diff --git a/.dev/features/ci-matrix-os-node/GRILL.md b/.dev/features/ci-matrix-os-node/GRILL.md
new file mode 100644
index 0000000..1fde852
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/GRILL.md
@@ -0,0 +1,109 @@
+# GRILL — ci-matrix-os-node (M7) — **ADVISORY, gates nothing**
+
+Plan under interrogation: `.dev/features/ci-matrix-os-node/PLAN.md`.
+**Spec-hash check:** recomputed `sha256(ARCHITECTURE.md)` = `bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e` — **matches** the plan's pin. No drift. (The computation is content-hash floor-grade; the *block* on drift is `/pharn-dev-build`'s gate, not this one.)
+**Griller discovery (FLOOR — enum membership):** `node .dev/floor/count-grillers.mjs .` → `{"registered":0,"grillers":[]}`. **No griller capabilities exist in this repo**, so Step 2b contributed nothing and the inline axes carry this entire grill. Stated so the coverage is not overread: the `testability` griller the stage doc names lives in pharn-oss, not here.
+
+The plan is treated as `trust: untrusted`. Its self-claims are tested, not believed.
+
+---
+
+## Findings
+
+### Axis: guarantee-audit completeness (P0)
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: important
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:106"
+  problem: "The plan fuses two DIFFERENT claims about `.gitattributes` into one row, and the only proof it schedules (Phase C's renormalize check) verifies the weaker one; the claim that actually matters is verified nowhere but the probe's Windows cell."
+  evidence: "\"Source bytes are LF on every OS at checkout\" → FLOOR — git's, declared … | \"The renormalization is a no-op today\" → git add --renormalize . && git diff --cached --stat must be empty"
+```
+
+Sharpened: `git add --renormalize .` run on **this macOS working tree** proves the *index does not change* — a statement about the repo's current bytes. It says nothing whatsoever about **what a Windows runner checks out under `core.autocrlf=true`**, which is the entire red-class `.gitattributes` is being shipped to kill. The two are separate claims with separate evidence, and only the second one matters. Recommendation: keep both proofs but stop presenting the renormalize output as evidence for the checkout claim — the Windows cell going green **is** that evidence, which is precisely the probe's job.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:103"
+  problem: "The plan labels the soft-tier gate FLOOR without naming HOW it executes in CI — no workflow step runs it, and floor.yml is a declared non-goal, so its CI enforcement rides entirely on its own test's live-repo block."
+  evidence: "\"No workflow in this repo declares a soft tier\" | FLOOR — primitive #3 (enum/regex), NEW in this increment."
+```
+
+Not a defect — it is the exact mechanism `check-action-pins` and `check-run-pins` already rely on, and the plan read that precedent correctly. But the reduction is only honest when stated end-to-end: **the gate runs in CI because `floor.yml`'s `node --test "**/*.test.mjs"` collects `check-soft-tier.test.mjs`, whose `★ LIVE REPO-CONSISTENCY` block invokes the checker against the real tree.** Delete that `★` block and the gate becomes decorative while still looking like floor. Recommendation: say so in the script header, and treat the `★` block as load-bearing rather than as a nicety.
+
+### Axis: eval coverage (P1)
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:41"
+  problem: "The new floor gate is NOT exercised by /pharn-dev-build's own floor — validate.mjs does not call check-soft-tier.mjs and npm run check does not collect .mjs tests — so a build that goes GREEN proves nothing about the gate this increment adds."
+  evidence: "`.dev/floor/check-soft-tier.mjs` — new, deterministic scanner … layer: floor (primitive #3)"
+```
+
+Concrete and checkable: `/pharn-dev-build`'s verdict is `node .dev/floor/validate.mjs .`, and `validate.mjs` walks markdown frontmatter — it never invokes the `check-*` scanners. `npm run check` = `format:check + lint + typecheck + vitest`, and vitest globs `tests/*.test.ts`, not `.dev/**/*.test.mjs`. So **both** of this stage's automatic verdicts are blind to the new gate. Recommendation (process, not plan-shape): run `node --test ".dev/**/*.test.mjs"` explicitly during build and paste the result — otherwise the increment's only genuinely new floor primitive ships unexecuted locally, and its first real execution is on a runner.
+
+### Axis: determinism / honest scope (P5, P7)
+
+```yaml
+- type: FINDING
+  rule_id: "P7"
+  severity: important
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:34"
+  problem: "Coverage-on-every-cell interacts with a fact the plan never records: vitest.config.ts enforces four coverage thresholds, so all five cells now gate on them — converting any platform-specific test skip into a red cell that reports a coverage table instead of a test name."
+  evidence: "3. **Coverage runs on EVERY cell** (draft proposed canonical-cell-only; overruled). Consequences, all simplifications:"
+```
+
+**This is the finding I would most want a human to see before the probe runs.** Measured this run: `vitest.config.ts:13-18` sets `thresholds: { statements: 90, branches: 82, functions: 95, lines: 92 }`, described in its own comment as *"Conservative floors set just below current measured coverage so CI stays green."* Those floors were calibrated against **exactly one platform**. Two consequences the plan calls "all simplifications" but are not:
+
+1. If any test skips or short-circuits on Windows/macOS — a `symlinkSync` fixture hitting `EPERM`, a platform-gated branch — coverage **drops below a floor tuned to have no headroom**, and the cell goes red on a *coverage table*, not a test name. That is a materially harder triage than a failing assertion, and it is a **new** red-class not in the brief's §3 taxonomy.
+2. `coverage.include: ['src/**/*.ts']` is a glob evaluated against paths on the runner. A glob/separator mismatch on Windows would not fail loudly — it would yield an **empty include set**, and empty-set threshold behavior is a silent-catastrophe shape rather than a clean red.
+
+I am **not** recommending reversing the human's decision — coverage everywhere has real value, and this is advisory. I am recommending that HALT 1's triage treat *"red on coverage threshold"* as its own named class, per §3's `Unclassified` rule, rather than filing it under a test failure it is not.
+
+```yaml
+- type: FINDING
+  rule_id: "P7"
+  severity: minor
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:33"
+  problem: "The increment now bundles two independent concerns — a measurement (the matrix) and an enforcement (the soft-tier gate) — after the plan's own draft argued they should be separate tickets."
+  evidence: "2. **The soft-tier fence IS built in this increment** (draft recommended deferring; overruled)."
+```
+
+Raised for the record, not to relitigate: the human weighed this and chose to bundle, which is legitimate. The residual cost is concrete — a red probe cell and a soft-tier-gate bug are now independent failure modes landing in one PR, so a revert of one is a revert of both. Worth one sentence in the PR description so the coupling is visible to a future bisect.
+
+### Axis: trust propagation (P2)
+
+No finding. The increment ingests no untrusted artifact, and the plan's fix-#1 discipline for the new scanner (verdict = integer count; offending line copied to output as data only) matches `check-action-pins.mjs`'s stated contract. Recorded as checked, not skipped.
+
+### Axis: one axis of change / no sibling imports (P3)
+
+No finding. Each planned file has one reason to change, and the plan's R3 explicitly **refuses** to share an enumerator module between floor scripts — preserving the no-floor-script-imports-another isolation rather than "DRY-ing" it into a shared dependency. That is the right call and the plan already gives the reason.
+
+---
+
+## Axis checked and DE-RISKED (reported so the absence of a finding is evidence, not silence)
+
+I suspected the single most common first-red cause for this exact change — **platform-specific optional deps missing from `package-lock.json`**, the `@esbuild/*` / `@rollup/*` class that makes `npm ci` fail on a platform the lock was not generated on. Measured rather than assumed:
+
+- `@esbuild/*` — **26** platform variants present, including `darwin-arm64`, `linux-x64`, `win32-x64`
+- `@rolldown/binding-*` — **11** variants, including `win32-x64-msvc` and `darwin-arm64`
+- `lightningcss-*` — all platforms including `win32-x64-msvc`
+
+The lockfile is fully populated across the matrix's three platforms. Residual, stated: *the lock containing a variant is not proof `npm ci` selects and links it correctly* — only the probe proves that. But this axis is healthier than expected and should **not** be the first place to look at HALT 1.
+
+---
+
+## Summary
+
+The plan is unusually explicit about what it does **not** guarantee, and its two strongest moves are both defensible under interrogation: refusing to write a tautology-test over `ci.yml`, and refusing to share an enumerator between floor scripts. Its guarantee audit is genuinely complete in structure — every row carries a reduction or an `advisory` label.
+
+The concerns are concentrated in one place: **things the GATE-1 amendments changed that the plan then re-described as simplifications without re-checking their consequences.** Coverage-on-every-cell is the sharp one — it silently recruits four calibrated-with-no-headroom thresholds into the gating set of four never-before-exercised platforms, and produces a red shape the brief's taxonomy does not have a row for. The other cluster is verification blindness: the increment's one genuinely new floor primitive is invisible to both `/pharn-dev-build`'s floor and `npm run check`, so nothing automatic in this pipeline will execute it before it reaches a runner.
+
+Nothing here argues against building. Two items (the coverage-threshold class, the explicit `node --test` run) are cheap enough to absorb during the build without a plan change.
+
+**ADVISORY VERDICT: 5 concerns raised (0 blocking-severity, 3 important, 2 minor), plus 1 axis checked and de-risked — for the human to weigh before `/pharn-dev-build`. This is not a pass, not a gate, and not a judgment that the plan is sound; `/pharn-dev-grill` gates nothing.**
diff --git a/.dev/features/ci-matrix-os-node/PLAN.md b/.dev/features/ci-matrix-os-node/PLAN.md
new file mode 100644
index 0000000..a876eba
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/PLAN.md
@@ -0,0 +1,157 @@
+# PLAN — ci-matrix-os-node (M7)
+
+- spec_content_hash: bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e # fix #4
+- increment: Expand `ci.yml` from one cell (`ubuntu-latest` × node 20) to a 5-cell OS×Node matrix, pin source bytes to LF, turn "no soft tier" from discipline into a floor gate, and **measure** the result by pushing a draft PR and reading the real cells before deciding the final shape.
+- layer(s): repo tooling / CI definitions + `.dev/floor` (repo infrastructure — the same layer as `floor.yml` and the `check-*-pins` gates that fence it; outside `ARCHITECTURE.md §4`'s product tree)
+- constitution_refs: [P0, P1, P5, P6, P7]
+- status: **APPROVED at GATE 1** (2026-08-11) with three amendments — recorded in "GATE 1 decisions" below.
