[bokelley]

Main lacks the immutable v3.1.22/v3.1.23 artifacts, and its hosted compliance publication manifest stops stable 3.1 selection at 3.1.20. This curated forward-port adds the exact released artifacts and discovery records, registers 3.1.22/3.1.23, and makes canonical hosted 3.1 selection load the 3.1.23 bundle. Historical registered pins remain selectable.

Draft; auto-merge off. Hold for human maintainer review and #7505 overlap reconciliation. #7505 is quarantined as Draft with auto-merge disabled under the coordinator HOLD. Maintainers must select the clean 341 tag-owned pages per snapshot and exclude the 43 main-only pages in each generated snapshot. Green CI does not lift this hold.

Hard ordering: human-reviewed corrected #7510 must land before #7507 (and before #7509). Human-reviewed #7506's fail-closed heartbeat completion must also land and be deployed to both web and worker before #7507 proceeds. Only after both prerequisites are verified, rebase #7507 onto the resulting exact main, preserve every immutable blob, the publication-manifest/test delta, and the clean docs exclusion, then rerun exact artifact audits, selector tests, exact-head CI, and independent delta/security review before seeking human approval. At the 2026-09-14 17:42 UTC check, both predecessors remain open; these prerequisites are unmet.

The final #7510 security audit identifies an ordering blocker: current main's routine Deploy calls the CDN backfill helper without a version restriction. Landing #7507 first could expose its newly committed 3.1.22/3.1.23 artifacts to routine publication outside the corrected release-authority fence. Green artifact/selector CI does not remove this deployment-path risk. #7510's corrected fence must already be on main before this artifact-bearing PR lands.

#7404 is not closed. This fixes the repository eligibility blocker; deployment and public cards have not been verified. After eventual human-reviewed landing and deployment, closure requires a complete heartbeat and public cards selecting 3.1.23 with full denominators and provenance. No merge, release publication, signing, deployment, branch-rule change, or production write is authorized here.

Exact candidate and source

• Head: 405de997e2fb318db658ae23f2a12922682fccdd
• Tree: 5e3926f84f10f87e9263136c57297dc1b1205aae
• Base: 36a86d6c4ae5c42e5e2e783d95bdb97b5cb6f614
• v3.1.22 tag: 3cb6cbc38293577fd27ac73ceeb2251e5464e673
• v3.1.23 tag / released 3.1.x: e57647988c44d93518f1d58cc15731aa5cf0fb54
• Successful release run: 34844866296

Added immutable files	v3.1.22	v3.1.23
Schemas	761	761
Compliance	288	288
Protocol tarball, sha256, sig, crt	4	4
Tag-owned versioned docs	341	341

Total: 2,788 added files, 2,374 unique Git blobs, 205,853,290 bytes. All remain byte-identical to reviewed head c69a4d0e39c768e5c6854a617eb0db5949969cdc and the original per-file Git/SHA-256 manifest. All 94,050 pre-existing immutable files on current main are preserved. The 2,106 non-docs objects were originally compared byte-for-byte against CDN, tag, and 3.1.x; both GitHub Release tuples also match. Each tar contains 2,199 regular files / 2,316 members, with all 761 schemas and 288 compliance files matching committed dist. Fresh checksum and Sigstore certificate identity/issuer verification pass without signing or secrets.

• 3.1.22.tgz SHA-256: fd4ee4450c182d778db5964eb30e39b1fee7f110dd7e27c65b88fb5bac66a30d
• 3.1.23.tgz SHA-256: 1b6ea825851dc052aeecd055c09633555335ab19d425c106d67060ed01ae6b9e

Hosted compliance correction and preserved behavior

hosted-compliance-version.ts filters checked-in compliance bundles through static/compliance/published-versions.json; adding dist alone left the 3.1 alias capped at 3.1.20. The amendment adds only 3.1.22 and 3.1.23 to published_versions. Every existing entry, npm tag, and package-only exclusion remains unchanged. This main-only manifest is absent from the released 3.1.x branch. Existing release registration and hosted selection already use it, so no runtime selector or SDK/package change is needed.

Deterministic tests now require canonical hosted 3.1 selection to return 3.1.23, select its compliance and schema directories, and load its actual index through the SDK. Exact 3.1.18, 3.1.20, 3.1.22, and 3.1.23 pins are exercised. The existing 3.0 hosted selector remains 3.0.25; the separate schema discovery 3.0 aliases remain 3.0.26. Before the manifest edit, the focused new assertions failed four cases while both older pins passed; after it, the full 55-test wrapper suite passes.

