chore: promote qualified migration staging to main

[ss-o]

Promotion readiness record

Candidate identity

• Prior main: 199bbcafddde93ab22f3fcf9e000e81ac3a75385.
• Candidate next: 4a91dbb1b401df7c52a125f0ee1cbb53e1f700ae.
• Candidate tree: 208b3063ca68d0b9d07409c62c4e0184cfedce6c.
• Complete compare.

The candidate retains every main change: git diff --name-only <candidate-next>...<prior-main> is empty. The compare contains reviewed staging #629 and the membership-form update #627. No runtime loader, installer or self-update default changes.

Refs #628. Part of z-shell/.github#771; ADR-0039 is accepted through policy #773.

Required validation

• Candidate ci(release): stage main qualification and signed milestones #629 passed all six Linux/macOS Zsh 5.8.1/5.9/5.9.2 legs and the aggregate Zsh Gate. Local validation passed 43 Zsh test files, native syntax/compilation, actionlint and targeted Trunk.
• This real main PR must prove the retained Promotion gate: full Zsh matrix, ZD native and compatibility, full Trunk, CodeQL, clean install/startup and real-object install/update/unload/delete checks. Every constituent must succeed, and the source guard and read-only release-plan checks must pass.
• Current-head hosted results and review of record are pending at opening. Recheck the exact base/head, all conversation/review threads and live protection immediately before merge.

Readiness review

Unresolved issues

The migration in #628 remains incomplete. This promotion delivers replacement qualification and separately authorized signed milestones before the main source-policy change. It does not remove the source guard, retire next, or declare completed fork qualification and downstream cutover.

User-facing and migration notes

Main consumers receive the reviewed staging change after this merge. Automatic promotion release publication is removed; a milestone requires a separately reviewed exact-current-main plan and signed annotated tag. Existing main installation and self-update channels remain intact. Coordinate Renovate scheduling with the source-policy cutover so transitional bot PRs are retargeted instead of bypassing checks.

Release plan

The deterministic plan for the candidate is a no-op since v2.2.3: only ci and chore commits are new. The real workflow summary must confirm that result. This merge authorizes no milestone tag or release.

Public-contract follow-ups

No loader or public API contract changes are in this compare. The remaining contribution templates, wiki guidance and meta-repository tracking/generation updates are covered by the coordinated migration, with existing source ownership preserved.

Merge contract

Use an ancestry-preserving merge commit only. Preserve next, the recorded parents and candidate tree, and verify exact-SHA main push qualification after delivery. Existing source restrictions remain until replacement qualification and required-context evidence are proven. Do not bypass any protection or change immutable tags.

Rollback readiness

Rollback owner: @ss-o. A confirmed qualification or consumer regression requires a reviewed protected-main hotfix revert preserving history; verify installation/update behavior and synchronize that repair into next before continuing. Never reset or force-push either persistent branch.

Agent handoff

• Status: In progress.
• Current state: Accepted policy and reviewed staging are ready for main qualification. This PR carries only two reviewed next changes.
• Blockers: Full current-head stable qualification and review of record; later cutover and retirement evidence remain pending.
• Next steps: Qualify and review this exact candidate, merge with preserved ancestry, verify the delivered main SHA, then perform the ordered cutover in docs/MAIN_MIGRATION.md.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 4a91dbb

Findings

No actionable findings in the complete promotion compare from main 199bbcafddde93ab22f3fcf9e000e81ac3a75385 to candidate 4a91dbb1b401df7c52a125f0ee1cbb53e1f700ae. Reviewed staging #629 and membership-form #627; the candidate tree exactly matches the previously reviewed staging tree. The stable-only three-dot content diff is empty. Both live APIs report clean mergeability with strict required checks unchanged; no reconciliation or bypass is required.

Note

This is a maintainer-elected self-review, not an independent review or approval to merge.

Validation

• Passed: Promotion Readiness, including Linux/macOS on Zsh 5.8.1, 5.9 and 5.9.2, ZD native and compatibility, full Trunk, CodeQL, clean install/startup and real-object lifecycle; the aggregate Promotion gate succeeded on this candidate.
• Passed: Current candidate Zsh, contract-impact, release-plan, source guard, commit policy and organization-routing checks. Live main protection still requires the source guard, Promotion gate and Release plan; no unresolved review threads or other review findings were present.
• Passed: Focused stable-qualification, release-plan, release-tag-verification and CI-registration regressions rerun against the byte-identical candidate tree. The earlier staging verification also passed all 43 Zsh test files, native syntax/compilation, actionlint and targeted Trunk.
• Unavailable: Copilot request returned no requested reviewers and produced no Copilot review_requested timeline event or review. Cause unconfirmed. Browser rendering of this review was not inspected.

Checklist evidence

• Specification and scope: pass for staging delivery. Accepted ADR-0039 and #628 require qualification before source-policy cutover. This PR deliberately retains the guard, next events and historical issue-closure machinery; remaining cutover obligations are explicit in docs/MAIN_MIGRATION.md and remain open.
• Correctness and failure behavior: pass. The actual aggregate command rejects all 18 failure/cancellation/skip combinations across its six dependencies. Release verification rejects stale main targets, unsigned/lightweight tags, incomplete or newer failed workflow evidence, non-push evidence and mismatched semantic versions. Ordinary workflow completion no longer publishes.
• Compatibility and consumers: pass within delivered checks. Native Zsh scripts retain the existing compatibility floor and all six hosted matrix legs pass. No loader, installation channel, self-update default or public API changed. Fork-hosted qualification and existing-clone self-update/recovery remain explicit cutover verification requirements, not completed claims.
• Security and authority: pass. Release planning uses read-only permissions, action references remain pinned, no signing key is added, and signed milestone creation requires separate authorization. Existing immutable tag and branch protections remain in place.
• Documentation and ownership: pass for staged state. Repository guidance describes the conditional transition and separates integration from milestone authorization; historical policy is retained until verified cutover. Membership links point to the canonical organization documents.

Limits and follow-up

The earlier behind state disappeared after qualification completed without a branch or ruleset change. A reviewed main-to-next reconciliation was authorized but is unnecessary on the observed clean candidate. Preserve a merge commit with the recorded parents and tree, then verify the delivered main push qualification, historical issue reconciliation, fork behavior, installation/update and coordinated policy/wiki/tracking cutover under #628 and z-shell/.github#771. Remote next retirement is a separately authorized cleanup gate. This promotion creates no tag or release.