+
+## Live state read this run (P6 — nothing asserted from memory)
+
+| Fact | Measured | How |
+| --- | --- | --- |
+| Base | `21db522`, `origin/main` synced (identical SHAs) | `git rev-parse HEAD origin/main` |
+| Brief's base `dd8af18` | **is an ancestor** of HEAD; 6 intervening commits | `git merge-base --is-ancestor` |
+| Drift in `.github/` since `dd8af18` | **none** — `git diff --stat dd8af18..HEAD -- .github/` is empty | `git diff` |
+| Intervening commits | 5 dependency bumps (#83–#87) + `3d5052e` M5 lint-gate (#90) + its loop artifacts | `git log` |
+| `ci.yml` shape | ONE job `check`, `ubuntu-latest`, `node-version: 20`, six gates via `always() && steps.install.outcome == 'success'`, `Test` = `npm run test:coverage` | read `.github/workflows/ci.yml` |
+| Action digests | `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`, `actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0`, `persist-credentials: false` | read `ci.yml:15-21` |
+| CRLF in tracked files | **zero** — `git grep -I -l $'\r'` returns empty | `git grep` |
+| `.gitattributes` | **absent** | `ls` |
+| `continue-on-error` in `.github/**` | **zero occurrences** — the new gate starts from a clean tree | `grep -rn .github/` (exit 1) |
+| `.github/actions/` | **does not exist** — so the gate's composite-action walk is *vacuous on this repo today* (covered by hermetic fixtures, not by the live tree) | `ls -d` |
+| `engines` | `{ "node": ">=20" }`; version `0.4.0` | read `package.json` |
+| Workflows present | `ci.yml`, `codeql.yml`, `floor.yml`, `gitleaks.yml`, `publish.yml` | `ls .github/workflows/` |
+
+**Base drift verdict: NOT material.** The brief's §0 description of `ci.yml`, the six-gate pattern, `engines`, and the `.gitattributes` absence all match byte-for-byte. The CRLF check is empty, so the `.gitattributes` renormalization is still a verified no-op. No HALT condition from §5 is tripped by the base.
+
+**One fact the brief predates** (landed in `3d5052e`, after `dd8af18`): `tests/lint-gate.test.ts` resolves the repo root from `import.meta.url` **and** spawns eslint against scratch files. It is both a repo-bytes reader and a spawn-based self-test — i.e. it sits in *two* of the risk classes this matrix exists to measure, and no runner has ever executed it outside `ubuntu × 20`. Recorded as an added reason the probe is worth running, not as a predicted failure.
+
+## GATE 1 decisions (human, 2026-08-11 — these amend the pre-approval draft)
+
+1. **Approved as written**, and the outward-facing step is authorized: create branch → push → open a **draft** PR. Nothing further — no merge, no ready-for-review flip, no branch-protection change.
+2. **The soft-tier fence IS built in this increment** (draft recommended deferring; overruled). The whitelist widens by one named item — `.dev/floor/check-soft-tier.mjs` + its `.test.mjs`. "No soft tier" stops being a promise and becomes floor primitive #3.
+3. **Coverage runs on EVERY cell** (draft proposed canonical-cell-only; overruled). Consequences, all simplifications: no `matrix.coverage` key, all six steps uniform across cells, and **`CLAUDE.md:23` is dropped from the whitelist** — `(CI runs this)` stays true unedited.
+4. **`fail-fast: false` is permanent**, not probe-only.
+
+## Files
+
+- `.github/workflows/ci.yml` — replace the single `check` job with a 5-cell `strategy.matrix` (`fail-fast: false`), explicit `name: ${{ matrix.os }} / node ${{ matrix.node }}`, six gates reused verbatim — layer: repo CI definition
+- `.gitattributes` — **new**, one line `* text=auto eol=lf` — layer: repo-wide byte policy
+- `.dev/floor/check-soft-tier.mjs` — **new**, deterministic scanner: no `continue-on-error` key anywhere in `.github/workflows/*.{yml,yaml}` or `.github/actions/**/action.{yml,yaml}` — layer: floor (primitive #3)
+- `.dev/floor/check-soft-tier.test.mjs` — **new**, hermetic fixtures + a `★ LIVE REPO-CONSISTENCY` block against the real tree (P1) — layer: floor test
+- `CHANGELOG.md` — one entry under `## [Unreleased] → ### Added`, following the `:279` "Repo-health tooling" precedent — layer: docs
+- `src/lib/apply-update.ts` — **HALT-1 line-item R1, approved 2026-08-11.** Make `readDiskState`'s absent-vs-unreadable split errno-free, fixing the Windows red cell — layer: `lib/`
+
+### The proposed `ci.yml` shape
+
+```yaml
+jobs:
+  check:
+    name: ${{ matrix.os }} / node ${{ matrix.node }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-latest, node: 20 }
+          - { os: ubuntu-latest, node: 22 }
+          - { os: ubuntu-latest, node: 24 }
+          - { os: windows-latest, node: 24 }
+          - { os: macos-latest, node: 24 }
+```
+
+The six steps stay **byte-identical in body** to today's — `npm ci`, then `format:check` / `lint` / `lint:md` / `typecheck` / `test:coverage` / `build`, each behind `if: ${{ always() && steps.install.outcome == 'success' }}`. Only `runs-on` and `node-version` become expressions. With coverage now uniform (decision 3), the "six-gate pattern preserved verbatim" claim is exactly true — per cell **and** per file; the draft's seventh-step caveat is gone.
+
+**The explicit `name:` is load-bearing, not decoration.** Without it GitHub derives each check's name from *every* matrix key — so any future key added to `include` would silently rename all five required checks and re-break branch protection. Pinning `name:` to `os` + `node` fixes the check identity against that.
+
+### The soft-tier gate — shape, enforcement, and honest residuals
+
+`check-soft-tier.mjs` follows the house style of its two neighbours exactly: Node stdlib only, no network, no `child_process`, no dynamic import; a **line scanner**, not a YAML parser; unrecognised shapes fail **toward flagging**.
+
+- **Enumerates** the same two sets `check-action-pins.mjs` does, for the same reason: `.github/workflows/*.{yml,yaml}` (non-recursive, mirroring GitHub) **and** `.github/actions/**/action.{yml,yaml}` (recursive) — a composite action is a laundering path if only call sites are scanned.
+- **Violation = the presence of a `continue-on-error:` key, value-blind.** `false` is rejected along with `true`. This is deliberate: reading the value would make the verdict depend on untrusted file content, whereas `violations.length > 0` is an integer test (the same P2/fix-#1 discipline `check-action-pins.mjs` states for its `ref` field). It also catches the experimental-cell laundering shape `continue-on-error: ${{ matrix.experimental }}` without needing to know what `matrix.experimental` is.
+- **Enforcement (outside the scanned workflow surface):** `floor.yml` runs `node .dev/floor/check-soft-tier.mjs .` directly (not only via its test file), and the `main protection` ruleset requires the `floor` status check. The `★ LIVE REPO-CONSISTENCY` block in `check-soft-tier.test.mjs` is retained as a third anti-vacuity residual on top of both wires.
+- **Named residuals** (stated, never claimed closed):
+  - **R1 — other required checks are still a REPO-SETTINGS property.** This gate guarantees no workflow *asks* to be soft, and `floor` itself is now required on `main`; a *different* job left out of the required list (e.g. a matrix cell) remains invisible to this scanner. The operational note for those names still goes to the human by hand.
+  - **R2 — SHELL-LEVEL SWALLOWING.** `run: npm test || true`, `set +e`, a trailing `|| exit 0` — a soft tier written in bash rather than YAML. Detecting it is classification, which P5 forbids. Out of contract by construction.
+  - **R3 — ENUMERATOR DUPLICATION.** `collectFiles`/`isYaml`/`safeLstat` are duplicated from `check-action-pins.mjs`, because **no floor script imports another** and that isolation is a safety property (one module's bug cannot take down two gates) — the identical trade `check-run-pins.mjs` documents as its R2. Mitigated the same way: the test cross-checks that this scanner's `files[]` equals `check-action-pins.mjs`'s for this repo, so the two walkers cannot drift silently.
+
+## Contracts satisfied
+
+- None in `pharn-contracts`. This increment adds no Capability, no `rule_id`, and no inter-layer contract — it changes where the **existing** gates execute, and adds one floor gate. Recorded explicitly so the absence is a finding, not an omission (P4).
+
+## Evals to write (P1)
+
+The matrix and `.gitattributes` add no product behavior — `src/**` is untouched, and every gate the matrix runs is an existing, already-tested gate. **The soft-tier gate does add behavior, so P1 binds it**, and it is tested in the `.mjs` floor-test style its two neighbours established (collected by `floor.yml`'s `node --test`, not by vitest — matching precedent, not inventing a home):
+
+- clean workflow fixture → exit 0, `violations: []`
+- `continue-on-error: true` on a step → exit 1, violation carries `{file, line}`
+- `continue-on-error: false` → exit 1 — **pins the value-blind choice**, so a later "helpful" relaxation is a test failure, not a silent drift
+- `continue-on-error: ${{ matrix.experimental }}` → exit 1 — the experimental-cell laundering shape
+- quoted-key and leading-whitespace variants → flagged (line-scanner tolerance)
+- a violation inside `.github/actions/x/action.yml` → flagged — pins that the composite-action laundering path is walked
+- a non-YAML file, and a file in a *subdirectory* of `.github/workflows/` → skipped (mirrors GitHub's own non-recursive rule)
+- `★ LIVE REPO-CONSISTENCY` — run against the **real repo**: exit 0, and `files[]` enumerates the live workflow directory (an anti-vacuity **lower bound**, so adding a workflow later never silently shrinks coverage)
+- `★` cross-check — `files[]` is deep-equal to `check-action-pins.mjs`'s for this repo (the R3 anti-drift)
+
+**What is deliberately NOT written:** a vitest test asserting `ci.yml` contains `"windows-latest"`. That asserts the file says what the file says — a tautology wearing a test's clothes, and precisely the "written in the config" mistaken for "guaranteed" disease P0 exists to prevent. **The execution proof is the probe**: five green cells on a real PR. That is why Phase A is empirical and HALT 1 is a results table.
