[88plug]

Most bot PRs (#315, #318, #320, #321, #322, #324, #325, #326) were red because the bumper's golden substitution left test files at the old pin, or because a test hardcoded a value a bump moves. This PR fixes the substitution rule and the per-site gaps. No historical record, ledger row, bench result or README history row changes, and no held pin moves.

Root cause

hack/pinlib/goldens.py live_pairs dropped every old pin string that any scanned file outside tests/ still contained. Leftover prose was enough to block a pair:

• k3s v1.37.1-k3s1: kept by a docstring example in hack/pinver.py and a note in integrations/eas/pins.json, so the 13 audit goldens never moved (chore(k3s): k3s v1.37.2-k3s1 #322).
• compute-runtime 26.35.39758.10: kept by a test input in oracle/test_oracle.py (chore(host-intel): compute-runtime 26.40.40196.8, level-zero 1.35.0, linux-tools 7.3.3 #320).
• The Hugging Face revisions in the model optimizer fixtures: kept by bench arm scripts (chore(hf-console-fallback): hf-gemma4-26b-int4-ov 7b3cbc98e24a9946e561f82c752ae26cd53fc660, hf-qwen3.8-27b 8c0b3d30f3ae96f5c7f774de704bf0ada83e422a, hf-qwen3.8-27b-int4-ov d15f4d91eccd11dd44f615ffdb539c61bf1f1e6e #318).

tests/bump_test.sh reproduces the failure: four new checks fail on the old goldens.py and pass on the new one.

The new rule (hack/pinlib/goldens.py, documented in pins/README.md)

A test keeps an old string only in these three cases:

• A live site holds it. Another pin's site outside tests/ still holds the string, for example two images at one digest. This check reads the registry's sites, not raw text.
• The test reads a record that holds it. The test names, by repo path, a kept record that still holds the string. A kept record is a file no bumper writes, .md aside. tests/bench_test.sh checking bench/apb/h7x.sh's pinned digest stays protected.
• It is a bare version in test code. The string is a version or tag on its own, and the test is a .py/.sh/#! script. There it is as likely an input (pinlib_test, policy_test, pinver_test) as an expectation. In recorded files (goldens, fixtures) bare versions move.

Digests and revisions also move when cut to 12 hex digits, the form plans and audits print.

Per-site fixes

• tests/audit_test.sh: reads the k3s tag from the Dockerfile. Its fake future versions are now ones no upstream will publish (v9.9.9-k3s1, cuda 99.9.9); 13.5.0 was the real cuda release in chore(cuda-test): cuda-test-image 13.5.0 #315.
• tests/bench_vs_test.sh: reads each stack's image from bench/competitors.lock (chore(images): image:images:ollama/ollama:0.40.13 0.40.15, image:images:busybox:1.37 1.38 #321).
• tests/host_setup_test.sh: reads compute-runtime, IGC, level-zero and the NPU archive from the launcher, as it already did for the PPA builds (chore(host-intel): compute-runtime 26.40.40196.8, level-zero 1.35.0, linux-tools 7.3.3 #320).
• tests/chat_ui_test.sh: reads the Open WebUI version from the manifest and the digest from images.lock. tests/detect_test.sh: checks the agent-sandbox images against SANDBOX_VERSION. The k3d-gpu-sandbox EAS fixture names the controller by tag, like its sibling fixtures (chore(opt-in-manifests): open-webui v0.13.0, agent-sandbox v1.0.10 #324).
• New hf-meta hook on group hf-console-fallback: re-reads each moved repo's record in tests/fixtures/hf at the new revision, using console/model_opt.py's own repo_record (chore(hf-console-fallback): hf-gemma4-26b-int4-ov 7b3cbc98e24a9946e561f82c752ae26cd53fc660, hf-qwen3.8-27b 8c0b3d30f3ae96f5c7f774de704bf0ada83e422a, hf-qwen3.8-27b-int4-ov d15f4d91eccd11dd44f615ffdb539c61bf1f1e6e #318, the chore(hf-console-fallback): hf-gemma4-26b-int4-ov 7b3cbc98e24a9946e561f82c752ae26cd53fc660, hf-qwen3.8-27b 8c0b3d30f3ae96f5c7f774de704bf0ada83e422a, hf-qwen3.8-27b-int4-ov d15f4d91eccd11dd44f615ffdb539c61bf1f1e6e #299 class).
• pins/registry.toml: derives the launcher's vver= for vllm-xpu (chore(vllm-xpu): vllm-xpu v0.33.0 #326), and for llm-scaler and gaudi-vllm, which had the same gap. tests/pins_test.py now fails when a canary package constant has no registry site.
• packaging/check.sh: rpm -K --nosignature and rpm -i --nosignature. RPM 6.1 in Fedora 45 rejects an unsigned package on both (digests SIGNATURES NOT OK, does not verify: no signature). Checked in fedora:45 and fedora:44, and a corrupted payload still fails the digest check (chore(packaging-images): packaging-fedora 45, image:packaging-images:debian:trixie-slim trixie-slim, image:packaging-images:ghcr.io/homebrew/brew:7.0.11 7.0.12 #325).

