From 7805ab855360b93664e3b4249728788ce675a82a Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 27 Sep 2026 04:48:15 +0000
Subject: [PATCH 1/3] docs(audit): refresh citations after main rewrite;
 glmGamPoi notices

main was rewritten to a new root (4c2c79e, PR #83) that shares no history
with the revision this audit was written against (4a848da), and the audited
code moved: Execution.jl +125/-60, estimation.jl +231/-29. ilr_basis.jl,
analysis.jl, provenance.jl and bench/ilr_bases/benchmark.jl are
byte-identical, so their citations are untouched.

Re-verifies all 21 findings against the new tree -- the four headline ones
(M3 dead clr_table, M4 redundant copies, N1 mixed healing scales, W1
is_dangerous not updated on :not_run) by reading the new code rather than
trusting the old line numbers -- and re-locates every citation into the two
files that moved.

Also corrects the catalogue for work that landed after the audit:
glmGamPoi dispersion is now a pure-Julia port (SUPPORTED_DISPERSION gains
"glmgampoi"; only local/mean/pooled remain refused), so
estimation.dispersion_refused no longer says "use parametric" for it. Adds
three entries: the port itself, its unported spline abundance trend, and
its pass-1 fallback; and records in the audit that two pure-Julia kernels
now exist, which bears on question 10 without changing the gate (CI still
has no verdict on any of this code).

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 ...026-09-26-memory-numerics-warning-audit.md | 118 ++++++++++++------
 docs/notices/catalogue.md                     |  25 ++--
 2 files changed, 94 insertions(+), 49 deletions(-)

diff --git a/docs/audit/2026-09-26-memory-numerics-warning-audit.md b/docs/audit/2026-09-26-memory-numerics-warning-audit.md
index 00a1a72..88abe38 100644
--- a/docs/audit/2026-09-26-memory-numerics-warning-audit.md
+++ b/docs/audit/2026-09-26-memory-numerics-warning-audit.md
@@ -12,6 +12,48 @@ Appendix A so each number can be re-derived.
 **Revision audited:** `main` @ `4a848da` (branch `arena/01a0de46-metamanifold-webui`,
 clean tree at audit time).
 
+## Revision note — 2026-09-27, after this audit landed
+
+This document was written against `main` @ `4a848da`. `main` has since been
+rewritten to a **new root** (`4c2c79e`, PR #83) that shares no history with
+`4a848da` — `git merge-base` returns nothing — and the audited code moved with
+it. On 2026-09-27 every finding was re-checked against `4c2c79e`:
+
+| file | state | effect on citations |
+|---|---|---|
+| `src/analysis/ilr_basis.jl` | byte-identical | none |
+| `src/analysis/analysis.jl` | byte-identical | none |
+| `src/core/provenance.jl` | byte-identical | none |
+| `bench/ilr_bases/benchmark.jl` | byte-identical | none |
+| `src/analysis/Execution.jl` | +125 / −60 | every citation re-located |
+| `src/analysis/estimation.jl` | +231 / −29 | every citation re-located |
+
+**All 21 findings still reproduce.** The four headline ones were re-verified by
+reading the new code, not by trusting the old line numbers: M3 (`clr_table` is
+still written at 1164 and read only for its dimensions at 1167, 1182, 1183), M4
+(`copy(counts)` at 840, two composable row slices at 858 and 868,
+`counts_after_zero = copy(filtered_counts)` at 989, `prepared =
+copy(counts_after_zero)` at 1062), N1 (`heal_nan_inf` still writes `epsilon` at
+603 and `log(1/epsilon)` at 608), and W1 (`is_dangerous =
+diagnostics.is_dangerous` at 1682, still copied from the pre-estimation
+diagnostics).
+
+Two things landed after the audit that bear on it:
+
+1. **`glmGamPoi` dispersion is now implemented** (issue #21), as a pure-Julia
+   port in `src/analysis/dispersion.jl` (1 163 lines) driven by a two-pass fit.
+   `SUPPORTED_DISPERSION = ("parametric", "glmgampoi")`; only `local`, `mean`
+   and `pooled` remain refused. The catalogue entry
+   `estimation.dispersion_refused` was written when all four were refused and
+   has been corrected; three entries have been added for the port, its
+   unported spline trend, and its pass-1 fallback.
+2. **There are now two pure-Julia kernels, not one** (`dispersion.jl`,
+   `zero_replacement.jl`). This strengthens the answer to question 10 without
+   changing the gate: both still need what `ILRBasis` already has — a published
+   conditions document, an independent oracle, and a stated parity tolerance —
+   before any accelerated backend is contemplated. CI still has no recorded
+   verdict on any of them (B1).
+
 ## What I could and could not run
 
 | | |
@@ -78,7 +120,7 @@ check ran and found nothing".
 Two rules fall out of the table and both are violated today:
 
 - **A check that did not run is `technical_resource`, not `data_quality`.**
-  `check_batch_confounding` (Execution.jl:500-518) always returns
+  `check_batch_confounding` (Execution.jl:504-522) always returns
   `has_batch_confounding => false`; that is `technical_resource` ("this check is
   a stub") and must never render as "no confounding detected" (**N3**).
 - **A result with no statistics is `result_safety`, and it blocks export even
@@ -97,7 +139,7 @@ boundary).
 
 ### M1 — The default Helmert ILR basis is O(D²·n) in allocation, and the O(D·n) replacement is already in the tree `severity: notice · category: technical_resource`
 
-`Execution.jl:1188` — `mean_first_i = mean(log_col[1:i])` inside
+`Execution.jl:1191` — `mean_first_i = mean(log_col[1:i])` inside
 `for i in 1:(n_taxa-1)`, inside `for j in 1:size(clr_table, 2)`.
 
 `log_col[1:i]` is a fresh `Vector{Float64}` of length `i`, allocated and summed
@@ -110,7 +152,7 @@ transform allocates **4·n·D·(D−1) bytes**:
 | 1 500 × 40 (the regression-gate workload) | 360 MB |
 | 10 000 × 20 (the benchmark's largest size) | **8.0 GB** |
 
-The comment at `Execution.jl:1175-1177` says the default loop is "left exactly
+The comment at `Execution.jl:1178-1180` says the default loop is "left exactly
 as it was so that no default-basis result moves", which was the right call for
 the PR that changed everything around it. But the engine it is protecting
 against drift from is in the same repository, is pure Julia, and is already
@@ -160,7 +202,7 @@ one-constant change and is the safer first step.
 
