diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index bc570278eb..9dc0c681ab 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -136,10 +136,6 @@ jobs:
   # in that run's place, so the displaced run's release waits for the next run
   # on ``main``: the tip's own Vendor Update if the tip's Unit Tests run has not
   # completed yet, else the next push's or Saturday's.
-  #
-  # #1967: util/release_vendor_update.py holds the step's shell, so the job
-  # checks out util/ alone, for it and util/_actions.py, which is all
-  # ``contents: read`` is for.
   vendor_update:
     name: Triggering Vendor Update
     runs-on: ubuntu-latest
@@ -147,23 +143,34 @@ jobs:
     timeout-minutes: 5
     permissions:
       actions: read
-      contents: read
     outputs:
       updated: ${{ steps.updated.outputs.updated }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          sparse-checkout: util
-          persist-credentials: false
-
       - name: Read whether its vendor-update job ran
         id: updated
         env:
           GH_TOKEN: ${{ github.token }}
           PCAPKIT_VENDOR_RUN_ID: ${{ github.event.workflow_run.id }}
-        run: python3 util/release_vendor_update.py
+        run: |
+          set -uo pipefail
+
+          if ! result="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${PCAPKIT_VENDOR_RUN_ID}/jobs" \
+                           --paginate --jq '.jobs[] | select(.name == "vendor-update") | .conclusion')"; then
+            echo "::warning title=Vendor Update not read (#1748)::could not list the jobs of Vendor Update run ${PCAPKIT_VENDOR_RUN_ID}, so this run treats it as one that updated."
+            exit 0
+          fi
+          case "$result" in
+            success)
+              echo "updated=true" >> "$GITHUB_OUTPUT"
+              ;;
+            skipped)
+              echo "updated=false" >> "$GITHUB_OUTPUT"
+              echo "Vendor Update run ${PCAPKIT_VENDOR_RUN_ID} skipped vendor-update: its verdict did not cover the commit it checked out."
+              ;;
+            *)
+              echo "::warning title=Vendor Update not read (#1748)::Vendor Update run ${PCAPKIT_VENDOR_RUN_ID} reports vendor-update as '${result//$'\n'/ }', so this run treats it as one that updated."
+              ;;
+          esac
 
   version_check:
     name: Check Version
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 3535123a10..d1bdbe71ce 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -630,9 +630,10 @@ jobs:
       # bound. APT_PACKAGES, the job's env, is what both the plan and the
       # install read, so the key always describes the set installed.
       #
-      # The plan, seed, install and collect steps run util/apt_packages.py
-      # (#1967); its docstring says what each subcommand does. `pypcap-parity`
-      # runs the same steps; every body but the install's is identical to these.
+      # The plan, install and collect steps run util/apt_packages.py (#1967);
+      # its docstring says what each subcommand does. The seed step, one copy
+      # and a count, stays inline. `pypcap-parity` runs the same steps; every
+      # body but the install's is identical to these.
       - name: Plan this engine's system packages
         id: apt-plan
         if: env.APT_PACKAGES != ''
@@ -650,7 +651,10 @@ jobs:
 
       - name: Seed apt's archive with this engine's cached .deb files
         if: steps.apt-cache.outputs.cache-matched-key != ''
-        run: /usr/bin/python3 util/apt_packages.py seed
+        run: |
+          set -eu
+          sudo cp "$RUNNER_TEMP"/apt-debs/*.deb /var/cache/apt/archives/
+          echo "Seeded $(find "$RUNNER_TEMP/apt-debs" -name '*.deb' | wc -l) .deb files"
 
       - name: Install this engine's system packages
         timeout-minutes: 10
@@ -961,7 +965,10 @@ jobs:
         id: apt-seed
         if: steps.apt-cache.outputs.cache-matched-key != ''
         continue-on-error: ${{ matrix.ktlo == true }}
-        run: /usr/bin/python3 util/apt_packages.py seed
+        run: |
+          set -eu
+          sudo cp "$RUNNER_TEMP"/apt-debs/*.deb /var/cache/apt/archives/
+          echo "Seeded $(find "$RUNNER_TEMP/apt-debs" -name '*.deb' | wc -l) .deb files"
 
       - name: Install libpcap headers, a C toolchain, and tshark
         id: apt-install
diff --git a/docs/source/contributing/workflows.rst b/docs/source/contributing/workflows.rst
index a44622333b..b48723940f 100644
--- a/docs/source/contributing/workflows.rst
+++ b/docs/source/contributing/workflows.rst
@@ -1208,11 +1208,14 @@ without the script, and runs the script against a small limit.
 Workflow Scripts (`#1967 <https://github.com/JarryShaw/PyPCAPKit/issues/1967>`__)
 ---------------------------------------------------------------------------------
 
-Shell that several steps repeat lives in a :file:`util/` script, which the steps
-run, rather than in a composite action: a composite action's inner steps cannot
-take ``timeout-minutes``, so each calling step keeps its own, with its ``shell:``,
-``if:``, ``env:`` and ``continue-on-error``. Each script's docstring says what it
-does; each has tests under :file:`tests/project/` that run it.
+Shell that several steps repeat, or that has real logic -- branches, or a bug
+history a test should pin -- lives in a :file:`util/` script, which the steps run,
+rather than in a composite action: a composite action's inner steps cannot take
+``timeout-minutes``, so each calling step keeps its own, with its ``shell:``,
+``if:``, ``env:`` and ``continue-on-error``. A few plain commands stay inline even
+where repeated, as the apt seed steps do, since they read more easily than a call
+to a script. Each script's docstring says what it does; each has tests under
+:file:`tests/project/` that run it.
 
