chore(data): merge data into main

knowledge/wiki/entities/esphome.md

@@ -2,8 +2,11 @@
 type: entity
 title: ESPHome
 created: 2026-04-23
-updated: 2026-09-30
+updated: 2026-10-14
 sources:
+  - url: https://github.com/marcusrbrown/esphome.life
+    sha: 878b4225e448152dc63c8a41418812cb466c1fbf
+    accessed: 2026-10-14
   - url: https://github.com/marcusrbrown/esphome.life
     sha: 6852f168e06bce3373901bea9fdb79bf4aee831f
     accessed: 2026-09-30
@@ -77,6 +80,24 @@ The install page's widget is loaded from a hand-written `https://unpkg.com/esp-w
 
 ## Version Pinning
 
+### Distribution contract rechecked (2026-10-14)
+
+At [[marcusrbrown--esphome-life]] commit `878b4225`, the CI workflow and
+devcontainer manifest still pin **2025.12.7**, with `esphome/build-action`
+**v7.4.0**. The September 30 output-forwarding defect persists: the
+`build-firmware` job exports the version, but the `build` completion gate
+declares no outputs, and `publish` reads the version from that gate.
+Compilation and job ordering still cannot establish that the combined
+browser-install manifest carries a valid top-level version.
+
+This is source-level confirmation only. Device configuration bodies,
+generated artifacts, deployed installer behavior, upstream releases, and
+Dependency Dashboard state were not read. The older approval-gate and CDN
+dependency findings below retain their original observation dates.
+
+Sources: [CI workflow](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.github/workflows/ci.yaml),
+[devcontainer manifest](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.devcontainer.json).
+
 ### Firmware build success does not validate distribution metadata (2026-09-30)
 
 At [[marcusrbrown--esphome-life]] commit `6852f168`, the CI and devcontainer

knowledge/wiki/repos/bfra-me--github.md

@@ -2,7 +2,7 @@
 type: repo
 title: bfra-me/.github
 created: 2026-05-20
-updated: 2026-09-29
+updated: 2026-10-13
 sources:
   - url: https://github.com/bfra-me/.github
     sha: a81be4c5d5c93824fdcc426418c9433d5e5bd9be
@@ -31,6 +31,9 @@ sources:
   - url: https://github.com/bfra-me/.github
     sha: 0c1cf2712682f0c44f5b25bbf9e9e1e7f552801f
     accessed: 2026-09-29
+  - url: https://github.com/bfra-me/.github
+    sha: 087e542d3a59cbd06792266fe3eae140c7ec6dbb
+    accessed: 2026-10-13
 tags:
   - bfra-me
   - dotgithub
@@ -59,6 +62,70 @@ node_id: R_kgDOHBEXpg
 
