ci: fold all open simplify PRs into one batch

.github/workflows/ci.yml

@@ -191,6 +191,23 @@ jobs:
           python3 scripts/test-rust-cache-lineage.py
           python3 scripts/check-rust-cache-lineage.py
 
+      # Packager unit tests. They do not need a release binary, so they run
+      # once here instead of once per release matrix target.
+      - name: Test release packagers
+        run: |
+          python3 scripts/test-check-packaged-lsp-bridge.py
+          python3 scripts/test-build-mcpb.py
+          python3 scripts/test-resolve-installed-binary.py
+          python3 scripts/test-check-packaged-mcp-stdio.py
+          python3 scripts/test-check-distribution-feature-wiring.py
+          python3 scripts/test-resolve-release-source-profile.py
+          python3 scripts/test-package-release-archive.py
+          python3 scripts/test-plan-release-recovery.py
+          python3 scripts/test-check-release-artifacts.py
+          bash scripts/test-check-distribution-clean-source.sh
+          bash scripts/test-check-distribution-snapshot.sh
+          bash scripts/test-check-distribution-reuse.sh
+
       # Release guards: drift, safety, installer, PR integrity, bundle check.
       # Pull requests only; the release PR itself is exempt because it is
       # the one change allowed to move the version authorities.
@@ -745,17 +762,11 @@ jobs:
       # `--tests` keeps the binaries in the dev-dependency graph the archive
       # is built from; a `--bins`-only build resolves 60 dependencies with
       # different features and compiles them a second time (see the Linux
-      # lane).
-      - name: Build workspace binaries and tests for the Windows test lane
+      # lane). The host-CLI example is the same `--workspace` resolution;
+      # a second cargo invocation would re-resolve it.
+      - name: Build workspace binaries, tests, and the host-CLI fixture
         shell: pwsh
-        run: cargo build --workspace --bins --tests --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval
-
-      # `--workspace`, not `-p tracedecay-cli`: the package selection decides
-      # feature unification, and the narrower one recompiles the code-index
-      # and extraction crates in a second configuration (see the Linux lane).
-      - name: Build Windows host-CLI test fixture
-        shell: pwsh
-        run: cargo build --workspace --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval
+        run: cargo build --workspace --bins --tests --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval
 
       # The controlled-workload Hotpath parity helpers are provisioned and
       # verified by the `hotpath-parity` job. Building them here would put a
@@ -1047,6 +1058,11 @@ jobs:
           # forks on the local feature while hotpath::io! expands on the backend.
           cargo check --workspace --all-targets --features hotpath/hotpath --locked
 
+      # One graph walk per push. The release resolver repeats it on the tag it
+      # builds, since a release is dispatched without waiting on this run.
+      - name: Check the production feature graph
+        run: python3 scripts/check-production-feature-profile.py
+
   # The configuration users actually receive. `scripts/resolve-release-source-profile.py`
   # resolves the release build to `--no-default-features --features production`
   # on the release profile, and nothing on a push compiled it: `debug-cli` is a

.github/workflows/distribution-acceptance.yml

@@ -57,19 +57,6 @@ jobs:
           echo "TRACEDECAY_SKIP_DASHBOARD_BUILD=1" >> "$GITHUB_ENV"
           echo "TRACEDECAY_DASHBOARD_BUNDLE_SHA256=${digest}" >> "$GITHUB_ENV"
 
-      - name: Validate portable distribution harnesses
-        run: |
-          python3 scripts/test-check-packaged-lsp-bridge.py
-          python3 scripts/test-build-mcpb.py
-          python3 scripts/test-resolve-installed-binary.py
-          python3 scripts/test-check-packaged-mcp-stdio.py
-          python3 scripts/test-check-distribution-feature-wiring.py
-          python3 scripts/test-resolve-release-source-profile.py
-          python3 scripts/test-package-release-archive.py
-          bash scripts/test-check-distribution-clean-source.sh
-          bash scripts/test-check-distribution-snapshot.sh
-          bash scripts/test-check-distribution-reuse.sh
-
       # rust-toolchain.toml is the only compiler this job may install. See
       # release-beta.yml: floating stable fragments rust-cache's env key.
       - name: Resolve pinned toolchain
@@ -96,6 +83,16 @@ jobs:
           mold-version: 2.41.0
           make-default: true
 
