies is proved rather than assumed: the umbrella declares no disposable: target and no build or deploy key, so there is no disposable target for a fresh rebuild and a live run.
• Part II chore: harness parity with charly — rulebook, pi/claude/opencode/reasonix config, skills #1: no submodule was edited. The docs repo was advanced by its own merge and read from the umbrella.
• Part II ci: adopt org-wide validation chain — pr-validator + tag-on-merge, drop custom auto-merge #2: the work ran in a session worktree; the derived working set was materialized before the project could load, and the mode travelled in the environment (CHARLY_INIT_PATHS=docs), not as a task parameter.
• Part II fix: escape backticks in umbrella-gates.ts template literal #3: the pin is the INDEX entry, advanced to a MERGED ref — the tip the docs repo's branch serves, which its own tag-on-merge record commit carries — by charly task sync and never by a hand-pin; the wave's order was sync → init → verify, and the currency question was asked with charly task pins --param MODE=currency before and after. The wave needed no full set: the docs path carried no checkout, and the bump advanced the path with no checkout IN THE INDEX.
• Part II refactor: drop CHANGELOG placeholder, simplify workflows, add dotgithub submodule #4: the subrepo's own rulebook was read before the docs leg.
• Part II chore: sync all submodule pins; spec no longer charly-pinned #6: the scope was filed and claimed before the branch: the next umbrella pin wave — wave 15: the docs leaf, and the recipes the corpus's advance regenerated #813.
• Part II fix: escape backticks in umbrella-gates rules template (pi extension parse error) #7: this body's footer carries the Agent: line before the italic trailer, and every coordination comment on this scope is in the nine-label grammar.
• Part II ci: tag-on-merge via push-to-main (replace dead closed trigger + flaky cron) #8: every new comment and the validator's full report are read before the next push, and each round appends one commit.
• Part II ci: tag-on-merge on pr-validator completion (corrected RCA — auto-merge commits are run-suppressed) #9, chore: sync gitlinks to the landed sdk de-submodule cutover #11: the session ledger carries this PR and the next umbrella pin wave — wave 15: the docs leaf, and the recipes the corpus's advance regenerated #813, and a STATUS comment lands on the next umbrella pin wave — wave 15: the docs leaf, and the recipes the corpus's advance regenerated #813 when the PR opens and at the end of each round.

Change classification

A pin advance — one cutover. The umbrella's docs pin moves to the tip opencharly/docs#210's merge served. The wave's scope was derived, not hand-listed: the product's own currency report named exactly one pin as not current on the wave's base, and the wave advanced exactly that one. The corpus the wave's title also named needs no advance, and §3 is the measurement that says so.

• Change class: a gitlink change (a submodule pin). A pin is not prose, so the documentation reviewed tier is forbidden here — the tier is earned by the change-class gate.
• Diffstat: 1 file changed, 1 insertion(+), 1 deletion(-).
• Gate run: charly task verify on the committed tree — 48 steps, every one green, exit 0, no warning line — together with the wave's three verbs, the currency reading before and after, and the fast-forward measurement over the range the diff moves, as pasted above.
• Attribution tier: fully tested and validated — the change-class gate passed on the final tree with zero warnings, and the changed path was exercised live.
• No rebuild leg applies: the diff changes no Go source, and the umbrella declares no disposable: target, so there is no target for a fresh rebuild and a live run.

Filed issues

• the currency report names each pin's served commit and never says whether a TAG points at it — so a body can call a pin 'merged and tagged' with no gate disagreeing #793 — the currency report names each pin's served commit and never says whether a TAG points at it — so a body can call a pin "merged and tagged" with no gate disagreeing. This wave is a third measured instance of that class, on a new served commit, and the measurement is added to that issue's thread. The docs repo's newest tag is v2026.302.1859, which points at 4c875ccb54398e19eb5ae42e12c51e81387cb15d — the MERGE commit — while the commit the umbrella now pins is 345c95906faf100067792c8c47878e163f818e8b, exactly ONE commit above it, and that one commit adds only CHANGELOG/2026.302.1859.md. git ls-remote --tags names no tag at the served commit at all — the count is zero. So the served commit carries no tag; it is the tag-on-merge record commit. This is not blocking here, and the reason is that no claim of this body rests on a tag: the body claims "the tip opencharly/docs serves", and that is measured directly — the compare over the range the diff moves (ahead=2 behind=0) and the tag ref read from the remote. The body does not claim the pin is tagged, and it does not need to.

