Delivery routing for #310-#342: two PRs, what rides with what, and what stays out

[m2ux]

Purpose

Ten issues are open from #310 up. They are not ten pieces of work: several share files, several are already delivered, and two pairs are the same defect at different sites. This issue records how they group into deliverable pull requests, what order those land in, and what deliberately stays out.

It is a routing document. Each item is worked in its own issue; this one only says what travels with what.

---

Two PRs

Server PR — guard reach and measurement honesty

Closes #341, closes #342, closes #337 S6 C4.

1. Guard reach: a gate expression is counted as consumption but never resolved #341 R1 — feed gate-expression names into read-resolution, so a when or validate target naming a value nothing produces is a finding. 80 sites (33 step when, 47 validate).
2. Guard reach: a gate expression is counted as consumption but never resolved #341 R2 — drop the duplicated check:site / check:svg steps from deploy-docs.yml; both are registry entries check:all already runs.
3. Guard reach: dead-output resolves consumers across workflow boundaries, so duplicate technique names mask real seams #342 R1–R3 — scope dead-output consumer resolution to the declaring workflow, restore the two entries pruned in b41aaacc, and make a stale report distinguish "seam closed" from "guard stopped seeing it".
4. Server backlog: unfinished work from #189, #232, #322, #323, #324 #337 S6 C4 — the resources/README.md id-shadowing decision, if it is resolved server-side rather than by a corpus naming rule.

Why one PR. All four touch scripts/check-binding-fidelity.ts and its triage file. #341 R1 lands with a triage pass by its own admission ("expect a first-run finding set"); #342 R1 lands with one too, because scoping the check re-opens findings. Splitting them means two triage passes over the same file and a guard that is red in between.

Corpus PR — close the artifacts-checkout defect class

Closes #319, closes #338 W2, closes #310 Part 2, partially closes #320.

1. Outstanding and deferred items from the review-mode friction continuation session #319 AP-114 + D-6, in one pass — move manage-git::artifact-commits into a 13-submit-for-review.yaml steps[] bind, then fix the activity-13 mermaid at activities/README.md:418, which the new step makes staler still.
2. Outstanding and deferred items from the review-mode friction continuation session #319 item 6 + Corpus backlog: unfinished work from #189, #232, #323, #324 #338 W2, together — these are the same defect at five sites. Four are the parent-repo assumption on the PR-description path (update-pr/TECHNIQUE.md:76, pr-description.md:143, manage-artifacts/TECHNIQUE.md, agent-conduct.md); the fifth is commit-and-persist.md:35, which still prescribes commit-regular-files for a path that is a submodule here. Fixing either alone leaves the class live — that is Outstanding and deferred items from the review-mode friction continuation session #319's own argument, extended by one file.
3. Outstanding and deferred items from the review-mode friction continuation session #319 items 3–5 — three single-line prose fixes in files the pass already touches.
4. Follow-ups from the requirements-refinement design session (PR #318): workflow-design decision machinery, meta binding gaps, and 9 open F-items #320 C-2 residual — end-workflow's three technique bindings still have no producer.
5. GitNexus use optimisation: workflow-design binds no graph ops, plus three undocumented index caveats #310 Part 2 — document the three graph caveats in meta/techniques/gitnexus-operations/TECHNIQUE.md. One file, no overlap with anything above; a cheap ride-along.

Blocker to resolve before scoping. #319's "~23 Med/Low from the two catalogue sweeps" is not enumerated in the issue — it points at a planning register on engineering. Read that register before committing to a scope manifest, or the PR's size is unknown at Gate 2.

---

Order

server PR  →  corpus PR  →  pointer bump  →  #336

• Server before corpus because Guard reach: dead-output resolves consumers across workflow boundaries, so duplicate technique names mask real seams #342 is currently removing real entries from the debt ledger and reporting them as closed. Any corpus measurement taken before it lands understates by an unknown amount.
• Outstanding and deferred items from the review-mode friction continuation session #319 before Corpus binding debt: close the 125 fix-later seams #327 triaged #336 because they collide in work-package/techniques/. Corpus binding debt: close the 125 fix-later seams #327 triaged #336 R1 alone works 69 findings across that tree; Outstanding and deferred items from the review-mode friction continuation session #319's semantic fixes land in the same files and are far harder to review under a mechanical diff.
• Corpus binding debt: close the 125 fix-later seams #327 triaged #336 last for the same reason as the first bullet — it is a burn-down of a ledger whose instrument is being repaired one step earlier. Measuring the debt before fixing the meter is how you get a number nobody trusts.