 ### M3 — The ILR branch builds a D×n CLR table and never reads a single value from it `severity: notice · category: technical_resource`
 
-`Execution.jl:1154-1180`:
+`Execution.jl:1157-1183`:
 
 ```
 clr_table = similar(counts_after_zero)   # 1154  — D×n Float64
@@ -191,8 +233,8 @@ refusal behaviour, one fewer `D×n` matrix.
 | 840 | `filtered_counts = copy(counts)` | **no** — only read to compute prevalence/abundance, then replaced at 858 |
 | 858 | `filtered_counts = filtered_counts[keep_taxa, :]` | yes |
 | 868 | `filtered_counts = filtered_counts[top_indices, :]` | yes, but composable with 858 into one slice |
-| 1059 | `prepared = copy(counts_after_zero)` | only for `clr` (writes in place at 1147) and `rarefy` (1233); every other branch reassigns `prepared` before reading it |
-| 1161 | `clr_table` (see M3) | no |
+| 1062 | `prepared = copy(counts_after_zero)` | only for `clr` (writes in place at 1150) and `rarefy` (1236); every other branch reassigns `prepared` before reading it |
+| 1164 | `clr_table` (see M3) | no |
 
 For a 20 000-taxon input filtered to 10 000 taxa over 200 samples the peak drops
 from ~107 MiB to ~76 MiB by removing the dead copy, the composable slice and
@@ -313,7 +355,7 @@ a linear scale. Both branches run on the same table. Consequences:
   proportions table.
 
 Two arbitrary sentinel values, chosen by an inconsistency, written into the
-table that is then fitted. The counts are recorded (`Execution.jl:1306`) but not the values, so nothing downstream can tell.
+table that is then fitted. The counts are recorded (`Execution.jl:1321`) but not the values, so nothing downstream can tell.
 
 **Change (low risk, and a decision the owner should make explicitly):** pick the
 rule per transform scale and record it. The honest options are (a) refuse
@@ -333,7 +375,7 @@ Question 7, answered: **self-healing changes data, not metadata.**
 | … with `DROP` | removes rows/columns, so the result table has a different shape **and** the surviving taxa/samples are renumbered |
 
 All three are recorded — `diagnostics.healings`, and again in
-`provenance["diagnostics"]["healings"]` (`Execution.jl:1676-1679`). What is
+`provenance["diagnostics"]["healings"]` (`Execution.jl:1703-1706`). What is
 recorded is a **sentence with a count**:
 `"Healed 3 NaN and 0 Inf with epsilon=1e-6"`. There is no record of *which*
 cells, so a healed value is indistinguishable from a measured one in the result
@@ -342,12 +384,12 @@ table, and two runs with the same input and the same count can differ.
 **Change (low risk, additive):** alongside each healing entry, record a compact
 fingerprint of what changed — the affected `(row, col)` positions when they are
 few, otherwise a count plus a SHA-256 of the position bitmap. The prepared-table
-hash (`Execution.jl:740`) already exists as a precedent for fingerprinting a
+hash (`Execution.jl:737`) already exists as a precedent for fingerprinting a
 matrix. **Belongs in:** MetaManifold.
 
 ### N3 — A check that always reports "no problem" `severity: warning · category: technical_resource`
 
-`Execution.jl:500-518`: `check_batch_confounding` returns
+`Execution.jl:504-522`: `check_batch_confounding` returns
 `has_batch_confounding => false` unconditionally, with
 `note => "Stub: real implementation would check correlation between batch and
 group via chi-square or ANOVA"`.
@@ -366,7 +408,7 @@ the record that it is owed. **Belongs in:** MetaManifold.
 | where | what it does |
 |---|---|
 | `diversity.jl:55-85` (`rarefy`) | genuine without-replacement subsampling: a pool of one entry per read, partial Fisher–Yates, `depth` draws |
-| `Execution.jl:1225-1234` (`normalization.method = "rarefy"`) | `prepared[:, j] = counts_after_zero[:, j] .* (min_lib / lib_sizes[j])` — a comment at line 1230 says *"For stub, rarefy by subsampling proportionally to min_lib (not exact, just scaling)"* |
+| `Execution.jl:1228-1237` (`normalization.method = "rarefy"`) | `prepared[:, j] = counts_after_zero[:, j] .* (min_lib / lib_sizes[j])` — a comment at line 1233 says *"For stub, rarefy by subsampling proportionally to min_lib (not exact, just scaling)"* |
 
 Both are reachable from the product: the catalogue
 (`docs/statistics/method-catalogue-v1.md:32`) lists `rarefy` under
@@ -425,7 +467,7 @@ repo settings. Recorded here because it gates everything in Part 5.
 
 ### B2 — RCall holds a second copy of the prepared table, and the cleanup is on the success path only `severity: warning · category: dependency_environment`
 
-`estimation.jl:458` `RCall.globalEnv[:est_counts] = prepared` copies the whole
+`estimation.jl:473` `RCall.globalEnv[:est_counts] = prepared` copies the whole
 `features × samples` matrix into R's global environment; Julia's `prepared` is
 still live. Peak is 2× the largest object for the duration of the fit.
 
@@ -481,17 +523,17 @@ carried rather than re-derived. **Belongs in:** MetaManifold.
 ### B4 — The provenance inventory does not include the package the estimator requires `severity: warning · category: dependency_environment`
 
 - `provenance.jl:303` — `const R_PACKAGES = ["dada2", "Biostrings", "ShortRead", "vegan"]`.
-- `estimation.jl:675` — `suppressPackageStartupMessages(library(MASS))`. **`MASS`
+- `estimation.jl:838` — `suppressPackageStartupMessages(library(MASS))`. **`MASS`
   is not in `R_PACKAGES`.** It *is* pinned in `renv.lock` (81 packages, `MASS`
   present), so this is an inventory gap, not a missing pin.
 - Consequence: `probe_r` can return `:ok` — *every required package present* —
   on a machine where the estimator will fail on its first line. The failure
-  does land in the right place (`estimation.jl:492` → `_not_run` with
+  does land in the right place (`estimation.jl:553` → `_not_run` with
   `"the fit could not be run: …"`) but it lands *after* provenance has declared
   the environment ready.
 - Separately, `Execution.jl:133` — `RAdapter(; r_packages = String["DESeq2", "edgeR"])`.
   **Neither is in `renv.lock`.** Those names are copied into the manifest
-  (`Execution.jl:1419`) as `adapter_config.r_packages`, so the manifest
+  (`Execution.jl:1434`) as `adapter_config.r_packages`, so the manifest
   asserts a dependency the pinned environment does not provide and nothing
   verifies.
 
@@ -503,7 +545,7 @@ list. **Belongs in:** MetaManifold.
 
 ### B5 — R-side warnings raised outside the per-feature handler never reach the manifest `severity: notice · category: technical_resource`
 
-`estimation.jl:741-748` wraps each fit in
+`estimation.jl:942-949` wraps each fit in
 `withCallingHandlers(..., warning = function(w) { warns <<- …; invokeRestart("muffleWarning") })`
 and folds the captured text into `est_note[i]`. That is a **capture**, not a
 suppression, and it is done well: a `glm.nb` "iteration limit reached" becomes a
@@ -524,7 +566,7 @@ MetaManifold.
 
 `Execution.jl:159-178` defines `JuliaAdapter(method, use_multithreading, seed,
 optimizer)`. `run_analysis` uses the adapter for exactly two things: the method
-match check (`Execution.jl:1580`) and `seed` (`1636`). Estimation always goes
+match check (`Execution.jl:1607`) and `seed` (`1663`). Estimation always goes
 through `Estimation.estimate_models`, i.e. R. There is no pure-Julia estimator
 to serve as a reference path (question 10 — qualified in Part 2).
 
@@ -537,7 +579,7 @@ one. **Belongs in:** MetaManifold.
 
 ### W1 — A run that produced no statistics is reported as safe `severity: danger · category: result_safety`
 
-`Execution.jl:1641-1658`:
+`Execution.jl:1657-1685`:
 