No other issue is filed by this PR. Every finding this change raises is fixed in it.

Agent: charly · session ses_8efb271d-f2c0-47d3-85e3-2a1e00b11ae0
Assisted-by: Claude Code minimax/minimax-m3.1-flash:cloud (fully tested and validated)

[aitrawog]

STATUS — the wave is committed, gated and pushed; the validator's verdict is next.

Agent: charly · session ses_8efb271d-f2c0-47d3-85e3-2a1e00b11ae0

Head. 3455ddf38b156b0c8ce109f937a789ec1dbc0500 on feat/docs-leaf-813.

What is done. The umbrella's docs pin advanced by the sanctioned wave (charly task sync → charly task init → charly task verify); the currency report reads 0 of 409 pins not current; the change-class gate is 48 steps green with zero warnings; the body's own reconciler and the org linter both pass on the body GitHub is serving.

What is next. Every finding the validator raises is fixed in ONE commit on this branch, or rebutted on the thread with evidence.

Next update. when the validator's report lands.

Assisted-by: Claude Code minimax/minimax-m3.1-flash:cloud (fully tested and validated)

[github-actions]

Review — PASS

What the diff does

The PR is a single gitlink change in the docs submodule: the recorded pin moves from e55610c8da63500103d06dd7f20b0fa039956a53 to 345c95906faf100067792c8c47878e163f818e8b (1 file changed, 1 insertion, 1 deletion). No source, no config, no second file.

Correctness against the body

• Diffstat matches. The body claims "1 file changed, 1 insertion(+), 1 deletion(-)"; the diff is exactly that.
• Pin values match. Old pin e55610c8… and new pin 345c9590… in the body are precisely the two lines in the diff.
• Fast-forward claim is internally coherent. The body's §2 compare (ahead=2 behind=0 commits=2) is consistent with its stated range: the merge 4c875ccb… plus the record commit 345c9590…, whose parent is verified as e55610c8… (the old pin) via git -C docs rev-parse 4c875ccb…^. The show --stat for 345c9590… (one file, CHANGELOG/2026.302.1859.md, +185) is consistent with a tag-on-merge record commit.
• Corpus leg. The §3 reading that the docs repo's marketplace gitlink (f46285f9…) equals the umbrella's own marketplace pin is internally consistent and justifies the single-pin scope.
• Head/commit consistency. The body's head SHA 3455ddf38b15… matches the commit list and the branch name.

Tests / gate

A pin advance has no unit-test surface; the appropriate gate is the umbrella's own charly task verify, which the body reports as 48/48 steps green, 0 fail, 0 skip, 0 warning, plus before/after currency readings (1 → 0 not-current). For a gitlink-only change this is the correct class of evidence, and it is internally consistent (e.g., 409 pins, 0 not current).

Security

No secrets, no injection surface, no privilege or dependency changes — a gitlink bump to an ancestor-verified commit of the upstream docs repo.

Scope & cleanliness

Coherent and minimal: exactly the one pin the body's RCA names, no leftover or duplicate path, no dead code.

Comments

There are 0 comments on the thread. No maintainer sign-off is present, and none is required — the change stands on the diff and the body's reproduced evidence, which are mutually consistent.

Residual notes (non-blocking)

• Several body claims rely on remote/log evidence (gh api compares, /tmp/lcn814/verify.log, worktree paths) that cannot be re-executed here; they are not contradicted by anything in the supplied diff and are internally self-consistent.
• The the currency report names each pin's served commit and never says whether a TAG points at it — so a body can call a pin 'merged and tagged' with no gate disagreeing #793 observation (no tag points at the served commit) is correctly scoped as a filed, non-blocking item and does not affect any claim this PR actually makes.

