fix(ci): the v1.139 review's findings — injectable dispatch input, two gates that stop measuring, a machine-dependent verdict (#458)

[avrabe]

Verify-Filter: (= id "FV-RELAY-EVIDENCE-001")

Triage of the v1.139 release-candidate review (#458). Refs #458, #459.

Fixed here (4 real findings)

#	finding	why it matters
1	soak.yml interpolated ${{ github.event.inputs.gz_max_s }} into a run: block	Actions expands ${{ }} before bash sees the text, so a dispatch-capable actor could end the assignment and run commands with the job's environment. The repo's own convention — stated in fleet-status.yml, followed by release.yml — is to bind inputs through env:.
2	the analytic soak tier lost its rungs to -e	Same trap as the gz ladder: the bench exits 1 on a FAIL verdict, so OUT=$(...) ended the step before the FAIL=1; continue arm could walk the remaining durations. A red step with no measurement — for a job whose entire purpose is to publish a number.
3	check-evidence.rs read the tool's own environment to decide whether a $VAR was an unfilled placeholder	The census disagreed with itself across machines: $WITNESS refused on a laptop, accepted on any runner exporting that name. Now it resolves only what the step assigns itself plus gate-supplied names. Verified identical output with and without WITNESS exported.
4	three nits, all real	the two relay_ scanners disagreed on an identifier boundary (my_relay_foo → phantom relay-foo root); setup-gh cached under $RUNNER_TEMP, which Actions empties at both ends of every job, so gh was re-downloaded twice per fleet tick; release.yml's --generate-notes fallback could not fire.

On that last one I did not simply delete the dead branch: that would leave a silent no-op if the notes body were ever empty. It now fails loudly, which is what the dead branch was pretending to guarantee.

Dismissed (3 phantoms, all caused by how I sliced the candidate)

The review PRs carry only part of the tree, so the reviewer correctly reported what it could see and drew conclusions that do not hold on main:

• "read_battery_v → Option<f32> breaks two impls and a call site" (REVIEW SLICE 2/2 — v1.139 substantive flight-path changes. DO NOT MERGE #459). On main both impls already return Option<f32>; they were excluded from the slice because their diffs are under 50 lines.
• "three gate scripts are never invoked" (REVIEW SLICE 1/2 — v1.139 gate tooling + CI workflows. DO NOT MERGE #458). They are cited in rivet artifact steps (FV-FALCON-CLAIMS-001/003/004, FV-RELAY-EVIDENCE-001, FV-FALCON-WASMEQ-002) — the slice excluded artifacts/.
• "check-component-claims.rs exits 1 for six of eight components; capability-reachability.rs exits 2 on a missing doc". Measured on main: all three exit 0. The slice lacked the very wasm/cm/*/Cargo.toml rewrites and docs/CAPABILITY-REACHABILITY.md that make them pass.

Lesson recorded: a partial slice invites confident findings about files it cannot see. Any future split needs the slice's own PR body to say so, or to be closed under the changes it references.

Still open from the review, deliberately not fixed here

#459's second finding is real and is NOT addressed by this PR: if read_battery_v starts returning None mid-flight, batt_state freezes at its last healthy snapshot and the low-battery failsafe can never fire — batt_present is only consulted at arm time. That is the same "absence is not health" defect #413 was about, on the in-flight side. It needs its own artifact and a failing test first, and a maintainer decision on whether it lands in v1.139 or v1.140.

All seven gate scripts' own test suites pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG