[felixfelix-bot]

Supersedes #1089. Same commits, rebased onto current main.

Why #1089's diff was inflated

#1089 merged main into a stale branch (and earlier resolve attempts were squash-merged into it). A squash moves the merge-base forward without making main an ancestor, so GitHub's merge-base..head window silently widened to include unrelated main history:

• resolve: merge main into #1000 (keep the module-count fix; it is this PR's purpose) #1089 showed 64 files, +2557/-211
• the actual change is 3 files changed, 7 insertions(+), 3 deletions(-)
• this rebuild: 1 commits off current main, main is a direct ancestor, no merge commits

This is the change: the module-count correction (16->18) and its backticked-form fence.

Method

git cherry-pick -x of only the branch's own commits onto current main. Merge commits, squash residue and stale-branch content are not carried. Where a picked commit was already fully present in main (e.g. an older go-pin bump later superseded by main's own), it was skipped as empty rather than force-applied — the resulting diff is the change that is still not in main, nothing more.

Verification

• cd src && go build ./... → rc 0
• 0 conflict markers
• cred-gate pre-commit hook clean, no --no-verify

Merge note

No merge commits here, so squash-merging is fine — unlike the earlier resolve PRs, there is no ancestry for a squash to destroy.

[Amperstrand]

Local CI gate — PR #1111: docs+contract: module-count claims 16->18, and fence the backticked form \u2014 scoped rebuild of #1089

Run of scripts/pr-verify.sh (the local CI gate: GitHub Actions is
org-blocked and the ngit lane fires only on maintainer mirror pushes,
so a PR ref gets no CI runs — this comment is the offline verification
evidence, produced on the pinned head SHA).

• Head: pr/rebuild-1000 @ 43559188f1
• Base: main @ 960dc10ee8
• Gate: pr-verify 6f304ed0e72d on ai-legion, started 2026-10-31 23:17 UTC, wall 488s
• Logs: /tmp/tollgate-pr-verify/1111-20261031T230933Z (on the verifying host)
• Retrospective stamp: PR merged 2026-10-25T12:33:46Z without a pre-merge gate run; this verification targets the merged PR head SHA, posted as backlog evidence (campaign frontier: every merged PR down to the campaign start gets a stamp)

Leg	Result	Detail
hygiene	PASS	no conflict markers in the tracked tree (0s)
contract-fences	FAIL	red: dependency sync — see contract-fences.log; 12 checks green; 1 skipped (absent from tree: entry-UI marker path fence) (4s)
packaging-sequential	PASS	14 suites (7s)
shell-suites	FAIL	red (1/20): ngit-ci-trigger_test.sh — logs in /tmp/tollgate-pr-verify/1111-20261031T230933Z/shell-suites (49s)
packaging-concurrent	PASS	14 suites, all at once (3s)
go-battery	PASS	18 modules, gofmt/vet/build/-race (425s)

Verdict: 2 leg(s) RED — 4 green.

What this gate does not run (no vacuous green)

• spec-quote drift check (greatspectations tool + pinned nuts fetch)
• reproducibility / conformance lanes (make release-check territory)
• router-visible behaviour (PRTA / bench — unit green ≠ router works)

Note: the ngit trigger suite red carries the nak key public
nsec-arg signature — the portability break the NGIT_TRUST
generalization fixed. Trees predating that change reproduce it
on this seat; it is environmental, not PR-caused.

failing-leg log tails

contract-fences — tail

   root: v0.48.0
   tollgate-cvm: v0.31.0
   tollgate_protocol: v0.48.0
   tollwallet: v0.48.0
   upstream_detector: v0.48.0
   upstream_session_manager: v0.48.0
   valve: v0.48.0
   wireless_gateway_manager: v0.48.0

Fix: update all go.mod files to the same version.
     Run 'go mod tidy' in each sub-module after updating.
== gonuts pin fence (offline identity)
ok   an aligned tree (block + single-line carriers) passes
ok   a block-form carrier on a different version
ok   a single-line carrier left behind (the token-recovery shape)
ok   a go.sum that never recorded the truth version (half-update)
ok   a self-consistent pseudo-version integration pin passes OFFLINE (the --latest leg is the release gate for it)
ok   a manifest without the .gonuts key
ok   a tree whose manifest names a pin no carrier has

7 cases, 0 failed
== gonuts pin carriers
  manifest pin (packaging/build-inputs.json .gonuts.version): v0.13.0
  carriers discovered by glob: 5 module(s)
✅ one pin, everywhere: github.com/OpenTollGate/gonuts-tollgate v0.13.0 across 5 carrier(s).
== mirror/relay sync
ok    BLOSSOM_SERVERS: 13 copies identical (https://blossom.primal.net https://blossom.psbt.me https://blossom2.orangesync.tech)
ok    relay list: 13 copies identical (wss://relay.damus.io wss://nos.lol wss://nostr.mom wss://relay2.orangesync.tech)
== stale import paths
✅ All 302 Go source files use correct import paths.

shell-suites — tail

--- ngit-ci-trigger_test.sh.log
ok   - refuses a workflow file that is absent from the worktree
ok   - refuses a workflow that is not present at the declared commit
ok   - refuses a signing key that is not the maintainer key
ok   - never prints the private key on refusal
ok   - refuses a key file with no nsec in it
invalid hex key: '0nsec1n8q09wev3hwlpyh64rfud6p4nlwwzerhgm48rcxpacjka3xlnw9qfc5hds' is not valid hex: encoding/hex: invalid byte: U+006E 'n'
ok   - prints the sha256 of the file's content at the declared commit
FAIL - fails loudly when every relay refuses the event
       rc=1 out=workflow : .ngit/act/workflows/fake.yml
commit   : e86c6bd5bae83dbe476d527c3dd3ec518b6689f3
sha256   : 0a2be7daf3741ba278eca69d6d25755580a1f4223c3c808b5e7e4d621e953544
ERROR: /tmp/tmp.RbnA6yxsZv/wrong.key is not the maintainer key (signer ..., expected 9cd14d9acdbab7ca...)
ok   - never prints the private key on the happy path

8 passed, 1 failed