Merge remote-tracking branch 'origin/main' into flaky-2026-10-28-judges

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md

scripts/free-test-durations.json

@@ -57,9 +57,6 @@
     "browse/test/daemon-log-hygiene.test.ts": 32,
     "browse/test/daemon-mismatch-refuse.test.ts": 105,
     "browse/test/data-platform.test.ts": 21,
-    "browse/test/dia-gui-readiness.test.ts": 895,
-    "browse/test/dia-launch-comparison.test.ts": 2807,
-    "browse/test/dia-macos-qualification.test.ts": 2829,
     "browse/test/domain-skills-e2e.test.ts": 520,
     "browse/test/domain-skills-storage.test.ts": 232,
     "browse/test/dotenv-isolation.test.ts": 405,

scripts/lib/windows-curation.ts

@@ -52,6 +52,7 @@ const WINDOWS_FRAGILE_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
 // the failure mode is structural rather than detectable via source-file scan.
 export const KNOWN_WINDOWS_INCOMPATIBLE: Array<{ file: string; reason: string }> = [
   // Like test/paid-rerun.test.ts (excluded by pattern), it replays a gate capture through the paid lane's --report and --rerun-plan CLI.
+  { file: 'test/shared-libs-index-flags-readonly.test.ts', reason: 'its assume-unchanged replay seeds the review through test/helpers/shared-libs-path-fixture.ts, which launches bin/gstack-review-log (a bash script) directly; windows-latest refuses it as not found in $PATH (windows-free-shard 5, run 40727825859)' },
   { file: 'test/credential-rejection.test.ts', reason: 'replays run 39696775546 through the --report and --rerun-plan CLI of the paid lane, which runs only on Linux CI; on windows-latest that CLI exits 1 with EINVAL in open() (windows-free-shard run 39982914852)' },
   // Field list 2, W11: the review-voice install is a POSIX launcher contract, exercised end to end on Linux and macOS.
   { file: 'test/capy-review-voice.test.ts', reason: 'copies the checkout with tar -C into the temp root (GNU tar reads a D: path as a remote host) and launches the bash --for review-voice installer with a colon-joined GSTACK_LAUNCH PATH' },

scripts/resolvers/review-scope.ts

@@ -133,11 +133,12 @@ or missing-reviewer rules.`;
 export function generateSharedCodeReuse(ctx: TemplateContext): string {
   return `**Reuse a skipped shared-code advisory only with complete structural evidence:**
 
-1. **Read the evidence.** Read all supporting callers and the helper destination.
-   Establish first-party authored provenance and whether the current extraction
-   is worthwhile; the checker cannot decide that. Retain \`evidence_paths\`/\`helper_target\`.
+1. **Read the evidence.** Read all supporting callers and the helper target
+   read-only: \`git update-index\`, even \`--really-refresh\`, clears the index flags
+   the checker reads. Establish first-party authored provenance and whether this
+   extraction is worthwhile; the checker cannot. Retain \`evidence_paths\`/\`helper_target\`.
 2. **Run the checker.** From the repository root, pass the current finding as
-   literal JSON on stdin. Replace REVIEW_START with this pass's captured token
+   literal JSON on stdin. Replace REVIEW_START with this pass's token
    and the example paths/symbol with actual evidence. Keep the quoted delimiter.
 
 \`\`\`bash
@@ -146,17 +147,17 @@ export function generateSharedCodeReuse(ctx: TemplateContext): string {
 GSTACK_SHARED_LIBS_REUSE_JSON
 \`\`\`
 
-3. **Act on its result.** Read the JSON. Only \`reusable: true\` permits suppression.
+3. **Act on its result.** Only \`reusable: true\` permits suppression.
    False, command failure or unreadable output requires fresh source review and a
    new decision, never suppression. Do not supply your own snapshot, prior record or coverage.
-4. **Persist through the logger.** The logger recomputes final coverage; never
-   supply proof yourself. Real defects retain normal Fix-First handling independently.
+4. **Persist through the logger.** The logger recomputes coverage; never supply
+   proof. Real defects retain normal Fix-First handling.
 
