chore(repository): audit tmp-should-not-create lineage before any deletion

[seonghobae]

Problem

tmp-should-not-create is a stale no-PR branch that must not remain a misleading writer surface, but deleting it without proving preservation of every unique delta would destroy evidence. The original SHA-only cleanup premise was therefore unsafe.

Fresh exact state — 2026-08-16

• protected main: a634066feb6ace12da2f305fe0e2691a15240997;
• frozen branch: e68e0a4bb319cd52c52b6641ae5f1fdd3312811b;
• merge base: 9adb784902cae19a150146a8fadd6a0491f67814;
• branch vs merge base: 21 commits ahead, exactly 10 changed paths;
• branch vs current main: diverged, 21 commits behind the branch side / 419 current-main commits on the other side.

No force-push, reset, merge, retarget, branch reuse, or opportunistic cherry-pick is allowed.

Complete path classification

The 10-path historical delta has now been classified against current protected truth using exact blobs/diffs and current behavior rather than branch titles:

1. AGENTS.md — preserved on current protected lineage; the historical branch content is not needed as a separate authority.
2. docs/doctoring/nanoid-cve-2026-67213.md — preserved on protected lineage; current package security evidence additionally advances the same transitive node beyond the historical remediation.
3. scripts/lib/main-governance-audit.mjs — preserved on protected lineage.
4. test/ci-exact-head-contract.test.ts — preserved on protected lineage.
5. test/main-governance-audit.test.ts — preserved on protected lineage.
6. .github/workflows/ci.yml — semantically superseded by current protected CI, which retains exact-head/toolchain verification and adds stronger current-live-base, lockfile-change and fail-closed controls.
7. .github/workflows/reviewer-ci.yml — semantically superseded by current protected reviewer workflow with the same required reviewer coverage/docstring/security intent plus newer immutable action/runtime controls.
8. test/workflow-readiness.test.ts — semantically superseded by current protected tests. In particular, protected truth now requires delegated Maintainer App capability-file ingress and rejects direct Maintainer App GH_TOKEN step use on the commercial-maintenance path, which is stricter than the historical branch contract.
9. CHANGELOG.md — historical unique entry recorded the bounded nanoid 3.3.16→3.3.17 remediation. Current protected CHANGELOG preserves that security lineage and now records the later bounded 3.3.17→3.3.18 remediation plus current package-manager evidence.
10. package-lock.json — historical patch changed only node_modules/nanoid version/resolved/integrity from 3.3.16 to 3.3.17. Current protected lockfile changes that same single node to 3.3.18, with current schema-v3 lockfile-change evidence and unchanged top-level metadata digest. The historical 3.3.17 bytes are therefore superseded, not uniquely required.

No still-required unique product/security/governance behavior remains solely on tmp-should-not-create.

Deletion boundary

The semantic preservation audit is complete. Remote-ref deletion is now the only remaining repository cleanup action, but it must use a supported non-force ref-deletion operation with an exact pre-delete ref check. The currently available GitHub mutation surface in this invocation exposes file deletion but not branch/ref deletion, so the branch is intentionally left frozen rather than emulating deletion with a force update.

Before deletion:

1. refetch main and tmp-should-not-create;
2. require the branch head to remain exactly e68e0a4bb319cd52c52b6641ae5f1fdd3312811b;
3. verify no open PR or active writer has adopted the branch;
4. delete the exact remote ref through a supported ref-deletion API;
5. verify the ref returns not-found;
6. only then close this issue.

Issue closure without observed ref absence is not deletion evidence.

Related: #27, #77, #79, #90, #91

[seonghobae]

Fresh lineage revalidation, without mutating the branch:

• protected main: db4f444c1b1849ec615364a233469870c23407e6;
• frozen branch head: unchanged e68e0a4bb319cd52c52b6641ae5f1fdd3312811b;
• exact compare is now diverged, 21 commits ahead / 102 commits behind, merge base 9adb784902cae19a150146a8fadd6a0491f67814;
• the net historical delta still spans the same ten workflow/package/governance/test paths recorded in the issue.