+
+## Guarantee audit (P0)
+
+| Claim | Reduction |
+| --- | --- |
+| "The tests execute on Windows, macOS, and node 20/22/24" | **FLOOR — the runner's, not this repo's.** GitHub executes the matrix; the proof is five green cells on the probe PR, an observed artifact. Until the probe returns this claim is **unmeasured** and is stated nowhere. |
+| "No workflow in this repo declares a soft tier" | **FLOOR — primitive #3 (enum/regex), NEW in this increment.** `check-soft-tier.mjs`, verdict = `violations.length > 0`, an integer test. Bounded by R1/R2/R3 above. |
+| "Both action digests stay pinned by 40-hex + full semver" | **FLOOR** — `check-action-pins.mjs`, executed against the real tree by its own `★` self-test. |
+| "No `run:` line I add installs a floating package" | **FLOOR** — `check-run-pins.mjs`, same `★` mechanism. Both new-shape `run:` lines are `npm run <script>`, which that checker's R1 names as out of contract by construction. |
+| "Source bytes are LF on every OS at checkout" | **FLOOR — git's, declared, and NARROWER than it sounds.** `* text=auto eol=lf` governs **tracked** files at checkout. Runtime-written fixtures (`writeFileSync`) are untouched, as is anything a test synthesizes. Scoped this way, not sold as "line endings can never break a test". |
+| "The renormalization is a no-op today" | **FLOOR** — `git add --renormalize . && git diff --cached --stat` must be **empty**; pasted in Phase C. Measured, not assumed. |
+| "Every cell gates the merge" | **ADVISORY — and NOT verifiable from this sandbox.** Repo settings are unreadable here; `check-soft-tier.mjs` R1 names the same wall. Both branches of the required-checks question go to the human verbatim at HALT 2. This is the increment's single largest operational risk and is never stated as closed. |
+| "The matrix results are the node-version-policy ticket's evidence base" | **ADVISORY** — a scoping statement for the PR description, not a guarantee. |
+
+## Trust audit (P2)
+
+No untrusted artifact is ingested. The increment fetches nothing, parses no remote frontmatter, and adds no network call. `check-soft-tier.mjs` reads files this repo owns, and — per the fix-#1 discipline — **no decision reads their content**: the verdict is an integer count, and the offending line text is copied verbatim into output as data only. `.gitattributes` is a git-side byte policy over tracked files; it moves no trust boundary.
+
+One second-order note, recorded because it is real rather than because it is dangerous: `on: pull_request` (unchanged, and **not** `pull_request_target`) means a fork PR's contents can run these gates. That was already true for the single cell; the matrix multiplies the runners, not the privilege. `permissions: contents: read` is preserved verbatim, no secrets are added, and `persist-credentials: false` stays on every checkout — so the blast radius per cell is identical to today's.
+
+## Determinism audit (P5)
+
+Every branch this increment introduces is a membership/equality test, never a classification. In `ci.yml`: `steps.install.outcome == 'success'` is the existing equality test reused verbatim; `matrix.os`/`matrix.node` are literal values from an explicit `include` list. In `check-soft-tier.mjs`: the verdict is `violations.length > 0`, and "is this a violation" is a regex key-match that never inspects the value.
+
+The **triage** step at HALT 1 is where P5 bites hardest, and the brief already fixes it: a red cell is classified into §3's taxonomy, which carries an explicit **`Unclassified`** row whose handling is *"fail toward flagging — never squeeze a novel red into the nearest existing row."* That is P5's terminal "ask" written into the process, and it is honored literally: any red I cannot place lands at HALT 1 as a proposed **new** class, unhandled.
+
+## Process (probe-first — the structural novelty)
+
+- **Phase A** — branch, write the five files, push, open a **draft PR**, let all five cells finish (`fail-fast: false`). → **HALT 1: the results table** (one row per cell: `os / node / result / wall time`; for every red cell the **verbatim first failure**, its §3 class, and a proposed handling as a **named line-item**).
+- **Phase B** — apply only HALT-1-approved handling, each its own declared whitelist item. → **HALT 2:** final diff + all-green runs + the required-checks note verbatim.
+- **Phase C** — paste the checks summary; paste the empty `git add --renormalize` proof; `npm run check` green locally; commit `chore(ci): test on windows/macos and node 22/24; pin source bytes to LF`.
+
+## HALT 1 — the probe's measurement (2026-08-11, PR #91, run 31520548206)
+
+| os / node | result | wall |
+| --- | --- | --- |
+| `ubuntu-latest` / 20 | pass | 39s |
+| `ubuntu-latest` / 22 | pass | 28s |
+| `ubuntu-latest` / 24 | pass | 29s |
+| `macos-latest` / 24 | pass | 40s |
+| `windows-latest` / 24 | **fail** | 62s |
+
+On Windows **5 of 6 gates passed** — `Format check`, `Lint`, `Markdown lint`, `Typecheck`, `Build`. Only `Test` failed, so the six-gate pattern isolated the failure without any log archaeology.
+
+**Predictions that did NOT materialize** (recorded because negative results are results): the **CRLF class was dead on arrival** — `.gitattributes` shipped in the probe and both text-reading gates passed on Windows; the grill's **coverage-threshold** concern did not fire (zero threshold errors); and the `@esbuild`/`@rolldown` lockfile class held on all three platforms.
+
+**The red cell — 3 failures, ONE root cause. New class: `errno-shape divergence` (accepted by the human at HALT 1).**
+
+`src/lib/apply-update.ts:52` uses `lstatSync(dest, { throwIfNoEntry: false })`, whose suppression covers **ENOENT only** — a POSIX-only truth stated in that line's own comment. POSIX raises `ENOTDIR` for a path whose parent is a regular file, so it escapes the suppression and is correctly classified `unreadable`; **Windows raises `ENOENT`**, so it is suppressed and the path is classified `absent`. (The errno was deduced, not assumed: `absent` is reachable only via that suppression.)
+
+Shipped, user-visible consequence: on Windows `pharn status` reports such a path as **Missing** — implying it can be restored, when a regular file squats on its parent and it cannot exist — and `pharn update` then plans a restore and **exits 1** instead of emitting the named skip. The "Unreadable" fourth drift category, the headline entry in this CHANGELOG's Unreleased section, has been POSIX-only correct since it shipped.
+
+The class is distinct from §3's `path-shape residue`: no path string is compared and `toPosix`/`safeJoin` are irrelevant. Signature: assertions about error **classification** failing only on Windows.
+
+**Approved handling — line-item R1:** fix product-side in `src/lib/apply-update.ts` **only**; classify the not-found branch by walking the parent chain (any intermediate component that exists and is not a directory → `unreadable`, else `absent`) rather than by errno. **No test file is edited** — the three failing tests assert the correct behavior, which is the strongest evidence this is a product fix and not a test accommodation.
+
+## Open questions (HALT)
+
+All four pre-build questions were resolved at GATE 1; both HALT 1 questions were resolved by the human on 2026-08-11. None remain open.
diff --git a/.dev/features/ci-matrix-os-node/REGRESSION.md b/.dev/features/ci-matrix-os-node/REGRESSION.md
new file mode 100644
index 0000000..e6662f9
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/REGRESSION.md
@@ -0,0 +1,55 @@
+# REGRESSION — ci-matrix-os-node (M7)
+
+**Base:** `21db522c0fe23c30c53510b954cccd4e34662e83` (`git merge-base HEAD origin/main` — the branch's fork point).
+
+**Base resolution — an advisory orchestration call, named rather than silent.** `git status --porcelain` was non-empty, whose literal reading is "a working-tree dogfood build → `base = HEAD`". The only dirty entry was `.pharn/writes-scope.json` — this stage's **own** Step 0 side-effect, which the command itself declares always-writable scratch. Taking `base = HEAD` would have compared HEAD to itself and produced a vacuous verdict over an empty `inside`. The feature is committed on a branch, so the merge-base is the real pre-build baseline. Recorded because the verdict is floor-grade only *given* this choice, and the choice was mine.
+
+## Partition
+
+`scope` exited **0** — every changed path is inside the plan's declared `## Files`, so there is **no fix#7 scope breach**. `inside` is 6 files, exactly the declared write set:
+
+| inside (the feature) |
+| --- |
+| `.dev/floor/check-soft-tier.mjs` |
+| `.dev/floor/check-soft-tier.test.mjs` |
+| `.gitattributes` |
+| `.github/workflows/ci.yml` |
+| `CHANGELOG.md` |
+| `src/lib/apply-update.ts` |
+
+Loop-owned artifacts (`.pharn/writes-scope.json`, `.dev/features/ci-matrix-os-node/**`) were excluded from `--changed`, following the convention the previous increment records (`.dev/features/lint-gate-no-soft-tier/REGRESSION.md:22`).
+
+`outside_tests` = **46** test files (the whole `*.test.mjs` / `*.test.cjs` universe minus this feature's own `check-soft-tier.test.mjs`). `outside_eval_pairs` = **none**: no `<cap>/evals/expected/*.json` exists in this repo today (the single `evals/expected` hit is a `.md` under `.dev/floor/test-fixtures/`), which is why no `structural:*` gate appears — matching the previous increment's report, which likewise carried none.
+
+## Gates
+
+| gate | base | head | |
+| --- | --- | --- | --- |
+| `tests` (46 files, 748 tests) | 0 | 0 | OK |
+| `validate` | 0 | 0 | OK |
+| `format:check` | 0 | 0 | OK |
+| `lint` | 0 | 0 | OK |
+| `lint:md` | 0 | 0 | OK |
+
+**The style gates were RUN, not skipped — deliberately, and it exposes a gap in the skip rule.** The rule skips `lint`/`format:check`/`lint:md` unless `inside` touches a shared style config, enumerated as `eslint.config.mjs`, `.prettierrc.json`, `.prettierignore`, `.markdownlint-cli2.jsonc`. This increment adds **`.gitattributes`**, which is *precisely* a file that changes the bytes on disk that style gates read — and it is not in that list. The alternative to running them was a platform-dependent argument that no flip is possible on macOS; running them costs one `npm ci` in the baseline worktree and needs no argument at all. **Reported, not fixed:** `.gitattributes` belongs in that enumeration, in `.claude/commands/pharn-dev-regress.md` — outside this increment's whitelist, so it is the human's call.
+
+`regressions[]`: **empty**. `pre_existing[]`: **empty**.
+
+## Two harness bugs found in this stage's own orchestration (P6 — the numbers were verified, not trusted)
+
+The first two baseline captures both recorded `tests: 1`. **Neither was a real failure**, and accepting either would have been the worst available outcome: `check-regress`'s table excludes a gate that is red at base as PRE-EXISTING, so `tests` — the single most important gate — would have been **dropped from the comparison entirely** while the stage still reported `no-regressions`.
+
+1. **zsh does not word-split unquoted parameter expansion.** The command doc's `node --test <outside_tests...>` idiom, written as `node --test $TESTS`, passes all 46 paths as **one** argument under zsh (unlike bash). Node reported `Could not find '<all 46 paths concatenated>'` and exited 1.
+2. **macOS `xargs` has no `-a` flag.** The first fix attempt died on usage and again exited 1.
+
+Corrected to `xargs node --test < list`, and every capture now carries a **liveness assertion** — the log must contain a real `ℹ fail 0` summary before its exit code is recorded. Verified: 748 tests ran at both base and head.
