[acamarata]

Rows

D-1113 (fixed). checkNoNullItems decoded the args/argv array without UseNumber, so a 5000-digit number was parsed as float64 and all its digits were echoed in the E420 message (5339 bytes). Added dec.UseNumber(). New request_nulls_test.go: the bound test fails before the fix (5339 bytes) and passes after; a second test pins that top-level nulls are still refused and nested ones are left to the typed decode.

D-0590 (fixed). scheduleEnvSelector now returns (string, error): a missing .env (fs.ErrNotExist) still means dev, any other read/parse error is returned and ScheduleStream fails before printing or writing a unit. New TestScheduleStreamMalformedDotEnv (malformed .env, no process ENV) fails on origin/main (err = <nil>) and passes now; it also checks the missing-.env case still yields ENV=dev.

D-0168 (blocked). Plugin data sets for nself backup are tied to P7-NODE-20 (ci serve backup|restore) and the open NODE owner question 3 (move the coordinator backup into nself backup). A scope decision, not a local fix.

D-0364 (blocked). Core backup create writing the k8s sidecar needs the EPIC DEPL D8 per-table fingerprint query to match plugins free/k8s/internal/ops byte for byte, taken in an exported REPEATABLE READ snapshot held open while pg_dump --snapshot streams. That is a cross-repo contract from P7-DEPL-08 and can only be verified against a live Postgres container (no docker on this worker).

D-0132 (blocked). Still present (hand-rolled ed25519.Verify in internal/license/{cache_entry,jwt,revocation_verify}.go, internal/plugin/verify.go, sdk/go/identity.go, sdk/go/licensing). The row's own resolution defers the move onto sdk/go/signing to when P10 touches those domains; a multi-domain rewrite of security-critical verification is not a small single-purpose change.

Commands run

• go build ./... ok
• go vet ./internal/backup ./internal/invoke clean; gofmt -l clean
• go test ./internal/backup/... ./internal/invoke/... 908 passed
• Reverted the D-0590 fix locally: new test fails; restored: passes

[acamarata]

Rebased onto current origin/main (6 commits landed, including #959). On the rebased head go build ./..., go vet ./... and go test ./... all pass, so the ratchet tests (nginx call-site list, docker funnel, file budget, panic baseline) are satisfied without touching any ratchet. The PR adds no new funnel, nginx or panic sites, and no non-test file over 300 lines. The earlier gate failure was the stale base plus a gate-host log glob error (no matches found: ...ci/nself-cli-c8f3107-...log*.log), not a test failure in this diff.

[acamarata]

Rebased onto current origin/main (5 commits behind, no conflicts). Full go build ./... and go test ./... pass locally on the rebased head (166 packages ok, including the nginx call-site, docker funnel, file-budget and panic-baseline ratchets; none loosened). The previous gate failure was Host key verification failed from the gate host (an ssh problem, not a test failure), so the rebase was the only change needed. New head: 05a026f.

[acamarata]

Rebased onto current origin/main (4 commits behind). Full go build ./... and go test ./... pass on the rebased head, including the nginx call-site, docker funnel, 300-line and panic-baseline ratchets; no ratchet was changed. The earlier gate failure was a stale base plus a log-glob error on the gate host (no matches found on the log path), not a test failure in this diff.