Promote Develop: Lint Tasks Through docker_lint, Resync Re-Level, Review Paging, Owner-First Secret Stems - #4070

## Summary

- **Page every review (#4002).** `gql` now replaces a windowed `reviews`
read with every page of the connection, oldest first, through
`page_reviews` in `scripts/pr_review_payload.py`. `page_files` moved
there too, so `scripts/pr_review.py` shrinks. Thread replies can no
longer push a round behind the window and cost a head its coverage. The
digest's `REVIEWS TRUNCATED` block and the `+` on section counts are
retired, along with the window sentences in `scripts/README.md`.
`reviews_truncated` stays as a fail-closed gate condition. It is vacuous
on a paged read, so a "truncated review history" condition in rule text
still reads true.
- **Read Copilot's "The review identified these findings" list
(#3875).** The spelling is now a findings-list label in
`scripts/reviewers/copilot.json`. An item naming a path and no line
counts as carried only by a thread on that path that repeats two or more
of its longer words, two thirds of them at least. One thread carries one
item. Any other item counts under `FINDINGS WITH NO THREAD` and prints
with its key.
- **Count a `Review notes` table on its `[P\d]` markers (#3893).** A
notes cell counts each marker it holds, and a `Reviewed.` row counts
nothing. Where the cells name more findings than any list, they print
under the no-thread block.
- **Retire the Copilot coverage-marker ask (#798, option 1).** This
removes `.github/copilot-instructions.md` item 5 and the
`fleet-code-review` marker paragraph, along with the pointer to the
marker in `pr-review-conduct`, and drops `findings=` from the regex. The
reader for `reviewed`/`changed` stays.
- **#1071 is re-checked and not closed.** Under the current gate, a
constructed billing-failure body still reads as a non-refusal round,
which holds the head as `shapes=HELD`. The issue is narrowed in a
comment to what remains.

Every behavior has a test that fails on `develop`, and each fixture is
constructed.

Closes on promotion: #4002, #3875, #3893, #798

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Summary

Settles three issues about how a repository is stood up and brought back
into line with the hub.

**#3922, resync grouping.** The instruction set and the carried Skills
tree now land in one pull request, with the
`.github/copilot-instructions.md` skill paths. Every other drift class
takes its own pull request, branched from `develop` only after that one
merges. `RESYNC.md` section 6 and the `resync-a-repo` skill state both
rules, and `AUDIT.md` section 10 and `audit-a-repo` point at the
grouping.

**#3920, standup ambiguities.**

1. A repository whose `main` holds content `develop` lacks re-levels
`develop` before the line-ending conversion (`STANDUP.md` 1A,
`RESYNC.md` section 3).
2. A partly stood-up repository takes `STANDUP.md`'s pull request shape
while its instruction set is partial.
3. A downstream `AUDIT.md` is the short, repository-scoped form.
4. Any existing tag is published history, so the version floor is the
next minor above it.
5. `eda.validation` now points at the `WORKFLOW.md` `eda` row.
6. `AUDIT.md` section 8 states the report path uses the repository name
in lowercase.
7. Both stale `placeholders` lists are gone from `spec/files.json`, and
`spec/validate.py` now requires each declared placeholder to occur in
its canonical file.
8. Discharged by #3938.

**#3938, line-ending reference.** KiCad leaves the LF-native example and
becomes the example of a text-mode tool format, pinned `text !eol` with
`end_of_line = unset`. STEP models are the worked example of a
byte-preserved file type. The check #3938 asked for came out yes: that
pair has to unset all four properties, because `end_of_line = unset`
alone leaves the other three applied from `[*]`.

`spec/fidelity-model.md` and the `copilot-instructions-keeper` skill
each cited the dropped lists, so each loses that statement.
`docs/eol-lf-rollout.md` now names the re-level ahead of the conversion.

## Local pass findings left as they stand

Every earlier listed finding is fixed on this branch. Local passes
raised these on text this change wrote, and each is declined on the
evidence given.