+
+**This is a floor-adjacent hazard in the stage itself, and it is worth a human's attention:** the verdict core (`check-regress.mjs`) is tested and correct, but it is only as good as the exit codes the command's **Bash** hands it, and that Bash is shell-dependent and silently degrades to a plausible-looking `1`. A capture that never ran is indistinguishable from a capture that ran and failed, by exit code alone. Reported here; `.claude/commands/pharn-dev-regress.md` is outside this increment's whitelist.
+
+## Verdict
+
+**REGRESSIONS: none — no deterministically-detectable breakage outside the feature.** (`check-regress.mjs verdict` exit **0**, `"verdict": "no-regressions"` — see `regression-report.json`.)
+
+The verdict is floor-grade: an exit-code comparison, not a judgment. Everything around it — choosing the base, the inside/outside partition, running the suite — is advisory orchestration, and the two harness bugs above are exactly why that distinction is not a formality.
+
+**Honest residual (P0/P7):** `/pharn-dev-regress` catches **exactly what its suite catches — nothing more.** A regression no deterministic check covers is invisible here. The claim is "deterministically-detectable breakage outside the feature is caught," **not** "nothing broke."
diff --git a/.dev/features/ci-matrix-os-node/REVIEW.md b/.dev/features/ci-matrix-os-node/REVIEW.md
new file mode 100644
index 0000000..4796b1a
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/REVIEW.md
@@ -0,0 +1,101 @@
+# REVIEW — ci-matrix-os-node (M7)
+
+**Floor first (P0, Step 1):** `node .dev/floor/validate.mjs .` → `FLOOR: GREEN — 0 capabilities checked in .`, exit **0**. The increment was eligible for review. Everything below the floor line is **advisory**.
+
+Increment under review is `trust: untrusted`. Nothing in it attempted to instruct me; the free-text quoted below is DATA.
+
+---
+
+## floor-gate findings (blocking)
+
+**None.**
+
+Recorded per lens so the absence is a checked result, not silence:
+
+- **L-floor → P0.** Every guarantee the increment states carries a reduction or an `advisory` label (`PLAN.md` guarantee-audit table; the `WHAT IS GUARANTEED` / `WHAT IS NOT` header block in `check-soft-tier.mjs:15-33`). The one claim that was *unproven* at grill time — that `.gitattributes` yields LF bytes on a **Windows checkout**, as distinct from the local renormalize no-op — has since been **discharged empirically**: `Format check` and `Markdown lint` both passed on `windows-latest / node 24` (run `31521684401`). That grill finding is closed by measurement, not by argument.
+- **L-eval → P1.** The one new behavior (`check-soft-tier.mjs`) ships 17 cases in `check-soft-tier.test.mjs`, including two `★` live-repo bindings. Verified — not assumed — that `floor.yml`'s glob set actually collects it: `node --test ".dev/**/*.test.mjs"` matches the file. The floor and this lens agree.
+- **L-trust → P2.** `check-soft-tier.mjs` copies the offending `value` into output at lines 189/198/205 and **never reads it for a decision**; the verdict is `violations.length > 0`, an integer test. Taint reaches the report, not the verdict.
+- **L-axis → P3.** `check-soft-tier.mjs` imports `node:fs` and `node:path` only — **no floor script imports another**, the isolation invariant `check-run-pins.mjs` names as a safety property, preserved. Its prose references to sibling scanners cite *why the duplication exists* (P4 citation), matching the precedent `check-run-pins.mjs` sets in its own R2; the test's `spawnSync` of the sibling is a cross-check, not a runtime dependency, and mirrors `check-run-pins.test.mjs:441`.
+
+---
+
+## advisory findings
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: "src/lib/apply-update.ts:50"
+  problem: "The R1 fix's correctness branch is unreachable on POSIX, so no local gate can exercise it — its sole regression test is a CI cell introduced by this very PR, which makes the fix's protection contingent on a config this same change is establishing."
+  evidence: "`parentBlocks` returns true only when a parent component exists and is not a directory; on POSIX `lstatSync` raises ENOTDIR and short-circuits before it is consulted."
+```
+
+This is the finding I would most want a human to weigh. `npm test`'s 643 cases say **nothing** about the R1 fix — they passed identically before it. The proof is one Windows cell. Concretely: if the Windows cell is later dropped, or never added to branch protection's required list (see the operational note below — a state this sandbox **cannot read**), then the fix silently becomes unverified and can regress with no signal. The bug it fixes survived undetected for exactly that reason.
+
+Options for the human, none of which I took unilaterally since HALT 1 scoped R1 to `src/lib/apply-update.ts` with no test edits:
+
+1. **Accept as-is** — the matrix *is* the regression suite for this class, which is the increment's thesis. Cheapest, and coherent.
+2. **Export `parentBlocks` and unit-test it directly** — reachable on POSIX (create a file, ask about a path beneath it). Costs a widened module surface for testability.
+3. **Inject the classification** so the ENOENT/ENOTDIR divergence can be simulated. Most faithful, most invasive.
+
+```yaml
+- type: FINDING
+  rule_id: "P7"
+  severity: minor
+  file: ".dev/features/ci-matrix-os-node/PLAN.md:39"
+  problem: "The increment ships four separable concerns — a CI matrix, a byte policy, a new floor gate, and a product bug fix — so a revert of any one is a revert of all four."
+  evidence: "## Files lists ci.yml, .gitattributes, check-soft-tier.mjs(+test), CHANGELOG.md, and src/lib/apply-update.ts."
+```
+
+Each addition was human-approved (the gate at GATE 1, the fix at HALT 1), and the fix could not have been found without the matrix, so the coupling is causally honest rather than accidental. Flagged only so a future bisect sees it; already noted in the PR description.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: important
+  file: ".claude/commands/pharn-dev-verify.md"
+  problem: "The verify stage's documented gate set does not cover this repo's .mjs tests, so an increment whose tests live in .mjs can reach a PASS verdict with its own tests never executed."
+  evidence: "the command doc states npm test \"auto-collects via its `**/*.test.mjs` glob\", while vitest.config.ts:6 sets include: ['tests/**/*.test.ts']."
+```
+
+Caught during this run and worked around by composing a `floor-tests` gate into the map (sanctioned — the stage states the gate **set** is advisory orchestration). But the workaround is mine, not a floor lock: a future run using the documented set would report PASS over an unexecuted test file. **Outside this increment's whitelist — reported, not fixed.**
+
+```yaml
+- type: FINDING
+  rule_id: "P5"
+  severity: important
+  file: ".claude/commands/pharn-dev-regress.md"
+  problem: "The regress stage's Bash orchestration is shell-dependent and can record a gate as red when that gate never executed, which check-regress then excludes as PRE-EXISTING — silently removing it from the comparison while the stage still reports no-regressions."
+  evidence: "`node --test $TESTS` passes all 46 paths as one argument under zsh (no word-splitting), yielding \"Could not find '<all 46 paths>'\" and exit 1."
+```
+
+Hit twice in this run (zsh word-splitting, then macOS `xargs -a`). The verdict core is tested and correct; the hazard is upstream of it, in the exit codes the command's Bash hands over. **A capture that never ran is indistinguishable from one that ran and failed, by exit code alone** — and the failure direction is the dangerous one, because a bogus red at *base* silently deletes a gate from the comparison. Mitigated in this run by asserting each log carries a real completion signal before recording its code. **Outside the whitelist — reported, not fixed.**
+
+```yaml
+- type: FINDING
+  rule_id: "P5"
+  severity: minor
+  file: ".claude/commands/pharn-dev-regress.md"
+  problem: "The style-gate skip rule enumerates shared style configs but omits .gitattributes, which changes the very bytes on disk that the style gates read."
+  evidence: "skip unless inside touches `eslint.config.mjs`, `.prettierrc.json`, `.prettierignore`, `.markdownlint-cli2.jsonc`."
+```
+
+Handled conservatively this run by running all three style gates rather than arguing a platform-dependent "no flip possible". One-line enumeration fix; the human's call.
+
+---
+
+## Proposed lesson for canon (P7 — proposed only; `/pharn-dev-review` never writes canon)
+
+**Candidate:** *An exit code is not evidence that a check ran.* When a stage's verdict is computed from captured exit codes, capture a **liveness assertion** alongside each one (a real completion signal in the log) before recording it. A harness that fails to invoke a gate produces the same integer as a gate that ran and failed — and where a red at baseline is treated as "pre-existing, exclude", a never-run gate silently **deletes itself from the comparison** while the stage still reports success.
+
+**Provenance:** this increment (`ci-matrix-os-node`, commits `9ef438c`, `489e8a4`); observed twice in one `/pharn-dev-regress` run — zsh not word-splitting `$TESTS`, then macOS `xargs` lacking `-a`. Both produced `tests: 1` at baseline; the true value was `0` (748 tests, 748 pass).
+
+Not written here. Promotion is a separate human-gated `/pharn-dev-memory-promote` run under its own scope.
+
+---
+
+## Verdict
+
+**GREEN — 0 floor-gate findings.** 5 advisory findings (3 important, 2 minor), of which **3 concern the dev-loop's own stage commands**, not this increment's product code, and are outside its whitelist.
+
+Advisory means advisory: none of the above blocks the increment, and this review computes no proceed/stop — that is the human's at the post-review gate.
diff --git a/.dev/features/ci-matrix-os-node/SHIP.md b/.dev/features/ci-matrix-os-node/SHIP.md
new file mode 100644
index 0000000..155a9cb
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/SHIP.md
@@ -0,0 +1,47 @@
+# SHIP — ci-matrix-os-node (M7)
+
+A thin, **advisory** roll-up of a `/pharn-dev-ship` run. It records **that the chain ran and its floor verdicts** — nothing more.
+
+## Stages run, in order
+
+| # | stage | outcome |
+| --- | --- | --- |
+| 1 | `/pharn-dev-plan` | `PLAN.md` written; **GATE 1** — human approved with three amendments |
+| 2 | `/pharn-dev-grill` | `GRILL.md` — 5 concerns (advisory, gates nothing); proceeded |
+| 3 | `/pharn-dev-build` | files written; floor GREEN |
+| — | probe (Phase A/B) | draft PR #91; **HALT 1** results table → human approved line-item R1 + a new red-class |
+| 4 | `/pharn-dev-regress` | `regression-report.json` + `REGRESSION.md` |
+| 5 | `/pharn-dev-verify` | `verify-report.json` + `VERIFY.md` |
+| 6 | `/pharn-dev-review` | `REVIEW.md` |
+
+**Where the run ended: GATE 2** — the post-review human gate. Not at a RED-verdict STOP; every structural verdict read GREEN.