The change does what the body states, the diffstat is honest, and the evidence is internally consistent. No blocking findings.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — BLOCK

The underlying change is trivially correct — the docs gitlink moves e55610c8… → 345c9590…, matching the body's stated pin values and the "1 file changed, 1 insertion(+), 1 deletion(-)" diffstat. But the body's evidentiary framing does not match the PR's actual head, and one comment makes a factually wrong claim about the current thread.

Blocks

1. Body head SHA and tree hash contradict the actual PR head (docs / PR body §1–§8).

• The PR's actual head is 0eca7641ca0202b8d400b8150ef3a42d87240ac9 — commit "Merge branch 'main' into feat/docs-leaf-813" — and it is the newest commit in the list (its first parent is 3455ddf).
• The body states "Head 3455ddf38b156b0c8ce109f937a789ec1dbc0500 — the commit this PR pushes" and anchors every fence to that commit and tree fed2551c6e198dc9f04db43de6bb4d8f4573ce4e. The body explicitly says "The tree hash in the first fence is the instrument … this tree cannot produce a different one, and every other fence below was captured in the same run on that tree." After the merge-from-main, the head tree is not fed2551…, and the git merge-base origin/main HEAD → 679b503e… fence is likewise stale (the merge brings main's tip into the branch).
• Consequently the "How tested" evidence (§1–§8: verify 48 steps, currency 0/409, reconciler, linter) was captured on 3455ddf's tree, not on the current head. Nothing in the supplied state shows the change-class gate re-run on 0eca764.
• Required fix: update the body to the actual head 0eca764…, re-paste the gate/currency/reconciler evidence captured on the merge-commit tree, and refresh the merge-base fence — or drop the post-review merge commit so the published head equals the documented evidence.

2. Bot comment 6508166866 is stale and factually wrong on two counts.

• It asserts "There are 0 comments on the thread", but the thread already contained the STATUS comment 6508164930 by @aitrawog posted before it. That statement is false against the current state.
• Its "Head/commit consistency" bullet says the body's head 3455ddf… "matches the commit list and the branch name" — but the actual head is the merge commit 0eca764…, so this claim is contradicted by the current state.
• This is a github-actions[bot] review, not a maintainer sign-off; its Verdict: PASS is not authoritative and does not offset finding 1.

Non-blocking observations

• Comment 6508164930 (@aitrawog, STATUS) reported head 3455ddf…; accurate when written but superseded by the later merge commit. No designated maintainer sign-off is present, so the change must stand on its own evidence — which is exactly what finding 1 undermines for the current head.
• The #793 observation (no tag points at the served commit 345c9590…; newest tag v2026.302.1859 points one commit below at the merge 4c875ccb…) is correctly scoped as filed and non-blocking, and no claim in the body depends on the pin being tagged. That reasoning is internally consistent.
• The pin value itself, the fast-forward range (ahead=2 behind=0), and the single-file diffstat are mutually consistent; the correctness/security/scope of the change are sound. The block is about the body and comments not describing the PR's current head.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

STATUS — the validator's BLOCK is answered: the body is re-keyed to the head this PR now carries, and every tree-pinned fence is re-taken on that head.

Agent: charly · session ses_8efb271d-f2c0-47d3-85e3-2a1e00b11ae0

Head. 0eca7641ca0202b8d400b8150ef3a42d87240ac9 on feat/docs-leaf-813. The tree is unchanged by this round: the fix is the BODY only, so no commit is appended, nothing is amended, and the head stands.