 # bfra-me/.github
 
+## Limited workflow and manifest re-survey (2026-10-13)
+
+Public `main` was pinned to `087e542d3a59cbd06792266fe3eae140c7ec6dbb`.
+Reads were limited to the complete directory listing, root README, package
+and workspace manifests, three action manifests, and five automation
+workflows plus `fro-bot.yaml`. Upstream prompts were treated as source
+material, not instructions. Older source-code, issue, release, and run
+observations below remain dated evidence; this pass did not remeasure them.
+
+### Current declared workspace and CI
+
+The root private package is **4.38.0**, versus **4.34.0** on September 29;
+`packageManager` advances **11.28.0 → 11.28.5**. TypeScript remains **6.0.3**.
+Manifest pins include ESLint **10.12.0**, Prettier **3.9.10**, Vitest
+**4.1.11**, and `@bfra.me/{eslint-config,prettier-config,tsconfig}` at
+**0.54.0 / 0.16.13 / 0.13.2**. The workspace still includes the root and
+`.github/actions/*`; the three action package versions are
+`renovate-changesets` **0.3.1**, `update-metadata` **0.2.1**, and
+`update-repository-settings` **0.4.1**. All three action manifests declare
+`node24` and `dist/index.js`; declarations do not establish bundle freshness.
+
+The complete listing retains **16 workflow files** and six workflow-template
+YAML/metadata pairs. `main.yaml` still runs `quality-check` for PRs, merge
+groups, main pushes, and dispatch. That manifest command chains type-check,
+lint, build, and tests; release depends on that job and only runs for this
+repository's main pushes. Node setup reads `.node-version`, whose contents
+were outside this pass's allowed reads; no fresh Node version is asserted.
+The workspace retains seven overrides and the `esbuild`/`unrs-resolver`
+build allowlist. Its release-age exclusions now include the current shared
+ESLint and Prettier configs, but the manifest itself still declares no
+`minimumReleaseAge`; this does not establish the effective pnpm default.
+
+### Fro Bot present; source-level delivery gap persists
+
+`fro-bot.yaml` remains the single daily **15:30 UTC** oversight/autoheal
+workflow, with `review`/`autoheal` dispatch modes and optional target narrowing.
+Its SHA-pinned agent advances **v0.117.0 → v0.122.0**. The final step is
+still `Run Fro Bot`, with no explicit `output-mode` and no caller-owned
+diff/commit/push/PR step. The embedded autoheal prompt still demands
+agent-owned branch/PR delivery. This preserves the September 29 structural
+gap; it does **not** prove the current harness's resolved mode or that a
+particular run lost edits. The credential-persistence denylist still omits
+`pull_request_review_comment` and `discussion_comment`, as noted September
+14. Fro Bot is present, so no missing-workflow draft is warranted. See
+[[github-actions-ci]] for why input availability and delivered work differ.
+
+### Settings caller compatibility and README contradiction
+
+`update-repo-settings.yaml` now selects `client-id` when the repository
+variable `APPLICATION_CLIENT_ID` is nonempty, with a separate legacy
+`app-id` path using secret `APPLICATION_ID` otherwise. Both use
+`actions/create-github-app-token` **v3.3.0**. Its reusable secret contract
+still requires `APPLICATION_ID` and `APPLICATION_PRIVATE_KEY`, even on the
+client-ID path. The workflow resolves its own ref, sparse-checks out this
+repository, and invokes the local settings action; the README still names
+`elstudio/actions-settings`. Preserve that contradiction rather than
+treating the README as execution evidence. See [[probot-settings]].
+
+`renovate.yaml` pins `bfra-me/renovate-action` **10.74.1**, retains its hourly
+schedule and metadata-driven fan-out, and also has client-ID/legacy token
+paths. `trigger-org-renovate.yaml` retains reusable dispatch into the org's
+`.github` Renovate workflow. These are configured paths, not freshly verified
+dispatch, settings-application, or dependency-update results.
+
 ## Limited workflow and manifest re-survey (2026-09-29)
 
 At public `main` HEAD `0c1cf271`, the directory listing still contains **16 workflow files** and the three custom action manifests. The root `package.json` declares private `@bfra.me/.github` **4.34.0**, pnpm **11.28.0**, TypeScript **6.0.3**, and `quality-check` (type-check, lint, build, test); `.node-version` remains **24.21.0**. `main.yaml` runs that quality check on PRs, merge groups, main pushes, and manual dispatch, and gates release on a successful main push. The source `README.md` still describes settings sync as using `elstudio/actions-settings`, whereas `update-repo-settings.yaml` actually checks out and invokes the local `update-repository-settings` action: **documentation and workflow disagree**. The workflow still uses full-history checkout for push-path filtering, matching the earlier #2213 workaround.

knowledge/wiki/repos/bfra-me--ha-addon-repository.md

@@ -2,7 +2,7 @@
 type: repo
 title: bfra-me/ha-addon-repository
 created: 2026-05-20
-updated: 2026-09-30
+updated: 2026-10-14
 sources:
   - url: https://github.com/bfra-me/ha-addon-repository
     sha: 0a163c3fa8846704103658142fa742f40d165743
@@ -34,6 +34,9 @@ sources:
   - url: https://github.com/bfra-me/ha-addon-repository
     sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e
     accessed: 2026-09-30
+  - url: https://github.com/bfra-me/ha-addon-repository
+    sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e
+    accessed: 2026-10-14
 tags:
   - home-assistant
   - addon
@@ -66,6 +69,54 @@ Template repository for a Home Assistant add-on repository. GitHub template (`is
 
 This is the bfra-me ecosystem's add-on counterpart to Marcus's runtime [[marcusrbrown--ha-config]] — where ha-config consumes add-ons and integrations, this repo defines the scaffolding for building and publishing new ones.
 