 .. list-table::
    :header-rows: 1
@@ -1266,10 +1269,12 @@ does; each has tests under :file:`tests/project/` that run it.
      - No.
    * - :file:`util/apt_packages.py`
      - The apt steps of ``unit-tests.yml``'s ``engine-tests`` and ``pypcap-parity``
-       (and so its KTLO twin): the plan, seed, install and collect steps, as
-       ``apt_packages.py plan``, ``seed``, ``install`` and ``collect``. The
-       ``actions/cache`` steps and the AppArmor step (`#2019
-       <https://github.com/JarryShaw/PyPCAPKit/issues/2019>`__) stay as they were.
+       (and so its KTLO twin): the plan, install and collect steps, as
+       ``apt_packages.py plan``, ``install`` and ``collect``. The
+       ``actions/cache`` steps, the seed steps (``Seed apt's archive with this
+       engine's cached .deb files`` and ``Seed apt's archive with the cached .deb
+       files``) and the AppArmor step (`#2019
+       <https://github.com/JarryShaw/PyPCAPKit/issues/2019>`__) stay inline.
      - No.
    * - :file:`util/_actions.py`
      - No step: it is imported by the scripts that share its annotations, step
@@ -1298,11 +1303,6 @@ does; each has tests under :file:`tests/project/` that run it.
        after a checkout of :file:`util/` alone (`#888
        <https://github.com/JarryShaw/PyPCAPKit/issues/888>`__).
      - No.
-   * - :file:`util/release_vendor_update.py`
-     - ``Read whether its vendor-update job ran`` in ``create-release.yml``'s
-       ``vendor_update``, on the image's ``python3`` after a checkout of
-       :file:`util/` alone (`#1748 <https://github.com/JarryShaw/PyPCAPKit/issues/1748>`__).
-     - No.
    * - :file:`util/release_tiers.py`
      - ``Read the released Python versions`` in ``create-release.yml``'s
        ``version_check``, on setup-python's ``python3`` (`#1660
diff --git a/tests/project/test_actions_helper_2047.py b/tests/project/test_actions_helper_2047.py
index 95ac60ec59..52043aadfe 100644
--- a/tests/project/test_actions_helper_2047.py
+++ b/tests/project/test_actions_helper_2047.py
@@ -46,7 +46,7 @@
 SCRIPTS = ('apt_packages', 'check_suite_report', 'ci_timing', 'classify_changes', 'codeql_report',
            'coverage_report', 'discussion_report', 'leg_summary', 'pip_install', 'project_status',
            'python_versions', 'regenerate_samples', 'release_conda', 'release_published', 'release_status',
-           'release_tags', 'release_tiers', 'release_upload', 'release_vendor_update', 'superseded',
+           'release_tags', 'release_tiers', 'release_upload', 'superseded',
            'update_python_versions', 'vendor_code_changed', 'vendor_test_gate', 'verdict_covers_checkout')
 #: The top-level modules the helper may import, each in Python 3.7's standard
 #: library: the running interpreter's :data:`sys.stdlib_module_names` would
@@ -72,7 +72,6 @@
     'release_tags': (['--help'], {}),
     'release_tiers': (['--help'], {}),
     'release_upload': (['--help'], {}),
-    'release_vendor_update': (['--help'], {}),
     'superseded': (['--help'], {}),
     'update_python_versions': (['--help'], {}),
     'vendor_code_changed': (['--help'], {}),
diff --git a/tests/project/test_apt_packages_1967.py b/tests/project/test_apt_packages_1967.py
index ef1317f449..60954d0243 100644
--- a/tests/project/test_apt_packages_1967.py
+++ b/tests/project/test_apt_packages_1967.py
@@ -1,18 +1,19 @@
 # -*- coding: utf-8 -*-
 """#1967: :file:`util/apt_packages.py`, the apt steps of ``engine-tests`` and ``pypcap-parity``.
 
-* :class:`TestPlan`, :class:`TestSeed`, :class:`TestInstall` and :class:`TestCollect`
-  run each subcommand in this process with :func:`subprocess.run` stubbed, so every
-  command it would run, and every failure of one, is checked without ``sudo`` or apt.
+* :class:`TestPlan`, :class:`TestInstall` and :class:`TestCollect` run each
+  subcommand in this process with :func:`subprocess.run` stubbed, so every command
+  it would run, and every failure of one, is checked without ``sudo`` or apt.
 * :class:`TestTheFormerShellAgrees` runs the shell the steps held before the script,
   and then the steps' own ``run:``, against the same stand-in ``sudo``, ``timeout``,
   ``apt-get``, ``dpkg``, ``dpkg-deb``, ``dpkg-query`` and ``debconf-set-selections``,
-  and requires the same status, output, commands and files.
-* :class:`TestTheStepsRunTheScript` pins each apt step to the script with its
-  ``id``, ``if:``, ``continue-on-error`` and ``timeout-minutes``, the KTLO twin to
-  the same steps, and the AppArmor step (#2019) to its inline shell; no other step
-  in any workflow keeps apt shell of its own, and #1672's scan of what a KTLO leg
-  may write sees the script's warnings.
+  and requires the same status, output, commands and files. The seed steps, which
+  #1967 put back inline as one copy and a count, run their own ``run:`` there.
+* :class:`TestTheStepsRunTheScript` pins each apt step to the script, or the seed
+  steps to their shell, with its ``id``, ``if:``, ``continue-on-error`` and
+  ``timeout-minutes``, the KTLO twin to the same steps, and the AppArmor step
+  (#2019) to its inline shell; no other step in any workflow keeps apt shell of its
+  own, and #1672's scan of what a KTLO leg may write sees the script's warnings.
 
 The retry, the fallback mirror and the cache key are also run through the steps by
 :mod:`tests.project.test_unit_tests_queue` and :mod:`tests.project.test_workflow_apt_cache`.
@@ -213,35 +214,6 @@ def test_a_missing_variable_is_an_error(self) -> None:
                 self.environ[name] = 'restored' if name != 'GITHUB_OUTPUT' else str(self.output)
 
 
-class TestSeed(_InProcess):
-    """The restored files into apt's archive with ``sudo cp``, then their count."""
-
-    def test_the_files_are_copied_and_counted(self) -> None:
-        cache = self.runner_temp / 'apt-debs'
-        (cache / 'nested').mkdir(parents=True)
-        for name in ('b.deb', 'a.deb', 'nested/c.deb', 'notes.txt'):
-            (cache / name).write_bytes(b'')
-        status, output, runner = self.main(['seed', '--archives', str(self.archives)], answers())
-        self.assertEqual(status, 0)
-        self.assertEqual(runner.commands, [['sudo', 'cp', str(cache / 'a.deb'), str(cache / 'b.deb'),
-                                            f'{self.archives}/']])
-        self.assertEqual(output, 'Seeded 3 .deb files\n')
-
-    def test_the_default_archive_is_apts(self) -> None:
-        (self.runner_temp / 'apt-debs').mkdir()
-        (self.runner_temp / 'apt-debs' / 'a.deb').write_bytes(b'')
-        _, _, runner = self.main(['seed'], answers())
-        self.assertEqual(runner.commands[0][-1], '/var/cache/apt/archives/')
-
-    def test_nothing_restored_fails_on_the_pattern(self) -> None:
-        for code, expected in ((1, 1), (-15, 143)):
-            with self.subTest(code=code):
-                status, output, runner = self.main(['seed', '--archives', str(self.archives)], answers(cp=(code, b'')))
-                self.assertEqual((status, output), (expected, ''))
-                self.assertEqual(runner.commands, [['sudo', 'cp', str(self.runner_temp / 'apt-debs' / '*.deb'),
-                                                    f'{self.archives}/']])
-
-
 class TestInstall(_InProcess):
     """debconf for tshark, then up to two update-and-install attempts, the second on a fallback mirror."""
 