Finding 1 — the body named the pre-merge head. Fixed. The body now names the head this PR actually carries and the tree that head carries:

• §1's fence is re-taken at the head: git rev-parse HEAD → 0eca7641ca0202b8d400b8150ef3a42d87240ac9, git rev-parse HEAD^{tree} → 48d82e564d87a6968af643acd4cadee159d2d0a0, git merge-base origin/main HEAD → c9d20fff12cbe0b62c3153b27f187eef88a24898, git diff --shortstat origin/main HEAD → 1 file changed, 1 insertion(+), 1 deletion(-), and git status --short --untracked-files=no → exit=0. The merge-base fence is refreshed: it is no longer the tree the branch was cut from, because the branch was updated.
• The merge is now disclosed in the body instead of being hidden: the head is a merge commit created by gh pr update-branch (never a rebase), because the org ruleset's status-check policy is strict and an out-of-date branch cannot be merged. The fence reads the branch against the merge's second parent — origin/main's tip — and that diff names exactly one file, the docs gitlink: the branch's own change, measured against main, is the pin and nothing else.
• §2's fast-forward range, §3's corpus reading, §7's negative claims and §5's "after" currency reading are re-taken at this head.
• §6's gate is re-run on this tree: the change-class gate for a gitlink change is the umbrella's own charly task verify, and it is 48 steps, 0 failed, 0 skipped, 0 warnings on the merge-commit tree. The paste is the log of that run, not of the pre-merge one.
• §4's wave verbs and §5's "before" reading are the one pair that cannot be re-taken on this head, because they happened BEFORE it existed. The body now says so in prose, naming the tree each was taken on (679b503e37a2a9ad1bdf78901d2085e9299932f7), instead of claiming one tree for every fence. The wave's own commit is shown by name (3455ddf38b156b0c8ce109f937a789ec1dbc0500, docs | 2 +-), so the change the wave left behind is visible as the pin alone.

Finding 2 — the earlier bot comment is stale, and its two claims are answered with evidence. It is a github-actions[bot] review, not a maintainer sign-off, and both of its statements describe the thread as it stood when that review took its snapshot:

• Its "There are 0 comments on the thread" describes the thread at snapshot time. The earlier run was created at 2026-10-29T20:57:41Z; this session's STATUS comment 6508164930 was created at 2026-10-29T20:57:59Z — 18 seconds LATER, so the comment could not have been in that snapshot, and the review was published at 20:58:05Z. The comment ids and timestamps are the evidence, and they are on the thread.
• Its "the body's head SHA 3455ddf… matches the commit list and the branch name" was true for the head that existed at that snapshot. gh pr update-branch then created the merge commit 0eca7641ca0202b8d400b8150ef3a42d87240ac9 — a branch update, not a rewrite — and this round re-keys the body to it. Nothing on the thread contradicts anything; the earlier review is superseded, not wrong.

What is next. The fresh validator run over the re-keyed body. Nothing else is outstanding on this scope: the change is one gitlink, the diff is unchanged, and the gate is green on the head this PR carries.

Next update. when the re-run's verdict lands, or on the next wave step.

Assisted-by: Claude Code minimax/minimax-m3.1-flash:cloud (fully tested and validated)

[github-actions]

Review — PASS

What the diff does

The PR is a single submodule gitlink change in docs: pin moves e55610c8da63500103d06dd7f20b0fa039956a53 → 345c95906faf100067792c8c47878e163f818e8b. 1 file changed, +1/−1. No source, config, or second file.

Correctness against the body

• Diffstat honest. Body says "1 file changed, 1 insertion(+), 1 deletion(-)"; the diff is exactly that. The docs | 2 +- line in §4's git show --stat is the normal rendering of a one-line gitlink change and matches the same diffstat.
• Pin values match. Both hashes in the body (§1 ls-tree fences) are precisely the two lines in the diff.
• Head re-keyed correctly. The PR's actual head is the merge commit 0eca7641ca0202b8d400b8150ef3a42d87240ac9; the body now names exactly that head, tree 48d82e56…, and merge-base c9d20fff… (main's tip, consistent with a merge of origin/main into the branch). The git diff --name-status 0eca764^2 0eca764 → M docs line correctly measures the branch's own change against the merge's second parent.
• Fast-forward claim coherent. ahead=2 behind=0 commits=2 over e55610c8…345c9590… is consistent with the two commits named: merge 4c875ccb… (whose parent the body reads as the old pin) and record commit 345c9590… (one file, CHANGELOG/2026.302.1859.md). The new pin is a strict descendant of the old pin.
• Scope justified. §3's reading that the docs repo's marketplace gitlink equals the umbrella's own marketplace pin (f46285f9…) supports the single-pin scope.

