Refresh pre-browser-rbe open PRs under the required proof gate

[Jesssullivan]

Problem

browser-rbe-proof is now required on main branch protection, and same-repo PRs now dispatch a real GloriousFlywheel REAPI browser proof when GF_REAPI_PROOF_ENABLED=true.

Existing open PRs created before .github/workflows/browser-rbe-proof.yml landed mostly do not contain that workflow file on their head branch. They will remain blocked by branch protection until each branch is refreshed/rebased onto current main, or closed if obsolete.

Current read-only inventory

Already rechecked with a real post-enablement proof:

• docs(ux): personas + power-tool lens model (Phase 0 design epic) #349: has browser-rbe-proof; rerun after enablement passed via GF child proof https://github.com/tinyland-inc/GloriousFlywheel/actions/runs/26723904845.

Open PR heads missing .github/workflows/browser-rbe-proof.yml at the time of inventory:

• chore(deps): bump actions/upload-artifact from 4 to 7 #313 dependabot/github_actions/main/actions/upload-artifact-7
• feat(openaq): expose PM2.5 payload metadata #309 feat/openaq-field-ui
• chore(deps): bump the minor-and-patch group across 1 directory with 10 updates #203 dependabot/npm_and_yarn/main/minor-and-patch-567876298d
• build(deps-dev): bump prettier-plugin-svelte from 3.5.2 to 4.0.1 #96 dependabot/npm_and_yarn/main/prettier-plugin-svelte-4.0.1
• chore(deps): bump marocchino/sticky-pull-request-comment from 2 to 3 #94 dependabot/github_actions/main/marocchino/sticky-pull-request-comment-3
• chore(deps): bump opentofu/setup-opentofu from 1 to 2 #93 dependabot/github_actions/main/opentofu/setup-opentofu-2
• build(deps): bump actions/attest-build-provenance from 2 to 4 #91 dependabot/github_actions/main/actions/attest-build-provenance-4
• feat(ci): [TIN-1398] bump to ci-templates@v1.1.0 + complete M3 (lane-env trigger + ci.yml wrapper) #86 feat/m3-completion-v1.1

Definition of done

• Each still-relevant open PR is refreshed onto current main so the browser proof workflow exists on the head branch and runs as a required check.
• Obsolete/stale PRs are closed with a short reason.
• No local tests, builds, checks, browser runs, or branch switches are used; use remote GitHub/GF surfaces only.

[Jesssullivan]

Linear: https://linear.app/tinyland/issue/TIN-1772/refresh-pre-browser-rbe-darkmap-prs-under-required-proof-gate

[Jesssullivan]

Remote refresh attempt started.

Accepted by GitHub update-branch API:

• chore(deps): bump actions/upload-artifact from 4 to 7 #313
• chore(deps): bump the minor-and-patch group across 1 directory with 10 updates #203
• build(deps-dev): bump prettier-plugin-svelte from 3.5.2 to 4.0.1 #96
• chore(deps): bump marocchino/sticky-pull-request-comment from 2 to 3 #94
• chore(deps): bump opentofu/setup-opentofu from 1 to 2 #93
• build(deps): bump actions/attest-build-provenance from 2 to 4 #91

Returned merge-conflict responses from GitHub and cannot be mechanically refreshed:

• feat(openaq): expose PM2.5 payload metadata #309
• feat(ci): [TIN-1398] bump to ci-templates@v1.1.0 + complete M3 (lane-env trigger + ci.yml wrapper) #86

No local branch switches, tests, builds, checks, or browser runs were used.

[Jesssullivan]

Remote-only checkpoint after serialized proof reruns.

Refreshed by GitHub update-branch and now clean under required checks:

• chore(deps): bump actions/upload-artifact from 4 to 7 #313
• chore(deps): bump the minor-and-patch group across 1 directory with 10 updates #203
• build(deps-dev): bump prettier-plugin-svelte from 3.5.2 to 4.0.1 #96
• chore(deps): bump marocchino/sticky-pull-request-comment from 2 to 3 #94
• chore(deps): bump opentofu/setup-opentofu from 1 to 2 #93
• build(deps): bump actions/attest-build-provenance from 2 to 4 #91

Each now reports mergeStateStatus=CLEAN with required checks green: browser-rbe-proof, secrets-scan, build-and-test, and bazel-graph.

Also verified:

• docs(ux): personas + power-tool lens model (Phase 0 design epic) #349 already carried the workflow and was re-proved after GF_REAPI_PROOF_ENABLED=true; it is also CLEAN with required checks green.
• feat(ci): [TIN-1398] bump to ci-templates@v1.1.0 + complete M3 (lane-env trigger + ci.yml wrapper) #86 was closed as obsolete: it was an old ci-templates v1.1 wrapper branch superseded by the current v2 lane-env / browser RBE proof posture.

Remaining work:

• feat(openaq): expose PM2.5 payload metadata #309 cannot be mechanically refreshed. GitHub update-branch returns merge conflicts, and the branch still contains unique OpenAQ payload metadata work (numericCount, nullCount, reading flags, parameter metadata). This needs a real conflict-resolution branch/worktree, not a blind update.

Operational note:

• The initial burst exposed a GloriousFlywheel child-run correlation/concurrency bug in the shared proof action. Tracked upstream as flywheel-reapi-proof resolves the wrong GF child run under concurrent dispatch tinyland-inc/ci-templates#45 and Linear TIN-1777. Workaround used here was serialized browser-rbe-proof reruns.

No local branch switches, tests, builds, checks, or browser runs were used.

[Jesssullivan]

TIN-1777 follow-up is now implemented as upstream PRs:

• fix(rbe): expose proof request id in GF workflow tinyland-inc/GloriousFlywheel#858 adds request_id to gf-reapi-cell-proof.yml, includes it in the run name, and stores it in proof-result evidence.
• fix(flywheel): correlate REAPI proof runs by request id tinyland-inc/ci-templates#46 makes flywheel-reapi-proof generate/pass that request id and resolve the child run by displayTitle instead of timestamp/latest-run selection.

This does not close #350 by itself; #309 still needs real conflict resolution or replacement. It removes the proof-action concurrency hazard exposed by the serialized reruns once both upstream PRs land.

Local validation completed in temp checkouts; no darkmap local tests/builds/browser runs were used.

[Jesssullivan]

Upstream request-id correlation is now implemented and released.\n\n- tinyland-inc/GloriousFlywheel#858 merged first, adding request_id support to gf-reapi-cell-proof and proof-result artifacts.\n- tinyland-inc/ci-templates#46 merged second, making flywheel-reapi-proof resolve the child run by request_id in displayTitle instead of timestamp-only latest-run selection.\n- tinyland-inc/ci-templates#47 cut v2.1.0; floating @v2 now points at v2.1.0, so this repo's browser-rbe-proof workflow using flywheel-reapi-proof@v2 picks up the fix without a darkmap workflow edit.\n\nNote: the ci-templates release workflow run is red because it pushed immutable v2.1.0 then rejected the floating v2 update on a stale tag lease; I completed the documented manual fallback by moving only the floating v2 tag and publishing the v2.1.0 release.