 ```
 outcome = Estimation.estimate_models(…)          # may return :not_run
@@ -555,7 +597,7 @@ The reason *is* recorded, in two places (`warnings` and
 `checks["estimation"]`), which is the good half. The other half:
 `is_dangerous` and `banner` are copied from the pre-estimation diagnostics, so
 they do not know that nothing was fitted. And
-`log_danger_banner_execution` runs **before** estimation (`Execution.jl:1619`),
+`log_danger_banner_execution` runs **before** estimation (`Execution.jl:1646`),
 so the log line for such a run is:
 
 ```
@@ -581,8 +623,8 @@ Question 8, answered in three parts:
 |---|---|---|
 | healings | `diagnostics.healings`, `provenance["diagnostics"]["healings"]` | **preserved** (counts only — see N2) |
 | warnings | `diagnostics.warnings`, `provenance["diagnostics"]["warnings"]` | **preserved** |
-| ILR basis warnings + DANGER reasons | `checks["ilr"]`, appended to `warnings` after `self_diagnostics` (`Execution.jl:1290-1295`, `1372-1400`) | **preserved**, with a comment explaining why the append must happen after |
-| scaling warnings | `checks["scaling"]` + `append!(warnings, scaling.warnings)` (`Execution.jl:1286-1289`, with a comment about not being clobbered) | **preserved** |
+| ILR basis warnings + DANGER reasons | `checks["ilr"]`, appended to `warnings` after `self_diagnostics` (`Execution.jl:1278-1279`, `1383-1398`) | **preserved**, with a comment explaining why the append must happen after |
+| scaling warnings | `checks["scaling"]` + `append!(warnings, scaling.warnings)` (`Execution.jl:1255-1256`, with a comment about not being clobbered) | **preserved** |
 | estimation `:not_run` | `checks["estimation"]` + a warning | **preserved in the record, invisible to `is_dangerous`** (W1) |
 | **a disabled analysis** (vegan absent → no NMDS/PERMANOVA) | `@warn` in the log, and a 503/500 from the route | **not in any manifest** — chart routes have no manifest at all |
 | **a degraded chart** (boxplot with no significance annotations) | caption text `_significance_caption` | **preserved for alpha only** |
@@ -666,8 +708,8 @@ intercepted:
 |---|---|
 | `bench/ilr_bases/benchmark.jl:108`, `regression_gate.jl:62`, `test/unit/test_provenance.jl:262`, `src/doi/Zenodo.jl:33` | `NullLogger` around a measured or network block — benchmark noise, not a warning policy |
 | `src/server/server.jl:216` | `_SuppressEpipe(global_logger())` — filters broken-pipe errors from HTTP handlers only |
-| `estimation.jl:741-748` | R `muffleWarning` around a single fit — **captures** the warning text into `est_note[i]`, so nothing is lost |
-| `analysis.jl:1031`, `estimation.jl:674` | `suppressWarnings(friedman.test(...))`, `suppressPackageStartupMessages` — targeted to one call each |
+| `estimation.jl:942-949` | R `muffleWarning` around a single fit — **captures** the warning text into `est_note[i]`, so nothing is lost |
+| `analysis.jl:1031`, `estimation.jl:838` | `suppressWarnings(friedman.test(...))`, `suppressPackageStartupMessages` — targeted to one call each |
 
 None is a global suppression. `run_nmds`'s `tryCatch(..., error = function(e) NULL)`
 at `analysis.jl:1026-1034` is the closest thing to a silent swallow — it discards
@@ -719,7 +761,7 @@ use views in `check_prevalence_abundance` and the two `check_all_zero_*` loops.
    kernel matters (**M8**). Nothing here needs a new library.
 
 4. **Does RCall duplicate large data structures?** Yes, in two ways. Inherently:
-   `RCall.globalEnv[:est_counts] = prepared` (`estimation.jl:458`) copies the
+   `RCall.globalEnv[:est_counts] = prepared` (`estimation.jl:473`) copies the
    whole table into R while Julia keeps its own, so peak is 2× the largest
    object for the duration of the fit. Avoidably: the `rm(...); gc()` that
    releases it is inside the `try`, so any throw leaks it for the process
@@ -759,7 +801,7 @@ use views in `check_prevalence_abundance` and the two `check_all_zero_*` loops.
 9. **Does a missing R package cause a clear "not run" rather than a plausible
    replacement?** For the *estimator*, yes — `Estimation` returns
    `EstimationOutcome(:not_run, reason, …)` with an empty `results`
-   (`estimation.jl:263-275`, `488-495`), and there is deliberately no fourth
+   (`estimation.jl:276-283`, `549-556`), and there is deliberately no fourth
    status meaning "something plausible was produced". For the *ordination and
    significance* layer, no — four different behaviours, one of which is a
    NaN-filled coordinate matrix (**B3**). And the provenance probe does not
@@ -793,7 +835,7 @@ Category key: **T** technical/resource · **D** dependency/environment ·
 | id | site | today | category | sev | action |
 |---|---|---|---|---|---|
 | `ilr.part_weights_unused_kinds` | `ilr_basis.jl:976` | silent | T | info | compute only the selected kind |
-| `exec.prepared_copy_unused` | `Execution.jl:1059` | silent | T | info | move the copy into `clr`/`rarefy` |
+| `exec.prepared_copy_unused` | `Execution.jl:1062` | silent | T | info | move the copy into `clr`/`rarefy` |
 | `exec.counts_copy_unused` | `Execution.jl:840` | silent | T | info | drop |
 | `bench.phase_undecomposed` | `bench/ilr_bases/benchmark.jl:70` | `::warning` | T | notice | phase the measurement |
 | `analysis.r_unavailable_relogged` | `analysis.jl:1000` | `@warn` per call | D | notice | memoise |
@@ -803,10 +845,10 @@ Category key: **T** technical/resource · **D** dependency/environment ·
 | id | site | today | category | sev | action |
 |---|---|---|---|---|---|
 | `ci.no_verdict` | `.github/workflows/ci.yml` | none | D | **fatal** | owner action; blocks the whole gate |
-| `r.package_not_probed` (`MASS`) | `provenance.jl:303` vs `estimation.jl:675` | none | D | warning | add `MASS` to `R_PACKAGES` |
+| `r.package_not_probed` (`MASS`) | `provenance.jl:303` vs `estimation.jl:838` | none | D | warning | add `MASS` to `R_PACKAGES` |
 | `r.adapter_packages_unpinned` | `Execution.jl:133` | manifest claims them | D | warning | default to pinned packages; mark verified |
-| `r.est_counts_leaked_on_error` | `estimation.jl:478` | none | D | warning | clean up in `finally` |
-| `r.warning_outside_handler` | `estimation.jl:741` | process log only | T | notice | collect into diagnostics |
+| `r.est_counts_leaked_on_error` | `estimation.jl:535` | none | D | warning | clean up in `finally` |
+| `r.warning_outside_handler` | `estimation.jl:942` | process log only | T | notice | collect into diagnostics |
 | `r.unavailable` | `analysis.jl:1005` | `@warn` | D | warning | return `RProbeStatus`, record as a notice |
 | `r.busy` | `analysis.jl:617`, `1023` | `@warn` / unhandled | D | warning | catch in both ordination paths |
 
@@ -819,28 +861,28 @@ Category key: **T** technical/resource · **D** dependency/environment ·
 | `ilr.balance_weights_not_isometric` | `ilr_basis.jl:1291` | in `checks` only | M | warning | *"effect sizes change, per-balance test statistics do not"* |
 | `ilr.pruned_tips` | `ilr_basis.jl:1225` | warning string | M | warning | |
 | `ilr.zero_length_tip_edges_replaced` | `ilr_basis.jl:1271` | warning string | M | warning | |
