[acamarata]

Rows

D-1123 (fixed). buildEvidence set freshness: current next to binding: unbound for a dirty tree or a missing commit, which the schema forbids. It now reports unknown with a reason, the same as internal/evidence/build.go. Test TestUnboundEvidenceIsNeverCurrent validates the document against ci-evidence.v1; it fails without the fix (freshness "current", schema error).

D-1125 (fixed, partly already fixed). The "ignores Options.Home" half was fixed by #472 (hook opens PolicyRequest.Store). The remaining half was real: only run-scope Ignored entries reached the run; protected-branch, pin and revision refusals and a stale fetch were dropped. PolicyResult.Notes now carries them and conclude adds them as policy: ... notes. Tests: TestPolicyHookReportsBranchDiagnostics, TestPolicyNotesReachSummary, TestPolicyNotes.

D-1126 (fixed). The tip-read failure was already reported as E672, but the text said "could not be fetched or read" even when the fetch had succeeded. Branch.Fetched now tells the cases apart and the note says "was fetched but its tip could not be read". Test TestFetchedButUnreadableTipIsReported fails without the resolve.go change.

D-0293 (BLOCKED). Porting free/file-processing and free/media-processing from Rust to Go is a rewrite of two plugin runtimes plus a decision on scope: the row asks to check overlap with free/storage-transform (no such directory exists; free/storage and free/object-storage do), and both plugins also ship a TypeScript implementation under ts/ that does use sharp/ffmpeg, so which implementation is canonical is an open product call. Not a small single-purpose fix, and it touches the release path (Dockerfiles, Cargo, cargo audit). Related D-0294 and D-0306 are untouched.

D-0623 (fixed, CI-comment part stale).

• .github/workflows/nself-ci.yml no longer has any pnpm or file: text; the gate there is the pinned nself-ci. The stale comment is in the two ts/pnpm-workspace.yaml files ("GitHub nself-ci workflow ... run pnpm 9"); corrected.
• free/file-processing/install.sh used npm (link: fails with EUNSUPPORTEDPROTOCOL, probed) and swallowed errors with 2>/dev/null || plugin_warn. It now installs shared and ts/ with pnpm, builds, and fails on any error or a missing pnpm. free/media-processing has no install.sh. Test: free/file-processing/tests/install-ts.test.sh (stub pnpm; install failure, build failure and missing pnpm each return 1).
• READMEs/QUICKSTART now say pnpm and why.
• New ts-pnpm-matrix job in build.yml: pnpm 9, 10, 11 x both plugins, shared deps installed with shared/dist absent, then install, typecheck, build. I ran all six combinations locally (pnpm 9.15.9, 10.34.8, 11.28.8): install, typecheck and build all exit 0. The workflow itself has not run on GitHub yet.

Commands run

• cd free/ci && go build -mod=vendor ./... && go vet -mod=vendor ./...: clean.
• go test -mod=vendor ./internal/run ./internal/policy: 375 passed.
• Whole module go test -mod=vendor ./...: failures in cmd/agent (TestServeStdioExitsNonZeroWithE663OnAProdStackMarker) and internal/legacy (TestSecretsEnvLiveKeyGateTrackedValueOnly) are pre-existing: both fail identically on a clean origin/main worktree. internal/run (TestStatusNotPostedForPartialCancelledOrOutsideConfig), internal/exec and agentapi failed once under load and pass on rerun.
• bash free/file-processing/tests/install-ts.test.sh: 4 ok.
• pnpm 9/10/11 install+typecheck+build matrix replicated locally in a scratch copy.