From 2534760faea57f639b78ae2135a7f476b3043a85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Przemys=C5=82aw=20Galarowicz?= <pgalarowicz@gmail.com>
Date: Mon, 10 Aug 2026 21:44:27 +0200
Subject: [PATCH 1/2] chore(ci): drop floating npm@latest from publish; assert
 the Trusted-Publishing npm floor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

publish.yml ran `npm install -g npm@latest` inside the repo's highest-trust job
— OIDC Trusted Publishing, `id-token: write`, the `npm-publish` environment —
so whatever npm shipped that day executed the release.

Two facts made the fix "delete", not "pin".

1. The install is unnecessary. Its own comment gives the only reason
   ("Trusted Publishing requires npm >= 11.5.1"), but the digest-pinned
   setup-node with node-version: 24 resolves to the latest released v24.x, and
   that release — v24.19.0 as of 2026-08-10 — bundles npm 11.17.0, verified
   against the tag itself rather than the branch head. npm's own docs confirm
   the floor: "Trusted publishing requires npm CLI version 11.5.1 or later and
   Node version 22.14.0 or higher." The publish job can run zero publish-time
   tool downloads.

2. The floating step had already crossed a major, silently. The registry
   `latest` dist-tag is npm 12.0.2 today, so every release since npm 12 shipped
   published with a major the workflow was never written against — the live
   demonstration of why @latest rots in a release path.

The step is replaced by an "Assert npm floor" step: pure node stdlib, no
packages, no network, a three-part integer semver compare that exits non-zero
naming both versions. The floor is now enforced instead of installed, and the
release job downloads no third-party tool at all.

Fail-closed rests on the PARSE, not the shell. `set -euo pipefail` does NOT
abort on a command substitution used as an argument (reproduced:
`bash -c 'set -euo pipefail; echo "[$(nonexistent)]"; echo REACHED'` prints
both and exits 0), so a failing `npm --version` arrives as "" and exits 1 as an
unparseable version.

Also adds .dev/floor/check-run-pins.mjs so this cannot silently regress.
check-action-pins scans `uses:` refs only; a `run:` line pulling @latest was
outside its contract. The new gate classifies every package spec in a
recognised install/exec invocation across workflows and local composite
actions, requiring an exact semver — enum reasons floating-version /
unpinned-package / unpinnable-version / unreadable-file. It is wired with no
workflow change: floor.yml's existing `node --test ".dev/**/*.test.mjs"` glob
collects its live repo-consistency test on every PR.

Proof of record, since publish.yml only fires on `release: published` and no
gate in this repo can execute it: the assert program was extracted from the
shipped publish.yml bytes and run against 11.5.0 (exit 1), 11.5.1 (exit 0,
inclusive), 11.17.0 (0), 12.0.2 (0), "" (1) and "garbage" (1); the whole step
body also executes clean against real npm. Execution proof is the next release.

Named residual, not fixed here: node-version: 24 floats within the major, so
the bundled npm floats across Node-vetted 11.x releases. The assert catches any
dip below the floor; pinning node exactly is the node-version-policy follow-up
(third mention — it has earned its own ticket).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../publish-npm-floor-assert/GRILL.md         | 178 ++++++++
 .../features/publish-npm-floor-assert/PLAN.md | 234 ++++++++++
 .../publish-npm-floor-assert/REGRESSION.md    |  63 +++
 .../publish-npm-floor-assert/REVIEW.md        | 170 +++++++
 .../features/publish-npm-floor-assert/SHIP.md |  57 +++
 .../publish-npm-floor-assert/VERIFY.md        |  81 ++++
 .../regression-report.json                    |  22 +
 .../verify-report.json                        |  19 +
 .dev/floor/check-run-pins.mjs                 | 384 ++++++++++++++++
 .dev/floor/check-run-pins.test.mjs            | 432 ++++++++++++++++++
 .github/workflows/publish.yml                 |  37 +-
 .pharn/pharn-dev-verify/results.json          |   2 +-
 .pharn/writes-scope.json                      |   6 +-
 docs/RELEASING.md                             |  14 +-
 14 files changed, 1687 insertions(+), 12 deletions(-)
 create mode 100644 .dev/features/publish-npm-floor-assert/GRILL.md
 create mode 100644 .dev/features/publish-npm-floor-assert/PLAN.md
 create mode 100644 .dev/features/publish-npm-floor-assert/REGRESSION.md
 create mode 100644 .dev/features/publish-npm-floor-assert/REVIEW.md
 create mode 100644 .dev/features/publish-npm-floor-assert/SHIP.md
 create mode 100644 .dev/features/publish-npm-floor-assert/VERIFY.md
 create mode 100644 .dev/features/publish-npm-floor-assert/regression-report.json
 create mode 100644 .dev/features/publish-npm-floor-assert/verify-report.json
 create mode 100644 .dev/floor/check-run-pins.mjs
 create mode 100644 .dev/floor/check-run-pins.test.mjs

