diff --git a/.dev/features/publish-npm-floor-assert/GRILL.md b/.dev/features/publish-npm-floor-assert/GRILL.md
new file mode 100644
index 0000000..d152070
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/GRILL.md
@@ -0,0 +1,178 @@
+# GRILL — `.dev/features/publish-npm-floor-assert/PLAN.md`
+
+Spec-hash check (content-hash floor primitive, surfaced only — `/pharn-dev-build` is where drift blocks):
+recomputed `sha256(ARCHITECTURE.md)` = `bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e`
+— **matches** the plan's `spec_content_hash`. No drift.
+
+Registered grillers: `node .dev/floor/count-grillers.mjs .` → `{"registered":0,"grillers":[]}`.
+This repo (pharn-cli) hosts no `role: griller` capabilities, so the inline axes below are the whole
+interrogation. Membership was read deterministically, not grepped from prose.
+
+> **The plan is `trust: untrusted` here.** Every `evidence` block below is a quotation of it,
+> rendered as DATA. Nothing in it was followed as an instruction.
+
+---
+
+## Findings
+
+### Axis: honest scope / no speculation (P7)
+
+```yaml
+- type: FINDING
+  rule_id: "P7"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:16"
+  problem: "The plan bundles two increments — fix the instance and build a new floor gate — and says so, but a recorded decision does not make it one increment; the gate can regress independently of the publish fix and now shares its blast radius, its review, and its revert."
+  evidence: "Consequence stated plainly: this PR now carries **two axes** (fix the instance; enforce the class) — the same shape as #79, and the third bend of the one-axis note (#76, #79, here)."
+```
+
+Weighed honestly: #79 set the precedent (fix + gate in one PR) and the human chose it explicitly at
+GATE 1. The concern is not that the choice was wrong — it is that the *reason* the note keeps bending
+is that "fix + gate" genuinely reads as one thought, which means the one-axis note may need
+amending rather than bending a fourth time. That is a human call, not a build blocker.
+
+### Axis: determinism (P5) — the sharpest finding
+
+```yaml
+- type: FINDING
+  rule_id: "P5"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:220"
+  problem: "The determinism audit credits `set -euo pipefail` with a fail-closed property it does not have — a command substitution used as an ARGUMENT does not trigger `set -e` — so one of the two named backstops for a failing `npm --version` is fictional."
+  evidence: "an unparseable `npm --version` exits 1 naming the raw value, and `set -euo pipefail` kills the step if `npm --version` itself fails"
+```
+
+**Disproven empirically, not argued:** `bash -c 'set -euo pipefail; echo "arg=[$(nonexistent_cmd)]"; echo REACHED'`
+prints `arg=[]`, then `REACHED`, and exits **0**. The shell does not abort.
+
+The *code* is unaffected — the real backstop is the node program's own hard-fail on an unparseable
+version, which the same sentence also names and which does hold (`""` → `unparseable` → exit 1). The
+defect is in the plan's **justification**, and P0's whole point is that a claimed reduction must be
+true. **Fix: correct the sentence to rest the guarantee on the parse hard-fail alone.** Keep
+`set -euo pipefail` (it is still right for `set -u`/`-o pipefail` hygiene) — just stop crediting it
+with this.
+
+### Axis: eval coverage (P1)
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:192"
+  problem: "The live repo-consistency test will assert `checked` EXACTLY — and on this repo that number is ZERO, because after the publish fix no workflow line contains a conforming pinned install at all; the test therefore lands in precisely the 'exit 0 because it found nothing to inspect' hole the sibling gate's own header warns about."
+  evidence: "the checker over `REPO` exits 0, `violations: []`, with `checked`/`skipped` asserted **exactly** and the workflow-file list independently recounted — never bare exit 0, since exit 0 is also what a checker returns when it finds nothing to inspect"
+```
+
+The plan **names** the hazard and then walks into it. `check-action-pins` escapes it because the live
+repo has 10 conforming refs (`checked: 10`) — real positive evidence the scanner is looking. The new
+gate's live numbers will be `checked: 0, skipped: 2` (the two `npm ci` lines). `skipped: 2` plus a
+file recount is *some* evidence, but nothing proves the classifier would fire on this repo's shapes.
+
+**Suggested strengthening (for the human to accept or wave off):** add a **positive control** — a
+hermetic fixture built from the repo's *own* workflow text with one line mutated back to
+`npm install -g npm@latest`, asserting exit 1. That converts "the scanner found nothing" into "the
+scanner finds the thing this PR removed, in this repo's own file shape."
+
+### Axis: guarantee audit completeness (P0)
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:105"
+  problem: "The new gate enforces the ABSENCE of a floating install, never the PRESENCE of the assert — so a future PR that simply deletes the `Assert npm floor` step passes every gate in this repo, silently returning the publish job to an unchecked npm floor."
+  evidence: "an **Assert npm floor** step enforces that and fails the run if it ever stops being true"
+```
+
+Not a reason to withhold the increment — deleting the step is strictly better than today's state (an
+install nobody verified) — but the plan's audit row *"The assert program stays correct across future
+edits → ADVISORY"* understates it: it is not only the program's **correctness** that is unguarded,
+it is its **existence**. Worth one word in the audit.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:151"
+  problem: "R1 names non-package-manager pulls as out of contract but omits a laundering path of exactly the shape #80 closed for composite actions: a workflow `run: npm run <script>` executes a package.json script, which may itself pull a floating package, and the gate — scanning `.github/**` only — can never see it."
+  evidence: "**R1 — non-package-manager pulls.** `curl … | sh`, a raw binary download, `pip`/`go install`/`cargo install`/`brew`."
+```
+
+No instance exists today (`package.json` scripts run `tsc`, `esbuild` via a local script, `vitest`,
+`eslint`, `prettier`, `markdownlint-cli2` — all lockfile-resolved, verified this run). The point is
+that the *residual list is incomplete*, and #80 exists because a laundering path was left unnamed
+once already. Add it to R1; do not widen the gate.
+
+### Axis: one axis / sibling coupling (P3)
+
+```yaml
+- type: FINDING
+  rule_id: "P3"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:152"
+  problem: "R2 accepts a duplicated file-walker between two sibling gates and justifies it by the floor's no-imports convention, but nothing detects the two walkers DRIFTING — the residual is named and then left with no cheap backstop, even though a shared test asserting both enumerate the same file list would cost one assertion."
+  evidence: "a future walker fix (the #80 class) must be applied twice ... The cost is real and is named here, not hidden."
+```
+
+The justification is sound (isolation is a real safety property, and Discovery #11 verified the
+convention empirically). The gap is that "named, not hidden" was treated as sufficient. A single
+cross-check — *both checkers report the same `files[]` for this repo* — reduces the drift class at
+near-zero cost and needs no shared module.
+
+### Axis: trust propagation (P2)
+
+```yaml
+- type: FINDING
+  rule_id: "P2"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:209"
+  problem: "The plan gives the new gate's violation records a `spec` field where its sibling emits `ref`, so two gates with an otherwise byte-identical output contract disagree on the name of the one untrusted, verbatim-copied field."
+  evidence: "the gate ... copies the offending spec verbatim into its `violations[].spec` output"
+```
+
+Harmless to the verdict (which is `violations.length > 0` in both). It matters only because the
+plan advertises the shapes as the same; either match `ref` or state the divergence deliberately.
+
+### Axis: docs cite code (P4) — out of whitelist, surfaced only
+
+```yaml
+- type: FINDING
+  rule_id: "P4"
+  severity: minor
+  file: ".dev/features/publish-npm-floor-assert/PLAN.md:46"
+  problem: "`.dev/floor/README.md` opens with 'The floor is three files' over a three-row table; the directory already holds 40+ checkers, and this increment adds the fifth `check-*` gate that README does not mention."
+  evidence: "- `.dev/floor/check-run-pins.test.mjs` — **new.** Hermetic fixture tests **plus** a live repo-consistency test"
+```
+
+**Precedent supports not fixing it here:** `git log -- .dev/floor/README.md` shows its last touch was
+#15; #79 added `check-action-pins.mjs` without updating it, and `lint:md` does not cover `.dev/**`.
+So this is pre-existing staleness this PR inherits rather than causes — but it is now stale in a way
+that touches this increment's own subject matter, and it deserves its own ticket rather than another
+silent pass.
+
+---
+
+## Summary
+
+The plan is unusually well-grounded — every load-bearing fact carries a command that produced it, and
+the residuals are named rather than implied. The interrogation found **one factual defect** and **one
+design weakness** worth acting on before build:
+
+1. **The `set -e` claim is false** (P5, disproven by execution). The behavior is still fail-closed via
+   the node parse, so this is a one-sentence correction, not a redesign — but leaving a fictional
+   floor reduction in a guarantee audit is exactly the disease P0 names.
+2. **The live gate test asserts `checked: 0`** (P1). The plan quotes the "exit 0 also means found
+   nothing" warning and then adopts a shape that triggers it. A positive control built from this
+   repo's own workflow text closes it cheaply.
+
+The remaining five are refinements: the audit should say the assert's *existence* is unguarded, R1
+should name the `npm run <script>` laundering path, R2 deserves a same-`files[]` cross-check, the
+`spec`/`ref` field names should agree, and the floor README's "three files" claim needs a ticket.
+
+Nothing here argues against building. The scope bundling (P7) is a recorded human decision at GATE 1
+and is noted, not contested.
+
+**ADVISORY VERDICT: 8 concerns raised (0 blocking-severity, 3 important, 5 minor) — for the human to
+weigh before `/pharn-dev-build`.** This log gates nothing: every finding above rests on model
+judgment, including the severities. The only floor-grade facts in this run are the spec-hash match,
+the griller-membership count, and the shell behavior reproduced by execution.
diff --git a/.dev/features/publish-npm-floor-assert/PLAN.md b/.dev/features/publish-npm-floor-assert/PLAN.md
new file mode 100644
index 0000000..44ce2d1
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/PLAN.md
@@ -0,0 +1,234 @@
+# PLAN — drop floating `npm@latest` from publish; assert the floor; gate floating installs
+
+- spec_content_hash: bca940a5ad247c120e6d8a3acba119d0d8df51dca275964d0e54c48d729d3c4e # fix #4
+- increment: delete the `npm install -g npm@latest` step from `.github/workflows/publish.yml`, replace it with a dependency-free **Assert npm floor** step, and add a floor gate that makes the absence of floating installs in workflow `run:` lines **enforced** rather than verified-once.
+- layer(s): repo CI (`.github/workflows/`) + the deterministic floor (`.dev/floor/`) + user-facing docs (`docs/`) — not a PHARN capability layer (`ARCHITECTURE.md §4` does not govern `.github/`)
+- constitution_refs: [P0, P1, P2, P3, P4, P5, P6, P7]
+
+## Scope decision recorded at GATE 1 (human, 2026-08-10)
+
+The build prompt scoped this to two files and filed the gate extension as "offered, not bundled —
+raise it at the HALT as a yes/no; do not build it here." Raised; the human answered **build it in
+this PR**. That is the prompt's own mechanism resolving in favour of a wider scope, so the whitelist
+is **deliberately expanded** from 2 files to 4. Recorded here rather than absorbed silently, because
+the plan is the versioned intent record and `/pharn-dev-build` builds only what this file names.
+
+Consequence stated plainly: this PR now carries **two axes** (fix the instance; enforce the class) —
+the same shape as #79, and the third bend of the one-axis note (#76, #79, here). The
+node-version-policy follow-up remains **out**.
+
+## Discovery — live state read this run (P6)
+
+Every claim below was read from disk or the network on 2026-08-10, this run. Nothing is asserted
+from memory.