@@ -421,8 +393,8 @@ class TestArguments(_InProcess):
     """One subcommand, and only its own options."""
 
     def test_refused(self) -> None:
-        for args in ([], ['update'], ['plan', 'extra'], ['seed', '--mirrors', 'x'], ['install', 'tshark'],
-                     ['collect', '--name', 'x']):
+        for args in ([], ['update'], ['plan', 'extra'], ['seed'], ['plan', '--archives', 'x'],
+                     ['install', 'tshark'], ['collect', '--name', 'x']):
             with self.subTest(args=args), contextlib.redirect_stderr(io.StringIO()):
                 with self.assertRaises(SystemExit) as raised:
                     self.main(args, answers())
@@ -449,7 +421,8 @@ def test_refused(self) -> None:
       echo "key=${prefix}$(printf '%s\n' "$plan" | sha256sum | cut -c1-16)" >> "$GITHUB_OUTPUT"
     fi
 ''').lstrip()  # noqa: E501
-FORMER_SEED = textwrap.dedent(r'''
+#: The seed steps' ``run:``, which a ``seed`` subcommand held for a while (#1967).
+SEED = textwrap.dedent(r'''
     set -eu
     sudo cp "$RUNNER_TEMP"/apt-debs/*.deb /var/cache/apt/archives/
     echo "Seeded $(find "$RUNNER_TEMP/apt-debs" -name '*.deb' | wc -l) .deb files"
@@ -511,7 +484,7 @@ def test_refused(self) -> None:
     ("Plan this engine's system packages", 'apt-plan', "env.APT_PACKAGES != ''", None, 4,
      f'{IMAGE_PYTHON} {SCRIPT} plan'),
     ("Seed apt's archive with this engine's cached .deb files", None,
-     "steps.apt-cache.outputs.cache-matched-key != ''", None, None, f'{IMAGE_PYTHON} {SCRIPT} seed'),
+     "steps.apt-cache.outputs.cache-matched-key != ''", None, None, SEED),
     ("Install this engine's system packages", None, None, None, 10,
      f'{IMAGE_PYTHON} {SCRIPT} install --name "$ENGINE"'),
     ("Collect this engine's installed .deb files for the cache", None,
@@ -522,7 +495,7 @@ def test_refused(self) -> None:
 PARITY_STEPS = (
     ('Plan the system packages', 'apt-plan', "env.APT_PACKAGES != ''", KTLO, 4, f'{IMAGE_PYTHON} {SCRIPT} plan'),
     ("Seed apt's archive with the cached .deb files", 'apt-seed', "steps.apt-cache.outputs.cache-matched-key != ''",
-     KTLO, None, f'{IMAGE_PYTHON} {SCRIPT} seed'),
+     KTLO, None, SEED),
     ('Install libpcap headers, a C toolchain, and tshark', 'apt-install', None, KTLO, 10,
      f'{IMAGE_PYTHON} {SCRIPT} install'),
     ('Collect the installed .deb files for the cache', None, ENGINE_STEPS[3][2], None, None,
@@ -530,7 +503,7 @@ def test_refused(self) -> None:
 )
 SITES = {'engine-tests': ENGINE_STEPS, 'pypcap-parity': PARITY_STEPS}
 #: Each step's former shell, by the subcommand that replaced it.
-FORMER = {'plan': FORMER_PLAN, 'seed': FORMER_SEED, 'collect': FORMER_COLLECT}
+FORMER = {'plan': FORMER_PLAN, 'collect': FORMER_COLLECT}
 APPARMOR = 'Let tshark read the checkout past its AppArmor profile'
 #: Text only the apt steps' former shell held.
 INLINE = ('apt-get', 'dpkg', 'debconf-set-selections', 'apt-mirrors', '/var/cache/apt', 'apt_install')
@@ -653,6 +626,8 @@ def scenarios(self) -> 'Iterator[tuple[str, str, str, dict[str, str]]]':
         """``(job, step, former shell, env)`` for every apt step but the installs."""
         for job, sites in SITES.items():
             for name, _, _, _, _, run in sites:
+                if SCRIPT not in run:
+                    continue
                 command = run.split(f'{SCRIPT} ', 1)[1].split()[0]
                 if command in FORMER:
                     yield job, name, FORMER[command], {}
@@ -676,23 +651,42 @@ def test_plan(self) -> None:
         self.assertTrue(keyed)
 
     def test_seed(self) -> None:
+        """The seed steps' own shell: ``sudo cp`` of the top-level files, then the count of every ``.deb``."""
+        cache = self.runner_temp / 'apt-debs'
+
         def nothing() -> None:
             pass
 
         def restored() -> None:
-            (self.runner_temp / 'apt-debs' / 'deep').mkdir(parents=True)
+            (cache / 'deep').mkdir(parents=True)
             for name in ('a.deb', 'b.deb', 'deep/c.deb', 'readme'):
-                (self.runner_temp / 'apt-debs' / name).write_text(name, encoding='utf-8')
+                (cache / name).write_text(name, encoding='utf-8')
 
-        for job, step, former, _ in self.scenarios():
-            if former is not FORMER_SEED:
-                continue
+        seeds = [(job, name, run) for job, sites in SITES.items() for name, *_, run in sites if run == SEED]
+        self.assertEqual([job for job, _, _ in seeds], list(SITES))
+        for job, step, _ in seeds:
+            run = next(item for item in steps(WORKFLOW, job) if item.get('name') == step)['run']
+            script = run.replace('/var/cache/apt/archives', str(self.archives))
             for prepare in (restored, nothing):
                 with self.subTest(job=job, restored=prepare is restored):
-                    old, new = self.both(job, step, former, prepare)
-                    self.assertEqual(new, old)
-                    self.assertEqual(sorted(path.name for path in self.archives.iterdir()),
-                                     ['a.deb', 'b.deb'] if prepare is restored else [])
+                    self.reset()
+                    prepare()
+                    result = subprocess.run(['bash', '-e', '-c', script], cwd=ROOT, env=self.env(),  # nosec: B603
+                                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT, check=False,
+                                            timeout=120)
+                    output = result.stdout.decode('utf-8', 'replace')
+                    copied = sorted(path.name for path in self.archives.iterdir())
+                    if prepare is restored:
+                        self.assertEqual((result.returncode, output, copied),
+                                         (0, 'Seeded 3 .deb files\n', ['a.deb', 'b.deb']))
+                        self.assertEqual(self.calls.read_text(encoding='utf-8'),
+                                         f'sudo cp {cache}/a.deb {cache}/b.deb {self.archives}/\n')
+                    else:
+                        # The unmatched glob stays the pattern, so `cp` fails on it and nothing is counted.
+                        self.assertEqual((result.returncode, copied), (1, []))
+                        self.assertNotIn('Seeded', output)
+                        self.assertEqual(self.calls.read_text(encoding='utf-8'),
+                                         f'sudo cp {cache}/*.deb {self.archives}/\n')
 
     def test_collect(self) -> None:
         def archive(broken: 'bool') -> 'Callable[[], None]':
@@ -745,7 +739,7 @@ def prepare(mirrors: 'Optional[str]' = mirrors) -> None:
 
 
 class TestTheStepsRunTheScript(unittest.TestCase):
-    """Each apt step is one call of the script with its guards; no step keeps apt shell."""
+    """Each apt step is one call of the script, or the seed steps' shell, with its guards; no step keeps apt shell."""
 
