Merge main into arch-refactor/648-resolve-org-once

Resolve get.rs and rollback.rs conflicts with #1027: keep this PR's
shared telemetry handle and take main's {code, message} error codes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: claude

.github/workflows/bun-compatibility.yml

@@ -130,11 +130,11 @@ jobs:
 
       - name: Cache cargo
         # save-if keeps writes on main so open PRs do not churn the repo's
-        # 10 GiB cache budget; rust-cache's automatic key already includes
-        # the runner OS, so one logical key serves all three builds.
+        # 10 GiB cache budget. Share dependency artifacts with the other
+        # debug=0 E2E builders on the same runner image.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: bun-native
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Build CLI
@@ -390,7 +390,7 @@ jobs:
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           # Keep binaries linked against different glibc versions separate.
-          key: bun-native-binary-${{ matrix.os }}
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Setup Python

.github/workflows/ci.yml

@@ -110,7 +110,7 @@ jobs:
       - run: rustup show
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: composer-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:

.github/workflows/composer-compatibility.yml

@@ -55,7 +55,7 @@ jobs:
       - run: rustup show
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: go-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

.github/workflows/go-compatibility.yml

@@ -21,8 +21,8 @@ name: Gradle patch compatibility
 #
 # 9.8.0 is the current release on services.gradle.org (re-checked
 # 2026-10-02; bump it here and in ci.yml together when a newer 9.x ships).
-# 7.6.6 is the last 7.x. Every distribution is sha256-checked against
-# services.gradle.org before use.
+# 7.6.6 is the last 7.x. scripts/install-gradle.sh pins every
+# distribution's sha256; add the new version's digest there too.
 #
 # Each mode runs its suites' `#[ignore]` tests by name prefix (the contract
 # scripts/ci-e2e-bundle.py --check enforces): agent = e2e_gradle_discovery_build
@@ -44,6 +44,7 @@ on:
     paths:
       - '.github/workflows/gradle-compatibility.yml'
       - 'scripts/ci-e2e-bundle.py'
+      - 'scripts/install-gradle.sh'
       - 'Cargo.lock'
       - 'Cargo.toml'
       - 'crates/*/Cargo.toml'
@@ -125,7 +126,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: gradle-compat
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Check the Gradle test-name prefixes
@@ -277,16 +278,8 @@ jobs:
         shell: bash
         env:
           GRADLE_VERSION: ${{ matrix.gradle }}
-        run: |
-          # Download flags: see the Maven step above.
-          url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
-          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
-          unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
-          launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
-          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi
-          echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV"
+        # Pinned digest, GitHub-release origin: see the script.
+        run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV"
 
       - name: Run the ${{ matrix.mode }} suites
         shell: bash

.github/workflows/gradle-compatibility.yml

@@ -0,0 +1,44 @@
+name: Merge queue fail-fast
+
+# Cancels a merge-queue entry's CI run the moment one of its jobs fails, so
+# `ci-ok` (if: always()) reports failure in seconds instead of after the
+# slowest e2e leg, and the queue evicts the entry and rebuilds the ones
+# behind it ~40 minutes sooner. See scripts/merge-queue-fail-fast.py.
+# Not a required check; it never fails.
+
+on:
+  merge_group:
+    types: [checks_requested]
+
+permissions: {}
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    timeout-minutes: 110
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        # Run the canceller as it is on the base branch, never the queued
+        # PRs' copy: this job holds an actions:write token, so executing
+        # merge-group-head bytes would hand that token to any queued PR.
+        with:
+          ref: ${{ github.event.merge_group.base_sha }}
+          persist-credentials: false
+          sparse-checkout: scripts/merge-queue-fail-fast.py
+          sparse-checkout-cone-mode: false
+
+      - name: Cancel the CI run on its first failed job
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.merge_group.head_sha }}
+        # Until this workflow lands, the base branch has no canceller to run.
+        run: |
+          if [ ! -f scripts/merge-queue-fail-fast.py ]; then
+            echo "scripts/merge-queue-fail-fast.py is not on the base branch yet; nothing to watch."
+            exit 0
+          fi
+          python3 -B scripts/merge-queue-fail-fast.py

.github/workflows/merge-queue-fail-fast.yml

@@ -78,7 +78,7 @@ jobs:
           persist-credentials: false
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: pdm-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Compile the CLI and the capstone once
         run: |

.github/workflows/pdm-compatibility.yml

@@ -68,7 +68,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: pipenv-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Install uv
         uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0

.github/workflows/pipenv-compatibility.yml

@@ -70,7 +70,7 @@ jobs:
           persist-credentials: false
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: poetry-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo build --locked -p socket-patch-cli
       - uses: ./.github/actions/upload-artifact

.github/workflows/poetry-compatibility.yml

@@ -283,7 +283,7 @@ jobs:
       - run: rustup show
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: sbt-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with: