fix(triage,mirror): address #1324 review findings on D304, D332, and #1234 convergence script

.github/workflows/actions.lock

@@ -109,7 +109,7 @@ workflows:
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     '.github/workflows/mirror.yml':
-        - 'hyperpolymath/standards@d55304a01b5260b0511aae0d14ed8b8770b00293'
+        - 'hyperpolymath/standards@70019048f862250c04346f27e6ca196ff7aa187a'
     '.github/workflows/no-js-scan.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/pages-archive.yml':
@@ -264,6 +264,15 @@ dependencies:
         commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
+    'hyperpolymath/standards@70019048f862250c04346f27e6ca196ff7aa187a':
+        ref: '70019048f862250c04346f27e6ca196ff7aa187a'
+        commit: 'sha1-70019048f862250c04346f27e6ca196ff7aa187a'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     'hyperpolymath/standards@d55304a01b5260b0511aae0d14ed8b8770b00293':
         ref: 'd55304a01b5260b0511aae0d14ed8b8770b00293'
         commit: 'sha1-d55304a01b5260b0511aae0d14ed8b8770b00293'
@@ -274,7 +283,6 @@ dependencies:
             - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
             - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406'
             - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
-            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     'ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7':
         ref: 'v3.9.0'
         commit: 'sha1-93303b622b2522e4411e295f9e77411a24912ac7'

.github/workflows/mirror-reusable.yml

@@ -14,13 +14,14 @@
 # `vars.<FORGE>_MIRROR_ENABLED == 'true'`, so forge selection is
 # configured per-repo via Actions vars — no per-call inputs required.
 #
-# Callers pass the per-forge SSH keys EXPLICITLY, by the names declared in
-# `workflow_call.secrets` below (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY,
-# CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY, DISROOT_SSH_KEY, GITEA_SSH_KEY,
-# RADICLE_KEY). Do not use `secrets: inherit`: it forwards every repo/org
-# secret the caller can see, not just these seven (standards#1108 §6b).
-# Without a passed secret, `${{ secrets.X }}` inside the reusable
-# evaluates to empty and that forge's job no-ops.
+# Callers pass the per-forge SSH keys and optional R2 backup secrets
+# EXPLICITLY, by the names declared in `workflow_call.secrets` below
+# (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY, CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY,
+# DISROOT_SSH_KEY, GITEA_SSH_KEY, RADICLE_KEY, R2_ACCESS_KEY_ID,
+# R2_SECRET_ACCESS_KEY, R2_AGE_RECIPIENT). Do not use `secrets: inherit`:
+# it forwards every repo/org secret the caller can see, not just these ten
+# (standards#1108 §6b). Without a passed secret, `${{ secrets.X }}` inside
+# the reusable evaluates to empty and that forge's job no-ops.
 #
 # Caller example (wrapper):
 #   # SPDX-License-Identifier: MPL-2.0
@@ -42,6 +43,9 @@
 #         DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
 #         GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
 #         RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
+#         R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+#         R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+#         R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }}
 
 name: Mirror to Git Forges (reusable)
 
