The intake runs (#316, #317) held 4 PRs on failing checks. Triaging them found that two of the four failures predate the bumps entirely — those repos have been red on main for weeks, and the intake only made it visible. This issue collects the repairs.
One claim for all of them: they are small, independent, and each PR names this issue.
1. lone — deno task ci aborts at its first link ✅ verified
deno fmt --check fails on two org-harness files that arrive without a trailing newline: .github/workflows/pr-claim.yml and .github/workflows/claim-sweep.yml. The job dies in one second, before lint, check, or the 339-test suite are reached.
deno.jsonc's fmt.exclude already carries this exact class (front-desk-add.yml, excluded by lone#36 for the identical reason). It was never extended when the other two callers were adopted on 2026-08-29.
Reformatting them is not an option — each self-declares "Identical bytes in every repo", so a newline diverges them from the template and the next re-roll reverts it.
Measured locally, not predicted:
before: error: Found 2 not formatted files in 111 files (ci dies in 1s)
after: Checked 109 files
ok | 339 passed | 0 failed (6s) deno task ci exit 0
2. hooksmith — osv/osv-scan red for ~25 days on a stale Cargo.lock
9 advisories across 6 crates, every one traceable to a lock entry the committed manifests no longer ask for:
| manifest says |
lock pins |
advisories |
git2 = "0.21" |
0.18.3 |
3 |
reqwest = "0.12" |
also keeps 0.11.27 |
h2 0.3.27, rustls-pemfile 1.0.4 |
indicatif = "0.18" |
0.17.11 |
number_prefix 0.4.0 |
ratatui = "0.30" |
0.26.3 |
lru 0.12.5, paste 1.0.15 |
ratatui 0.26.3 cannot satisfy ^0.30 and git2 0.18.3 cannot satisfy ^0.21 — the lock has not been re-resolved since those manifests moved.
Three advisories (number_prefix, paste, rustls-pemfile) have no patched release. They can only clear by dropping the stale parent, which a re-resolve does. They must not be suppressed.
3. hooksmith — a dead jsonschema import blocks the cargo bump
crates/scripts/agreement_validator.rs:4 imports JSONSchema, renamed to Validator upstream. The file never constructs a schema — validate_schema is a // TODO stub returning Ok(()), and the compiler already warns unused import. Deleting the line is a provably behaviour-neutral fix.
(A second, real call site exists in crates/xtask/src/jsonc.rs. A third candidate — hooksmith-app/modules/contract_validation.rs — turned out on verification to be never compiled: that crate's lib.rs and main.rs contain zero mod declarations. It needs no port.)
4. The durable fix: rollers should emit a trailing newline
Item 1 is a symptom. The canonical caller templates are written without a trailing newline, so every Deno-formatted repo that adopts one goes red until someone adds an fmt.exclude entry. Fixing it at the source fixes the class.
Compatible with #319's byte-identity skip guard: that compares content modulo a trailing newline (both sides pass through command substitution, which strips them), so adding one will not cause perpetual re-rolls.
Not in scope
hooksmith#135 — the kube 3.1→4.2 bump needs a coupled k8s-openapi 0.27→0.28 edit, and the build died in a build script before rustc typechecked any workspace source, so a major-version source break may well surface behind it. That is a maintainer's call on a major bump, not intake cleanup. Diagnosis is on the PR.
Related: #316 · #317 · infra#560 · hooksmith#134/#135/#136 · lone#45 · lone#36 (the precedent)
The intake runs (#316, #317) held 4 PRs on failing checks. Triaging them found that two of the four failures predate the bumps entirely — those repos have been red on
mainfor weeks, and the intake only made it visible. This issue collects the repairs.One claim for all of them: they are small, independent, and each PR names this issue.
1.
lone—deno task ciaborts at its first link ✅ verifieddeno fmt --checkfails on two org-harness files that arrive without a trailing newline:.github/workflows/pr-claim.ymland.github/workflows/claim-sweep.yml. The job dies in one second, beforelint,check, or the 339-test suite are reached.deno.jsonc'sfmt.excludealready carries this exact class (front-desk-add.yml, excluded by lone#36 for the identical reason). It was never extended when the other two callers were adopted on 2026-08-29.Reformatting them is not an option — each self-declares "Identical bytes in every repo", so a newline diverges them from the template and the next re-roll reverts it.
Measured locally, not predicted:
2.
hooksmith—osv/osv-scanred for ~25 days on a staleCargo.lock9 advisories across 6 crates, every one traceable to a lock entry the committed manifests no longer ask for:
git2 = "0.21"0.18.3reqwest = "0.12"0.11.27h2 0.3.27,rustls-pemfile 1.0.4indicatif = "0.18"0.17.11number_prefix 0.4.0ratatui = "0.30"0.26.3lru 0.12.5,paste 1.0.15ratatui 0.26.3cannot satisfy^0.30andgit2 0.18.3cannot satisfy^0.21— the lock has not been re-resolved since those manifests moved.Three advisories (
number_prefix,paste,rustls-pemfile) have no patched release. They can only clear by dropping the stale parent, which a re-resolve does. They must not be suppressed.3.
hooksmith— a deadjsonschemaimport blocks the cargo bumpcrates/scripts/agreement_validator.rs:4importsJSONSchema, renamed toValidatorupstream. The file never constructs a schema —validate_schemais a// TODOstub returningOk(()), and the compiler already warnsunused import. Deleting the line is a provably behaviour-neutral fix.(A second, real call site exists in
crates/xtask/src/jsonc.rs. A third candidate —hooksmith-app/modules/contract_validation.rs— turned out on verification to be never compiled: that crate'slib.rsandmain.rscontain zeromoddeclarations. It needs no port.)4. The durable fix: rollers should emit a trailing newline
Item 1 is a symptom. The canonical caller templates are written without a trailing newline, so every Deno-formatted repo that adopts one goes red until someone adds an
fmt.excludeentry. Fixing it at the source fixes the class.Compatible with #319's byte-identity skip guard: that compares content modulo a trailing newline (both sides pass through command substitution, which strips them), so adding one will not cause perpetual re-rolls.
Not in scope
hooksmith#135 — the kube 3.1→4.2 bump needs a coupledk8s-openapi0.27→0.28 edit, and the build died in a build script before rustc typechecked any workspace source, so a major-version source break may well surface behind it. That is a maintainer's call on a major bump, not intake cleanup. Diagnosis is on the PR.Related: #316 · #317 ·
infra#560 ·hooksmith#134/#135/#136 ·lone#45 ·lone#36 (the precedent)