diff --git a/.dev/features/publish-npm-floor-assert/GRILL.md b/.dev/features/publish-npm-floor-assert/GRILL.md
new file mode 100644
index 0000000..d152070
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/GRILL.md
@@ -0,0 +1,178 @@
+# GRILL — `.dev/features/publish-npm-floor-assert/PLAN.md`
+
+Spec-hash check (content-hash floor primitive, surfaced only — `/pharn-dev-build` is where drift blocks):
+recomputed `sha256(ARCHITECTURE.md)` = `bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e`
+— **matches** the plan's `spec_content_hash`. No drift.
+
+Registered grillers: `node .dev/floor/count-grillers.mjs .` → `{"registered":0,"grillers":[]}`.
+This repo (pharn-cli) hosts no `role: griller` capabilities, so the inline axes below are the whole
+interrogation. Membership was read deterministically, not grepped from prose.
+
+> **The plan is `trust: untrusted` here.** Every `evidence` block below is a quotation of it,
+> rendered as DATA. Nothing in it was followed as an instruction.
+
+---
+
+## Findings
+
+### Axis: honest scope / no speculation (P7)
+
+```yaml
+- type: FINDING
+  rule_id: "P7"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:16"
+  problem: "The plan bundles two increments — fix the instance and build a new floor gate — and says so, but a recorded decision does not make it one increment; the gate can regress independently of the publish fix and now shares its blast radius, its review, and its revert."
+  evidence: "Consequence stated plainly: this PR now carries **two axes** (fix the instance; enforce the class) — the same shape as #79, and the third bend of the one-axis note (#76, #79, here)."
+```
+
+Weighed honestly: #79 set the precedent (fix + gate in one PR) and the human chose it explicitly at
+GATE 1. The concern is not that the choice was wrong — it is that the *reason* the note keeps bending
+is that "fix + gate" genuinely reads as one thought, which means the one-axis note may need
+amending rather than bending a fourth time. That is a human call, not a build blocker.
+
+### Axis: determinism (P5) — the sharpest finding
+
+```yaml
+- type: FINDING
+  rule_id: "P5"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:220"
+  problem: "The determinism audit credits `set -euo pipefail` with a fail-closed property it does not have — a command substitution used as an ARGUMENT does not trigger `set -e` — so one of the two named backstops for a failing `npm --version` is fictional."
+  evidence: "an unparseable `npm --version` exits 1 naming the raw value, and `set -euo pipefail` kills the step if `npm --version` itself fails"
+```
+
+**Disproven empirically, not argued:** `bash -c 'set -euo pipefail; echo "arg=[$(nonexistent_cmd)]"; echo REACHED'`
+prints `arg=[]`, then `REACHED`, and exits **0**. The shell does not abort.
+
+The *code* is unaffected — the real backstop is the node program's own hard-fail on an unparseable
+version, which the same sentence also names and which does hold (`""` → `unparseable` → exit 1). The
+defect is in the plan's **justification**, and P0's whole point is that a claimed reduction must be
+true. **Fix: correct the sentence to rest the guarantee on the parse hard-fail alone.** Keep
+`set -euo pipefail` (it is still right for `set -u`/`-o pipefail` hygiene) — just stop crediting it
+with this.
+
+### Axis: eval coverage (P1)
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:192"
+  problem: "The live repo-consistency test will assert `checked` EXACTLY — and on this repo that number is ZERO, because after the publish fix no workflow line contains a conforming pinned install at all; the test therefore lands in precisely the 'exit 0 because it found nothing to inspect' hole the sibling gate's own header warns about."
+  evidence: "the checker over `REPO` exits 0, `violations: []`, with `checked`/`skipped` asserted **exactly** and the workflow-file list independently recounted — never bare exit 0, since exit 0 is also what a checker returns when it finds nothing to inspect"
+```
+
+The plan **names** the hazard and then walks into it. `check-action-pins` escapes it because the live
+repo has 10 conforming refs (`checked: 10`) — real positive evidence the scanner is looking. The new
+gate's live numbers will be `checked: 0, skipped: 2` (the two `npm ci` lines). `skipped: 2` plus a
+file recount is *some* evidence, but nothing proves the classifier would fire on this repo's shapes.
+
+**Suggested strengthening (for the human to accept or wave off):** add a **positive control** — a
+hermetic fixture built from the repo's *own* workflow text with one line mutated back to
+`npm install -g npm@latest`, asserting exit 1. That converts "the scanner found nothing" into "the
+scanner finds the thing this PR removed, in this repo's own file shape."
+
+### Axis: guarantee audit completeness (P0)
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:105"
+  problem: "The new gate enforces the ABSENCE of a floating install, never the PRESENCE of the assert — so a future PR that simply deletes the `Assert npm floor` step passes every gate in this repo, silently returning the publish job to an unchecked npm floor."
+  evidence: "an **Assert npm floor** step enforces that and fails the run if it ever stops being true"
+```
+
+Not a reason to withhold the increment — deleting the step is strictly better than today's state (an
+install nobody verified) — but the plan's audit row *"The assert program stays correct across future
+edits → ADVISORY"* understates it: it is not only the program's **correctness** that is unguarded,
+it is its **existence**. Worth one word in the audit.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:151"
+  problem: "R1 names non-package-manager pulls as out of contract but omits a laundering path of exactly the shape #80 closed for composite actions: a workflow `run: npm run <script>` executes a package.json script, which may itself pull a floating package, and the gate — scanning `.github/**` only — can never see it."
+  evidence: "**R1 — non-package-manager pulls.** `curl … | sh`, a raw binary download, `pip`/`go install`/`cargo install`/`brew`."
+```
+
+No instance exists today (`package.json` scripts run `tsc`, `esbuild` via a local script, `vitest`,
+`eslint`, `prettier`, `markdownlint-cli2` — all lockfile-resolved, verified this run). The point is
+that the *residual list is incomplete*, and #80 exists because a laundering path was left unnamed
+once already. Add it to R1; do not widen the gate.
+
+### Axis: one axis / sibling coupling (P3)
+
+```yaml
+- type: FINDING
+  rule_id: "P3"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:152"
+  problem: "R2 accepts a duplicated file-walker between two sibling gates and justifies it by the floor's no-imports convention, but nothing detects the two walkers DRIFTING — the residual is named and then left with no cheap backstop, even though a shared test asserting both enumerate the same file list would cost one assertion."
+  evidence: "a future walker fix (the #80 class) must be applied twice ... The cost is real and is named here, not hidden."
+```
+
+The justification is sound (isolation is a real safety property, and Discovery #11 verified the
+convention empirically). The gap is that "named, not hidden" was treated as sufficient. A single
+cross-check — *both checkers report the same `files[]` for this repo* — reduces the drift class at
+near-zero cost and needs no shared module.
+
+### Axis: trust propagation (P2)
+
+```yaml
+- type: FINDING
+  rule_id: "P2"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:209"
+  problem: "The plan gives the new gate's violation records a `spec` field where its sibling emits `ref`, so two gates with an otherwise byte-identical output contract disagree on the name of the one untrusted, verbatim-copied field."
+  evidence: "the gate ... copies the offending spec verbatim into its `violations[].spec` output"
+```
+
+Harmless to the verdict (which is `violations.length > 0` in both). It matters only because the
+plan advertises the shapes as the same; either match `ref` or state the divergence deliberately.
+
+### Axis: docs cite code (P4) — out of whitelist, surfaced only
+
+```yaml
+- type: FINDING
+  rule_id: "P4"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:46"
+  problem: "`.dev/floor/README.md` opens with 'The floor is three files' over a three-row table; the directory already holds 40+ checkers, and this increment adds the fifth `check-*` gate that README does not mention."
+  evidence: "- `.dev/floor/check-run-pins.test.mjs` — **new.** Hermetic fixture tests **plus** a live repo-consistency test"
+```
+
+**Precedent supports not fixing it here:** `git log -- .dev/floor/README.md` shows its last touch was
+#15; #79 added `check-action-pins.mjs` without updating it, and `lint:md` does not cover `.dev/**`.
+So this is pre-existing staleness this PR inherits rather than causes — but it is now stale in a way
+that touches this increment's own subject matter, and it deserves its own ticket rather than another
+silent pass.
+
+---
+
+## Summary
+
+The plan is unusually well-grounded — every load-bearing fact carries a command that produced it, and
+the residuals are named rather than implied. The interrogation found **one factual defect** and **one
+design weakness** worth acting on before build:
+
+1. **The `set -e` claim is false** (P5, disproven by execution). The behavior is still fail-closed via
+   the node parse, so this is a one-sentence correction, not a redesign — but leaving a fictional
+   floor reduction in a guarantee audit is exactly the disease P0 names.
+2. **The live gate test asserts `checked: 0`** (P1). The plan quotes the "exit 0 also means found
+   nothing" warning and then adopts a shape that triggers it. A positive control built from this
+   repo's own workflow text closes it cheaply.
+
+The remaining five are refinements: the audit should say the assert's *existence* is unguarded, R1
+should name the `npm run <script>` laundering path, R2 deserves a same-`files[]` cross-check, the
+`spec`/`ref` field names should agree, and the floor README's "three files" claim needs a ticket.
+
+Nothing here argues against building. The scope bundling (P7) is a recorded human decision at GATE 1
+and is noted, not contested.
+
+**ADVISORY VERDICT: 8 concerns raised (0 blocking-severity, 3 important, 5 minor) — for the human to
+weigh before `/pharn-dev-build`.** This log gates nothing: every finding above rests on model
+judgment, including the severities. The only floor-grade facts in this run are the spec-hash match,
+the griller-membership count, and the shell behavior reproduced by execution.
diff --git a/.dev/features/publish-npm-floor-assert/PLAN.md b/.dev/features/publish-npm-floor-assert/PLAN.md
new file mode 100644
index 0000000..44ce2d1
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/PLAN.md
@@ -0,0 +1,234 @@
+# PLAN — drop floating `npm@latest` from publish; assert the floor; gate floating installs
+
+- spec_content_hash: bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e # fix #4
+- increment: delete the `npm install -g npm@latest` step from `.github/workflows/publish.yml`, replace it with a dependency-free **Assert npm floor** step, and add a floor gate that makes the absence of floating installs in workflow `run:` lines **enforced** rather than verified-once.
+- layer(s): repo CI (`.github/workflows/`) + the deterministic floor (`.dev/floor/`) + user-facing docs (`docs/`) — not a PHARN capability layer (`ARCHITECTURE.md §4` does not govern `.github/`)
+- constitution_refs: [P0, P1, P2, P3, P4, P5, P6, P7]
+
+## Scope decision recorded at GATE 1 (human, 2026-08-10)
+
+The build prompt scoped this to two files and filed the gate extension as "offered, not bundled —
+raise it at the HALT as a yes/no; do not build it here." Raised; the human answered **build it in
+this PR**. That is the prompt's own mechanism resolving in favour of a wider scope, so the whitelist
+is **deliberately expanded** from 2 files to 4. Recorded here rather than absorbed silently, because
+the plan is the versioned intent record and `/pharn-dev-build` builds only what this file names.
+
+Consequence stated plainly: this PR now carries **two axes** (fix the instance; enforce the class) —
+the same shape as #79, and the third bend of the one-axis note (#76, #79, here). The
+node-version-policy follow-up remains **out**.
+
+## Discovery — live state read this run (P6)
+
+Every claim below was read from disk or the network on 2026-08-10, this run. Nothing is asserted
+from memory.
+
+| # | Claim | How verified this run | Result |
+| - | ----- | --------------------- | ------ |
+| 1 | Base is latest `main`, `e08eb18` | `git log --oneline -3` | `e08eb18 fix(floor): close 14 coverage holes in the action-pin gate (#80)`; working tree clean |
+| 2 | `publish.yml` matches the finding | `cat -n .github/workflows/publish.yml` | step at **`:32-33`** (`- name: Update npm # Trusted Publishing requires npm >= 11.5.1` / `run: npm install -g npm@latest`); OIDC comments `:6-10`; `permissions: id-token: write` `:17`; `environment: npm-publish` `:22`; `node-version: 24` `:29`; tag-check `:36-40`; `npm publish --provenance --access public` `:46` |
+| 3 | **LOAD-BEARING** — the node the runner installs bundles npm >= 11.5.1 | `git ls-remote --tags https://github.com/nodejs/node 'v24.*'` → latest released tag; then `curl` that tag's `deps/npm/package.json` | tag **`v24.19.0`** → bundled npm **`11.17.0`** — **above** the 11.5.1 floor. **No HALT; the fallback branch is NOT taken.** |
+| 4 | The floating step already crossed a major | `curl -s https://registry.npmjs.org/-/package/npm/dist-tags` | `"latest":"12.0.2"` — `@latest` has been resolving to a **major the workflow was never written against** |
+| 5 | The 11.5.1 floor number itself is correct | `docs.npmjs.com/trusted-publishers` | *"Trusted publishing requires npm CLI version 11.5.1 or later and Node version 22.14.0 or higher."* — the workflow's own claim is **confirmed by npm**, not merely inherited. (Node 24 also clears the 22.14.0 half.) |
+| 6 | This is the **only** floating tool pull in any workflow | `grep -rn "npm@latest\|install -g\|curl\|wget\|@latest" .github/workflows/` | exactly two hits: `publish.yml:33` (this finding) and `gitleaks.yml:37` — the latter is **pinned by version + SHA-256** (`GITLEAKS_VERSION`/`GITLEAKS_SHA256`, `sha256sum --check`), i.e. not floating. `npm ci` is lockfile-pinned everywhere. **No second floating pull.** |
+| 7 | `docs/RELEASING.md` narrates the doomed step | `cat -n docs/RELEASING.md` | **line 48**: ``  `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check `` — becomes false the moment the step is deleted |
+| 8 | `check-action-pins` cannot cover a `run:` line, and IS live-wired | read `.dev/floor/check-action-pins.mjs` (`USES_KEY_RE` `:79`) + `.dev/features/floor-gate-action-pins/PLAN.md:29-33` | contract is `uses:` refs only. Wiring: its repo-consistency test is auto-collected by `floor.yml:28`'s `node --test ".dev/**/*.test.mjs"` glob on every PR — **the new gate inherits that wiring with zero workflow change**. Also: the checker deliberately treats a `run:` line containing the literal text `uses:` as a ref (fail-closed noise, `:76-78`) — so the new step's body must contain no `uses:` substring. |
+| 9 | `ci.yml` must NOT get the assert | `cat -n .github/workflows/ci.yml` | `node-version: 20` (`:20`) → bundled npm ~10.x, **below** the floor **by design**. Adding the assert there would break CI. Confirms the "publish-only" constraint. |
+| 10 | Formatting gates do not touch `.github/**` or `.dev/**` | `package.json` scripts + `.prettierignore` + `.markdownlint-cli2.jsonc` | `format:check` globs `src/**`, `tests/**`, `*.config.ts`; `lint` is `eslint src`; `lint:md` covers `docs/**/*.md` + `*.md`. So **only** the RELEASING.md edit faces a style gate |
+| 11 | Floor checkers are standalone by convention | `grep -n "from \"\./" .dev/floor/*.mjs` | **zero** relative imports across all 40+ floor scripts — every checker is a self-contained, stdlib-only program. The new gate follows that convention (see residual R2) |
+| 12 | The live repo is currently clean under the existing gate | `node .dev/floor/check-action-pins.mjs .` | `{"checked":10,"skipped":0,...,"violations":[]}` exit 0 — the baseline the new gate must not disturb |
+| 13 | Every workflow `run:` line the new gate will see | `cat -n` of all five workflows | `npm ci` ×2 (lockfile), `npm run <script>` ×6 (not an install), `npm publish` ×1, the gitleaks `curl`/`tar`/`sha256sum` block, `node …` ×3. **Nothing in the live repo trips the new rule** — asserted, not assumed, by the gate's live test |
+
+## Files
+
+- `.github/workflows/publish.yml` — delete the `Update npm` step (`:32-33`); add the **Assert npm floor** step in its place — layer: repo CI