@@ -453,6 +457,7 @@ jobs:
   mirror-r2-bundle:
     # D303/D304: Cloudflare R2 git-bundle backup with mandatory client-side
     # age encryption before any bytes leave the runner.
+    name: Mirror encrypted bundle to Cloudflare R2
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.R2_BUNDLE_MIRROR_ENABLED == 'true'
@@ -474,9 +479,9 @@ jobs:
         run: |
           set -euo pipefail
           if [[ ! "$R2_ENDPOINT" =~ ^https://[a-zA-Z0-9-]+(\.eu|\.fedramp|\.us)?\.r2\.cloudflarestorage\.com$ ]] ||
-             [[ ! "$R2_BUCKET" =~ ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ ]] ||
+             [[ ! "$R2_BUCKET" =~ ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$ ]] ||
              [[ ! "$AGE_RECIPIENT" =~ ^(age1[a-z0-9]{58}|ssh-ed25519[[:space:]]+AAAA[A-Za-z0-9+/=]+)$ ]]; then
-            echo "::error::Configure valid R2_ENDPOINT_URL (*.r2.cloudflarestorage.com), R2_BUCKET, and R2_AGE_RECIPIENT (age1... or ssh-ed25519)"
+            echo "::error::Configure valid R2_ENDPOINT_URL (*.r2.cloudflarestorage.com), R2_BUCKET (lowercase alphanumeric and hyphens), and R2_AGE_RECIPIENT (age1... or ssh-ed25519)"
             exit 1
           fi
       - name: Create, age-encrypt, and upload git bundle to Cloudflare R2
@@ -490,8 +495,13 @@ jobs:
           AGE_RECIPIENT: ${{ env.R2_RECIPIENT }}
           MIRROR_ORG: ${{ vars.R2_ORG || vars.MIRROR_ORG || github.repository_owner }}
           REPO_NAME: ${{ github.event.repository.name }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
+          if [[ ! "$COMMIT_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::Invalid COMMIT_SHA"
+            exit 1
+          fi
           if ! command -v age >/dev/null 2>&1; then
             sudo apt-get update -qq && sudo apt-get install -y -qq age
           fi
@@ -503,7 +513,11 @@ jobs:
           age -r "$AGE_RECIPIENT" -o "$ENC_BUNDLE" "$RAW_BUNDLE"
           rm -f "$RAW_BUNDLE"
           test -s "$ENC_BUNDLE"
-          aws s3 cp "$ENC_BUNDLE" "s3://${R2_BUCKET}/${MIRROR_ORG}/${REPO_NAME}/latest.bundle.age" --endpoint-url "$R2_ENDPOINT"
+          BUNDLE_TS="$(date -u +%Y%m%dT%H%M%SZ)-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          SNAPSHOT_KEY="s3://${R2_BUCKET}/${MIRROR_ORG}/${REPO_NAME}/snapshots/${BUNDLE_TS}-${COMMIT_SHA}.bundle.age"
+          LATEST_KEY="s3://${R2_BUCKET}/${MIRROR_ORG}/${REPO_NAME}/latest.bundle.age"
+          aws s3 cp "$ENC_BUNDLE" "$SNAPSHOT_KEY" --endpoint-url "$R2_ENDPOINT"
+          aws s3 cp "$ENC_BUNDLE" "$LATEST_KEY" --endpoint-url "$R2_ENDPOINT"
       - name: Skipped (R2 credentials or age recipient not configured)
         if: ${{ env.R2_KEY_ID == '' || env.R2_SECRET_KEY == '' || env.R2_RECIPIENT == '' }}
         run: |

.github/workflows/mirror.yml

@@ -14,8 +14,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d55304a01b5260b0511aae0d14ed8b8770b00293
-    # Exactly the seven optional secrets the callee declares at the
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@70019048f862250c04346f27e6ca196ff7aa187a
+    # Exactly the ten optional secrets the callee declares at the
     # pinned SHA (verified declared ⊇ referenced). Was `secrets:
     # inherit`, which forwarded every repo/org secret (standards#1108
     # §6b; the old convention is tracked in #943).
@@ -27,3 +27,6 @@ jobs:
       DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
       GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
       RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }}

docs/MIRROR-HOST-VERIFICATION.adoc

@@ -40,11 +40,30 @@ Per owner rulings D303 and D304 (`standards#1234`), `mirror-reusable.yml` also
 provides an optional `mirror-r2-bundle` job gated on
 `vars.R2_BUNDLE_MIRROR_ENABLED == 'true'`. When enabled and provisioned with
 `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_ENDPOINT_URL`
-(`https://<account>.r2.cloudflarestorage.com`), `R2_BUCKET`, and
-`R2_AGE_RECIPIENT` (`age1...` or `ssh-ed25519`), the runner creates a full
+(`https://<account>[.eu|.fedramp|.us].r2.cloudflarestorage.com`), `R2_BUCKET`,
+and `R2_AGE_RECIPIENT` (`age1...` or `ssh-ed25519`), the runner creates a full
 `git bundle`, verifies it, encrypts it client-side with `age -r`, removes the
 plaintext bundle, and uploads only the `.bundle.age` ciphertext to Cloudflare
-R2.
+R2 under both an immutable `snapshots/<timestamp>-<sha>.bundle.age` object key
+and `latest.bundle.age`.
+
+Callers must pass the R2 credentials explicitly in the `secrets:` block because
+GitHub Actions does not forward caller secrets to a reusable workflow
+automatically. Without these mappings, `mirror-r2-bundle` skips the upload and
+emits a notice. Map `R2_AGE_RECIPIENT` under `secrets:` when the recipient is
+stored as a secret; when stored as an Actions variable (`vars.R2_AGE_RECIPIENT`),
+the reusable workflow reads it directly from `vars` without a secret mapping:
+
+[source,yaml]
+----
+jobs:
+  mirror:
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@<sha>
+    secrets:
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }}
+----
 