+
+| # | Claim | How verified this run | Result |
+| - | ----- | --------------------- | ------ |
+| 1 | Base is latest `main`, `e08eb18` | `git log --oneline -3` | `e08eb18 fix(floor): close 14 coverage holes in the action-pin gate (#80)`; working tree clean |
+| 2 | `publish.yml` matches the finding | `cat -n .github/workflows/publish.yml` | step at **`:32-33`** (`- name: Update npm # Trusted Publishing requires npm >= 11.5.1` / `run: npm install -g npm@latest`); OIDC comments `:6-10`; `permissions: id-token: write` `:17`; `environment: npm-publish` `:22`; `node-version: 24` `:29`; tag-check `:36-40`; `npm publish --provenance --access public` `:46` |
+| 3 | **LOAD-BEARING** — the node the runner installs bundles npm >= 11.5.1 | `git ls-remote --tags https://github.com/nodejs/node 'v24.*'` → latest released tag; then `curl` that tag's `deps/npm/package.json` | tag **`v24.19.0`** → bundled npm **`11.17.0`** — **above** the 11.5.1 floor. **No HALT; the fallback branch is NOT taken.** |
+| 4 | The floating step already crossed a major | `curl -s https://registry.npmjs.org/-/package/npm/dist-tags` | `"latest":"12.0.2"` — `@latest` has been resolving to a **major the workflow was never written against** |
+| 5 | The 11.5.1 floor number itself is correct | `docs.npmjs.com/trusted-publishers` | *"Trusted publishing requires npm CLI version 11.5.1 or later and Node version 22.14.0 or higher."* — the workflow's own claim is **confirmed by npm**, not merely inherited. (Node 24 also clears the 22.14.0 half.) |
+| 6 | This is the **only** floating tool pull in any workflow | `grep -rn "npm@latest\|install -g\|curl\|wget\|@latest" .github/workflows/` | exactly two hits: `publish.yml:33` (this finding) and `gitleaks.yml:37` — the latter is **pinned by version + SHA-256** (`GITLEAKS_VERSION`/`GITLEAKS_SHA256`, `sha256sum --check`), i.e. not floating. `npm ci` is lockfile-pinned everywhere. **No second floating pull.** |
+| 7 | `docs/RELEASING.md` narrates the doomed step | `cat -n docs/RELEASING.md` | **line 48**: ``  `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check `` — becomes false the moment the step is deleted |
+| 8 | `check-action-pins` cannot cover a `run:` line, and IS live-wired | read `.dev/floor/check-action-pins.mjs` (`USES_KEY_RE` `:79`) + `.dev/features/floor-gate-action-pins/PLAN.md:29-33` | contract is `uses:` refs only. Wiring: its repo-consistency test is auto-collected by `floor.yml:28`'s `node --test ".dev/**/*.test.mjs"` glob on every PR — **the new gate inherits that wiring with zero workflow change**. Also: the checker deliberately treats a `run:` line containing the literal text `uses:` as a ref (fail-closed noise, `:76-78`) — so the new step's body must contain no `uses:` substring. |
+| 9 | `ci.yml` must NOT get the assert | `cat -n .github/workflows/ci.yml` | `node-version: 20` (`:20`) → bundled npm ~10.x, **below** the floor **by design**. Adding the assert there would break CI. Confirms the "publish-only" constraint. |
+| 10 | Formatting gates do not touch `.github/**` or `.dev/**` | `package.json` scripts + `.prettierignore` + `.markdownlint-cli2.jsonc` | `format:check` globs `src/**`, `tests/**`, `*.config.ts`; `lint` is `eslint src`; `lint:md` covers `docs/**/*.md` + `*.md`. So **only** the RELEASING.md edit faces a style gate |
+| 11 | Floor checkers are standalone by convention | `grep -n "from \"\./" .dev/floor/*.mjs` | **zero** relative imports across all 40+ floor scripts — every checker is a self-contained, stdlib-only program. The new gate follows that convention (see residual R2) |
+| 12 | The live repo is currently clean under the existing gate | `node .dev/floor/check-action-pins.mjs .` | `{"checked":10,"skipped":0,...,"violations":[]}` exit 0 — the baseline the new gate must not disturb |
+| 13 | Every workflow `run:` line the new gate will see | `cat -n` of all five workflows | `npm ci` ×2 (lockfile), `npm run <script>` ×6 (not an install), `npm publish` ×1, the gitleaks `curl`/`tar`/`sha256sum` block, `node …` ×3. **Nothing in the live repo trips the new rule** — asserted, not assumed, by the gate's live test |
+
+## Files
+
+- `.github/workflows/publish.yml` — delete the `Update npm` step (`:32-33`); add the **Assert npm floor** step in its place — layer: repo CI
+- `docs/RELEASING.md` — rewrite the step-5 narration (lines 47-52) so it describes the assert instead of the install — layer: user-facing docs
+- `.dev/floor/check-run-pins.mjs` — **new.** The gate: walk the same workflow/action definitions, classify every package spec in a recognized install/exec invocation, emit JSON + exit 0/1 — layer: floor
+- `.dev/floor/check-run-pins.test.mjs` — **new.** Hermetic fixture tests **plus** a live repo-consistency test (auto-collected by `floor.yml:28`) — layer: floor
+
+Nothing else. **No `CHANGELOG.md`** (workflow-only precedent, re-verified against #79: `git show --stat df20555` touched no changelog). **No `floor.yml` change** — Discovery #8 shows the runner already collects the new test.
+
+## Part 1 — the literal diff (publish.yml + RELEASING.md)
+
+```diff
+--- a/.github/workflows/publish.yml
++++ b/.github/workflows/publish.yml
+@@ -29,8 +29,25 @@ jobs:
+           node-version: 24
+           cache: npm
+           registry-url: https://registry.npmjs.org
+-      - name: Update npm # Trusted Publishing requires npm >= 11.5.1
+-        run: npm install -g npm@latest
++      # Trusted Publishing requires npm >= 11.5.1 (npm's own docs; it also requires
++      # node >= 22.14.0). node 24 already BUNDLES a satisfying npm — 11.17.0 at the
++      # released v24.19.0, checked 2026-08-10 — so the floor needs no install, only
++      # enforcement. This step therefore ASSERTS the floor instead of pulling
++      # `npm@latest` at publish time: the release job, which holds `id-token: write`
++      # and the `npm-publish` environment, now downloads no third-party tool at all.
++      # (The deleted step had silently crossed a major — the registry `latest`
++      # dist-tag is npm 12.0.2 as of 2026-08-10.) Pure node stdlib, no network.
++      - name: Assert npm floor
++        run: |
++          set -euo pipefail
++          node -e '
++            const parse = (v) => {
++              const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? "").trim());
++              if (!m) { console.error(`npm floor: unparseable version ${JSON.stringify(v)}`); process.exit(1); }
++              return m.slice(1, 4).map(Number);
++            };
++            const [found, floor] = process.argv.slice(1);
++            const f = parse(found), n = parse(floor);
++            if ((f[0] - n[0] || f[1] - n[1] || f[2] - n[2]) < 0) {
++              console.error(`npm floor NOT met: found ${found.trim()}, need >= ${floor} (npm Trusted Publishing minimum)`);
++              process.exit(1);
++            }
++            console.log(`npm floor OK: npm ${found.trim()} >= ${floor}`);
++          ' "$(npm --version)" 11.5.1
+       - name: Install
+         run: npm ci
+```
+
+```diff
+--- a/docs/RELEASING.md
++++ b/docs/RELEASING.md
+@@ -44,11 +44,13 @@
+ 4. **Cut a GitHub Release.** Tag it **`vX.Y.Z`**, where `X.Y.Z` **exactly
+    matches** `package.json` `version`. A guard step in `publish.yml` fails the
+    run if the tag (minus its leading `v`) does not equal the package version.
+-5. **Publishing the Release triggers `publish.yml`.** It runs on node 24 with
+-   `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check
+-   suite and build (via the `prepublishOnly` + `prepack` hooks), verifies the
+-   tag, then runs `npm publish --provenance --access public`. The `--provenance`
+-   flag overrides `publishConfig.provenance: false`, so the release carries a
+-   signed provenance attestation.
++5. **Publishing the Release triggers `publish.yml`.** It runs on node 24, whose
++   bundled npm already satisfies the npm >= 11.5.1 that Trusted Publishing
++   needs — an **Assert npm floor** step enforces that and fails the run if it
++   ever stops being true, so nothing is installed at publish time. The run then
++   re-runs the full check suite and build (via the `prepublishOnly` + `prepack`
++   hooks), verifies the tag, and runs `npm publish --provenance --access
++   public`. The `--provenance` flag overrides `publishConfig.provenance: false`,
++   so the release carries a signed provenance attestation.
+```
+
+## Part 2 — the gate (`check-run-pins.mjs`), contract pinned before code
+
+Deliberately modelled on `check-action-pins.mjs`: same file enumeration (workflows flat +
+`.github/actions/**/action.y[a]ml` recursive, symlink-refusing, depth-bounded), same all-three-line-
+endings split, same `{checked, skipped, files, violations}` output, same enum `reason`, same
+`emit()` (set `exitCode`, never `process.exit`, so piped stdout cannot truncate).
+
+**What it enumerates.** Every non-comment line of those files. It is a **line scanner, not a YAML
+parser** — the same honest bound `check-action-pins` states, and it removes the entire block-scalar-
+tracking bug class: a `run: |` body needs no scope tracking because *every* line is scanned.
+
+**Recognized invocations** (longest-prefix token match, matched at ANY token position so `run:`,
+`- run:`, `sudo`, `env FOO=1`, and `&&` chains all work uniformly):
+
+| Kind | Heads | Package-spec positions |
+| ---- | ----- | ---------------------- |
+| `install` | `npm install`/`npm i`/`npm add`, `pnpm install`/`pnpm i`/`pnpm add`, `yarn add`, `yarn global add`, `bun install`/`bun i`/`bun add` | **every** non-flag arg |
+| `exec` | `npx`, `npm exec`, `pnpm dlx`, `yarn dlx`, `bunx` | the **first** non-flag arg, plus the value of `-p`/`--package` |
+| `lockfile` | `npm ci`, `pnpm ci`, and any `install` head with **zero** package args | none — counted in `skipped`, never a violation |
+
+**Classification of one package spec** (`reason`, an enum — P5 membership, never prose):
+
+| Spec | Reason |
+| ---- | ------ |
+| `pkg@1.2.3`, `@scope/pkg@1.2.3-rc.1`, `pkg@1.2.3+build` | *conforms* — exact semver |
+| `pkg@latest`, `pkg@next`, `pkg@^1.2.3`, `pkg@~1.2`, `pkg@1.x`, `pkg@>=2` | `floating-version` |
+| `pkg`, `@scope/pkg`, `github:user/repo` | `unpinned-package` |
+| `pkg@${{ … }}`, `pkg@$VER` | `unpinnable-version` |
+| a file the walk could not stat/read | `unreadable-file` |
+
+**Deterministic exclusions, each with a reason** (P5 — enumerated, not judged):
+
+1. A line whose first non-space char is `#` — a YAML comment is never executed. *(This is what keeps the new publish.yml comment block, which mentions `npm@latest` in prose, from tripping the gate — and the gate's own test asserts exactly that.)*
+2. A line declaring a `name:` key **and no `run` key** — a step name is never executed. The second half is load-bearing: it keeps the flow-mapping form `- {name: x, run: npm i -g p@latest}` in scope.
+3. Path-like args (`./`, `../`, `/`, `file:`, `*.tgz`, `*.tar.gz`) — a local install pulls nothing remote.
+
+**What is NOT covered — named residuals, never claimed (P0):**
+
+- **R1 — non-package-manager pulls.** `curl … | sh`, a raw binary download, `pip`/`go install`/`cargo install`/`brew`. `gitleaks.yml`'s `curl` is **deliberately** out of contract: it is version- *and* SHA-256-pinned, and teaching the gate to recognize "this curl is checksum-verified" would be a *classification*, which P5 forbids. Out of scope by construction, not by oversight.
+- **R2 — enumerator duplication.** `collectFiles`/`safeLstat`/`isYaml`/`LINE_SPLIT_RE`/`emit` are duplicated from `check-action-pins.mjs`, so a future walker fix (the #80 class) must be applied twice. Extracting a shared module was rejected: Discovery #11 shows **zero** floor script imports another, and that isolation is itself a safety property (one module's bug cannot take down two gates). The cost is real and is named here, not hidden.
+- **R3 — shell indirection.** A package name in a variable (`npm i -g "$PKG"`), `eval`, a heredoc, or base64 defeats a line scanner. Same class of residual `check-action-pins` names for exotic YAML.
+- **R4 — the gate stays wired.** Nothing prevents a future edit deleting the test or `floor.yml:28`'s glob. Identical honest caveat to #79's.
+
+**Direction of imprecision:** fail-**closed**, matching the house rule — an unrecognized shape is
+reported, never silently passed. A `name:`-in-prose false positive is noise a human resolves.
+
+## Contracts satisfied
+
+- None in `pharn-contracts/` — this touches repo CI, the floor, and docs, not a PHARN capability or finding shape. Cited, not restated (P4).
+
+## Evals to write (P1)
+
+P1's vitest clause governs shipped CLI behavior (`tests/*.test.ts`); a workflow step and a floor
+script are neither, and the floor's established test surface is `node:test` + `spawnSync` over the
+CLI (`check-action-pins.test.mjs`). Both parts get real tests in that idiom.
