diff --git a/.github/requirements-ci.txt b/.github/requirements-ci.txt
index 237054009..6ee7200b6 100644
--- a/.github/requirements-ci.txt
+++ b/.github/requirements-ci.txt
@@ -1 +1,2 @@
 pre-commit==4.6.2
+PyYAML==6.0.3
diff --git a/.github/workflows/bonedigger.yml b/.github/workflows/bonedigger.yml
index 726c8af13..65254246c 100644
--- a/.github/workflows/bonedigger.yml
+++ b/.github/workflows/bonedigger.yml
@@ -1,14 +1,21 @@
 name: issue lifecycle
 
+# Triggers are deliberately narrower than they look like they could be. The
+# pinned bonedigger lifecycle has exactly two jobs, `issues.opened` and
+# `issue_comment.created`, so subscribing to any other activity type dispatches
+# the reusable workflow only to skip every job in it (bluefin#981). Widen this
+# only alongside a bonedigger release that actually handles the new type.
 on:
   issues:
-    types: [opened, labeled, closed]
+    types: [opened]
   issue_comment:
     types: [created]
 
+# Scoped to what the callee declares (issues: write, contents: read). It reads
+# `event.issue.pull_request` straight from the payload and never calls the pulls
+# API, so no pull-requests scope is needed.
 permissions:
   issues: write
-  pull-requests: write
   contents: read
 
 jobs:
diff --git a/.github/workflows/lab-check.yml b/.github/workflows/lab-check.yml
index 885174c24..bd6e8b012 100644
--- a/.github/workflows/lab-check.yml
+++ b/.github/workflows/lab-check.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Fail with actionable message if token minting was denied
         if: steps.app-token.outcome == 'failure' || steps.app-token.outputs.token == ''
         run: |
-          echo "::error::MergeRaptor token mint failed — the GitHub App installation almost certainly lacks the requested 'checks: write' permission. This cannot be fixed from the repository; an org owner must grant it (Organization settings → GitHub Apps → MergeRaptor → Permissions). Verify current grants with: gh api orgs/projectbluefin/installations --jq '.installations[] | select(.app_slug == \"mergeraptor\") | .permissions' — see docs/skills/ci/references/mergeraptor-checks.md."
+          echo "::error::MergeRaptor token mint failed — the app lacks the requested 'checks: write' permission. This cannot be fixed from the repository; an org owner must grant it in the GitHub UI, and it may take TWO steps. Step 1, only if 'checks' is absent from 'gh api /apps/mergeraptor --jq .permissions': Organization settings → Developer settings → GitHub Apps → MergeRaptor → Permissions & events → Repository permissions → Checks: Read and write → Save. Until that is done the installation page has nothing to approve. Step 2: approve the resulting request under Organization settings → GitHub Apps → MergeRaptor → Review request. Verify with: gh api orgs/projectbluefin/installations --jq '.installations[] | select(.app_slug == \"mergeraptor\") | .permissions' — see docs/skills/ci/references/mergeraptor-checks.md."
           exit 1
 
       - name: Create or update lab check
@@ -82,9 +82,15 @@ jobs:
           STARTED_AT=$(jq -r '.started_at // empty' <<<"${CHECK_JSON}")
           COMPLETED_AT=$(jq -r '.completed_at // empty' <<<"${CHECK_JSON}")
 
+          # check_name filters server-side. Without it the first page is 100
+          # check runs of every name, newest first, so on a busy commit the
+          # existing lab check falls off the page and this lookup returns
+          # nothing -- which silently turns every update into a duplicate
+          # check run (bluefin#939).
           CHECK_ID=$(
             gh api --method GET \
               "repos/${GITHUB_REPOSITORY}/commits/${SHA}/check-runs" \
+              -f check_name="${CHECK_NAME}" \
               -f per_page=100 \
               --jq '.check_runs
                 | map(select(.name == "'"${CHECK_NAME}"'" and .app.slug == "'"${APP_SLUG}"'"))
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index a42e488f5..c82299e2b 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -50,6 +50,9 @@ jobs:
       - name: Check testsuite workflow contract
         run: python3 scripts/check-testsuite-workflow-ref.py
 
