diff --git a/.github/workflows/gate-topology.yml b/.github/workflows/gate-topology.yml
index 1ae64d499c..48d21a2d91 100644
--- a/.github/workflows/gate-topology.yml
+++ b/.github/workflows/gate-topology.yml
@@ -115,19 +115,21 @@ jobs:
   # claw/sarif: a changed .t27 spec that does not parse, or declares functions with no body, becomes a code-scanning
   # alert from the TRI CLAW App. The law is specs/claw/sarif_feed.t27 (gen/c/claw/sarif_feed.c); this job mints the
   # token (security_events write + contents read, the code-scanning-sarif row of specs/claw/github_surface.t27),
-  # runs the signed t27o release t27c over the changed specs and uploads what the law prints.
+  # runs the signed t27o release t27c over the changed specs and uploads what the law prints. #10501: no token is asked for
+  # when no .t27 changed, and an installation without security_events write leaves a step-summary note, never a red job.
   claw-sarif:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
-    permissions: {contents: read}
+    permissions: {contents: read, pull-requests: read}
     steps:
       - id: have
-        env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}"}
-        run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/sarif uploaded nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
-      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-security-events: write, permission-contents: read}}
-      - {if: steps.have.outputs.ok, uses: actions/checkout@v6, with: {fetch-depth: 2}}
-      - {if: steps.have.outputs.ok, uses: sigstore/cosign-installer@v3}
-      - if: steps.have.outputs.ok
+        env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}", GH_TOKEN: "${{ github.token }}", R: "${{ github.repository }}", N: "${{ github.event.pull_request.number }}"}
+        run: gh api --paginate "repos/$R/pulls/$N/files" --jq '.[]|select(.status!="removed")|.filename|select(endswith(".t27"))' > /tmp/t27s; if [ ! -s /tmp/t27s ]; then echo "claw/sarif asked for no token - this pull request changes no .t27 file." >> "$GITHUB_STEP_SUMMARY"; elif [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/sarif uploaded nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
+      - {id: tok, if: steps.have.outputs.ok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-security-events: write, permission-contents: read}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/sarif uploaded nothing - the TRI CLAW App could not mint a token with security_events write; grant it and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/checkout@v6, with: {fetch-depth: 2}}
+      - {if: steps.tok.outputs.token, uses: sigstore/cosign-installer@v3}
+      - if: steps.tok.outputs.token
         env: {V: t27o-v0.1.0}
         run: |
           cd /tmp; B=https://github.com/gHashTag/t27/releases/download/$V
@@ -136,7 +138,7 @@ jobs:
           sha256sum -c --ignore-missing checksums-$V.txt; chmod +x t27c; cd "$GITHUB_WORKSPACE"
           printf '#include "gen/c/claw/sarif_feed.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(void){size_t k=1<<22,n;uint8_t*b=malloc(k),*o=malloc(k);n=fread(b,1,k,stdin);size_t m=feed_sarif(b,n,o,k);if(n==k||m>k)return 3;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -I . -x c -o /tmp/feed -
           git diff --name-only --diff-filter=d HEAD^1 HEAD -- '*.t27' | while read -r f; do printf '%s\t%s\t%s\n' "$f" "$(/tmp/t27c spec-status "$f" 2>&1 </dev/null | tail -1)" "$(/tmp/t27c parse "$f" 2>&1 >/dev/null </dev/null | head -1)"; done | /tmp/feed > /tmp/claw.sarif
-      - {if: steps.have.outputs.ok, uses: github/codeql-action/upload-sarif@v4, with: {sarif_file: /tmp/claw.sarif, category: claw/sarif, token: "${{ steps.tok.outputs.token }}"}}
+      - {if: steps.tok.outputs.token, uses: github/codeql-action/upload-sarif@v4, with: {sarif_file: /tmp/claw.sarif, category: claw/sarif, token: "${{ steps.tok.outputs.token }}"}}
 
