Merge remote-tracking branch 'origin/main' into HEAD

* origin/main: (40 commits)
  feat(pro): use built-in Rails i18n compiler for React Intl demo (#4128)
  Fix pr-merge-ledger UTF-8 crash under non-UTF-8 locale (#4123)
  Add canonical AI-agent prompts source (prompts.yml) (#4124)
  Local benchmark runner: raise server-boot timeout for slower machines (#4073) (#4125)
  Docs(generator): note Pro production devtool for source-mapped SSR stacks (#3893) (#4113)
  docs: add "Consuming an Unreleased Build" guide and fix pnpm git-subdir syntax (#4117)
  Address deferred AI-review feedback on PR-helper scripts (#4069) (#4105)
  Wrap generated demo file paths in onboarding page (Part 1 of #4062) (#4107)
  fix(ci): build bundle-size base from PR merge commit's first parent (#4110)
  Add internal RSC architecture deep-dive docs (RoR Pro vs Next.js) (#4006)
  Disable noisy automatic benchmark regression issue filing (#4071) (#4116)
  Release-train branching + phase-tiered merge gating (beta/RC/final) (#4018)
  Fix Webpack dependency selection in install generator (#4109)
  Document health-probe status-code contract and Control Plane probes (#4053) (#4063)
  Local dedicated-hardware benchmark runner (#4073) (#4088)
  docs(tooling): surface SVG diagram alt text in generated llms-full files (#4087)
  docs(agents): codify review-loop convergence + local/CI parity in PR-batch workflow (#4101)
  Split RenderFunction: drop the legacy renderer arm (#4096)
  Add OSS hydrate_on scheduling (#4037)
  Docs: fix stale evaluate-issue gate cross-reference (#3910) (#4104)
  ...

Author: justin808

.agents/skills/address-review/SKILL.md

@@ -221,6 +221,8 @@ Triage rules:
 - Deduplicate overlapping comments before classifying them. Keep one representative item for the underlying issue.
 - Verify factual claims locally before classifying a comment as `MUST-FIX`.
 - If a claim appears wrong, classify it as `SKIPPED` and note briefly why.
+- When a reviewer identifies an unexplained sibling-lock version split, platform-precompiled/source-build transition, or new build-time dependency, treat the lockfile dependency drift item as `MUST-FIX`.
+  - Verify the lockfile diff and require either alignment or an explicit rationale in PR evidence before classifying the item as resolved.
 - Preserve the original review comment ID and thread ID when available so the command can reply to the correct place and resolve the correct thread later.
 - Treat actionable review summary bodies as normal feedback to classify (`MUST-FIX`/`DISCUSS` as appropriate); skip only boilerplate or status-only summaries.
 
@@ -450,6 +452,8 @@ If the user selects skipped/declined items for rationale replies, post those rep
 
 Before committing or asking for push confirmation, run the self-review gate: review the combined fix diff for correctness bugs, style violations, and inconsistencies introduced by the fixes themselves. Fix critical issues immediately.
 
+Converge the review loop, don't chase it: every push re-triggers the configured review bots on the new head and produces a fresh batch of comments. Batch all code fixes into a single push; resolve purely advisory threads (style, dead-code, "consider…", informational, positive) in-thread with a reply — **without a new commit**, since resolving a thread does not re-trigger reviews while a push does. Never resolve a confirmed blocker by reply alone. See [Review-Loop Convergence](../../workflows/pr-processing.md#review-loop-convergence-push-amplification).
+
 When 2+ selected fixes touch different files with no logical dependency, process them in parallel if the environment supports it. Instruct parallel helpers not to commit; keep all changes unstaged until the combined diff passes the self-review gate.
 After parallel fixes complete, verify no conflicts exist between the changes by checking whether any helpers touched the same files (`git diff --name-only`).
 

.agents/skills/address-review/bin/fetch-pr-review-data

@@ -256,14 +256,17 @@ module FetchPrReviewData
     end
 
     def validate_pr!(pr_number)
-      raise Error, "a positive integer PR number is required\n\n#{USAGE}" unless pr_number.to_s.match?(/\A\d+\z/)
+      raise Error, "a positive integer PR number is required\n\n#{USAGE}" unless pr_number.to_s.match?(/\A[1-9]\d*\z/)
 
       pr_number
     end
 
+    # Strict OWNER/REPO: non-empty owner and name, exactly one slash, no spaces.
+    REPO_FORMAT = %r{\A[^/\s]+/[^/\s]+\z}
+
     def resolve_repo!(repo)
       repo ||= capture!("gh", "repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner").strip
-      raise Error, "--repo must be in OWNER/REPO form (got: '#{repo}')" unless repo.include?("/")
+      raise Error, "--repo must be in OWNER/REPO form (got: '#{repo}')" unless repo.match?(REPO_FORMAT)
 
       repo
     end

.agents/skills/address-review/bin/fetch-pr-review-data-test.rb

@@ -105,10 +105,28 @@ def test_rejects_non_integer_pr
     assert_includes out, "positive integer PR number is required"
   end
 
