[acamarata]

D-1184 (fixed)

scripts/drill/toolchain-pins/run read a tool row's sources through a process substitution (done < <(jq -c '.sources[]' ...)). set -euo pipefail does not stop a failed process substitution, so a tool row with no sources made jq fail silently, the loop ran zero times and the row passed with nothing checked. The script now reads sources first and emits a failing check ("tool row has no sources to verify") when it is absent or empty.

Test: TestDrillFailsWhenAToolRowHasNoSources (absent and empty cases). Against the old script both cases fail (exit 0, result pass); with the fix they pass.

D-0112 (not changed here, blocked on a product decision)

• notify vs notifications: notifications is already deprecated since v1.1.0 with a migration note in its README and registry description pointing to notify. No code change needed beyond the formal sunset step.
• jobs vs job-queue: these are not drop-in duplicates (jobs is Postgres-polling, bundle task, port 3105; job-queue is Redis-backed with a DLQ, library service kind, requires nself >=1.0.0). Picking the survivor is a product-scope call, and the registry deprecation entry needs a regenerated, signed registry.json (release flow). Left for the owner.

Checks

• bash -n scripts/drill/toolchain-pins/run: ok
• cd free/ci && go vet -mod=vendor ./internal/toolchain/: ok
• go test -mod=vendor ./internal/toolchain/...: ok
• go test -mod=vendor ./... in free/ci: two failures, cmd/agent TestServeStdioExitsNonZeroWithE663OnAProdStackMarker and internal/legacy TestSecretsEnvLiveKeyGateTrackedValueOnly. Both fail identically on a clean origin/main, so they pre-exist.