fix: keep gstack-upgrade under its size budget, exempt state-matrix's fetch hint, fit the periodic plan's 37 slices

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

.github/workflows/evals-periodic.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Emit run manifest (ALL periodic tests minus reasoned excludes)
         env:
           EVALS_ALL: "1"
-        run: EVALS_TIER=periodic bun --no-install run scripts/test-paid-shards.ts --tier periodic --emit-plan /tmp/paid-plan/manifest.json --slice-budget 420 --jobs 2 --max-parallel 36
+        run: EVALS_TIER=periodic bun --no-install run scripts/test-paid-shards.ts --tier periodic --emit-plan /tmp/paid-plan/manifest.json --slice-budget 420 --jobs 2 --max-parallel 37
 
       # Codex-only slices run on the host-run eval-codex-slices job; the
       # container executor runs every other slice.
@@ -258,7 +258,7 @@ jobs:
       fail-fast: false
       # Every planned slice starts at once; test/evals-workflow-wiring.test.ts
       # fails when the live plan outgrows this cap.
-      max-parallel: 36
+      max-parallel: 37
       matrix:
         slice: ${{ fromJSON(needs.plan-slices.outputs.periodic_slices) }}
     steps:
@@ -397,7 +397,7 @@ jobs:
       packages: read
     strategy:
       fail-fast: false
-      max-parallel: 36
+      max-parallel: 37
       matrix:
         slice: ${{ fromJSON(needs.plan-slices.outputs.periodic_codex_slices) }}
     steps:

gstack-upgrade/SKILL.md

@@ -46,10 +46,7 @@ echo "AUTO_UPGRADE=$_AUTO"
 
 **Otherwise**, use AskUserQuestion:
 - Question: "gstack **v{new}** is available (you're on v{old}). Upgrade now?"
-  When the line has a fourth field, `UPGRADE_AVAILABLE <old> <old>+<n> <sha>`,
-  main moved `<n>` commits past this checkout without a new version; ask
-  instead: "gstack main has **{n} new commit(s)** since your checkout (still
-  v{old}; main is at {sha}). Upgrade now?"
+  Four fields (`UPGRADE_AVAILABLE <old> <old>+<n> <sha>`, main moved): ask "gstack main is **{n} commit(s)** past v{old} (at {sha}). Upgrade now?"
 - Options: ["Yes, upgrade now", "Always keep me up to date", "Not now", "Never ask again"]
 
 **If "Yes, upgrade now":** Proceed to Step 2.
@@ -77,7 +74,7 @@ _NEW_LEVEL=$((_CUR_LEVEL + 1))
 [ "$_NEW_LEVEL" -gt 3 ] && _NEW_LEVEL=3
 echo "$_REMOTE_VER $_NEW_LEVEL $(date +%s)" > "$_SNOOZE_FILE"
 ```
-Note: `{new}` is the remote version from the `UPGRADE_AVAILABLE` output — substitute it from the update check result. On the four-field line, substitute the fourth field (the main SHA) for `{new}` in this block: that snooze ends when main moves again.
+Note: `{new}` is the remote version from the `UPGRADE_AVAILABLE` output — substitute it from the update check result. On a four-field line use the SHA (fourth field) as `{new}`, so the snooze ends when main moves.
 
 Tell user the snooze duration: "Next reminder in 24h" (or 48h or 1 week, depending on level). Tip: "Set `auto_upgrade: true` in `~/.gstack/config.yaml` for automatic upgrades."
 
@@ -378,7 +375,7 @@ rm -f "$GSTACK_STATE_ROOT"/update-snoozed
 
 Read `$INSTALL_DIR/CHANGELOG.md`. Find all version entries between the old version and the new version. Summarize as 5-7 bullets grouped by theme. Don't overwhelm — focus on user-facing changes. Skip internal refactors unless they're significant.
 
-On the four-field (same-version) upgrade there is no new CHANGELOG entry: summarize the commit subjects the upgrade brought instead (`git -C "$INSTALL_DIR" log --oneline <PRE_UPGRADE_COMMIT>..HEAD`, with the PRE_UPGRADE_COMMIT the upgrade printed, at most 7 bullets) and title it "gstack v{old}, now at main {sha} ({n} unreleased commit(s))".
+Four fields: summarize `git -C "$INSTALL_DIR" log --oneline <PRE_UPGRADE_COMMIT>..HEAD` (≤7 bullets) as "gstack v{old}, main at {sha}".
 
 Format:
 ```
@@ -409,7 +406,7 @@ When invoked directly as `/gstack-upgrade` (not from a preamble):
 ```
 Use the output to determine if an upgrade is available.
 
-2. If `UPGRADE_AVAILABLE <old> <new>` (or `UPGRADE_AVAILABLE <old> <old>+<n> <sha>`: main moved without a new version): follow Steps 2-6 above.
+2. If `UPGRADE_AVAILABLE` (three or four fields): follow Steps 2-6 above.
 
    If `CHECK_FAILED ...`: the remote version could not be read, so the update
    status is unknown. Show the line (it names the URL that failed) and tell the

gstack-upgrade/SKILL.md.tmpl

@@ -43,10 +43,7 @@ echo "AUTO_UPGRADE=$_AUTO"
 
 **Otherwise**, use AskUserQuestion:
 - Question: "gstack **v{new}** is available (you're on v{old}). Upgrade now?"
-  When the line has a fourth field, `UPGRADE_AVAILABLE <old> <old>+<n> <sha>`,
-  main moved `<n>` commits past this checkout without a new version; ask
-  instead: "gstack main has **{n} new commit(s)** since your checkout (still
-  v{old}; main is at {sha}). Upgrade now?"
+  Four fields (`UPGRADE_AVAILABLE <old> <old>+<n> <sha>`, main moved): ask "gstack main is **{n} commit(s)** past v{old} (at {sha}). Upgrade now?"
 - Options: ["Yes, upgrade now", "Always keep me up to date", "Not now", "Never ask again"]
 
 **If "Yes, upgrade now":** Proceed to Step 2.
@@ -74,7 +71,7 @@ _NEW_LEVEL=$((_CUR_LEVEL + 1))
 [ "$_NEW_LEVEL" -gt 3 ] && _NEW_LEVEL=3
 echo "$_REMOTE_VER $_NEW_LEVEL $(date +%s)" > "$_SNOOZE_FILE"
 ```
-Note: `{new}` is the remote version from the `UPGRADE_AVAILABLE` output — substitute it from the update check result. On the four-field line, substitute the fourth field (the main SHA) for `{new}` in this block: that snooze ends when main moves again.
+Note: `{new}` is the remote version from the `UPGRADE_AVAILABLE` output — substitute it from the update check result. On a four-field line use the SHA (fourth field) as `{new}`, so the snooze ends when main moves.
 
