fix(pins): recover the 2026-09-03 dirty tree and close its pin chain (#393)

[2233admin]

Recovers 40 files left uncommitted by a 2026-09-03 session, and closes the
pin chain they left open. DR-0013 forbids compiling on the host that owns the
original checkout, which is why this work sat untested for 27 days.

What the recovery found

The 2026-09-03 session did not merely forget to commit. It ran a stash, hit
conflicts, and left three internalization records carrying live
<<<<<<< Updated upstream / >>>>>>> Stashed changes markers. Those files
were not valid JSON, so ast_grep_internalization, internalization_record,
and declared_pins could not parse them. Nothing caught it because no host
could run the suite.

A second defect sat underneath: crates/code-intel-cli/src/snapshot.rs was
edited, and the same session touched orchestration/integrations.json
without updating the declared toolchain digest. capability_contract and
capability_exec both reported it stale.

Commits

• 4851812 — the 40 files as one reviewable recovery unit
• 5e40a14 — drop the three conflict-marker files, restore the last committed state
• b5dc807 — resync repository.snapshot-identity in integrations.json
• d410af5 — REPO_SNAPSHOT_DIGEST in capability_exec.rs was pinned to the pre-2026-09-03 snapshot.rs, so repo.snapshot failed closed with request implementation differs from declaration
• 1e79b85 — repin the 9 declared pins that d410af5 invalidated (it changed capability_exec.rs's own digest)

1e79b85 must be the last commit: the chain closes on itself, and the
internalization records are the last link.

Verification

cargo test --workspace --no-fail-fast → exit 0, 70 test targets, 0 failures
on 1e79b85, run on DESKTOP-AL7MNNO (Windows 11 Home, MSVC 14.44.35207,
Rust 1.95.0 per rust-toolchain.toml, ripgrep 14.1.0, ast-grep 0.42.3 —
the versions ci.yml installs).

Baseline for comparison: the same suite on the pre-recovery tree produced
32 failing targets. 35 of those failures were a single missing rg
binary, not code defects — walk.rs::governed_visible_files returns None
when ripgrep is absent, which silently disables the repository_ignored
gate instead of failing loudly. The rest were the conflict markers and the
stale pins above.

Notes for review

• Snapshot identity does not change. This is a recovery, not a fix.
• The #403 streaming-hash work is present but incomplete: snapshot.rs
  imports Sha256 and never uses it. hash_records still builds the second
  full-tree buffer. Worth a follow-up, not this PR.
• flash_ratchet.rs (DR-0012) is wired and its tests pass here. This also
  fixes the README 404 where docs/decisions/README.md listed DR-0012 as
  active while the record existed only in a dirty worktree.

Relates to #403, #393.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[repowise-bot]

🔍 1 thing to check

1. 5 files that usually change with this PR's files are not in it: crates/code-intel-cli/src/main.rs, crates/code-intel-cli/src/cli/command_catalog/mod.rs, crates/code-intel-cli/src/cli/command_catalog/tests.rs (+2 more)

✅ Health of changed files: 3.5 → 3.7 (+0.2)

---

📊 See the full report for this PR
_{Your repo map with this PR's blast radius lit up, every caller of the contracts it changes, and health before and after. No sign-in. · Plain markdown for agents · ⭐ Star Repowise · 📥 Install bot · Silence on a single PR with [skip repowise] in the title · Per-repo toggle on repowise.dev/settings/bot · Updated 2026-09-30 07:59 UTC}

[github-actions]

Code Intel change risk

Score	Percentile	Level
66/100	54th (vs last 41 commits)	🟢 low

Top signals

• Diff shape: 46 file(s), +2638/-909 (max file share 0.12)
• Test asymmetry: source changed, tests touched
• Bug-magnet: 223 fix commit(s) in touched files (180d)
• Churn: 570 commit(s) touching these files (90d)

_{revspec: origin/main..HEAD · threshold: score >= 80 blocks unless labeled risk-accepted; percentile is reported, not gated (#201) · code-intel change risk}