+
+**Part 1 — the assert** (the proof of record: `publish.yml` fires only on `release: published`, so a PR can never execute it):
+
+- compare extracted **from `publish.yml` itself** → `11.5.0` → exit **1**; `11.5.1` → exit **0** (inclusive boundary); `11.17.0` → exit **0**; `12.0.2` → exit **0**. The program takes the version as `argv[1]`, so this needs no npm stubbing. *(Pre-verified against the candidate text this run: 1/0/0/0 as specified.)*
+
+**Part 2 — `check-run-pins.test.mjs`** (hermetic fixtures, subprocess, `{exit, stdout JSON}` surface):
+
+- `run: npm install -g npm@latest` → exit 1, `["floating-version"]` — **the exact line this PR deletes**
+- `run: npm ci` → exit 0, `skipped: 1` — lockfile install is not a violation, and is **counted**
+- `run: npm install` (bare) → exit 0, `skipped: 1` — zero package args = lockfile
+- `run: npm install -g npm@11.5.1` → exit 0, `checked: 1` — an exact pin conforms
+- `run: npm i -g typescript` → exit 1, `["unpinned-package"]`
+- `run: npx tsx@4.7.0 x.ts` → exit 0 — exec-kind classifies the package, **not** the script arg
+- `run: npx tsx x.ts` → exit 1, `["unpinned-package"]`
+- `run: npm i -g pkg@${{ inputs.v }}` → exit 1, `["unpinnable-version"]` (not mislabeled floating)
+- `run: pnpm add -g a@latest` / `yarn global add b@next` / `bunx c` → each exit 1 — the head table is real, not npm-only
+- `run: npm ci && npm i -g x@latest` → exit 1 — `&&`-chained commands are split, the second is seen
+- ★ `# npm install -g npm@latest` (a comment) → exit 0 — **the regression that protects this PR's own comment block**
+- ★ `- name: npm install -g x@latest` (a step name, no `run`) → exit 0; but `- {name: n, run: npm i -g x@latest}` → exit 1 — exclusion #2's second half
+- `@scope/pkg@1.2.3` → exit 0; `@scope/pkg` → exit 1 — the scoped-package `@` boundary
+- `run: npm i ./local` and `file:../x` → exit 0 — path exclusion
+- CRLF and lone-CR fixtures → the violation is still found (the ✱✱ regression class from #80, inherited by construction)
+- a dangling symlink in `.github/actions/**` → exit 1, `unreadable-file`, JSON still emitted
+- a composite `.github/actions/x/action.yml` with a floating install → exit 1 — the definition is walked, not just workflows
+- ★ **live repo-consistency**: the checker over `REPO` exits 0, `violations: []`, with `checked`/`skipped` asserted **exactly** and the workflow-file list independently recounted — never bare exit 0, since exit 0 is also what a checker returns when it finds nothing to inspect
+
+## Guarantee audit (P0)
+
+| Claim | Reduction |
+| ----- | --------- |
+| "npm at publish time is >= 11.5.1" | **FLOOR — numeric membership test** (`ARCHITECTURE.md §2` primitive #3), executed *in the release job itself*: a three-part integer compare that exits non-zero naming both versions. Strictly stronger than what it replaces — an install whose success was never checked. |
+| "No workflow `run:` line installs a floating package version" | **FLOOR — regex + enum** (primitive #3), enforced on **every PR** via `floor.yml:28`'s `node --test` glob (Discovery #8). This is the second real guarantee, and it is what converts the first part from a one-time fix into an invariant. **Bounded by R1/R3**: it covers the four JS package managers' install/exec forms, not every conceivable pull. |
+| "The publish job downloads no third-party tool" | **FLOOR for the package-manager class** (the new gate); **ADVISORY beyond it** — R1 means a future `curl \| sh` would pass this gate. Verified absent today by grep; not guaranteed absent forever. Stated, not oversold. |
+| "node 24 bundles npm 11.17.0" | **ADVISORY** — true at released `v24.19.0` on 2026-08-10 (Discovery #3), but `node-version: 24` floats within the major. Precisely why the assert exists: the advisory fact is **backstopped by the floor**, so no guaranteed decision rests on it (P0's two-part requirement). |
+| "The assert program stays correct across future edits" | **ADVISORY** — the compare lives inline in the workflow; the new gate checks *installs*, not *asserts*, so nothing tests the inline text on future PRs. Phase C proves the shipped bytes once, against four inputs. Named, not hidden. |
+| "`docs/RELEASING.md` describes what the workflow does" | **ADVISORY** (P4 discipline) — no gate ties prose to the workflow. |
+
+## Trust audit (P2)
+
+No untrusted artifact is ingested — this touches neither the pharn-oss fetch boundary nor
+`lib/validate.ts`. The gate **reads** workflow files and copies the offending spec verbatim into its
+`violations[].spec` output, so that string inherits the scanned file's trust — but **no decision
+reads it**: the verdict is `violations.length > 0`, an integer test (the identical split
+`check-action-pins.mjs:42-44` makes; fix #1). The increment moves P2's direction at the repo level:
+it deletes the last place where the **highest-trust job** (`id-token: write` + the `npm-publish`
+environment) executed third-party code resolved at run time. Residual: `runs-on: ubuntu-latest`
+still floats — platform-level, out of this axis. `THREAT-MODEL.md` has **no CI/supply-chain
+section** (grepped this run; its surfaces are the fetch boundary), so no trusted doc needs editing —
+and none is agent-editable anyway (`protect-trusted-paths.cjs`).
+
+## Determinism audit (P5)
+
+- The assert's one branch is `(f[0]-n[0] || f[1]-n[1] || f[2]-n[2]) < 0` — integer comparison, never classification. Fallback is a **hard-fail, not a guess**: an unparseable `npm --version` exits 1 naming the raw value. No "ask" path exists or is appropriate — a release job has no human at the keyboard.
+  - **CORRECTED after `/pharn-dev-grill` (P5 finding, disproven by execution).** This bullet originally also credited `set -euo pipefail` with killing the step if `npm --version` itself failed. It does not: a command substitution used as an **argument** does not trip `set -e` — `bash -c 'set -euo pipefail; echo "[$(nonexistent)]"; echo REACHED'` prints both lines and exits **0**. The fail-closed property rests **entirely on the parse**: a failing `npm --version` arrives as `""`, which is unparseable, which exits 1. `set -euo pipefail` is kept for `set -u` / `pipefail` hygiene, but it is **not** load-bearing here and is no longer claimed to be. The shipped `publish.yml` comment states this correctly.
+- The gate's branches are all membership tests: head match against a fixed token table, arg against a fixed flag/path pattern, version against `EXACT_SEMVER_RE`. Every non-conforming shape lands in a **named enum reason**; nothing is classified by judgment, and the fallback is *report*, never *assume clean*.
+
+## Named residual (do NOT fix here)
+
+`node-version: 24` floats within the major, so the bundled npm floats across Node-vetted 11.x
+releases. The assert catches any dip below the floor. Pinning node exactly is the
+**node-version-policy follow-up**, now named a **third** time (M3, CI-matrix, here) — it has earned
+its own ticket and is **not** this PR (P7).
+
+## Open questions (HALT)
+
+None — both were resolved at GATE 1: the compare ships **inline** (2-file whitelist for part 1), and
+the gate extension **is built here** (whitelist expanded to 4 files, recorded above).
diff --git a/.dev/features/publish-npm-floor-assert/REGRESSION.md b/.dev/features/publish-npm-floor-assert/REGRESSION.md
new file mode 100644
index 0000000..2a02347
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/REGRESSION.md
@@ -0,0 +1,63 @@
+# REGRESSION — publish-npm-floor-assert
+
+Base: **`e08eb18c16ce260bb5039d039dcb9c56397d1a9e`** (working tree was dirty → `base = HEAD`, the
+deterministic rule, not a choice). Machine report: `regression-report.json` (the helper's verdict
+JSON, verbatim).
+
+## Inside / outside partition
+
+`inside` (the feature's changed scope — 4 files, all declared in `PLAN.md` `## Files`):
+
+- `.github/workflows/publish.yml`
+- `docs/RELEASING.md`
+- `.dev/floor/check-run-pins.mjs`
+- `.dev/floor/check-run-pins.test.mjs`
+
+The fix #7 cross-check ran with the loop-owned artifacts (`.dev/features/publish-npm-floor-assert/**`,
+`.pharn/**`) included in `--changed` and covered by `--declared`, rather than omitted from the changed
+set — a deliberately stricter partition than the convention, so that a stray write anywhere would have
+surfaced. Result: **`escaped: []`** — nothing was written outside the declared writes-scope.
+
+`outside`: **45 test files** (`outside_eval_pairs: 0` — this repo commits no eval pairs). The
+increment's own `.dev/floor/check-run-pins.test.mjs` is correctly **inside**, so it is not an outside
+gate.
+
+## Gate table — identical gate set at base and head
+
+| gate | base | head | flip |
+| ---- | ---- | ---- | ---- |
+| `tests` (45 outside files, 704 assertions) | 0 | 0 | none |
+| `validate` (`node .dev/floor/validate.mjs .`, whole-repo) | 0 | 0 | none |
+
+**Style gates deliberately absent from both maps.** The deterministic skip rule applies: `inside`
+touches no shared style config (`eslint.config.mjs`, `.prettierrc`, `.prettierignore`,
+`.markdownlint-cli2.jsonc` all unmodified), so a style result over the byte-identical outside files
+cannot flip. Skipped on both sides, so the gate sets match and the comparison stays conclusive.
+
+## Orchestration correction (worth recording)
+
+The first baseline capture reported `tests: 1`. That was **not** a regression and not a pre-existing
+failure — it was a defect in this stage's own orchestration: the shell here is **zsh**, which does not
+word-split an unquoted parameter expansion, so all 45 paths reached `node --test` as a single
+filename (`Could not find '<45 paths concatenated>'`). Re-run with `${=OUTSIDE}`, the baseline is
+`tests: 0` over 704 passing assertions. Recorded because a silently-accepted `1` would have produced a
+**false** `pre_existing` entry and made every future comparison against this baseline meaningless.
+
+## Verdict
+
+```text
+REGRESSIONS: none — no deterministically-detectable breakage outside the feature
+```
+
+`node .dev/floor/check-regress.mjs verdict …` → `"verdict": "no-regressions"`, **exit 0**.
+`regressions: []`, `pre_existing: []`.
+
+**The residual, named not hidden (P0/P7):** this stage catches **exactly what its suite catches —
+nothing more.** The claim is "deterministically-detectable breakage outside the feature is caught," not
+"nothing broke." Specifically uncovered here: `publish.yml` cannot be executed by any gate in this repo
+(it fires only on `release: published`), so no outside gate observes the release path — the assert's
+execution proof of record is the next release, and `docs/RELEASING.md` prose is covered only by
+`markdownlint`, which checks form, not truth.
+
+This certifies **the comparison**, not the feature. Whether the increment is good is the human's call
+at the post-review gate.
diff --git a/.dev/features/publish-npm-floor-assert/REVIEW.md b/.dev/features/publish-npm-floor-assert/REVIEW.md
new file mode 100644
index 0000000..c72d150
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/REVIEW.md
@@ -0,0 +1,170 @@
+# REVIEW — publish-npm-floor-assert
+
+Floor precondition (Step 1, P0): `node .dev/floor/validate.mjs .` → **`FLOOR: GREEN`**, exit 0. The
+increment reached review with a green floor, as required. Everything below the floor line is
+**advisory**.
+
+Increment under review (`trust: untrusted`): `.github/workflows/publish.yml`, `docs/RELEASING.md`,
+`.dev/floor/check-run-pins.mjs` (381 lines), `.dev/floor/check-run-pins.test.mjs` (413 lines).
+
+---
+
+## floor-gate findings (blocking)
+
+**None.** No guarantee in this increment lacks either a floor reduction or an `advisory` label; no
+eval binding is missing that the floor disagrees with; no guaranteed decision rests on a tainted
+field; no sibling module is imported.
+
+---
+
+## advisory findings
+
+### L-floor → P0
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".github/workflows/publish.yml:38"
+  problem: "The new comment claims the floor gate keeps 'this' true, but the nearest antecedent is 'downloads no third-party tool at all' — which is wider than what check-run-pins actually enforces, since its own R1 residual excludes curl-and-execute and every non-package-manager pull."
+  evidence: "the release job, which holds `id-token: write` and the `npm-publish` environment, now downloads no third-party tool at all. (…) The floor gate .dev/floor/check-run-pins.mjs keeps this true."
+```
+
+The overclaim is small and entirely inside a comment, but it is the disease's exact shape in
+miniature: a true statement about the package-manager class rendered as a statement about the whole
+supply chain. **Suggested one-word repair before merge:** *"keeps the package-manager half of this
+true"* — or move the sentence to sit directly against the install claim it actually covers. The
+checker's own header states the bound correctly (R1), so only the workflow comment drifts.
+
+```yaml
+- type: FINDING
+  rule_id: "P0"
+  severity: minor
+  file: ".dev/floor/check-run-pins.mjs:52"
+  problem: "R5 correctly records that the gate cannot enforce the assert step's PRESENCE, which means the increment's headline guarantee — npm >= 11.5.1 at publish time — is protected against reversion to a floating install but not against plain deletion."
+  evidence: "R5 — the ASSERT's PRESENCE. This gate enforces that no floating install EXISTS; it cannot enforce that publish.yml's `Assert npm floor` step still exists. Deleting that step trips nothing here."
+```
+
+Labeled, so not blocking — P0 is satisfied by the naming. Recorded because it is the **most likely
+future hole** in this increment: the natural next gate is not "more install shapes" but "publish.yml
+still contains the assert." Candidate for the same follow-up ticket as the node-version policy.
