Tracker: `WORKFLOW.md > 5. Test Methodology`

[ptr727]

Tracker for WORKFLOW.md > 5. Test Methodology. Filed under #1315's roll-up of the open prose backlog: every finding a bundle issue enumerated against this unit is listed here once, one line each, naming the issue it came from, and the bundle is closed as a duplicate of this tracker so the finding is not lost and the bundle stops being a unit of work. A new pre-existing finding on this unit gathers here per pr-review-conduct's Merge Gate, numbering continuing this list. This tracker closes when the unit is rewritten and each line below is settled or superseded.

1. The 5A D2 bullet says the release gate 'skips on smoke', where D2.2 requires an early exit with the job still reporting success; a job-level if: would wrongly pass. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
2. S1 and S4 both read 'validate-release skipped (smoke), succeeds', which is self-contradictory since a skipped job's conclusion is skipped, not success. [WORKFLOW.md > 5B. End-to-End Trace Scenarios (No Execution, Deterministic from the YAML)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
3. S7 presents all three publish triggers as reaching both branch arms, but D4.1 makes the schedule default-branch-only and gates the bot push to main, so only a dispatch reaches develop. [WORKFLOW.md > 5B. End-to-End Trace Scenarios (No Execution, Deterministic from the YAML)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
4. 5A requires each pass/fail/N-A verdict to carry a file:line citation, which an N/A verdict cannot have because the construct is absent. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
5. 5A requires a delete step at every cross-job transfer artifact's consumer and drops D5.1's MAY exception, so a repo taking that permission fails the check. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
6. The NuGet and PyPI addenda say the artifact is deleted 'under the download step's own success', dropping D5.2's !cancelled() half that carries the meaning. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
7. D6.2 is unqualified that branch-derived config never reads github.ref_name, while 5A adds a publish- exception; the two give opposite verdicts on one evidence. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
8. Three 5A addendum items stand behind no D-guarantee: the .NET runtime-subset rule, 'runs sequentially inside one composite-action job', and the site generator's checksum pin. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
9. 'The smoke runtime set is a strict non-empty subset of the full runtime set' is unsatisfiable for a single-runtime repo, and 'runtime set' is defined in no section. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
10. Two 5A claims are true by accident: the NuGet push gating reason is wrong (the job lives in the publisher), and the == 'main' parentheticals name a literal where the default branch is required. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
11. 'Actions are SHA-pinned' drops both of D9.1's qualifiers, the trailing # vX.Y.Z comment and the one documented no-pin exception. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
12. environment: { name: pypi } fixes a literal environment name no rule states; section 3 requires only that the publish job sit behind an environment. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
13. The static-site terminal check and S12 disagree: 5A puts the golden-list floor first and calls it load-bearing, S12 omits it and carries D4.6's bounded wait instead. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
14. Two live probes have no convergence or baseline discipline; the NuGet query fires straight after a publish and asynchronous indexing records absent as a failure. [WORKFLOW.md > 5C. Live Probe (Where Warranted)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
15. 'per leg' is undefined in 'inspect the latest real publish's logs for PublicRelease/SemVer2 per leg', and reads as the branch matrix D3.1 abolished. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
16. D1.6's two-secret-store requirement is reachable by no static check, since the stores are repository settings a read-only audit may not be permitted to read. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Fifteen pre-existing WORKFLOW.md section 5 defects a whole-unit read surfaced #1231)
17. The 5A D1.6 bullet's N/A instruction is per repository where the requirement is per type, dropping the C# leg on a mixed repo whose Python side has no tests. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Whole-Unit Passes Over WORKFLOW.md Sections 4 and 5 Raise Twelve Pre-Existing Contract Defects #1242)
18. A repo can hold CODECOV_TOKEN in both stores, pass every 5A clause, and still upload tokenless, since no shipped PR stub forwards a secrets: key. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Whole-Unit Passes Over WORKFLOW.md Sections 4 and 5 Raise Twelve Pre-Existing Contract Defects #1242)
19. The remaining section 5 findings concern walkthrough and scenario prose rather than a single item and are held as one line pending their own verification pass. (Whole-Unit Passes Over WORKFLOW.md Sections 4 and 5 Raise Twelve Pre-Existing Contract Defects #1242)

[ptr727]

Appended from the class 6 whole-unit read of this section (#1388), numbering continuing the list above.