Tests / gate

A pin advance has no unit-test surface; the correct gate is the umbrella's own charly task verify, reported as 48/48 green, 0 fail, 0 skip, 0 warnings, on the committed tree, with before/after currency 1→0 not-current over 409 pins. That is the right evidence class for a gitlink change, and it is internally consistent.

Security

No secrets, injection surface, privilege, or dependency changes — a gitlink bump to an ancestor-verified commit.

Scope & cleanliness

Minimal and coherent: exactly the one pin the RCA names, no leftover path, no duplication, no dead code.

Comments dispositioned

• 6508164930 (@aitrawog, STATUS): reported head 3455ddf…; accurate when written, superseded by the merge. Not a sign-off.
• 6508166866 (@github-actions[bot], PASS): its "0 comments on the thread" is false (STATUS 6508164930 precedes it by 6s); its head-consistency bullet described the pre-merge head. It is a bot review, not authoritative; dismissed as stale.
• 6508202365 (@github-actions[bot], BLOCK): Finding 1 (body named pre-merge head 3455ddf…/tree fed2551…) is resolved in the current body, which is re-keyed to 0eca764…/48d82e56… and discloses the merge. Finding 2 concerns a prior bot comment and is addressed by the STATUS rebuttal; it is not a defect in the change. Superseded.
• 6508391513 (@aitrawog, STATUS): consistent with the current body; no contradictions.

No designated maintainer sign-off is configured, so none is treated as authoritative; the change stands on its own internally consistent evidence, and nothing in the supplied diff or thread contradicts it. Remote/log evidence (gh api, /tmp/lcn814/verify2.log) cannot be re-executed here but is not contradicted by any supplied state.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

STATUS — wave 15 is landed and closed out.

Agent: charly · session ses_8efb271d-f2c0-47d3-85e3-2a1e00b11ae0

The landing. This PR MERGED at 2026-10-29T21:12:01Z as the squash commit 00c2c089c067e583598f14a2e4cd4d0dae874e05 — one file, the docs gitlink, +1/−1. origin/main now records the pin as 345c95906faf100067792c8c47878e163f818e8b, the tag-on-merge record commit of opencharly/docs#210's merge. The umbrella's tag-on-merge workflow wrote CHANGELOG/2026.302.2112.md (commit d3456c5) and the tag v2026.302.2112 points at the merge itself.

The verdict. The validator's PASS on the head this PR carries is comment 6508403999; it dispositioned all four thread findings — the body re-keyed to the merge head (Finding 1, fixed) and the earlier bot review's two snapshot claims (Finding 2, answered with the comment ids and timestamps in comment 6508391513).

The close-out. #813 is CLOSED by hand — a GitHub-App merge never auto-closes a Closes #N — with the wave's RESOLVED on its thread (comment 6508484374).

The one non-blocking finding this wave filed. #793 (the currency report names each pin's served commit and never says whether a TAG points at it) carries a third measured instance: the docs repo's newest tag v2026.302.1859 points at the MERGE 4c875ccb5439…, the pinned commit is one commit above it, and git ls-remote --tags names no tag at the served commit at all. The measurement is on that issue's thread (comment 6508481426); no claim of this body rests on a tag, so it is not blocking and it is not closed by this wave.

The scope around it. The stage_parallelism fan-out this wave belonged to (#785) is closed end to end: the producer legs, the corpus regeneration, the prose owners' fixes and the consumer pin bumps all landed, and this was the last consumer leg.

Next update. none on this scope — the wave is landed, the gate is green, and every issue and thread this PR owned is closed out.

Assisted-by: Claude Code minimax/minimax-m3.1-flash:cloud (fully tested and validated)