DEN-3945: consolidate all branches into main (2026-09-12 sweep)

[ORESoftware]

Consolidation of all branches into main — DEN-3945 fleet sweep (2026-09-12)

Linear: DEN-3945. Every local branch, worktree and uncommitted change under ~/codes was published without force; this PR merges every branch not already in main with merge commits only, conflicts resolved semantically per ORESoftware/my-ai/AGENTS.md. Durable sweep record: ORESoftware/den-3945-fleet-sweep.

Semantically resolved and merged

• origin/main (base advance) — Merge 30939d2: the sweep head was 8 commits behind origin/main (through 3317d2e 'fix: harden latest-deps lock and exact-head provenance #75 harden latest-deps lock and exact-head provenance'). Conflict-free ort merge, merged first per the brief.
• chore/DEN-3956-tmp-temp-ignores — Merge d193bc8. Single new commit 0dd2b98. .gitignore resolved as a semantic union, not either side: the branch predates main's '# typespec-json-schema-validator comparison evidence' block and its file would have deleted that ignore, while main's file would have dropped the DEN-3956 trailing-slash scratch rules. Result is main's file plus the branch's 3 lines. Proved with git check-ignore --no-index: tmp/x, temp/x, tmp/worktrees/a/b, temp/worktrees/a/b and .typespec-json-schema-validator/report.json ignored; src/main.rs, README.md and k8s/deployment.yaml not ignored; env/enc/*.env.enc and env/template.env.example still match their negations.
• recovered/claude/autosave-7887f6f06301-20260822 — Merge a220ebb. 26 'claude autosave' commits from merge base 499cb2a (2026-07-25); the raw merge produced 24 conflicts. Every changed path was checked individually against main's history since the merge base before resolving: 15 paths hold a blob byte-identical to the sweep head, and 22 more hold a blob literally present in main's history since the merge base (ci.yml at c6adb31, k8s-contract.yml and k8s/base/ingress.yaml at 042f5b6, Cargo.toml/Cargo.lock and src/{lib,proxy,routes,server,state,views}.rs at 2270f37, Dockerfile at cffb9e1, README.md at e756f9e, RUNTIME.md at d08804a, agents.md at b9176c7, justfile at d1928c2, k8s/base/deployment.yaml at 823de5b, k8s/kustomization.yaml at 114fd77). So these are not two live designs - main absorbed the branch and moved on - and each conflict was resolved to the sweep head on that per-path evidence, not by a blanket strategy. TWO RESURRECTIONS REFUSED: the raw merge re-added .github/workflows/image.yml and src/routes.rs, both of which main deleted AFTER absorbing this branch's versions; the merge commit omits both, so the committed tree is exactly the sweep head minus the four files below. CARRIED the branch's one genuinely unlanded change: deletion of the four pre-kustomize flat manifests k8s/{deployment,ingress,networkpolicy,service}.yaml left behind by the move to k8s/base/. Safe and proven: git grep finds no reference to them anywhere in the tree, k8s/kustomization.yaml lists only 'base' and 'externalsecret.yaml', tests/database_boundary.rs reads k8s/base/deployment.yaml, and the flat copies are stale (old registry.zpkg.tech host, no imagePullSecrets, no SHARED_AUTH_URL). Render-neutral: kubectl kustomize over k8s, k8s/overlays/aws and k8s/overlays/hetzner - the three entry points .github/workflows/k8s-contract.yml gates, and 'path: k8s' is what ORESoftware/k8s-cluster remote/argocd/apps/zed.applications.yaml points dd-zed-web-server at - gives byte-identical output before and after the deletion.
• (sweep-head defect fix) Cargo.lock — Two follow-up commits fixing gates the sweep head itself was failing, neither of which is a main problem. ab0f598: rustfmt src/cli.rs, which is not on main and arrives from f4eaa57 (fix/DEN-390-executable-flags2env-boot); ci.yml runs cargo fmt --all -- --check and it was failing on one joined-line hunk. 28cd545: the sweep head's Cargo.toml declares flags2env at rev d7bad9ea but Cargo.lock was byte-identical to main and had no flags2env entry, so cargo metadata --locked failed and with it all five locked ci.yml steps. The inconsistency is inherited, not resolution-induced - branch fix/DEN-390-executable-flags2env-boot changed Cargo.toml and left Cargo.lock untouched. Regenerated with the toolchain rust-toolchain.toml pins (rustup run 1.97.1 cargo metadata), never hand-edited; the delta is purely additive - zero removed or changed lines - adding flags2env at exactly the pinned rev plus one new transitive dep libloading 0.8.9, with the zed-interfaces 7d31f80 and zed-lib-core 9ca7592 source pins ci.yml asserts left intact.

