W0 closeout: harness citation scenario (#256.3 verified), deck refresh, D3 decision record

.dev/decisions/D-2026-08-11-bot-identity-machine-user.md

@@ -0,0 +1,42 @@
+# D-2026-08-11 — Bot identity: quantecon-services machine user, not a GitHub App
+
+**Status**: decided (owner, 2026-08-11, W0 closeout). Migration itself is deferred
+until an identity change is imminent; this records the direction so the deciding
+evidence is not rediscovered the hard way.
+
+## Decision
+
+When the sync bot's identity moves off the maintainer's personal PAT, it moves to the
+**`quantecon-services` machine user** (an ordinary user account with a PAT), not to a
+GitHub App. #61 remains open as the migration task; #221 closes with this record.
+
+## Why
+
+The `\translate-resync` trust gate (#192) admits `OWNER`/`MEMBER`/`COLLABORATOR` by
+`comment.author_association`. #221 measured (2026-07-26, three unrelated Apps) that
+**GitHub Apps always report `NONE`** for that field — structurally, because the field
+describes a person's membership and an App installation has none. So:
+
+- **Machine user**: reports `MEMBER`/`COLLABORATOR` once added to the org/repo — the
+  gate passes with **zero code change** in any of its ~17 copies.
+- **App**: resync silently stops responding for the bot; fixing it means an explicit
+  login allowlist in every gate copy plus `src/inputs.ts`.
+
+The failure mode being *silent* is what makes recording this worth a file: on
+migration day nothing errors — the command just stops working.
+
+## Constraints that ride along (from #221)
+
+- **Name the token, not just the identity**: comments posted with
+  `secrets.GITHUB_TOKEN` never trigger workflows (GitHub's recursion guard), so the
+  credential choice decides whether the `issue_comment` event exists at all.
+- **Nothing the bot posts may contain the command string** once it posts under a
+  trigger-capable credential. Today that holds by accident (`postSuccessComment`
+  omits it; the failure issue carries it but issues cannot self-trigger). The
+  migration PR should add a test making it hold by construction.
+
+## Migration checklist (when imminent — from #61)
+
+Mint PAT under `quantecon-services` → grant write on source + target repos → rotate
+the secret in each source repo (lecture-python-programming, test-translation-sync,
+and any wired since) → verify authorship on a test PR → add the command-string test.

.dev/log/2026-08-11-w0-closeout.md

@@ -0,0 +1,48 @@
+# W0 closeout: D1/D3 recorded, #256.3 harness-verified, #7 deck refreshed
+
+2026-08-11, third session entry of the day (after [the #116 pair](2026-08-11-116-trailing-newline.md)
+and [the S-fix batch](2026-08-11-w0-sfix-batch.md)). The owner walked the four remaining
+W0 items one by one.
+
+## Decisions
+
+- **D1 (global font mechanism): deferred to W2 kickoff**, explicitly. The box moved from
+  #258 to #260 as a kickoff gate; the editions-side conversation should start early.
+- **D3 (bot identity): direction recorded, migration deferred** —
+  [`D-2026-08-11-bot-identity-machine-user.md`](../decisions/D-2026-08-11-bot-identity-machine-user.md).
+  Machine user, not App; #221's `author_association=NONE` measurement is the deciding
+  evidence. #221 closes with the record; #61 stays open as the migration task.
+
+## #256.3 — verified on the harness, not the calendar
+
+The owner chose harness verification over waiting for an organic batch. Scenario 27 +
+fixtures added (target `_config.yml` with `bibtex_bibfiles` + `references.bib` missing
+`ArrowDebreu1954`; source bib carrying it). First run, scoped `--languages zh-cn
+--scenarios 27 --action-ref v0` (v0 peels to `c74e3aa` = v0.25.0, checked against the
+tag-lag hazard): sync green, test-translation-sync.zh-cn#710 delivered the translated
+`{cite}` role, the appended bib entry under the #117 marker, and the state file.
+Evidence commented on #256; box ticked in #258.
+
+**Finding for W1 (#259)**: the PR's `translation-sync-metadata` `files[]` declared only
+`lecture-minimal.md` — the delivered `references.bib` and state file are undeclared.
+Delivery exceeding declaration is the benign inverse of #256 defect 1; the
+declared-vs-delivered assertion should reconcile both directions.
+
+**Estate note**: the scoped run left test-translation-sync's `.github/` carrying only
+the zh-cn sync workflow (documented scoped-run behavior). The next unscoped harness run
+restores fa/ml.
+
+## #7 — deck refreshed, not wontfixed
+
+Owner call: refresh. `presentations/action-translation-sync.*` →
+`action-translation.md` + regenerated PDF/HTML (marp 4.5.0), content rewritten against
+v0.25.0: Sonnet 5, three modes, verdict routing + shadow mode, deterministic guardrails,
+the `translate` CLI, trust gates, real production estate, 1,516 tests / 27 scenarios.
+Stale claims removed (v0.7.0, Sonnet 4.5, "357 terms", 183 tests). Diagram unchanged —
+the flow it draws is still accurate.
+
+## W0 status after this
+
+All twelve #258 boxes ticked. Remaining open member issues that survive W0: #61
+(migration, deferred), #234 items 1–3/5 (W1-shaped), #7 closes with this PR. W0 can be
+closed; W1 (#259, with #169 first/alongside) is the next engineering focus.