+      - name: Check Renovate auto-merge authentication contract
+        run: python3 scripts/check-renovate-automerge-auth.py
+
       - name: Check for undeclared gitlinks
         shell: bash
         env:
@@ -192,7 +195,12 @@ jobs:
         run: |
           set -euo pipefail
           # Minimum line coverage threshold (raise this as coverage improves).
-          THRESHOLD=30
+          # Measured BATS line coverage has held steady at 53.8-54.4% across
+          # recent pr-validation runs (e.g. runs 31344003528, 31345539779,
+          # 31715546591, 31742984919). 45% keeps a buffer against normal
+          # run-to-run variance while still catching real regressions; see
+          # https://github.com/projectbluefin/bluefin/issues/518.
+          THRESHOLD=45
           COBERTURA="coverage/kcov/cobertura.xml"
           if [[ ! -f "${COBERTURA}" ]]; then
             echo "warning: ${COBERTURA} not found; skipping threshold check" >&2
diff --git a/.github/workflows/promote-testing-to-main.yml b/.github/workflows/promote-testing-to-main.yml
index 16dffde0a..23f9da624 100644
--- a/.github/workflows/promote-testing-to-main.yml
+++ b/.github/workflows/promote-testing-to-main.yml
@@ -21,7 +21,43 @@ permissions:
   statuses: write
 
 jobs:
+  release_window:
+    name: Check stable release window
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      should_enqueue: ${{ steps.window.outputs.should_enqueue }}
+    steps:
+      - name: Determine whether to enqueue the promotion
+        id: window
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+
+          case "$EVENT_NAME" in
+            workflow_dispatch)
+              echo "Manual dispatch — allowing the hotfix release escape hatch."
+              echo "should_enqueue=true" >> "$GITHUB_OUTPUT"
+              ;;
+            schedule)
+              weekday=$(date -u +%u)
+              if [[ "$weekday" == "2" ]]; then
+                echo "Tuesday UTC schedule — allowing the weekly stable release."
+                echo "should_enqueue=true" >> "$GITHUB_OUTPUT"
+              else
+                echo "Non-Tuesday schedule — refreshing promotion gates without enqueueing."
+                echo "should_enqueue=false" >> "$GITHUB_OUTPUT"
+              fi
+              ;;
+            *)
+              echo "Push trigger — refreshing the promotion PR without enqueueing."
+              echo "should_enqueue=false" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+
   promote:
+    needs: [release_window]
     uses: projectbluefin/actions/.github/workflows/reusable-promote-squash.yml@v1
     with:
       variants: >-
@@ -31,5 +67,5 @@ jobs:
       run_e2e: false
       # main uses a merge queue ruleset (17070404): gh pr merge --auto is blocked.
       # use_merge_queue: true calls enqueuePullRequest GraphQL instead.
-      use_merge_queue: true
+      use_merge_queue: ${{ needs.release_window.outputs.should_enqueue == 'true' }}
     secrets: inherit
diff --git a/.github/workflows/renovate-automerge.yml b/.github/workflows/renovate-automerge.yml
index ebc9bd5dd..c12101041 100644
--- a/.github/workflows/renovate-automerge.yml
+++ b/.github/workflows/renovate-automerge.yml
@@ -15,3 +15,6 @@ jobs:
     uses: projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@v1
     with:
       head_sha: ${{ github.event.workflow_run.head_sha }}
+    secrets:
+      app_id: ${{ secrets.MERGERAPTOR_APP_ID }}
+      private_key: ${{ secrets.MERGERAPTOR_PRIVATE_KEY }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dfb769e55..eea607b06 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -70,6 +70,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif
diff --git a/Containerfile b/Containerfile
index 4dfdebb17..98ced21f5 100644
--- a/Containerfile
+++ b/Containerfile
@@ -35,6 +35,7 @@ COPY /build_files/shared/utils/ghcurl /build_files/shared/utils/ghcurl
 FROM scratch AS ctx
 COPY /system_files /system_files
 COPY /build_files/shared/build-gnome-extensions.sh /build_files/shared/build-gnome-extensions.sh
+COPY /build_files/shared/checkpoint-rpmdb.sh /build_files/shared/checkpoint-rpmdb.sh
 COPY /build_files/shared/clean-stage.sh /build_files/shared/clean-stage.sh
 COPY /build_files/shared/disable-repos.sh /build_files/shared/disable-repos.sh
 COPY /build_files/shared/finalize-gnome-extensions.sh /build_files/shared/finalize-gnome-extensions.sh
@@ -86,7 +87,8 @@ RUN --mount=type=cache,dst=/var/cache/libdnf5 \
         export PATH="/tmp/scripts/helpers:$PATH" && \
         /ctx/build_files/base/03-packages.sh && \
         /ctx/build_files/base/04-install-kernel-akmods.sh && \
-        /ctx/build_files/base/05-override-install.sh \
+        /ctx/build_files/base/05-override-install.sh && \
+        /ctx/build_files/shared/checkpoint-rpmdb.sh \
     '
 