Verification

• This PR's CI: 82 of 82 checks green at the head.
• Local runs: every test command in ci.yml ran locally, 150 in all with the sim-matrix and agent-examples matrices expanded. That was 11 full runs: this head, plus one tree per open bot group. Each group tree was built by running hack/bump <group> with this bumper against live upstreams and committing the result.
• Failures: in every run, the only failures were suites that depend on timing or on what else runs on the machine. Under 16 parallel jobs these were oracle/test_adversarial.py (its 10 s Ctrl-C wait), tests/wildct_hold_test.sh, bench/admission/test_run.sh, and once tests/eas_test.sh, whose argv sampler reads ps -eo args and saw another tree's run. All of them passed when rerun alone in the same tree.
• Before and after: the same full run on each group's bump from the old bumper reproduced each bot PR's failure. These were audit_test (chore(cuda-test): cuda-test-image 13.5.0 #315, chore(k3s): k3s v1.37.2-k3s1 #322), host_setup_test (chore(host-intel): compute-runtime 26.40.40196.8, level-zero 1.35.0, linux-tools 7.3.3 #320), bench_vs_test (chore(images): image:images:ollama/ollama:0.40.13 0.40.15, image:images:busybox:1.37 1.38 #321), audit_test/chat_ui_test/detect_test/eas_test (chore(opt-in-manifests): open-webui v0.13.0, agent-sandbox v1.0.10 #324), packaging/check.sh nfpm (chore(packaging-images): packaging-fedora 45, image:packaging-images:debian:trixie-slim trixie-slim, image:packaging-images:ghcr.io/homebrew/brew:7.0.11 7.0.12 #325), canary_spec_test (chore(vllm-xpu): vllm-xpu v0.33.0 #326) and model_opt_test (chore(hf-console-fallback): hf-gemma4-26b-int4-ov 7b3cbc98e24a9946e561f82c752ae26cd53fc660, hf-qwen3.8-27b 8c0b3d30f3ae96f5c7f774de704bf0ada83e422a, hf-qwen3.8-27b-int4-ov d15f4d91eccd11dd44f615ffdb539c61bf1f1e6e #318). All of them pass after the fix.
• Lint: shellcheck v0.11.0 (severity warning) on the changed scripts, actionlint 1.7.12 and pyflakes are clean. hadolint, arch-image and pkgbuild-lint ran in CI only; this PR touches no Dockerfile or PKGBUILD.

After merge

The open bot PR branches were cut by the old bumper, so they stay red until the next Freshness run regenerates them on this main. Policy verdicts are unchanged: review-labelled bumps still need a human approval and their canaries.