 Tell user the snooze duration: "Next reminder in 24h" (or 48h or 1 week, depending on level). Tip: "Set `auto_upgrade: true` in `~/.gstack/config.yaml` for automatic upgrades."
 
@@ -375,7 +372,7 @@ rm -f "$GSTACK_STATE_ROOT"/update-snoozed
 
 Read `$INSTALL_DIR/CHANGELOG.md`. Find all version entries between the old version and the new version. Summarize as 5-7 bullets grouped by theme. Don't overwhelm — focus on user-facing changes. Skip internal refactors unless they're significant.
 
-On the four-field (same-version) upgrade there is no new CHANGELOG entry: summarize the commit subjects the upgrade brought instead (`git -C "$INSTALL_DIR" log --oneline <PRE_UPGRADE_COMMIT>..HEAD`, with the PRE_UPGRADE_COMMIT the upgrade printed, at most 7 bullets) and title it "gstack v{old}, now at main {sha} ({n} unreleased commit(s))".
+Four fields: summarize `git -C "$INSTALL_DIR" log --oneline <PRE_UPGRADE_COMMIT>..HEAD` (≤7 bullets) as "gstack v{old}, main at {sha}".
 
 Format:
 ```
@@ -406,7 +403,7 @@ When invoked directly as `/gstack-upgrade` (not from a preamble):
 ```
 Use the output to determine if an upgrade is available.
 
-2. If `UPGRADE_AVAILABLE <old> <new>` (or `UPGRADE_AVAILABLE <old> <old>+<n> <sha>`: main moved without a new version): follow Steps 2-6 above.
+2. If `UPGRADE_AVAILABLE` (three or four fields): follow Steps 2-6 above.
 
    If `CHECK_FAILED ...`: the remote version could not be read, so the update
    status is unknown. Show the line (it names the URL that failed) and tell the

test/egress-receipt-wiring.test.ts

@@ -148,6 +148,8 @@ const SCANNER_EXEMPT: Record<string, string> = {
     'fetches the user\'s own repo\'s base branch for version-claim freshness — a user-repo dev-workflow op, not gstack-state egress',
   'bin/gstack-version-bump':
     'git fetch appears only in an error-message string',
+  'bin/gstack-state-matrix':
+    'git fetch appears only in an error-message string (the fix the user runs when origin/<base> has no merge base)',
   'bin/gstack-redact-prepush':
     'git push mentions are hook documentation strings (bypass instructions)',
   'browse/src/security-classifier.ts':

test/update-check-main-moved.test.ts

@@ -181,7 +181,7 @@ describe('equal VERSION, main moved past the checkout', () => {
     const skill = fs.readFileSync(path.join(ROOT, 'gstack-upgrade', 'SKILL.md'), 'utf8');
     const block = /```bash\n(GSTACK_STATE_ROOT=\$\(~\/\.claude\/skills\/gstack\/bin\/gstack-paths[^\n]*\n_SNOOZE_FILE=[\s\S]*?)```/.exec(skill)![1]!;
     expect(block).toContain('_REMOTE_VER="{new}"');
-    expect(skill).toContain('On the four-field line, substitute the fourth field (the main SHA) for `{new}` in this block');
+    expect(skill).toContain('On a four-field line use the SHA (fourth field) as `{new}`');
     const bin = path.join(fx.root, '.claude', 'skills', 'gstack', 'bin');
     fs.mkdirSync(bin, { recursive: true });
     fs.mkdirSync(path.join(path.dirname(bin), 'lib'), { recursive: true });