 # hadolint ignore=DL3006
@@ -150,7 +152,8 @@ RUN --mount=type=cache,dst=/var/cache/libdnf5 \
         /ctx/build_files/base/19-initramfs.sh && \
         /ctx/build_files/shared/validate-repos.sh && \
         /ctx/build_files/shared/clean-stage.sh && \
-        /ctx/build_files/base/20-tests.sh \
+        /ctx/build_files/base/20-tests.sh && \
+        /ctx/build_files/shared/checkpoint-rpmdb.sh \
     '
 
 # Embed the Stable container-native ISO contract after Stage 2. This runs
diff --git a/build_files/base/20-tests.sh b/build_files/base/20-tests.sh
index bd56824d3..a36960379 100755
--- a/build_files/base/20-tests.sh
+++ b/build_files/base/20-tests.sh
@@ -35,6 +35,13 @@ test -f /usr/share/ublue-os/homebrew/fonts.Brewfile
 test -f /usr/share/ublue-os/homebrew/preinstall.d/bluefinctl.Brewfile
 test -f /usr/share/ublue-os/homebrew/preinstall.d/system-cli.Brewfile
 test -x /usr/bin/brew-preinstall
+# ExecStart names /usr/bin/brew-preinstall, but that is a two-line trampoline
+# (`exec /usr/libexec/brew-preinstall`). Asserting only the trampoline still
+# passes when the payload it exec's is renamed or dropped upstream -- the unit
+# then fails at first login with status 127 and bluefinctl silently never
+# installs, which is exactly the symptom reported in #965. Assert the file that
+# actually does the work, not just the one systemd calls.
+test -x /usr/libexec/brew-preinstall
 test -f /usr/lib/systemd/user/brew-preinstall.service
 grep -q '^enable brew-preinstall\.service$' /usr/lib/systemd/user-preset/01-brew-preinstall.preset
 