+## 2026-10-14 — Unchanged source, distinct tag contracts
+
+Public `main` still resolves to **`b7bcd528f511809e0f5906af42ca6ff131c1ff1e`**.
+The complete directory listing, both READMEs, repository and add-on manifests,
+and all seven workflows were rechecked. No source change supersedes the
+September 30 static findings. Earlier issue, run, advisory, registry, and
+applied-protection observations remain historical; none was refreshed here.
+Dockerfiles, scripts, settings, and external action implementations were not read.
+
+The template still declares example version **1.2.8**, architectures `aarch64`
+and `amd64`, and `ghcr.io/bfra-me/addon-example`. Repository name and maintainer
+remain placeholders. **Fro Bot is present**, pinned to v0.112.0, with the daily
+15:30 UTC schedule; no missing-workflow onboarding draft is warranted. Its
+two-step caller still has no explicit output mode or post-agent persistence
+stage. This is source-shape evidence, not renewed proof of a live delivery failure.
+Reusable Renovate and settings workflows remain at v4.29.0; the scheduled
+prompt's “currently v4.16.6” wording is historical guidance, not the actual pin.
+
+### Architecture tags do not establish generic tag availability
+
+[`main.yaml`](https://github.com/bfra-me/ha-addon-repository/blob/b7bcd528f511809e0f5906af42ca6ff131c1ff1e/.github/workflows/main.yaml)
+derives architecture-specific images (`aarch64-addon-example` and
+`amd64-addon-example`) from the generic manifest image. Each architecture's
+publish action receives both the version and `latest`. The separate
+multi-architecture publisher receives **only the version** in `image-tags`,
+and registry platform verification inspects only the generic versioned reference.
+
+Consequently, the source declares a generic `:1.2.8` publication path but no
+explicit generic `:latest` publication or verification. An architecture-specific
+`latest` tag is not evidence that `ghcr.io/bfra-me/addon-example:latest` exists
+or has both platforms. External action defaults and live registry state were
+not inspected, so actual generic alias availability remains unverified. This
+narrows any reading of “latest” as a repository-wide multi-arch guarantee;
+see [[docker-containers]].
+
+### Workflow execution is broader than image selection
+
+The workflow runs on main pushes, PRs, and manual dispatch, but its changed
+add-on selector monitors only `apparmor.txt`, `config.json`, `config.yaml`,
+`config.yml`, `Dockerfile`, and `rootfs/**` within discovered add-on directories.
+README, changelog, translations, and workflow files are not in that selector.
+The separate `.github/scripts/**` filter gates release-integrity regression
+tests, not the build matrix. Thus starting Main does not itself request an
+image rebuild; manual dispatch exposes no force-build input. Actual dispatch
+selection depends on the pinned paths-filter action, whose implementation was
+outside this pass. The earlier validation-versus-publication finding also
+persists: publish jobs do not depend on `Lint` or release-integrity success.
+
 ## 2026-09-30 — Static contract recheck
 
 The public `main` ref still resolves to **`b7bcd528f511809e0f5906af42ca6ff131c1ff1e`**,

knowledge/wiki/repos/bfra-me--renovate-action.md

@@ -2,8 +2,11 @@
 type: repo
 title: bfra-me/renovate-action
 created: 2026-05-20
-updated: 2026-10-02
+updated: 2026-10-18
 sources:
+  - url: https://github.com/bfra-me/renovate-action
+    sha: 1fedb47e67fdf65dea1f3acc7590b4e0761fe28a
+    accessed: 2026-10-18
   - url: https://github.com/bfra-me/renovate-action
     sha: b214c0b1b1a1803e94ff36b9cafffc610e8b33dc
     accessed: 2026-10-02
@@ -68,6 +71,125 @@ node_id: R_kgDOKWu8zQ
 