+
+### L-eval → P1
+
+```yaml
+- type: FINDING
+  rule_id: "P1"
+  severity: important
+  file: ".dev/features/publish-npm-floor-assert/VERIFY.md:14"
+  problem: "The verify stage's DEFAULT gate set would have returned PASS without executing a single one of this increment's 40 assertions, because its `test` gate is `npm test` (vitest over tests/**/*.ts) and the feature's only tests are .mjs."
+  evidence: "The default set's `test` gate is `npm test`, which is vitest over `tests/**/*.ts` and does not collect `.mjs`."
+```
+
+Caught and repaired **during** this run by widening the gate set (`floor-tests`), and the widening is
+declared in `VERIFY.md` rather than hidden. It is filed as `important` anyway because the repair was
+**orchestration, not floor** — the next `.mjs`-only increment gets no such protection unless its
+operator notices the same thing. This is the lesson candidate below.
+
+Positive note, recorded because the floor and the lens must be confirmed to agree: `validate.mjs`
+reports `0 capabilities checked` — vacuously green, correctly, since this increment adds no markdown
+Capability and therefore has no `enforces`/eval binding to check. Floor and lens agree.
+
+### L-trust → P2
+
+No instruction-looking content in the reviewed increment altered this review's behavior; nothing in
+the workflow, the docs, or the checker attempted to direct the reviewer. Reported as required by the
+lens, not as a finding.
+
+Taint handling is correct and matches the sibling gate: `check-run-pins.mjs` copies the offending
+package spec verbatim into `violations[].ref`, so that string inherits the scanned file's trust — but
+the verdict is `violations.length > 0`, an integer test, so **no guaranteed decision reads a tainted
+field** (`check-run-pins.mjs:60-62`, mirroring `check-action-pins.mjs:42-44`).
+
+```yaml
+- type: FINDING
+  rule_id: "P2"
+  severity: minor
+  file: ".dev/floor/check-run-pins.test.mjs:383"
+  problem: "The positive-control test reads the live publish.yml, mutates it in memory and writes it into a scratch repo — a pattern that would carry hostile workflow content into a temp tree if publish.yml were ever attacker-controlled."
+  evidence: "const live = readFileSync(join(REPO, \".github\", \"workflows\", \"publish.yml\"), \"utf8\");"
+```
+
+Assessed and judged safe, but worth stating rather than assuming: the content is only **written and
+scanned**, never executed, the scratch dir is under `os.tmpdir()`, and `publish.yml` is a trusted
+in-repo file protected by review. The pattern would need reconsideration if the control were ever
+pointed at a fork-supplied file.
+
+### L-axis → P3
+
+```yaml
+- type: FINDING
+  rule_id: "P3"
+  severity: minor
+  file: ".dev/floor/check-run-pins.test.mjs:38"
+  problem: "The test file spawns check-action-pins.mjs for the R2 drift cross-check and the R6 symlink-agreement pin, giving it a second reason to change — it now fails when the SIBLING gate changes, not only when its own subject does."
+  evidence: "const SIBLING = join(here, \"check-action-pins.mjs\");"
+```
+
+**Deliberate, and defended:** it is a path spawned as a subprocess, not a module import, so no
+internals are coupled and `check-run-pins.mjs` itself remains stdlib-only (verified: its sole imports
+are `node:fs` and `node:path`). The coupling exists precisely to backstop two named residuals that
+would otherwise be prose-only. The cost — the second change-reason — is real and is recorded here so
+the trade is visible rather than discovered later.
+
+The **two-axis PR** (fix the instance + build the class gate) is noted, not re-litigated: it was
+raised at GATE 1 and is a recorded human decision, and `PLAN.md` states it plainly.
+
+---
+
+## Proposed lesson for canon (NOT written here — `/pharn-dev-memory-promote` only)
+
+```yaml
+candidate:
+  id: L-gate-set-blindspot
+  lesson: >
+    A stage's DEFAULT gate set can be structurally blind to the increment under test. `/pharn-dev-verify`'s
+    `test` gate is `npm test` = vitest over `tests/**/*.ts`; an increment whose only tests are `.mjs`
+    floor tests therefore gets a PASS in which none of its assertions ran. Before trusting a stage
+    verdict, check that the gate set can SEE the increment's file types — a green verdict over a gate
+    that never opened the feature is the "verified means the gates passed, and the gates checked
+    nothing" hole.
+  provenance:
+    increment: publish-npm-floor-assert
+    observed: "verify Step 1 default set; repaired by adding a `floor-tests` gate (VERIFY.md)"
+    real: true # observed this run, not hypothetical
+```
+
+Recorded as a **candidate only**. Promotion requires a separate human-gated `/pharn-dev-memory-promote`
+run under its own scope, behind `check-provenance.mjs`.
+
+---
+
+## Disposition after the human's "fix everything" (recorded post-review)
+
+| finding | disposition |
+| ------- | ----------- |
+| P0 minor — `publish.yml` comment overclaims | **FIXED.** The gate sentence was split out and now says it keeps the **package-manager half** true, naming R1's exclusion of curl-and-execute inline. |
+| P0 minor — R5, the assert's PRESENCE unguarded | **FIXED, next door.** `check-run-pins.test.mjs` now asserts that `- name: Assert npm floor` and its `"$(npm --version)" 11.5.1` comparison are present in the committed `publish.yml`. Collected by the same `floor.yml` `node --test` run, so reversion-to-floating **and** plain deletion are both caught. Verified to fail when the step is removed. R5's text in the checker header was rewritten to say the coverage exists but is **not this program's doing**. |
+| P1 important — verify gate-set blindspot | **REPAIRED IN-RUN** (the `floor-tests` gate) and retained as the canon candidate below. |
+| P2 minor — the positive control reads the live `publish.yml` | **NO CHANGE.** Assessed safe: content is written and scanned, never executed; the file is trusted and review-protected. Kept as a stated note. |
+| P3 minor — the test file spawns the sibling gate | **NO CHANGE.** Deliberate; it is the backstop for residuals R2 and R6, and it couples by subprocess path, not by import. |
+
+One finding was raised in `GRILL.md` and is **not** fixed here, on the constitution's own instruction:
+`.dev/floor/README.md` opens *"The floor is three files"* over a three-row table while the directory
+holds 40+ checkers. That is a P4 doc-contradicts-code condition, and `CONSTITUTION.md` states the
+agent **MUST NOT auto-fix a constitution violation** — it is flagged for human review, not repaired
+in passing. It is also pre-existing (last touched in #15; #79 added a checker without updating it)
+and outside this increment's approved `## Files`.
+
+## Verdict
+
+```text
+GREEN — 0 floor-gate (blocking) findings; 5 advisory findings (1 important, 4 minor)
+```
+
+Three of the five are now fixed (see the disposition table); two were assessed and deliberately kept.
+The one important finding was already repaired within this run.
+
+**This verdict is advisory.** `/pharn-dev-review` computes no floor gate of its own — its only
+floor-grade content is `validate.mjs` GREEN, which `/pharn-dev-build` and `/pharn-dev-verify` already gated. Severity
+assignments above are LLM judgment. Whether this increment merges is the human's call.
diff --git a/.dev/features/publish-npm-floor-assert/SHIP.md b/.dev/features/publish-npm-floor-assert/SHIP.md
new file mode 100644
index 0000000..9c9cf1c
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/SHIP.md
@@ -0,0 +1,57 @@
+# SHIP — publish-npm-floor-assert
+
+Chain: `/pharn-dev-plan` → **[human approved]** → `/pharn-dev-grill` → `/pharn-dev-build` →
+`/pharn-dev-regress` → `/pharn-dev-verify` → `/pharn-dev-review`. Ran in order; ended at **GATE 2**
+(post-review human decision), not at a RED-verdict STOP.
+
+## Stages and where the run ended
+
+| # | stage | outcome |
+| - | ----- | ------- |
+| 1 | `/pharn-dev-plan` | **GATE 1** — halted; human approved. Two questions answered: compare ships **inline**; the floor-gate extension **built in this PR** (whitelist widened 2 → 4 files, recorded in `PLAN.md`) |
+| 2 | `/pharn-dev-grill` | advisory; **gates nothing**. 8 concerns (0 blocking, 3 important, 5 minor) — `GRILL.md` |
+| 3 | `/pharn-dev-build` | floor GREEN → proceed |
+| 4 | `/pharn-dev-regress` | `no-regressions` → proceed |
+| 5 | `/pharn-dev-verify` | `PASS` → proceed |
+| 6 | `/pharn-dev-review` | advisory; **GATE 2** — presented to the human |
+
+## Structural verdicts read, verbatim
+
+- **`/pharn-dev-build`** → `node .dev/floor/validate.mjs .` **exit `0`** (`FLOOR: GREEN`). Supporting: `npm run check` clean (prettier, eslint, tsc ×2, 625 vitest).
+- **`/pharn-dev-regress`** → `regression-report.json` `.verdict` = **`"no-regressions"`** (helper exit 0). `regressions: []`, `pre_existing: []`. Base `e08eb18c16ce260bb5039d039dcb9c56397d1a9e`; outside gates `tests 0→0`, `validate 0→0` over 45 files / 704 assertions. Scope partition returned **`escaped: []`**.
+- **`/pharn-dev-verify`** → `verify-report.json` `.verdict` = **`"PASS"`** (helper exit 0), `failing_gates: []`, over 8 gates: `test`, `floor-tests`, `validate`, `lint`, `format:check`, `lint:md`, `check-run-pins`, `check-action-pins` — all `0`. `verifiers: {registered: 0, findings: []}` (advisory, and structurally not a verdict input).
+
+## Pointers (cited, not restated — P4)
+
+- `.dev/features/publish-npm-floor-assert/PLAN.md` — the approved intent, incl. the literal diff and the recorded scope decision
+- `.dev/features/publish-npm-floor-assert/GRILL.md` — advisory, gates nothing
+- `.dev/features/publish-npm-floor-assert/REGRESSION.md` / `regression-report.json`
+- `.dev/features/publish-npm-floor-assert/VERIFY.md` / `verify-report.json`
+- `.dev/features/publish-npm-floor-assert/REVIEW.md` — **GREEN, 0 blocking; 5 advisory findings**
+
+## Two corrections this run made to its own reasoning (recorded, not buried)
+
+1. **The grill disproved a plan claim by execution.** `PLAN.md` credited `set -euo pipefail` with aborting on a failing `npm --version`; a command substitution used as an *argument* does not trip `set -e`. The shipped step now rests its fail-closed property on the **parse** and says so in a comment. `PLAN.md` itself still carries the original sentence — it was outside the build's writes-scope, and the floor correctly refused to let it be edited mid-build.
+2. **The regress baseline was initially wrong for orchestration reasons.** The first capture reported `tests: 1`; the cause was zsh not word-splitting an unquoted expansion, passing 45 paths as one filename. Re-run correctly, base and head are both `0`. A silently-accepted `1` would have written a false `pre_existing` entry.
+
+## Post-GATE-2 fix round (human said "fix everything")
+
+Three of the review's five advisory findings were repaired, and every verdict above was **re-computed
+against the fixed code** — the numbers in this file are the final ones:
+
+- `publish.yml`'s comment no longer overclaims: the gate sentence now scopes itself to the **package-manager half** and names R1's exclusion of curl-and-execute.
+- **Residual R5 closed.** `check-run-pins.test.mjs` now asserts the `Assert npm floor` step and its `11.5.1` comparison are present in the committed `publish.yml`, so deletion is caught, not just reversion. Proven to fail against a copy with the step removed.
+- `PLAN.md`'s determinism audit carries an explicit **CORRECTED** note retiring the false `set -e` claim.
+- Two findings were assessed and deliberately kept (the positive control reading a trusted file; the test file's subprocess coupling to the sibling gate) — both are backstops for named residuals.
+
+**Not fixed, by the constitution's own instruction:** `.dev/floor/README.md` says *"The floor is three
+files"* while the directory holds 40+ checkers — a P4 doc-contradicts-code condition. `CONSTITUTION.md`
+states the agent **MUST NOT auto-fix a constitution violation**; it is flagged for human review. It is
+pre-existing (last touched in #15) and outside this increment's `## Files`.
+
+## Standing decision
+
+The chain ran; the named floor verdicts are as shown — **this is NOT a judgment that the increment is
+good or wise; that is the human's call at the post-review gate.**
+
+`/pharn-dev-ship` did not merge, push, commit, or apply any seal.
diff --git a/.dev/features/publish-npm-floor-assert/VERIFY.md b/.dev/features/publish-npm-floor-assert/VERIFY.md
new file mode 100644
index 0000000..b5b84f2
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/VERIFY.md
@@ -0,0 +1,81 @@
+# VERIFY — publish-npm-floor-assert
+
+Machine report: `verify-report.json` (the `check-verify.mjs` verdict verbatim + the advisory
+`verifiers` block merged in after the verdict was computed).