 `scripts/tests/science-ci-security-test.sh` launches the assertions in
 `scripts/tests/science-ci-security-test.rb`, which exercise every actual SSH

docs/reorg/2026-10-14-tidy/ISSUE-1234-CLOSEOUT-REPORT.adoc

@@ -28,7 +28,7 @@
 | *B / D332*
 | `.github/settings.yml` vs `check-settings-drift.sh` (`2026-10-14` comment 2)
 | *Ruled & Scripted (`95` active repos)*
-| Ruled: *"Uninstall the Probot Settings app, then delete `.github/settings.yml` across the estate."* Full 95-repo census (64 `hyperpolymath`, 31 `metadatastician`) recorded below and automated in `scripts/triage-2026-10-23-issue-1234-apply.sh` (checks that app `1561` installation `145157322` is uninstalled before deleting `.github/settings.yml`).
+| Ruled: *"Uninstall the Probot Settings app, then delete `.github/settings.yml` across the estate."* Full 95-repo census (65 `hyperpolymath`, 30 `metadatastician`) recorded below and automated in `scripts/triage-2026-10-23-issue-1234-apply.sh` (checks that app `1561` installation `145157322` is uninstalled before opening `.github/settings.yml` deletion PRs across all 95 repositories).
 
 | *A1 (D16)*
 | Remove ruleset bypass for apps `1561`, `946600`, `85455`
@@ -694,14 +694,14 @@ All 24 repositories carrying `.github/workflows/cflite_*.yml` or `.github/workfl
 | *TRANSFER the 42 `*.jl` package repos to `metadatastician` in one wave* + 1 atomic PR to `julia-professional-registry`; *KEEP `julia-professional-registry` in `hyperpolymath`*
 
 | *Tier 4: Multi-Ecosystem / Registry-Published Flagships (`crates.io` / `hex.pm` / `npmjs.com` / Submodule Hubs)*
-| `22`
-| `affinescript`, `ambientops`, `anamnesis`, `blocky-writer`, `boj-server`, `boj-server-mk2`, `bunsenite`, `chapeliser`, `deed-core`, `developer-ecosystem`, `echidna`, `excel-economic-numbers-tool`, `git-scripts`, `gitbot-fleet`, `iseriser`, `jtv-lang`, `k9-ecosystem`, `nextgen-databases`, `odds-and-sods-package-manager`, `palimpsest-license`, `patallm-gallery`, `proven`, `repo-guardian`, `rrecord-verity`, `volumod` (note: `standards` is in Tier 2; `22` distinct non-Tier-2 repos)
+| `25`
+| `affinescript`, `ambientops`, `anamnesis`, `blocky-writer`, `boj-server`, `boj-server-mk2`, `bunsenite`, `chapeliser`, `deed-core`, `developer-ecosystem`, `echidna`, `excel-economic-numbers-tool`, `git-scripts`, `gitbot-fleet`, `iseriser`, `jtv-lang`, `k9-ecosystem`, `nextgen-databases`, `odds-and-sods-package-manager`, `palimpsest-license`, `patallm-gallery`, `proven`, `repo-guardian`, `rrecord-verity`, `volumod` (`25` distinct non-Tier-2 repos)
 | *Medium package-metadata cost:* `12` repos reference `crates.io/crates/*`, `7` reference `hex.pm/packages/*`, `8` reference `npmjs.com/package/*`, `affinescript` is referenced by `affinescript-verify.yml`, and `jtv-lang` hosts `ViperPkg` (`subdir = "viper-pkg"` in `julia-professional-registry`). GitHub maintains permanent HTTP/Git redirects on repo transfer so existing `cargo`/`hex`/`npm` installs continue working as long as the old `hyperpolymath/<repo>` name is never reused, and `Cargo.toml`/`mix.exs`/`package.json` `repository` URLs update on the next patch release.
 | *DEFER to Wave 2* (transfer per-flagship alongside next release bump, updating `Cargo.toml`/`mix.exs`/`package.json` and `affinescript-verify.yml`)
 
 | *Tier 5: Standalone Active Repositories (Zero External Registry URLs, Zero Estate CI Callers)*
-| `274`
-| All remaining 274 active public `hyperpolymath` repositories (0 archived, 0 forks, 0 `julia-professional-registry` entries, 0 `crates.io`/`hex.pm`/`npmjs.com` publications, 0 incoming `uses:` or `repository:` references from `standards` workflows)
+| `271`
+| All remaining 271 active public `hyperpolymath` repositories (0 archived, 0 forks, 0 `julia-professional-registry` entries, 0 `crates.io`/`hex.pm`/`npmjs.com` publications, 0 incoming `uses:` or `repository:` references from `standards` workflows)
 | *Low cost:* GitHub automatically redirects Git remotes and web URLs; org-level rulesets on `metadatastician` (`Branch-Floor`, `Tag-Floor`, `Require-Signed-Commits`, `Require-Linear-History`, `Secret-Scan-Floor`, `Lock-Floor`, `EstateBranching`, `EstateTagging`) immediately cover transferred repos without per-repo ruleset maintenance. Only per-repo cost is updating `README.adoc` / `CITATION.cff` / `.well-known` self-links via a post-transfer script (`docs/compliance/repo-transfer-to-enterprise-playbook.adoc`).
 | *READY TO TRANSFER in batched waves* (after A5 / D298 reverts `metadatastician` `Branch-Floor` and `Tag-Floor` to canon)
 |===
@@ -714,7 +714,7 @@ All 24 repositories carrying `.github/workflows/cflite_*.yml` or `.github/workfl
 
