Estate drift remediation — 2026-05-16 sweep findings

[hyperpolymath]

Tracking parent for systemic drift surfaced during the 2026-05-16 estate sync. Reframes ~10 ad-hoc PRs into deliberate, template-propagated workstreams. Sub-issues below; PRs Refs #N (not Closes); joint-close only on explicit agreement.

Context: the sync touched ~30 repos and revealed the drift is systemic, not per-repo. Remediate via the canonical template repos (rsr-template-repo / v3-templater) + gitbot enforcement, not hand-PRs.

Cross-repo companion (not a sub-issue, different repo): ephapax v2-grammar re-port — filed separately in hyperpolymath/ephapax.

[hyperpolymath]

Autonomous sweep 2026-05-17 — sub-issue status (Refs, not Closes; per protocol left open for joint-close)

Sub	State	Action
#48 upload-artifact bad SHA	Remediated	20 PRs replacing fabricated 65c79d7f… with real v4.6.2 ea165f8d…. Generator already correct (templates clean) — one-time backfill.
#64 unresolvable setup-beam pins	Remediated + generator fixed	standards#75 (21 hypatia-scan.yml), rsr-template-repo#51 + v3-templater#70 (generator source — templates did carry the bad pin).
#55 CODEOWNERS workflow line	Remediated (solo repos)	7 PRs dropping /.github/workflows/ on solo-owned repos (gitbot-fleet, echidna, coq-jr, cloudguard-server, cloudguard-cli, snifs, affinescript-vite). idaptik kept — multi-owner.
#67 npm lockfiles	Template-side done	Both rsr-template-repo & v3-templater .gitignore already carry package-lock.json + **/package-lock.json. Remaining: estate propagation + gitbot reject (epic-ongoing).
#68 .editorconfig/.claude gitignore	Template-side done	Both canonical .gitignore already carry .editorconfig + .claude/. Remaining: propagation (epic-ongoing).
#69 token-in-URL / SSH-only	Policy doc + audit done	standards#76 adds REMOTE-URL-POLICY.adoc. Audit: 0 token-in-URL across 20 ~/dev clones. Remaining: manual gho_ token rotation (owner browser action).

No sub-issue closed — joint-close on explicit agreement per this epic's protocol.