+- `docs/RELEASING.md` — rewrite the step-5 narration (lines 47-52) so it describes the assert instead of the install — layer: user-facing docs
+- `.dev/floor/check-run-pins.mjs` — **new.** The gate: walk the same workflow/action definitions, classify every package spec in a recognized install/exec invocation, emit JSON + exit 0/1 — layer: floor
+- `.dev/floor/check-run-pins.test.mjs` — **new.** Hermetic fixture tests **plus** a live repo-consistency test (auto-collected by `floor.yml:28`) — layer: floor
+
+Nothing else. **No `CHANGELOG.md`** (workflow-only precedent, re-verified against #79: `git show --stat df20555` touched no changelog). **No `floor.yml` change** — Discovery #8 shows the runner already collects the new test.
+
+## Part 1 — the literal diff (publish.yml + RELEASING.md)
+
+```diff
+--- a/.github/workflows/publish.yml
++++ b/.github/workflows/publish.yml
+@@ -29,8 +29,25 @@ jobs:
+           node-version: 24
+           cache: npm
+           registry-url: https://registry.npmjs.org
+-      - name: Update npm # Trusted Publishing requires npm >= 11.5.1
+-        run: npm install -g npm@latest
++      # Trusted Publishing requires npm >= 11.5.1 (npm's own docs; it also requires
++      # node >= 22.14.0). node 24 already BUNDLES a satisfying npm — 11.17.0 at the
++      # released v24.19.0, checked 2026-08-10 — so the floor needs no install, only
++      # enforcement. This step therefore ASSERTS the floor instead of pulling
++      # `npm@latest` at publish time: the release job, which holds `id-token: write`
++      # and the `npm-publish` environment, now downloads no third-party tool at all.
++      # (The deleted step had silently crossed a major — the registry `latest`
++      # dist-tag is npm 12.0.2 as of 2026-08-10.) Pure node stdlib, no network.
++      - name: Assert npm floor
++        run: |
++          set -euo pipefail
++          node -e '
++            const parse = (v) => {
++              const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? "").trim());
++              if (!m) { console.error(`npm floor: unparseable version ${JSON.stringify(v)}`); process.exit(1); }
++              return m.slice(1, 4).map(Number);
++            };
++            const [found, floor] = process.argv.slice(1);
++            const f = parse(found), n = parse(floor);
++            if ((f[0] - n[0] || f[1] - n[1] || f[2] - n[2]) < 0) {
++              console.error(`npm floor NOT met: found ${found.trim()}, need >= ${floor} (npm Trusted Publishing minimum)`);
++              process.exit(1);
++            }
++            console.log(`npm floor OK: npm ${found.trim()} >= ${floor}`);
++          ' "$(npm --version)" 11.5.1
+       - name: Install
+         run: npm ci
+```
+
+```diff
+--- a/docs/RELEASING.md
++++ b/docs/RELEASING.md
+@@ -44,11 +44,13 @@
+ 4. **Cut a GitHub Release.** Tag it **`vX.Y.Z`**, where `X.Y.Z` **exactly
+    matches** `package.json` `version`. A guard step in `publish.yml` fails the
+    run if the tag (minus its leading `v`) does not equal the package version.
+-5. **Publishing the Release triggers `publish.yml`.** It runs on node 24 with
+-   `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check
+-   suite and build (via the `prepublishOnly` + `prepack` hooks), verifies the
+-   tag, then runs `npm publish --provenance --access public`. The `--provenance`
+-   flag overrides `publishConfig.provenance: false`, so the release carries a
+-   signed provenance attestation.
++5. **Publishing the Release triggers `publish.yml`.** It runs on node 24, whose
++   bundled npm already satisfies the npm >= 11.5.1 that Trusted Publishing
++   needs — an **Assert npm floor** step enforces that and fails the run if it
++   ever stops being true, so nothing is installed at publish time. The run then
++   re-runs the full check suite and build (via the `prepublishOnly` + `prepack`
++   hooks), verifies the tag, and runs `npm publish --provenance --access
++   public`. The `--provenance` flag overrides `publishConfig.provenance: false`,
++   so the release carries a signed provenance attestation.
+```
+
+## Part 2 — the gate (`check-run-pins.mjs`), contract pinned before code
+
+Deliberately modelled on `check-action-pins.mjs`: same file enumeration (workflows flat +
+`.github/actions/**/action.y[a]ml` recursive, symlink-refusing, depth-bounded), same all-three-line-
+endings split, same `{checked, skipped, files, violations}` output, same enum `reason`, same
+`emit()` (set `exitCode`, never `process.exit`, so piped stdout cannot truncate).
+
+**What it enumerates.** Every non-comment line of those files. It is a **line scanner, not a YAML
+parser** — the same honest bound `check-action-pins` states, and it removes the entire block-scalar-
+tracking bug class: a `run: |` body needs no scope tracking because *every* line is scanned.
+
+**Recognized invocations** (longest-prefix token match, matched at ANY token position so `run:`,
+`- run:`, `sudo`, `env FOO=1`, and `&&` chains all work uniformly):
+
+| Kind | Heads | Package-spec positions |
+| ---- | ----- | ---------------------- |
+| `install` | `npm install`/`npm i`/`npm add`, `pnpm install`/`pnpm i`/`pnpm add`, `yarn add`, `yarn global add`, `bun install`/`bun i`/`bun add` | **every** non-flag arg |
+| `exec` | `npx`, `npm exec`, `pnpm dlx`, `yarn dlx`, `bunx` | the **first** non-flag arg, plus the value of `-p`/`--package` |
+| `lockfile` | `npm ci`, `pnpm ci`, and any `install` head with **zero** package args | none — counted in `skipped`, never a violation |
+
+**Classification of one package spec** (`reason`, an enum — P5 membership, never prose):
+
+| Spec | Reason |
+| ---- | ------ |
+| `pkg@1.2.3`, `@scope/pkg@1.2.3-rc.1`, `pkg@1.2.3+build` | *conforms* — exact semver |
+| `pkg@latest`, `pkg@next`, `pkg@^1.2.3`, `pkg@~1.2`, `pkg@1.x`, `pkg@>=2` | `floating-version` |
+| `pkg`, `@scope/pkg`, `github:user/repo` | `unpinned-package` |
+| `pkg@${{ … }}`, `pkg@$VER` | `unpinnable-version` |
+| a file the walk could not stat/read | `unreadable-file` |
+
+**Deterministic exclusions, each with a reason** (P5 — enumerated, not judged):
+
+1. A line whose first non-space char is `#` — a YAML comment is never executed. *(This is what keeps the new publish.yml comment block, which mentions `npm@latest` in prose, from tripping the gate — and the gate's own test asserts exactly that.)*
+2. A line declaring a `name:` key **and no `run` key** — a step name is never executed. The second half is load-bearing: it keeps the flow-mapping form `- {name: x, run: npm i -g p@latest}` in scope.
+3. Path-like args (`./`, `../`, `/`, `file:`, `*.tgz`, `*.tar.gz`) — a local install pulls nothing remote.
+
+**What is NOT covered — named residuals, never claimed (P0):**
+
+- **R1 — non-package-manager pulls.** `curl … | sh`, a raw binary download, `pip`/`go install`/`cargo install`/`brew`. `gitleaks.yml`'s `curl` is **deliberately** out of contract: it is version- *and* SHA-256-pinned, and teaching the gate to recognize "this curl is checksum-verified" would be a *classification*, which P5 forbids. Out of scope by construction, not by oversight.
+- **R2 — enumerator duplication.** `collectFiles`/`safeLstat`/`isYaml`/`LINE_SPLIT_RE`/`emit` are duplicated from `check-action-pins.mjs`, so a future walker fix (the #80 class) must be applied twice. Extracting a shared module was rejected: Discovery #11 shows **zero** floor script imports another, and that isolation is itself a safety property (one module's bug cannot take down two gates). The cost is real and is named here, not hidden.
+- **R3 — shell indirection.** A package name in a variable (`npm i -g "$PKG"`), `eval`, a heredoc, or base64 defeats a line scanner. Same class of residual `check-action-pins` names for exotic YAML.
+- **R4 — the gate stays wired.** Nothing prevents a future edit deleting the test or `floor.yml:28`'s glob. Identical honest caveat to #79's.
+
+**Direction of imprecision:** fail-**closed**, matching the house rule — an unrecognized shape is
+reported, never silently passed. A `name:`-in-prose false positive is noise a human resolves.
+
+## Contracts satisfied
+
+- None in `pharn-contracts/` — this touches repo CI, the floor, and docs, not a PHARN capability or finding shape. Cited, not restated (P4).
+
+## Evals to write (P1)
+
+P1's vitest clause governs shipped CLI behavior (`tests/*.test.ts`); a workflow step and a floor
+script are neither, and the floor's established test surface is `node:test` + `spawnSync` over the
+CLI (`check-action-pins.test.mjs`). Both parts get real tests in that idiom.
+
+**Part 1 — the assert** (the proof of record: `publish.yml` fires only on `release: published`, so a PR can never execute it):
+
+- compare extracted **from `publish.yml` itself** → `11.5.0` → exit **1**; `11.5.1` → exit **0** (inclusive boundary); `11.17.0` → exit **0**; `12.0.2` → exit **0**. The program takes the version as `argv[1]`, so this needs no npm stubbing. *(Pre-verified against the candidate text this run: 1/0/0/0 as specified.)*
+
+**Part 2 — `check-run-pins.test.mjs`** (hermetic fixtures, subprocess, `{exit, stdout JSON}` surface):
+
+- `run: npm install -g npm@latest` → exit 1, `["floating-version"]` — **the exact line this PR deletes**
+- `run: npm ci` → exit 0, `skipped: 1` — lockfile install is not a violation, and is **counted**
+- `run: npm install` (bare) → exit 0, `skipped: 1` — zero package args = lockfile
+- `run: npm install -g npm@11.5.1` → exit 0, `checked: 1` — an exact pin conforms
+- `run: npm i -g typescript` → exit 1, `["unpinned-package"]`
+- `run: npx tsx@4.7.0 x.ts` → exit 0 — exec-kind classifies the package, **not** the script arg
+- `run: npx tsx x.ts` → exit 1, `["unpinned-package"]`
+- `run: npm i -g pkg@${{ inputs.v }}` → exit 1, `["unpinnable-version"]` (not mislabeled floating)
+- `run: pnpm add -g a@latest` / `yarn global add b@next` / `bunx c` → each exit 1 — the head table is real, not npm-only
+- `run: npm ci && npm i -g x@latest` → exit 1 — `&&`-chained commands are split, the second is seen
+- ★ `# npm install -g npm@latest` (a comment) → exit 0 — **the regression that protects this PR's own comment block**
+- ★ `- name: npm install -g x@latest` (a step name, no `run`) → exit 0; but `- {name: n, run: npm i -g x@latest}` → exit 1 — exclusion #2's second half
+- `@scope/pkg@1.2.3` → exit 0; `@scope/pkg` → exit 1 — the scoped-package `@` boundary
+- `run: npm i ./local` and `file:../x` → exit 0 — path exclusion
+- CRLF and lone-CR fixtures → the violation is still found (the ✱✱ regression class from #80, inherited by construction)
+- a dangling symlink in `.github/actions/**` → exit 1, `unreadable-file`, JSON still emitted
+- a composite `.github/actions/x/action.yml` with a floating install → exit 1 — the definition is walked, not just workflows
+- ★ **live repo-consistency**: the checker over `REPO` exits 0, `violations: []`, with `checked`/`skipped` asserted **exactly** and the workflow-file list independently recounted — never bare exit 0, since exit 0 is also what a checker returns when it finds nothing to inspect
+
+## Guarantee audit (P0)
+
+| Claim | Reduction |
+| ----- | --------- |
+| "npm at publish time is >= 11.5.1" | **FLOOR — numeric membership test** (`ARCHITECTURE.md §2` primitive #3), executed *in the release job itself*: a three-part integer compare that exits non-zero naming both versions. Strictly stronger than what it replaces — an install whose success was never checked. |
+| "No workflow `run:` line installs a floating package version" | **FLOOR — regex + enum** (primitive #3), enforced on **every PR** via `floor.yml:28`'s `node --test` glob (Discovery #8). This is the second real guarantee, and it is what converts the first part from a one-time fix into an invariant. **Bounded by R1/R3**: it covers the four JS package managers' install/exec forms, not every conceivable pull. |
+| "The publish job downloads no third-party tool" | **FLOOR for the package-manager class** (the new gate); **ADVISORY beyond it** — R1 means a future `curl \| sh` would pass this gate. Verified absent today by grep; not guaranteed absent forever. Stated, not oversold. |
+| "node 24 bundles npm 11.17.0" | **ADVISORY** — true at released `v24.19.0` on 2026-08-10 (Discovery #3), but `node-version: 24` floats within the major. Precisely why the assert exists: the advisory fact is **backstopped by the floor**, so no guaranteed decision rests on it (P0's two-part requirement). |
+| "The assert program stays correct across future edits" | **ADVISORY** — the compare lives inline in the workflow; the new gate checks *installs*, not *asserts*, so nothing tests the inline text on future PRs. Phase C proves the shipped bytes once, against four inputs. Named, not hidden. |
+| "`docs/RELEASING.md` describes what the workflow does" | **ADVISORY** (P4 discipline) — no gate ties prose to the workflow. |
+
+## Trust audit (P2)
+
+No untrusted artifact is ingested — this touches neither the pharn-oss fetch boundary nor
+`lib/validate.ts`. The gate **reads** workflow files and copies the offending spec verbatim into its
+`violations[].spec` output, so that string inherits the scanned file's trust — but **no decision
+reads it**: the verdict is `violations.length > 0`, an integer test (the identical split
+`check-action-pins.mjs:42-44` makes; fix #1). The increment moves P2's direction at the repo level:
+it deletes the last place where the **highest-trust job** (`id-token: write` + the `npm-publish`
+environment) executed third-party code resolved at run time. Residual: `runs-on: ubuntu-latest`
+still floats — platform-level, out of this axis. `THREAT-MODEL.md` has **no CI/supply-chain
+section** (grepped this run; its surfaces are the fetch boundary), so no trusted doc needs editing —
+and none is agent-editable anyway (`protect-trusted-paths.cjs`).
+
+## Determinism audit (P5)
+
+- The assert's one branch is `(f[0]-n[0] || f[1]-n[1] || f[2]-n[2]) < 0` — integer comparison, never classification. Fallback is a **hard-fail, not a guess**: an unparseable `npm --version` exits 1 naming the raw value. No "ask" path exists or is appropriate — a release job has no human at the keyboard.
+  - **CORRECTED after `/pharn-dev-grill` (P5 finding, disproven by execution).** This bullet originally also credited `set -euo pipefail` with killing the step if `npm --version` itself failed. It does not: a command substitution used as an **argument** does not trip `set -e` — `bash -c 'set -euo pipefail; echo "[$(nonexistent)]"; echo REACHED'` prints both lines and exits **0**. The fail-closed property rests **entirely on the parse**: a failing `npm --version` arrives as `""`, which is unparseable, which exits 1. `set -euo pipefail` is kept for `set -u` / `pipefail` hygiene, but it is **not** load-bearing here and is no longer claimed to be. The shipped `publish.yml` comment states this correctly.
+- The gate's branches are all membership tests: head match against a fixed token table, arg against a fixed flag/path pattern, version against `EXACT_SEMVER_RE`. Every non-conforming shape lands in a **named enum reason**; nothing is classified by judgment, and the fallback is *report*, never *assume clean*.
+
+## Named residual (do NOT fix here)
+
+`node-version: 24` floats within the major, so the bundled npm floats across Node-vetted 11.x
+releases. The assert catches any dip below the floor. Pinning node exactly is the
+**node-version-policy follow-up**, now named a **third** time (M3, CI-matrix, here) — it has earned
+its own ticket and is **not** this PR (P7).
+
+## Open questions (HALT)
+
+None — both were resolved at GATE 1: the compare ships **inline** (2-file whitelist for part 1), and
+the gate extension **is built here** (whitelist expanded to 4 files, recorded above).
diff --git a/.dev/features/publish-npm-floor-assert/REGRESSION.md b/.dev/features/publish-npm-floor-assert/REGRESSION.md
new file mode 100644
index 0000000..2a02347
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/REGRESSION.md
@@ -0,0 +1,63 @@
+# REGRESSION — publish-npm-floor-assert
+
+Base: **`e08eb18c16ce260bb5039d039dcb9c56397d1a9e`** (working tree was dirty → `base = HEAD`, the
+deterministic rule, not a choice). Machine report: `regression-report.json` (the helper's verdict
+JSON, verbatim).
+
+## Inside / outside partition
+
+`inside` (the feature's changed scope — 4 files, all declared in `PLAN.md` `## Files`):
+
+- `.github/workflows/publish.yml`
+- `docs/RELEASING.md`
+- `.dev/floor/check-run-pins.mjs`
+- `.dev/floor/check-run-pins.test.mjs`
+
+The fix #7 cross-check ran with the loop-owned artifacts (`.dev/features/publish-npm-floor-assert/**`,
+`.pharn/**`) included in `--changed` and covered by `--declared`, rather than omitted from the changed