     def test_each_site_runs_the_script_with_its_guards(self) -> None:
         for job, sites in {**SITES, 'pypcap-parity-ktlo': PARITY_STEPS}.items():
@@ -765,10 +759,10 @@ def test_each_site_runs_the_script_with_its_guards(self) -> None:
                 self.assertEqual(positions[3], positions[2] + 2)
 
     def test_a_ktlo_leg_reads_only_warnings_from_it(self) -> None:
-        """#1672's scan of a step's commands sees the script's, which are warnings alone."""
+        """#1672's scan of a step's commands sees the script's, which are warnings alone; the seed's, none."""
         for name, *_, run in PARITY_STEPS:
             with self.subTest(step=name):
-                self.assertEqual(commands(run), {'warning'})
+                self.assertEqual(commands(run), {'warning'} if SCRIPT in run else set())
                 self.assertLessEqual(commands(run), KTLO_COMMANDS)
 
     def test_the_ktlo_twin_runs_the_same_steps(self) -> None:
@@ -794,9 +788,12 @@ def test_the_packages_come_from_the_job(self) -> None:
     def test_no_step_keeps_apt_shell(self) -> None:
         found = []
         covered = {name for sites in SITES.values() for name, *_ in sites}
+        seeds = {name for sites in SITES.values() for name, *_, run in sites if run == SEED}
         for path in sorted(WORKFLOWS.glob('*.yml')):
             for job, spec in (load(path).get('jobs') or {}).items():
                 for item in spec.get('steps') or ():
+                    if path.name == WORKFLOW and item.get('name') in seeds and item.get('run') == SEED:
+                        continue  # pinned to its shell above
                     run = '\n'.join(line for line in str(item.get('run', '')).splitlines()
                                     if not line.lstrip().startswith('#'))
                     found.extend(f'{path.name} {job} {item.get("name")!r}: {piece}'
diff --git a/tests/project/test_discussion_report_2030.py b/tests/project/test_discussion_report_2030.py
index 957eebf894..82e443e439 100644
--- a/tests/project/test_discussion_report_2030.py
+++ b/tests/project/test_discussion_report_2030.py
@@ -662,10 +662,7 @@ def test_create_release_still_reads_vendor_update_alone(self) -> None:
         spec = load('cron-vendor.yml')
         self.assertNotIn('name', spec['jobs']['vendor-update'])
         self.assertEqual([job.get('name', job_id) for job_id, job in spec['jobs'].items()].count('vendor-update'), 1)
-        # #1967: Create Release's vendor_update runs util/release_vendor_update.py, which selects it.
-        self.assertIn('run: python3 util/release_vendor_update.py',
-                      (WORKFLOWS / 'create-release.yml').read_text(encoding='utf-8'))
-        release = (ROOT / 'util' / 'release_vendor_update.py').read_text(encoding='utf-8')
+        release = (WORKFLOWS / 'create-release.yml').read_text(encoding='utf-8')
         self.assertIn('select(.name == "vendor-update")', release)
 
     def test_the_vendor_report_steps_never_fail_the_job(self) -> None:
diff --git a/tests/project/test_release_reads_the_vendor_update_1748.py b/tests/project/test_release_reads_the_vendor_update_1748.py
index 336b4cc1f3..e210e0201f 100644
--- a/tests/project/test_release_reads_the_vendor_update_1748.py
+++ b/tests/project/test_release_reads_the_vendor_update_1748.py
@@ -14,8 +14,9 @@
 run to decide, so Vendor Update cannot conclude anything but ``success`` there
 without going red or cancelled. Create Release's ``vendor_update`` job reads the
 triggering run's jobs instead, and ``version_check`` skips on ``updated ==
-'false'``. Its script, :file:`util/release_vendor_update.py` since #1967, runs
-here against a stand-in ``gh`` that applies the real ``--jq`` filter with ``jq``.
+'false'``. Its step's inline shell runs here under ``bash -e``, as a step with no
+``shell:`` runs, against a stand-in ``gh`` that applies the real ``--jq`` filter
+with ``jq``.
 
 """
 
@@ -32,7 +33,7 @@
 from tests._support import scale_timeout
 from tests.project.test_release_gates import (NULL, WORKFLOW, declared_if, declared_needs,
                                               evaluate_condition, job_blocks, release_context)
-from tests.project.test_release_tags_the_run_sha_1634 import script_command, workflow_steps
+from tests.project.test_release_tags_the_run_sha_1634 import workflow_steps
 
 if TYPE_CHECKING:
     from typing import Any, Optional
@@ -86,10 +87,11 @@ def test_it_runs_only_for_a_vendor_update_that_succeeded(self) -> None:
                 context = release_context(event_name=event_name, workflow_run_conclusion=conclusion)
                 self.assertEqual(evaluate_condition(condition, context), expected)
 
-    def test_it_reads_the_triggering_runs_jobs_with_read_scopes_only(self) -> None:
-        """``actions: read`` for the listing; ``contents: read`` for the checkout of its script (#1967)."""
+    def test_it_reads_the_triggering_runs_jobs_with_actions_read_only(self) -> None:
+        """``actions: read`` for the listing, and nothing else: the job checks nothing out (#1967)."""
         block = self.jobs['vendor_update']
-        self.assertIn('    permissions:\n      actions: read\n      contents: read\n    outputs:', block)
+        self.assertIn('    permissions:\n      actions: read\n    outputs:', block)
+        self.assertEqual([step.get('name') for step in self.steps['vendor_update']], [STEP])
         self.assertIn('updated: ${{ steps.updated.outputs.updated }}', block)
         step = named(self.steps['vendor_update'], STEP)
         self.assertEqual(step.get('id'), 'updated')
@@ -114,18 +116,11 @@ def test_only_a_skipped_vendor_update_job_stops_version_check(self) -> None:
 
 @unittest.skipIf(shutil.which('jq') is None or shutil.which('bash') is None, 'needs jq and bash on PATH')
 class TestTheScript(unittest.TestCase):
-    """``vendor_update``'s step against the two real shapes and the ones it cannot read.
-
-    It runs ``python3 util/release_vendor_update.py`` (#1967), here on this
-    interpreter.
-
-    """
+    """``vendor_update``'s step against the two real shapes and the ones it cannot read."""
 