+
+## FLOOR layer — the gates that own the verdict
+
+| gate | exit |
+| ---- | ---- |
+| `test` (`npm test` — vitest, 625 assertions over `tests/**/*.ts`) | 0 |
+| `floor-tests` (`node --test` over the floor/hook globs — 745 assertions, **incl. this feature's 41**) | 0 |
+| `validate` (`node .dev/floor/validate.mjs .`) | 0 |
+| `lint` (`eslint src`) | 0 |
+| `format:check` (prettier) | 0 |
+| `lint:md` (markdownlint over `docs/**/*.md` + `*.md`) | 0 |
+| `check-run-pins` (the gate this increment adds, over the live repo) | 0 |
+| `check-action-pins` (the sibling gate — proves the edit did not disturb it) | 0 |
+
+```text
+VERIFIED: floor gates PASS
+```
+
+`node .dev/floor/check-verify.mjs …` → `"verdict": "PASS"`, **exit 0**, `failing_gates: []`.
+
+### Gate-set composition — a deliberate widening, declared (P0, two clocks)
+
+The gate **set** is this stage's **advisory** composition; only the verdict over it is floor. Three
+gates were added beyond the command's default set, for one reason each:
+
+- **`floor-tests`.** The default set's `test` gate is `npm test`, which is **vitest over
+  `tests/**/*.ts` and does not collect `.mjs`**. This increment's only tests are
+  `.dev/floor/check-run-pins.test.mjs` — so a PASS on the default set would have certified a run in
+  which **not one of the feature's own 40 assertions executed**. That is precisely the "verified
+  means the gates passed — and these gates checked nothing about the feature" hole. Added, and it is
+  the same runner `floor.yml:28` uses in CI, so it is not a bespoke gate.
+- **`check-run-pins` / `check-action-pins`.** The new gate over the live repo, and its sibling — the
+  latter because this increment edits a workflow file the sibling scans, and "I did not break the
+  neighbouring gate" should be an integer in the report, not a claim in prose.
+
+Stated honestly: nothing floor-locks these gates into future runs (L9's residual). The widening is
+orchestration, recorded here so it is auditable rather than invisible.
+
+## ADVISORY layer — verifiers
+
+`node .dev/floor/count-verifiers.mjs .` → `{"registered":0,"verifiers":[]}`.
+
+**No verifiers registered — floor gates only.** Step 2 was a no-op; the verdict is the floor gates
+alone. Nothing was authored to fill the slot (P7).
+
+## Evidence recorded outside the gate set (not verdict inputs)
+
+These are proofs the gates structurally cannot run, listed so the report does not imply more coverage
+than the integers above carry:
+
+- **The assert program, extracted from the shipped `publish.yml` bytes** and run against six inputs:
+  `11.5.0` → exit 1 · `11.5.1` → exit 0 (inclusive boundary) · `11.17.0` → exit 0 · `12.0.2` → exit 0 ·
+  `""` → exit 1 (`unparseable version ""`) · `garbage` → exit 1. The last two exercise the fail-closed
+  path that the grill's P5 finding corrected the reasoning for.
+- **The whole step body executed verbatim** against the real local npm: `npm floor OK: npm 11.12.1 >= 11.5.1`, exit 0.
+- **`publish.yml` parses as YAML** (via the transitive `js-yaml`, not a new dependency): 6 steps, the
+  `Update npm` step gone, `permissions.id-token: write`, `environment: npm-publish`, `node-version: 24`,
+  the tag guard, and `npm publish --provenance` all intact.
+- **`grep -rn "npm@latest\|install -g npm" .github/workflows/`** → empty; the broader
+  `"@latest\|install -g\|add -g\|global add"` → also empty.
+- **The assert step's PRESENCE is now itself a gate assertion** (residual R5, closed after review):
+  removing `- name: Assert npm floor` from `publish.yml` makes `check-run-pins.test.mjs` fail —
+  demonstrated by running the same regex against a copy with the step deleted (`true` → `false`).
+
+**Re-run note:** every gate above was re-executed after the post-review fixes; these are the final
+numbers, not the pre-fix ones.
+
+## Honest residual (P0/P7)
+
+**Verified = the named gates passed. This is NOT a guarantee of correctness beyond what those gates
+check** — verifier concerns would be advisory help, not assurance, and today there are none.
+
+The specific, load-bearing limit for this increment: **`publish.yml` runs only on `release: published`,
+so no gate in this repo can execute it.** The evidence above proves the assert's *logic* and its
+*shell body*, and the PR's Actions run proves it *parses* — but the **execution proof of record is the
+next release**. Anyone reading this as "the release path is verified" is reading more than the
+integers support.
diff --git a/.dev/features/publish-npm-floor-assert/regression-report.json b/.dev/features/publish-npm-floor-assert/regression-report.json
new file mode 100644
index 0000000..c82f33b
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/regression-report.json
@@ -0,0 +1,22 @@
+{
+  "base": "e08eb18c16ce260bb5039d039dcb9c56397d1a9e",
+  "inside": [
+    ".github/workflows/publish.yml",
+    "docs/RELEASING.md",
+    ".dev/floor/check-run-pins.mjs",
+    ".dev/floor/check-run-pins.test.mjs"
+  ],
+  "outside_gates": {
+    "tests": {
+      "base": 0,
+      "head": 0
+    },
+    "validate": {
+      "base": 0,
+      "head": 0
+    }
+  },
+  "regressions": [],
+  "pre_existing": [],
+  "verdict": "no-regressions"
+}
diff --git a/.dev/features/publish-npm-floor-assert/verify-report.json b/.dev/features/publish-npm-floor-assert/verify-report.json
new file mode 100644
index 0000000..3b88e00
--- /dev/null
+++ b/.dev/features/publish-npm-floor-assert/verify-report.json
@@ -0,0 +1,19 @@
+{
+  "feature": "publish-npm-floor-assert",
+  "gates": {
+    "check-action-pins": 0,
+    "check-run-pins": 0,
+    "floor-tests": 0,
+    "format:check": 0,
+    "lint": 0,
+    "lint:md": 0,
+    "test": 0,
+    "validate": 0
+  },
+  "verdict": "PASS",
+  "failing_gates": [],
+  "verifiers": {
+    "registered": 0,
+    "findings": []
+  }
+}
diff --git a/.dev/floor/check-run-pins.mjs b/.dev/floor/check-run-pins.mjs
new file mode 100644
index 0000000..ed97344
--- /dev/null
+++ b/.dev/floor/check-run-pins.mjs
@@ -0,0 +1,407 @@
+#!/usr/bin/env node
+// .dev/floor/check-run-pins.mjs — deterministic floor check over the SHELL COMMANDS the GitHub
+// Actions definitions in this repo execute: every package a `run:` line installs or execs must be
+// pinned to an EXACT semver. A floating spec (`@latest`, `@next`, `^1.2.3`) or a bare name is a
+// violation.
+//
+// NON-LLM, dependency-free (Node stdlib only). No network, no child_process, no eval, no dynamic import.
+//
+// WHY IT EXISTS (P7 — a real, already-observed drift, not a hypothetical): publish.yml ran
+// `npm install -g npm@latest` INSIDE the release job — the one job holding `id-token: write` and the
+// `npm-publish` environment — so whatever npm shipped that day executed the release. It had silently
+// crossed a major: the registry `latest` dist-tag was npm 12.0.2 while the step was written against
+// 11.x. `check-action-pins.mjs` could never have caught it: its contract is `uses:` refs, and this
+// was a `run:` line. That gap is what this file closes.
+//
+// WHAT IS GUARANTEED (P0 — floor primitive #3, enum/regex; ARCHITECTURE.md §2):
+//   the FORM of every package spec this scanner ENUMERATES — an exact `MAJOR.MINOR.PATCH` version.
+// WHAT IS NOT (named residuals, never claimed):
+//   • R1 — NON-PACKAGE-MANAGER PULLS. `curl … | sh`, a raw binary download, `pip`/`go install`/
+//     `cargo install`/`brew`. gitleaks.yml's `curl` is DELIBERATELY out of contract: it is version-
+//     AND SHA-256-pinned, and teaching this checker to recognise "that curl is checksum-verified"
+//     would be a CLASSIFICATION, which P5 forbids. Out of scope by construction, not by oversight.
+//     Also out of contract, and of the same laundering shape .github/actions/** had before it was
+//     walked: `run: npm run <script>` executes a package.json script, which could itself pull a
+//     floating package. This scanner reads .github/** only and can never see it.
+//   • R2 — ENUMERATOR DUPLICATION. collectFiles/safeLstat/isYaml/LINE_SPLIT_RE/emit are duplicated
+//     from check-action-pins.mjs, so a walker fix must be applied twice. A shared module was
+//     rejected: NO floor script imports another, and that isolation is a safety property (one
+//     module's bug cannot take down two gates). check-run-pins.test.mjs cross-checks that both
+//     checkers enumerate the SAME files[] for this repo, so the two walkers cannot drift silently.
+//   • R3 — SHELL INDIRECTION. A package name in a variable (`npm i -g "$PKG"`), `eval`, a heredoc,
+//     or base64 defeats a line scanner. `$`-bearing specs are reported as `unpinnable-version`;
+//     a name assembled out of sight is not seen at all.
+//   • R4 — VALUE-SEPARATED FLAGS. `npm i --some-flag value pkg@1.2.3` may read `value` as a package
+//     spec. URLs (`://`) and paths are excluded; other flag values are not. Fail-CLOSED noise.
+//   • R5 — the ASSERT's PRESENCE, covered NEXT DOOR rather than here. THIS checker enforces only
+//     that no floating install exists; it classifies specs it finds, so deleting publish.yml's
+//     `Assert npm floor` step outright would trip nothing in this file. That other half is asserted
+//     by check-run-pins.test.mjs (the step and its 11.5.1 floor value must be present), which the
+//     same floor.yml `node --test` run collects — so the guarantee is whole, but it is NOT this
+//     program's doing. Named so the split is visible.
+//   • R7 — CONTINUATION IS BACKSLASH-ONLY. Trailing `\\` joins the next physical line before
+//     parsing (first line number kept for findings). A `run: |` block without `\\` is still one
+//     shell line per YAML line — correct. Heredocs, quotes spanning lines, and other multi-line
+//     shell forms are not reconstructed.
+//   • R6 — SYMLINK ASYMMETRY, INHERITED. A symlink under .github/workflows/ is reported as
+//     `unreadable-file`, but a symlinked .github/actions/**/action.yml is skipped SILENTLY by the
+//     walk. check-action-pins.mjs behaves identically (verified against the same fixture), so this
+//     is inherited, not introduced — and fixing it belongs in a change that touches BOTH walkers,
+//     which is a different axis than this gate. check-run-pins.test.mjs pins the asymmetry with an
+//     assertion that both gates agree, so neither can change it unilaterally or silently.
+//   • Total YAML fidelity. This is a LINE SCANNER, not a YAML parser (stdlib-only; js-yaml is a
+//     transitive dep, not ours). Every line of every enumerated file is scanned, which is why no
+//     block-scalar scope tracking is needed — and why an unrecognised shape fails TOWARD flagging.
+//
+// WHAT IT ENUMERATES (identical to check-action-pins — both are executed by GitHub):
+//   1. `.github/workflows/*.{yml,yaml}` — non-recursive, mirroring GitHub.
+//   2. `.github/actions/**/action.{yml,yaml}` — LOCAL composite/docker action definitions, walked
+//      recursively. A composite action's `runs.steps[].run:` is a real shell command running with
+//      the job's token; scanning only workflows would make it a laundering path.
+//
+// Usage:  node .dev/floor/check-run-pins.mjs [targetDir]      (default: cwd)
+// Output: {"checked":<int>,"skipped":<int>,"files":[...],"violations":[{file,line,ref,reason}]}
+// Exit:   0 clean · 1 >=1 violation
+//
+// Every output field is enum-gated / path-resolved (paths, ints, an enum `reason`). The `ref` value
+// is copied verbatim from the scanned file, so it inherits that file's trust — but NO decision reads
+// it: the verdict is `violations.length > 0`, an integer test (P2, fix #1). The field is named `ref`,
+// not `spec`, so this checker's records are shape-identical to check-action-pins'.
+
+import { readFileSync, readdirSync, existsSync, lstatSync } from "node:fs";
+import { join, sep } from "node:path";
+
+// An EXACT version: MAJOR.MINOR.PATCH, with optional prerelease / build metadata. Anything else —
+// `latest`, `next`, `^1.2.3`, `~1.2`, `1.x`, `>=2`, `beta` — is floating by definition.
+const EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// Split on ALL THREE line-ending conventions. Splitting on "\n" alone leaves a trailing "\r" on
+// every line of a CRLF file, which defeats line-anchored matching and makes the WHOLE FILE
+// invisible — exit 0, checked:0, byte-identical to a clean repo. Reachable BY ACCIDENT via
+// core.autocrlf; this repo has no .gitattributes and prettier's globs exclude .github/**.
