wave 2: eight backlog lanes as one integration train (15 items close)

.github/required-contexts.txt

@@ -91,6 +91,14 @@ cla
 #
 # The quoting in backlog-hygiene.yml is load-bearing: the job name contains " #", which YAML would
 # truncate at the comment marker, and the job NAME is the context string.
+#
+# THIS CONTEXT STRING NOW UNDER-DESCRIBES ITS JOB, deliberately. Since BACKLOG #1095 the job also runs
+# the diff-scoped CITATION gate: every backlog number a PR adds beside a ledger path must name the
+# file that item actually lives in. It rides this context rather than taking its own because a new
+# context would be UNREQUIRED and therefore decoration -- the promotion note above is that reasoning
+# -- and because renaming a job to describe both checks CHANGES the context string, which is the
+# required-but-absent trap and would wedge every PR. The name is frozen; what the job covers is
+# documented in backlog-hygiene.yml's header and here.
 a PR that implements BACKLOG #N must update BACKLOG.md
 
 # (Historical note, kept because it is the reasoning that made the promotion safe: it triggers on

.github/workflows/backlog-hygiene.yml

@@ -15,6 +15,14 @@
 #     implement a backlog item (`BACKLOG #N` in its title or body) and touches engine/IDE code, then
 #     it must also update `docs/BACKLOG.md`. That is the step whose omission caused #60.
 #
+# THE JOB BELOW NOW RUNS TWO CHECKS, and its `name:` describes only the first. That is deliberate and
+# must stay: the name is the branch-protection CONTEXT STRING, so renaming it makes the required
+# context stop reporting and wedges every PR (see .github/required-contexts.txt). The second check is
+# the CITATION gate (BACKLOG #1095) — every backlog number this PR adds beside a ledger path must
+# name the file that item actually lives in. It rides this job rather than a new one for the same
+# reason: an unrequired context is decoration, since auto-merge blocks only on required ones, and
+# adding one to branch protection is not an in-repo change.
+#
 # Read-only. No secrets. Workflow expressions are hoisted into `env` and never interpolated into a
 # `run:` body (zizmor: a PR title/body is attacker-controlled on a fork PR and must arrive as data).
 name: backlog-hygiene
@@ -110,3 +118,25 @@ jobs:
           item body — then drop the 'BACKLOG #$n' token from this PR's title/body.
           EOF
           exit 1
+
+      # BACKLOG #1095. Retiring an item MOVES it verbatim from docs/BACKLOG.md into
+      # docs/archive/backlog/, and every citation that named the live file keeps pointing at a file
+      # the item is no longer in. No link checker can see this: docs/BACKLOG.md resolves perfectly,
+      # and only the human-readable number beside it is stale.
+      #
+      # DIFF-SCOPED, and that is the design rather than a convenience. PR #271 declined a gate partly
+      # because "a gate that fails on a legitimate archive is one people delete"; with pre-existing
+      # violations a corpus-wide gate is red on day one and gets suppressed. --base/--head restricts
+      # findings to lines THIS PR added, so it can only be red about something the PR wrote. Run the
+      # script with neither flag for the repo-wide report, which is a measurement, not a merge gate.
+      #
+      # No setup-python: the checker and the parse_items module it imports are stdlib-only, so the
+      # runner's preinstalled python3 is enough and the job stays a checkout plus two scripts.
+      - name: Every backlog citation this PR adds must name the file its item lives in
+        env:
+          # Hoisted, never interpolated into the script body (zizmor: template injection).
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          python3 scripts/docs/backlog_citation_check.py --base "$BASE_SHA" --head "$HEAD_SHA"

.github/workflows/security.yml

@@ -19,12 +19,15 @@ name: Security
 # it scans on the same run as the other gates rather than relying on native push protection.
 # See docs/SECURITY.md.
 #
-# NO push-to-main trigger (dropped for CI cost): every push to main is an auto-merged PR whose head
-# was JUST scanned by the pull_request run of this same workflow, so the post-merge re-scan re-ran
-# identical scanners on identical content minutes later (~376 runs/month at ~8 billed min each).
-# The drift a push run could in principle catch (a CVE disclosed between the PR scan and the merge)
-# is exactly what the daily cron below exists for — caught within ~24h, the same bound as a CVE
-# against an unchanged main. On-demand full scans: workflow_dispatch.
+# THE TRIGGER SET IS THE `on:` BLOCK BELOW AND NOTHING ELSE. Each arm carries its own reason there,
+# so this header states none of them and must not start. A header paragraph that ALSO describes the
+# triggers is a second definition, free to drift from the first — and one did: for months a paragraph
+# here denied a trigger the `on:` block declared ten lines beneath it, at length and with costings.
+# It was DELETED rather than corrected, because correcting it would have left the second definition
+# in place to drift again. The cost of that drift is not to CI, which behaved as the `on:` block says;
+# it is that the rest of this header is load-bearing (the continue-on-error trap above), and a reader
+# who finds one paragraph of it demonstrably false has no way to tell which of the others still hold.
+# tests/test_security_posture.py refuses the return of a header claim that denies a declared trigger.
 on:
   pull_request:
   # Post-merge re-scan (main only). A fork PR is scanned STRUCTURAL-ONLY by design -- the secret is