+set — a deliberately stricter partition than the convention, so that a stray write anywhere would have
+surfaced. Result: **`escaped: []`** — nothing was written outside the declared writes-scope.
+
+`outside`: **45 test files** (`outside_eval_pairs: 0` — this repo commits no eval pairs). The
+increment's own `.dev/floor/check-run-pins.test.mjs` is correctly **inside**, so it is not an outside
+gate.
+
+## Gate table — identical gate set at base and head
+
+| gate | base | head | flip |
+| ---- | ---- | ---- | ---- |
+| `tests` (45 outside files, 704 assertions) | 0 | 0 | none |
+| `validate` (`node .dev/floor/validate.mjs .`, whole-repo) | 0 | 0 | none |
+
+**Style gates deliberately absent from both maps.** The deterministic skip rule applies: `inside`
+touches no shared style config (`eslint.config.mjs`, `.prettierrc`, `.prettierignore`,
+`.markdownlint-cli2.jsonc` all unmodified), so a style result over the byte-identical outside files
+cannot flip. Skipped on both sides, so the gate sets match and the comparison stays conclusive.
+
+## Orchestration correction (worth recording)
+
+The first baseline capture reported `tests: 1`. That was **not** a regression and not a pre-existing
+failure — it was a defect in this stage's own orchestration: the shell here is **zsh**, which does not
+word-split an unquoted parameter expansion, so all 45 paths reached `node --test` as a single
+filename (`Could not find '<45 paths concatenated>'`). Re-run with `${=OUTSIDE}`, the baseline is
+`tests: 0` over 704 passing assertions. Recorded because a silently-accepted `1` would have produced a
+**false** `pre_existing` entry and made every future comparison against this baseline meaningless.
+
+## Verdict
+
+```text
+REGRESSIONS: none — no deterministically-detectable breakage outside the feature
+```
+
+`node .dev/floor/check-regress.mjs verdict …` → `"verdict": "no-regressions"`, **exit 0**.
+`regressions: []`, `pre_existing: []`.
+
+**The residual, named not hidden (P0/P7):** this stage catches **exactly what its suite catches —
+nothing more.** The claim is "deterministically-detectable breakage outside the feature is caught," not
+"nothing broke." Specifically uncovered here: `publish.yml` cannot be executed by any gate in this repo
+(it fires only on `release: published`), so no outside gate observes the release path — the assert's
+execution proof of record is the next release, and `docs/RELEASING.md` prose is covered only by
+`markdownlint`, which checks form, not truth.
+
+This certifies **the comparison**, not the feature. Whether the increment is good is the human's call
+at the post-review gate.
diff --git a/.dev/features/publish-npm-floor-assert/REVIEW.md b/.dev/features/publish-npm-floor-assert/REVIEW.md
new file mode 100644
index 0000000..c72d150
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/REVIEW.md
@@ -0,0 +1,170 @@
+# REVIEW — publish-npm-floor-assert
+
+Floor precondition (Step 1, P0): `node .dev/floor/validate.mjs .` → **`FLOOR: GREEN`**, exit 0. The
+increment reached review with a green floor, as required. Everything below the floor line is
+**advisory**.
+
+Increment under review (`trust: untrusted`): `.github/workflows/publish.yml`, `docs/RELEASING.md`,
+`.dev/floor/check-run-pins.mjs` (381 lines), `.dev/floor/check-run-pins.test.mjs` (413 lines).
+
+---
+
+## floor-gate findings (blocking)
+
+**None.** No guarantee in this increment lacks either a floor reduction or an `advisory` label; no
+eval binding is missing that the floor disagrees with; no guaranteed decision rests on a tainted
+field; no sibling module is imported.
+
+---
+
+## advisory findings
+
+### L-floor → P0
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".github/workflows/publish.yml:38"
+  problem: "The new comment claims the floor gate keeps 'this' true, but the nearest antecedent is 'downloads no third-party tool at all' — which is wider than what check-run-pins actually enforces, since its own R1 residual excludes curl-and-execute and every non-package-manager pull."
+  evidence: "the release job, which holds `id-token: write` and the `npm-publish` environment, now downloads no third-party tool at all. (…) The floor gate .dev/floor/check-run-pins.mjs keeps this true."
+```
+
+The overclaim is small and entirely inside a comment, but it is the disease's exact shape in
+miniature: a true statement about the package-manager class rendered as a statement about the whole
+supply chain. **Suggested one-word repair before merge:** *"keeps the package-manager half of this
+true"* — or move the sentence to sit directly against the install claim it actually covers. The
+checker's own header states the bound correctly (R1), so only the workflow comment drifts.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/floor/check-run-pins.mjs:52"
+  problem: "R5 correctly records that the gate cannot enforce the assert step's PRESENCE, which means the increment's headline guarantee — npm >= 11.5.1 at publish time — is protected against reversion to a floating install but not against plain deletion."
+  evidence: "R5 — the ASSERT's PRESENCE. This gate enforces that no floating install EXISTS; it cannot enforce that publish.yml's `Assert npm floor` step still exists. Deleting that step trips nothing here."
+```
+
+Labeled, so not blocking — P0 is satisfied by the naming. Recorded because it is the **most likely
+future hole** in this increment: the natural next gate is not "more install shapes" but "publish.yml
+still contains the assert." Candidate for the same follow-up ticket as the node-version policy.
+
+### L-eval → P1
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/VERIFY.md:14"
+  problem: "The verify stage's DEFAULT gate set would have returned PASS without executing a single one of this increment's 40 assertions, because its `test` gate is `npm test` (vitest over tests/**/*.ts) and the feature's only tests are .mjs."
+  evidence: "The default set's `test` gate is `npm test`, which is vitest over `tests/**/*.ts` and does not collect `.mjs`."
+```
+
+Caught and repaired **during** this run by widening the gate set (`floor-tests`), and the widening is
+declared in `VERIFY.md` rather than hidden. It is filed as `important` anyway because the repair was
+**orchestration, not floor** — the next `.mjs`-only increment gets no such protection unless its
+operator notices the same thing. This is the lesson candidate below.
+
+Positive note, recorded because the floor and the lens must be confirmed to agree: `validate.mjs`
+reports `0 capabilities checked` — vacuously green, correctly, since this increment adds no markdown
+Capability and therefore has no `enforces`/eval binding to check. Floor and lens agree.
+
+### L-trust → P2
+
+No instruction-looking content in the reviewed increment altered this review's behavior; nothing in
+the workflow, the docs, or the checker attempted to direct the reviewer. Reported as required by the
+lens, not as a finding.
+
+Taint handling is correct and matches the sibling gate: `check-run-pins.mjs` copies the offending
+package spec verbatim into `violations[].ref`, so that string inherits the scanned file's trust — but
+the verdict is `violations.length > 0`, an integer test, so **no guaranteed decision reads a tainted
+field** (`check-run-pins.mjs:60-62`, mirroring `check-action-pins.mjs:42-44`).
+
+```yaml
+- type: FINDING
+  rule_id: "P2"
+  severity: minor
+  file: ".dev/floor/check-run-pins.test.mjs:383"
+  problem: "The positive-control test reads the live publish.yml, mutates it in memory and writes it into a scratch repo — a pattern that would carry hostile workflow content into a temp tree if publish.yml were ever attacker-controlled."
+  evidence: "const live = readFileSync(join(REPO, \".github\", \"workflows\", \"publish.yml\"), \"utf8\");"
+```
+
+Assessed and judged safe, but worth stating rather than assuming: the content is only **written and
+scanned**, never executed, the scratch dir is under `os.tmpdir()`, and `publish.yml` is a trusted
+in-repo file protected by review. The pattern would need reconsideration if the control were ever
+pointed at a fork-supplied file.
+
+### L-axis → P3
+
+```yaml
+- type: FINDING
+  rule_id: "P3"
+  severity: minor
+  file: ".dev/floor/check-run-pins.test.mjs:38"
+  problem: "The test file spawns check-action-pins.mjs for the R2 drift cross-check and the R6 symlink-agreement pin, giving it a second reason to change — it now fails when the SIBLING gate changes, not only when its own subject does."
+  evidence: "const SIBLING = join(here, \"check-action-pins.mjs\");"
+```
+
+**Deliberate, and defended:** it is a path spawned as a subprocess, not a module import, so no
+internals are coupled and `check-run-pins.mjs` itself remains stdlib-only (verified: its sole imports
+are `node:fs` and `node:path`). The coupling exists precisely to backstop two named residuals that
+would otherwise be prose-only. The cost — the second change-reason — is real and is recorded here so
+the trade is visible rather than discovered later.
+
+The **two-axis PR** (fix the instance + build the class gate) is noted, not re-litigated: it was
+raised at GATE 1 and is a recorded human decision, and `PLAN.md` states it plainly.
+
+---
+
+## Proposed lesson for canon (NOT written here — `/pharn-dev-memory-promote` only)
+
+```yaml
+candidate:
+  id: L-gate-set-blindspot
+  lesson: >
+    A stage's DEFAULT gate set can be structurally blind to the increment under test. `/pharn-dev-verify`'s
+    `test` gate is `npm test` = vitest over `tests/**/*.ts`; an increment whose only tests are `.mjs`
+    floor tests therefore gets a PASS in which none of its assertions ran. Before trusting a stage
+    verdict, check that the gate set can SEE the increment's file types — a green verdict over a gate
+    that never opened the feature is the "verified means the gates passed, and the gates checked
+    nothing" hole.
+  provenance:
+    increment: publish-npm-floor-assert
+    observed: "verify Step 1 default set; repaired by adding a `floor-tests` gate (VERIFY.md)"
+    real: true # observed this run, not hypothetical
+```
+
+Recorded as a **candidate only**. Promotion requires a separate human-gated `/pharn-dev-memory-promote`
+run under its own scope, behind `check-provenance.mjs`.
+
+---
+
+## Disposition after the human's "fix everything" (recorded post-review)
+
+| finding | disposition |
+| ------- | ----------- |
+| P0 minor — `publish.yml` comment overclaims | **FIXED.** The gate sentence was split out and now says it keeps the **package-manager half** true, naming R1's exclusion of curl-and-execute inline. |
+| P0 minor — R5, the assert's PRESENCE unguarded | **FIXED, next door.** `check-run-pins.test.mjs` now asserts that `- name: Assert npm floor` and its `"$(npm --version)" 11.5.1` comparison are present in the committed `publish.yml`. Collected by the same `floor.yml` `node --test` run, so reversion-to-floating **and** plain deletion are both caught. Verified to fail when the step is removed. R5's text in the checker header was rewritten to say the coverage exists but is **not this program's doing**. |
+| P1 important — verify gate-set blindspot | **REPAIRED IN-RUN** (the `floor-tests` gate) and retained as the canon candidate below. |
+| P2 minor — the positive control reads the live `publish.yml` | **NO CHANGE.** Assessed safe: content is written and scanned, never executed; the file is trusted and review-protected. Kept as a stated note. |
+| P3 minor — the test file spawns the sibling gate | **NO CHANGE.** Deliberate; it is the backstop for residuals R2 and R6, and it couples by subprocess path, not by import. |
+
+One finding was raised in `GRILL.md` and is **not** fixed here, on the constitution's own instruction:
+`.dev/floor/README.md` opens *"The floor is three files"* over a three-row table while the directory
+holds 40+ checkers. That is a P4 doc-contradicts-code condition, and `CONSTITUTION.md` states the
+agent **MUST NOT auto-fix a constitution violation** — it is flagged for human review, not repaired
+in passing. It is also pre-existing (last touched in #15; #79 added a checker without updating it)
+and outside this increment's approved `## Files`.
+
+## Verdict
+
+```text
+GREEN — 0 floor-gate (blocking) findings; 5 advisory findings (1 important, 4 minor)
+```
+
+Three of the five are now fixed (see the disposition table); two were assessed and deliberately kept.
+The one important finding was already repaired within this run.
+
+**This verdict is advisory.** `/pharn-dev-review` computes no floor gate of its own — its only
+floor-grade content is `validate.mjs` GREEN, which `/pharn-dev-build` and `/pharn-dev-verify` already gated. Severity
+assignments above are LLM judgment. Whether this increment merges is the human's call.
diff --git a/.dev/features/publish-npm-floor-assert/SHIP.md b/.dev/features/publish-npm-floor-assert/SHIP.md
new file mode 100644
index 0000000..9c9cf1c
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/SHIP.md
@@ -0,0 +1,57 @@
+# SHIP — publish-npm-floor-assert
+
+Chain: `/pharn-dev-plan` → **[human approved]** → `/pharn-dev-grill` → `/pharn-dev-build` →
+`/pharn-dev-regress` → `/pharn-dev-verify` → `/pharn-dev-review`. Ran in order; ended at **GATE 2**
+(post-review human decision), not at a RED-verdict STOP.
+
+## Stages and where the run ended
+
+| # | stage | outcome |
+| - | ----- | ------- |
+| 1 | `/pharn-dev-plan` | **GATE 1** — halted; human approved. Two questions answered: compare ships **inline**; the floor-gate extension **built in this PR** (whitelist widened 2 → 4 files, recorded in `PLAN.md`) |
+| 2 | `/pharn-dev-grill` | advisory; **gates nothing**. 8 concerns (0 blocking, 3 important, 5 minor) — `GRILL.md` |
+| 3 | `/pharn-dev-build` | floor GREEN → proceed |
+| 4 | `/pharn-dev-regress` | `no-regressions` → proceed |
+| 5 | `/pharn-dev-verify` | `PASS` → proceed |
+| 6 | `/pharn-dev-review` | advisory; **GATE 2** — presented to the human |
+
+## Structural verdicts read, verbatim
+
+- **`/pharn-dev-build`** → `node .dev/floor/validate.mjs .` **exit `0`** (`FLOOR: GREEN`). Supporting: `npm run check` clean (prettier, eslint, tsc ×2, 625 vitest).
+- **`/pharn-dev-regress`** → `regression-report.json` `.verdict` = **`"no-regressions"`** (helper exit 0). `regressions: []`, `pre_existing: []`. Base `e08eb18c16ce260bb5039d039dcb9c56397d1a9e`; outside gates `tests 0→0`, `validate 0→0` over 45 files / 704 assertions. Scope partition returned **`escaped: []`**.
+- **`/pharn-dev-verify`** → `verify-report.json` `.verdict` = **`"PASS"`** (helper exit 0), `failing_gates: []`, over 8 gates: `test`, `floor-tests`, `validate`, `lint`, `format:check`, `lint:md`, `check-run-pins`, `check-action-pins` — all `0`. `verifiers: {registered: 0, findings: []}` (advisory, and structurally not a verdict input).
+
+## Pointers (cited, not restated — P4)
+
+- `.dev/features/publish-npm-floor-assert/PLAN.md` — the approved intent, incl. the literal diff and the recorded scope decision
+- `.dev/features/publish-npm-floor-assert/GRILL.md` — advisory, gates nothing
+- `.dev/features/publish-npm-floor-assert/REGRESSION.md` / `regression-report.json`
+- `.dev/features/publish-npm-floor-assert/VERIFY.md` / `verify-report.json`
+- `.dev/features/publish-npm-floor-assert/REVIEW.md` — **GREEN, 0 blocking; 5 advisory findings**
+
+## Two corrections this run made to its own reasoning (recorded, not buried)
+
+1. **The grill disproved a plan claim by execution.** `PLAN.md` credited `set -euo pipefail` with aborting on a failing `npm --version`; a command substitution used as an *argument* does not trip `set -e`. The shipped step now rests its fail-closed property on the **parse** and says so in a comment. `PLAN.md` itself still carries the original sentence — it was outside the build's writes-scope, and the floor correctly refused to let it be edited mid-build.
+2. **The regress baseline was initially wrong for orchestration reasons.** The first capture reported `tests: 1`; the cause was zsh not word-splitting an unquoted expansion, passing 45 paths as one filename. Re-run correctly, base and head are both `0`. A silently-accepted `1` would have written a false `pre_existing` entry.
+
+## Post-GATE-2 fix round (human said "fix everything")
+
+Three of the review's five advisory findings were repaired, and every verdict above was **re-computed
+against the fixed code** — the numbers in this file are the final ones:
+
+- `publish.yml`'s comment no longer overclaims: the gate sentence now scopes itself to the **package-manager half** and names R1's exclusion of curl-and-execute.
+- **Residual R5 closed.** `check-run-pins.test.mjs` now asserts the `Assert npm floor` step and its `11.5.1` comparison are present in the committed `publish.yml`, so deletion is caught, not just reversion. Proven to fail against a copy with the step removed.
