Say that the pin this gate waits for is here, and that the revisit is untaken

[iderex]

The issue this belongs to

Closes #408

What changed

The paragraph in .github/lint/lint.sh that explains why the nursery lint group
is not denied now names rust-toolchain.toml and the component list that puts
clippy inside the pin, says that the upgrade it guards against is a commit to
that file rather than a runner image moving underneath the gate, and says that the
revisit it asks for is available and has not been taken. It also says what it
claimed before and how that was found.

Whether nursery is denied now is deliberately NOT decided here. That is the
revisit itself, it is a judgement about how strict this gate is, and taking it
inside a correction to a comment would settle it without anybody deciding it.

No rule, register entry, denied group, threshold or setting of this leg changes.
Every added line is a comment.

What failure it prevents

A revisit condition staying invisible after it is met. This file is where the
condition is set and is therefore where a reader checks it, so a stale one here
holds the question open indefinitely with nothing saying it has become answerable.
The condition has been met for twenty-three days and the only thing that could
have said so was saying the opposite.

This is a correction and the failure has already happened. What was wrong: the
paragraph said "the version this repository builds with is not even pinned yet,
which is #14" and closed with "It is worth revisiting once it is". How it was
found: by reading it against the other sites under .github/ that name #14, every
one of which reads the pin as landed.

Evidence

Read at 28537c6c5f1d5bda1dc14c8ac2f8d64f3d8e6ef1, which is the base of this
branch. The head being pushed is ff09a87.

The sentence as it stood.

git rev-parse origin/main
28537c6c5f1d5bda1dc14c8ac2f8d64f3d8e6ef1
git show 28537c6c:./.github/lint/lint.sh | sed -n '45,48p'
# `nursery` holds lints the analyser's own authors describe as still under
# development. Denying them means a toolchain upgrade can redden this gate for a
# lint nobody finished, and the version this repository builds with is not even
# pinned yet, which is #14. It is worth revisiting once it is.

The pin it says is absent, and that clippy is inside it.

git show 28537c6c:rust-toolchain.toml | tail -4
[toolchain]
channel = "1.98.0"
components = ["clippy", "llvm-tools", "rustfmt"]
profile = "minimal"
gh api repos/Flowfin/core/issues/14 --jq '"#14 \(.state) \(.state_reason) closed \(.closed_at)"'
#14 closed completed closed 2026-08-25T15:16:08Z
git grep -n 'cargo clippy --all-targets' 28537c6c -- .github/lint/lint.sh
28537c6c:.github/lint/lint.sh:238:  cargo clippy --all-targets -- -D warnings $deny $args

It held for under ten hours.

git log -S'not even' --format='%h %aI %s' 28537c6c -- .github/lint/lint.sh
3b236ce 2026-08-25T07:35:48+02:00 Analyse the tree with the language's own analyser (#17)
git log --diff-filter=A --format='%h %aI %s' 28537c6c -- rust-toolchain.toml
74812d3 2026-08-25T17:16:06+02:00 Pin the toolchain in the tree, and refuse another one (#14) (#188)
git merge-base --is-ancestor 3b236ce 74812d3 ; echo "exit=$?"
exit=0

The order is the lint change first, then the pin, and the change that landed the
pin did not open this comment:

git show 74812d3 --stat --format='' | grep -c '.github/lint/lint.sh' ; echo "exit=$?"
0
exit=1

The phrase survives at this head only as a quotation inside the correction, and
nothing at this head asserts it.

git grep -n 'not even pinned' HEAD -- .github/
HEAD:.github/lint/lint.sh:54:# THIS PARAGRAPH SAID THE VERSION WAS "not even pinned yet, which is #14", AND

That is the one occurrence, it is the sentence reporting what was wrong, and the
negative disclosure is kept rather than deleted so a later reader meets the
correction instead of a paragraph that was always right.

The register fixtures still hold at this head, which is what proves the parser
still reads this file the same way.

bash .github/lint/lint.sh selftest | tail -1
Every fixture held. The rules the gate applies are the rules these fixtures ran.

The paths this change touches.

git diff --name-only origin/main...HEAD
.github/lint/lint.sh

The means. The change is prose in the comment header of a shell script, in the
format that file already is. It adds no language, no runtime and no dependency.

What this does not cover

• Whether nursery should now be denied. That is the revisit, it is a
  judgement nobody has taken, and this change writes down that it is available
  rather than taking it. The paragraph says so in those words.
• The restriction group. Its reason does not depend on the pin and is not
  read or edited here.
• Whether the lint leg should compare the compiler that ran against the pin.
  .github/toolchain/toolchain.sh holds that comparison and build.yml runs it.
  Whether lint should too is a separate question and is not asked here.
• Any other claim in .github/lint/lint.sh. I read the paragraph about the
  two undenied groups. That is a sweep of one paragraph rather than of the file.
• The shell analyser. shellcheck is not installed on the machine this was
  written on, so .github/shell-analysis/shell-analysis.sh could NOT be run
  here - it refused with shellcheck: command not found. That leg's verdict on
  this change is whatever its run on this pull request reports, and I have not
  predicted it. The change adds only comment lines, which is a reason to expect
  it to pass and is not a measurement of it.
• The other legs. I ran .github/lint/lint.sh selftest on this machine and
  nothing else. The rest is what this pull request's own runs report.

Who has read it

Nobody other than the author has read this change. There is no second reader on
this board tonight, and the evidence above stands in place of one rather than the
question being left open.