+
+## Structural verdicts read, verbatim
+
+| stage | verdict source | value |
+| --- | --- | --- |
+| `/pharn-dev-build` | `node .dev/floor/validate.mjs .` exit code | **0** (`FLOOR: GREEN — 0 capabilities checked in .`) |
+| `/pharn-dev-regress` | `regression-report.json` `.verdict` | **`"no-regressions"`** (`check-regress.mjs verdict` exit 0) |
+| `/pharn-dev-verify` | `verify-report.json` `.verdict` | **`"PASS"`** (`check-verify.mjs` exit 0, `failing_gates: []`) |
+
+Each was read as a deterministic value, not judged. `/pharn-dev-review` has **no** structural verdict and none was invented for it (P0, fix #3): its `REVIEW.md` is prose, and a finding's `severity` is LLM-assigned and advisory.
+
+## External execution proof (not a floor verdict — an observed artifact)
+
+PR **#91**, run `31521684401`: `ubuntu-latest` × {20, 22, 24}, `windows-latest` × 24, `macos-latest` × 24 — **all five green**, plus `floor`, `CodeQL`, `gitleaks`, `Socket Security`.
+
+The first probe run (`31520548206`) was **red on `windows-latest / node 24`** and produced this increment's most valuable output: a real, shipped, cross-platform bug in `readDiskState` (`errno-shape divergence` — a new §3 red-class accepted by the human at HALT 1). Fixed under line-item R1 in `489e8a4`.
+
+## Pointers (cited, not restated — P4)
+
+- `.dev/features/ci-matrix-os-node/REVIEW.md` — 0 floor-gate findings, 5 advisory; **3 of them concern the dev-loop's own stage commands**, not this increment's product code.
+- `.dev/features/ci-matrix-os-node/GRILL.md` — advisory, pre-build.
+- `.dev/features/ci-matrix-os-node/REGRESSION.md`, `VERIFY.md` — the human renders of the two machine verdicts above.
+
+## Standing item requiring a human, which no verdict here covers
+
+**Branch-protection required checks.** This PR renames the merge gate from one `check` job to five per-cell names. This sandbox cannot read repo settings, so the current state is **unverified**. Both branches, verbatim, are in the PR description and were handed over at HALT 1.
+
+---
+
+Chain ran; the named floor verdicts are as shown — this is **NOT** a judgment that the increment is good or wise; that is the human's call at the post-review gate.
diff --git a/.dev/features/ci-matrix-os-node/VERIFY.md b/.dev/features/ci-matrix-os-node/VERIFY.md
new file mode 100644
index 0000000..8ea64a2
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/VERIFY.md
@@ -0,0 +1,43 @@
+# VERIFY — ci-matrix-os-node (M7)
+
+## FLOOR layer — the gates that own the verdict
+
+| gate | exit | what actually ran (liveness-asserted, not inferred from the code) |
+| --- | --- | --- |
+| `test` | 0 | vitest — `Tests 643 passed (643)` |
+| `floor-tests` | 0 | `node --test` over the `.mjs`/`.cjs` floor suite — `ℹ tests 765 · pass 765 · fail 0` |
+| `validate` | 0 | `FLOOR: GREEN — 0 capabilities checked in .` |
+| `lint` | 0 | eslint, `--max-warnings 0` |
+| `format:check` | 0 | prettier |
+| `lint:md` | 0 | markdownlint-cli2 |
+
+Every exit code above was recorded only **after** its log was checked for a real completion signal. That is not ceremony: during `/pharn-dev-regress` two separate harness bugs produced a plausible-looking `1` from a gate that had **never executed** (zsh not word-splitting an unquoted list, then macOS `xargs` lacking `-a`). A capture that never ran is indistinguishable from one that ran and failed, by exit code alone.
+
+### `floor-tests` was ADDED to the gate set, and why that matters
+
+`vitest.config.ts:6` sets `include: ['tests/**/*.test.ts']`. So `npm test` collects **only** `tests/*.test.ts` — and this feature's own test, **`.dev/floor/check-soft-tier.test.mjs` (17 cases)**, is collected by **none** of the standard gates. A PASS assembled from the documented set would have implied coverage of the increment's own tests that it did not have.
+
+The stage's own doc says the gate **set** is *advisory orchestration* — `check-verify.mjs` is generic over gate keys — so composing one more gate in is sanctioned, and `/pharn-dev-verify` still "invents none": `floor-tests` is verbatim the command `.github/workflows/floor.yml` already runs in CI.
+
+Stated honestly, per the two-clocks rule: **the verdict now covers this feature's own tests because I composed that gate in, not because anything floor-locks it there.** A future run that omits `floor-tests` would still report PASS.
+
+> **Reported, not fixed (outside this increment's whitelist):** the command doc asserts that `npm test` "auto-collects via its `**/*.test.mjs` glob." That is the generic pharn-oss framing and is **false in pharn-cli**, whose vitest include is `tests/**/*.test.ts`. Any increment whose tests live in `.mjs` is silently unverified by the documented gate set. The human's call — `.claude/commands/pharn-dev-verify.md` is not mine to edit here.
+
+No `structural:*` gate appears: no `<cap>/evals/expected/*.json` exists in this repo (the single `evals/expected` path is a `.md` fixture under `.dev/floor/test-fixtures/`), so the feature ships no committed eval pair — the same absence `/pharn-dev-regress` recorded.
+
+## ADVISORY layer — verifiers
+
+`node .dev/floor/count-verifiers.mjs .` → `{"registered":0,"verifiers":[]}`.
+
+**No verifiers registered — floor gates only.** Step 2 is a no-op, no `claude -p` call was made, and no untrusted verifier free-text exists in this run. None is authored speculatively (P7).
+
+## Verdict
+
+**VERIFIED: floor gates PASS.** (`check-verify.mjs` exit **0**, `"verdict": "PASS"`, `failing_gates: []` — see `verify-report.json`.)
+
+**Honest residual:** verified = **the named gates passed**; this is **NOT** a guarantee of correctness beyond what those gates check — verifier concerns are advisory help, not assurance, and there are none today.
+
+Two specific things the gates above do **not** cover, named because this increment's whole subject is the difference between a check that runs and a check that only appears to:
+
+1. **The matrix itself is not verified by any local gate.** No gate here executes on Windows, macOS, or Node 22/24. The execution proof is external and empirical: five green cells on PR #91 run `31521684401`.
+2. **The R1 fix's blocking branch is unreachable on POSIX.** `readDiskState`'s `parentBlocks` true-branch cannot be reached on macOS/Linux, because `lstatSync` raises `ENOTDIR` and short-circuits first. So the 643 vitest tests passing locally say **nothing** about the fix. Its only regression test is the Windows CI cell — which is the point of the increment, and is now permanent.
diff --git a/.dev/features/ci-matrix-os-node/regression-report.json b/.dev/features/ci-matrix-os-node/regression-report.json
new file mode 100644
index 0000000..c84086b
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/regression-report.json
@@ -0,0 +1,36 @@
+{
+  "base": "21db522c0fe23c30c53510b954cccd4e34662e83",
+  "inside": [
+    ".dev/floor/check-soft-tier.mjs",
+    ".dev/floor/check-soft-tier.test.mjs",
+    ".gitattributes",
+    ".github/workflows/ci.yml",
+    "CHANGELOG.md",
+    "src/lib/apply-update.ts"
+  ],
+  "outside_gates": {
+    "format:check": {
+      "base": 0,
+      "head": 0
+    },
+    "lint": {
+      "base": 0,
+      "head": 0
+    },
+    "lint:md": {
+      "base": 0,
+      "head": 0
+    },
+    "tests": {
+      "base": 0,
+      "head": 0
+    },
+    "validate": {
+      "base": 0,
+      "head": 0
+    }
+  },
+  "regressions": [],
+  "pre_existing": [],
+  "verdict": "no-regressions"
+}
diff --git a/.dev/features/ci-matrix-os-node/verify-report.json b/.dev/features/ci-matrix-os-node/verify-report.json
new file mode 100644
index 0000000..ec991d0
--- /dev/null
+++ b/.dev/features/ci-matrix-os-node/verify-report.json
@@ -0,0 +1,14 @@
+{
+  "feature": "ci-matrix-os-node",
+  "gates": {
+    "floor-tests": 0,
+    "format:check": 0,
+    "lint": 0,
+    "lint:md": 0,
+    "test": 0,
+    "validate": 0
+  },
+  "verdict": "PASS",
+  "failing_gates": [],
+  "verifiers": { "registered": 0, "findings": [] }
+}
diff --git a/.dev/floor/check-run-pins.test.mjs b/.dev/floor/check-run-pins.test.mjs
index 3e3b561..93399f2 100644
--- a/.dev/floor/check-run-pins.test.mjs
+++ b/.dev/floor/check-run-pins.test.mjs
@@ -368,9 +368,9 @@ test("★ the live repo has NO floating install in any workflow run: line", () =
   assert.deepEqual(d.violations, [], `unexpected violations: ${JSON.stringify(d.violations)}`);
   assert.equal(r.status, 0);
 
-  // `npm ci` in ci.yml and publish.yml — asserted EXACTLY, so an exemption can never become a
-  // silent hole. If this number changes, a lockfile install was added or removed on purpose.
-  assert.equal(d.skipped, 2);
+  // `npm ci` in ci.yml (one per gate job) and publish.yml — asserted EXACTLY, so an exemption can
+  // never become a silent hole. If this number changes, a lockfile install was added or removed on purpose.
+  assert.equal(d.skipped, 7);
 
   // Independent recount of the enumerated workflow files, case-insensitively — exit 0 is also what
   // a checker returns when it opened nothing.
diff --git a/.dev/floor/check-soft-tier.mjs b/.dev/floor/check-soft-tier.mjs
new file mode 100644
index 0000000..df911a4
--- /dev/null
+++ b/.dev/floor/check-soft-tier.mjs
@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+// .dev/floor/check-soft-tier.mjs — deterministic floor check over the GitHub Actions definitions
+// this repo executes: NO job, step, or matrix cell may declare `continue-on-error`.
+//
+// NON-LLM, dependency-free (Node stdlib only). No network, no child_process, no eval, no dynamic import.
+//
+// WHY IT EXISTS (P7 — a real triggering need, not a hypothetical): the OS×Node matrix landed five
+// cells, four of which had never executed a test. The standing temptation when one goes red is to
+// mark it `continue-on-error: true` and call it "experimental" — which produces a YELLOW cell: a
+// check that renders as present, gates nothing, and reads to every future contributor as covered.
+// A yellow cell is a lie with extra steps. Before this file, "no soft tier" was DISCIPLINE — a
+// sentence in a build brief that nothing enforced. This is the fence.
+//
+// WHAT IS GUARANTEED (P0 — floor primitive #3, enum/regex; ARCHITECTURE.md §2):
+//   the ABSENCE of a `continue-on-error` key on every line this scanner ENUMERATES.