20. 5A D1.6's "keeps its existing validator pin, a migration owed rather than drift" names a "validator pin" found nowhere in the unit, and "owed rather than drift" is a fourth verdict where the audit records pass, fail, or N/A. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
21. 5A D7 has a github.event.inputs.<name> boolean compared against 'true' alone, while the "Workflow YAML Conventions" Boolean inputs rule that 5A D8/D9 routes conditionals to says compare both forms, so one if: passes D7 and fails that rule on the same evidence, the D7.3 conflict Tracker: WORKFLOW.md > 4. Behavioral Contract: Expected Outcomes #1369 item 35 and Tracker: GOVERNANCE.md > Workflow YAML Conventions #1367 item 1 already hold, seen from 5A. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
22. 5A D8/D9's "emits a ::warning:: on the non-matching branch" names a branch where an actor comparison has a non-matching actor, and "branch" elsewhere in the unit means a git ref. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
23. 5A D4's asset delete "narrowed by inputs.expect_release_assets" and 5A D5's delete "gated so it runs exactly when the consumption happened" give the release-asset-* delete two different gates, one of which runs it when the download failed. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
24. 5A's core items, the global publisher concurrency group and the dispatch rejected off main or develop, are declared for every repo, while the static-site addendum keys concurrency on the environment and admits any ref, and the unit says nowhere that an addendum overrides a core item. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
25. 5A D8/D9's trailing "(wrapper repos)" attaches to the auto-merge: false exception, reading as wrapper bump PRs matching no merge-bot rule, which contradicts S11's wrapper expectation that the merge-bot auto-merges. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
26. 5B S12's expected output "a release installs under its own id ... no tag and no release are created" uses "release" for a deploy directory and for a GitHub release in one cell, so the predicted-versus-expected diff cannot be read literally. [WORKFLOW.md > 5B. End-to-End Trace Scenarios (No Execution, Deterministic from the YAML)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
27. 5A's evidence list names no file outside the audited repository and no ref at which a callee's file:line is taken, while D1.6 and the Docker items assert facts inside hub-hosted reusable workflows the repo only calls by pinned SHA, so followed literally those items have no evidence to cite. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
28. 5A D3's "NuGet.org derives the prerelease flag from the SemVer2 -g<sha> suffix rather than the workflow setting one" describes the registry's behavior rather than a structural fact in the repo, so a static read has nothing to mark pass or fail with a file:line. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
29. 5A D4's "releaseTrigger: dispatch-only" names a field whose source the unit states nowhere, so a reader cannot locate the value that decides whether the skip leg is recorded N/A, the same gap Tracker: .agents/skills/workflow-ci-contract/SKILL.md #1386 item 1 holds for the skill. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
30. 5A NuGet's "The release-asset .7z carries the package(s)" and 5A Docker's main-only readme gate fix an archive format and a branch gate no D-guarantee states, two further instances of the class item 8 lists, so a repo zipping its asset or publishing its readme from both branches fails a check with no guarantee behind it. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
31. 5C's "Open a trivial-change PR touching one target and confirm S1" instructs a repository write, while the section's actor rule covers only a dispatch and a re-run, so the one probe that opens a pull request has no stated actor. [WORKFLOW.md > 5C. Live Probe (Where Warranted)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
32. 5B S5's "the paths filter excludes it, so nothing publishes" names the construct 5A D1 defines as the PR entry workflow's changes job, which a push to main never runs, so the row either means the plan job's path test and should name it or names a trigger-level filter that leaves no run to trace. [WORKFLOW.md > 5B. End-to-End Trace Scenarios (No Execution, Deterministic from the YAML)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
33. 5A's per-type addenda check a .snupkg push "where symbols are enabled", a deployment-branch rule on the pypi environment, and a callee re-asserting the environment name, three checks standing behind no D-guarantee and no section 3 statement, and nothing the unit names decides where symbols are enabled. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)
34. 5A D2's "an entry validation job/step exists per complex-input workflow" names a class no section defines, since D2.1 and section 3 bind per invariant rather than per workflow, so a many-input workflow carrying no invariant reads as a fail on a rule section 4 does not state. [WORKFLOW.md > 5A. Static Audit (No Execution)] (Cut WORKFLOW.md Section 2 to a Pointer at Workflow YAML Conventions #1388)

[ptr727]

Ten more from a #1311 second-round pass (complete-brief whole-unit read, opus tier, no PR — read-only) over this section, numbering continuing the list above. The reviewer was briefed with the full text of items 20-34 before reading and confirmed all 15 still present as worded without re-deriving any of them.