-| `exec.rarefy_discouraged` | `Execution.jl:1220` | `@warn` + DANGER | M | danger | see N4 — the method is not rarefaction |
+| `exec.rarefy_discouraged` | `Execution.jl:1223` | `@warn` + DANGER | M | danger | see N4 — the method is not rarefaction |
 | `config.pseudocount_unusual` (≥1, <0.1) | `AnalysisConfig.jl:182`, `401-404` | `@warn` | M | warning | |
 | `config.epsilon_extreme` | `AnalysisConfig.jl:212`, `412-415` | `@warn` | M | warning | |
 | `config.css_quantile_below_median` | `AnalysisConfig.jl:229` | `@warn` | M | warning | |
 | `config.tmm_trims_zero` | `AnalysisConfig.jl:240` | `@warn` | M | warning | |
 | `config.parameter_inert` (`css_quantile` / `tmm_*` with a method that ignores them) | `AnalysisConfig.jl:249-252` | `@warn` | M | warning | a recorded parameter that does nothing |
 | `scaling.*` (CSS quantile, TMM undefined, RLE zero features) | `scaling.jl:214`, `342`, `348`, `410`, `416` | warning strings | Q | warning | already well worded |
-| `estimation.boundary_theta` / `separation` | `estimation.jl:786-799` | row `status = "boundary"` | M | warning | correctly not counted as `ok` |
+| `estimation.boundary_theta` / `separation` | `estimation.jl:979-995` | row `status = "boundary"` | M | warning | correctly not counted as `ok` |
 
 ## Possible correctness risks
 
 | id | site | risk | category | sev |
 |---|---|---|---|---|
-| `estimation.not_run_reported_safe` | `Execution.jl:1641-1658` | zero results, `is_dangerous = false`, log says "safe" | R | **danger** |
+| `estimation.not_run_reported_safe` | `Execution.jl:1657-1685` | zero results, `is_dangerous = false`, log says "safe" | R | **danger** |
 | `nmds.nan_filled_result` | `analysis.jl:1020` | a full-size NaN coordinate matrix is a plausible-looking result | R | **danger** |
 | `permanova.reason_discarded` | `analysis.jl:1086-1091` | `nothing` conflates three distinct causes | R | warning |
 | `exec.batch_confounding_stub` | `Execution.jl:500` | renders as "no confounding found" | T | warning |
 | `heal.nan_inf_scale_mixed` | `Execution.jl:600-616` | writes out-of-scale values into the fitted table | R | **danger** |
 | `heal.positions_unrecorded` | `Execution.jl:706` | healed cells indistinguishable from measured ones | R | warning |
-| `exec.rarefy_is_scaling` | `Execution.jl:1225-1234` | fractional counts into a count model, under the name "rarefy" | M | **danger** |
+| `exec.rarefy_is_scaling` | `Execution.jl:1228-1237` | fractional counts into a count model, under the name "rarefy" | M | **danger** |
 | `ilr.dendrogram_threshold_half` | `ilr_basis.jl:1250-1252` | refuses at a reported 2 GiB that is really 4 GiB | T | warning |
-| `ilr.helmert_quadratic` | `Execution.jl:1188` | 8 GB of churn at the benchmark's largest size; not a wrong answer, but a wall | T | notice |
+| `ilr.helmert_quadratic` | `Execution.jl:1191` | 8 GB of churn at the benchmark's largest size; not a wrong answer, but a wall | T | notice |
 
 ---
 
@@ -885,7 +927,7 @@ These are infrastructure. They have large, boring test matrices (allocation
 bounds, streaming edge cases, concurrency) that would drown a statistics suite,
 and no scientific semantics of their own.
 
-1. **The R hand-off protocol.** The 2× copy at `estimation.jl:458` is inherent
+1. **The R hand-off protocol.** The 2× copy at `estimation.jl:473` is inherent
    to RCall. A zero-copy or shared-memory hand-off (Arrow C data interface, or
    a shared array for the duration of the fit) belongs here, together with the
    session-pool problem implied by `r_runtime.jl` (one embedded interpreter for
@@ -991,7 +1033,7 @@ asking a kernel library to make it faster.
 
 `Float64 = 8 bytes`. All figures DERIVED from source, not measured.
 
-**A1. Default Helmert allocation** (`Execution.jl:1188`).
+**A1. Default Helmert allocation** (`Execution.jl:1191`).
 Per sample: Σ_{i=1}^{D−1} 8i = 4·D·(D−1) bytes. Per run: × n.
 
 | D × n | bytes |
@@ -1017,7 +1059,7 @@ file text = 2·D(D−1); `String(copy(bytes))` = the same; `W` (Int8) = D(D−1)
 |---|---|---|---|---|---|
 | 10 000 | 191 MiB | 191 MiB | 95 MiB | 477 MiB | 1.0e8 |
 
-**A4. Count-table copies** (`Execution.jl:840`, `858`, `868`, `1059`, `1154`),
+**A4. Count-table copies** (`Execution.jl:840`, `858`, `868`, `1062`, `1157`),
 input 20 000 taxa → 10 000 retained, 200 samples. One retained copy = 15.3 MiB;
 input = 30.5 MiB. Current peak ≈ 107 MiB; after removing the dead copy, the
 composable slice and `clr_table` ≈ 76 MiB.
@@ -1032,6 +1074,6 @@ samples: a 40 MiB `DataFrame` plus a 40 MiB `Matrix`, filled by 5 000 000
 |---|---|
 | M1's 8 GB, M2's 2×, M5's 477 MiB | `julia --project=. bench/ilr_bases/benchmark.jl ILR_BENCH_TAXA=10000` (already reports `allocated_bytes` and ΔpeakRSS) |
 | that `hclust_r`'s `diss` copy is not elided | `@allocated` on `hclust_r(tau, D, "average")` vs `2·sizeof(tau)` |
-| that the R copy of `est_counts` doubles peak | `Sys.maxrss()` immediately before and after `estimation.jl:458` |
+| that the R copy of `est_counts` doubles peak | `Sys.maxrss()` immediately before and after `estimation.jl:473` |
 | whether `MASS` is present in the CI image | `Rscript -e 'packageVersion("MASS")'`, or extend `probe_r` (B4) and read the manifest |
 | the `startup_failure` root cause | `gh api /repos/hyperpolymath/MetaManifold-WebUI/actions/runs/<id>` — zero jobs, and GitHub's own "workflow file issue" verdict |
diff --git a/docs/notices/catalogue.md b/docs/notices/catalogue.md
index a8226d2..76d6199 100644
--- a/docs/notices/catalogue.md
+++ b/docs/notices/catalogue.md
@@ -54,21 +54,21 @@ something the reader will not expect.
 
 | id | cat | sev | usable / blocks | banner | summary | action | site · audit |
 |---|---|---|---|---|---|---|---|
-| `exec.heal.nan_inf` | R | danger | **no / yes** | yes | `{nan_count} NaN and {inf_count} Inf in the prepared table were replaced with {rule}.` | Choose `drop_policy = refuse`, or re-run with a transform that does not produce them. | `Execution.jl:600, 1305` · §N1, §N2 |
+| `exec.heal.nan_inf` | R | danger | **no / yes** | yes | `{nan_count} NaN and {inf_count} Inf in the prepared table were replaced with {rule}.` | Choose `drop_policy = refuse`, or re-run with a transform that does not produce them. | `Execution.jl:600, 1320` · §N1, §N2 |
 | `exec.heal.nan_inf.value_scale_mixed` | R | danger | **no / yes** | yes | `Healing replaced NaN with {epsilon} but ±Inf with log(1/{epsilon}); those are different scales for one table.` | Pick one scale and record it. | `Execution.jl:600-616` · §N1 |
 | `exec.heal.all_zero_samples_dropped` | Q | warning | yes / no | yes | `{n} samples with no reads at all were dropped before the transform.` | Re-run; their relative abundances do not exist. | `Execution.jl:654` · §N2 |
 | `exec.heal.all_zero_samples_imputed` | M | warning | yes / no | yes | `{n} samples with no reads at all were imputed with {epsilon} before the transform.` | Prefer `drop`; imputation invents a uniform distribution. | `Execution.jl:654` · §N2 |