 | *D355* (A4 / D97 follow-up)
 | Repository transfer wave plan (`hyperpolymath` -> `metadatastician`)
-| **(1) Keep Tier 0 (3 identity repos), Tier 1 (`cargo-zigbuild`, `MetaManifold-WebUI`; delete `explore` per D329), Tier 2 (12 CI/CD spine repos + `julia-professional-registry`), and the 3 private vaults/farm in `hyperpolymath`; (2) Transfer Tier 3 (42 `*.jl` package repos) to `metadatastician` with one atomic `Package.toml` URL PR in `julia-professional-registry` (per ADR-0003); (3) Transfer Tier 5 (274 zero-consumer active repos) in batches of 25 after D298 is applied; (4) Hold Tier 4 (22 registry-published flagships) for per-release transfer.**
+| **(1) Keep Tier 0 (3 identity repos), Tier 1 (`cargo-zigbuild`, `MetaManifold-WebUI`; delete `explore` per D329), Tier 2 (12 CI/CD spine repos + `julia-professional-registry`), and the 3 private vaults/farm in `hyperpolymath`; (2) Transfer Tier 3 (42 `*.jl` package repos) to `metadatastician` with one atomic `Package.toml` URL PR in `julia-professional-registry` (per ADR-0003); (3) Transfer Tier 5 (271 zero-consumer active repos) in batches of 25 after D298 is applied; (4) Hold Tier 4 (25 registry-published flagships) for per-release transfer.**
 | Transfer Tier 3 (`42` `*.jl` repos) only for now / Transfer Tier 3 + Tier 4 + Tier 5 / Freeze all transfers
 |===
 
@@ -923,10 +923,10 @@ ____
 *Ruling D332 (`2026-10-14` comment 2 on `#1234`):* *"Uninstall the Probot Settings app, then delete `.github/settings.yml` across the estate."*
 