     @classmethod
     def setUpClass(cls) -> None:
-        run = named(workflow_steps(WORKFLOW.read_text(encoding='utf-8'))['vendor_update'], STEP)['run']
-        cls.command = script_command(run)
-        assert cls.command is not None, run
+        cls.script = named(workflow_steps(WORKFLOW.read_text(encoding='utf-8'))['vendor_update'], STEP)['run']
 
     def setUp(self) -> None:
         self.tmp = pathlib.Path(tempfile.mkdtemp(prefix='pcapkit-1748-'))
@@ -133,6 +128,7 @@ def setUp(self) -> None:
         (self.tmp / 'bin').mkdir()
         (self.tmp / 'bin' / 'gh').write_text(FAKE_GH, encoding='utf-8')
         (self.tmp / 'bin' / 'gh').chmod(0o755)
+        (self.tmp / 'step.sh').write_text(self.script, encoding='utf-8')
 
     def run_step(self, reply: 'Optional[dict[str, Any]]',
                  fail: 'bool' = False) -> 'tuple[subprocess.CompletedProcess[str], str]':
@@ -146,8 +142,8 @@ def run_step(self, reply: 'Optional[dict[str, Any]]',
             'REPLY': str(self.tmp / 'reply.json'), 'ARGS': str(self.tmp / 'args'),
             'GH_FAIL': '1' if fail else '',
         }
-        result = subprocess.run(self.command, cwd=self.tmp, env=env, capture_output=True,
-                                text=True, check=False, timeout=scale_timeout(30))
+        result = subprocess.run(['bash', '-e', str(self.tmp / 'step.sh')], cwd=self.tmp, env=env,
+                                capture_output=True, text=True, check=False, timeout=scale_timeout(30))
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
         return result, output.read_text(encoding='utf-8')
 
diff --git a/tests/project/test_release_status_scripts_1967.py b/tests/project/test_release_status_scripts_1967.py
index 2a8e1d5359..6f743281e7 100644
--- a/tests/project/test_release_status_scripts_1967.py
+++ b/tests/project/test_release_status_scripts_1967.py
@@ -1,16 +1,19 @@
 # -*- coding: utf-8 -*-
-"""#1967: :file:`util/release_status.py` and :file:`util/release_vendor_update.py`, run as Create Release runs them.
+"""#1967: :file:`util/release_status.py`, and ``vendor_update``'s inline shell, run as Create Release runs them.
 
 * :class:`TestTheFormerShellAgrees` runs the shell ``release_status``'s "Report
-  why this run did or did not release anything" and ``vendor_update``'s "Read
-  whether its vendor-update job ran" held before the scripts, on the cases
-  below, and each script on the same, and requires the same status, standard
-  output and error, ``$GITHUB_OUTPUT``, ``$GITHUB_STEP_SUMMARY`` and ``gh``
-  calls. Both step bodies are kept here verbatim, and each case table is checked
-  to reach every branch of its shell.
-* :class:`TestTheStepsRunTheScripts` pins each step to its script, after a
-  checkout of :file:`util/` alone, and the scripts to the standard library and
-  Python 3.7's syntax.
+  why this run did or did not release anything" held before the script, on the
+  cases below, and the script on the same, and requires the same status,
+  standard output and error, ``$GITHUB_OUTPUT``, ``$GITHUB_STEP_SUMMARY`` and
+  ``gh`` calls. The former body is kept here verbatim, and the case table is
+  checked to reach every branch of it.
+* :class:`TestTheVendorUpdateStaysInline` pins ``vendor_update``'s "Read whether
+  its vendor-update job ran", which #1967 moved to a script and then put back
+  inline as too plain to need one, to its shell verbatim, with no checkout, and
+  runs that ``run:`` on its own case table, which reaches each of its branches.
+* :class:`TestTheStepsRunTheScripts` pins ``release_status``'s step to its
+  script, after a checkout of :file:`util/` alone, and the script to the
+  standard library and Python 3.7's syntax.
 
 The shell ran as a step with no ``shell:`` runs on the runner, ``bash -e``, and
 ``bash`` prefixes each of its own errors with the script's path and line, which
@@ -206,9 +209,9 @@
     exit 1
 ''').lstrip()
 
-#: "Read whether its vendor-update job ran" in ``vendor_update``, as it held
-#: before :file:`util/release_vendor_update.py`.
-FORMER_VENDOR = textwrap.dedent(r'''
+#: "Read whether its vendor-update job ran" in ``vendor_update``: its ``run:``,
+#: which a script held for a while (#1967).
+VENDOR_SHELL = textwrap.dedent(r'''
     set -uo pipefail
 
     if ! result="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${PCAPKIT_VENDOR_RUN_ID}/jobs" \
@@ -235,9 +238,10 @@
 JOBS = {
     'release_status': ('Report why this run did or did not release anything', 'python3 util/release_status.py',
                        {'contents': 'read'}),
-    'vendor_update': ('Read whether its vendor-update job ran', 'python3 util/release_vendor_update.py',
-                      {'actions': 'read', 'contents': 'read'}),
 }
+#: ``vendor_update``'s one step, and its permissions: the listing's alone.
+VENDOR_STEP = 'Read whether its vendor-update job ran'
+VENDOR_PERMISSIONS = {'actions': 'read'}
 #: The checkout each job opens with: this run's commit, :file:`util/` alone.
 CHECKOUT = {'ref': '${{ github.sha }}', 'sparse-checkout': 'util', 'persist-credentials': False}
 
@@ -378,7 +382,7 @@
     ('neither', b'success\n', {'PCAPKIT_VENDOR_RUN_ID': UNSET, 'GITHUB_REPOSITORY': UNSET}),
 )
 
-#: Each way the former ``vendor_update`` shell ends: ``name -> (status,
+#: Each way the ``vendor_update`` shell ends: ``name -> (status,
 #: $GITHUB_OUTPUT, its standard output, as a pattern)``.
 VENDOR_BRANCHES = {
     'not listed': (0, '', r'::warning title=Vendor Update not read \(#1748\)::could not list the jobs of '),
@@ -451,6 +455,19 @@ def run_both(self, shell: 'str', script: 'str', env: 'dict[str, str]',
         """The state each leaves: :meth:`former` on ``shell``, then ``python3 util/<script>`` as its step runs it."""
         return self.former(shell, env, reply), self.state([sys.executable, str(UTIL / script)], env, reply)
 