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- **E2E harness scenario 27: citation backfill is now exercisable end-to-end** (#256 defect 3 verification): the harness fixtures carried zero `{cite}` keys, which is why #117 was unexercisable at v0.25.0 release gating. Target repos now reset with a minimal `_config.yml` (whose `bibtex_bibfiles` is what arms the guard) plus a `references.bib` deliberately missing the test key; the source repo carries the key. Scenario 27 introduces the citation and the sync PR must deliver the backfilled entry. Verified against the deployed release on first run: `--action-ref v0` (= v0.25.0), sync green, test-translation-sync.zh-cn#710 delivered the translated citation, the appended bib entry, and the state file. Observation recorded for the W1 declared-vs-delivered work: the metadata `files[]` block declares only the markdown, not the bib or state file it also delivers.
+
 ### Deprecated
 - **Reading the legacy `heading-map:` frontmatter format now logs a deprecation warning** (#53): every writer has emitted the `translation:` format since v0.13.0, so a legacy read means the file predates the migration. The warning names the migration command (`npx translate headingmap`) and fires once per process — the reader has no filename to report, so per-read repeats would add noise without information. The fallback itself is scheduled for removal in a later release (work plan W6); the warning is the notice period.
 

presentations/README.md

@@ -1,6 +1,6 @@
 # Presentations
 
-Modern presentation for the Translation Sync Action project built with Marp and Mermaid.
+Marp + Mermaid slide deck for the action-translation project. Content refreshed 2026-08-11 against v0.25.0 (#7); regenerate with `./build.sh` after editing the source.
 
 ## Quick Start
 
@@ -11,13 +11,13 @@ Build the presentation:
 ```
 
 This generates:
-- `action-translation-sync.pdf` - PDF presentation
-- `action-translation-sync.html` - HTML presentation  
+- `action-translation.pdf` - PDF presentation
+- `action-translation.html` - HTML presentation  
 - `diagrams/workflow.png` - Pre-rendered Mermaid diagram
 
 ## Files
 
-- `action-translation-sync.md` - Marp Markdown source (default theme)
+- `action-translation.md` - Marp Markdown source (default theme)
 - `diagrams/workflow.mmd` - Mermaid diagram source
 - `diagrams/workflow.png` - Generated diagram (created by build script)
 - `build.sh` - Automated build script
@@ -56,12 +56,12 @@ mmdc -i diagrams/workflow.mmd -o diagrams/workflow.png -t neutral -b transparent
 
 Build PDF:
 ```bash
-marp action-translation-sync.md -o action-translation-sync.pdf --allow-local-files
+marp action-translation.md -o action-translation.pdf --allow-local-files
 ```
 
 Build HTML:
 ```bash
-marp action-translation-sync.md -o action-translation-sync.html --allow-local-files
+marp action-translation.md -o action-translation.html --allow-local-files
 ```
 
 ## Presentation Contents
@@ -79,7 +79,7 @@ marp action-translation-sync.md -o action-translation-sync.html --allow-local-fi
 
 ### Markdown Source
 
-Edit `action-translation-sync.md` - standard Markdown with Marp directives.
+Edit `action-translation.md` - standard Markdown with Marp directives.
 
 The presentation uses Marp's **default theme** with custom CSS for two-column layouts.
 
@@ -95,8 +95,8 @@ Using Marp's built-in **default** theme - clean and simple, works well for conte
 
 ## Presenting
 
-**PDF:** Open `action-translation-sync.pdf` in any PDF viewer  
-**HTML:** Open `action-translation-sync.html` in a browser (arrow keys to navigate)
+**PDF:** Open `action-translation.pdf` in any PDF viewer  
+**HTML:** Open `action-translation.html` in a browser (arrow keys to navigate)
 
 ## Changelog