actions: bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6

.github/workflows/codeql.yml

@@ -23,22 +23,6 @@
 # top and granted per job, every action pinned to a commit with its version in a
 # comment, and checkout without persisted credentials. The one write scope here
 # is security-events, which is what uploading the results needs and nothing more.
-#
-# The version in that comment is the exact one the pinned commit is tagged as,
-# never the major. Both spellings leave the same commit running, so the whole
-# difference is in what the comment claims. A comment reading v4 is a claim about
-# a reference upstream moves, and it stops being true on the day upstream tags a
-# release without anybody here touching a file; an exact version is a claim about
-# the commit written next to it, which cannot go stale on its own. The two steps
-# below carried a major until this comment landed, and were the only two sites in
-# this tree that did. The command that says so prints nothing now, and printing
-# nothing is the state to keep it in:
-#
-#   git grep -nE 'uses: .*@[0-9a-f]{40} # v[0-9]+$' -- .github/workflows/
-#
-# The audit in zizmor.yml reads the comment against the tags the pinned commit
-# carries and fails the build on a mismatch, so the spelling is held by a check
-# rather than by memory.
 name: CodeQL
 
 on:

.github/workflows/scorecard.yml

@@ -90,7 +90,7 @@ jobs:
 
       # Surface the findings in the code-scanning tab, alongside CodeQL and zizmor.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
           category: scorecard

.github/workflows/zizmor.yml

@@ -11,20 +11,13 @@
 # regular persona is the one zizmor documents for CI ("high-signal, low-noise,
 # actionable"). The pedantic persona is deliberately NOT used to gate: it adds
 # low-severity hygiene findings (undocumented permissions, missing concurrency,
-# unnamed jobs) that are stylistic, not security-blocking, and some are
-# context-blind (it would demand run-cancelling concurrency on a publishing
-# workflow, which must never be cancelled mid-publish). Those findings are not
-# gated here, and no issue on this tracker collects them today.
-#
-# A pin comment that disagrees with the commit beside it is NOT in that set. This
-# line listed it as a pedantic hygiene finding and that was wrong: the regular
-# persona reports ref-version-mismatch at medium, so the step below fails the
-# build on one. Two of them did exactly that on every pull request against this
-# board, which is what corrected this sentence.
+# pin-comment mismatches, unnamed jobs) that are stylistic, not security-blocking,
+# and some are context-blind (it would demand run-cancelling concurrency on a
+# publishing workflow, which must never be cancelled mid-publish). Those findings
+# are not gated here, and no issue on this tracker collects them today.
 #
 # Rule for future workflow changes: every new or edited workflow must pass this
-# gate before merge. Keep actions SHA-pinned, comment each pin with the exact
-# version its commit is tagged as rather than the major, keep checkout on
+# gate before merge. Keep actions SHA-pinned, keep checkout on
 # persist-credentials:false, grant write permissions per job (never
 # workflow-level), and never restore a cache in a job that publishes a release.
 name: Workflow Security Analysis
@@ -82,7 +75,7 @@ jobs:
         # skip the "Fail on actionable findings" step below.
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
           category: zizmor

README.md

@@ -60,9 +60,3 @@ There is no licence file. That is not a neutral state, since without one nobody
 has permission to reuse anything here, and it is the first entry of the open
 question that collects the decisions this plan does not take. Until it is
 answered, treat everything on this board as readable and not as reusable.
-
-## License
-
-AGPL-3.0, copyright 2026 Nils Lehnen.
-
-The full text is in [LICENSE](LICENSE).

docs/operator-guide.md

@@ -148,27 +148,16 @@ anything in the tree. Three ways to reach it, each printing to standard error:
 
     ./lab frobnicate
     lab: unknown verb "frobnicate"
-    (and then the help text, because the verb is not one it has)
 
     ./lab
     (the help text, because no verb was given)
 
-The help text is described rather than pasted in both of those, because a copy
-of it here drifts against the runner that prints it, and the runner is the
-thing a reader is checking.
-
 `3` is not a code this command returns. It belongs to the integration-hardware
 harness under `internal/hardware`, which is asked for separately, and it is
 declared where its only producer is:
 
-    git grep 'ExitAskedAndDeliveredNothing = ' -- internal/hardware
-    internal/hardware/hardware.go:const ExitAskedAndDeliveredNothing = 3
-
-That command carries no line number on purpose. With `-n` the paste names a
-line rather than a declaration, and an edit anywhere above the constant moves
-the line without changing anything the sentence claims, so the quotation goes
-stale while the claim it supports stays true. The file and the declaration are
-what the claim rests on and neither of them moves.
+    git grep -n 'ExitAskedAndDeliveredNothing = ' -- internal/hardware
+    internal/hardware/hardware.go:45:const ExitAskedAndDeliveredNothing = 3
 
 So the record fixes four codes, `lab` returns three of them, and a caller
 keyed on any of the four is reading that record whether or not anybody said so.