+// WHAT IS NOT (named residuals, never claimed):
+//   • R1 — "GATES THE MERGE" IS A REPO-SETTINGS PROPERTY, NOT A FILE PROPERTY. This gate proves no
+//     workflow ASKS to be soft. It cannot read branch protection, so a job simply left OUT of the
+//     required-checks list is invisible here and is soft in the only way that finally matters.
+//     Nothing in .github/** can close this; it is closed by a human in Settings → Branches.
+//   • R2 — SHELL-LEVEL SWALLOWING. `run: npm test || true`, `set +e`, a trailing `|| exit 0` — a
+//     soft tier written in bash instead of YAML. Recognising it means deciding whether a shell
+//     fragment neutralises an exit code, which is a CLASSIFICATION (P5 forbids). Out of contract by
+//     construction, not by oversight.
+//   • R3 — ENUMERATOR DUPLICATION. collectFiles/safeLstat/isYaml/LINE_SPLIT_RE/emit are duplicated
+//     from check-action-pins.mjs. A shared module was rejected for the reason check-run-pins.mjs
+//     already records as its own R2: NO floor script imports another, and that isolation is a safety
+//     property (one module's bug cannot take down two gates). check-soft-tier.test.mjs cross-checks
+//     that this scanner and check-action-pins.mjs enumerate the SAME files[] for this repo, so the
+//     three walkers cannot drift silently.
+//   • R4 — `if:` CONDITIONS ARE NOT READ. This repo's six gates deliberately use
+//     `if: always() && steps.install.outcome == 'success'`, which is honest: the step still fails the
+//     job. A hostile `if:` that routes around failure is not distinguishable from that honest one
+//     without classification. Only the `continue-on-error` key is in contract.
+//
+// WHAT IT ENUMERATES — identical to check-action-pins.mjs, and for the identical reason (both are
+// executed by GitHub, so both are in scope):
+//   1. `.github/workflows/*.{yml,yaml}` — non-recursive, mirroring GitHub (files in subdirectories
+//      of that folder are not workflows).
+//   2. `.github/actions/**/action.{yml,yaml}` — LOCAL composite action definitions, walked
+//      recursively. A composite action's steps can carry `continue-on-error` too, so scanning only
+//      workflows would leave the same laundering path `uses:` had before that walk was added.
+//
+// Usage:  node .dev/floor/check-soft-tier.mjs [targetDir]      (default: cwd)
+// Output: {"checked":<int>,"lines":<int>,"files":[...],"violations":[{file,line,value,reason}]}
+// Exit:   0 clean · 1 >=1 violation
+//
+// `checked` counts FILES and `lines` counts LINES — not violations, which are zero in a healthy
+// repo and therefore useless as an anti-vacuity bound. `lines` is the stronger of the two: it proves
+// the scanner actually READ content rather than merely stat-ing a directory.
+//
+// Every output field is enum-gated / path-resolved (paths, ints, an enum `reason`). The `value` is
+// copied verbatim from the scanned file, so it inherits that file's trust — but NO decision reads
+// it: the verdict is `violations.length > 0`, an integer test (P2, fix #1). See VALUE-BLINDNESS.
+
+import { readFileSync, readdirSync, existsSync, lstatSync } from "node:fs";
+import { join, sep } from "node:path";
+
+// Split on ALL THREE line-ending conventions. Splitting on "\n" alone leaves a trailing "\r" on
+// every line of a CRLF file, which defeats any line-anchored match — the exact fail-OPEN
+// check-action-pins.mjs documents at its own LINE_SPLIT_RE. The repo now ships `.gitattributes`
+// (`* text=auto eol=lf`), which kills that class at checkout for TRACKED files; this stays because
+// a scanner must not depend on a policy file remaining present to be correct.
+const LINE_SPLIT_RE = /\r\n|\r|\n/;
+
+// A `continue-on-error` key ANYWHERE in the line — deliberately NOT anchored to line start, because
+// `- { os: x, continue-on-error: true }` and `jobs: {j: {continue-on-error: true}}` are valid YAML
+// that GitHub honours and an anchored regex never sees.
+//
+// The leading `(?:^|[\s,{[])` is what stops a longer key that merely ENDS in the same text
+// (`my-continue-on-error:`) from matching — `-` is not in that character class.
+//
+// Deliberate imprecision, in the fail-CLOSED direction: a `run:` line whose text happens to contain
+// `continue-on-error:` is reported. Noise a human resolves in one look; a missed soft tier is not.
+const SOFT_KEY_RE = /(?:^|[\s,{[])["']?continue-on-error["']?\s*:\s*([^,}\]]*)/g;
+
+// Reasons are an ENUM, never prose (P5 — membership, not classification).
+const REASON = {
+  SOFT_TIER: "soft-tier-declared", // a continue-on-error key is present, whatever its value
+  UNREADABLE: "unreadable-file", // could not stat/read (e.g. a dangling symlink)
+};
+
+function emit(obj, code) {
+  // NOT process.exit(): stdout is ASYNC on a pipe, and exiting truncates it. Setting exitCode lets
+  // the write drain and Node exit naturally — the lesson check-action-pins.mjs records at its emit().
+  process.stdout.write(JSON.stringify(obj) + "\n");
+  process.exitCode = code;
+}
+
+const isYaml = (f) => /\.ya?ml$/i.test(f); // case-INsensitive: `CI.YML` must not be silently dropped
+
+// lstat, not stat: a DANGLING symlink makes stat throw ENOENT, which would crash the walk before
+// any JSON is emitted.
+function safeLstat(abs) {
+  try {
+    return lstatSync(abs);
+  } catch {
+    return null;
+  }
+}
+
+// Enumerate every file GitHub would execute. Returns readable {rel, abs} pairs plus unreadable ones.
+function collectFiles(target) {
+  const found = [];
+  const unreadable = [];
+
+  // 1. workflows — flat, mirroring what GitHub actually executes.
+  const wfRel = join(".github", "workflows");
+  const wfDir = join(target, wfRel);
+  if (existsSync(wfDir)) {
+    let names = [];
+    try {
+      names = readdirSync(wfDir).sort();
+    } catch {
+      unreadable.push({ rel: wfRel, abs: wfDir });
+    }
+    for (const name of names) {
+      if (!isYaml(name)) continue;
+      const abs = join(wfDir, name);
+      const st = safeLstat(abs);
+      if (st === null || st.isSymbolicLink()) {
+        unreadable.push({ rel: join(wfRel, name), abs });
+        continue;
+      }
+      if (st.isFile()) found.push({ rel: join(wfRel, name), abs });
+    }
+  }
+
+  // 2. local action definitions — recursive, depth-bounded, symlink-refusing.
+  const walk = (absDir, relDir, depth) => {
+    if (depth > 8) return; // bounded: a pathological tree cannot hang the floor
+    let names = [];
+    try {
+      names = readdirSync(absDir).sort();
+    } catch {
+      unreadable.push({ rel: relDir, abs: absDir });
+      return;
+    }
+    for (const name of names) {
+      const abs = join(absDir, name);
+      const rel = join(relDir, name);
+      const st = safeLstat(abs);
+      if (st === null) {
+        unreadable.push({ rel, abs });
+        continue;
+      }
+      if (st.isSymbolicLink()) continue; // never follow a symlink out of the tree
+      if (st.isDirectory()) walk(abs, rel, depth + 1);
+      else if (st.isFile() && /^action\.ya?ml$/i.test(name)) found.push({ rel, abs });
+    }
+  };
+  const actRel = join(".github", "actions");
+  const actDir = join(target, actRel);
+  if (existsSync(actDir)) walk(actDir, actRel, 0);
+
+  return { found, unreadable };
+}
+
+// Pull EVERY continue-on-error declaration out of one line. Returns [] when the line declares none.
+//
+// VALUE-BLINDNESS IS THE DESIGN, NOT AN OVERSIGHT. `continue-on-error: false` is rejected alongside
+// `true`, for three reasons: (1) reading the value would make the verdict depend on untrusted file
+// content, where `violations.length > 0` depends on nothing; (2) `false` restates a default and buys
+// nothing, while sitting one character from `true` in a future diff; (3) it catches the
+// experimental-cell laundering shape `continue-on-error: ${{ matrix.experimental }}` without this
+// scanner ever having to learn what `matrix.experimental` is. The value is CAPTURED for the human's
+// report and never consulted for the verdict.
+function parseSoftTier(raw) {
+  if (raw.trimStart().startsWith("#")) return []; // a commented-out example is not a declaration
+
+  const out = [];
+  SOFT_KEY_RE.lastIndex = 0; // the regex is /g and shared: reset before each line
+  let m;
+  while ((m = SOFT_KEY_RE.exec(raw)) !== null) {
+    out.push(m[1].trim());
+  }
+  return out;
+}
+
+function main() {
+  const target = process.argv[2] || process.cwd();
+  const { found, unreadable } = collectFiles(target);
+
+  const violations = [];
+  let lines = 0;
+
+  // An entry we cannot read is a VIOLATION, not a skip: "I could not look" must never render as
+  // "there was nothing to find".
+  for (const u of unreadable) {
+    violations.push({ file: u.rel.split(sep).join("/"), line: 0, value: "", reason: REASON.UNREADABLE });
+  }
+
+  for (const f of found) {
+    const rel = f.rel.split(sep).join("/");
+    let fileLines;
+    try {
+      fileLines = readFileSync(f.abs, "utf8").split(LINE_SPLIT_RE);
+    } catch {
+      violations.push({ file: rel, line: 0, value: "", reason: REASON.UNREADABLE });
+      continue;
+    }
+    lines += fileLines.length;
+
+    fileLines.forEach((raw, i) => {
+      for (const value of parseSoftTier(raw)) {
+        violations.push({ file: rel, line: i + 1, value, reason: REASON.SOFT_TIER });
+      }
+    });
+  }
+
+  emit(
+    {
+      checked: found.length,
+      lines,
+      files: found.map((f) => f.rel.split(sep).join("/")),
+      violations,
+    },
+    violations.length > 0 ? 1 : 0,
+  );
+}
+
+main();
diff --git a/.dev/floor/check-soft-tier.test.mjs b/.dev/floor/check-soft-tier.test.mjs
new file mode 100644
index 0000000..75c7e8b
--- /dev/null
+++ b/.dev/floor/check-soft-tier.test.mjs
@@ -0,0 +1,264 @@
+// .dev/floor/check-soft-tier.test.mjs — tests for the no-soft-tier floor gate.
+//
+// Two kinds of test live here, and the split is deliberate:
+//   1. HERMETIC — scratch repos on disk, exercising the contract without touching this repo.
+//   2. LIVE REPO-CONSISTENCY (the ★ at the bottom) — validates the COMMITTED tree against REALITY.