+- `PLAN.md`'s determinism audit carries an explicit **CORRECTED** note retiring the false `set -e` claim.
+- Two findings were assessed and deliberately kept (the positive control reading a trusted file; the test file's subprocess coupling to the sibling gate) — both are backstops for named residuals.
+
+**Not fixed, by the constitution's own instruction:** `.dev/floor/README.md` says *"The floor is three
+files"* while the directory holds 40+ checkers — a P4 doc-contradicts-code condition. `CONSTITUTION.md`
+states the agent **MUST NOT auto-fix a constitution violation**; it is flagged for human review. It is
+pre-existing (last touched in #15) and outside this increment's `## Files`.
+
+## Standing decision
+
+The chain ran; the named floor verdicts are as shown — **this is NOT a judgment that the increment is
+good or wise; that is the human's call at the post-review gate.**
+
+`/pharn-dev-ship` did not merge, push, commit, or apply any seal.
diff --git a/.dev/features/publish-npm-floor-assert/VERIFY.md b/.dev/features/publish-npm-floor-assert/VERIFY.md
new file mode 100644
index 0000000..b5b84f2
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/VERIFY.md
@@ -0,0 +1,81 @@
+# VERIFY — publish-npm-floor-assert
+
+Machine report: `verify-report.json` (the `check-verify.mjs` verdict verbatim + the advisory
+`verifiers` block merged in after the verdict was computed).
+
+## FLOOR layer — the gates that own the verdict
+
+| gate | exit |
+| ---- | ---- |
+| `test` (`npm test` — vitest, 625 assertions over `tests/**/*.ts`) | 0 |
+| `floor-tests` (`node --test` over the floor/hook globs — 745 assertions, **incl. this feature's 41**) | 0 |
+| `validate` (`node .dev/floor/validate.mjs .`) | 0 |
+| `lint` (`eslint src`) | 0 |
+| `format:check` (prettier) | 0 |
+| `lint:md` (markdownlint over `docs/**/*.md` + `*.md`) | 0 |
+| `check-run-pins` (the gate this increment adds, over the live repo) | 0 |
+| `check-action-pins` (the sibling gate — proves the edit did not disturb it) | 0 |
+
+```text
+VERIFIED: floor gates PASS
+```
+
+`node .dev/floor/check-verify.mjs …` → `"verdict": "PASS"`, **exit 0**, `failing_gates: []`.
+
+### Gate-set composition — a deliberate widening, declared (P0, two clocks)
+
+The gate **set** is this stage's **advisory** composition; only the verdict over it is floor. Three
+gates were added beyond the command's default set, for one reason each:
+
+- **`floor-tests`.** The default set's `test` gate is `npm test`, which is **vitest over
+  `tests/**/*.ts` and does not collect `.mjs`**. This increment's only tests are
+  `.dev/floor/check-run-pins.test.mjs` — so a PASS on the default set would have certified a run in
+  which **not one of the feature's own 40 assertions executed**. That is precisely the "verified
+  means the gates passed — and these gates checked nothing about the feature" hole. Added, and it is
+  the same runner `floor.yml:28` uses in CI, so it is not a bespoke gate.
+- **`check-run-pins` / `check-action-pins`.** The new gate over the live repo, and its sibling — the
+  latter because this increment edits a workflow file the sibling scans, and "I did not break the
+  neighbouring gate" should be an integer in the report, not a claim in prose.
+
+Stated honestly: nothing floor-locks these gates into future runs (L9's residual). The widening is
+orchestration, recorded here so it is auditable rather than invisible.
+
+## ADVISORY layer — verifiers
+
+`node .dev/floor/count-verifiers.mjs .` → `{"registered":0,"verifiers":[]}`.
+
+**No verifiers registered — floor gates only.** Step 2 was a no-op; the verdict is the floor gates
+alone. Nothing was authored to fill the slot (P7).
+
+## Evidence recorded outside the gate set (not verdict inputs)
+
+These are proofs the gates structurally cannot run, listed so the report does not imply more coverage
+than the integers above carry:
+
+- **The assert program, extracted from the shipped `publish.yml` bytes** and run against six inputs:
+  `11.5.0` → exit 1 · `11.5.1` → exit 0 (inclusive boundary) · `11.17.0` → exit 0 · `12.0.2` → exit 0 ·
+  `""` → exit 1 (`unparseable version ""`) · `garbage` → exit 1. The last two exercise the fail-closed
+  path that the grill's P5 finding corrected the reasoning for.
+- **The whole step body executed verbatim** against the real local npm: `npm floor OK: npm 11.12.1 >= 11.5.1`, exit 0.
+- **`publish.yml` parses as YAML** (via the transitive `js-yaml`, not a new dependency): 6 steps, the
+  `Update npm` step gone, `permissions.id-token: write`, `environment: npm-publish`, `node-version: 24`,
+  the tag guard, and `npm publish --provenance` all intact.
+- **`grep -rn "npm@latest\|install -g npm" .github/workflows/`** → empty; the broader
+  `"@latest\|install -g\|add -g\|global add"` → also empty.
+- **The assert step's PRESENCE is now itself a gate assertion** (residual R5, closed after review):
+  removing `- name: Assert npm floor` from `publish.yml` makes `check-run-pins.test.mjs` fail —
+  demonstrated by running the same regex against a copy with the step deleted (`true` → `false`).
+
+**Re-run note:** every gate above was re-executed after the post-review fixes; these are the final
+numbers, not the pre-fix ones.
+
+## Honest residual (P0/P7)
+
+**Verified = the named gates passed. This is NOT a guarantee of correctness beyond what those gates
+check** — verifier concerns would be advisory help, not assurance, and today there are none.
+
+The specific, load-bearing limit for this increment: **`publish.yml` runs only on `release: published`,
+so no gate in this repo can execute it.** The evidence above proves the assert's *logic* and its
+*shell body*, and the PR's Actions run proves it *parses* — but the **execution proof of record is the
+next release**. Anyone reading this as "the release path is verified" is reading more than the
+integers support.
diff --git a/.dev/features/publish-npm-floor-assert/regression-report.json b/.dev/features/publish-npm-floor-assert/regression-report.json
new file mode 100644
index 0000000..c82f33b
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/regression-report.json
@@ -0,0 +1,22 @@
+{
+  "base": "e08eb18c16ce260bb5039d039dcb9c56397d1a9e",
+  "inside": [
+    ".github/workflows/publish.yml",
+    "docs/RELEASING.md",
+    ".dev/floor/check-run-pins.mjs",
+    ".dev/floor/check-run-pins.test.mjs"
+  ],
+  "outside_gates": {
+    "tests": {
+      "base": 0,
+      "head": 0
+    },
+    "validate": {
+      "base": 0,
+      "head": 0
+    }
+  },
+  "regressions": [],
+  "pre_existing": [],
+  "verdict": "no-regressions"
+}
diff --git a/.dev/features/publish-npm-floor-assert/verify-report.json b/.dev/features/publish-npm-floor-assert/verify-report.json
new file mode 100644
index 0000000..3b88e00
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/verify-report.json
@@ -0,0 +1,19 @@
+{
+  "feature": "publish-npm-floor-assert",
+  "gates": {
+    "check-action-pins": 0,
+    "check-run-pins": 0,
+    "floor-tests": 0,
+    "format:check": 0,
+    "lint": 0,
+    "lint:md": 0,
+    "test": 0,
+    "validate": 0
+  },
+  "verdict": "PASS",
+  "failing_gates": [],
+  "verifiers": {
+    "registered": 0,
+    "findings": []
+  }
+}
diff --git a/.dev/floor/check-run-pins.mjs b/.dev/floor/check-run-pins.mjs
new file mode 100644
index 0000000..3534e07
--- /dev/null
+++ b/.dev/floor/check-run-pins.mjs
@@ -0,0 +1,384 @@
+#!/usr/bin/env node
+// .dev/floor/check-run-pins.mjs — deterministic floor check over the SHELL COMMANDS the GitHub
+// Actions definitions in this repo execute: every package a `run:` line installs or execs must be
+// pinned to an EXACT semver. A floating spec (`@latest`, `@next`, `^1.2.3`) or a bare name is a
+// violation.
+//
+// NON-LLM, dependency-free (Node stdlib only). No network, no child_process, no eval, no dynamic import.
+//
+// WHY IT EXISTS (P7 — a real, already-observed drift, not a hypothetical): publish.yml ran
+// `npm install -g npm@latest` INSIDE the release job — the one job holding `id-token: write` and the
+// `npm-publish` environment — so whatever npm shipped that day executed the release. It had silently
+// crossed a major: the registry `latest` dist-tag was npm 12.0.2 while the step was written against
+// 11.x. `check-action-pins.mjs` could never have caught it: its contract is `uses:` refs, and this
+// was a `run:` line. That gap is what this file closes.
+//
+// WHAT IS GUARANTEED (P0 — floor primitive #3, enum/regex; ARCHITECTURE.md §2):
+//   the FORM of every package spec this scanner ENUMERATES — an exact `MAJOR.MINOR.PATCH` version.
+// WHAT IS NOT (named residuals, never claimed):
+//   • R1 — NON-PACKAGE-MANAGER PULLS. `curl … | sh`, a raw binary download, `pip`/`go install`/
+//     `cargo install`/`brew`. gitleaks.yml's `curl` is DELIBERATELY out of contract: it is version-
+//     AND SHA-256-pinned, and teaching this checker to recognise "that curl is checksum-verified"
+//     would be a CLASSIFICATION, which P5 forbids. Out of scope by construction, not by oversight.
+//     Also out of contract, and of the same laundering shape .github/actions/** had before it was
+//     walked: `run: npm run <script>` executes a package.json script, which could itself pull a
+//     floating package. This scanner reads .github/** only and can never see it.
+//   • R2 — ENUMERATOR DUPLICATION. collectFiles/safeLstat/isYaml/LINE_SPLIT_RE/emit are duplicated
+//     from check-action-pins.mjs, so a walker fix must be applied twice. A shared module was
+//     rejected: NO floor script imports another, and that isolation is a safety property (one
+//     module's bug cannot take down two gates). check-run-pins.test.mjs cross-checks that both
+//     checkers enumerate the SAME files[] for this repo, so the two walkers cannot drift silently.
+//   • R3 — SHELL INDIRECTION. A package name in a variable (`npm i -g "$PKG"`), `eval`, a heredoc,
+//     or base64 defeats a line scanner. `$`-bearing specs are reported as `unpinnable-version`;
+//     a name assembled out of sight is not seen at all.
+//   • R4 — VALUE-SEPARATED FLAGS. `npm i --some-flag value pkg@1.2.3` may read `value` as a package
+//     spec. URLs (`://`) and paths are excluded; other flag values are not. Fail-CLOSED noise.
+//   • R5 — the ASSERT's PRESENCE, covered NEXT DOOR rather than here. THIS checker enforces only
+//     that no floating install exists; it classifies specs it finds, so deleting publish.yml's
+//     `Assert npm floor` step outright would trip nothing in this file. That other half is asserted
+//     by check-run-pins.test.mjs (the step and its 11.5.1 floor value must be present), which the
+//     same floor.yml `node --test` run collects — so the guarantee is whole, but it is NOT this
+//     program's doing. Named so the split is visible.
+//   • R6 — SYMLINK ASYMMETRY, INHERITED. A symlink under .github/workflows/ is reported as
+//     `unreadable-file`, but a symlinked .github/actions/**/action.yml is skipped SILENTLY by the
+//     walk. check-action-pins.mjs behaves identically (verified against the same fixture), so this
+//     is inherited, not introduced — and fixing it belongs in a change that touches BOTH walkers,
+//     which is a different axis than this gate. check-run-pins.test.mjs pins the asymmetry with an
+//     assertion that both gates agree, so neither can change it unilaterally or silently.
+//   • Total YAML fidelity. This is a LINE SCANNER, not a YAML parser (stdlib-only; js-yaml is a
+//     transitive dep, not ours). Every line of every enumerated file is scanned, which is why no
+//     block-scalar scope tracking is needed — and why an unrecognised shape fails TOWARD flagging.
+//
+// WHAT IT ENUMERATES (identical to check-action-pins — both are executed by GitHub):
+//   1. `.github/workflows/*.{yml,yaml}` — non-recursive, mirroring GitHub.
+//   2. `.github/actions/**/action.{yml,yaml}` — LOCAL composite/docker action definitions, walked
+//      recursively. A composite action's `runs.steps[].run:` is a real shell command running with
+//      the job's token; scanning only workflows would make it a laundering path.
+//
+// Usage:  node .dev/floor/check-run-pins.mjs [targetDir]      (default: cwd)
+// Output: {"checked":<int>,"skipped":<int>,"files":[...],"violations":[{file,line,ref,reason}]}
+// Exit:   0 clean · 1 >=1 violation
+//
+// Every output field is enum-gated / path-resolved (paths, ints, an enum `reason`). The `ref` value
+// is copied verbatim from the scanned file, so it inherits that file's trust — but NO decision reads
+// it: the verdict is `violations.length > 0`, an integer test (P2, fix #1). The field is named `ref`,
+// not `spec`, so this checker's records are shape-identical to check-action-pins'.
+
+import { readFileSync, readdirSync, existsSync, lstatSync } from "node:fs";
+import { join, sep } from "node:path";
+
+// An EXACT version: MAJOR.MINOR.PATCH, with optional prerelease / build metadata. Anything else —
+// `latest`, `next`, `^1.2.3`, `~1.2`, `1.x`, `>=2`, `beta` — is floating by definition.
+const EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// Split on ALL THREE line-ending conventions. Splitting on "\n" alone leaves a trailing "\r" on
+// every line of a CRLF file, which defeats line-anchored matching and makes the WHOLE FILE
+// invisible — exit 0, checked:0, byte-identical to a clean repo. Reachable BY ACCIDENT via
+// core.autocrlf; this repo has no .gitattributes and prettier's globs exclude .github/**.
+// (The same root cause cost check-action-pins a silent hole; it is fixed here by construction.)
+const LINE_SPLIT_RE = /\r\n|\r|\n/;
+
+// Shell command separators. A single line legitimately carries several commands
+// (`npm ci && npm i -g x@latest`), and scanning only the first would hide the rest.
+const SEGMENT_SPLIT_RE = /&&|\|\||;|\|/;
+
+// A `name:` key in KEY POSITION — line start, after an optional YAML sequence dash. Anchoring is
+// load-bearing and deliberate: an UNANCHORED test would also match a `run:` body line such as
+// `echo "name: x" && npm i -g y@latest`, and skipping that line would be a fail-OPEN miss. Anchored,
+// only a genuine step-name line is skipped.
+const NAME_KEY_START_RE = /^\s*-?\s*["']?name["']?\s*:/;
+// A `run` key ANYWHERE — this is what keeps the flow-mapping form `- {name: n, run: npm i -g p}`
+// in scope even though it opens with a name-ish key.
+const RUN_KEY_RE = /(?:^|[\s,{[])["']?run["']?\s*:/;
+
+// Reasons are an ENUM, never prose (P5 — membership, not classification).
+const REASON = {
+  FLOATING: "floating-version", // `pkg@latest`, `pkg@^1.2.3` — resolves differently over time
+  UNPINNED: "unpinned-package", // `pkg`, `@scope/pkg`, `github:user/repo` — no version at all
+  UNPINNABLE: "unpinnable-version", // a ${{ }} expression or $VAR — no fixed identity to pin
+  UNREADABLE: "unreadable-file", // could not stat/read (e.g. a dangling symlink)
+};
+
+// Recognised command heads, matched as an exact token sequence. LONGEST FIRST at each position, so
+// `yarn global add` is never mis-read as `yarn` + junk.
+//   install  — every non-flag argument is a package spec
+//   exec     — the package is resolved and RUN; only the package position is a spec
+//   lockfile — resolves from a committed lockfile, so it is deterministic without a version
+const HEADS = [
+  { tokens: ["yarn", "global", "add"], kind: "install" },
+  { tokens: ["npm", "install"], kind: "install" },
+  { tokens: ["npm", "i"], kind: "install" },
+  { tokens: ["npm", "add"], kind: "install" },
+  { tokens: ["npm", "exec"], kind: "exec" },
+  { tokens: ["npm", "ci"], kind: "lockfile" },
+  { tokens: ["pnpm", "install"], kind: "install" },
+  { tokens: ["pnpm", "i"], kind: "install" },
+  { tokens: ["pnpm", "add"], kind: "install" },
+  { tokens: ["pnpm", "dlx"], kind: "exec" },
+  { tokens: ["yarn", "add"], kind: "install" },
+  { tokens: ["yarn", "dlx"], kind: "exec" },
+  { tokens: ["bun", "install"], kind: "install" },
+  { tokens: ["bun", "i"], kind: "install" },
+  { tokens: ["bun", "add"], kind: "install" },
+  { tokens: ["npx"], kind: "exec" },
+  { tokens: ["bunx"], kind: "exec" },
+].sort((a, b) => b.tokens.length - a.tokens.length);
+
+// An argument that pulls nothing from a registry: a local path, a file: spec, a tarball, or a URL
+// (the common shape of a value-separated flag such as `--registry https://…`).
+const NOT_A_REGISTRY_SPEC_RE = /^(?:\.\.?[/\\]|[/\\]|~[/\\]|file:)|\.(?:tgz|tar\.gz)$|:\/\//;
+
+function emit(obj, code) {
+  // NOT process.exit(): stdout is ASYNC on a pipe, and exiting truncates it — a large violation set
+  // was cut at exactly 65536 bytes through `| cat`, leaving consumers with unparseable output.