-| `exec.heal.all_zero_taxa_dropped` | Q | warning | yes / no | yes | `{n} all-zero taxa were dropped after the transform.` | Note that balances and CLR centres were computed with them present. | `Execution.jl:675, 1320` · §N2 |
+| `exec.heal.all_zero_taxa_dropped` | Q | warning | yes / no | yes | `{n} all-zero taxa were dropped after the transform.` | Note that balances and CLR centres were computed with them present. | `Execution.jl:675, 1335` · §N2 |
 | `exec.heal.all_zero_taxa_imputed` | M | warning | yes / no | yes | `{n} all-zero taxa were imputed with {epsilon}.` | Prefer `drop`. | `Execution.jl:675` · §N2 |
 | `exec.heal.positions_unrecorded` | R | warning | yes / no | yes | `{n} values were rewritten but only the count was recorded, so healed cells cannot be told from measured ones.` | Re-run once positions are recorded. | `Execution.jl:706` · §N2 |
 | `exec.diag.zero_variance` | Q | warning | yes / no | no | `{n_taxa} taxa and {n_samples} samples have zero variance; singularities are likely in LM/GLM.` | Inspect them. | `Execution.jl:556` |
 | `exec.diag.library_size_outliers` | Q | warning | yes / no | no | `{n} samples are more than 3 sd from the mean library size.` | Check for contamination or a failed run. | `Execution.jl:563` |
 | `exec.diag.low_prevalence_abundance` | Q | warning | yes / no | no | `{n_prev} taxa below min_prevalence and {n_abund} below min_abundance were filtered.` | Relax the thresholds if the biology is rare. | `Execution.jl:568` |
-| `exec.diag.batch_confounding_not_implemented` | T | warning | yes / no | no | **Batch confounding was not checked; this check is not implemented.** | Treat confounding as unknown. | `Execution.jl:500` · §N3 |
+| `exec.diag.batch_confounding_not_implemented` | T | warning | yes / no | no | **Batch confounding was not checked; this check is not implemented.** | Treat confounding as unknown. | `Execution.jl:504` · §N3 |
 | `exec.filter.max_features` | M | warning | yes / no | yes | `Filtered to the {n} most abundant taxa; the rest were not tested.` | Raise `max_features`. | `Execution.jl:870` |
 | `exec.epistemic.no_avec_fibre` | Q | warning | yes / no | yes | `No taxon has avec_fibre = true, so epistemic filtering would remove everything; nothing was filtered.` | Check the taxon metadata. | `Execution.jl:883` |
-| `exec.rarefy_is_scaling` | M | danger | yes / no | yes | `normalization.method = 'rarefy' scaled each sample by min_lib/lib; it did not subsample reads.` | Use the pipeline's `rarefy` (real subsampling) or a depth offset. | `Execution.jl:1225-1234` · §N4 |
-| `exec.estimation_not_run` | R | danger | **no / yes** | yes | `No statistics were produced: {reason}.` | Fix the cause named in the reason and re-run. | `Execution.jl:1641-1658` · §W1 |
+| `exec.rarefy_is_scaling` | M | danger | yes / no | yes | `normalization.method = 'rarefy' scaled each sample by min_lib/lib; it did not subsample reads.` | Use the pipeline's `rarefy` (real subsampling) or a depth offset. | `Execution.jl:1228-1237` · §N4 |
+| `exec.estimation_not_run` | R | danger | **no / yes** | yes | `No statistics were produced: {reason}.` | Fix the cause named in the reason and re-run. | `Execution.jl:1657-1685` · §W1 |
 | `exec.memory.allocation_churn` | T | notice | yes / no | no | `Preparation allocated {bytes} across {phases} phases.` | None; recorded for provenance. | new · §M1–M4 |
 | `exec.memory.peak_rss` | T | notice | yes / no | no | `Peak process memory grew by {bytes} during preparation.` | None; recorded for provenance. | new · §M2, §M5 |
 
@@ -99,11 +99,14 @@ something the reader will not expect.
 
 | id | cat | sev | usable / blocks | banner | summary | action | site · audit |
 |---|---|---|---|---|---|---|---|
-| `estimation.not_run` | R | danger | **no / yes** | yes | `No model was fitted: {reason}.` | Fix the cause named in the reason. | `estimation.jl:263, 488` |
-| `estimation.feature_failed` | M | notice | yes / no | no | `{n} of {total} features produced no fit; each row says why and is excluded from the BH family.` | None, unless the rate is high. | `estimation.jl:~530` |
-| `estimation.feature_boundary` | M | warning | yes / no | yes | `{n} features are at a boundary ({reasons}); their standard errors are not trustworthy.` | Do not interpret those rows. | `estimation.jl:786-799` |
-| `estimation.dispersion_refused` | F | fatal | **no / yes** | yes | `dispersion_method '{method}' has no implementation here: {reason}.` | Use `parametric`. | `estimation.jl:70-75` |
+| `estimation.not_run` | R | danger | **no / yes** | yes | `No model was fitted: {reason}.` | Fix the cause named in the reason. | `estimation.jl:276, 549` |
+| `estimation.feature_failed` | M | notice | yes / no | no | `{n} of {total} features produced no fit; each row says why and is excluded from the BH family.` | None, unless the rate is high. | `estimation.jl:591` |
+| `estimation.feature_boundary` | M | warning | yes / no | yes | `{n} features are at a boundary ({reasons}); their standard errors are not trustworthy.` | Do not interpret those rows. | `estimation.jl:979-995` |
+| `estimation.dispersion_refused` | F | fatal | **no / yes** | yes | `dispersion_method '{method}' has no implementation here: {reason}.` | Use `parametric` or `glmgampoi`; `local`, `mean` and `pooled` are refused by name. | `estimation.jl:71-79` |
 | `estimation.exclusion_rate_high` | R | danger | yes / yes | yes | `{pct}% of features produced no fit; that is a finding about the data, not a detail.` | Investigate before publishing. | new |
+| `estimation.dispersion_glmgampoi_port` | M | warning | yes / no | yes | `The dispersion estimate came from this repository's pure-Julia port of glmGamPoi, not from R's glmGamPoi (two-pass fit: per-feature NB means, then a refit at fixed dispersion).` | Read `docs/statistics/method-conditions/dispersion-glmGamPoi.md` before citing it as glmGamPoi. | `estimation.jl:85`, `src/analysis/dispersion.jl` |
+| `estimation.dispersion_spline_refused` | F | fatal | **no / yes** | yes | `glmGamPoi with {n} features (>= {threshold}) needs the spline abundance trend, which the port does not implement.` | Set `advanced.glmgampoi_abundance_trend` to the non-trended prior, or use `parametric`. | `src/analysis/dispersion.jl:68`, `estimation.jl:83` |
+| `estimation.dispersion_pass1_fallback` | Q | warning | yes / no | no | `{n} feature(s) had no pass-1 fit and entered the dispersion estimate with their mean over samples; they fail again in pass 2 with their own reason.` | Inspect those features. | `estimation.jl:508` |
 
 ## `r.*` — the embedded R runtime
 
@@ -113,8 +116,8 @@ something the reader will not expect.
 | `r.package_missing` | D | error | **no / yes** | yes | `R is reachable but {packages} are not installed.` | Restore the renv library. | `provenance.jl:358` · §B4 |
 | `r.package_not_probed` | D | warning | yes / no | no | `{package} is required by the estimator but is not in the probed package list, so provenance cannot see it missing.` | Add it to `R_PACKAGES`. | `provenance.jl:303` · §B4 |