The growing behind_by count further rejects merge/reuse/reset as a safe remedy, but does not prove the 21 unique commits are byte-redundant. Deletion remains prohibited until each unique commit/path is classified against current protected truth and surviving clean successors. No branch ref or file was changed.

[seonghobae]

Fresh lineage audit against protected main baf2f666e147d5c54a7486efb3fe9b227584cb06 and frozen tmp-should-not-create head e68e0a4bb319cd52c52b6641ae5f1fdd3312811b: the branch remains diverged at 21 ahead / 417 behind with merge base 9adb784902cae19a150146a8fadd6a0491f67814, so deletion is still non-authorizing. One path is now classified with exact byte evidence: scripts/lib/main-governance-audit.mjs is blob 3529ec11acbb22747ec1cb5e9307dd211f12d2b2 on both the frozen branch and current protected main. That path's historical branch semantics are therefore already preserved byte-for-byte and need no successor repair. The remaining mixed workflow/package/docs/test paths are not inferred redundant from this result; keep the branch frozen until each remaining path is similarly classified or intentionally superseded with exact evidence.

[seonghobae]

Lineage audit advanced with three additional exact blob classifications against protected main baf2f666e147d5c54a7486efb3fe9b227584cb06 and frozen head e68e0a4bb319cd52c52b6641ae5f1fdd3312811b. The following historical branch paths are now proven preserved byte-for-byte on current protected main: docs/doctoring/nanoid-cve-2026-67213.md = blob 31014eea7a4e9227dfdcacf0187c9447fefaa0eb; test/ci-exact-head-contract.test.ts = blob 85c1bed6096363d58db1c18d2ae68cbaf2f84ecb; test/main-governance-audit.test.ts = blob 33334687933dc6936b2614da004f43eef9828ee9. Together with the previously classified scripts/lib/main-governance-audit.mjs blob 3529ec11acbb22747ec1cb5e9307dd211f12d2b2, four of the ten historical delta paths no longer require preservation work. test/workflow-readiness.test.ts is explicitly NOT byte-identical (0d79a1c... on the frozen branch versus d6961f6... on current main), so no redundancy inference is made for it. Keep the branch frozen; next audit should classify the remaining workflows, AGENTS/CHANGELOG, package-lock, and workflow-readiness semantics before any deletion decision.

[seonghobae]

Fresh lineage audit against protected main a634066feb6ace12da2f305fe0e2691a15240997 and frozen tmp-should-not-create e68e0a4bb319cd52c52b6641ae5f1fdd3312811b now reports 21 ahead / 419 behind, merge base 9adb784902cae19a150146a8fadd6a0491f67814.

One remaining divergent control-plane path is now classified more narrowly: .github/workflows/ci.yml is not byte-equivalent (main blob 755fde583a2f4c282c37285b9a2f22f7c7e468cf; frozen branch blob 5c66f4c822c471c65519c164a33a805e44fb8b84). The frozen branch version lacks the current protected-main checkout fetch-depth: 0 setting, so copying/merging that historical workflow wholesale would regress the present exact-checkout/base-materialization contract. This path therefore cannot justify merging or reusing the frozen branch as-is; any genuinely unique historical semantics still need path-level comparison against current protected truth before branch deletion.

No branch ref was moved, deleted, reset, merged, or cherry-picked.

[seonghobae]

Fresh deletion preflight on 2026-09-03: remote branch tmp-should-not-create still exists at the previously audited exact head e68e0a4bb319cd52c52b6641ae5f1fdd3312811b, remains unprotected, and a fresh open-PR search for head:tmp-should-not-create returns zero results. The preservation audit in this issue therefore remains applicable and no new writer/PR has adopted the lane. The currently exposed repository mutation surface still provides non-force ref movement but not exact remote-ref deletion; moving the branch elsewhere would be a force-like substitute and is intentionally not used. Keep the branch frozen and this issue open until a supported DELETE-ref operation is available, then refetch the exact head immediately before deletion and verify the ref becomes not-found.