+    def branches(self, shell: 'str', cases: 'list[tuple[str, dict[str, str], bytes]]',
+                 classify: 'Callable[[tuple[object, ...]], list[str]]') -> 'dict[str, list[str]]':
+        """Each case's branch, as ``classify(state)`` names it from ``shell``'s run."""
+        reached = {}  # type: dict[str, list[str]]
+        for name, env, reply in cases:
+            old = self.former(shell, env, reply)
+            branch = classify(old)
+            with self.subTest(case=name):
+                self.assertEqual(len(branch), 1, f'{name} matches {branch}: {old!r}')
+            for found in branch:
+                reached.setdefault(found, []).append(name)
+        return reached
+
 
 def status_env_names() -> 'list[str]':
     """The variables ``release_status``'s step's ``env:`` sets, each of them, as Actions does."""
@@ -496,9 +513,6 @@ def status_env(self, overrides: 'dict[str, Optional[str]]') -> 'dict[str, str]':
         base.update(STATUS_BASE)
         return self.env(base, overrides)
 
-    def vendor_env(self, overrides: 'dict[str, Optional[str]]') -> 'dict[str, str]':
-        return self.env({'GH_TOKEN': 'not-a-token', 'PCAPKIT_VENDOR_RUN_ID': '38650191283'}, overrides)
-
     def test_the_cases_set_what_the_step_sets(self) -> None:
         """The base sets every ``env:`` name, as Actions does, so an unset one is a case's own."""
         self.assertEqual(sorted(STATUS_BASE), sorted(status_env_names()))
@@ -509,26 +523,6 @@ def test_the_release_status(self) -> None:
                 old, new = self.run_both(FORMER_STATUS, 'release_status.py', self.status_env(overrides))
                 self.assertEqual(new, old)
 
-    def test_the_vendor_update(self) -> None:
-        for name, reply, overrides in VENDOR_CASES:
-            with self.subTest(case=name):
-                old, new = self.run_both(FORMER_VENDOR, 'release_vendor_update.py', self.vendor_env(overrides),
-                                         reply)
-                self.assertEqual(new, old)
-
-    def branches(self, shell: 'str', cases: 'list[tuple[str, dict[str, str], bytes]]',
-                 classify: 'Callable[[tuple[object, ...]], list[str]]') -> 'dict[str, list[str]]':
-        """Each case's branch, as ``classify(state)`` names it from the former shell's run."""
-        reached = {}  # type: dict[str, list[str]]
-        for name, env, reply in cases:
-            old = self.former(shell, env, reply)
-            branch = classify(old)
-            with self.subTest(case=name):
-                self.assertEqual(len(branch), 1, f'{name} matches {branch}: {old!r}')
-            for found in branch:
-                reached.setdefault(found, []).append(name)
-        return reached
-
     def test_every_status_branch_is_reached(self) -> None:
         """The curated cases alone reach each of :data:`STATUS_BRANCHES`, each case exactly one."""
         def classify(state: 'tuple[object, ...]') -> 'list[str]':
@@ -543,19 +537,6 @@ def classify(state: 'tuple[object, ...]') -> 'list[str]':
                                 classify)
         self.assertEqual(sorted(reached), sorted(STATUS_BRANCHES))
 
-    def test_every_vendor_branch_is_reached(self) -> None:
-        def classify(state: 'tuple[object, ...]') -> 'list[str]':
-            status, stdout, stderr, output = state[0], str(state[1]), str(state[2]), state[3]
-            written = str(output)[len('earlier=1\n'):] if output is not None else ''
-            return [name for name, (code, lines, pattern) in VENDOR_BRANCHES.items()
-                    if status == code and written == lines and re.match(pattern, stdout)
-                    and (pattern != '$' or stdout == '')
-                    and (name != 'an unset variable' or 'unbound variable' in stderr)]
-        reached = self.branches(FORMER_VENDOR,
-                                [(name, self.vendor_env(overrides), reply) for name, reply, overrides in VENDOR_CASES],
-                                classify)
-        self.assertEqual(sorted(reached), sorted(VENDOR_BRANCHES))
-
     def test_the_samples_reach_past_the_early_exits(self) -> None:
         """So agreement on them is agreement on the reconciliation, not only on case 1."""
         titles = set()
@@ -568,8 +549,39 @@ def test_the_samples_reach_past_the_early_exits(self) -> None:
                 self.assertIn(title, titles)
 
 
+@unittest.skipIf(not BASH, 'needs bash, which runs the step')
+class TestTheVendorUpdateStaysInline(_Stand):
+    """``vendor_update`` runs its shell inline (#1967), and that shell ends each way it should."""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.found = steps(WORKFLOW, 'vendor_update')
+
+    def vendor_env(self, overrides: 'dict[str, Optional[str]]') -> 'dict[str, str]':
+        return self.env({'GH_TOKEN': 'not-a-token', 'PCAPKIT_VENDOR_RUN_ID': '38650191283'}, overrides)
+
+    def test_the_step_holds_its_shell_and_nothing_checks_out(self) -> None:
+        self.assertEqual([step.get('name') for step in self.found], [VENDOR_STEP])
+        self.assertEqual(self.found[0]['run'], VENDOR_SHELL)
+        self.assertEqual(load(WORKFLOW)['jobs']['vendor_update']['permissions'], VENDOR_PERMISSIONS)
+
+    def test_every_branch_is_reached(self) -> None:
+        """Each case of :data:`VENDOR_CASES` ends one way, and between them every way."""
+        def classify(state: 'tuple[object, ...]') -> 'list[str]':
+            status, stdout, stderr, output = state[0], str(state[1]), str(state[2]), state[3]
+            written = str(output)[len('earlier=1\n'):] if output is not None else ''
+            return [name for name, (code, lines, pattern) in VENDOR_BRANCHES.items()
+                    if status == code and written == lines and re.match(pattern, stdout)
+                    and (pattern != '$' or stdout == '')
+                    and (name != 'an unset variable' or 'unbound variable' in stderr)]
+        reached = self.branches(self.found[0]['run'],
+                                [(name, self.vendor_env(overrides), reply) for name, reply, overrides in VENDOR_CASES],
+                                classify)
+        self.assertEqual(sorted(reached), sorted(VENDOR_BRANCHES))
+
+
 class TestTheStepsRunTheScripts(unittest.TestCase):
-    """Each job checks out :file:`util/` alone, at this run's commit, and runs its script on the image's ``python3``."""
+    """The job checks out :file:`util/` alone, at this run's commit, and runs its script on the image's ``python3``."""
 
