test(view): qualify bounded canonical hydration and retained-anchor admission

Apply the reviewed incremental patch on top of 9cdf6da's physical reader,
checking all three input/output Git blob hashes. Compile and execute the exact
streaming/selection modules before exposing candidate blobs. Run real CLI
byte/NUL/role/window-count regressions alongside every existing coordinate test.
The runner publishes blobs only, never commits or refs; production delivery
remains through a guarded direct-main GitHub update. No blanket test-pass claim.

.github/workflows/gh493-coordinate-candidate.yml

@@ -1,13 +1,108 @@
 name: GH493 canonical anchor candidate
 
-# The reviewed candidate is now production code. Keep this manual entry point
-# as a read-only alias for the permanent regression suite, not a blob publisher.
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/gh493-coordinate-candidate.yml
 
 permissions:
   contents: read
 
 jobs:
-  verify:
-    uses: ./.github/workflows/message-coordinate-regression.yml
+  prepare:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 45
+    permissions:
+      contents: write
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_PROFILE_TEST_DEBUG: '0'
+      CARGO_PROFILE_DEV_DEBUG: '0'
+      CARGO_TERM_COLOR: never
+      RUST_MIN_STACK: '134217728'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db
+        with:
+          shared-key: gh493-identity
+          cache-on-failure: true
+      - name: Apply hash-checked canonical hydration changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import base64, hashlib, json, os, pathlib, subprocess, urllib.request
+          expected = {'src/followup_coordinates.rs': 'a2696d4ca7fe2c57553b57294a3295f778d3cec4', 'src/followup_coordinates/window.rs': '55e7a41b2b016e90ce6b5ddac7efe50fc02e5a02', 'tests/gh493_windowed_followup.rs': '7e9c17ad4d7f3e9a7175ee87c9d8f07dab67bacc'}
+          for path, sha in expected.items():
+              assert subprocess.check_output(['git', 'hash-object', path], text=True).strip() == sha, path
+          sha = '9c6f5988e094dcb28d74b09ad86206fc77042126'
+          request = urllib.request.Request(f'https://api.github.com/repos/{os.environ["GITHUB_REPOSITORY"]}/git/blobs/{sha}', headers={'Authorization': 'Bearer ' + os.environ['GH_TOKEN'], 'Accept': 'application/vnd.github+json', 'User-Agent': 'OpenAI File Downloader, XaiImageApiFetch/1.0'})
+          with urllib.request.urlopen(request, timeout=60) as response:
+              result = json.load(response)
+          assert result['encoding'] == 'base64'
+          patch = base64.b64decode(result['content'])
+          assert hashlib.sha1(b'blob ' + str(len(patch)).encode() + b'\0' + patch).hexdigest() == sha
+          subprocess.run(['git', 'apply', '--check', '-'], input=patch, check=True)
+          subprocess.run(['git', 'apply', '-'], input=patch, check=True)
+          for path, sha in {'src/followup_coordinates.rs': '86be285e0842ee864cbf74a31a93764cea2c116a', 'src/followup_coordinates/window.rs': '6be9aa05c75fb5e18d6a13eeac4f9e6c86c8ab73', 'tests/gh493_windowed_followup.rs': '4f6c03d86402d79d7798c850ef2f469ba79e2412'}.items():
+              assert subprocess.check_output(['git', 'hash-object', path], text=True).strip() == sha, path
+          PY
+      - name: Format and execute exact streaming and selection modules
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustfmt --edition 2024 --config skip_children=true src/followup_coordinates.rs src/followup_coordinates/window.rs tests/gh493_windowed_followup.rs
+          git diff --check
+          printf '#[path = "%s/src/followup_coordinates/stream.rs"] mod stream;\n#[path = "%s/src/followup_coordinates/window.rs"] mod window;\n' "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE" > "$RUNNER_TEMP/stream-tests.rs"
+          rustc --edition 2024 --test "$RUNNER_TEMP/stream-tests.rs" -o "$RUNNER_TEMP/stream-tests"
+          "$RUNNER_TEMP/stream-tests" --nocapture
+      - name: Publish reviewed blobs only, never commits or refs
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json, os, pathlib, shutil, subprocess, urllib.request
+          paths = ['src/followup_coordinates.rs', 'src/followup_coordinates/window.rs', 'tests/gh493_windowed_followup.rs']
+          manifest = {'base_commit': os.environ['GITHUB_SHA'], 'base_blobs': {}, 'candidate_blobs': {}}
+          for path in paths:
+              manifest['base_blobs'][path] = subprocess.check_output(['git', 'rev-parse', f'HEAD:{path}'], text=True).strip()
+              request = urllib.request.Request(f'https://api.github.com/repos/{os.environ["GITHUB_REPOSITORY"]}/git/blobs', data=json.dumps({'content': pathlib.Path(path).read_text(), 'encoding': 'utf-8'}).encode(), headers={'Authorization': 'Bearer ' + os.environ['GH_TOKEN'], 'Accept': 'application/vnd.github+json', 'Content-Type': 'application/json', 'User-Agent': 'OpenAI File Downloader, XaiImageApiFetch/1.0'}, method='POST')
+              with urllib.request.urlopen(request, timeout=60) as response:
+                  sha = json.load(response)['sha']
+              assert sha == subprocess.check_output(['git', 'hash-object', path], text=True).strip()
+              manifest['candidate_blobs'][path] = sha
+              destination = pathlib.Path('candidate') / path
+              destination.parent.mkdir(parents=True, exist_ok=True)
+              shutil.copyfile(path, destination)
+          pathlib.Path('candidate/manifest.json').write_text(json.dumps(manifest, indent=2) + '\n')
+          pathlib.Path('candidate/review.patch').write_bytes(subprocess.check_output(['git', 'diff']))
+          print(json.dumps(manifest, indent=2))
+          PY
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: canonical-bounded-followup-candidate
+          path: candidate/
+          retention-days: 1
+          if-no-files-found: error
+      - name: Real canonical byte limits, physical bounds and preserved identity regressions
+        run: cargo test --locked --no-fail-fast --test gh493_windowed_followup --test cli_view_budget --test gh493_message_coordinates --test gh493_reported_coordinates --test spec_view_expand_error_envelopes -- --nocapture
+      - name: Existing raw-line recovery and dispatch contracts
+        if: ${{ !cancelled() }}
+        run: |
+          cargo test --locked --test cli_robot view_
+          cargo test --locked --test cli_dispatch_coverage parse_expand_with_context
+      - name: Strict native lint
+        if: ${{ !cancelled() }}
+        run: cargo clippy --locked --test cli_view_budget --test gh493_message_coordinates --test gh493_windowed_followup -- -D warnings