   # claw/suggest: a changed .t27 spec that `t27c fmt` (specs/tri/fmt_source.t27, whitespace only) would reformat becomes a
   # suggestion review from the TRI CLAW App. Placement is specs/claw/suggest.t27, the driver is specs/claw/suggest_feed.t27
diff --git a/MIGRATION_AUDIT.md b/MIGRATION_AUDIT.md
index 2e853668e6..2cfe2324d7 100644
--- a/MIGRATION_AUDIT.md
+++ b/MIGRATION_AUDIT.md
@@ -50,7 +50,7 @@ centralization in the `tri` CLI, per issue #592.
 | `conformance/kepler_newton_tests.py` | C | Keep | Conformance helper not on gate. |
 | `test_notebooklm.py`, `test_notebooklm_venv.sh` | C | Keep | Manual smoke tests at repo root. |
 | `scripts/tri-*.py`, `scripts/audit_discovery.py`, `scripts/check_first_party_doc_language.py`, `scripts/verify_*.py`, `scripts/lee_*.py`, `scripts/compare_*.py`, `scripts/fix_*.py`, `scripts/overnight_research_agent.py`, `scripts/print_pellis_seal_decimal.py`, `scripts/unified_search_all.py`, `scripts/wrapup/*.py` | C | Keep | Standalone helpers; none referenced from `.githooks/` or commit-path workflows. |
-| `scripts/install-*.sh`, `scripts/setup-git-hooks.sh`, `scripts/auto-*.sh`, `scripts/check-conflicts.sh`, `scripts/bulk-create-notebooks.sh`, `scripts/generate_episodes.sh`, `scripts/git_commands_tasks_1_4.sh`, `scripts/mcp-wrapper.sh`, `scripts/phi-loop-stack.sh`, `scripts/run_v51_multiple.sh`, `scripts/test-agent-bridge.sh`, `scripts/verify-notebooklm.sh`, `scripts/verify-ssot-integration.sh` | C | Keep | One-shot setup / human-invoked utilities; not gated. |
+| `scripts/install-*.sh`, `scripts/setup-git-hooks.sh`, `scripts/auto-*.sh`, `scripts/check-conflicts.sh`, `scripts/bulk-create-notebooks.sh`, `scripts/generate_episodes.sh`, `scripts/mcp-wrapper.sh`, `scripts/phi-loop-stack.sh`, `scripts/run_v51_multiple.sh`, `scripts/test-agent-bridge.sh`, `scripts/verify-notebooklm.sh`, `scripts/verify-ssot-integration.sh` | C | Keep | One-shot setup / human-invoked utilities; not gated. |
 
 ## New `tri` subcommands added by this PR
 
diff --git a/scripts/git_commands_tasks_1_4.sh b/scripts/git_commands_tasks_1_4.sh
deleted file mode 100755
index afe80d3d5d..0000000000
--- a/scripts/git_commands_tasks_1_4.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash
-# Git commands for Trinity Physics deployment tasks 1-4
-
-echo "=== Trinity Physics Deployment Git Commands ==="
-echo ""
-
-# Step 1: Stage new files
-echo "Step 1: Staging new files..."
-git add scripts/pysr_true_blind_test.py
-git add research/pysr-blind-test/occam_results.md
-git add proofs/gravity/dl_bounds.v
-
-# Step 2: Stage modified files (if needed)
-echo "Step 2: Checking modified files..."
-# FORMULA_TABLE.md updates will be staged separately after manual review
-
-# Step 3: Commit with traceability
-echo "Step 3: Creating commit..."
-git commit -m "feat(trinity-physics): Deploy PySR blind test, Occam search, Coq DL bounds
-
-- Add pysr_true_blind_test.py with PDG 2024 integration
-- Add occam_results.md: PM4 confirmed as unique complexity=3 solution
-- Update dl_bounds.v: formalized Domagala-Lewandowski bounds
-
-Closes #N
-"
-echo ""
-echo "=== Git commands completed ==="
-echo "Next steps:"
-echo "  1. Review FORMULA_TABLE.md updates"
-echo "  2. Run PySR blind tests"
-echo "  3. Push to remote if validated"