diag(probe): reveal the masked CI cascade + two governance-bridge hypotheses

- The `dune runtest` repair landed (build/coverage both green on the parts
  they can reach); that unmasked `Run codegen WASM tests`, which had been
  skipped on every run since 2026-09-21. The probe now runs the whole
  remaining chain (codegen WASM, Bun-ESM, native Bun, face transformers,
  no-extension-ts) in one cycle so the rest of the cascade is visible without
  one failure per push.
- Two throwaway workflows test why `Governance Baseline` cannot start: A
  grants job-level permissions to the same local reusable, B drops the
  reusable entirely. Whichever starts tells us the axis.
- examples README for the on-ramp consumer.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/zz-probe-a.yml

@@ -0,0 +1,18 @@
+# This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
+#
+# TEMPORARY PROBE (deleted before merge) — hypothesis A:
+# the local reusable call fails at run-creation because the CALLER JOB does
+# not grant permissions explicitly (the only reusable caller in this repo that
+# works, spark-theatre-gate.yml, does grant them at job level). Same shape as
+# governance-baseline.yml, plus job-level permissions.
+name: ZZ Probe A
+on:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  governance:
+    uses: ./.github/workflows/governance-baseline-impl.yml
+    permissions:
+      contents: read

.github/workflows/zz-probe-b.yml

@@ -0,0 +1,23 @@
+# This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
+#
+# TEMPORARY PROBE (deleted before merge) — hypothesis B: no reusable workflow
+# at all, and the pinned context reproduced by naming the job literally.
+# A normal (non-caller) workflow always starts, so this is what the bridge
+# becomes if the reusable mechanism itself is what the platform refuses.
+name: ZZ Probe B
+on:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  governance:
+    name: Validate Hypatia baseline
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+      - name: Validate .hypatia-baseline.json (if present)
+        run: |
+          echo "probe B: plain job, no reusable workflow"

examples/consumers/extension-boundary/README.adoc

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Consumer example: an extension-shaped host boundary
+:toc: macro
+:icons: font
+
+A complete, minimal consumer of AffineScript — the thing
+link:../../../docs/ON-RAMP.adoc[docs/ON-RAMP.adoc] describes in prose.
+
+It is shaped after the first real consumer request
+(`hyperpolymath/affinescript#771`, from `hyperpolymath/blocky-writer#73`): a
+browser extension whose document engine lives behind a two-function boundary,
+compiled to WebAssembly, with an error taxonomy that has to cross that
+boundary intact.
+
+toc::[]
+
+== Run it
+
+[source,console]
+----
+$ just on-ramp-example          # from the repository root
+# or
+$ ./examples/consumers/extension-boundary/build.sh
+----
+
+Expected output:
+
+[source,console]
+----
+Compiling boundary.affine -> boundary.wasm
+Compiled …/src/boundary.affine -> …/dist/boundary.wasm (WASM)
+Running host.mjs
+examples/consumers/extension-boundary: OK
+----
+
+`build.sh` finds the compiler three ways, so it works in a checkout
+(`_build/default/bin/main.exe`), against a release binary on `PATH`
+(`affinescript`), or with `dune exec`. That is deliberate: a consumer's build
+script should not care which of the three you have.
+
+== The four files, and why each exists
+
+[cols="1,3",options="header"]
+|===
+| File | What it is
+
+| `src/boundary.affine`
+| The consumer's own module. It declares the host functions it calls with
+  `extern fn` (the whole binding story — no compiler change, no IDL, no
+  adapter package), wraps them in typed helpers, and never touches a string
+  it did not receive from the host.
+
+| `host.mjs`
+| The other half: an import object that satisfies those declarations, a
+  `{code, message, context}` payload the host owns, and assertions for the
+  contract (success path, failure path, message round-trip, exported
+  surface).
+
+| `build.sh`
+| Compile, then run. The "smallest thing that turns `src/*.affine` into
+  something that compiles", in executable form.
+
+| `dist/`
+| Build output (gitignored). `boundary.wasm` is what you would ship in an
+  extension bundle next to `host.mjs`'s import object.
+|===
+
+== The parts worth copying
+
+*Declare the boundary before porting bodies.* The `extern fn` block at the top
+of `src/boundary.affine` fixes every type the guest can see. In a real port
+this is the first thing to write, because the compiler's error messages are
+most useful at the seam.
+
+*Codes, not strings.* `bw_detect_blocks` returns an `Int` status; the message
+lives host-side and is reachable byte-by-byte via
+`bw_error_message_len` / `bw_error_message_byte`. The guest never allocates,
+never encodes, and cannot invent an error shape the host does not know.
+
+*Assert the contract in CI.* `host.mjs` is not a smoke test — it asserts that
+`fill` propagates the exact `BW_*` code, that the message round-trips
+byte-for-byte, and that the guest exports the names it advertised. The same
+script runs in this repository's `build` job, so the on-ramp cannot rot.
+
+*Nothing here is browser-specific.* Node is used only to read the file and to
+have an assertion library. `WebAssembly.instantiate(bytes, imports)` with the
+same `imports` object runs unchanged in a Firefox/Chrome extension background
+frame, in Bun, or in Deno.
+
+== What this example deliberately does not do
+
+* *No byte transfer through linear memory.* Parameters are `i32`, so real byte
+  work is a `(pointer, length)` pair into the guest's exported `memory`; see
+  `tests/codegen/test_net_send.mjs` for a worked host-side write, and
+  `tests/codegen/test_file_roundtrip.mjs` for a round-trip. Kept out here so
+  the boundary pattern is the only thing in view.
+* *No closures.* Passing a callback to the host uses the
+  `[fnId @+0, envPtr @+4]` + `__indirect_function_table` ABI; a complete
+  dispatcher is in `tests/codegen/test_closure_indirect_dispatch.mjs` and in
+  `packages/affine-vscode/mod.js`.
+* *No bundler, no manifest.* There is no `deno.json`, no `package.json`, no
+  `affine.toml`. A consumer's build file is this shell script, because the
+  compiler takes a source file and `-o`.

tools/ci/diag-probe.sh

@@ -46,6 +46,26 @@ if log.exists():
 else:
     annotate("diag-runtest", "runtest.log was not produced")
 
+# ── 1b. the whole masked cascade, in one shot ─────────────────────────────
+# `dune runtest` failed first, so every later step in the build job was
+# skipped and its state was unknown. Now that the tests pass, surface the
+# whole remaining chain at once instead of one failure per CI cycle.
+CASCADE = [
+    ("codegen WASM", ["bash", "tools/run_codegen_wasm_tests.sh"]),
+    ("codegen Bun-ESM (codegen-deno corpus)", ["bash", "tools/run_codegen_deno_tests.sh"]),
+    ("native Bun-ESM", ["bash", "tools/run_codegen_bun_tests.sh"]),
+    ("face transformers", ["bash", "tools/run_face_transformer_tests.sh"]),
+    ("no-extension-ts", ["bash", "tools/check-no-extension-ts.sh"]),
+]
+out = []
+for label, argv in CASCADE:
+    rc, text = run(argv, timeout=900)
+    tail = text.splitlines()[-40:]
+    out.append(f"===== {label}: rc={rc} =====\n" + "\n".join(tail))
+body = "\n\n".join(out)
+annotate("diag-cascade", body)
+summary("diag: masked cascade", body)
+
 # ── 2. parser probe: which construct does the #644 test need? ─────────────
 VARIANTS = {
     "v1-exact-test-source": """module EmptyArm;