35. 5A's own instructions contradict each other on N/A: "Assert the structural fact behind each applicable D-guarantee, each pass/fail/N-A with a file:line citation" both scopes the work to applicable items (excluding N/A by the section's own definition, "a check or scenario for an absent construct is recorded N/A") and then demands a citation an absent construct cannot have — D1.6's own "Record the whole item N/A for a repo with no tests" names no file to cite. Distinct from item 20 (a fourth verdict word) and 27/28 (evidence living outside the repo). [WORKFLOW.md > 5A. Static Audit] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
36. The NuGet addendum's "The push uses --skip-duplicate and is gated by that job's needs: on the release-task call, never on an existence check, so a PR never reaches it" misstates the mechanism: a needs: edge orders/gates on status, it does not filter triggers, so it cannot be what keeps a PR out of the job. What actually keeps a PR out is stated two sentences earlier ("publish-nuget is a job in the repo's own publisher") together with D1's smoke-flag rule, not the needs: edge this sentence credits. [WORKFLOW.md > 5A, NuGet addendum] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
37. 5C's own criterion for probing ("where a live signal exists that the static trace cannot produce") is stated in the Assessment procedure and lists four items, none of them S1 — yet 5C's first bullet is "Open a trivial-change PR touching one target and confirm S1," which is exactly the 5B scenario the section header calls "Deterministic from the YAML." The unit prescribes a probe its own stated criterion for probing excludes. [WORKFLOW.md > 5C. Live Probe / Assessment] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
38. The Assessment lets an unrun 5C probe never constrain the verdict ("no 5C probe that was run contradicts either"), while 5C's own deploy-ref-gate bullet says the opposite is the point of that specific probe ("a gate that fails open and a gate nobody tripped produce the same empty run history, so 'we have never seen it fail' is not evidence"). Every agent-run assessment of a static-site repo can therefore record "operational" on exactly the evidence 5C says is not evidence. [WORKFLOW.md > 5C. Live Probe / Assessment] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
39. 5A's own evidence list ("Remember the two layers: assert each input in the layer that declares it") never defines "the two layers" before using them, and the unit itself supplies at least two candidate pairings elsewhere (workflow-vs-composite-action under D1; caller-vs-called-leaf-vs-publisher under D6), which decides a different file:line for the same input depending which pairing a reader picks. [WORKFLOW.md > 5A. Static Audit] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
40. 5B's own instruction prescribes a four-dimension prediction ("the predicted run/skip + version + release + artifact-end-state table"), while most Expected cells in the table (S2, S3, S5, S8, S10, S13) state run/skip only, leaving the comparison undefined for the other three dimensions on those rows. [WORKFLOW.md > 5B. Trace Scenarios] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
41. D3 requires a called leaf to classify off github.ref directly, while D6 forbids a called leaf from reading github.ref_name and requires inputs.branch instead, with only the word "config" separating the required read from the forbidden one and no criterion in this unit distinguishing D3's classification context from D6's config context. [WORKFLOW.md > 5A, D3/D6] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
42. D5's cleanup clause says a delete step loops "all ids" for one artifact name, immediately followed by "no cleanup step enumerates and deletes the run's whole artifact set" — "all ids" is never scoped to the one matching name, so a delete step satisfying the first clause's wording as read could be the exact blanket delete the second clause bans. [WORKFLOW.md > 5A, D5] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
43. The PyPI addendum's "The pypi environment has a deployment-branch rule" states no required content, and one plausible content (default-branch-only) directly contradicts D3.4, which requires a develop PyPI publish (.dev0 appended on develop). An auditor can pass a rule that would block every .dev0 publish D3.4 requires to exist. [WORKFLOW.md > 5A, PyPI addendum] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)
44. S1 and S4's Expected cells both give the same job two conclusions in one cell ("validate-release skipped (smoke), succeeds"), leaving an auditor unable to tell which single value the predicted run/skip table should carry for that job. [WORKFLOW.md > 5B. Trace Scenarios] (Why the Backlog Grows: Prose Review Has No Fixed Point, and a Plan to Keep the Rigor Without It #1311 second round)

