Pin six existing CI jobs to Ubuntu 24.04

.github/workflows/axial-density-review.yml

@@ -12,8 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-python@v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11'
       - name: Exact algebra in both modes with semantic mutations
@@ -31,7 +31,7 @@ jobs:
             done
           done
           git rev-parse HEAD > "$RUNNER_TEMP/axial-evidence/checkout_commit.txt"
-      - uses: actions/upload-artifact@v7.0.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         if: always()
         with:
           name: axial-density-replay

.github/workflows/c026-reciprocal.yml

@@ -23,5 +23,8 @@ jobs:
         env:
           PYTHONDONTWRITEBYTECODE: '1'
         run: |
-          python -B -S -m unittest discover -s repairs/c026_reciprocal_20260927 -p 'test_*.py' -v
-          python -B -O -S -m unittest discover -s repairs/c026_reciprocal_20260927 -p 'test_*.py' -v
+          set -euo pipefail
+          python -B -S -m unittest discover -s repairs/c026_reciprocal_20260927 -p 'test_*.py' -v 2>&1 | tee "$RUNNER_TEMP/c026-normal.log"
+          grep -Eq '^Ran [1-9][0-9]* tests? in ' "$RUNNER_TEMP/c026-normal.log" || { echo "::error::C026 normal discovery collected 0 tests or returned no count"; exit 1; }
+          python -B -O -S -m unittest discover -s repairs/c026_reciprocal_20260927 -p 'test_*.py' -v 2>&1 | tee "$RUNNER_TEMP/c026-optimized.log"
+          grep -Eq '^Ran [1-9][0-9]* tests? in ' "$RUNNER_TEMP/c026-optimized.log" || { echo "::error::C026 optimized discovery collected 0 tests or returned no count"; exit 1; }

.github/workflows/c6-fourier-cutoff.yml

@@ -16,6 +16,12 @@ name: C6 Fourier-cutoff finite controls
     paths:
       - 'frontiers/c6_fourier_cutoff_20260929/**'
       - '.github/workflows/c6-fourier-cutoff.yml'
+      - 'imports/lifetime_parent_20260925/UNIFORM_MATRIX_CAP_AND_LIFETIME.md'
+      - 'frontiers/c6_factorial_moment_20260929/PROOF.md'
+      - 'frontiers/c6_sharpened_20260929/PROOF.md'
+      - 'frontiers/intermediate_window_20260928/PROOF.md'
+      - 'reviews/d5_reconciliation_20260929/RECONCILIATION.md'
+      - 'reviews/d5_punctured_pin_continuum_claude_20260929/REVIEW.md'
   workflow_dispatch:
 
 permissions:

.github/workflows/cap-i4-d3-adapter.yml

@@ -17,7 +17,7 @@ permissions:
   contents: read
 jobs:
   replay:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 8
     strategy:
       fail-fast: false

.github/workflows/cusp-second-order.yml

@@ -5,6 +5,7 @@ name: Cusp second-order exact controls
     paths:
       - 'frontiers/cusp_second_order_20261001/**'
       - '.github/workflows/cusp-second-order.yml'
+      - 'tests/test_cusp_workflow_protocol.py'
       # bound merged sources (consumed in SOURCES.json) and the pinned unmerged dependencies (#191, #198; verified by blob)
       - 'frontiers/remainder_vanishing_20260930/PROOF.md'
       - 'frontiers/remainder_rate_20260930/PROOF.md'
@@ -32,6 +33,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Cusp workflow protocol regressions
+        run: |
+          python -B -S -m unittest discover -s tests -p test_cusp_workflow_protocol.py -v
+          python -B -O -S -m unittest discover -s tests -p test_cusp_workflow_protocol.py -v
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -81,19 +86,33 @@ jobs:
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('consumed unmerged dependency differs from the pinned blob (rebind required): ' + entry['path'] + ' via ' + where)
               print(json.dumps({'consumed_unmerged_verified': entry['path'], 'git_blob': entry['git_blob'], 'via': where}))
+          # Complete immutable reports from the original five mutants, characterized
+          # in both modes at 11f9127f (run 37465152509/1). These are not exit-only
+          # expectations or reports generated by the current mutant as its own oracle.
+          contracts = {
+              'M1': (1536, '9302b83844a9c6d9a2b9f65bfc68ff9c96b7a1e610447b796bee130f08bd625b', 'C2 elder window'),
+              'M2': (1514, '0b55d471950c3a2dc4914d78ac6810ddffd4c903ae128e4ff0e2d333fe969852', 'C6 elder cusp integral'),
+              'M3': (1571, '72f2b370a2ff1a1202852e8eb328f7b3b86cb8df5fb520fdc20b69b325bbef25', 'C4 cusp limit field'),
+              'M4': (1604, '056b3738ae7319b50377c1f30c428e1f55ac5d331db890d30a81776c8507ae56', 'C3 fiber identity'),
+              'M5': (1456, '3e863170bff01721399a056d94f651427a064bfc86e032e9cfe39d54b218c963', 'C8 determinant derivative'),
+          }
+          if manifest['mutants'] != list(contracts):
+              raise ValueError('cusp mutant inventory differs from the complete ordered contract')
           script = str(root / 'cusp_check.py')
           expected = (root / 'RESULTS.json').read_bytes()
           for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
+              baseline = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600)
+              if baseline.stdout != expected or baseline.stderr:
+                  raise RuntimeError('baseline streams differ from RESULTS.json/empty stderr under ' + ' '.join(flags))
               for m in manifest['mutants']:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+                  result = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600)
+                  size, sha256, reason = contracts[m]
+                  if (result.returncode != 1 or result.stderr or len(result.stdout) != size
+                          or hashlib.sha256(result.stdout).hexdigest() != sha256):
+                      raise RuntimeError('mutant ' + m + ' did not emit its exact ' + reason + ' rejection report')
+              unknown = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600)
+              if unknown.returncode != 2 or unknown.stdout or unknown.stderr != b'unknown mutant label\n':
+                  raise RuntimeError('unknown mutant label did not emit the complete expected exit-2 diagnostic')
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/d2-two-mass-floors.yml

