[InauguralPhysicist]

Closes #1942.

Evidence (the Codex Cloud draft's report, reviewed):

Result

The nightly.yml valgrind-full job now invokes the same local composite
action as both Valgrind lanes in ci.yml. The two environment variables that
no committed caller set were removed rather than preserving an unrepeatable
test interface.

Old/new input inventory and differential

The old nightly step consumed these states: Valgrind already present; present
but not runnable; the initial install succeeding or installing an unrunnable
binary; refresh/install attempt 1, 2, or 3 succeeding or installing an
unrunnable binary; and all four installs failing. I modeled all eleven states
from the two shell control flows and ran the model for both implementations.
The old and shared implementations agree on outcome, install count, and update
count in every state:

input	result	installs / updates
preinstalled	success	0 / 0
preinstalled, unrunnable	verification failure	0 / 0
initial install succeeds	success	1 / 0
initial install is unrunnable	verification failure	1 / 0
refreshed install 1, 2, or 3 succeeds	success	2, 3, or 4 / 1, 2, or 3
refreshed install 1, 2, or 3 is unrunnable	verification failure	2, 3, or 4 / 1, 2, or 3
every install fails	SETUP FAILURE	4 / 3

The comparison did find the already-reported command-level disagreement. The
old nightly copy installed only valgrind, refreshed the image's configured
sources, and did not retain packages. The shared implementation installs
valgrind libc6-dbg with --no-install-recommends, refreshes explicit Ubuntu
sources, and retains the archives. The shared answer is correct: its comment
records why Noble needs libc6-dbg for Memcheck startup, and the composite
action deliberately owns restoration and publication of its archive cache.
Selecting it also makes nightly exercise exactly the implementation exercised
by the PR lanes instead of silently preserving the known divergence.

The differential was run with:

python3 - <<'PY'


...
PY

It printed diff=none for every row above and printed the command disagreement
separately. Static checks also show that the diagnostic now has one owner and
the dead environment knobs have none:

$ rg -n 'valgrind not in the current index' .github tools
tools/install_valgrind.sh:82:  echo "::warning::valgrind not in the current index; refreshing (attempt $attempt)"
$ rg -n 'VALGRIND_APT_(FIRST_)?OPTIONS' .

Gate plant

After a green workflow check, I outdented the new uses key by two spaces.
bash tools/workflow_yaml_check.sh returned 1 with workflow-yaml: FAIL and a
YAML block-collection parse error. Restoring the workflow returned the same
command to workflow-yaml: OK; bash tools/ci_tier_check.sh was green before
and after the plant.

Checks

• bash tools/workflow_yaml_check.sh: green (workflow-yaml: OK, 9 files).
• bash tools/ci_tier_check.sh: green, including its own self-test.
• bash tools/precheck.sh: 15 checks passed, three binary-dependent checks
  skipped because no EigenScript binary was built, and the changelog check
  could not run because this shallow checkout has no origin remote or
  merge-base. The applicable workflow and CI-tier checks passed within it.
• git diff --check: green.

Hosted nightly

🤖 Generated with Claude Code

https://claude.ai/code/session_01KC99CmwatKssQYggkBCgwF

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T19:24:37.057635Z	—	PR opened
🔒 Security Review	✅ Completed 2026-10-24T19:25:24.132502Z	cbc0d1b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

✅ 13 untouched benchmarks

---

_{Comparing nightly-valgrind-shared-1942 (cbc0d1b) with main (8316aeb)}