[ptr727]

5A collapsed to a procedure and an evidence rule (#1394)

Pull request 3 of the #1311 sequence. 5A's nine "Core" bullets and five per-type addenda, roughly
2400 words restating section 4 in a second voice, are replaced by three paragraphs: how a verdict
is recorded, where evidence lives when it is not in the workflow files, and how to cite it.

What that makes unwritable

A section that says where to look cannot disagree with the guarantee, so items 1, 4, 5, 6, 7, 8,
9, 10, 11, 12, 15, 16, 17, 18, 20, 21, 22, 23, 24, 25, 27, 28, 29, 30, 33, 34, 35, 36, 39, 41, 42,
43 are unwritable rather than fixed: each quotes 5A text that no longer exists.

Fixed here

2 and 44 (S1 and S4 gave one job two conclusions in one cell), 31 (5C's fence reached
only the dispatching probes), and 37 and 38 in part.

Surviving, still open on this tracker

3 (S7 presents all three publish triggers as reaching both branch arms), 13 (the S12 half
alone, the 5A half having gone with the addenda), 14 (two live probes with no convergence or
baseline discipline), 19, 26 (S12 uses "release" for a deploy directory and a GitHub
release in one cell), 32 (S5 names a construct a push to main never runs), 40 (5B
prescribes a four-dimension prediction and most Expected cells state run/skip only).

New, from this pull request's own review

Sixteen whole-unit passes over ten units and five diff passes raised roughly 70 findings. These
are the ones that outlived the change and belong here.

45. 5B carries no counterpart to the pinned-SHA read. AUDIT.md section 5 and audit-a-repo
    now tell an auditor to read a workflow the repo only calls at the SHA the caller pins, and 5A's
    citation rule admits that evidence, but 5B, where the job graph is actually walked, does not say
    it. An agent tracing S7 for a repo whose publisher calls a hub task by pinned SHA reads the
    hub's current main and predicts a table for YAML the audited repo never runs. Introduced by
    Collapse WORKFLOW.md 5A to a Procedure and an Evidence Rule #1394, which landed the rule on two surfaces of three.
46. The Assessment's step 3 probe list omits 5C's first bullet, the trivial-change PR
    confirming S1, which is 5C's only other writing probe. The list predates the file's first
    commit.
47. S11's two legs rejoin into one tail. After the auto-merge: false fork, both legs reach
    "the main pin publishes via the gate", but on that leg a human merges the bump PR, and D4.1
    and S6 both say a human merge publishes nothing.
48. 5A's citation rule has no form for a pass that rests on an absence. D5.5, D6.1's "not
    artifact-ids:", D3's "no IGNORE_GITHUB_REF" and D1.6's "carries no
    xunit.runner.visualstudio" are all satisfied by something not being there, and the only
    absence leg the rule offers is reserved for an N/A verdict on an inapplicable item.
49. 5A's evidence paragraph and its citation paragraph disagree on how many classes there are.
    The citation rule offers a form for "a setting, a ruleset, or a secret name", and the evidence
    paragraph names two of those three, omitting an environment's own settings, which is where
    every host-specific value in a hugo repo lives.