+// (The same root cause cost check-action-pins a silent hole; it is fixed here by construction.)
+const LINE_SPLIT_RE = /\r\n|\r|\n/;
+
+// Shell command separators. A single line legitimately carries several commands
+// (`npm ci && npm i -g x@latest`), and scanning only the first would hide the rest.
+const SEGMENT_SPLIT_RE = /&&|\|\||;|\|/;
+
+// A `name:` key in KEY POSITION — line start, after an optional YAML sequence dash. Anchoring is
+// load-bearing and deliberate: an UNANCHORED test would also match a `run:` body line such as
+// `echo "name: x" && npm i -g y@latest`, and skipping that line would be a fail-OPEN miss. Anchored,
+// only a genuine step-name line is skipped.
+const NAME_KEY_START_RE = /^\s*-?\s*["']?name["']?\s*:/;
+// A `run` key ANYWHERE — this is what keeps the flow-mapping form `- {name: n, run: npm i -g p}`
+// in scope even though it opens with a name-ish key.
+const RUN_KEY_RE = /(?:^|[\s,{[])["']?run["']?\s*:/;
+
+// Reasons are an ENUM, never prose (P5 — membership, not classification).
+const REASON = {
+  FLOATING: "floating-version", // `pkg@latest`, `pkg@^1.2.3` — resolves differently over time
+  UNPINNED: "unpinned-package", // `pkg`, `@scope/pkg`, `github:user/repo` — no version at all
+  UNPINNABLE: "unpinnable-version", // a ${{ }} expression or $VAR — no fixed identity to pin
+  UNREADABLE: "unreadable-file", // could not stat/read (e.g. a dangling symlink)
+};
+
+// Recognised command heads, matched as an exact token sequence. LONGEST FIRST at each position, so
+// `yarn global add` is never mis-read as `yarn` + junk.
+//   install  — every non-flag argument is a package spec
+//   exec     — the package is resolved and RUN; only the package position is a spec
+//   lockfile — resolves from a committed lockfile, so it is deterministic without a version
+const HEADS = [
+  { tokens: ["yarn", "global", "add"], kind: "install" },
+  { tokens: ["npm", "install"], kind: "install" },
+  { tokens: ["npm", "i"], kind: "install" },
+  { tokens: ["npm", "add"], kind: "install" },
+  { tokens: ["npm", "exec"], kind: "exec" },
+  { tokens: ["npm", "ci"], kind: "lockfile" },
+  { tokens: ["pnpm", "install"], kind: "install" },
+  { tokens: ["pnpm", "i"], kind: "install" },
+  { tokens: ["pnpm", "add"], kind: "install" },
+  { tokens: ["pnpm", "dlx"], kind: "exec" },
+  { tokens: ["yarn", "add"], kind: "install" },
+  { tokens: ["yarn", "dlx"], kind: "exec" },
+  { tokens: ["bun", "install"], kind: "install" },
+  { tokens: ["bun", "i"], kind: "install" },
+  { tokens: ["bun", "add"], kind: "install" },
+  { tokens: ["npx"], kind: "exec" },
+  { tokens: ["bunx"], kind: "exec" },
+].sort((a, b) => b.tokens.length - a.tokens.length);
+
+// An argument that pulls nothing from a registry: a local path, a file: spec, a tarball, or a URL
+// (the common shape of a value-separated flag such as `--registry https://…`).
+const NOT_A_REGISTRY_SPEC_RE = /^(?:\.\.?[/\\]|[/\\]|~[/\\]|file:)|\.(?:tgz|tar\.gz)$|:\/\//;
+
+function emit(obj, code) {
+  // NOT process.exit(): stdout is ASYNC on a pipe, and exiting truncates it — a large violation set
+  // was cut at exactly 65536 bytes through `| cat`, leaving consumers with unparseable output.
+  // Setting exitCode lets the write drain and Node exit naturally.
+  process.stdout.write(JSON.stringify(obj) + "\n");
+  process.exitCode = code;
+}
+
+const isYaml = (f) => /\.ya?ml$/i.test(f); // case-INsensitive: `CI.YML` must not be silently dropped
+
+// lstat, not stat: a DANGLING symlink makes stat throw ENOENT, which would crash the walk before any
+// JSON is emitted.
+function safeLstat(abs) {
+  try {
+    return lstatSync(abs);
+  } catch {
+    return null;
+  }
+}
+
+// Enumerate every file GitHub would execute. Returns readable {rel, abs} pairs plus unreadable ones.
+function collectFiles(target) {
+  const found = [];
+  const unreadable = [];
+
+  // 1. workflows — flat, mirroring what GitHub actually executes.
+  const wfRel = join(".github", "workflows");
+  const wfDir = join(target, wfRel);
+  if (existsSync(wfDir)) {
+    let names = [];
+    try {
+      names = readdirSync(wfDir).sort();
+    } catch {
+      /* unreadable dir: nothing to enumerate */
+    }
+    for (const name of names) {
+      if (!isYaml(name)) continue;
+      const abs = join(wfDir, name);
+      const st = safeLstat(abs);
+      if (st === null || st.isSymbolicLink()) {
+        unreadable.push({ rel: join(wfRel, name), abs });
+        continue;
+      }
+      if (st.isFile()) found.push({ rel: join(wfRel, name), abs });
+    }
+  }
+
+  // 2. local action definitions — recursive, depth-bounded, symlink-refusing.
+  const walk = (absDir, relDir, depth) => {
+    if (depth > 8) return; // bounded: a pathological tree cannot hang the floor
+    let names = [];
+    try {
+      names = readdirSync(absDir).sort();
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const abs = join(absDir, name);
+      const rel = join(relDir, name);
+      const st = safeLstat(abs);
+      if (st === null) {
+        unreadable.push({ rel, abs });
+        continue;
+      }
+      if (st.isSymbolicLink()) continue; // never follow a symlink out of the tree
+      if (st.isDirectory()) walk(abs, rel, depth + 1);
+      else if (st.isFile() && /^action\.ya?ml$/i.test(name)) found.push({ rel, abs });
+    }
+  };
+  const actRel = join(".github", "actions");
+  const actDir = join(target, actRel);
+  if (existsSync(actDir)) walk(actDir, actRel, 0);
+
+  return { found, unreadable };
+}
+
+// A `${{ … }}` expression contains SPACES, so a naive whitespace tokenizer shatters
+// `pkg@${{ inputs.v }}` into three tokens and reports three findings for one spec. Collapsing the
+// expression to a space-free placeholder BEFORE tokenizing keeps it one spec — and the placeholder
+// still carries `$`, so classifySpec reports it as unpinnable rather than conforming.
+const collapseExpressions = (line) => line.replace(/\$\{\{.*?\}\}/g, "${{...}}");
+
+// Normalise ONE token: drop surrounding quotes (which must not smuggle a floating spec past the
+// tests), a leading `$(`/`(` from a command substitution, and trailing shell / YAML-flow punctuation
+// (`flow@latest}` inside `- {name: n, run: …}` is the spec `flow@latest`).
+const normalizeToken = (t) =>
+  t
+    .replace(/^["']|["']$/g, "")
+    .replace(/^\$\(|^\(/, "")
+    .replace(/[),;\]}]+$/, "")
+    .replace(/^["']|["']$/g, "");
+
+// Classify ONE package spec. Returns a REASON, or null when it conforms.
+// ORDER IS LOAD-BEARING: the expression test runs FIRST, so `pkg@${{ inputs.v }}` is reported as
+// unpinnable rather than mislabeled floating.
+function classifySpec(spec) {
+  if (spec.includes("${{") || spec.includes("$")) return REASON.UNPINNABLE;
+
+  // `@scope/name@1.2.3` — the LAST `@` separates the version. An `@` at index 0 is the scope
+  // sigil, not a separator, so `@scope/name` correctly reads as having no version.
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return REASON.UNPINNED;
+
+  const version = spec.slice(at + 1);
+  if (version === "") return REASON.UNPINNED;
+  return EXACT_SEMVER_RE.test(version) ? null : REASON.FLOATING;
+}
+
+// Pull the package-spec positions out of one command's arguments.
+// Returns {specs, exempt} — `exempt` counts args deliberately excluded, so an exemption can never
+// become a silent hole.
+function specPositions(kind, args) {
+  const specs = [];
+  let exempt = 0;
+
+  if (kind === "install") {
+    for (const a of args) {
+      if (a === "--" || a.startsWith("-")) continue; // flags are not packages
+      if (NOT_A_REGISTRY_SPEC_RE.test(a)) {
+        exempt += 1;
+        continue;
+      }
+      specs.push(a);
+    }
+    return { specs, exempt };
+  }
+
+  // exec: the package is whatever the runner RESOLVES — the first positional, or the value of
+  // -p/--package. Later positionals are the executed command and ITS arguments, never packages.
+  let sawPackageFlag = false;
+  let tookPositional = false;
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") continue;
+    if (a === "-p" || a === "--package") {
+      const v = args[j + 1];
+      if (v !== undefined) {
+        specs.push(v);
+        j += 1;
+      }
+      sawPackageFlag = true;
+      continue;
+    }
+    if (a.startsWith("--package=")) {
+      specs.push(a.slice("--package=".length));
+      sawPackageFlag = true;
+      continue;
+    }
+    if (a.startsWith("-")) continue;
+    // With an explicit -p/--package, the first positional is the COMMAND, not a package.
+    if (!tookPositional && !sawPackageFlag) {
+      specs.push(a);
+      tookPositional = true;
+    }
+  }
+
+  const kept = [];
+  for (const s of specs) {
+    if (NOT_A_REGISTRY_SPEC_RE.test(s)) exempt += 1;
+    else kept.push(s);
+  }
+  return { specs: kept, exempt };
+}
+
+// Find the FIRST recognised command head in a token list. Scanning from any position (not just
+// token 0) is what makes `run:`, `- run:`, `sudo`, and `env FOO=1` prefixes all work uniformly
+// without enumerating them.
+function findHead(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    for (const head of HEADS) {
+      if (head.tokens.every((t, k) => tokens[i + k] === t)) {
+        return { kind: head.kind, args: tokens.slice(i + head.tokens.length) };
+      }
+    }
+  }
+  return null;
+}
+
+// Parse ONE line into zero or more {reason, ref} records, plus an exempt count.
+function parseLine(raw) {
+  const out = [];
+  let exempt = 0;
+
+  if (raw.trimStart().startsWith("#")) return { out, exempt }; // a YAML comment is never executed
+  // A step name is never executed — but only when the line does not ALSO declare a run key.
+  if (NAME_KEY_START_RE.test(raw) && !RUN_KEY_RE.test(raw)) return { out, exempt };
+
+  for (const segment of collapseExpressions(raw).split(SEGMENT_SPLIT_RE)) {
+    const tokens = segment.split(/\s+/).filter(Boolean).map(normalizeToken).filter(Boolean);
+    const head = findHead(tokens);
+    if (head === null) continue;
+
+    if (head.kind === "lockfile") {
+      exempt += 1; // `npm ci` — deterministic from the committed lockfile
+      continue;
+    }
+
+    const { specs, exempt: argExempt } = specPositions(head.kind, head.args);
+    exempt += argExempt;
+
+    // An install head with NO package argument is a lockfile install (`npm install` bare). Guard on
+    // argExempt so an install whose only argument was an excluded PATH is counted once, not twice.
+    if (specs.length === 0) {
+      if (head.kind === "install" && argExempt === 0) exempt += 1;
+      continue;
+    }
+
+    for (const spec of specs) out.push({ reason: classifySpec(spec), ref: spec });
+  }
+
+  return { out, exempt };
+}
+
+
+// Join shell continuation lines (trailing `\\`) into logical lines. The first physical line number
+// is preserved for findings — a continued `npm install \\` / `pkg@latest` pair reports line 1.
+function joinContinuations(lines) {
+  const logical = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = i + 1;
+    let text = lines[i];
+    i += 1;
+    while (text.trimEnd().endsWith("\\") && i < lines.length) {
+      text = `${text.trimEnd().slice(0, -1)} ${lines[i].trimStart()}`;
+      i += 1;
+    }
+    logical.push({ text, line });
+  }
+  return logical;
+}
+
+function main() {
+  const target = process.argv[2] || process.cwd();
+  const { found, unreadable } = collectFiles(target);
+
+  const violations = [];
+  let checked = 0;
+  let skipped = 0;
+
+  // An entry we cannot read is a VIOLATION, not a skip: "I could not look" must never render as
+  // "there was nothing to find".
