test: preserve stranded CI baseline fixes

CONTRIBUTING.md

@@ -10,6 +10,7 @@ We require this to reduce the maintainer's burden of reviewing and merging contr
 Pushing through it runs an AI-driven review/test/lint pipeline in an isolated worktree, forwards the push upstream only after every check passes, and opens a clean PR automatically.
 
 A GitHub Actions check (`Require no-mistakes`) runs on PRs targeting `main` and fails if the body is missing the deterministic signature that no-mistakes writes.
+The generated `## Pipeline` section must contain `Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)` exactly; prose that merely says the checks passed is not a substitute for that machine-verifiable marker.
 Dependency bots are exempt so their automation keeps working, but regular contributor PRs without the signature will not be reviewed or merged.
 
 ## Workflow

tests/behavior-test-durations.tsv

@@ -92,4 +92,5 @@
 23744	tests/fm-x-mode.test.sh
 250	tests/lavish-repair.test.sh
 6200	tests/lavish.test.sh
+160	tests/no-mistakes-required.test.sh
 92	tests/operating-fundamentals.test.sh

tests/fm-account-routing-suite.sh

@@ -5208,7 +5208,7 @@ SH
   mkdir -p "$lock/.reclaiming"
   printf '1\nstale-reclaimer\n' > "$lock/.reclaiming/owner"
   touch -t 200001010000 "$lock" "$lock/.reclaiming"
-  FM_ACCOUNT_META_LOCK_WAIT_SECONDS=2 FM_ACCOUNT_META_LOCK_ORPHAN_GRACE_SECONDS=0 \
+  FM_ACCOUNT_META_LOCK_ORPHAN_GRACE_SECONDS=0 \
     bash -c '. "$1"; held=$(fm_account_meta_lock_acquire "$2" lock-task) || exit $?; fm_account_meta_lock_release "$held"' \
     _ "$ROOT/bin/fm-account-routing-lib.sh" "$state" || fail "abandoned metadata reclaim owner blocked acquisition"
   assert_absent "$lock" "metadata lock retained an abandoned reclaim owner"

tests/fm-behavior-shards.test.sh

@@ -22,8 +22,8 @@ test_checked_in_plan_is_complete_balanced_and_deterministic() {
 
   out=$("$SHARDER" --check "$SHARD_COUNT") \
     || fail "checked-in behavior shard plan failed its coverage guard"
-  assert_contains "$out" "FM_BEHAVIOR_PLAN ok tests=90 shards=8" \
-    "coverage guard did not report the complete 90-test inventory"
+  assert_contains "$out" "FM_BEHAVIOR_PLAN ok tests=91 shards=8" \
+    "coverage guard did not report the complete 91-test inventory"
   "$SHARDER" --plan "$SHARD_COUNT" > "$plan_a"
   "$SHARDER" --plan "$SHARD_COUNT" > "$plan_b"
   cmp -s "$plan_a" "$plan_b" || fail "same durations produced different shard plans"
@@ -165,7 +165,7 @@ test_post_run_guard_requires_the_exact_executed_union() {
   write_complete_manifests "$plan" "$good"
   out=$("$SHARDER" --verify "$SHARD_COUNT" "$good") \
     || fail "post-run guard rejected the exact complete manifest union"
-  assert_contains "$out" "FM_BEHAVIOR_COMPLETENESS ok tests=90 shards=8" \
+  assert_contains "$out" "FM_BEHAVIOR_COMPLETENESS ok tests=91 shards=8" \
     "post-run guard did not report complete execution"
 
   cp -R "$good" "$missing"

tests/no-mistakes-required.test.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd -- "$(dirname -- "$0")/.." && pwd)
+MARKER='Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)'
+WORKFLOW="$ROOT/.github/workflows/no-mistakes-required.yml"
+CONTRIBUTING="$ROOT/CONTRIBUTING.md"
+
+assert_marker_assignment_once() {
+  local file=$1
+  local count
+
+  count=$(grep -Fc -- "marker='$MARKER'" "$file" || true)
+  if [[ $count -ne 1 ]]; then
+    printf 'expected exactly one no-mistakes marker assignment in %s, found %s\n' \
+      "$file" "$count" >&2
+    return 1
+  fi
+}
+
+# The workflow and contributor instructions are both inputs to the external
+# publisher. Keep their machine-verifiable signature synchronized so a PR body
+# cannot claim successful publication while omitting the gate marker.
+assert_marker_assignment_once "$WORKFLOW"
+
+if ! grep -Fq -- "\`$MARKER\` exactly" "$CONTRIBUTING"; then
+  printf 'CONTRIBUTING.md does not document the workflow marker exactly\n' >&2
+  exit 1
+fi
+
+printf 'no-mistakes PR signature contract is synchronized\n'