Section 6, from the same review

50. The source-only bullet's N/A list marks constructs present and passing for the half of the
    source-only population that owns its release task rather than calling the hub's, since
    build-release-task.yml carries the D6.1 pattern download and the D5.1/D5.2/D5.3/D5.5 cleanup.
    5A says an N/A verdict names an absent construct, and there is a line to cite.
51. The bullet hard-codes releaseTrigger: dispatch-only into the type, which the registry lets
    vary within it: this hub is ["source-only", "docs"] with two-phase, and HolidayLights is
    ["source-only"] with none. On either the S5/S6/S9 N/A calls and the applicable-scenario list
    are wrong.
52. D5.6's contrast clause and the static-site bullet's N/A list both stop at D5.4, where the
    source-only list now reads D5.1-D5.5. D5.5 is plainly a run-scoped-artifact item, so the fix is
    in the other two surfaces.
53. The source-only bullet names a data-library target where the tree says "Data / asset
    library" and the machine name is library, a third name for one thing. Introduced by Collapse WORKFLOW.md 5A to a Procedure and an Evidence Rule #1394 and
    left unfixed: it was raised after the edit budget was spent, and the rule says escalate rather
    than keep editing.
54. The intro's already-known over-promise now covers guarantees as well as scenarios, and its two
    co-surfaces were not swept with it: section 1's "Section 6 names which items go N/A per project
    type" and workflow-ci-contract's "the per-project-type walkthroughs that say which items go
    N/A per type". Settling the intro item needs all three edited together.

AUDIT.md, surfaced by the same passes

55. Its preamble calls the verdict vocabulary "WORKFLOW.md's" and omits drift finding, which
    is AUDIT.md's own addition, while the flowchart four lines below hangs it off section 7 as a
    peer of operational and defect. Same shape as the applicability extension Collapse WORKFLOW.md 5A to a Procedure and an Evidence Rule #1394 marked.
56. That flowchart draws s2 --> s3 unconditionally, with no exit for section 2's archived or
    excluded stop, though it does model the standup exit at s0. audit-a-repo's summary of
    section 2 drops the same stop.
57. audit-a-repo's "deterministic subset" bullet renders a two-way split where section 4 insists
    on three and warns that "the line between the two halves is not where a reader assumes". It
    drops the partial-evidence third, and lists Dependabot coverage flat although section 6
    mechanizes ecosystem presence only and leaves the dual-target check to inspection.

Two facts 5A was the only home for

Section 6 or spec/project-types.json carries every other deleted addendum fact, verified by a
sweep of all 175 code spans in the deleted text.

• The pypi environment's deployment-branch rule is genuinely lost. Filed with the caveat item
  43 records: its one plausible content, default-branch-only, would block every .dev0 publish
  D3.4 requires, so this is a candidate to drop rather than restore.
• A publish-<target> job reads github.ref_name correctly. Filed on Tracker: WORKFLOW.md > 4. Behavioral Contract: Expected Outcomes #1369, where section 4
  is owned.

[ptr727]

Pre-existing findings on this unit from the three review rounds of the #1311 PRs 2/4/6 change,
numbering continuing the list above.

58. The Assessment's "Record the workflow operational when every applicable 5A item passes"
    names a set 5A no longer defines. After Collapse WORKFLOW.md 5A to a Procedure and an Evidence Rule #1394 collapsed 5A to a procedure it enumerates no
    items of its own, and what is recorded are section 4's D-guarantees, which the document's own
    opening states as "every applicable guarantee holds".
59. S11's expected output says a develop pin ships "via a develop dispatch or promotion", which
    D4.1 falsifies: the promotion merge ships nothing and the pin ships on the next main publish
    after it. Same root cause as item 46, on a second surface. D8.3 and S11 were not swept when
    section 6's upstream-wrapper row was corrected to "the main pin's next gated publish rather
    than the merge itself".
60. Section 5C's write fence is a closed enumeration of three shapes ("opens a pull request,
    dispatches a workflow, or re-runs a real publish") and a fourth is added four bullets later
    ("any probe that acts on the deploy host directly"). A fifth falls outside both.
61. 5B's instruction "evaluate every job's if:/needs: against the inputs" is scoped to job-level
    conditions while the same paragraph sends the trace through composite actions, whose gates are
    steps, and D7.3's string-versus-boolean rule (which decides those gates) appears in no S-row's
    Exercises column.

AUDIT.md section 5, which has no tracker of its own

62. It claims to run "WORKFLOW.md's methodology" while enumerating two of its three modes and
    none of its Assessment. WORKFLOW.md's verdict has three conjuncts, and several 5C probes are
    reads a read-only audit can run (querying a registry for the classification, reading a real
    publish run's logs). Followed literally, a repo whose only defect is visible in one of those
    passes this section.