-**What a reusable result proves (do not reconstruct these checks yourself):**
-- Identity: \`sharedLibsFingerprint\` plus the actual repo, raw branch and current snapshot.
+**What a reusable result proves (never reconstruct these checks):**
+- Identity: \`sharedLibsFingerprint\` plus the repo, raw branch and current snapshot.
   The checker reads REVIEW_START without consuming/replacing it. Sanitized branch names are not identity.
 - Prior decision: completed/converged review, verified binding, explicit Skip and
-  logger-versioned \`snapshot_covered_paths\`; older unversioned coverage needs a fresh decision.
+  logger-versioned \`snapshot_covered_paths\`; unversioned coverage needs a fresh decision.
 - Source: \`canReuseSharedLibsAdvisory\` requires every supporting path's raw file
   byte-for-byte with its blob. Exclude assume-unchanged, skip-worktree and sparse index
   entries; symlinks/ancestors, submodules, ignored/outside or unreadable files;

scripts/typecheck-test-baseline.json

@@ -34,10 +34,6 @@
     "browse/test/cookie-import-reliability.test.ts\tTS2769\tNo overload matches this call. The last overload gave the following error. Argument of type 'number' is not assignable to parameter of type 'Function'.": 1,
     "browse/test/cookie-import-transport.test.ts\tTS2741\tProperty 'preconnect' is missing in type '() => Promise<Response>' but required in type 'typeof fetch'.": 2,
     "browse/test/cookie-import-transport.test.ts\tTS2741\tProperty 'preconnect' is missing in type '() => Promise<never>' but required in type 'typeof fetch'.": 1,
-    "browse/test/dia-gui-readiness.test.ts\tTS2352\tConversion of type '() => { status: number; stderr: string; stdout: string; }' to type '{ (command: string): SpawnSyncReturns<NonSharedBuffer>; (command: string, options: SpawnSyncOptionsWithStringEncoding): SpawnSyncReturns<...>; (command: string, options: SpawnSyncOptionsWithBufferEncoding): SpawnSyncReturns<...>; (command: string, options?: SpawnSyncOptions | undefined): SpawnSyncReturns<...>; (comm...' may be a mistake because neither type sufficiently overlaps with the other. If this was intentional, convert the expression to 'unknown' first. Type '{ status: number; stderr: string; stdout: string; }' is missing the following properties from type 'SpawnSyncReturns<NonSharedBuffer>': pid, output, signal": 1,
-    "browse/test/dia-launch-comparison.test.ts\tTS7016\tCould not find a declaration file for module '../../.github/scripts/dia-launch-driver.mjs'. '.github/scripts/dia-launch-driver.mjs' implicitly has an 'any' type.": 1,
-    "browse/test/dia-macos-qualification.test.ts\tTS2352\tConversion of type '() => { status: number; stderr: string; stdout: string; }' to type '{ (command: string): SpawnSyncReturns<NonSharedBuffer>; (command: string, options: SpawnSyncOptionsWithStringEncoding): SpawnSyncReturns<...>; (command: string, options: SpawnSyncOptionsWithBufferEncoding): SpawnSyncReturns<...>; (command: string, options?: SpawnSyncOptions | undefined): SpawnSyncReturns<...>; (comm...' may be a mistake because neither type sufficiently overlaps with the other. If this was intentional, convert the expression to 'unknown' first. Type '{ status: number; stderr: string; stdout: string; }' is missing the following properties from type 'SpawnSyncReturns<NonSharedBuffer>': pid, output, signal": 2,
-    "browse/test/dia-macos-qualification.test.ts\tTS2769\tNo overload matches this call. The last overload gave the following error. Argument of type 'string' is not assignable to parameter of type '\"browser_profile_unavailable\" | \"code_signing_error\" | \"debugging_pipe_unavailable\" | \"default_profile_policy\" | \"dynamic_library_error\" | \"graphics_or_bootstrap_error\" | \"keychain_access_failed\" | \"keychain_interaction_disallowed\" | \"keychain_interaction_required\"'.": 1,
     "browse/test/domain-skills-e2e.test.ts\tTS2339\tProperty 'cleanup' does not exist on type 'BrowserManager'.": 1,
     "browse/test/extension-token.test.ts\tTS2353\tObject literal may only specify known properties, and 'idleTimeoutMs' does not exist in type 'ServerConfig'.": 1,
     "browse/test/handoff.test.ts\tTS2339\tProperty 'pid' does not exist on type 'never'.": 1,

scripts/ubicloud/setup-free-suite.sh

@@ -11,7 +11,7 @@ NODE_SHA256=1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce
 export DEBIAN_FRONTEND=noninteractive
 sudo -E apt-get update -qq
 sudo -E apt-get install -y -qq --no-install-recommends \
-  git curl unzip zip xz-utils ca-certificates build-essential clang python3-venv jq \
+  git curl unzip zip xz-utils ca-certificates build-essential python3-venv jq \
   xvfb x11-utils poppler-utils fonts-noto-color-emoji zsh >/dev/null
 
 # Ubuntu 24.04 blocks unprivileged user namespaces, which Chromium's sandbox