docs(state): record S12, EasyHDR and github-stats done and homebrew-taps blocked

[edbfi]

Records S12, the Native tier. EasyHDR and github-stats are rolled out. homebrew-taps is blocked (B9) on a compositor crash that only the owner can resolve.

What changed

• STATE.md:
  • S12 is blocked: B9 (homebrew-taps); EasyHDR and github-stats done;
  • the EasyHDR and github-stats rows are live;
  • homebrew-taps' row references B9.
• DECISIONS.md: B9. On ubuntu-latest, Ubuntu noble's weston 13.0.0 (headless, pixman) segfaults during fcast-sender's Wayland window check, while the same check passes on ARM64.
• templates/ci-rust.yml: synced to EasyHDR's proven workflow; the template is effectively EasyHDR's. Only the template's placeholder cron differs. It adds:
  • core.autocrlf false, because Git for Windows checks out CRLF and the line-ending hooks expect the committed LF bytes;
  • a reg add for the HKCU …\CurrentVersion\Run key, which some runner VMs lack and the autostart tests open;
  • libfontconfig1-dev for Slint's font stack in deny's cargo check;
  • the sequential Windows tests job (the row's explicit test list, plus doctests), required in ci-ok;
  • 30-minute timeouts.
• design/ci.md: ci-A2 records that ubuntu-latest moves to 26.04 between 2026-10-19 and 2026-11-19, and the ARM64 label must follow [V, 2026-10-09].

Evidence

Repo	Rollout PR → merge (rule suite)	Push CI	Dependabot
github-stats	#31 → d901e88 (pass), on master	green	#32 auto-merged
EasyHDR	#175 → 7c876eb (pass)	green: checks, Windows tests, smoke, deny	#177, #178 auto-merged (pass, push green). #176 and #179 are red and held (see Owner actions)
homebrew-taps	#40 open	formulae (ubuntu-latest) red: the weston segfault, in run 37870300691 and run 37867532705	—

In both rolled-out repos:

• settings were re-read after applying them;
• the D21 ruleset was verified, and classic protection returns 404;
• every rule suite is pass;
• immortality.yml was dispatched (success);
• security updates went on after the merge;
• the workflow token is read, without PR approval [V, 2026-10-09].

homebrew-taps got no settings, ruleset or auto-merge workflow. The fredtv build fix (openssl-sys pointed at openssl@3) works on both architectures. prek run --all-files --hook-stage manual passes locally.

Deviations

• EasyHDR:
  • The reg add step works around a product defect: AutoStartManager::enable opens the Run key instead of creating it.
  • A first theory, --test-threads=1, was wrong, and Pullfrog caught it; the commit was reverted.
  • The separate fuzz/Cargo.lock stays separate. Codex's P2 about it is REJECTED as an owner decision, and #179 now shows the predicted drift.
• homebrew-taps: the ruleset will be admin-only until the D16 deploy key exists (settings-A1 stays open).
• Cron minutes: EasyHDR 38, github-stats 44, homebrew-taps 50 (prepared).

Codex review (gpt-6-astra, high)

• S12 plan and the repo diff reviews are recorded in each repo PR:
  • EasyHDR: one P2 REJECTED as an owner decision (fuzz lockfile); delta reviews had no findings.
  • homebrew-taps: two P2s fixed (deleted-dependency selection, reinstall from source).
  • github-stats: no findings.
• This PR's diff review on d4384b2: no findings. The read-only template tests, privileged-jobs, actionlint, zizmor and doc_guard pass, and the 26.04 dates match runner-images#14748. Its sandbox had no GitHub access; the Evidence table holds the live results.

Review

• Pullfrog on d4384b2 (review), two info notes on the tests job:
  • "drop 'The old CI's list'": REJECTED. The template mirrors EasyHDR's live ci.yml byte for byte apart from the cron; any rewording goes into both, EasyHDR first.
  • "the explicit list overlaps the generic cargo-test hook; reg add only in checks": REJECTED, with no change needed. EasyHDR's own hook runs cargo test --locked --lib, so checks covers the lib tests, where the autostart tests and therefore reg add belong, and tests covers the integration targets. None of those six targets references autostart.

Owner actions

• B9: pick the fix for the weston 13 segfault in homebrew-taps' Wayland check: another compositor or renderer, a newer weston, or an explicit x86_64 exception. Then re-run docs(state): finish S19, the homebrew-taps updater and the #3 reconciliation #40 and finish its sequence.
• homebrew-taps:
  • Create the write deploy key (D16).
  • Decide whether to delete the unused vendored scripts/vendor/gh-workflow-immortality.sh.
  • Before about 2026-10-19, plan the ubuntu-26.04-arm label (ci-A2).
• EasyHDR:
  • #176 (Rust 1.99) fails on new clippy lints: src/config/models.rs:1112, and the unfulfilled #[expect(clippy::float_cmp)] in tests/memory_usage_test.rs.
  • #179 needs fuzz/Cargo.lock updated; or make fuzz/ a workspace member.
  • AutoStartManager::enable should create the Run key (create_subkey).
• Grouped security updates in EasyHDR and github-stats.

[pullfrog]

ℹ️ No critical issues — two minor suggestions on the new tests job.

Reviewed changes

Reviewed the full PR (2 commits) against main. doc_guard is silent and tools/test_templates.py passes; the STATE.md aggregates, the Last updated stamp and the B9 cross-references agree with the new rows.

• STATE.md: S12 is blocked on B9 with EasyHDR and github-stats rows live; homebrew-taps' row points at B9.
• DECISIONS.md: adds blocker B9 (weston 13 segfault on ubuntu-latest).
• design/ci.md: ci-A2 records the ubuntu-latest 26.04 move and the ARM64 label that must follow.
• templates/ci-rust.yml: carries EasyHDR's Windows fixes (core.autocrlf false, reg add Run key, libfontconfig1-dev, 30-minute timeouts) and adds a sequential Windows tests job required in ci-ok.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}