+  for (const u of unreadable) {
+    violations.push({ file: u.rel.split(sep).join("/"), line: 0, ref: "", reason: REASON.UNREADABLE });
+  }
+
+  for (const f of found) {
+    const rel = f.rel.split(sep).join("/");
+    let lines;
+    try {
+      lines = readFileSync(f.abs, "utf8").split(LINE_SPLIT_RE);
+    } catch {
+      violations.push({ file: rel, line: 0, ref: "", reason: REASON.UNREADABLE });
+      continue;
+    }
+
+    for (const { text, line } of joinContinuations(lines)) {
+      const { out, exempt } = parseLine(text);
+      skipped += exempt;
+      for (const { reason, ref } of out) {
+        checked += 1;
+        if (reason !== null) violations.push({ file: rel, line, ref, reason });
+      }
+    }
+  }
+
+  emit(
+    { checked, skipped, files: found.map((f) => f.rel.split(sep).join("/")), violations },
+    violations.length > 0 ? 1 : 0,
+  );
+}
+
+main();
diff --git a/.dev/floor/check-run-pins.test.mjs b/.dev/floor/check-run-pins.test.mjs
new file mode 100644
index 0000000..3e3b561
--- /dev/null
+++ b/.dev/floor/check-run-pins.test.mjs
@@ -0,0 +1,451 @@
+// .dev/floor/check-run-pins.test.mjs — tests for the deterministic run-line pin floor check.
+//
+// NO `claude -p`, NO git, NO network. Three kinds of test, deliberately mixed (the split
+// check-action-pins.test.mjs makes, plus one addition forced by this gate's shape):
+//
+//   1. HERMETIC — each builds a small repo in an os.tmpdir() scratch dir and asserts the public
+//      surface (exit code + stdout JSON) by subprocess.
+//   2. LIVE REPO-CONSISTENCY (the ★) — validates the COMMITTED tree against REALITY. This is what
+//      makes a floating install a BUILD FAILURE rather than a property someone has to remember to
+//      re-grep: floor.yml's `node --test ".dev/**/*.test.mjs"` collects this file on every
+//      pull_request and every push to main, so the gate needs no workflow change to be wired.
+//   3. POSITIVE CONTROL (the ★★) — the addition. This repo's live numbers are `checked: 0`,
+//      because after the publish fix NO workflow line contains a pinned install at all. A live
+//      assertion of `violations: []` over `checked: 0` is therefore weak in exactly the way exit 0
+//      is weak: it is ALSO what a checker returns when it finds nothing to inspect. So the live
+//      workflow text is read from disk, ONE line is mutated back to the `npm install -g npm@latest`
+//      this increment deleted, and the checker must flag it — proving the scanner fires on THIS
+//      repo's own file shape, not merely on synthetic fixtures.
+//
+// The ✱ tests are the defects found by running the first version of this checker against a fixture
+// covering every planned case. Each was reproduced before being fixed:
+//   ✱ `pkg@${{ inputs.v }}`  → whitespace-tokenized into THREE findings for one spec
+//   ✱ `- {name: n, run: …}`  → the spec was reported as `flow@latest}` with the flow brace attached
+//   ✱ `$(npm i -g x@latest)` → the `$(` prefix hid the head entirely — a silent MISS, not noise
+//   ✱ `npm i ./local`        → counted `skipped` twice (path exemption + empty-args exemption)
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readdirSync, readFileSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const here = dirname(fileURLToPath(import.meta.url)); // .dev/floor
+const REPO = join(here, "..", ".."); // repo root
+const CAP = join(here, "check-run-pins.mjs");
+const SIBLING = join(here, "check-action-pins.mjs");
+
+function run(targetDir, capPath = CAP) {
+  return spawnSync(process.execPath, [capPath, targetDir], { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function json(r) {
+  return JSON.parse(r.stdout);
+}
+function scratch() {
+  return mkdtempSync(join(tmpdir(), "pharn-runpins-"));
+}
+function reasons(r) {
+  return json(r).violations.map((v) => v.reason);
+}
+function refs(r) {
+  return json(r).violations.map((v) => v.ref);
+}
+
+// Build a scratch repo whose single workflow contains `body` verbatim under a steps: list.
+function repoWith(body, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), `name: t\njobs:\n  j:\n    steps:\n${body}\n`);
+  return root;
+}
+// The same, but writing the file bytes exactly as given (for line-ending fixtures).
+function repoWithRaw(bytes, { name = "ci.yml" } = {}) {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  writeFileSync(join(root, ".github", "workflows", name), bytes);
+  return root;
+}
+
+// ---------------------------------------------------------------------------
+// Conforming shapes
+
+test("an EXACT semver pin → exit 0, checked counts it", () => {
+  const r = run(repoWith("      - run: npm install -g npm@11.5.1"));
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r).violations, []);
+  assert.equal(json(r).checked, 1);
+});
+
+test("a prerelease / build-metadata version is still an exact pin", () => {
+  for (const v of ["1.2.3-rc.1", "1.2.3+build.5", "1.2.3-beta.2+exp"]) {
+    const r = run(repoWith(`      - run: npm i -g pkg@${v}`));
+    assert.equal(r.status, 0, `expected ${v} to conform`);
+  }
+});
+
+test("`npm ci` is a lockfile install → exit 0, counted in skipped (never a silent pass)", () => {
+  const r = run(repoWith("      - run: npm ci"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).skipped, 1);
+  assert.equal(json(r).checked, 0);
+});
+
+test("bare `npm install` (zero package args) is a lockfile install → skipped, not a violation", () => {
+  const r = run(repoWith("      - run: npm install"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).skipped, 1);
+});
+
+test("`npm run <script>` and `npm publish` are not installs and are never classified", () => {
+  const r = run(repoWith("      - run: npm run build\n      - run: npm publish --provenance --access public"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+  assert.equal(json(r).skipped, 0);
+});
+
+test("a local path / file: / tarball arg pulls nothing from a registry → exempt, counted in skipped", () => {
+  const r = run(repoWith("      - run: npm i ./local\n      - run: npm i file:../x\n      - run: npm i ./p.tgz"));
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r).violations, []);
+  // ✱ each of the three counts ONCE — the path exemption must not also fire the empty-args exemption.
+  assert.equal(json(r).skipped, 3);
+});
+
+// ---------------------------------------------------------------------------
+// Violating shapes — the enum
+
+test("`npm install -g npm@latest` → exit 1, floating-version (the exact line this increment deleted)", () => {
+  const r = run(repoWith("      - run: npm install -g npm@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["floating-version"]);
+  assert.deepEqual(refs(r), ["npm@latest"]);
+});
+
+test("every floating specifier form is floating-version, not just a dist-tag", () => {
+  for (const v of ["latest", "next", "beta", "^1.2.3", "~1.2", "1.x", ">=2", "1.2"]) {
+    const r = run(repoWith(`      - run: npm i -g pkg@${v}`));
+    assert.equal(r.status, 1, `expected @${v} to be flagged`);
+    assert.deepEqual(reasons(r), ["floating-version"], `wrong reason for @${v}`);
+  }
+});
+
+test("a bare package name → unpinned-package", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g typescript"))), ["unpinned-package"]);
+});
+
+test("a git / github spec has no version → unpinned-package", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g github:user/repo"))), ["unpinned-package"]);
+});
+
+test("✱ a ${{ }} expression version → ONE unpinnable-version finding, not three tokens", () => {
+  const r = run(repoWith("      - run: npm i -g pkg@${{ inputs.version }}"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unpinnable-version"]);
+});
+
+test("a shell variable version → unpinnable-version (not mislabeled floating)", () => {
+  assert.deepEqual(reasons(run(repoWith("      - run: npm i -g pkg@$VERSION"))), ["unpinnable-version"]);
+});
+
+// ---------------------------------------------------------------------------
+// Scoped packages — the `@` boundary
+
+test("@scope/pkg@1.2.3 conforms; @scope/pkg alone is unpinned (the scope sigil is not a separator)", () => {
+  assert.equal(run(repoWith("      - run: npm i -g @scope/pkg@1.2.3")).status, 0);
+  const r = run(repoWith("      - run: npm i -g @scope/pkg"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unpinned-package"]);
+  assert.deepEqual(refs(r), ["@scope/pkg"]);
+});
+
+// ---------------------------------------------------------------------------
+// exec-kind — only the package position is a spec
+
+test("`npx tsx@4.7.0 src/index.ts` → exit 0: the script argument is NOT a package", () => {
+  const r = run(repoWith("      - run: npx tsx@4.7.0 src/index.ts"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1); // exactly one spec classified, not two
+});
+
+test("`npx tsx src/index.ts` → exit 1 on the package only", () => {
+  const r = run(repoWith("      - run: npx tsx src/index.ts"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["tsx"]);
+});
+
+test("`npx -p pkg@1.5.0 cmd` reads the -p VALUE as the package and the positional as the command", () => {
+  const r = run(repoWith("      - run: npx -p cowsay@1.5.0 cowsay hi"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1);
+});
+
+test("`npx --package=pkg cmd` with no version → unpinned-package on the flag value", () => {
+  const r = run(repoWith("      - run: npx --package=cowsay cowsay hi"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["cowsay"]);
+});
+
+test("the head table is not npm-only — pnpm / yarn / bun / bunx / dlx are all recognised", () => {
+  const cases = [
+    ["pnpm add -g a@latest", "floating-version"],
+    ["pnpm dlx b", "unpinned-package"],
+    ["yarn global add c@next", "floating-version"],
+    ["yarn add d", "unpinned-package"],
+    ["yarn dlx e", "unpinned-package"],
+    ["bun add -g f@latest", "floating-version"],
+    ["bunx g", "unpinned-package"],
+    ["npm exec h", "unpinned-package"],
+  ];
+  for (const [cmd, reason] of cases) {
+    const r = run(repoWith(`      - run: ${cmd}`));
+    assert.equal(r.status, 1, `expected \`${cmd}\` to be flagged`);
+    assert.deepEqual(reasons(r), [reason], `wrong reason for \`${cmd}\``);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Line-shape handling
+
+test("chained commands are split — the SECOND command is not hidden by the first", () => {
+  const r = run(repoWith("      - run: npm ci && npm i -g x@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["x@latest"]);
+  assert.equal(json(r).skipped, 1); // the `npm ci` half still counted
+});
+
+test("a `sudo` / `env` prefix does not hide the command (the head is matched at any position)", () => {
+  assert.equal(run(repoWith("      - run: sudo npm i -g p@latest")).status, 1);
+  assert.equal(run(repoWith("      - run: env FOO=1 npm i -g p@latest")).status, 1);
+});
+
+test("✱ a $( ) command substitution does not hide the head (this was a silent MISS)", () => {
+  const r = run(repoWith("      - run: $(npm i -g hidden@latest)"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["hidden@latest"]);
+});
+
+test("✱ a flow-mapping step reports the spec WITHOUT the trailing brace", () => {
+  const r = run(repoWith("      - {name: n, run: npm i -g flow@latest}"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["flow@latest"]);
+});
+
+test("a quoted spec cannot smuggle a floating version past the version test", () => {
+  assert.deepEqual(reasons(run(repoWith(`      - run: npm i -g "pkg@latest"`))), ["floating-version"]);
+  assert.deepEqual(reasons(run(repoWith(`      - run: npm i -g 'pkg@latest'`))), ["floating-version"]);
+});
+
+test("a run: | block scalar body is scanned with no scope tracking (every line is scanned)", () => {
+  const r = run(repoWith("      - run: |\n          set -e\n          npm i -g deep@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["deep@latest"]);
+});
+
+test("shell continuation lines (trailing \\) are joined — package args on the next line classify", () => {
+  const r = run(repoWith("      - run: npm install \\\n          pkg@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["pkg@latest"]);
+  assert.equal(json(r).violations[0].line, 5); // first physical line of the continued command
+});
+
+test("a continued exact pin conforms", () => {
+  const r = run(repoWith("      - run: npm install -g \\\n          npm@11.5.1"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 1);
+});
+
+test("continuation inside a run: | block is joined before parsing", () => {
+  const r = run(repoWith("      - run: |\n          npm i -g \\\n              deep@latest"));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["deep@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// Deterministic exclusions — and the fail-OPEN holes they must NOT create
+
+test("★ a YAML comment is never executed → exit 0 (this protects publish.yml's own comment block)", () => {
+  const r = run(repoWith("      # npm install -g npm@latest"));
+  assert.equal(r.status, 0);
+  assert.equal(json(r).checked, 0);
+});
+
+test("★ a step NAME is never executed → exit 0; but the same line with a run key IS scanned", () => {
+  assert.equal(run(repoWith("      - name: npm install -g inprose@latest")).status, 0);
+  assert.equal(run(repoWith("      - {name: n, run: npm i -g flow@latest}")).status, 1);
+});
+
+test("★ the name-exclusion is ANCHORED — `echo \"name: x\" && npm i -g p@latest` is NOT skipped", () => {
+  // An unanchored `name:` test would swallow this whole line: a fail-OPEN miss, not noise.
