Hotfix: revert v1.1.12 F003 (the branch-protection.yml realignment that re-added CodeQL + check-test-pairing). The v1.1.12 release.yml run timed out at attempt 20/20 with Still missing: CodeQL check-test-pairing, confirming the rationale for re-adding them was wrong.
Key insight (worth reading):
CodeQLis a workflow name. The check-runs API returns job names. The CodeQL workflow's only job isanalyze— that's what lands as a check-run on every commit. ListingCodeQLincontexts:made it perpetually missing.check-test-pairingruns only onpull_requestevents. Squash-merge to main produces a new commit; PR-only workflows never re-run on that commit. Parent-SHA fallback (added in v1.1.8 PR #213) covers squash-merges that didn't firepush:main; it does NOT make PR-only check-runs retroactively appear on main commits.
v1.1.8's path (drop both from branch-protection.yml, accept the drift between YAML and live main protection) was correct. v1.1.13 restores it. No other v1.1.12 changes are reverted — F002 (release.yml fail-closed + branch-protection.yml template + setup wiring), F004 (check-template-sync drift guard), F005 (--ignore-scripts default), F006 (behavioral subprocess test), F008 (e2b skipped-scenario logging) all stay. F002's release.yml gate continues to work because the YAML's contexts list is once again only contexts the gate can actually satisfy.
Internal
.github/branch-protection.ymlcontexts: revert to the 13-entry list from v1.1.8. Comment block updated to explain why CodeQL + check-test-pairing must NOT be re-added.tests/test-registry-consistency.jscanonical-required-checks list synced.