batch/0.70.0: 0.70.0 fold batch (#4352, #4020, #4062, …)

.claude/skills/apr-dogfood/SKILL.md

@@ -1591,7 +1591,7 @@ The nine clusters at zero, largest first: `http-orchestrate-banco` (95),
 `test-harness` (49), `rag-eval` (44), `qa-cgp` (37), `simulation` (18),
 `orchestrate-pacha-secrets` (17).
 
-**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 838 features gated (17.2%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
+**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 864 features gated (16.7%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
 
 The rule is about the NUMBER, not about a phrasing, and it is enforced on every
 surface that can emit one: the gate's own report, the receipt, the output of

.claude/skills/pr-review/SKILL.md

@@ -22,7 +22,7 @@ difference is a defect in this file.
 **Contract**: `contracts/pr-review-skill-v2.yaml` (§1 grounding, §7 blocking, §8 metrics)
 **Guard**: `scripts/check_pr_review_receipt.sh` — it validates what you emit here, it has
 its own positive controls, and its mutation set (`scripts/mutate-guard.sh`) reports
-233/233. **Run it on your own receipt before you post anything.**
+237/237. **Run it on your own receipt before you post anything.**
 
 ## Context
 
@@ -438,7 +438,7 @@ Bash guards are exercised with `bats-core` fixtures. For the receipt guard itsel
 mutation set already exists and is a derivation, not a list:
 
 ```bash
-bash scripts/mutate-guard.sh          # 233/233 on scripts/check_pr_review_receipt.sh
+bash scripts/mutate-guard.sh          # 237/237 on scripts/check_pr_review_receipt.sh
 ```
 
 **`attempted: 0` with `status: consulted` is rejected** (fixture row 2). A mutation set
@@ -1192,7 +1192,7 @@ the real merged commits, not from the spec's reasoning about them.
 ## §13 Autonomous merge on quorum (DESIGNED AND BUILT, **NOT ARMED**)
 
 Spec §13. Operator instruction, 2026-08-31: PRs auto-merge once the review quorum passes.
-The mechanism exists — `scripts/pr_review_quorum_arm.sh`, a table of 83 rows, a 134-mutant
+The mechanism exists — `scripts/pr_review_quorum_arm.sh`, a table of 90 rows, a 134-mutant
 set at 100% — and **it is reachable from no workflow that can merge anything.** §13.11 is
 the arming ladder; rung 0 is where this file is written.
 
@@ -1345,7 +1345,7 @@ That is the first falsifiable property of the section, and `q-44` plus the
 ### §13.9 Verifying the mechanism
 
 ```bash
-bats tests/pr-review-quorum.bats            # 83 rows: one per refusal path, four that PERMIT
+bats tests/pr-review-quorum.bats            # 90 rows: one per refusal path, four that PERMIT
 bash scripts/mutate_quorum_arm.sh           # 134/134 — §13.10 fixes this at one, no ratchet
 bash scripts/mutate_quorum_arm.sh --list    # the catalogue, no mutants run
 ```

.github/actionlint.yaml

@@ -24,3 +24,5 @@ self-hosted-runner:
     - apple-silicon
     - m4
     - mini
+    # #4292 / infra#1042: the mini's dedicated repo-level release runner
+    - mini-builder

.github/workflows/book-contracts.yml

@@ -39,6 +39,15 @@ on:
   schedule:
     - cron: '45 22 * * *'
 
+
+# #3676: no concurrency group meant every superseded PR push ran the ~18 min
+# chapter suite to completion. Sampled 24 h to 2026-09-24 19:15Z: ~1650 of ~3700
+# wall-minutes of this workflow's pull_request runs came after a newer push
+# to the same PR had already started. Same shape as ci.yml: one group per PR, a
+# new push cancels the old run, and push/schedule runs are never cancelled.
+concurrency:
+  group: book-contracts-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
   contents: read
 

.github/workflows/book.yml

@@ -60,9 +60,14 @@ permissions:
   pages: write
   id-token: write
 
+# #3676: one group per PR, and a newer push cancels the superseded run. The old
+# workflow-level group "pages" (cancel false) held EVERY run -- all PRs, main and
+# the nightly -- in one global queue, so each PR's mdBook check waited behind
+# every other PR's. Only the Pages deploy needs that serialisation, so the
+# "pages" group now sits on the deploy job alone. Non-PR events never cancel.
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: book-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
@@ -203,6 +208,10 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # GitHub Pages deploys never overlap and are never cancelled (was workflow-level).
+    concurrency:
+      group: "pages"
+      cancel-in-progress: false
     permissions:
       pages: write
       id-token: write