 | `r.runtime_busy` | D | warning | **no / yes** | yes | `The R runtime was busy for {waited}s (a pipeline run holds it); nothing was computed.` | Retry when the pipeline has finished. | `analysis.jl:617` · §B3 |
-| `r.state_leaked` | D | warning | yes / no | no | `R objects from a failed fit remain in the global environment for the life of the process.` | None at runtime; fixed by cleaning up in `finally`. | `estimation.jl:478` · §B2 |
-| `r.warning_uncollected` | T | notice | yes / no | no | `R emitted {n} warning(s) outside the per-feature handler; they are in the process log only.` | Grep the log by `run_id`. | `estimation.jl:741` · §B5 |
+| `r.state_leaked` | D | warning | yes / no | no | `R objects from a failed fit remain in the global environment for the life of the process.` | None at runtime; fixed by cleaning up in `finally`. | `estimation.jl:535` · §B2 |
+| `r.warning_uncollected` | T | notice | yes / no | no | `R emitted {n} warning(s) outside the per-feature handler; they are in the process log only.` | Grep the log by `run_id`. | `estimation.jl:942` · §B5 |
 | `r.adapter_packages_unpinned` | D | warning | yes / no | no | `The adapter records r_packages {packages}, which renv.lock does not pin; nothing verified them.` | Record what is actually loaded. | `Execution.jl:133` · §B4 |
 
 ## `ord.*` / `analysis.*` — ordination, diversity, charts

From 8c63f8aef7db31896a11377a3b1768259786c63f Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 27 Sep 2026 05:16:00 +0000
Subject: [PATCH 2/3] fix(ci): satisfy the Actions allow-list so workflows can
 start

Every workflow run since 2026-09-25 22:19 UTC failed with
startup_failure and zero jobs. The run annotations name two
enforcement rules, neither of which a running job could ever have
reported:

* actions must be from a repository owned by hyperpolymath, created
  by GitHub, verified in the GitHub Marketplace, or match the
  configured pattern -- julia-actions/setup-julia, julia-actions/cache
  and julia-actions/julia-processcoverage match none of those;
* all actions must be pinned to a full-length commit SHA -- the
  Proofs workflow still used @v4/@v5 tag refs.

Changes, one per violation, with behaviour preserved:

* ci/ui/doi: julia-actions/setup-julia replaced by an inline install
  of the official 1.12.5 binaries, verified against the official
  checksum file before use; JULIA_VERSION keeps the pin that
  test/unit/test_install_pins.jl compares against tool_versions.yml
  and Manifest.toml;
* ci/ui/doi: julia-actions/cache replaced by actions/cache at
  55cc834 (v6.1.0) over the same depot directories, keyed on the
  workflow's own Manifest/Project pair;
* ci: julia-actions/julia-processcoverage replaced by the equivalent
  CoverageTools invocation (same default directories, same lcov.info);
* proofs: checkout/setup-python/cache/upload-artifact pinned to the
  commits their existing tags pointed at, so behaviour is unchanged.

test/unit/test_install_pins.jl locates the Julia pin by step name
now, and a new testset walks every workflow and fails on any action
that is not full-SHA-pinned and allow-listed, so a future dependabot
bump to a tag or an unverified owner reddens Pkg.test instead of
silencing Actions.

Validated offline: YAML parse + duplicate-key scan of all four
workflows, policy self-check mirroring the new testset, bash -n on
every run block, JULIA_VERSION regex against the pin file.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 .github/workflows/ci.yml       | 70 ++++++++++++++++++++++++++++-----
 .github/workflows/doi.yml      | 34 ++++++++++++++--
 .github/workflows/proofs.yml   | 14 ++++---
 .github/workflows/ui.yml       | 34 ++++++++++++++--
 test/unit/test_install_pins.jl | 72 +++++++++++++++++++++++++++++++---
 5 files changed, 197 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e2e5195..493adda 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -240,17 +240,53 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Julia
-        uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32  # v3.0.2
-        with:
-          # Pinned rather than tracking latest stable, because a pinned Manifest.toml
-          # resolved by an unpinned Julia is not a reproducible build. This must equal
-          # julia_version in Manifest.toml; it cannot be read from the pin file, since
-          # nothing can be read before Julia exists. test/unit/test_install_pins.jl
-          # fails if the three ever disagree.
-          version: "1.12.5"
+        # julia-actions/setup-julia is refused by this repository's Actions
+        # allow-list: every action must be from a repository owned by
+        # hyperpolymath, created by GitHub, verified in the GitHub Marketplace,
+        # or match the configured pattern, AND be pinned to a full-length
+        # commit SHA. A refused action does not fail the job -- it prevents the
+        # job from starting (startup_failure), which silenced every workflow
+        # from 2026-09-25 22:19 UTC onward. Julia is therefore installed
+        # straight from the official binaries and verified against the
+        # official checksum file before anything from it executes.
+        #
+        # JULIA_VERSION is pinned rather than tracking latest stable, because a
+        # pinned Manifest.toml resolved by an unpinned Julia is not a
+        # reproducible build. It must equal julia_version in Manifest.toml; it
+        # cannot be read from the pin file, since nothing can be read before
+        # Julia exists. test/unit/test_install_pins.jl fails if the three ever
+        # disagree.
+        run: |
+          set -euo pipefail
+          JULIA_VERSION="1.12.5"
+          archive="julia-${JULIA_VERSION}-linux-x86_64.tar.gz"
+          base="https://julialang-s3.julialang.org/bin"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 600 \
+            "${base}/linux/x64/${JULIA_VERSION%.*}/${archive}" \
+            -o "${RUNNER_TEMP}/${archive}"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 120 \
+            "${base}/checksums/julia-${JULIA_VERSION}.sha256" \
+            -o "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256"
+          grep "${archive}" "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256" \
+            | (cd "${RUNNER_TEMP}" && sha256sum --check)
+          mkdir -p "${RUNNER_TEMP}/julia"
+          tar -xzf "${RUNNER_TEMP}/${archive}" -C "${RUNNER_TEMP}/julia" --strip-components=1
+          echo "${RUNNER_TEMP}/julia/bin" >> "${GITHUB_PATH}"
 
       - name: Cache Julia packages
-        uses: julia-actions/cache@a7bed9df697e5d7309d68afe7542a87621a8b6c8  # v3.3.0
+        # julia-actions/cache is refused by the Actions allow-list (see
+        # "Set up Julia" above); actions/cache at a full-length SHA is
+        # permitted and caches the same depot directories.
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: |
+            ~/.julia/artifacts
+            ~/.julia/packages
+            ~/.julia/compiled
+            ~/.julia/registries
+          key: julia-depot-${{ runner.os }}-${{ hashFiles('Manifest.toml', 'Project.toml') }}