- `RESYNC.md:74`, `introduced`, declined: a path the re-level brought in
and the conversion then rewrites can conflict at the first promotion.
`branching-and-release-model`
`references/branch-protection-and-promotion.md` already governs an
EOL-only promotion conflict, including the content check and the
throwaway branch off `main`, so this procedure does not restate it.
- `spec/validate.py` `placeholder_errors`, `introduced`, declined: its
missing-canonical error can repeat `main()`'s reference check. It stays,
because `main()` checks a reference only for `intent` and `verbatim`
entries, so a presence entry with a renamed reference would otherwise
pass silently. Its bare `is_file()` stays too, since the manifest is
maintainer-authored and the gate only reads the file.
- `line-endings.md` KiCad list, `introduced`, declined: a pass suggested
`.kicad_wks` also writes in text mode, from memory rather than a source
read. The list is the set #3938's source trace established, and an
unverified addition is not made here.
- `tests/test_spec_validate.py` `test_the_shipped_manifest_is_clean`,
`introduced`, declined: it asserts nothing today because no entry
declares a list. It follows the same file's
`test_the_shipped_registry_is_clean` convention, and it fails the moment
a stale list returns.

## Pre-existing findings, not filed

- `RESYNC.md` section 3, `pre-existing`: a repository already on LF
whose `main` holds content `develop` lacks gets no re-level instruction.
The maintainer's answer to #3920 item 1 scopes the re-level to the
conversion case.
- `RESYNC.md` section 3 step 1, `pre-existing`: "nothing else has
written to the tree yet" is false where `CLAUDE.md` is written first and
left uncommitted, since `carry.py apply-sections` then refuses the dirty
target.

## Verification

- `tests/test_spec_validate.py` passes, 8 new cases included. Disabling
the token check fails one and removing the call site fails another.
- `spec/validate.py`, `scripts/build_dist.py --check`, and
`scripts/prose_lint.py --diff` are clean.
- A scratch repository confirmed `text !eol` checks out `i/lf w/crlf`
under `core.eol=crlf` and `core.autocrlf=true`, and stays clean after a
CRLF rewrite.
- A scratch repository confirmed `git merge --squash origin/main`
carries `main`'s delta with no merge commit.
- An EditorConfig resolve confirmed the three properties `end_of_line =
unset` leaves behind.

Closes on promotion: #3922, #3920, #3938

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…th in Editor and Tasks (#4069)

## Summary

Answers #1147 and #4049.

Closes on promotion: #1147, #4049

### #1147: one rule for lint containers

Before this change, the four Docker Lint tasks in
`catalog/snippets/configs/vscode-tasks.json` and
`vscode-tasks-python.json` bound the live checkout, writable and with
networking, into `:latest` images. Each now runs `scripts/docker_lint.py
--linter <name>` through the carried `hub_fetch_run.py`. Each task
therefore gets the wrapper's snapshot of tracked and unignored files,
its read-only mount, and its disabled networking. The .NET snippet keeps
its Windows `py -3` override. The Python snippet keeps its `uv run
--no-project python` form.

`hub_fetch_run.py` changes in two ways:
- COMPANIONS gains `scripts/docker_lint.py`'s companions. One is
`scripts/local_review.py`, which the wrapper imports. The other is
`spec/git_env.py`, which `local_review.py` imports through a `sys.path`
entry computed from its own location.
- A script with companions now has `main`'s commit resolved, has every
file fetched from that commit, and prints the commit on stderr. So a
Lint task run names the hub commit it ran from, as "Hub-Hosted Tooling"
requires of a hub tool's result. The prose gate keeps its own provenance
variable. `repo_gate.py`, which the commit hook runs, still makes no
lookup.
- Each fetched file now keeps its hub-relative path inside the scratch
directory. The old flat layout put that `sys.path` entry at the parent
of the scratch directory, which is the shared temporary root. A
`spec/git_env.py` planted there would then be imported, and the
companion that should have been read would never be found.

`GOVERNANCE.md` "Running the Linters Locally" now says the four tasks
run the wrapper. `RESYNC.md` step 6 now names the Lint group rather than
lint-task images, and copies the current hook helper in the same commit.
Without that copy, a carrier's older helper fetches `docker_lint.py`
without its companions, and the import fails. `comment-and-doc-style`
loses two clauses that had nothing left to follow. One covered a
repository shipping no `HISTORY.md`, but every repository carries one
(`spec/files.json`). The other let a repository widen its own CI
spelling list, but that list belongs to the hub's reusable
`validate-task.yml`, which takes no spelling input. Both pointed at the
`Lint: Spelling` task's file list, which no longer exists. Its generated
copies are regenerated.