 * **Owner Prerequisite:** Uninstall GitHub App `settings` (`app_id: 1561`, installation `145157322` at `https://github.com/settings/installations/145157322`).
-* **Estate Census (95 active repositories carrying `.github/settings.yml`):**
-** **`hyperpolymath` (64 repos):** `007`, `ambientops`, `apiserver`, `arthropodologist`, `asdf-overlay-manager`, `audit-my-cloud`, `awesome-lifecycle`, `betlang`, `bunsenite`, `bust`, `cable-audit`, `chapeliser`, `chrono-mcp`, `cicd-hyper-a`, `civic-connect`, `claude-config-vault`, `clippy-cornucopia`, `conative-gating`, `conflow`, `con-sensual`, `CryptographicAudit.jl`, `developer-ecosystem`, `dicti0nary-attack`, `docmatrix`, `echidnabot`, `ensaid-concatenator`, `ensaid- fleet`, `EntryPoint.jl`, `ephapax`, `error-catalog-mcp`, `exotic-programming-ideas`, `ExplicitlyTyped.jl`, `family-ops`, `feedback-o-tron`, `FireFlag.jl`, `flat-mate`, `formatrix-docs`, `git-private-farm-dashboard`, `git-reticulator`, `grim-repo`, `guix-overlay-pack`, `heterogenous-mobile-computing`, `hypatia`, `i-human`, `ipv6-only`, `iseriser`, `januskey`, `jtv-lang`, `julia-ecosystem`, `line-em-up`, `lithoglyph`, `local-coord-mcp`, `MarkovChains.jl`, `meta-repo-manager`, `minix-sdk`, `model-check-mcp`, `mustfile`, `my-lang`, `nesy-solver`, `network-ambulance`, `neurophone`, `nexia-list`, `nextgen-databases`, `nextgen-languages`.
-** **`metadatastician` (31 repos):** `_pathroot`, `affinescript-libraries`, `apate`, `arango-arango`, `burble`, `chora`, `data-prep`, `deliberation`, `design-practice`, `epistemic-logic`, `ergo`, `eval-harness`, `evidence-graph`, `floating-point-arithmetic`, `formal-methods`, `git-forensics`, `governance-audit`, `graph-analytics`, `information-retrieval`, `kcq`, `knot-knot`, `knowledge-representation`, `language-design`, `marid`, `meta-analysis`, `metadatastician-governance`, `methodology`, `model-checking`, `odraz`, `ontology-engineering`, `probabilistic-programming`.
-* Automated deletion (gated on verifying app `1561` is uninstalled) is in `scripts/triage-2026-10-23-issue-1234-apply.sh` (Section D332).
+* **Estate Census (95 active repositories in `hyperpolymath` and `metadatastician` carrying `.github/settings.yml` on `HEAD`):**
+** **`hyperpolymath` (65 repos):** `.github`, `affinescript-vite`, `anytype`, `Apodeixis.jl`, `atoma`, `autoformal-fidelity`, `bactrian`, `bofj-kitt`, `boj-server`, `cafescripto`, `cargo-zigbuild`, `cicd-squabbler`, `contractiles`, `CoprocessorRuntime.jl`, `czech-file-knife`, `dictask`, `echidna`, `ephapax`, `EpistemicTypes.jl`, `fraying-model-computational-testbed`, `haec`, `hermeneia`, `heron-polyfeed-reader`, `ideas-to-alphas`, `jaffascript`, `kategoria`, `kitchenspeak`, `krl`, `lithoglyph`, `llm-grace`, `lucidscript`, `natsci-studio`, `nesy-solver`, `nextgen-typing`, `occupancy-types`, `panoply`, `patch-bridge`, `proof-burrower`, `Protoctist.jl`, `proven`, `pseudoscript`, `quintessence`, `rattlescript`, `reasonably-good-token-vault`, `recon-silly-ation`, `ResidualEvidenceTypes.jl`, `resource-algebra`, `rsr-template-repo`, `scaffoldia`, `secret-types`, `sholes`, `snifs`, `somethings-fishy`, `stateful-artefacts`, `system-et`, `trigger`, `trope-checker`, `typed-wasm`, `unified-api-adapter`, `vocarium`, `xmlpull-zig`, `zig-boringtls`, `zig-dnssec`, `zig-icu-collation`, `zig-unorm`.
+** **`metadatastician` (30 repos):** `_pathroot`, `affinescript-libraries`, `berrywiki`, `bowtie-workbench`, `burble`, `cadastra`, `cerro-torre`, `cleave`, `consent-aware-web`, `first-post`, `gossamer`, `groove`, `hvn-dehallucinator`, `IDApTIK`, `knot-knot`, `kyq`, `lintel`, `marid`, `metadatastician-governance`, `odraz`, `paint-type`, `rokur`, `selur`, `sim-public-relations`, `spline`, `stapeln`, `svalinn`, `vordr`, `ZenodoDeposits.jl`, `ZeroInflatedCounts.jl`.
+* Automated deletion PR creation across all 95 repositories (gated on verifying app `1561` is uninstalled) is in `scripts/triage-2026-10-23-issue-1234-apply.sh` (Section D332).
 
 '''
 
@@ -1040,6 +1040,6 @@ Per `docs/reorg/2026-10-14-tidy/README.adoc` and `#1234` **A4 (D97)**, the conso
 
 | *D355*
 | Repository transfer wave plan (A4 / D97 follow-up)
-| **(1) Keep Tier 0 (3 identity repos), Tier 1 (forks; delete `explore` per D329), Tier 2 (12 CI/CD spine repos + `julia-professional-registry`), and 3 private vaults/farm in `hyperpolymath`; (2) Transfer Tier 3 (42 `*.jl` package repos) to `metadatastician` with 1 atomic `Package.toml` PR in `julia-professional-registry`; (3) Transfer Tier 5 (274 zero-consumer active repos) in batches of 25 after D298 is applied; (4) Hold Tier 4 (22 registry-published flagships) for per-release transfer.**
+| **(1) Keep Tier 0 (3 identity repos), Tier 1 (forks; delete `explore` per D329), Tier 2 (12 CI/CD spine repos + `julia-professional-registry`), and 3 private vaults/farm in `hyperpolymath`; (2) Transfer Tier 3 (42 `*.jl` package repos) to `metadatastician` with 1 atomic `Package.toml` PR in `julia-professional-registry`; (3) Transfer Tier 5 (271 zero-consumer active repos) in batches of 25 after D298 is applied; (4) Hold Tier 4 (25 registry-published flagships) for per-release transfer.**
 | Transfer Tier 3 (`42` `*.jl` repos) only / Freeze all transfers
 |===