@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   two-mass-controls:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/d3-l4-anisotropic.yml

@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   d3-l4-replay:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       fail-fast: false

.github/workflows/downstream-gate.yml

@@ -18,7 +18,7 @@ jobs:
     outputs:
       checked_commit: ${{ steps.checks-identity.outputs.checked_commit }}
     name: downstream-replay
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
@@ -157,7 +157,7 @@ jobs:
     name: math-downstream-gates
     if: ${{ always() }}
     needs: [checks, formal]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/em-intermediate-elder.yml

@@ -0,0 +1,64 @@
+name: Lifetime note EM replay
+
+'on':
+  pull_request:
+    paths:
+      - 'frontiers/em_intermediate_elder_20261006/**'
+      - 'tests/test_em_intermediate_elder_replay_protocol.py'
+      - 'tests/test_em_intermediate_elder_replay_evidence.py'
+      - '.github/workflows/em-intermediate-elder.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  replay:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: ['-B -S', '-B -O -S']
+    name: replay (python ${{ matrix.mode }})
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11.16'
+      - name: Verify protocol, stored identities, extractions and all published controls
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        shell: bash
+        run: |
+          set -euo pipefail
+          out="$RUNNER_TEMP/qs-replay-evidence"
+          mkdir -p "$out/logs"
+          python ${{ matrix.mode }} -m unittest discover -s tests -p test_em_intermediate_elder_replay_protocol.py -v 2>&1 | tee "$out/logs/protocol.txt"
+          python ${{ matrix.mode }} -m unittest discover -s tests -p test_em_intermediate_elder_replay_evidence.py -v 2>&1 | tee "$out/logs/process-evidence-tests.txt"
+          QS_REPLAY_EVIDENCE_DIR="$out/children" python ${{ matrix.mode }} frontiers/em_intermediate_elder_20261006/replay.py 2>&1 | tee "$out/logs/replay.txt"
+          git diff --exit-code
+          test -z "$(git status --porcelain)"
+      - name: Preserve exact public sources and available execution logs
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          out="$RUNNER_TEMP/qs-replay-evidence"
+          mkdir -p "$out"
+          cp -a frontiers/em_intermediate_elder_20261006 "$out/packet"
+          cp tests/test_em_intermediate_elder_replay_protocol.py "$out/"
+          cp tests/test_em_intermediate_elder_replay_evidence.py "$out/"
+          cp .github/workflows/em-intermediate-elder.yml "$out/"
+          git rev-parse HEAD > "$out/tested_commit.txt"
+          printf '%s\n' '${{ matrix.mode }}' > "$out/mode.txt"
+          printf '%s\n' "$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT" > "$out/run.txt"
+      - name: Retain evidence on success or failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: qs-replay-${{ strategy.job-index }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/qs-replay-evidence/
+          if-no-files-found: error