• Schema aggregate indices preserve every main 3.2 RC and existing version record, add 3.1.22/3.1.23, and advance stable 3.1/latest selectors to 3.1.23. The regression test checks committed discovery against immutable release discovery.
• CHANGELOG adds exact released 3.1.22/3.1.23 sections without duplicate headings; all existing main sections remain byte-identical.
• Required docs(release): correct v3.1.22 record for v3.1.23 #7451 release notes, versions page, and 3.0-to-3.1 migration guidance are retained, including the 3.2-only cache_namespace contract effective October 25, 2026.
• Required docs metadata remains narrowly scoped: docs.json, llms-current.md, and the schema-tools release-map literal advance 3.1.21 to 3.1.23; .dockerignore includes the new live docs snapshot.
• Package/lock, changeset state, source schemas/compliance, and already-landed fix(compliance): drop get_adcp_capabilities from required_tools across 17 storyboards (OR-gate bug) #6774/fix(compliance): drop comply_test_controller from canonical_format_validate_input required_tools (OR-gate) #7405 semantics are unchanged relative to current main. No raw merge or wholesale conflict resolution was used.

Docs provenance and quarantined overlap

Tags/3.1.x do not contain these dist/docs snapshots. Official snapshot branches #7448 (closed, 5c5795a7ee4e65fb4c6d05e2382775e846b0b4b2) and #7505 (quarantined Draft, bc88c54837a4e0c2ab29d7ea4756ff495b09b1a4) each contain 43 main-only pages absent from their tag: the extraction fallback overlays tag docs onto main before moving the combined directory.

This PR contains exactly each tag's 341-file set. Every included blob matches both the corresponding official snapshot blob and a clean tag extraction with that workflow base's standard link rewrites. The extra pages are excluded. New deterministic tests pin sorted relative paths and file SHA-256 hashes for each complete reviewed snapshot, rejecting added pages, omissions, and byte changes without needing Git in CI.

#7505 is the intentional docs snapshot/navigation overlap, now quarantined; #7504 is the separate human merge that advanced the earlier main base. The #7505 HOLD records its stale 71f9cd54 base, failed checks, lack of human approval, and contamination. Maintainers must reconcile using the clean tag-owned snapshots before any readiness claim. This PR does not modify #7505's branch or the extraction workflow.

Current-main rebase and validation

The previous reviewed candidate c69a4d0 was based on af1ea266 after #7504. Current main 36a86d6c adds #7494/#7516/#7515/#7512: 28 changed paths, including compliance source and docs, with no direct overlap in the curated diff. Pure rebase intermediate e2be9ee79a0ac5f6a5d3deefbc31717063d423e7 has an old-to-new raw object diff exactly equal to the old-to-new main diff. The amendment then changes only the publication manifest and the two deterministic test files. Main's newer work and all reviewed artifact bytes are preserved.