+  const r = run(repoWith(`      - run: echo "name: x" && npm i -g sneaky@latest`));
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["sneaky@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// File enumeration — inherited hard-won behavior
+
+test("CRLF line endings do not hide a violation (whole file was invisible in the sibling gate)", () => {
+  const root = repoWithRaw("name: t\r\njobs:\r\n  j:\r\n    steps:\r\n      - run: npm i -g p@latest\r\n");
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["p@latest"]);
+});
+
+test("lone-CR (classic Mac) line endings do not collapse the file into one invisible line", () => {
+  const root = repoWithRaw("name: t\rjobs:\r  j:\r    steps:\r      - run: npm i -g p@latest\r");
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["p@latest"]);
+});
+
+test("an UPPERCASE workflow filename is still opened", () => {
+  const r = run(repoWith("      - run: npm i -g p@latest", { name: "CI.YML" }));
+  assert.equal(r.status, 1);
+  assert.equal(json(r).files.length, 1);
+});
+
+test("a local composite action's run: is walked — it is not a laundering path", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "actions", "setup"), { recursive: true });
+  writeFileSync(
+    join(root, ".github", "actions", "setup", "action.yml"),
+    "name: setup\nruns:\n  using: composite\n  steps:\n    - run: npm i -g sneaky@latest\n      shell: bash\n",
+  );
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(refs(r), ["sneaky@latest"]);
+});
+
+test("a dangling symlink in workflows/ is a VIOLATION, not a skip, and JSON is still emitted", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  symlinkSync(join(root, "nope"), join(root, ".github", "workflows", "d.yml"));
+  const r = run(root);
+  assert.equal(r.status, 1);
+  assert.deepEqual(reasons(r), ["unreadable-file"]);
+  assert.deepEqual(json(r).files, []); // it was never opened, and says so
+});
+
+// This pins CURRENT, INHERITED behavior rather than desired behavior — see the R6 residual in
+// check-run-pins.mjs. A symlinked action.yml is skipped SILENTLY by the .github/actions/** walk,
+// while the same symlink under .github/workflows/ is reported. Both gates agree (verified by
+// running check-action-pins.mjs against the identical fixture), so this test exists to make the
+// asymmetry VISIBLE and to fail loudly if either gate changes it unilaterally.
+test("a symlinked action.yml is currently skipped silently — asymmetry pinned, both gates agree", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "actions", "x"), { recursive: true });
+  symlinkSync(join(root, "nope"), join(root, ".github", "actions", "x", "action.yml"));
+
+  const mine = run(root);
+  const sibling = run(root, SIBLING);
+  assert.equal(mine.status, 0);
+  assert.deepEqual(json(mine), { checked: 0, skipped: 0, files: [], violations: [] });
+  assert.equal(sibling.status, 0);
+  assert.deepEqual(json(mine).violations, json(sibling).violations, "the two gates must agree on symlink handling");
+});
+
+test("a repo with no .github at all emits valid JSON and exits 0", () => {
+  const r = run(scratch());
+  assert.equal(r.status, 0);
+  assert.deepEqual(json(r), { checked: 0, skipped: 0, files: [], violations: [] });
+});
+
+test("a large violation set survives the pipe (stdout must not be truncated)", () => {
+  const body = Array.from({ length: 2000 }, (_, i) => `      - run: npm i -g pkg${i}@latest`).join("\n");
+  const r = run(repoWith(body));
+  assert.equal(r.status, 1);
+  assert.equal(json(r).violations.length, 2000);
+});
+
+// ---------------------------------------------------------------------------
+// ★ LIVE REPO-CONSISTENCY — the committed tree, not a fixture
+
+test("★ the live repo has NO floating install in any workflow run: line", () => {
+  const r = run(REPO);
+  const d = json(r);
+  assert.deepEqual(d.violations, [], `unexpected violations: ${JSON.stringify(d.violations)}`);
+  assert.equal(r.status, 0);
+
+  // `npm ci` in ci.yml and publish.yml — asserted EXACTLY, so an exemption can never become a
+  // silent hole. If this number changes, a lockfile install was added or removed on purpose.
+  assert.equal(d.skipped, 2);
+
+  // Independent recount of the enumerated workflow files, case-insensitively — exit 0 is also what
+  // a checker returns when it opened nothing.
+  const expected = readdirSync(join(REPO, ".github", "workflows"))
+    .filter((f) => /\.ya?ml$/i.test(f))
+    .sort()
+    .map((f) => `.github/workflows/${f}`);
+  assert.deepEqual(d.files, expected);
+  assert.ok(expected.length >= 5, "expected at least five workflows in this repo");
+});
+
+test("★ publish.yml carries no `npm install -g` and no `@latest` at all", () => {
+  const text = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+  const code = text
+    .split(/\r\n|\r|\n/)
+    .filter((l) => !l.trimStart().startsWith("#"))
+    .join("\n");
+  assert.ok(!/install\s+-g/.test(code), "publish.yml reintroduced a global install");
+  assert.ok(!/@latest/.test(code), "publish.yml reintroduced an @latest ref");
+});
+
+// Closes residual R5. The CHECKER cannot enforce that a step EXISTS — it only classifies package
+// specs it finds, so deleting the assert outright would trip nothing in check-run-pins.mjs. This
+// assertion covers the other half, in the same place and by the same runner (floor.yml's
+// `node --test`), so the increment's headline guarantee is protected against BOTH reversion to a
+// floating install AND plain deletion. It reads the committed file; it never executes it.
+test("★ publish.yml still ENFORCES the npm floor — the assert step and its floor value are present", () => {
+  const text = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+  const code = text
+    .split(/\r\n|\r|\n/)
+    .filter((l) => !l.trimStart().startsWith("#"))
+    .join("\n");
+
+  assert.match(code, /- name: Assert npm floor$/m, "the `Assert npm floor` step was removed from publish.yml");
+  assert.match(code, /"\$\(npm --version\)" 11\.5\.1/, "the assert no longer compares npm --version against 11.5.1");
+  // The floor value must agree with npm's documented Trusted Publishing minimum. If npm ever raises
+  // it, this fails loudly rather than letting publish.yml assert a stale number.
+  assert.ok(code.includes("11.5.1"), "the 11.5.1 Trusted Publishing floor is no longer named in publish.yml");
+});
+
+// ---------------------------------------------------------------------------
+// ★★ POSITIVE CONTROL — prove the scanner fires on THIS repo's own file shape.
+// The live assertions above pass with `checked: 0`, which is also what a broken scanner reports.
+
+test("★★ mutating the live publish.yml back to `npm install -g npm@latest` IS caught", () => {
+  const root = scratch();
+  mkdirSync(join(root, ".github", "workflows"), { recursive: true });
+  const live = readFileSync(join(REPO, ".github", "workflows", "publish.yml"), "utf8");
+
+  // Re-insert the deleted step verbatim, into the real file's real surroundings.
+  const mutated = live.replace(
+    /^(\s*)- name: Assert npm floor$/m,
+    "$1- name: Update npm\n$1  run: npm install -g npm@latest\n$1- name: Assert npm floor",
+  );
+  assert.notEqual(mutated, live, "the anchor step was not found — this control is not exercising anything");
+  writeFileSync(join(root, ".github", "workflows", "publish.yml"), mutated);
+
+  const r = run(root);
+  assert.equal(r.status, 1, "the gate did NOT catch the very line this increment removed");
+  assert.deepEqual(reasons(r), ["floating-version"]);
+  assert.deepEqual(refs(r), ["npm@latest"]);
+});
+
+// ---------------------------------------------------------------------------
+// R2 backstop — the two duplicated walkers must not drift apart silently
+
+test("★ this gate and check-action-pins enumerate the SAME files for the live repo", () => {
+  assert.deepEqual(json(run(REPO)).files, json(run(REPO, SIBLING)).files);
+});
+
+// ---------------------------------------------------------------------------
+// Cleanup: scratch dirs live under os.tmpdir(); remove the ones this file made.
+
+test("cleanup", () => {
+  for (const d of readdirSync(tmpdir())) {
+    if (d.startsWith("pharn-runpins-")) rmSync(join(tmpdir(), d), { recursive: true, force: true });
+  }
+});
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6a08177..162b8b7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,8 +29,41 @@ jobs:
           node-version: 24
           cache: npm
           registry-url: https://registry.npmjs.org
-      - name: Update npm # Trusted Publishing requires npm >= 11.5.1
-        run: npm install -g npm@latest
+      # Trusted Publishing requires npm >= 11.5.1 (npm's own docs; it also requires
+      # node >= 22.14.0). node 24 already BUNDLES a satisfying npm — 11.17.0 at the
+      # released v24.19.0, checked 2026-08-10 — so the floor needs no install, only
+      # enforcement. This step therefore ASSERTS the floor instead of globally
+      # installing the floating `latest` npm at publish time: the release job, which
+      # holds `id-token: write` and the `npm-publish` environment, now downloads no
+      # third-party tool at all. (The deleted step had silently crossed a major — the
+      # registry `latest` dist-tag was npm 12.0.2 on 2026-08-10.) Pure node stdlib,
+      # no network.
+      #
+      # The floor gate .dev/floor/check-run-pins.mjs keeps the PACKAGE-MANAGER half of
+      # that true — no workflow run: line may install or exec an unpinned package. It
+      # does NOT cover curl-and-execute or any non-package-manager pull (its R1
+      # residual), so "downloads nothing" is enforced for one class, not universally.
+      #
+      # Fail-closed rests on the PARSE, not on the shell: a command substitution used
+      # as an argument does NOT trip `set -e`, so an `npm --version` that fails or
+      # prints nothing arrives here as "" and exits 1 as an unparseable version.
+      - name: Assert npm floor
+        run: |
+          set -euo pipefail
+          node -e '
+            const parse = (v) => {
+              const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? "").trim());
+              if (!m) { console.error(`npm floor: unparseable version ${JSON.stringify(v)}`); process.exit(1); }
+              return m.slice(1, 4).map(Number);
+            };
+            const [found, floor] = process.argv.slice(1);
+            const f = parse(found), n = parse(floor);
+            if ((f[0] - n[0] || f[1] - n[1] || f[2] - n[2]) < 0) {
+              console.error(`npm floor NOT met: found ${found.trim()}, need >= ${floor} (npm Trusted Publishing minimum)`);
+              process.exit(1);
+            }
+            console.log(`npm floor OK: npm ${found.trim()} >= ${floor}`);
+          ' "$(npm --version)" 11.5.1
       - name: Install
         run: npm ci
       - name: Verify tag matches package.json version
diff --git a/.pharn/pharn-dev-verify/results.json b/.pharn/pharn-dev-verify/results.json
index c1e0603..27b910f 100644
--- a/.pharn/pharn-dev-verify/results.json
+++ b/.pharn/pharn-dev-verify/results.json
@@ -1 +1 @@
-{"test":0,"validate":0,"lint":0,"format:check":0,"lint:md":0}
\ No newline at end of file
+{"test":0,"validate":0,"lint":0,"format:check":0,"lint:md":0,"floor-tests":0,"check-run-pins":0,"check-action-pins":0}
\ No newline at end of file
diff --git a/.pharn/writes-scope.json b/.pharn/writes-scope.json
index fd255a1..919117d 100644
--- a/.pharn/writes-scope.json
+++ b/.pharn/writes-scope.json
@@ -1,7 +1,7 @@
 {
   "scope": [
-    ".dev/features/harden-action-pin-coverage/REVIEW.md"
+    ".dev/features/publish-npm-floor-assert/SHIP.md"
   ],
-  "set_by": ".claude/commands/pharn-dev-review.md",
-  "set_at": "2026-08-10T09:51:03.659Z"
+  "set_by": ".claude/commands/pharn-dev-ship.md",
+  "set_at": "2026-08-10T19:43:58.416Z"
 }
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index af3b6e3..078bbe7 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -44,12 +44,14 @@ credential is stored or passed.
 4. **Cut a GitHub Release.** Tag it **`vX.Y.Z`**, where `X.Y.Z` **exactly
    matches** `package.json` `version`. A guard step in `publish.yml` fails the
    run if the tag (minus its leading `v`) does not equal the package version.
-5. **Publishing the Release triggers `publish.yml`.** It runs on node 24 with
-   `npm@latest` (Trusted Publishing needs npm >= 11.5.1), re-runs the full check
-   suite and build (via the `prepublishOnly` + `prepack` hooks), verifies the
-   tag, then runs `npm publish --provenance --access public`. The `--provenance`
-   flag overrides `publishConfig.provenance: false`, so the release carries a
-   signed provenance attestation.
+5. **Publishing the Release triggers `publish.yml`.** It runs on node 24, whose
+   bundled npm already satisfies the npm >= 11.5.1 that Trusted Publishing
+   needs — an **Assert npm floor** step enforces that and fails the run if it
+   ever stops being true, so nothing is installed at publish time. The run then
+   re-runs the full check suite and build (via the `prepublishOnly` + `prepack`
+   hooks), verifies the tag, and runs `npm publish --provenance --access
+   public`. The `--provenance` flag overrides `publishConfig.provenance: false`,
+   so the release carries a signed provenance attestation.
 
 ## Verify the release