A workflows pointer bump is needed after the corpus PR, as always. The protocol is recorded in tests/e2e/__snapshots__/corpus-sha.json — stamp it in the same commit. b41aaacc is a worked example.

---

What stays out, and why

Issue	Why not in either PR
#336	Big, mechanical, per-class sweep across work-package and substrate-node-security-audit. Collides with the corpus PR's files, and combining makes the diff unreviewable. Its own PR — probably several, following its own R3 → R5 → R2 → R1 → R4 sequence.
#317	Needs a design call between four stated directions before a single line changes. Direction 2 ("make the timer real") is server work; the rest is corpus. Not batchable until settled.
#310 Part 1	The gap is real and reproduces, but the target moved: workflow-authoring binds zero graph operations, and its activity set is now four with impact-analysis demoted to a technique. That is a workflow-authoring enhancement with its own scope, not a documentation fix.
#337 S1	Needs an ADR, changes delivery semantics, and gates corpus W1. The largest behavioural change on the board — isolate it.
#337 S7	The issue itself says keep it isolated: schema migration, the only item that can break existing content.
#337 S2 / S3 / S4 / S5	Independent M-sized features, each its own theme. S3 is small enough to ride the server PR if you want corpus W3 unblocked sooner.
#320 Group D	Nine F-items in requirements-refinement, a third workflow. F-12 and F-13 are human design calls, and F-13 is additionally blocked on an AP-80 preservation audit.
#316	Self-deferred by its own text, and it is repo configuration rather than either repo's code. Its stated revisit trigger — a second, non-admin operator — has not fired.
#321	Delivered by #339 (S1–S4, S6) and #340 (S5). What remains is the drain-to-zero retirement policy, not a code change.

---

Staleness found while routing this

Verified 2026-07-28 against origin/main at b41aaacc and origin/workflows at f84fe02b. Several issues carry content that merged work has overtaken; a reader following them as written would do dead work. #337 and #338 have been corrected in place. The rest are listed here so the corrections are not lost:

Issue	Correction
#310	Part 1's target is deprecated. The gap reproduces in workflow-authoring, which binds zero graph ops — but the fix needs remapping onto four activities, not the three named. Part 4 (embeddings: 0) is not this repo.
#317	Both defects survived the rewrite: workflow-authoring/workflow.yaml:21-22 restates the auto-resolve licence and 06-scope-and-draft.yaml:44 carries autoAdvanceMs: 30000. Live against a live workflow.
#319	Group 1's "deferred as moot" prediction is now fact. Everything else re-verified live.
#320	Header says PR #318 is open — it merged. C-1 is fixed by #328. C-2 is half-stale: the three names are now declared at meta/workflow.yaml:41,44,47, so the literal-fallthrough mechanism is gone and only the no-producer half stands. C-3 is half-stale: usage landed in #329; only _meta.trace_token remains. B-3 is fixed by construction. Groups A and B die with workflow-design.
#321	Largely delivered — re-scope to the retirement trigger.
#336	The ledger reads 123 as of b41aaacc, but the real debt is still 125: two workflow-design entries were pruned because #342's masking defect made them invisible, not because they closed. The distribution table's workflow-design row moves 3/4 → 3/2 for the same reason.

---

Related

• GitNexus use optimisation: workflow-design binds no graph ops, plus three undocumented index caveats #310, Workflow operation is admin-only: engineering branch protection vs commit-and-persist, and the branch mixes two trust classes #316, Soft mid-flow checkpoints self-resolve without presentation, and autoAdvanceMs is never enforced #317, Outstanding and deferred items from the review-mode friction continuation session #319, Follow-ups from the requirements-refinement design session (PR #318): workflow-design decision machinery, meta binding gaps, and 9 open F-items #320, Cut workflow-design to a minimal shape: settled as a new additive workflow (workflow-authoring), not an in-place rename #321, Corpus binding debt: close the 125 fix-later seams #327 triaged #336, Server backlog: unfinished work from #189, #232, #322, #323, #324 #337, Corpus backlog: unfinished work from #189, #232, #323, #324 #338, Guard reach: a gate expression is counted as consumption but never resolved #341, Guard reach: dead-output resolves consumers across workflow boundaries, so duplicate technique names mask real seams #342 — everything routed here.
• b41aaacc — the pointer bump that surfaced Guard reach: dead-output resolves consumers across workflow boundaries, so duplicate technique names mask real seams #342 and the stale-count correction to Corpus binding debt: close the 125 fix-later seams #327 triaged #336.