+  def test_rejects_zero_pr
+    out, status = Open3.capture2e("ruby", SCRIPT, "0", "--repo", "owner/repo")
+    refute status.success?
+    assert_includes out, "positive integer PR number is required"
+  end
+
   def test_rejects_bad_repo_form
     # gh is not reached for a malformed --repo, so this passes without network.
     out, status = Open3.capture2e("ruby", SCRIPT, "12", "--repo", "owneronly")
     refute status.success?
     assert_includes out, "--repo must be in OWNER/REPO form"
   end
+
+  def test_rejects_repo_with_extra_path_segment
+    out, status = Open3.capture2e("ruby", SCRIPT, "12", "--repo", "a/b/c")
+    refute status.success?
+    assert_includes out, "--repo must be in OWNER/REPO form"
+  end
+
+  def test_rejects_repo_with_empty_owner
+    out, status = Open3.capture2e("ruby", SCRIPT, "12", "--repo", "/repo")
+    refute status.success?
+    assert_includes out, "--repo must be in OWNER/REPO form"
+  end
 end

.agents/skills/adversarial-pr-review/SKILL.md

@@ -47,6 +47,11 @@ handoffs, Codex/Claude comparison, and output templates.
 
 ## Merge Gate
 
+This review is a **required** gate for PRs whose target branch is in the `rc` or
+`final` release phase (target `release/*`), per `AGENTS.md` ->
+**Release-Train Branching And Phase Gating**. For `beta`-phase PRs (target `main`)
+it remains advisory unless a maintainer or high-risk policy requests it.
+
 Before marking a PR ready or merging it, all `BLOCKING` and `DISCUSS` findings
 from this review must be fixed, explicitly decided, or waived by a maintainer.
 Do not require an AI reviewer approval object or positive AI issue comment as a

.agents/skills/evaluate-issue/SKILL.md

@@ -49,6 +49,22 @@ AI-found gaps are leads, not priorities. Prioritize real customer reports, verif
    - Prefer narrow fail-fast guards, clearer errors, docs, or workarounds when they solve the real risk.
    - Be skeptical of broad identity, runtime, CI, workflow, dependency, or Pro/RSC changes unless impact justifies the complexity.
    - Split complex fixes into prerequisites and decision points; do not let a polished RFC imply immediate priority.
+   - For investigation or benchmark conclusions, recommendations to `close` or
+     `document/work around` require closing evidence:
+     - Cite a reproducible artifact (script, data file, benchmark command plus
+       environment), or when the artifact is missing, state why it is missing and
+       why the conclusion remains sound from the available data. Do not treat
+       absence alone as satisfying the gate.
+     - Verify that headline numbers match the document's own tables.
+     - Carry production-environment caveats when the evidence was collected on a
+       different platform.
+     - If the conclusion could reasonably be challenged from the artifacts alone,
+       such as missing control variables, platform-specific data, or
+       non-monotonic/outlier data points, recommend a correction, follow-up, or
+       explicit caveat instead of closing as settled.
+     - If the closing-evidence gate cannot be satisfied, use `park / P3` only as
+       a caveated no-PR outcome or report a `product decision` blocker; do not
+       present it as a settled closing or workaround recommendation.
 
 5. Classify recurring process misses
    - Use this only when the issue would add or change agent, review, CI, release, or audit process.

.agents/skills/plan-pr-batch/SKILL.md

@@ -62,17 +62,23 @@ Plan a PR batch
      helper, which does the authoritative local three-dot diff (fetching the
      verified base/head into session-unique temporary refs, never checking out
      untrusted PR code), validates `baseRefName`/`headRefName` as untrusted
-     refspec data, falls back to the PR Files API, and cleans up its temp refs:
-     `.agents/skills/plan-pr-batch/bin/pr-file-touch-map N --repo OWNER/REPO`
+     refspec data, falls back to the PR Files API, and cleans up its temp refs.
+     **For parallel batch scheduling, always pass `--cross-check`** so the local
+     diff and the Files API must independently agree on the path set — a
+     fail-safe against a silent under-report scheduling two colliding items into
+     the same wave:
+     `.agents/skills/plan-pr-batch/bin/pr-file-touch-map N --repo OWNER/REPO --cross-check`
      It prints `{pr, repo, source, changed_files, paths, renames}`:
-     - `source` is `local-diff` (authoritative), `files-api` (best-effort
-       cross-check, used only when the local diff cannot run), or `UNKNOWN`.
+     - `source` is `verified` (cross-check: both sources agreed — the only value
+       safe to place in a parallel worktree lane), `local-diff` / `files-api`
+       (default mode, single source), or `UNKNOWN`.
      - `paths` covers creates, edits, deletes, and **both** sides of every
        rename/copy; `renames` lists `{old, new}` pairs.
-     - When `source` is `UNKNOWN`, no trustworthy path list could be produced
-       (unfetchable refs, a broken/capped/inconsistent Files API response, or a
-       rename row missing its previous filename); treat the item as serial — not
-       safe for a parallel worktree lane.
+     - **Treat anything other than `verified` as serial** when scheduling parallel
+       waves. `UNKNOWN` means no trustworthy path list could be produced (a
+       cross-check disagreement, an unfetchable source, a broken/capped Files API
+       response, or a rename/copy row missing its previous filename) — never put
+       it in a parallel lane.
      - The helper owns the security and portability details (refspec injection
        guards, fork pull-ref vs head-repo vs reachable-SHA fetch, shallow-clone
        deepen-and-retry, Files API `changedFiles` sanity check and ~3000-file