+//      Retained as an anti-vacuity residual on top of two outer wires (both must stay):
+//        (a) floor.yml shells `node .dev/floor/check-soft-tier.mjs .` directly — enforcement lives
+//            outside the scanned `.github/workflows` / `.github/actions` surface, not in ci.yml;
+//        (b) the `main protection` ruleset requires the `floor` status check on merge.
+//      Delete the ★ block and a PR could still remove both outer wires while hermetic fixtures pass.
+//      Do not delete it.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readdirSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const here = dirname(fileURLToPath(import.meta.url)); // .dev/floor
+const REPO = join(here, "..", ".."); // repo root
+const CAP = join(here, "check-soft-tier.mjs");
+const SIBLING = join(here, "check-action-pins.mjs");
+
+function run(targetDir, capPath = CAP) {
+  return spawnSync(process.execPath, [capPath, targetDir], { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function json(r) {
+  return JSON.parse(r.stdout);
+}
+function scratch() {
+  return mkdtempSync(join(tmpdir(), "pharn-softtier-"));
+}
+function reasons(r) {
+  return json(r).violations.map((v) => v.reason);
+}
+
+// A scratch repo whose single workflow contains `body` verbatim under a steps: list.
+function repoWith(body, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), `name: t\njobs:\n  j:\n    steps:\n${body}\n`);
+  return root;
+}
+// The same, but writing the file bytes exactly as given (for line-ending fixtures).
+function repoWithRaw(bytes, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), bytes);
+  return root;
+}
+
+// --- the clean case ---------------------------------------------------------------------------
+
+test("a workflow with no continue-on-error is clean", () => {
+  const root = repoWith(`      - name: Test\n        run: npm test\n`);
+  const r = run(root);
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r).violations, []);
+  // Anti-vacuity: it must have READ the file, not merely stat-ed the directory.
+  assert.equal(json(r).checked, 1);
+  assert.ok(json(r).lines > 3, `expected lines read, got ${json(r).lines}`);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("an empty repo is clean but reports having checked nothing", () => {
+  const root = scratch();
+  const r = run(root);
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+  assert.equal(json(r).lines, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// --- the violation, and its VALUE-BLINDNESS ----------------------------------------------------
+
+test("continue-on-error: true on a step is a violation carrying file and line", () => {
+  const root = repoWith(`      - name: Flaky\n        continue-on-error: true\n        run: npm test\n`);
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["soft-tier-declared"]);
+  assert.equal(json(r).violations[0].file, ".github/workflows/ci.yml");
+  assert.equal(json(r).violations[0].line, 6); // name,jobs,  j:,    steps:,  - name:,  continue-on-error
+  assert.equal(json(r).violations[0].value, "true");
+  rmSync(root, { recursive: true, force: true });
+});
+
+// This is the test that PINS the design decision. `false` is a no-op that restates a default, so a
+// future contributor will reasonably want to allow it — at which point the verdict starts depending
+// on an untrusted file's VALUE instead of on an integer count. If that relaxation is ever wanted, it
+// must be an argued change that breaks this test, never a quiet one.
+test("continue-on-error: false is ALSO a violation — the scanner is value-blind by design", () => {
+  const root = repoWith(`      - name: Honest\n        continue-on-error: false\n        run: npm test\n`);
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["soft-tier-declared"]);
+  assert.equal(json(r).violations[0].value, "false");
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("the experimental-cell laundering shape is caught without interpreting the expression", () => {
+  const root = repoWith(`      - name: Maybe\n        continue-on-error: \${{ matrix.experimental }}\n        run: npm test\n`);
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["soft-tier-declared"]);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a job-level and a flow-mapping declaration are both seen", () => {
+  const root = repoWithRaw(
+    `name: t\njobs:\n  a:\n    continue-on-error: true\n  b: { continue-on-error: true }\n`,
+  );
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.equal(json(r).violations.length, 2);
+  assert.deepEqual(
+    json(r).violations.map((v) => v.line),
+    [4, 5],
+  );
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a quoted key does not smuggle a soft tier past the scanner", () => {
+  const root = repoWith(`      - name: Q\n        "continue-on-error": true\n        run: npm test\n`);
+  assert.equal(run(root).status, 1);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a CRLF file is scanned line-by-line, not collapsed", () => {
+  const root = repoWithRaw(`name: t\r\njobs:\r\n  j:\r\n    continue-on-error: true\r\n`);
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.equal(json(r).violations[0].line, 4);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// --- what must NOT be flagged ------------------------------------------------------------------
+
+test("a commented-out example is not a declaration", () => {
+  const root = repoWith(`      # continue-on-error: true\n      - run: npm test\n`);
+  assert.equal(run(root).status, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a longer key merely ENDING in the same text does not match", () => {
+  const root = repoWith(`      - name: N\n        my-continue-on-error: true\n        run: npm test\n`);
+  assert.equal(run(root).status, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// --- enumeration boundaries --------------------------------------------------------------------
+
+test("a non-YAML file in the workflows dir is not scanned", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", "notes.md"), "continue-on-error: true\n");
+  const r = run(root);
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a file in a SUBDIRECTORY of workflows/ is not a workflow (mirrors GitHub)", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows", "nested"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", "nested", "x.yml"), "continue-on-error: true\n");
+  const r = run(root);
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// The laundering path: exempting composite actions would let a soft tier live one `uses:` away.
+test("a composite action definition IS walked", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "actions", "setup"), { recursive: true });
+  writeFileSync(
+    join(root, ".github", "actions", "setup", "action.yml"),
+    `name: s\nruns:\n  using: composite\n  steps:\n    - continue-on-error: true\n      run: x\n      shell: bash\n`,
+  );
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.equal(json(r).violations[0].file, ".github/actions/setup/action.yml");
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("an uppercase .YML extension is scanned", () => {
+  const root = repoWith(`      - continue-on-error: true\n`, { name: "CI.YML" });
+  assert.equal(run(root).status, 1);
+  rmSync(root, { recursive: true, force: true });
+});
+
+
+// --- unreadable scan roots ---------------------------------------------------------------------
+
+test("an unreadable workflows directory is a violation, not a silent skip", () => {
+  const root = scratch();
+  const dir = join(root, ".github", "workflows");
+  mkdirSync(dir, { recursive: true });
+  chmodSync(dir, 0o000);
+  try {
+    const r = run(root);
+    assert.equal(r.status, 1);
+    assert.deepEqual(reasons(r), ["unreadable-file"]);
+    assert.equal(json(r).violations[0].file, ".github/workflows");
+  } finally {
+    chmodSync(dir, 0o700);
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("an unreadable actions directory is a violation, not a silent skip", () => {
+  const root = scratch();
+  const dir = join(root, ".github", "actions");
+  mkdirSync(dir, { recursive: true });
+  chmodSync(dir, 0o000);
+  try {
+    const r = run(root);
+    assert.equal(r.status, 1);
+    assert.deepEqual(reasons(r), ["unreadable-file"]);
+    assert.equal(json(r).violations[0].file, ".github/actions");
+  } finally {
+    chmodSync(dir, 0o700);
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// --- ★ LIVE REPO-CONSISTENCY — the committed tree, not a fixture -------------------------------
+
+test("★ this repo declares no soft tier", () => {
+  const r = run(REPO);
+  assert.equal(r.status, 0, `soft tier declared in this repo:\n${r.stdout}`);
+  assert.deepEqual(json(r).violations, []);
+});
+
+test("★ the live scan is not vacuous — it read every workflow on disk", () => {
+  const j = json(run(REPO));
+  // A LOWER BOUND, so adding a workflow later never silently shrinks coverage.
+  assert.ok(j.checked >= 5, `expected >=5 workflow files scanned, got ${j.checked}`);
+  assert.ok(j.lines > 100, `expected real content read, got ${j.lines} lines`);
+
+  const onDisk = readdirSync(join(REPO, ".github", "workflows"))
+    .filter((f) => /\.ya?ml$/i.test(f))
+    .sort()
+    .map((f) => `.github/workflows/${f}`);
+  assert.deepEqual(
+    j.files.filter((f) => f.startsWith(".github/workflows/")),
+    onDisk,
+  );
+});
+
+// R3 anti-drift: the enumerator is duplicated from check-action-pins.mjs on purpose (no floor script
+// imports another). This is what stops the two copies from diverging in silence.
+test("★ this scanner and check-action-pins.mjs enumerate the SAME files", () => {
+  assert.deepEqual(json(run(REPO)).files, json(run(REPO, SIBLING)).files);
+});
+
+// DELIBERATELY ABSENT: a test asserting ci.yml contains "windows-latest" / "macos-latest" /
+// "fail-fast: false". The plan (`## Evals to write`) rules that out as a tautology wearing a test's
+// clothes — it asserts the file says what the file says, which is the "written in the config"
+// mistaken for "guaranteed" disease (P0). The matrix's execution proof is the five green cells on
+// the PR, an observed artifact, not a string match. Recorded here so its absence reads as a
+// decision rather than an oversight.
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..6313b56
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 35ea667..928d492 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,37 +8,118 @@ on:
 permissions:
   contents: read
 
+# Shared 5-cell matrix — pinned once so every gate job fans out identically.
+x-ci-matrix: &ci-matrix
+  fail-fast: false
+  matrix:
+    include:
+      - { os: ubuntu-latest, node: 20 }
+      - { os: ubuntu-latest, node: 22 }
+      - { os: ubuntu-latest, node: 24 }
+      - { os: windows-latest, node: 24 }
+      - { os: macos-latest, node: 24 }
+
 jobs:
-  check:
-    runs-on: ubuntu-latest
+  format-check:
+    # Explicit name pins check identity to gate + cell so branch protection can
+    # require each gate independently (not one combined check job per cell).
+    name: Format check (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: ${{ matrix.node }}
           cache: npm
       - name: Install
-        id: install
         run: npm ci
-      # Run each gate independently so one failure can't mask the others, but skip
-      # them cleanly if install failed — no cascade of misleading "deps missing" errors.