     def test_each_job_checks_out_util_then_runs_its_script(self) -> None:
         blocks = job_blocks((ROOT / '.github' / 'workflows' / WORKFLOW).read_text(encoding='utf-8'))
@@ -589,14 +601,14 @@ def test_each_job_checks_out_util_then_runs_its_script(self) -> None:
     def test_no_step_holds_the_former_shell(self) -> None:
         for job, found in sorted(load(WORKFLOW)['jobs'].items()):
             for step in found.get('steps', []):
-                for line in ('reconciled_github', 'Stranded partial release', 'select(.name == "vendor-update")'):
+                for line in ('reconciled_github', 'Stranded partial release'):
                     with self.subTest(job=job, step=step.get('name'), line=line):
                         self.assertNotIn(line, step.get('run', ''))
 
     def test_the_scripts_need_only_util_and_python_3_7(self) -> None:
         """The sparse checkout holds :file:`util/`, and the image's ``python3`` nothing installed."""
         allowed = {'__future__', 'argparse', 'os', 'subprocess', 'sys', 'typing', '_actions', 'util'}
-        for name in ('release_status.py', 'release_vendor_update.py'):
+        for name in ('release_status.py',):
             with self.subTest(script=name):
                 tree = ast.parse((UTIL / name).read_text(encoding='utf-8'), feature_version=(3, 7))
                 imported = {alias.name.split('.')[0] for node in ast.walk(tree) if isinstance(node, ast.Import)
diff --git a/tests/project/test_release_tags_the_run_sha_1634.py b/tests/project/test_release_tags_the_run_sha_1634.py
index 09fa437a27..2523781576 100644
--- a/tests/project/test_release_tags_the_run_sha_1634.py
+++ b/tests/project/test_release_tags_the_run_sha_1634.py
@@ -150,9 +150,10 @@
 #: commit Vendor Update ran *on*, ``945c3c3d8`` for run 38008819343, not its bump.
 UPSTREAM_COMMIT = re.compile(r'\bworkflow_run\.head_|\bhead_commit\b')
 
-#: The jobs that check out the repository, which is every job with steps:
-#: ``vendor_update`` and ``release_status`` check out util/ for their scripts (#1967).
-CHECKOUT_JOBS = ('vendor_update', 'version_check', 'github', 'tag', 'pypi', 'conda', 'release_status')
+#: The jobs that check out the repository, which is every job with steps but
+#: ``vendor_update``, whose shell is inline: ``release_status`` checks out util/
+#: for its script (#1967).
+CHECKOUT_JOBS = ('version_check', 'github', 'tag', 'pypi', 'conda', 'release_status')
 
 #: Git commands that move a checkout onto ``main``'s history or rewrite it.
 #: ``merge-base`` is a read, so it is excluded from ``git merge``.
diff --git a/util/apt_packages.py b/util/apt_packages.py
index b8a95fcc4b..aaf72cd692 100644
--- a/util/apt_packages.py
+++ b/util/apt_packages.py
@@ -1,12 +1,11 @@
 # -*- coding: utf-8 -*-
-"""Plan, seed, install and collect a job's system packages (#1967).
+"""Plan, install and collect a job's system packages (#1967).
 
-The apt steps of :file:`.github/workflows/unit-tests.yml`'s ``engine-tests`` and
-``pypcap-parity`` jobs (and so ``pypcap-parity-ktlo``) run, from the checkout's
-root and on the image's ``/usr/bin/python3``::
+The plan, install and collect steps of :file:`.github/workflows/unit-tests.yml`'s
+``engine-tests`` and ``pypcap-parity`` jobs (and so ``pypcap-parity-ktlo``) run, from
+the checkout's root and on the image's ``/usr/bin/python3``::
 
     /usr/bin/python3 util/apt_packages.py plan
-    /usr/bin/python3 util/apt_packages.py seed
     /usr/bin/python3 util/apt_packages.py install [--name NAME]
     /usr/bin/python3 util/apt_packages.py collect
 
@@ -24,9 +23,6 @@
    ``apt-debs-<ImageOS>-<RUNNER_ARCH>-<APT_SET>-``, and ``key``, that prefix and the
    first 16 hex digits of the lines' SHA-256, are appended to ``$GITHUB_OUTPUT``.
    ``ImageOS`` is ``unknown`` when unset or empty.
-``seed``
-   ``sudo cp $RUNNER_TEMP/apt-debs/*.deb /var/cache/apt/archives/``, its status the
-   script's on a failure, then how many ``.deb`` files that directory holds.
 ``install``
    Nothing when ``APT_PACKAGES`` is empty. Otherwise, when it names ``tshark``,
    pre-seeds debconf against its "non-superusers may capture" prompt, then up to
@@ -84,7 +80,7 @@
 INSTALL_BOUND = 180
 #: The runner image's ``mirror+file:`` list, which ``install`` edits before its retry.
 MIRRORS = '/etc/apt/apt-mirrors.txt'
-#: apt's archive, which ``seed`` fills and ``collect`` reads.
+#: apt's archive, which ``collect`` reads.
 ARCHIVES = '/var/cache/apt/archives'
 #: The cached ``.deb`` files, under ``$RUNNER_TEMP``.
 CACHE_DIR = 'apt-debs'
@@ -145,17 +141,6 @@ def plan() -> 'int':
     return 0
 
 
-def seed(archives: 'str') -> 'int':
-    """Copy the restored ``.deb`` files into apt's archive."""
-    cache = os.path.join(os.environ['RUNNER_TEMP'], CACHE_DIR)
-    # An unmatched glob stays the pattern, as the shell's does, so `cp` fails on it.
-    copied = call(['sudo', 'cp', *(debs(cache) or [os.path.join(cache, '*.deb')]), archives + '/'])
-    if copied.returncode != 0:
-        return _actions.exit_status(copied.returncode)
-    _actions.say(f'Seeded {count_debs(cache)} .deb files')
-    return 0
-
-
 def fallback(mirrors: 'str', suffix: 'str') -> 'None':
     """Drop azure from ``mirrors`` when another ``http`` mirror would remain, and say so."""
     if not os.path.isfile(mirrors):
@@ -242,10 +227,8 @@ def main(argv: 'Optional[list[str]]' = None) -> 'int':
     commands = parser.add_subparsers(dest='command', metavar='COMMAND')
     commands.required = True
     commands.add_parser('plan', help='update the indexes and write the cache key')
-    for command, text in (('seed', 'copy the restored .deb files into apt\'s archive'),
-                          ('collect', 'copy the installed versions\' .deb files into the cache')):
-        sub = commands.add_parser(command, help=text)
-        sub.add_argument('--archives', default=ARCHIVES, help=f'apt\'s archive (default: {ARCHIVES})')
+    sub = commands.add_parser('collect', help='copy the installed versions\' .deb files into the cache')
+    sub.add_argument('--archives', default=ARCHIVES, help=f'apt\'s archive (default: {ARCHIVES})')
     sub = commands.add_parser('install', help='install APT_PACKAGES, retrying once')
     sub.add_argument('--name', help='what the annotation titles name, in parentheses')
     sub.add_argument('--mirrors', default=MIRRORS, help=f'the mirror list (default: {MIRRORS})')
@@ -253,7 +236,6 @@ def main(argv: 'Optional[list[str]]' = None) -> 'int':
 