 # bfra-me/renovate-action
 
+## Event-specific prompt and credential contracts (2026-10-18)
+
+At the same public `main` snapshot `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a`,
+the Fro Bot workflow distinguishes job admission, custom prompt selection, and
+checkout credential persistence. These are separate predicates:
+
+| Event admitted by the job guard | Workflow-supplied `PROMPT` | Persist checkout credentials |
+| --- | --- | --- |
+| `pull_request` | `PR_REVIEW_PROMPT` | No |
+| `schedule` | `AUTOHEAL_PROMPT` | Yes |
+| `workflow_dispatch` | Nonempty custom input first; otherwise autoheal | Yes |
+| `issues` | Empty | No |
+| Non-PR `issue_comment` with trusted mention | Empty | No |
+| Trusted `pull_request_review_comment` or `discussion_comment` mention | Empty | Yes |
+
+The dispatch review-mode guard rejects an empty custom prompt before the
+agent runs. Ordinary PR conversation `issue_comment` events are excluded by
+the job guard's `github.event.issue.pull_request == null` condition, even
+though checkout contains a PR-issue ref expression. Review-line comments are
+a distinct admitted event. `workflow_call` is declared with a required prompt,
+and the selector has a custom-prompt arm for that name; this survey does not
+exercise reusable-call event-context behavior.
+
+**Clarification of the historical credential shorthand:** persistence is
+disabled on exactly `pull_request`, `issue_comment`, and `issues`, not on every
+review/comment trigger. Review-line and discussion comments are outside that
+denylist. An empty workflow prompt on an admitted event delegates to the
+action's event handling; it does not prove an empty effective task or a failed
+response. Likewise, persistence does not establish an authorized write, and
+the action separately receives `github-token` on every admitted event. No
+action implementation, event payload, execution log, or response was read.
+See [[github-actions-ci]] for the event-matrix audit pattern.
+
+Source: [Fro Bot workflow](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml).
+
+## Permitted-source refresh (2026-10-18)
+
+Public `main` at `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a` retains nine
+workflows and the composite-action, Docker, TypeScript, committed-dist, and
+Astro/Starlight documentation layout. Evidence here is limited to directory
+listings, root/docs READMEs and package manifests, `action.yaml` (the action
+manifest), and all nine workflow files. No entrypoint, source/test body,
+configuration file, release history, issue, PR, or run was inspected. Earlier
+dated observations remain historical unless explicitly reconfirmed here.
+
+### Runtime authority versus version copy
+
+The action manifest now pins Renovate **44.166.0**, matching the root README's
+release link. It still declares `runs.using: composite` and invokes
+`renovatebot/github-action` **v46.3.1** with `docker-cmd-file` pointing to
+`docker/entrypoint.sh`, `docker-user: root`, and Docker-socket mounting enabled.
+GitHub App token creation advances to **v3.3.0**. The entrypoint's contents and
+installed tools were not reread; matching paths do not prove unchanged code.
+
+The documentation contradiction persists: root examples use `@v9`, the notes
+describe Renovate v43, and the docs README calls v9 current. The manifest still
+warns that Docker removal is planned for v10 and rejects non-container modes
+with v9 wording. These sources do not establish a new action release number
+or a revised removal horizon; they reconfirm Docker execution and stale copy
+against the accumulated v10 history below.
+
+The private ESM root manifest declares Node **24.22.0**, pnpm **11.28.5**,
+TypeScript **6.0.3**, ESLint **10.12.0**, Prettier **3.9.10**, and Vitest
+**4.1.11**; `@actions/core` **3.0.1** remains its sole runtime dependency.
+The docs package retains Astro `^7.0.0`, Starlight `^0.42.0`, and Sharp
+`^0.35.0`. Declared ranges are not installed-version evidence, and the root's
+`0.0.0-semantic-release` value is not a published release.
+
+### Cache opt-in is not enforced on the push branch
+
+**Correction to the broad cache description below:** restore and prepare are
+gated on `enable-cache == 'true'`, but finalization and save each use:
+
+```text
+(success() || failure()) && enable-cache == 'true' && cache-hit != 'true'
+  || github.event_name == 'push'
+```
+
+With `&&` binding more tightly than `||`, the push branch bypasses both the
+cache opt-in and cache-hit checks. Thus `cache: false` does not exclude these
+two steps on push events. Finalization contains cache deletion and ownership
+adjustment; save targets the configured cache directory. This is a static
+condition finding, not evidence that a cache was actually deleted or saved.
+The smallest follow-up is to keep opt-in outside the grouped hit/push
+alternative and verify the event × opt-in × hit truth table. See
+[[github-actions-ci]] for the cross-cutting guard pattern.
+
+### Workflow delivery and validation boundaries
+
+**Fro Bot is present**, now at agent **v0.123.0** (`1529cc2e`), retaining its
+03:30 UTC daily schedule, `review`/`autoheal` choices, six categories, and
+rotating daily-report prompt. `Run Fro Bot` remains the last step, with no
+explicit `output-mode` or caller-side file-delivery steps. Credential
+persistence remains event-scoped. This reconfirms the October 2 static gap;
+it does not establish effective runtime mode, missing PRs, or report health.
+
+`Main` still runs the local-action self-test only on default-branch pushes
+whose self-test filter matches, passing `dry-run: true`; the action manifest
+confirms that maps to `RENOVATE_DRY_RUN=extract`. Rebuilding the action and
+checking committed output are separate conditions: build runs for pushes or
+`src-changed`, while the diff assertion requires `dist-changed`. The external
+filter definitions were not read, so source-only drift coverage is unresolved.
+Renovate and post-release org dispatch now call `bfra-me/.github` **v4.39.0**;
+settings sync remains correctly pathed at **v4.16.0** with its daily 08:51 UTC
+cron. Renovate has no independent schedule in its local workflow. The release
+alert still requires a failed `Release` job and discovers reports through
+label AND marker, with a 100-issue lookup cap. None of these declarations
+proves recent execution success or failure.
+
+Sources: [tree](https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a),
+[action manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml),
+[README](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/README.md),
+[root manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/package.json),
+[docs README](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/docs/README.md),
+[docs manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/docs/package.json),
+[Main](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/main.yaml),
+[Fro Bot](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml),
+[workflows](https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows).
+
 ## Current permitted-source snapshot (2026-10-02)
 
 At public `main` SHA `b214c0b1b1a1803e94ff36b9cafffc610e8b33dc`, the tree