EPBDS-16211 make the plan tell the truth: 121 corrections

.github/workflows/ci.yml

@@ -270,13 +270,17 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # `--legacy-peer-deps` is deliberate, not carelessness: an installed package still declares a
+      # `--legacy-peer-deps` is deliberate, not carelessness: installed packages still declare a
       # `react ^16.8.0 || ^17.0.0 || ^18.0.0` peer, so npm would abort this install with ERESOLVE.
-      #   1. react-final-form 6.5.9 (19-ready line is 7.0.1 — §9.7-F4)
-      # There were TWO. `semantic-ui-react` was the other, and §9.7-F1 step 3½ removed it — which is
-      # the whole point of that step: the dependency ENTRY is what caps a host's React, not the
-      # bundled code (§2.6-11). One cap left, and it is a tracked upgrade. The flag overrides the
-      # peer check for this throwaway install only and never touches what we declare to consumers.
+      #   1. react-final-form       6.5.9 (19-ready line is 7.0.1 — §9.7-F4)
+      #   2. react-final-form-arrays 3.1.4 (19-ready line is 5.0.0 — same §9.7-F4 bump)
+      # There were THREE. `semantic-ui-react` was the third, and §9.7-F1 step 3½ removed it — which
+      # is the whole point of that step: the dependency ENTRY is what caps a host's React, not the
+      # bundled code (§2.6-11). Corrected 2026-09-17: this comment used to say "One cap left" and
+      # list only react-final-form. It was wrong — `react-final-form-arrays` is a direct dependency
+      # carrying the identical cap, so the flag is needed for it too, and the §9.7-F4 bump has to
+      # move both packages together. The flag overrides the peer check for this throwaway install
+      # only and never touches what we declare to consumers.
       # `--no-save` leaves package.json alone.
       - name: Install React 19 over the lock
         run: npm install --no-save --legacy-peer-deps react@19 react-dom@19