     run = {
         'plan': plan,
-        'seed': lambda: seed(args.archives),
         'install': lambda: install(args.mirrors, args.name),
         'collect': lambda: collect(args.archives),
     }[args.command]  # type: Callable[[], int]
diff --git a/util/release_vendor_update.py b/util/release_vendor_update.py
deleted file mode 100644
index 37c2412b71..0000000000
--- a/util/release_vendor_update.py
+++ /dev/null
@@ -1,138 +0,0 @@
-# -*- coding: utf-8 -*-
-"""Whether the Vendor Update that started a Create Release run updated anything (#1748).
-
-:file:`.github/workflows/create-release.yml`'s ``vendor_update`` job runs it as
-``python3 util/release_vendor_update.py``, the step "Read whether its
-vendor-update job ran". It lists the jobs of Vendor Update run
-``PCAPKIT_VENDOR_RUN_ID`` with ``gh api``, "List jobs for a workflow run", and
-reads the conclusion of the one named ``vendor-update``:
-
-``success``
-    appends ``updated=true`` to ``$GITHUB_OUTPUT``;
-``skipped``
-    appends ``updated=false`` and says why: its verdict did not cover the commit
-    it checked out;
-anything else, or a listing that failed
-    leaves ``updated`` unset, with a ``::warning``, so ``version_check`` runs as
-    before #1748: it can cost a run, never a release.
-
-It exits 0 on each. The step formerly held this as shell, under ``set -uo
-pipefail`` and the runner's ``bash -e``; this prints the same lines, unescaped as
-``echo`` wrote them, and replaces each line break in a conclusion it cannot read
-with a space, as ``${result//$'\\n'/ }`` did. A variable it reads that is unset,
-which Actions never leaves it, is ``<name>: unbound variable`` where the shell's
-``set -u`` refused it: inside ``gh api``'s arguments that fails the listing, and
-anywhere else it ends the script with status 1.
-
-The job checks out only :file:`util/` and has no setup-python, so this runs on
-the image's ``python3``: standard library only, and Python 3.7's syntax.
-
-"""
-
-from __future__ import annotations
-
-import argparse
-import os
-# gh, with a fixed argument list and no shell.
-import subprocess  # nosec: B404
-import sys
-from typing import TYPE_CHECKING
-
-try:  # #2047: run as `python util/<script>.py`, with util/ first on sys.path
-    import _actions
-except ImportError:  # imported as util.<script>, or loaded by path, from the repository root
-    from util import _actions
-
-if TYPE_CHECKING:
-    from typing import Optional, Tuple
-
-__all__ = ['JOBS_JQ', 'Unbound', 'var', 'list_conclusion', 'read', 'main']
-
-#: The ``--jq`` filter reading the ``vendor-update`` job's conclusion.
-JOBS_JQ = '.jobs[] | select(.name == "vendor-update") | .conclusion'
-#: The title of every warning, for a run this cannot read.
-NOT_READ = 'Vendor Update not read (#1748)'
-
-
-class Unbound(Exception):
-    """A variable read as ``$NAME`` that is unset, which ``set -u`` refused."""
-
-
-def var(name: 'str') -> 'str':
-    """``$name``; :exc:`Unbound` where it is unset."""
-    try:
-        return os.environ[name]
-    except KeyError:
-        raise Unbound(name) from None
-
-
-def unbound(error: 'Unbound') -> 'None':
-    """Say what ``set -u`` said."""
-    sys.stdout.flush()
-    print(f'{error}: unbound variable', file=sys.stderr, flush=True)
-
-
-def list_conclusion() -> 'Tuple[int, str]':
-    """``gh api``'s status as the shell reports it, and its output as ``$(...)`` gives it.
-
-    Its standard error goes where the script's does. A ``gh`` missing from
-    ``PATH`` is status 127, and an unset variable in its arguments status 1.
-
-    """
-    try:
-        endpoint = f"repos/{var('GITHUB_REPOSITORY')}/actions/runs/{var('PCAPKIT_VENDOR_RUN_ID')}/jobs"
-    except Unbound as error:
-        unbound(error)
-        return 1, ''
-    sys.stdout.flush()
-    try:
-        result = subprocess.run(['gh', 'api', endpoint, '--paginate', '--jq', JOBS_JQ],  # nosec: B603 B607
-                                stdout=subprocess.PIPE, check=False)
-    except FileNotFoundError:
-        print('gh: command not found', file=sys.stderr, flush=True)
-        return 127, ''
-    output = result.stdout.decode('utf-8', 'surrogateescape').rstrip('\n')
-    return _actions.exit_status(result.returncode), output
-
-
-def updated(value: 'str') -> 'None':
-    """Append ``updated=value`` to ``$GITHUB_OUTPUT``."""
-    _actions.set_output('updated', value, environ={'GITHUB_OUTPUT': var('GITHUB_OUTPUT')})
-
-
-def read() -> 'int':
-    """Read the ``vendor-update`` job's conclusion into ``updated``; the exit status."""
-    status, result = list_conclusion()
-    if status:
-        _actions.say(_actions.annotation(
-            'warning', f"could not list the jobs of Vendor Update run {var('PCAPKIT_VENDOR_RUN_ID')}, so this run "
-                       'treats it as one that updated.', title=NOT_READ, escape=False))
-        return 0
-    if result == 'success':
-        updated('true')
-    elif result == 'skipped':
-        updated('false')
-        _actions.say(f"Vendor Update run {var('PCAPKIT_VENDOR_RUN_ID')} skipped vendor-update: its verdict did "
-                     'not cover the commit it checked out.')
-    else:
-        flat = result.replace('\n', ' ')
-        _actions.say(_actions.annotation(
-            'warning', f"Vendor Update run {var('PCAPKIT_VENDOR_RUN_ID')} reports vendor-update as '{flat}', so "
-                       'this run treats it as one that updated.',
-            title=NOT_READ, escape=False))
-    return 0
-
-
-def main(argv: 'Optional[list[str]]' = None) -> 'int':
-    """Read the triggering Vendor Update's ``vendor-update`` job; the exit status."""
-    parser = argparse.ArgumentParser(description=__doc__.split('\n', 1)[0])
-    parser.parse_args(argv)
-    try:
-        return read()
-    except Unbound as error:
-        unbound(error)
-        return 1
-
-
-if __name__ == '__main__':
-    sys.exit(main())