+          restore-keys: |
+            julia-depot-${{ runner.os }}-
 
       # Static source lint, deliberately dependency-free (`--project=no`) so it can
       # run before instantiation and fail in seconds rather than after the ~26
@@ -632,7 +668,21 @@ jobs:
           exit "$status"
 
       - name: Process coverage
-        uses: julia-actions/julia-processcoverage@03114f09f119417c3242a9fb6e0b722676aedf38  # v1
+        # Faithful replacement for julia-actions/julia-processcoverage, which
+        # the Actions allow-list refuses: same library (CoverageTools), same
+        # default directories (src and ext, with ext skipped when absent), same
+        # output (lcov.info at the workspace root). The temporary environment
+        # keeps the checkout's Project/Manifest untouched.
+        run: |
+          set -euo pipefail
+          julia --startup-file=no -e '
+            using Pkg
+            Pkg.activate(temp = true)
+            Pkg.add(PackageSpec(name = "CoverageTools"))
+            using CoverageTools
+            dirs = filter(isdir, ["src", "ext"])
+            LCOV.writefile("lcov.info", mapreduce(process_folder, vcat, dirs))
+          '
 
       - name: Upload coverage artifact (local, Codecov removed per Milestone 2)
         if: always()
diff --git a/.github/workflows/doi.yml b/.github/workflows/doi.yml
index 5e5b4c5..693de0d 100644
--- a/.github/workflows/doi.yml
+++ b/.github/workflows/doi.yml
@@ -21,10 +21,38 @@ jobs:
       JULIA_PKG_PRECOMPILE_AUTO: '0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32  # v3.0.2
+      # julia-actions/* is refused by the repository's Actions allow-list
+      # (startup_failure), so Julia is installed from the official binaries
+      # with checksum verification instead -- same version and procedure as
+      # ci.yml's "Set up Julia" step, which test/unit/test_install_pins.jl pins.
+      - name: Set up Julia
+        run: |
+          set -euo pipefail
+          JULIA_VERSION="1.12.5"
+          archive="julia-${JULIA_VERSION}-linux-x86_64.tar.gz"
+          base="https://julialang-s3.julialang.org/bin"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 600 \
+            "${base}/linux/x64/${JULIA_VERSION%.*}/${archive}" \
+            -o "${RUNNER_TEMP}/${archive}"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 120 \
+            "${base}/checksums/julia-${JULIA_VERSION}.sha256" \
+            -o "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256"
+          grep "${archive}" "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256" \
+            | (cd "${RUNNER_TEMP}" && sha256sum --check)
+          mkdir -p "${RUNNER_TEMP}/julia"
+          tar -xzf "${RUNNER_TEMP}/${archive}" -C "${RUNNER_TEMP}/julia" --strip-components=1
+          echo "${RUNNER_TEMP}/julia/bin" >> "${GITHUB_PATH}"
+      - name: Cache Julia packages
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
-          version: '1.12.5'
-      - uses: julia-actions/cache@a7bed9df697e5d7309d68afe7542a87621a8b6c8  # v3.3.0
+          path: |
+            ~/.julia/artifacts
+            ~/.julia/packages
+            ~/.julia/compiled
+            ~/.julia/registries
+          key: julia-depot-${{ runner.os }}-${{ hashFiles('test/doi/Manifest.toml', 'test/doi/Project.toml') }}
+          restore-keys: |
+            julia-depot-${{ runner.os }}-
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version-file: .bun-version
diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml
index e0b1cea..b86c615 100644
--- a/.github/workflows/proofs.yml
+++ b/.github/workflows/proofs.yml
@@ -37,14 +37,18 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      # Tag refs (@v4/@v5) are refused by the repository's Actions allow-list,
+      # which requires a full-length commit SHA; run 36293672919 never started
+      # for exactly this reason. The SHAs below are the commits the tags pointed
+      # at when the policy was enforced, so behaviour is unchanged.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.11"
 
       - name: Cache the vendored toolchain
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             proofs/.vendor
@@ -75,7 +79,7 @@ jobs:
 
       - name: Upload the type-check transcript
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: agda-typecheck-transcript
           path: proofs-typecheck.log
@@ -89,7 +93,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
       - name: Every module is listed, and every listed module exists
         run: |
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 03904de..5b9d09c 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -21,10 +21,38 @@ jobs:
       JULIA_PKG_PRECOMPILE_AUTO: '0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32  # v3.0.2
+      # julia-actions/* is refused by the repository's Actions allow-list
+      # (startup_failure), so Julia is installed from the official binaries
+      # with checksum verification instead -- same version and procedure as
+      # ci.yml's "Set up Julia" step, which test/unit/test_install_pins.jl pins.
+      - name: Set up Julia
+        run: |
+          set -euo pipefail
+          JULIA_VERSION="1.12.5"
+          archive="julia-${JULIA_VERSION}-linux-x86_64.tar.gz"
+          base="https://julialang-s3.julialang.org/bin"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 600 \
+            "${base}/linux/x64/${JULIA_VERSION%.*}/${archive}" \
+            -o "${RUNNER_TEMP}/${archive}"
+          curl --fail --location --retry 3 --retry-all-errors --max-time 120 \
+            "${base}/checksums/julia-${JULIA_VERSION}.sha256" \
+            -o "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256"
+          grep "${archive}" "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256" \
+            | (cd "${RUNNER_TEMP}" && sha256sum --check)
+          mkdir -p "${RUNNER_TEMP}/julia"
+          tar -xzf "${RUNNER_TEMP}/${archive}" -C "${RUNNER_TEMP}/julia" --strip-components=1
+          echo "${RUNNER_TEMP}/julia/bin" >> "${GITHUB_PATH}"
+      - name: Cache Julia packages
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
-          version: '1.12.5'
-      - uses: julia-actions/cache@a7bed9df697e5d7309d68afe7542a87621a8b6c8  # v3.3.0
+          path: |
+            ~/.julia/artifacts
+            ~/.julia/packages
+            ~/.julia/compiled
+            ~/.julia/registries
+          key: julia-depot-${{ runner.os }}-${{ hashFiles('ui/Manifest.toml', 'ui/Project.toml') }}
+          restore-keys: |
+            julia-depot-${{ runner.os }}-
       - name: Instantiate isolated UI environment
         run: julia --project=ui -e 'using Pkg; Pkg.instantiate()'
       - name: Test contracts and backend URL validation
diff --git a/test/unit/test_install_pins.jl b/test/unit/test_install_pins.jl
index 3b54afc..4c42078 100644
--- a/test/unit/test_install_pins.jl
+++ b/test/unit/test_install_pins.jl
@@ -29,10 +29,10 @@ const EXPECTED_PLATFORMS = ["linux-x86_64", "linux-aarch64", "macos-x86_64", "ma
 
 is_sha256(s) = s isa AbstractString && occursin(r"^[0-9a-f]{64}$", s)
 