+  // Setting exitCode lets the write drain and Node exit naturally.
+  process.stdout.write(JSON.stringify(obj) + "\n");
+  process.exitCode = code;
+}
+
+const isYaml = (f) => /\.ya?ml$/i.test(f); // case-INsensitive: `CI.YML` must not be silently dropped
+
+// lstat, not stat: a DANGLING symlink makes stat throw ENOENT, which would crash the walk before any
+// JSON is emitted.
+function safeLstat(abs) {
+  try {
+    return lstatSync(abs);
+  } catch {
+    return null;
+  }
+}
+
+// Enumerate every file GitHub would execute. Returns readable {rel, abs} pairs plus unreadable ones.
+function collectFiles(target) {
+  const found = [];
+  const unreadable = [];
+
+  // 1. workflows — flat, mirroring what GitHub actually executes.
+  const wfRel = join(".github", "workflows");
+  const wfDir = join(target, wfRel);
+  if (existsSync(wfDir)) {
+    let names = [];
+    try {
+      names = readdirSync(wfDir).sort();
+    } catch {
+      /* unreadable dir: nothing to enumerate */
+    }
+    for (const name of names) {
+      if (!isYaml(name)) continue;
+      const abs = join(wfDir, name);
+      const st = safeLstat(abs);
+      if (st === null || st.isSymbolicLink()) {
+        unreadable.push({ rel: join(wfRel, name), abs });
+        continue;
+      }
+      if (st.isFile()) found.push({ rel: join(wfRel, name), abs });
+    }
+  }
+
+  // 2. local action definitions — recursive, depth-bounded, symlink-refusing.
+  const walk = (absDir, relDir, depth) => {
+    if (depth > 8) return; // bounded: a pathological tree cannot hang the floor
+    let names = [];
+    try {
+      names = readdirSync(absDir).sort();
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const abs = join(absDir, name);
+      const rel = join(relDir, name);
+      const st = safeLstat(abs);
+      if (st === null) {
+        unreadable.push({ rel, abs });
+        continue;
+      }
+      if (st.isSymbolicLink()) continue; // never follow a symlink out of the tree
+      if (st.isDirectory()) walk(abs, rel, depth + 1);
+      else if (st.isFile() && /^action\.ya?ml$/i.test(name)) found.push({ rel, abs });
+    }
+  };
+  const actRel = join(".github", "actions");
+  const actDir = join(target, actRel);
+  if (existsSync(actDir)) walk(actDir, actRel, 0);
+
+  return { found, unreadable };
+}
+
+// A `${{ … }}` expression contains SPACES, so a naive whitespace tokenizer shatters
+// `pkg@${{ inputs.v }}` into three tokens and reports three findings for one spec. Collapsing the
+// expression to a space-free placeholder BEFORE tokenizing keeps it one spec — and the placeholder
+// still carries `$`, so classifySpec reports it as unpinnable rather than conforming.
+const collapseExpressions = (line) => line.replace(/\$\{\{.*?\}\}/g, "${{...}}");
+
+// Normalise ONE token: drop surrounding quotes (which must not smuggle a floating spec past the
+// tests), a leading `$(`/`(` from a command substitution, and trailing shell / YAML-flow punctuation
+// (`flow@latest}` inside `- {name: n, run: …}` is the spec `flow@latest`).
+const normalizeToken = (t) =>
+  t
+    .replace(/^["']|["']$/g, "")
+    .replace(/^\$\(|^\(/, "")
+    .replace(/[),;\]}]+$/, "")
+    .replace(/^["']|["']$/g, "");
+
+// Classify ONE package spec. Returns a REASON, or null when it conforms.
+// ORDER IS LOAD-BEARING: the expression test runs FIRST, so `pkg@${{ inputs.v }}` is reported as
+// unpinnable rather than mislabeled floating.
+function classifySpec(spec) {
+  if (spec.includes("${{") || spec.includes("$")) return REASON.UNPINNABLE;
+
+  // `@scope/name@1.2.3` — the LAST `@` separates the version. An `@` at index 0 is the scope
+  // sigil, not a separator, so `@scope/name` correctly reads as having no version.
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return REASON.UNPINNED;
+
+  const version = spec.slice(at + 1);
+  if (version === "") return REASON.UNPINNED;
+  return EXACT_SEMVER_RE.test(version) ? null : REASON.FLOATING;
+}
+
+// Pull the package-spec positions out of one command's arguments.
+// Returns {specs, exempt} — `exempt` counts args deliberately excluded, so an exemption can never
+// become a silent hole.
+function specPositions(kind, args) {
+  const specs = [];
+  let exempt = 0;
+
+  if (kind === "install") {
+    for (const a of args) {
+      if (a === "--" || a.startsWith("-")) continue; // flags are not packages
+      if (NOT_A_REGISTRY_SPEC_RE.test(a)) {
+        exempt += 1;
+        continue;
+      }
+      specs.push(a);
+    }
+    return { specs, exempt };
+  }
+
+  // exec: the package is whatever the runner RESOLVES — the first positional, or the value of
+  // -p/--package. Later positionals are the executed command and ITS arguments, never packages.
+  let sawPackageFlag = false;
+  let tookPositional = false;
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") continue;
+    if (a === "-p" || a === "--package") {
+      const v = args[j + 1];
+      if (v !== undefined) {
+        specs.push(v);
+        j += 1;
+      }
+      sawPackageFlag = true;
+      continue;
+    }
+    if (a.startsWith("--package=")) {
+      specs.push(a.slice("--package=".length));
+      sawPackageFlag = true;
+      continue;
+    }
+    if (a.startsWith("-")) continue;
+    // With an explicit -p/--package, the first positional is the COMMAND, not a package.
+    if (!tookPositional && !sawPackageFlag) {
+      specs.push(a);
+      tookPositional = true;
+    }
+  }
+
+  const kept = [];
+  for (const s of specs) {
+    if (NOT_A_REGISTRY_SPEC_RE.test(s)) exempt += 1;
+    else kept.push(s);
+  }
+  return { specs: kept, exempt };
+}
+
+// Find the FIRST recognised command head in a token list. Scanning from any position (not just
+// token 0) is what makes `run:`, `- run:`, `sudo`, and `env FOO=1` prefixes all work uniformly
+// without enumerating them.
+function findHead(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    for (const head of HEADS) {
+      if (head.tokens.every((t, k) => tokens[i + k] === t)) {
+        return { kind: head.kind, args: tokens.slice(i + head.tokens.length) };
+      }
+    }
+  }
+  return null;
+}
+
+// Parse ONE line into zero or more {reason, ref} records, plus an exempt count.
+function parseLine(raw) {
+  const out = [];
+  let exempt = 0;
+
+  if (raw.trimStart().startsWith("#")) return { out, exempt }; // a YAML comment is never executed
+  // A step name is never executed — but only when the line does not ALSO declare a run key.
+  if (NAME_KEY_START_RE.test(raw) && !RUN_KEY_RE.test(raw)) return { out, exempt };
+
+  for (const segment of collapseExpressions(raw).split(SEGMENT_SPLIT_RE)) {
+    const tokens = segment.split(/\s+/).filter(Boolean).map(normalizeToken).filter(Boolean);
+    const head = findHead(tokens);
+    if (head === null) continue;
+
+    if (head.kind === "lockfile") {
+      exempt += 1; // `npm ci` — deterministic from the committed lockfile
+      continue;
+    }
+
+    const { specs, exempt: argExempt } = specPositions(head.kind, head.args);
+    exempt += argExempt;
+
+    // An install head with NO package argument is a lockfile install (`npm install` bare). Guard on
+    // argExempt so an install whose only argument was an excluded PATH is counted once, not twice.
+    if (specs.length === 0) {
+      if (head.kind === "install" && argExempt === 0) exempt += 1;
+      continue;
+    }
+
+    for (const spec of specs) out.push({ reason: classifySpec(spec), ref: spec });
+  }
+
+  return { out, exempt };
+}
+
+function main() {
+  const target = process.argv[2] || process.cwd();
+  const { found, unreadable } = collectFiles(target);
+
+  const violations = [];
+  let checked = 0;
+  let skipped = 0;
+
+  // An entry we cannot read is a VIOLATION, not a skip: "I could not look" must never render as
+  // "there was nothing to find".
+  for (const u of unreadable) {
+    violations.push({ file: u.rel.split(sep).join("/"), line: 0, ref: "", reason: REASON.UNREADABLE });
+  }
+
+  for (const f of found) {
+    const rel = f.rel.split(sep).join("/");
+    let lines;
+    try {
+      lines = readFileSync(f.abs, "utf8").split(LINE_SPLIT_RE);
+    } catch {
+      violations.push({ file: rel, line: 0, ref: "", reason: REASON.UNREADABLE });
+      continue;
+    }
+
+    lines.forEach((raw, i) => {
+      const { out, exempt } = parseLine(raw);
+      skipped += exempt;
+      for (const { reason, ref } of out) {
+        checked += 1;
+        if (reason !== null) violations.push({ file: rel, line: i + 1, ref, reason });
+      }
+    });
+  }
+
+  emit(
+    { checked, skipped, files: found.map((f) => f.rel.split(sep).join("/")), violations },
+    violations.length > 0 ? 1 : 0,
+  );
+}
+
+main();
diff --git a/.dev/floor/check-run-pins.test.mjs b/.dev/floor/check-run-pins.test.mjs
new file mode 100644
index 0000000..f5ad329
--- /dev/null
+++ b/.dev/floor/check-run-pins.test.mjs
@@ -0,0 +1,432 @@
+// .dev/floor/check-run-pins.test.mjs — tests for the deterministic run-line pin floor check.
+//
+// NO `claude -p`, NO git, NO network. Three kinds of test, deliberately mixed (the split
+// check-action-pins.test.mjs makes, plus one addition forced by this gate's shape):
+//
+//   1. HERMETIC — each builds a small repo in an os.tmpdir() scratch dir and asserts the public
+//      surface (exit code + stdout JSON) by subprocess.
+//   2. LIVE REPO-CONSISTENCY (the ★) — validates the COMMITTED tree against REALITY. This is what
+//      makes a floating install a BUILD FAILURE rather than a property someone has to remember to
+//      re-grep: floor.yml's `node --test ".dev/**/*.test.mjs"` collects this file on every
+//      pull_request and every push to main, so the gate needs no workflow change to be wired.
+//   3. POSITIVE CONTROL (the ★★) — the addition. This repo's live numbers are `checked: 0`,
+//      because after the publish fix NO workflow line contains a pinned install at all. A live
+//      assertion of `violations: []` over `checked: 0` is therefore weak in exactly the way exit 0
+//      is weak: it is ALSO what a checker returns when it finds nothing to inspect. So the live
+//      workflow text is read from disk, ONE line is mutated back to the `npm install -g npm@latest`
+//      this increment deleted, and the checker must flag it — proving the scanner fires on THIS
+//      repo's own file shape, not merely on synthetic fixtures.
+//
+// The ✱ tests are the defects found by running the first version of this checker against a fixture
+// covering every planned case. Each was reproduced before being fixed:
+//   ✱ `pkg@${{ inputs.v }}`  → whitespace-tokenized into THREE findings for one spec
+//   ✱ `- {name: n, run: …}`  → the spec was reported as `flow@latest}` with the flow brace attached
+//   ✱ `$(npm i -g x@latest)` → the `$(` prefix hid the head entirely — a silent MISS, not noise
+//   ✱ `npm i ./local`        → counted `skipped` twice (path exemption + empty-args exemption)
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readdirSync, readFileSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const here = dirname(fileURLToPath(import.meta.url)); // .dev/floor
+const REPO = join(here, "..", ".."); // repo root
+const CAP = join(here, "check-run-pins.mjs");
+const SIBLING = join(here, "check-action-pins.mjs");
+
+function run(targetDir, capPath = CAP) {
+  return spawnSync(process.execPath, [capPath, targetDir], { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function json(r) {
+  return JSON.parse(r.stdout);
+}
+function scratch() {
+  return mkdtempSync(join(tmpdir(), "pharn-runpins-"));
+}
+function reasons(r) {
+  return json(r).violations.map((v) => v.reason);
+}
+function refs(r) {
+  return json(r).violations.map((v) => v.ref);
+}
+
+// Build a scratch repo whose single workflow contains `body` verbatim under a steps: list.
+function repoWith(body, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), `name: t\njobs:\n  j:\n    steps:\n${body}\n`);
+  return root;
+}
+// The same, but writing the file bytes exactly as given (for line-ending fixtures).
+function repoWithRaw(bytes, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), bytes);
+  return root;
+}
+
+// ---------------------------------------------------------------------------
+// Conforming shapes
+
+test("an EXACT semver pin → exit 0, checked counts it", () => {
+  const r = run(repoWith("      - run: npm install -g npm@11.5.1"));
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r).violations, []);
+  assert.equal(json(r).checked, 1);
+});
+
+test("a prerelease / build-metadata version is still an exact pin", () => {
+  for (const v of ["1.2.3-rc.1", "1.2.3+build.5", "1.2.3-beta.2+exp"]) {
+    const r = run(repoWith(`      - run: npm i -g pkg@${v}`));
+    assert.equal(r.status, 0, `expected ${v} to conform`);
+  }
+});
+
+test("`npm ci` is a lockfile install → exit 0, counted in skipped (never a silent pass)", () => {
+  const r = run(repoWith("      - run: npm ci"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).skipped, 1);
+  assert.equal(json(r).checked, 0);
+});
+
+test("bare `npm install` (zero package args) is a lockfile install → skipped, not a violation", () => {
+  const r = run(repoWith("      - run: npm install"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).skipped, 1);
+});
+
+test("`npm run <script>` and `npm publish` are not installs and are never classified", () => {
+  const r = run(repoWith("      - run: npm run build\n      - run: npm publish --provenance --access public"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+  assert.equal(json(r).skipped, 0);
+});
+
+test("a local path / file: / tarball arg pulls nothing from a registry → exempt, counted in skipped", () => {
+  const r = run(repoWith("      - run: npm i ./local\n      - run: npm i file:../x\n      - run: npm i ./p.tgz"));
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r).violations, []);
+  // ✱ each of the three counts ONCE — the path exemption must not also fire the empty-args exemption.
+  assert.equal(json(r).skipped, 3);
+});
+
+// ---------------------------------------------------------------------------
+// Violating shapes — the enum
+
+test("`npm install -g npm@latest` → exit 1, floating-version (the exact line this increment deleted)", () => {
+  const r = run(repoWith("      - run: npm install -g npm@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["floating-version"]);
+  assert.deepEqual(refs(r), ["npm@latest"]);
+});
+
+test("every floating specifier form is floating-version, not just a dist-tag", () => {
+  for (const v of ["latest", "next", "beta", "^1.2.3", "~1.2", "1.x", ">=2", "1.2"]) {
+    const r = run(repoWith(`      - run: npm i -g pkg@${v}`));
+    assert.equal(r.status, 1, `expected @${v} to be flagged`);
+    assert.deepEqual(reasons(r), ["floating-version"], `wrong reason for @${v}`);
+  }
+});
+
+test("a bare package name → unpinned-package", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g typescript"))), ["unpinned-package"]);
+});
+
+test("a git / github spec has no version → unpinned-package", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g github:user/repo"))), ["unpinned-package"]);
+});
+
+test("✱ a ${{ }} expression version → ONE unpinnable-version finding, not three tokens", () => {
+  const r = run(repoWith("      - run: npm i -g pkg@${{ inputs.version }}"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unpinnable-version"]);
+});
+
+test("a shell variable version → unpinnable-version (not mislabeled floating)", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g pkg@$VERSION"))), ["unpinnable-version"]);
+});
+
+// ---------------------------------------------------------------------------
+// Scoped packages — the `@` boundary
+
+test("@scope/pkg@1.2.3 conforms; @scope/pkg alone is unpinned (the scope sigil is not a separator)", () => {
+  assert.equal(run(repoWith("      - run: npm i -g @scope/pkg@1.2.3")).status, 0);
+  const r = run(repoWith("      - run: npm i -g @scope/pkg"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unpinned-package"]);
+  assert.deepEqual(refs(r), ["@scope/pkg"]);
+});
+
+// ---------------------------------------------------------------------------
+// exec-kind — only the package position is a spec
+
+test("`npx tsx@4.7.0 src/index.ts` → exit 0: the script argument is NOT a package", () => {
+  const r = run(repoWith("      - run: npx tsx@4.7.0 src/index.ts"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1); // exactly one spec classified, not two
+});
+
+test("`npx tsx src/index.ts` → exit 1 on the package only", () => {
+  const r = run(repoWith("      - run: npx tsx src/index.ts"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["tsx"]);
+});
+
+test("`npx -p pkg@1.5.0 cmd` reads the -p VALUE as the package and the positional as the command", () => {