Not merged — already landed / superseded (evidence)

• macs-mbp/main-unpushed-20260912 — Single new commit 5bea60d 'chore(lint): adopt the ORES lint toolkit' adding .ores-lint/ at VERSION 1.0.0; the sweep head already carries 1.3.0 of the same toolkit (from rescue/worktree-macbook-20260912 / the macs-mbp wip snapshots, merged in an earlier sweep generation). All 13 paths the branch adds exist on the head: install-git-hooks.sh byte-identical, the other 12 strictly larger and supersets. Verified rather than assumed: config.sh 1.3.0 adds ORES_LINT_SKIP_DART/GLEAM/REQUIRE_SEND, ORES_LINT_REQUIRE_SEND_INCLUDE_TESTS and ORES_LINT_DEPTH=5; required-tools.json adds dart and gleam; lint.sh replaces 1.0.0's root-only package.json/Cargo.toml test with depth-5 discovery of nested crates plus dart.sh, gleam.sh and the cross-language require-send.mjs pass; eslint/plugin.mjs still carries the ores/require-send rule (messageId missingSend, terminalMethods) with an added eslint-disable escape hatch; the ores-lint.yml workflow keeps js/rs detection and widens it with git ls-files fallbacks plus dart/gleam. No PR ever existed (REST head= empty and commits/5bea60d/pulls = [] at rc 0, not an error). Merging it would downgrade the toolkit 1.3.0 -> 1.0.0.

Not merged — the branch has its own open PR

• none

Not merged — needs a human/product decision

• none

Local verification (exact head 28cd545233a7)

All 88 origin branches were tested for containment against the merged head, not just the 3 the claim listed; the outside ones beyond these 3 head open PRs the helper filters (#77, #76, #74, #73, #70, #66, #65, #64, #63, #51, #49, #47, #43, #42) or are already ledgered. Clone made self-contained (repack -a -d, alternates into ~/codes/zed-pkg/zed-monorepo submodule store removed, fsck --connectivity-only clean). No AGENTS.md/agents.md case collision: the tree carries lowercase agents.md only, and ls-tree lowercased has no duplicates. open-pr-heads.sh rc=0. Pushed after EVERY commit; remote sweep ref == local head 28cd545. Working tree clean, git diff --check origin/main HEAD clean, git grep finds no conflict markers. GATES from ci.yml run on the merged head with the pinned toolchain (rustup run 1.97.1; note the shell's default rustc is Homebrew 1.95.0, so the pin was selected explicitly - that is the only environment difference from the runner): source-graph pin assertions PASS (zed-interfaces 7d31f80 and zed-orm-core 9ca7592 pinned identically in Cargo.toml and Cargo.lock, no path deps) - reimplemented in bash rather than the workflow's inline Python, per the no-new-Python-tooling preference; actionlint on all 18 workflows PASS (one pre-existing shellcheck SC2251 info in dependency-graph-insights.yml, which is on main); cargo fmt --all -- --check CLEAN (after ab0f598); node --check assets/dependency-graph.js OK; node scripts/build-graph-assets.mjs --check rc=0; node tests/dependency-graph.mjs PASS; cargo metadata --locked rc=0 (after 28cd545); cargo check --locked --all-targets rc=0; cargo clippy --locked --all-targets -- -D warnings CLEAN; cargo test --locked 110 passed / 0 failed / 1 ignored (cargo-nextest is not installed locally, so cargo test stood in for the nextest step); RUSTDOCFLAGS='-D warnings' cargo doc --locked --no-deps CLEAN; cargo build --locked --release OK; the Enforce process-runtime boundaries step PASS in full (src/main.rs is 4 lines <= 6, all six required files present, all seven required git grep assertions hold, no DatabaseConnection/PgPoolOptions/routes::router/TcpListener::bind in src/main.rs, git diff --check clean). k8s-contract.yml gates PASS: kubectl kustomize renders k8s, k8s/overlays/aws and k8s/overlays/hetzner at rc 0. ores-lint.yml gate PASS: sh .ores-lint/lint.sh rc=0 (warn-only; 13 pre-existing clippy expect() warnings, require-send clean over 25 files). PRE-EXISTING DEFECT, not sweep-caused and not CI-breaking: .ores-lint/selftest.sh fails because .ores-lint/require-send.test.mjs is absent from the 1.3.0 toolkit - the same incomplete rollout DECISIONS.md item 19 records across ~40 repos. ores-lint.yml runs lint.sh, not selftest.sh, so the workflow is unaffected. Disk 66 GB free at the end; the cargo target dir was redirected into build-tmp and all build output plus TJSV scratch deleted.

Contracts (TJSV)

PASSED on the merged head. Peer pair test/fixtures/schema-authority-canary/{main.tsp,authored.schema.json}, run at the exact revision .github/workflows/typespec-json-schema-peer-authority.yml pins (ORESoftware/typespec-json-schema-validator@5b04b08), extracted read-only with git archive into build-tmp rather than working inside ~/codes; that pin is an ancestor of the local checkout head and package-lock.json is byte-identical (52c574d) at both, so the reused node_modules is the matching toolchain. check: parity PASSED, 0 findings (structural 0, differential 0), TypeSpec=2/generated=2/authored=2 declarations, 63 probes / 63 agreements / 0 divergences / 0 refusals. No camelCase-vs-snake_case divergence arose. Neither authored authority was modified or regenerated from the other. Node 22.13.0 locally.

Merge policy

Draft until verified on the exact head. Where this org has no GitHub Actions minutes, zero-step jobs are admission refusals, not passes.

🤖 Generated with Claude Code

[linear-code]

DEN-3945