### A terminated Lint task no longer leaves a snapshot behind

Now that the tasks run the wrapper, cancelling one is an ordinary way
for a run to end. On Linux and macOS, closing the task's terminal sends
SIGHUP. `scripts/docker_lint.py` now handles it the way it already
handled SIGTERM, so the snapshot is removed. On Windows the process tree
is killed outright, and no handler runs. So each run now holds a lock on
an owner file beside its snapshot, `docker-lint-snapshot-<id>.owner`.
The run writes that file only after it takes the lock. At the start of
its execution phase, a later run removes a snapshot only when it can
lock the owner file and the file is not empty. The OS releases the lock
only when the holding process is gone, so a concurrent run's snapshot is
never removed. A process id would not prove that, because ids get
reused. A snapshot directory with no owner file, such as one left before
this change, is never touched. The sweep runs on every platform. A Linux
or macOS run killed with SIGKILL leaves its snapshot behind just as a
Windows run does.

### #4049: no literal path in "Editor and Tasks"

The sentence about the Python Environments extension now says "that
folder's `settings.json`". So the `dead-path` rule no longer reads a
path in it. As the maintainer answered, `hub_hosted` does not grow.

## Local Review Notes

Two local passes raised the same design point. I declined it. The import
closure of `docker_lint.py` is declared in each carrier's copy of
COMPANIONS, so a later hub-side import needs a re-copied helper. That
coupling is the design the maintainer chose on #1147 (option 1, "with
local_review.py added to hub_fetch_run.py's companions"). It is also how
the prose gate already pairs with `prose-gate.json`. The step 6 instance
it exposed is fixed above.

The third local pass found that commit attribution is keyed on the
script having companions. So `repo_gate.py`, behind `Lint: EOL` and the
commit hook's EOL check, still fetches bare `main` and names no commit.
I declined extending it here. Naming a commit there needs a lookup, and
`GOVERNANCE.md` "Running the Linters Locally" limits the commit hook's
network calls to the prose gate's single commit lookup. Printing `@main`
would name no commit, so it would not meet the rule either. The gap
predates this change, and it is listed below.

A later pass found that `remove_snapshot` passes
`shutil.rmtree(onexc=...)`, which needs Python 3.12. I declined it.
`host-tools.json` sets the fleet's `python3` floor at 3.13, and its
entry says "Neither is evidence that spec/ or scripts/ code should hedge
for anything older than 3.13". `scripts/local_review.py`, which this
same wrapper imports, already calls `rmtree(onexc=...)`.

## Pre-existing findings, not filed

- `catalog/snippets/hub_fetch_run.py` `main()`, the `repo_gate.py` route
(`Lint: EOL` and the commit hook's EOL check): the run names no hub
commit, contrary to `GOVERNANCE.md` "Hub-Hosted Tooling". Class:
`pre-existing`, contract drift.

## Verification

- `tests/test_hub_fetch_run.py` gains eight tests: two over the task
snippets, and six that run the hub's real `docker_lint.py --help` from
the scratch directory the helper builds. With the fix reverted, all
eight fail. Reverting only the commit pinning fails the six fetch tests.
Two mutations fail them separately: the flat layout fails the
planted-module test, and a missing `spec/git_env.py` companion fails
four.
- `tests/test_docker_lint.py` gains seven tests: the SIGHUP
registration, a sweep of an ended run's snapshot, a snapshot whose run
still holds its lock, an owner file not yet written, a snapshot with no
owner file, a clean run leaving nothing, and a cross-process run. That
last one is kept while alive and removed once killed. Reverting the
SIGHUP line fails the SIGHUP test, and disabling the sweep fails the
sweep test. The `msvcrt` branch runs in this repository's Windows
unit-test job.
- `test_hub_fetch_run` and `test_cli_usage` pass under the runner
`OPERATIONS.md` names.
- An end-to-end run with real uv and Docker used a constructed
repository holding a git-ignored file. The wrapper's
`editorconfig-checker` task staged only the tracked paths and passed.
- Dead-path reproduction: a constructed repository commits
`.vscode/settings.json` and then deletes it. `prose_lint.py` reports
`dead-path` on develop's "Editor and Tasks" text, and reports nothing on
this branch's text.
- `scripts/build_dist.py --check` reports the generated trees current.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>