-"""Return the first step of `job` whose `uses:` names `action`, or nothing."""
-function ci_step_using(job, action)
+"""Return the first step of `job` whose `name:` is `name`, or nothing."""
+function ci_step_named(job, name)
     for step in get(job, "steps", [])
-        startswith(get(step, "uses", ""), action) && return step
+        get(step, "name", nothing) == name && return step
     end
     return nothing
 end
@@ -203,11 +203,22 @@ end
         # Read from the `Set up Julia` step rather than from a matrix: the matrix was
         # removed because GitHub appends a matrix combination to the posted check name
         # (see "a required check name is a stable identifier" below). The step is located
-        # by its `uses:` rather than by index, so reordering the steps cannot make this
+        # by its name rather than by index, so reordering the steps cannot make this
         # assertion quietly vanish.
-        setup = ci_step_using(job, "julia-actions/setup-julia")
+        #
+        # It used to be located by its `uses: julia-actions/setup-julia`, but that
+        # action is refused by the repository's Actions allow-list (see "every GitHub
+        # Action satisfies the repository Actions policy" below), so Julia is now
+        # installed by a pinned `run:` step whose JULIA_VERSION carries the copy this
+        # testset exists to keep honest.
+        setup = ci_step_named(job, "Set up Julia")
         @test setup !== nothing
-        @test setup["with"]["version"] == pins["runtimes"]["julia"]["version"]
+        setup_run = setup === nothing ? "" : get(setup, "run", "")
+        julia_pin = match(r"JULIA_VERSION=\"([^\"]+)\"", setup_run)
+        @test julia_pin !== nothing
+        if julia_pin !== nothing
+            @test julia_pin[1] == pins["runtimes"]["julia"]["version"]
+        end
 
         # A floating runner would carry the R apt pin, which names a 24.04 build, off to
         # whatever the next LTS ships.
@@ -303,6 +314,55 @@ end
         end
     end
 
+    @testset "every GitHub Action satisfies the repository Actions policy" begin
+        # MEASURED 2026-09-25 22:19 UTC through 2026-09-27: every workflow run
+        # failed with `startup_failure` and zero jobs because the repository
+        # began enforcing an Actions allow-list. The run annotation reads:
+        # actions must be "from a repository owned by hyperpolymath, created by
+        # GitHub, verified in the GitHub Marketplace, or match the pattern"
+        # configured for the repository, and "all actions must also be pinned
+        # to a full-length commit SHA". A violation is not a red job -- it is a
+        # job that never starts, so nothing INSIDE the workflow can report it.
+        # This testset is where that policy becomes visible to `Pkg.test`.
+        #
+        # Local actions (`./...`) are part of the checked-out tree: always
+        # allowed, and there is no remote ref to pin.
+        github_owned_owners = ("actions", "github", "hyperpolymath")
+        # Marketplace-verified third parties used by this repository. Extend
+        # deliberately -- each entry is a claim that the action is verified,
+        # made here because the check itself cannot reach the Marketplace.
+        marketplace_verified = ("oven-sh/setup-bun",)
+
+        violations = String[]
+        workflows = sort(readdir(joinpath(REPO_ROOT, ".github", "workflows")))
+        @test !isempty(workflows)
+        for file in workflows
+            (endswith(file, ".yml") || endswith(file, ".yaml")) || continue
+            workflow = YAML.load_file(joinpath(REPO_ROOT, ".github", "workflows", file))
+            for (_, job) in get(workflow, "jobs", Dict())
+                for step in get(job, "steps", [])
+                    uses = get(step, "uses", nothing)
+                    uses === nothing && continue
+                    startswith(uses, "./") && continue
+                    parts = split(uses, '@'; limit = 2)
+                    if length(parts) != 2
+                        push!(violations, "$file: $uses has no @ref")
+                        continue
+                    end
+                    src, ref = parts
+                    if !occursin(r"^[0-9a-f]{40}$", ref)
+                        push!(violations, "$file: $uses is not pinned to a full-length commit SHA")
+                    end
+                    owner = first(split(src, '/'))
+                    if !(owner in github_owned_owners || src in marketplace_verified)
+                        push!(violations, "$file: $uses is neither github-owned, hyperpolymath-owned, nor on the verified list")
+                    end
+                end
+            end
+        end
+        @test isempty(violations)
+    end
+
     @testset "a required check name is a stable identifier" begin
         ci = YAML.load_file(CI_PATH)
 

From 8788eb6d827f4870d5fa441ccbf48940b1450e37 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 27 Sep 2026 05:16:09 +0000
Subject: [PATCH 3/3] fix(provenance): warn when a manifest probe falls back to
 a placeholder

The ExecutionManifest constructor swallowed probe_metamanifold and
probe_host failures into OrderedDict(version=>unknown /
hostname=>unknown) with no record of the refusal: a manifest that
looks probed when it was not. Both catch blocks now emit @warn with
the probe name and the error text before writing the placeholder,
which is the audit's rule that every fallback stays visible
(category: dependency_environment). The placeholder values
themselves are unchanged, so the manifest schema and every existing
assertion over it are untouched.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 src/analysis/Execution.jl | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/analysis/Execution.jl b/src/analysis/Execution.jl
index 960d3d4..526d846 100644
--- a/src/analysis/Execution.jl
+++ b/src/analysis/Execution.jl
@@ -281,14 +281,21 @@ struct ExecutionManifest
         if !haskey(prov, "config_hash")
             prov["config_hash"] = config_hash
         end
+        # Both probe fallbacks warn: a placeholder written silently makes the
+        # manifest look probed when it was not, which is exactly the
+        # concealment rule every fallback in this product is judged by
+        # (audit category: dependency_environment). The placeholder keeps the
+        # schema; the warning keeps the reason.
         try
             prov["metamanifold"] = probe_metamanifold()
-        catch
+        catch err
+            @warn "Metamanifold probe failed — manifest will record version=unknown" probe="metamanifold" err=sprint(showerror, err)
             prov["metamanifold"] = OrderedDict("version" => "unknown")
         end
         try
             prov["host"] = probe_host()
-        catch
+        catch err
+            @warn "Host probe failed — manifest will record hostname=unknown" probe="host" err=sprint(showerror, err)
             prov["host"] = OrderedDict("hostname" => "unknown")
         end