backlog: file #1330 -- PR 487's resolver conflict is a judgment merge whose obvious resolution re-arms a fixed defect

[wshallwshall]

Filed under a live 5-hour rung, because it cannot be finished in the remaining window and the analysis behind it would otherwise die with this session.

Why #487 is not a mechanical merge

It conflicts with main in five files, all in the bash-interpreter resolver area #505 rewrote. An adversarial per-file pass — one classifier per file, each handed to a skeptic told to refute it — found that some of #487's assertions were written against the old interpreter selection order.

#505 reversed that order for cause: bin/bash.exe is the MSYSTEM=MINGW64 wrapper and rewrites PATH so /mingw64/bin outranks anything a caller prepends. So resolving toward #487 re-arms the exact defect #505 fixed, rather than merely duplicating work.

The blast radius is every test that PATH-stubs a binary Git ships in mingw64/bin — measured: curl, git, openssl shipped; gh, jq, python not. That asymmetry is why #505's release-age rows failed while its gh-stub rows passed, and why it read as flakiness for hours.

What the item carries so nobody re-derives it

• the pointer to the per-file verdicts and their refutations
• that b1 lane (PARTIAL, not a supersession of #432): interpreter proof, ASVS payload types, auth+store, doc-lane gates #487's CI is ~15 hours stale, with all three failures already explained — the gitleaks one is a 23-minute window that closed itself when fix(redact): the log redactor emitted the token it claimed to redact (item 1183) #491 merged needles and allowlist together
• two smaller stranded pieces: #1321's banner flip (handed over after #1322 landed first via tls: first-party contexts inherited an unasserted suite list (#1317), repair main's census tests, file #1319 and #1322 #525) and two ASVS re-scores whose item numbers nobody can derive, because no cell-to-item map exists and the tracker correctly refused to invent one. One of those is pass to PARTIAL — a re-open, not a closure.

One process note

This was first committed from a scratch worktree and the ledger gate correctly refused it: #1330 is allocated to lander-5c09c3, and the gate compares the committing path to the allocation record. The push succeeded while the commit failed, briefly publishing a branch byte-identical to main — an empty branch advertising work that was not there.

Re-done with the documented escape, git switch -c <new> origin/main from the allocating worktree. I had explained that mechanism to three other seats today before needing it myself.