+      # The acceptance script runs the packaged suites through nextest, and
+      # the MCP suite's structural-rewrite proof shells out to ast-grep.
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Install ast-grep
+        uses: ./.github/actions/install-ast-grep
+        with:
+          version: "0.44.0"
+
       - name: Build release binary for packaging
         run: cargo build --package tracedecay-cli --bin tracedecay --release --target ${{ env.TARGET }} --no-default-features --features production --locked
 

.github/workflows/release-beta.yml

@@ -134,19 +134,6 @@ jobs:
           digest="$(python3 scripts/check-dashboard-bundle.py dashboard/app-dist --print-digest)"
           echo "TRACEDECAY_DASHBOARD_BUNDLE_SHA256=${digest}" >> "$GITHUB_ENV"
 
-      - name: Validate portable distribution harnesses
-        run: |
-          python3 scripts/test-check-packaged-lsp-bridge.py
-          python3 scripts/test-build-mcpb.py
-          python3 scripts/test-resolve-installed-binary.py
-          python3 scripts/test-check-packaged-mcp-stdio.py
-          python3 scripts/test-check-distribution-feature-wiring.py
-          python3 scripts/test-resolve-release-source-profile.py
-          python3 scripts/test-package-release-archive.py
-          bash scripts/test-check-distribution-clean-source.sh
-          bash scripts/test-check-distribution-snapshot.sh
-          bash scripts/test-check-distribution-reuse.sh
-
       # rust-toolchain.toml is the only compiler this job may install.
       # dtolnay/rust-toolchain@stable also installs floating stable, and
       # rust-cache hashes every rustc into the environment key, so each
@@ -163,13 +150,10 @@ jobs:
           toolchain: ${{ steps.pin.outputs.toolchain }}
           targets: ${{ matrix.target }}
 
-      # Restore before the first cargo invocation. resolve-release-source-profile
-      # runs `cargo tree` twice (~4 min cold on beta.40) and used to do that
-      # before rust-cache, so a warm registry sitting in Actions cache never
-      # reached the step that needed it. Tag runs can restore only same-ref or
-      # default-branch caches; this shared-key must stay stable so a later
-      # master writer can seed them. cache-workspace-crates stays false: the
-      # 10 GB repo budget is already full of CI lineages (~13.8 GB / 28 entries).
+      # Restore before the packaging compile. Tag runs can restore only
+      # same-ref or default-branch caches; this shared-key must stay stable so
+      # a later master writer can seed them. cache-workspace-crates stays
+      # false: the 10 GB repo budget is already full of CI lineages.
       - name: Cache Rust build
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -229,11 +213,6 @@ jobs:
           "$binary" --version
           "$binary" --help >/dev/null
 
-      - name: Get version
-        id: version
-        shell: bash
-        run: echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
-
       - name: Package MCPB
         shell: bash
         run: |
@@ -246,11 +225,11 @@ jobs:
           python3 scripts/build-mcpb.py build \
             --binary "$binary" \
             --output "$bundle" \
-            --version "${{ steps.version.outputs.version }}" \
+            --version "${RELEASE_TAG#v}" \
             --platform "${{ matrix.name }}"
           python3 scripts/build-mcpb.py verify \
             --bundle "$bundle" \
-            --version "${{ steps.version.outputs.version }}" \
+            --version "${RELEASE_TAG#v}" \
             --platform "${{ matrix.name }}"
 
       - name: Verify MCPB runtime (unix)