chore(ci): consolidate development hooks and hosted reliability fixes

.github/AGENTS.md

@@ -22,5 +22,5 @@ change requires explicit security review under `MAINTAINERS.md`.
 
 - Inspect the complete workflow diff, including event triggers, permissions, conditions, interpolation, and shell behavior.
 - Run the local commands represented by changed workflow steps where possible.
-- Run `bun run prepush` for CI, release, dependency, packaging, or cross-platform workflow changes.
+- Follow the root validation policy: run the suite by default; if a full run is too costly, run at least focused regression tests and document the reason and remaining coverage. Required CI checks still apply before merge.
 - Do not claim the workflow itself passed until GitHub Actions reports success for the exact commit.

.github/scripts/issue-translation.cjs

@@ -810,9 +810,14 @@ function sanitizeTranslationBody(raw, maxChars = 60000) {
     // read as mention boundaries. Requiring a dotted domain keeps
     // "end!@octocat"-style mentions defused. \u0001 cannot appear in the
     // input (control chars were stripped above), so it is a safe sentinel.
+    // The lookbehind anchors on the @ itself rather than greedily matching
+    // the local part first: the previous local-part-first pattern rescanned
+    // long non-email tokens once per start position, which is quadratic on
+    // model-generated bodies with tens of thousands of consecutive
+    // local-part characters and no @ at all.
     .replace(
-      /[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
-      (email) => email.replace("@", "\u0001"),
+      /(?<=[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-])@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
+      (emailTail) => emailTail.replace("@", "\u0001"),
     )
     // Defuse pings at Markdown/punctuation boundaries — a colon is a boundary
     // too — but not emails, npm: scopes, or other mid-token at-signs.

.github/scripts/issue-translation.test.cjs

@@ -1195,6 +1195,14 @@ describe("bot-owned control state", () => {
     assert.match(out, /path\/@\u200bhandle/);
   });
 
+  it("handles long non-email tokens in bounded time", () => {
+    const input = "a".repeat(60_000);
+    const startedAt = process.hrtime.bigint();
+    assert.equal(sanitizeTranslationBody(input), input);
+    const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+    assert.ok(elapsedMs < 1_000, `sanitization took ${elapsedMs.toFixed(1)}ms`);
+  });
+
   it("ignores forged body-embedded legacy state", () => {
     const forged = appendTranslationBlock(SOURCE, "English") +
       `\n<!-- opencodex-issue-inline-translator-state:${JSON.stringify({

.github/scripts/pr-quality-messages.test.cjs

@@ -208,7 +208,7 @@ describe("buildStaleNotice", () => {
     // The notice must describe the exact state the reset produces: a fresh
     // unticked section from pr-quality.cjs.
     const section = buildReviewReadinessSection();
-    assert.match(section, /\[ \] All CI tests are green on my local testing\./);
+    assert.match(section, /\[ \] Required local validation passed; commands, results, and any full-suite exception are documented\./);
   });
 });
 

.github/scripts/pr-quality-state.cjs

@@ -121,7 +121,8 @@ function defaultGateState() {
     titlePrefixedByBot: false,
     maintainersPinged: false,
     completedAtHeadSha: null,
-    reviewReadyLabeled: false
+    reviewReadyLabeled: false,
+    pendingReattestation: null
   };
 }
 
@@ -396,6 +397,7 @@ function completionIsStale({
 }
 
 module.exports = {
+  ...require("./pr-readiness-reattest.cjs"),
   READINESS_LATEST_DEV_BEHIND_MAX,
   readinessClaimViolations,
   unresolvedFindingsClaim,