+  const r = run(repoWith("      - run: npx -p cowsay@1.5.0 cowsay hi"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1);
+});
+
+test("`npx --package=pkg cmd` with no version → unpinned-package on the flag value", () => {
+  const r = run(repoWith("      - run: npx --package=cowsay cowsay hi"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["cowsay"]);
+});
+
+test("the head table is not npm-only — pnpm / yarn / bun / bunx / dlx are all recognised", () => {
+  const cases = [
+    ["pnpm add -g a@latest", "floating-version"],
+    ["pnpm dlx b", "unpinned-package"],
+    ["yarn global add c@next", "floating-version"],
+    ["yarn add d", "unpinned-package"],
+    ["yarn dlx e", "unpinned-package"],
+    ["bun add -g f@latest", "floating-version"],
+    ["bunx g", "unpinned-package"],
+    ["npm exec h", "unpinned-package"],
+  ];
+  for (const [cmd, reason] of cases) {
+    const r = run(repoWith(`      - run: ${cmd}`));
+    assert.equal(r.status, 1, `expected \`${cmd}\` to be flagged`);
+    assert.deepEqual(reasons(r), [reason], `wrong reason for \`${cmd}\``);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Line-shape handling
+
+test("chained commands are split — the SECOND command is not hidden by the first", () => {
+  const r = run(repoWith("      - run: npm ci && npm i -g x@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["x@latest"]);
+  assert.equal(json(r).skipped, 1); // the `npm ci` half still counted
+});
+
+test("a `sudo` / `env` prefix does not hide the command (the head is matched at any position)", () => {
+  assert.equal(run(repoWith("      - run: sudo npm i -g p@latest")).status, 1);
+  assert.equal(run(repoWith("      - run: env FOO=1 npm i -g p@latest")).status, 1);
+});
+
+test("✱ a $( ) command substitution does not hide the head (this was a silent MISS)", () => {
+  const r = run(repoWith("      - run: $(npm i -g hidden@latest)"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["hidden@latest"]);
+});
+
+test("✱ a flow-mapping step reports the spec WITHOUT the trailing brace", () => {
+  const r = run(repoWith("      - {name: n, run: npm i -g flow@latest}"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["flow@latest"]);
+});
+
+test("a quoted spec cannot smuggle a floating version past the version test", () => {
+  assert.deepEqual(reasons(run(repoWith(`      - run: npm i -g "pkg@latest"`))), ["floating-version"]);
+  assert.deepEqual(reasons(run(repoWith(`      - run: npm i -g 'pkg@latest'`))), ["floating-version"]);
+});
+
+test("a run: | block scalar body is scanned with no scope tracking (every line is scanned)", () => {
+  const r = run(repoWith("      - run: |\n          set -e\n          npm i -g deep@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["deep@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// Deterministic exclusions — and the fail-OPEN holes they must NOT create
+
+test("★ a YAML comment is never executed → exit 0 (this protects publish.yml's own comment block)", () => {
+  const r = run(repoWith("      # npm install -g npm@latest"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+});
+
+test("★ a step NAME is never executed → exit 0; but the same line with a run key IS scanned", () => {
+  assert.equal(run(repoWith("      - name: npm install -g inprose@latest")).status, 0);
+  assert.equal(run(repoWith("      - {name: n, run: npm i -g flow@latest}")).status, 1);
+});
+
+test("★ the name-exclusion is ANCHORED — `echo \"name: x\" && npm i -g p@latest` is NOT skipped", () => {
+  // An unanchored `name:` test would swallow this whole line: a fail-OPEN miss, not noise.
+  const r = run(repoWith(`      - run: echo "name: x" && npm i -g sneaky@latest`));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["sneaky@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// File enumeration — inherited hard-won behavior
+
+test("CRLF line endings do not hide a violation (whole file was invisible in the sibling gate)", () => {
+  const root = repoWithRaw("name: t\r\njobs:\r\n  j:\r\n    steps:\r\n      - run: npm i -g p@latest\r\n");
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["p@latest"]);
+});
+
+test("lone-CR (classic Mac) line endings do not collapse the file into one invisible line", () => {
+  const root = repoWithRaw("name: t\rjobs:\r  j:\r    steps:\r      - run: npm i -g p@latest\r");
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["p@latest"]);
+});
+
+test("an UPPERCASE workflow filename is still opened", () => {
+  const r = run(repoWith("      - run: npm i -g p@latest", { name: "CI.YML" }));
+  assert.equal(r.status, 1);
+  assert.equal(json(r).files.length, 1);
+});
+
+test("a local composite action's run: is walked — it is not a laundering path", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "actions", "setup"), { recursive: true });
+  writeFileSync(
+    join(root, ".github", "actions", "setup", "action.yml"),
+    "name: setup\nruns:\n  using: composite\n  steps:\n    - run: npm i -g sneaky@latest\n      shell: bash\n",
+  );
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["sneaky@latest"]);
+});
+
+test("a dangling symlink in workflows/ is a VIOLATION, not a skip, and JSON is still emitted", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  symlinkSync(join(root, "nope"), join(root, ".github", "workflows", "d.yml"));
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unreadable-file"]);
+  assert.deepEqual(json(r).files, []); // it was never opened, and says so
+});
+
+// This pins CURRENT, INHERITED behavior rather than desired behavior — see the R6 residual in
+// check-run-pins.mjs. A symlinked action.yml is skipped SILENTLY by the .github/actions/** walk,
+// while the same symlink under .github/workflows/ is reported. Both gates agree (verified by
+// running check-action-pins.mjs against the identical fixture), so this test exists to make the
+// asymmetry VISIBLE and to fail loudly if either gate changes it unilaterally.
+test("a symlinked action.yml is currently skipped silently — asymmetry pinned, both gates agree", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "actions", "x"), { recursive: true });
+  symlinkSync(join(root, "nope"), join(root, ".github", "actions", "x", "action.yml"));
+
+  const mine = run(root);
+  const sibling = run(root, SIBLING);
+  assert.equal(mine.status, 0);
+  assert.deepEqual(json(mine), { checked: 0, skipped: 0, files: [], violations: [] });
+  assert.equal(sibling.status, json(sibling).violations.length > 0 ? 1 : 0);
+  assert.deepEqual(json(mine).violations, json(sibling).violations, "the two gates must agree on symlink handling");
+});
+
+test("a repo with no .github at all emits valid JSON and exits 0", () => {
+  const r = run(scratch());
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r), { checked: 0, skipped: 0, files: [], violations: [] });
+});
+
+test("a large violation set survives the pipe (stdout must not be truncated)", () => {
+  const body = Array.from({ length: 2000 }, (_, i) => `      - run: npm i -g pkg${i}@latest`).join("\n");
+  const r = run(repoWith(body));
+  assert.equal(r.status, 1);
+  assert.equal(json(r).violations.length, 2000);
+});
+
+// ---------------------------------------------------------------------------
+// ★ LIVE REPO-CONSISTENCY — the committed tree, not a fixture
+
+test("★ the live repo has NO floating install in any workflow run: line", () => {
+  const r = run(REPO);
+  const d = json(r);
+  assert.deepEqual(d.violations, [], `unexpected violations: ${JSON.stringify(d.violations)}`);
+  assert.equal(r.status, 0);
+
+  // `npm ci` in ci.yml and publish.yml — asserted EXACTLY, so an exemption can never become a
+  // silent hole. If this number changes, a lockfile install was added or removed on purpose.
+  assert.equal(d.skipped, 2);
+
+  // Independent recount of the enumerated workflow files, case-insensitively — exit 0 is also what
+  // a checker returns when it opened nothing.
+  const expected = readdirSync(join(REPO, ".github", "workflows"))
+    .filter((f) => /\.ya?ml$/i.test(f))
+    .sort()
+    .map((f) => `.github/workflows/${f}`);
+  assert.deepEqual(d.files, expected);
+  assert.ok(expected.length >= 5, "expected at least five workflows in this repo");
+});
+
+test("★ publish.yml carries no `npm install -g` and no `@latest` at all", () => {
+  const text = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+  const code = text
+    .split(/\r\n|\r|\n/)
+    .filter((l) => !l.trimStart().startsWith("#"))
+    .join("\n");
+  assert.ok(!/install\s+-g/.test(code), "publish.yml reintroduced a global install");
+  assert.ok(!/@latest/.test(code), "publish.yml reintroduced an @latest ref");
+});
+
+// Closes residual R5. The CHECKER cannot enforce that a step EXISTS — it only classifies package
+// specs it finds, so deleting the assert outright would trip nothing in check-run-pins.mjs. This
+// assertion covers the other half, in the same place and by the same runner (floor.yml's
+// `node --test`), so the increment's headline guarantee is protected against BOTH reversion to a
+// floating install AND plain deletion. It reads the committed file; it never executes it.
+test("★ publish.yml still ENFORCES the npm floor — the assert step and its floor value are present", () => {
+  const text = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+  const code = text
+    .split(/\r\n|\r|\n/)
+    .filter((l) => !l.trimStart().startsWith("#"))
+    .join("\n");
+
+  assert.match(code, /- name: Assert npm floor$/m, "the `Assert npm floor` step was removed from publish.yml");
+  assert.match(code, /"\$\(npm --version\)" 11\.5\.1/, "the assert no longer compares npm --version against 11.5.1");
+  // The floor value must agree with npm's documented Trusted Publishing minimum. If npm ever raises
+  // it, this fails loudly rather than letting publish.yml assert a stale number.
+  assert.ok(code.includes("11.5.1"), "the 11.5.1 Trusted Publishing floor is no longer named in publish.yml");
+});
+
+// ---------------------------------------------------------------------------
+// ★★ POSITIVE CONTROL — prove the scanner fires on THIS repo's own file shape.
+// The live assertions above pass with `checked: 0`, which is also what a broken scanner reports.
+
+test("★★ mutating the live publish.yml back to `npm install -g npm@latest` IS caught", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  const live = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+
+  // Re-insert the deleted step verbatim, into the real file's real surroundings.
+  const mutated = live.replace(
+    /^(\s*)- name: Assert npm floor$/m,
+    "$1- name: Update npm\n$1  run: npm install -g npm@latest\n$1- name: Assert npm floor",
+  );
+  assert.notEqual(mutated, live, "the anchor step was not found — this control is not exercising anything");
+  writeFileSync(join(root, ".github", "workflows", "publish.yml"), mutated);
+
+  const r = run(root);
+  assert.equal(r.status, 1, "the gate did NOT catch the very line this increment removed");
+  assert.deepEqual(reasons(r), ["floating-version"]);
+  assert.deepEqual(refs(r), ["npm@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// R2 backstop — the two duplicated walkers must not drift apart silently
+
+test("★ this gate and check-action-pins enumerate the SAME files for the live repo", () => {
+  assert.deepEqual(json(run(REPO)).files, json(run(REPO, SIBLING)).files);
+});
+
+// ---------------------------------------------------------------------------
+// Cleanup: scratch dirs live under os.tmpdir(); remove the ones this file made.
+
+test("cleanup", () => {
+  for (const d of readdirSync(tmpdir())) {
+    if (d.startsWith("pharn-runpins-")) rmSync(join(tmpdir(), d), { recursive: true, force: true });
+  }
+});
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6a08177..162b8b7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,8 +29,41 @@ jobs:
           node-version: 24
           cache: npm
           registry-url: https://registry.npmjs.org
-      - name: Update npm # Trusted Publishing requires npm >= 11.5.1
-        run: npm install -g npm@latest
+      # Trusted Publishing requires npm >= 11.5.1 (npm's own docs; it also requires
+      # node >= 22.14.0). node 24 already BUNDLES a satisfying npm — 11.17.0 at the
+      # released v24.19.0, checked 2026-08-10 — so the floor needs no install, only
+      # enforcement. This step therefore ASSERTS the floor instead of globally
+      # installing the floating `latest` npm at publish time: the release job, which
+      # holds `id-token: write` and the `npm-publish` environment, now downloads no
+      # third-party tool at all. (The deleted step had silently crossed a major — the
+      # registry `latest` dist-tag was npm 12.0.2 on 2026-08-10.) Pure node stdlib,
+      # no network.
+      #
+      # The floor gate .dev/floor/check-run-pins.mjs keeps the PACKAGE-MANAGER half of
+      # that true — no workflow run: line may install or exec an unpinned package. It
+      # does NOT cover curl-and-execute or any non-package-manager pull (its R1
+      # residual), so "downloads nothing" is enforced for one class, not universally.
+      #
+      # Fail-closed rests on the PARSE, not on the shell: a command substitution used
+      # as an argument does NOT trip `set -e`, so an `npm --version` that fails or
+      # prints nothing arrives here as "" and exits 1 as an unparseable version.
+      - name: Assert npm floor
+        run: |
+          set -euo pipefail
+          node -e '
+            const parse = (v) => {
+              const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? "").trim());
+              if (!m) { console.error(`npm floor: unparseable version ${JSON.stringify(v)}`); process.exit(1); }
+              return m.slice(1, 4).map(Number);
+            };
+            const [found, floor] = process.argv.slice(1);
+            const f = parse(found), n = parse(floor);
+            if ((f[0] - n[0] || f[1] - n[1] || f[2] - n[2]) < 0) {
+              console.error(`npm floor NOT met: found ${found.trim()}, need >= ${floor} (npm Trusted Publishing minimum)`);
+              process.exit(1);
+            }
+            console.log(`npm floor OK: npm ${found.trim()} >= ${floor}`);
+          ' "$(npm --version)" 11.5.1
       - name: Install
         run: npm ci
       - name: Verify tag matches package.json version
diff --git a/.pharn/pharn-dev-verify/results.json b/.pharn/pharn-dev-verify/results.json
index c1e0603..27b910f 100644
--- a/.pharn/pharn-dev-verify/results.json
+++ b/.pharn/pharn-dev-verify/results.json
@@ -1 +1 @@
-{"test":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
+{"test":0,"validate":0,"lint":0,"format:check":0,"lint:md":0,"floor-tests":0,"check-run-pins":0,"check-action-pins":0}
\ No newline at end of file
diff --git a/.pharn/writes-scope.json b/.pharn/writes-scope.json
index fd255a1..919117d 100644
--- a/.pharn/writes-scope.json
+++ b/.pharn/writes-scope.json
@@ -1,7 +1,7 @@
 {
   "scope": [
-    ".dev/features/harden-action-pin-coverage/REVIEW.md"
+    ".dev/features/publish-npm-floor-assert/SHIP.md"
   ],
-  "set_by": ".claude/commands/pharn-dev-review.md",
-  "set_at": "2026-08-10T09:51:03.659Z"
+  "set_by": ".claude/commands/pharn-dev-ship.md",
+  "set_at": "2026-08-10T19:43:58.416Z"
 }
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index af3b6e3..078bbe7 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -44,12 +44,14 @@ credential is stored or passed.
 4. **Cut a GitHub Release.** Tag it **`vX.Y.Z`**, where `X.Y.Z` **exactly
    matches** `package.json` `version`. A guard step in `publish.yml` fails the
    run if the tag (minus its leading `v`) does not equal the package version.
-5. **Publishing the Release triggers `publish.yml`.** It runs on node 24 with
-   `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check
-   suite and build (via the `prepublishOnly` + `prepack` hooks), verifies the
-   tag, then runs `npm publish --provenance --access public`. The `--provenance`
-   flag overrides `publishConfig.provenance: false`, so the release carries a
-   signed provenance attestation.
+5. **Publishing the Release triggers `publish.yml`.** It runs on node 24, whose
+   bundled npm already satisfies the npm >= 11.5.1 that Trusted Publishing
+   needs — an **Assert npm floor** step enforces that and fails the run if it
+   ever stops being true, so nothing is installed at publish time. The run then
+   re-runs the full check suite and build (via the `prepublishOnly` + `prepack`
+   hooks), verifies the tag, and runs `npm publish --provenance --access
+   public`. The `--provenance` flag overrides `publishConfig.provenance: false`,
+   so the release carries a signed provenance attestation.
 