• Root unit: 71 files / 1,066 tests passed.
• Hosted storyboard wrapper/version selection: 55/55 passed.
• Downstream compliance publication, diagnostics, discovery, and heartbeat: 5 files / 111 tests passed.
• Passed: full schema suite (1,005 schemas plus contract tests), release-workflow tests, published-compliance checker against npm tags, version synchronization, compliance generation check, immutable-artifact guard/tests, schema version IDs, packaged compliance references, docs navigation, typecheck, and normal precommit hooks (including scoped server unit and guard checks).
• Exact artifact tree/hash audit, docs set hashes, aggregate indices, changelog, and all historical conflict exclusions pass. Both signatures and tar contents were reverified. The new manifest/test delta passes git diff --check; the full PR retains 88 inherited whitespace warnings in byte-identical immutable docs.
• The local advisory pre-push storyboard matrix was explicitly skipped; canonical training/compliance source changes since the old remote head are inherited from main. Fresh PR storyboard CI remains authoritative.
• The first local push stopped at the changeset hook because the retained authoring branch is named conductor/...; the actual destination is the existing forward-merge/... branch, exempt under .github/workflows/changeset-check.yml. Version sync, changeset scope, schema-link lint, and docs navigation were checked explicitly before pushing with that local hook disabled. No branch rename, new changeset, hook-file edit, or branch-rule change was made.
• Independent exact-head delta review found no concrete blocker to updating this Draft. It reverified the manifest seam, regression tests, all added artifact blobs and all inherited immutable files; report: .context/manifest-independent-review.md.
• A follow-up independent exact-head audit found no artifact or code blocker at 405de997 on 36a86d6c: candidate tree and merge tree match, and all 2,788 additions, both signed release tuples, both clean 341-page snapshots, all 94,050 inherited immutable files, the publication manifest, selector behavior, and exact CI were verified.
• Terminal exact-head CI on 405de997: at 2026-09-14 17:36 UTC, GitHub reports 54 successful checks, 3 skipped, 1 neutral, zero pending or failing checks, plus IPR Policy / Signature success. Build Check 34871662370 passed on attempt 1, completing at 17:27 UTC; Training Agent Storyboards 34871662302 passed on attempt 1, completing at 17:35 UTC. Both runs identify the exact head above. The earlier queue hold is resolved; prior c69 CI remains historical evidence. Current main was rechecked at 17:42 UTC and remains 36a86d6c; the terminal CI snapshot is unchanged. This green result does not lift the fix(release): fence publication and recover superseded releases #7510 release-security prerequisite, fix(compliance): require explicit heartbeat completion before publication #7506 landing and web/worker deployment prerequisite, chore: snapshot docs for v3.1.23 #7505 quarantine/reconciliation, or human-review holds; any subsequent rebase requires fresh exact-head validation and independent delta/security review.

Historical CI evidence and local limitation

On the previous exact c69 head, Build 34848630880 attempt 1 failed one private-ledger migration assertion: expected unknown_exposure, received persistence_uncertain; shard 3/4 had 614 passed / 7 skipped and its aggregator failed. PostgreSQL logged a SHARE ROW EXCLUSIVE recovery table-lock timeout. Independent exact af1/c69 analysis reproduced the same existing 250 ms contention bound on both refs; unmodified isolated cases passed 10/10 per ref and fresh-schema full files passed 36/36. Retained-database failures and setup limitations are preserved in the evidence. After that diagnosis, the single authorized failed-job retry passed on attempt 2: shard 3/4 39 files / 615 tests passed / 7 tests skipped, ledger file 36/36, aggregator green. This does not establish that the underlying contention sensitivity is fixed.

The much earlier broad local server run crossed a selector edit/rebase and is not exact-head evidence: 613 files; 9,366 passed, 31 skipped, 5 failed (four stale module-mapping assertions and one 30-second HTTP-test timeout). Fresh affected-file checks then passed 3 files / 69 tests. That broad run remains inconclusive; no new full local server-suite pass is claimed here. The terminal exact-head CI above supplies current CI evidence; the required rebase after both predecessor conditions are met will need fresh CI again.

Separate ancestry root cause

#7387 submitted true merge da6b3a8e015a9efccc9e2270503b85cd8e7041ca with main parent ae2d124ee30cf4e9340024673e1e2f84c16cde27 and stable parent e384ef14c554f6d286e2ed26dd3e3171411085ea. It landed as squash 43660756df57824d0f979e860080161efb7b9efa, retaining only the main parent while allow_merge_commit is false. Stable ancestry never reached main, causing automation's repeated historical conflicts. This curated patch does not redesign or repair that ancestry.

Authoring/review workspace. Evidence lives in .context/: manifest-exact-artifact-audit.json, manifest-rebase-overlap.json, manifest-tar-verification.json, manifest-*.log, manifest-independent-review.md, and the original CDN/tag/GitHub provenance records. Original artifact manifest SHA-256: bdf318a584716e8fd63b2eb174b8293e88e8646baedbc47571911981cd8e3213. Historical CI diagnosis manifest SHA-256: f8125286906e2bcc948dd1f8bb6fc2a9e8adc457805bae0b14cd89f70fd39450.

[bokelley]

Queue cleanup: this forward-port is now superseded. Current main already contains the immutable 3.1.22 and 3.1.23 schema/compliance artifacts and registers both versions in static/compliance/published-versions.json, so hosted 3.1 selection can reach 3.1.23. The branch is now broadly conflicted, and the release line has advanced to the 3.1.24 version-package train. The remaining historical docs-snapshot material should not be replayed as part of this obsolete 2,788-file artifact branch; any missing historical docs snapshot should be regenerated independently from its tag.