       - name: Format check
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run format:check
+
+  lint:
+    name: Lint (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - name: Install
+        run: npm ci
       - name: Lint
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run lint
+
+  markdown-lint:
+    name: Markdown lint (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - name: Install
+        run: npm ci
       - name: Markdown lint
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run lint:md
+
+  typecheck:
+    name: Typecheck (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - name: Install
+        run: npm ci
       - name: Typecheck
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run typecheck
+
+  test:
+    name: Test (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - name: Install
+        run: npm ci
       - name: Test
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run test:coverage
+
+  build:
+    name: Build (${{ matrix.os }} / node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy: *ci-matrix
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - name: Install
+        run: npm ci
       - name: Build
-        if: ${{ always() && steps.install.outcome == 'success' }}
         run: npm run build
diff --git a/.github/workflows/floor.yml b/.github/workflows/floor.yml
index 1e59ee5..9ef6d06 100644
--- a/.github/workflows/floor.yml
+++ b/.github/workflows/floor.yml
@@ -26,5 +26,7 @@ jobs:
         # Explicit globs (mirrors `npm test`): bare `node --test` skips the
         # dot-directory, which would silently drop the write-guard hook test.
         run: node --test "**/*.test.mjs" "**/*.test.cjs" ".claude/**/*.test.cjs" ".claude/**/*.test.mjs" ".dev/**/*.test.cjs" ".dev/**/*.test.mjs"
+      - name: No soft tier
+        run: node .dev/floor/check-soft-tier.mjs .
       - name: Validate floor
         run: node .dev/floor/validate.mjs .
diff --git a/.pharn/pharn-dev-regress/base-results.json b/.pharn/pharn-dev-regress/base-results.json
index d4c2fb0..f81ae35 100644
--- a/.pharn/pharn-dev-regress/base-results.json
+++ b/.pharn/pharn-dev-regress/base-results.json
@@ -1 +1 @@
-{"tests":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
+{"tests":0,"validate":0,"format:check":0,"lint":0,"lint:md":0}
diff --git a/.pharn/pharn-dev-regress/head-results.json b/.pharn/pharn-dev-regress/head-results.json
index d4c2fb0..f81ae35 100644
--- a/.pharn/pharn-dev-regress/head-results.json
+++ b/.pharn/pharn-dev-regress/head-results.json
@@ -1 +1 @@
-{"tests":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
+{"tests":0,"validate":0,"format:check":0,"lint":0,"lint:md":0}
diff --git a/.pharn/pharn-dev-verify/results.json b/.pharn/pharn-dev-verify/results.json
index c1e0603..ae37bf8 100644
--- a/.pharn/pharn-dev-verify/results.json
+++ b/.pharn/pharn-dev-verify/results.json
@@ -1 +1 @@
-{"test":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
+{"test":0,"floor-tests":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
diff --git a/.pharn/writes-scope.json b/.pharn/writes-scope.json
index 70a3321..11c352f 100644
--- a/.pharn/writes-scope.json
+++ b/.pharn/writes-scope.json
@@ -1,7 +1,7 @@
 {
   "scope": [
-    ".dev/features/lint-gate-no-soft-tier/SHIP.md"
+    ".dev/features/ci-matrix-os-node/SHIP.md"
   ],
   "set_by": ".claude/commands/pharn-dev-ship.md",
-  "set_at": "2026-08-11T14:10:24.724Z"
+  "set_at": "2026-08-12T08:42:51.545Z"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c31305..2595736 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **On Windows, `pharn status` called a path Missing that cannot exist, and `pharn update` crashed
+  trying to restore it.** When a regular file squats where a directory belongs, POSIX reports
+  `ENOTDIR` for anything underneath it while **Windows reports `ENOENT`** — the same code the
+  filesystem uses for "simply not there". `readDiskState` suppressed `ENOENT` (via
+  `lstatSync`'s `throwIfNoEntry: false`) and so classified a blocked path as `absent`: `status`
+  listed it under **Missing**, implying it could be restored, and `update` then planned that restore
+  and **exited 1** instead of emitting the named skip. The whole "Unreadable" drift category below
+  was POSIX-only correct from the day it shipped. The absent-vs-unreadable split no longer reads the
+  errno at all — it asks the filesystem what the parent components actually **are**, which answers
+  identically on every platform. A symlinked parent is deliberately still **not** blocking: refusing
+  to write through a symlink stays `applyWrites`' job, so the partial-failure record contract is
+  unchanged. Found by the new Windows CI cell on its first run.
+
 - **`pharn status` no longer crashes on a path it cannot read, and no longer misreports what sits
   there.** The drift check read your project with its own bare `existsSync` / `readFileSync`, which
   went wrong four ways. A **directory** where a file belongs threw `EISDIR` out of the middle of the
@@ -62,6 +75,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **CI now runs the suite on Windows, macOS, and Node 20/22/24 — and the source bytes are pinned to
+  LF.** Every gate used to execute on exactly one cell, `ubuntu-latest` × Node 20, while `publish.yml`
+  built the shipped artifact on Node 24 — so the release ran a Node no test had ever seen, and the
+  riskiest surface in the repo (`safeJoin`/`toPosix` path handling, the symlink fixtures across
+  `apply-update`/`backup`/`install-capabilities`, records byte-equality, the spawn-based self-tests)
+  had never touched a non-Linux filesystem. `ci.yml` is now a five-cell matrix — `ubuntu-latest` ×
+  {20, 22, 24} plus `windows-latest` and `macos-latest` on 24, the Node the release ships — with
+  `fail-fast: false`, so a red cell produces a full failure table instead of aborting its siblings.
+  Each cell runs the same six independent gates as before. A new `.gitattributes` (`* text=auto
+  eol=lf`) makes checked-out bytes deterministic on every OS, which matters because the suite now
+  contains tests that read the repo's own tracked files; it is a **no-op renormalization** today
+  (zero CRLF in tracked files), and it removes at the source the class that `check-action-pins.mjs`
+  had already been forced to defend against per-scanner. Repo tooling only — no product behavior
+  changes.
+- **A floor gate for "no soft tier".** `.dev/floor/check-soft-tier.mjs` refuses any
+  `continue-on-error` key in `.github/workflows/*.{yml,yaml}` or `.github/actions/**/action.{yml,yaml}`
+  — the value is never read, so `false` and `${{ matrix.experimental }}` are refused alongside `true`
+  and the verdict stays an integer count rather than a judgment about untrusted file content. The
+  rule existed before as a convention; a five-cell matrix makes "just mark the red one experimental"
+  a standing temptation, and a check that renders as present while gating nothing is worse than no
+  check at all. Enforcement is wired outside the scanned workflow tree: `floor.yml` runs the scanner
+  directly, the `floor` job is a required status check on `main`, and the `★` live-repo block in
+  `check-soft-tier.test.mjs` is retained as an anti-vacuity residual on top. Named residuals, not
+  claimed closed: other jobs left out of the required-checks list are still soft in the only way that
+  finally matters, and the scanner does not read shell-level swallowing such as `|| true`.
 - **`pharn update --yes` (`-y`) — a real flag, for CI and scripts.** It skips **the confirmation prompt
   and nothing else**: the version note still prints, the same per-file decision table applies, files you
   edited are still skipped rather than overwritten, the recorded version is still withheld when anything
diff --git a/src/lib/apply-update.ts b/src/lib/apply-update.ts
index a540ba0..c35caed 100644
--- a/src/lib/apply-update.ts
+++ b/src/lib/apply-update.ts
@@ -36,6 +36,45 @@ export class ApplyError extends Error {
   }
 }
 
+/**
+ * Does a component of `rel` exist but not as a directory, so that `rel` CANNOT
+ * exist? Only components BELOW `projectRoot` are examined — what sits above the
+ * root is not pharn's business and may legitimately be unreadable.
+ *
+ * Errno-free on purpose: it observes what the components ARE rather than what
+ * failing to stat one reported, so it answers identically on every platform.
+ * A component that cannot be inspected at all counts as blocking — "I could not
+ * look" must never render as "there was nothing there".
+ */
+function parentBlocks(projectRoot: string, rel: string): boolean {
+  // Walk segments outward-in from the root, the same way `assertNoSymlinkPath`
+  // below does — an outer component being a file is the REASON an inner one
+  // cannot be inspected, so the outermost answer is the true one. Segment-walking
+  // also keeps containment structural (`safeJoin` per step) rather than resting on
+  // a lexical prefix compare, which would confuse `/a/b` with `/a/bc`.
+  const segments = rel.split('/').filter((s) => s.length > 0);
+  let current = '';
+  for (const segment of segments.slice(0, -1)) {
+    current = current ? `${current}/${segment}` : segment;
+    let st;
+    try {
+      st = lstatSync(safeJoin(projectRoot, current), { throwIfNoEntry: false });
+    } catch {
+      return true;
+    }
+    if (!st) return false; // a genuinely missing directory — the path is absent, not blocked
+    // A SYMLINKED parent is deliberately not blocking. It does not mean the path
+    // cannot exist — refusing to write THROUGH a symlink is `applyWrites`' job
+    // (see the trust note at the top of this file), and deciding it here would
+    // turn a planned write into a silent skip and dissolve the ApplyError
+    // contract. When the link points at a file, the lstat above already raises
+    // ENOTDIR on POSIX and this function is never consulted.
+    if (st.isSymbolicLink()) continue;
+    if (!st.isDirectory()) return true;
+  }
+  return false;
+}
+
 /**
  * Classify what the project holds at `rel` — the disk side of the decision
  * table. Never throws: an unhashable path becomes the `unreadable` terminal so
@@ -43,17 +82,31 @@ export class ApplyError extends Error {
  */
 export function readDiskState(projectRoot: string, rel: string): DiskState {
   const dest = safeJoin(projectRoot, rel);
-  // `throwIfNoEntry: false` suppresses ENOENT ONLY — a path whose PARENT is a
-  // regular file raises ENOTDIR, which would crash the whole run instead of
-  // producing the named skip this function promises. Catching keeps the terminal
-  // deterministic (P5): unreadable, reported, never silently overwritten.
+  // Catching keeps the terminal deterministic (P5): unreadable, reported, never
+  // silently overwritten. The `absent` split below is deliberately NOT decided by
+  // errno — see `parentBlocks`.
   let stat;
   try {
     stat = lstatSync(dest, { throwIfNoEntry: false });
   } catch {
     return { kind: 'unreadable', reason: 'the path could not be inspected' };
   }
-  if (!stat) return { kind: 'absent' };
+  // Not found. "Not found" and "cannot exist" are different terminals, and which
+  // errno distinguishes them is PLATFORM-SPECIFIC: POSIX raises ENOTDIR when a
+  // parent component is a regular file, Windows raises ENOENT for that same
+  // situation. Reading the errno therefore classified a blocked path as `absent`
+  // on Windows — so `status` called it Missing (implying it can be restored) and
+  // `update` planned a restore that then crashed. Ask the filesystem what is
+  // actually there instead (P5: a membership test over real components, not an
+  // errno guess). Costs extra lstats only on this already-not-found branch.
+  if (!stat) {
+    return parentBlocks(projectRoot, rel)
+      ? {
+          kind: 'unreadable',
+          reason: 'a parent of the path is not a directory',
+        }
+      : { kind: 'absent' };
+  }
   if (stat.isSymbolicLink()) {
     return { kind: 'unreadable', reason: 'the path is a symlink' };
   }