One semantic conflict on the `all-checks-passed` verdict job. Master moved
it to `ubuntu-latest`; this branch had routed it through the failover
selector so a hosted-pool outage could not leave the required verdict
queued. Master's resolution satisfies that requirement more directly:
standard hosted capacity is independent of both custom pools, so the
verdict is reachable whichever pool is degraded, and the selector is no
longer needed. Kept `ubuntu-latest` and folded the failover reasoning
into its comment.
The failover runbook accordingly documents three failover jobs (the three
required Linux workers), not four, and states why the verdict stays on
standard hosted capacity in both states.
config.sh only registers; the runner stays offline until svc.sh
install/start. Both language sides updated so emergency capacity
actually comes online.
- serial-linux-selfhosted checks out fetch-depth 0: depth 2 misses
github.event.before on multi-commit or force pushes, failing the
archive verifier on a valid tree. Full fetch is cheap against the
VM's local mirror.
- Runbook (both languages): every remaining admin phrasing (problem
statement, switch heading, alternatives, consequences) now says
writer; and the 'composes with this mechanism' claim about a
master-ref-pinned runner group is replaced with the truth observed
live on 2026-07-27 — master-ref pinning blocks PR failover, and the
shipped posture is repository-scoped all-workflow group access.
Static gate green locally: 32 passed, 0 failed.
The standby lane itself is push-only, but under failover pull_request
jobs do reach these runners with the PR merge ref's workflow. The
workflow comment and the larger-runner note (both languages) now state
that plainly and name the actual boundary — repository membership
(private, forking disabled, Dependabot excluded) — matching the
runbook. Static gate green locally: 32 passed, 0 failed.
- Sweep every remaining 'admin-only' claim (workflow comments, runbook
lines 13/40, topology note, all zh pairs): the variable is
writer-manageable, and the boundary against untrusted code is
repository membership (private, forking disabled, Dependabot
excluded) — stated identically at every site instead of only in the
'who can flip' paragraph.
- Serial cross-platform reference note (both languages): master now
runs four references — the three hosted OS legs plus the self-hosted
standby drill, linked to the failover runbook.
Static gate green locally: 32 passed, 0 failed.
Tianyi Cui
Chinesezjc
07akioni
Turtle
imccyu
Yichen Jiang
kingwl
NI0317