.github/workflows/equal-height-mass.yml

@@ -5,6 +5,7 @@ name: Equal-height mass controls
     paths:
       - 'frontiers/equal_height_mass_value_20261001/**'
       - '.github/workflows/equal-height-mass.yml'
+      - 'tests/test_equal_height_workflow.py'
       # bound merged sources (consumed and cited_only in SOURCES.json)
       - 'frontiers/c7_zero_gap_limit_20260929/PROOF.md'
       - 'frontiers/three_fronts_20260924/LIFETIME_REMAINDER.md'
@@ -31,6 +32,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise complete output contracts in both modes
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          set -euo pipefail
+          python -B -S -m unittest discover -s tests -p test_equal_height_workflow.py -v
+          python -B -O -S -m unittest discover -s tests -p test_equal_height_workflow.py -v
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -58,19 +66,31 @@ jobs:
                   raise ValueError('merged source drifted: ' + entry['path'])
           if manifest.get('consumed_unmerged'):
               raise ValueError('this packet declares no unmerged dependency')
+          mutants = manifest.get('mutants')
+          if type(mutants) is not list or mutants != ['M1', 'M2', 'M3']:
+              raise RuntimeError('complete ordered M1-M3 inventory required')
+          # Fixed full reports measured from unchanged checker 92ba3cde in both modes.
+          # Byte identity is intentional; changed diagnostics need a reviewed rebind.
+          contracts = {
+              'M1': (933, 'b6f95f60a211e6abf9c5595fcc26ebd74ea5d3c6c5ade551e94ac1ce4e98952f'),
+              'M2': (938, '4cd2c6f39ed2c920d0fc69fb3a1826b9cec35465c3013d00996b4b26ce788c49'),
+              'M3': (935, 'ac69c631970c2b5f6b1cba6c9457b5601148d0ca7ea087cc012e2772ffd9fa09'),
+          }
           script = str(root / 'equal_height_mass.py')
           expected = (root / 'RESULTS.json').read_bytes()
           for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in manifest['mutants']:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+              result = subprocess.run([sys.executable, *flags, script], capture_output=True, timeout=600)
+              if result.returncode != 0 or result.stdout != expected or result.stderr != b'':
+                  raise RuntimeError('baseline exit/stdout/stderr differs under ' + ' '.join(flags))
+              for m in mutants:
+                  result = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600)
+                  size, digest = contracts[m]
+                  if (result.returncode != 1 or result.stderr != b'' or len(result.stdout) != size
+                          or hashlib.sha256(result.stdout).hexdigest() != digest):
+                      raise RuntimeError('mutant ' + m + ' differs from its complete fixed rejection report')
+              result = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600)
+              if result.returncode != 2 or result.stdout != b'' or result.stderr != b'unknown mutant label\n':
+                  raise RuntimeError('unknown mutant label differs from fixed exit/stdout/stderr')
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/formal-lean.yml

@@ -28,7 +28,7 @@ jobs:
       run_id: ${{ steps.required-binding.outputs.run_id }}
       run_attempt: ${{ steps.required-binding.outputs.run_attempt }}
       receipt_sha256: ${{ steps.required-binding.outputs.receipt_sha256 }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     env:
       LEAN_NUM_THREADS: 2

.github/workflows/full-regression-suite.yml

@@ -54,8 +54,12 @@ jobs:
       - name: Full repository regression suite in both Python modes
         run: |
           set -euo pipefail
-          python -B -S -m unittest discover -s tests -v
-          python -B -O -S -m unittest discover -s tests -v
+          log_dir="$(mktemp -d)"
+          trap 'rm -rf "$log_dir"' EXIT
+          python -B -S -m unittest discover -s tests -v 2>&1 | tee "$log_dir/normal.log"
+          grep -Eq '^Ran [1-9][0-9]* tests? in [0-9]+([.][0-9]+)?s$' "$log_dir/normal.log"
+          python -B -O -S -m unittest discover -s tests -v 2>&1 | tee "$log_dir/optimized.log"
+          grep -Eq '^Ran [1-9][0-9]* tests? in [0-9]+([.][0-9]+)?s$' "$log_dir/optimized.log"
       - name: Confirm the suite left the tested commit unchanged
         env:
           TESTED_SHA: ${{ github.sha }}

.github/workflows/lean-specification-proofs.yml

@@ -0,0 +1,59 @@
+name: Lean statement proofs (kernel evidence about registered Props only, no scientific promotion)
+
+'on':
+  pull_request:
+    paths:
+      - 'specifications/lean_statement_proofs_20261011/**'
+      - 'specifications/lean_statements_20261010/**'
+      - '.github/workflows/lean-specification-proofs.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  proof-evidence:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    env:
+      LEAN_NUM_THREADS: 2
+      PYTHONDONTWRITEBYTECODE: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11.16'
+      - name: Unit tests in both Python modes and the source check (no Lean)
+        run: |
+          set -euo pipefail
+          P=specifications/lean_statement_proofs_20261011
+          python -B -S "$P/test_check.py"
+          python -B -O -S "$P/test_check.py"
+          python -B -S "$P/check.py"
+      - name: Install pinned Lean and retrieve the Mathlib cache
+        uses: leanprover/lean-action@f061402b660e0c34644504b324e830f2991d4865
+        with:
+          lake-package-directory: specifications/lean_statement_proofs_20261011
+          auto-config: 'false'
+          build: 'false'
+          test: 'false'
+          lint: 'false'
+          use-mathlib-cache: 'true'
+          use-github-cache: 'false'
+      - name: Lean-driving unit tests on dependency-free fixture packages (environment audit, its controls, the escapes it must refuse)
+        run: python -B -S specifications/lean_statement_proofs_20261011/test_check.py LeanHelpers
+      - name: "Exact Lean version, fresh build (statement packet from source, then the proof modules), leanchecker, #check and #print axioms of every inventoried theorem, environment audit, negative controls, receipt"
+        run: python -B -S specifications/lean_statement_proofs_20261011/check.py --execute
+      - name: Tracked tree unchanged
+        run: git diff --exit-code
+      - name: Preserve logs and receipt
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: lean-specification-proofs-${{ github.run_id }}-${{ github.run_attempt }}
+          path: specifications/lean_statement_proofs_20261011/.lake/evidence/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14