 ## Verify the release
 

From 88af5fbd0f67300607bdb2c449dff5a7e607ac31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Przemys=C5=82aw=20Galarowicz?= <pgalarowicz@gmail.com>
Date: Mon, 10 Aug 2026 21:54:23 +0200
Subject: [PATCH 2/2] fix(floor): join shell continuation lines in
 check-run-pins scanner

Backslash-continued run commands are merged before parseLine so package
args on the next line classify correctly, and the symlink parity test
pins the sibling gate exit code directly.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .dev/floor/check-run-pins.mjs      | 31 ++++++++++++++++++++++++++----
 .dev/floor/check-run-pins.test.mjs | 21 +++++++++++++++++++-
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/.dev/floor/check-run-pins.mjs b/.dev/floor/check-run-pins.mjs
index 3534e07..ed97344 100644
--- a/.dev/floor/check-run-pins.mjs
+++ b/.dev/floor/check-run-pins.mjs
@@ -39,6 +39,10 @@
 //     by check-run-pins.test.mjs (the step and its 11.5.1 floor value must be present), which the
 //     same floor.yml `node --test` run collects — so the guarantee is whole, but it is NOT this
 //     program's doing. Named so the split is visible.
+//   • R7 — CONTINUATION IS BACKSLASH-ONLY. Trailing `\\` joins the next physical line before
+//     parsing (first line number kept for findings). A `run: |` block without `\\` is still one
+//     shell line per YAML line — correct. Heredocs, quotes spanning lines, and other multi-line
+//     shell forms are not reconstructed.
 //   • R6 — SYMLINK ASYMMETRY, INHERITED. A symlink under .github/workflows/ is reported as
 //     `unreadable-file`, but a symlinked .github/actions/**/action.yml is skipped SILENTLY by the
 //     walk. check-action-pins.mjs behaves identically (verified against the same fixture), so this
@@ -341,6 +345,25 @@ function parseLine(raw) {
   return { out, exempt };
 }
 
+
+// Join shell continuation lines (trailing `\\`) into logical lines. The first physical line number
+// is preserved for findings — a continued `npm install \\` / `pkg@latest` pair reports line 1.
+function joinContinuations(lines) {
+  const logical = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = i + 1;
+    let text = lines[i];
+    i += 1;
+    while (text.trimEnd().endsWith("\\") && i < lines.length) {
+      text = `${text.trimEnd().slice(0, -1)} ${lines[i].trimStart()}`;
+      i += 1;
+    }
+    logical.push({ text, line });
+  }
+  return logical;
+}
+
 function main() {
   const target = process.argv[2] || process.cwd();
   const { found, unreadable } = collectFiles(target);
@@ -365,14 +388,14 @@ function main() {
       continue;
     }
 
-    lines.forEach((raw, i) => {
-      const { out, exempt } = parseLine(raw);
+    for (const { text, line } of joinContinuations(lines)) {
+      const { out, exempt } = parseLine(text);
       skipped += exempt;
       for (const { reason, ref } of out) {
         checked += 1;
-        if (reason !== null) violations.push({ file: rel, line: i + 1, ref, reason });
+        if (reason !== null) violations.push({ file: rel, line, ref, reason });
       }
-    });
+    }
   }
 
   emit(
diff --git a/.dev/floor/check-run-pins.test.mjs b/.dev/floor/check-run-pins.test.mjs
index f5ad329..3e3b561 100644
--- a/.dev/floor/check-run-pins.test.mjs
+++ b/.dev/floor/check-run-pins.test.mjs
@@ -243,6 +243,25 @@ test("a run: | block scalar body is scanned with no scope tracking (every line i
   assert.deepEqual(refs(r), ["deep@latest"]);
 });
 
+test("shell continuation lines (trailing \\) are joined — package args on the next line classify", () => {
+  const r = run(repoWith("      - run: npm install \\\n          pkg@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["pkg@latest"]);
+  assert.equal(json(r).violations[0].line, 5); // first physical line of the continued command
+});
+
+test("a continued exact pin conforms", () => {
+  const r = run(repoWith("      - run: npm install -g \\\n          npm@11.5.1"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1);
+});
+
+test("continuation inside a run: | block is joined before parsing", () => {
+  const r = run(repoWith("      - run: |\n          npm i -g \\\n              deep@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["deep@latest"]);
+});
+
 // ---------------------------------------------------------------------------
 // Deterministic exclusions — and the fail-OPEN holes they must NOT create
 
@@ -323,7 +342,7 @@ test("a symlinked action.yml is currently skipped silently — asymmetry pinned,
   const sibling = run(root, SIBLING);
   assert.equal(mine.status, 0);
   assert.deepEqual(json(mine), { checked: 0, skipped: 0, files: [], violations: [] });
-  assert.equal(sibling.status, json(sibling).violations.length > 0 ? 1 : 0);
+  assert.equal(sibling.status, 0);
   assert.deepEqual(json(mine).violations, json(sibling).violations, "the two gates must agree on symlink handling");
 });