diff --git a/build_files/shared/checkpoint-rpmdb.sh b/build_files/shared/checkpoint-rpmdb.sh
new file mode 100755
index 000000000..7b606290b
--- /dev/null
+++ b/build_files/shared/checkpoint-rpmdb.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/bash
+
+echo "::group:: ===$(basename "$0")==="
+
+set -eoux pipefail
+
+# Leave the rpmdb as a single self-contained file in the committed layer.
+#
+# The Fedora bootc base images ship /usr/lib/sysimage/rpm/rpmdb.sqlite in
+# SQLite WAL journal mode together with stale rpmdb.sqlite-{shm,wal}
+# sidecars, and every dnf transaction in a build stage switches the database
+# back to WAL and leaves fresh sidecars behind. A layer committed in that
+# state is not self-contained: the next stage's first rpmdb read must
+# reconstruct WAL state through overlayfs, which is where CI's
+# "database disk image is malformed" failures come from (issue #995;
+# docs/skills/ci/references/failure-modes.md). Checkpointing the WAL and
+# switching to the default rollback-journal mode makes the database an
+# ordinary single file that any later stage — and the shipped image — can
+# read without WAL machinery. Run this as the last step of any RUN whose
+# rpmdb a later stage or the final image will read.
+
+# RPMDB_PATH: absolute path of the rpmdb SQLite database.
+# Defaults to the bootc sysimage location; overridden in unit tests.
+RPMDB_PATH="${RPMDB_PATH:-/usr/lib/sysimage/rpm/rpmdb.sqlite}"
+
+# sqlite3.connect() would silently create an empty database at a wrong path;
+# a build without an rpmdb here is broken and must fail now, not later.
+if [[ ! -f "${RPMDB_PATH}" ]]; then
+    echo "checkpoint-rpmdb: no rpmdb at ${RPMDB_PATH}" >&2
+    exit 1
+fi
+
+python3 - "${RPMDB_PATH}" <<'PYEOF'
+import sqlite3
+import sys
+
+db = sqlite3.connect(sys.argv[1])
+db.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+db.execute("PRAGMA journal_mode=DELETE")
+db.close()
+PYEOF
+
+rm -f "${RPMDB_PATH}-shm" "${RPMDB_PATH}-wal"
+
+echo "::endgroup::"
diff --git a/docs/skills/ci/SKILL.md b/docs/skills/ci/SKILL.md
index 55d150d0c..ddf05f7ae 100644
--- a/docs/skills/ci/SKILL.md
+++ b/docs/skills/ci/SKILL.md
@@ -47,22 +47,24 @@ gh run view RUN_ID --repo projectbluefin/bluefin --log-failed
 gh run rerun RUN_ID --repo projectbluefin/bluefin --failed-only
 ```
 
-Read the actual workflow before describing or changing its behavior. Shared
-logic belongs in the reusable workflow that owns it; callers should stay thin.
+Read the actual workflow before changing its behavior. Shared logic belongs in
+the reusable workflow that owns it; callers should stay thin.
 The `unit-tests` job in `pr-validation.yml` runs BATS with kcov and publishes
 `bats-tap-results` plus `bats-kcov-report` artifacts for shell-test visibility.
 Coverage runs route child `bash <script>` calls through
 `tests/coverage/bin/bash`, because wrapping only the top-level BATS process
 does not trace those child shells. The wrapper records each sandbox copy's
 original source path, and `merge_kcov.py` combines those hits with kcov's
-pre-parsed source inventory. A zero-line report is an instrumentation failure.
+pre-parsed source inventory (a zero-line report is an instrumentation failure).
 kcov is not packaged for Ubuntu 24.04, so the job builds v43 from a pinned,
 SHA-256-verified source archive and caches the result. The coverage run must
-redirect BATS output to a file: kcov captures child stdout through a pipe it
+redirect BATS output to a file — kcov captures child stdout through a pipe it
 stops draining, so streaming the full TAP log through it deadlocks the job.
-The instrumented rerun does not gate the job — `Run unit tests` owns pass/fail
-— but `merge_kcov.py` fails when no source lines were executed.
-Tests that `source` a library into the BATS process itself are not traced.
+The instrumented rerun does not gate the job — `Run unit tests` owns pass/fail —
+but `merge_kcov.py` fails when no source lines were executed. Tests that
+`source` a library into the BATS process itself are not traced.
+
+The `Enforce BATS coverage threshold` step's `THRESHOLD` is an evidence-based floor: measure recent successful runs' `BATS line coverage` log lines before raising it, and leave buffer for run-to-run variance.
 
 A pull request whose head branch lives on a fork reports **zero** checks until a
 maintainer approves the run — identical to "checks still queued", so confirm:
@@ -72,17 +74,16 @@ gh pr view PR --repo projectbluefin/bluefin --json headRepositoryOwner,maintaine
 gh api -X POST repos/projectbluefin/bluefin/actions/runs/RUN_ID/approve
 ```
 
-Zero checks with no pending approval means the PR targets `main`. Retarget
-with `gh pr edit PR --base testing`; rebuild branches cut from `main`.
+Zero checks with no pending approval means the PR targets `main`. Retarget with
+`gh pr edit PR --base testing`; rebuild branches cut from `main`.
 
-`maintainerCanModify: true` also means fix commits can be pushed straight to the
-contributor's branch.
+`maintainerCanModify: true` also means fix commits can be pushed straight to the contributor's branch.
 
 Containerfile stages that consume source through bind mounts inherit the mounted
 stage's image ID as part of their cache key. Give each consuming stage its own
 narrow `scratch` context covering only the paths it reads — `ctx-build` for the
 package stage, `ctx` for the overlay stages, `ctx-iso` for the ISO layer — and
-pass an explicit content-hash build argument as a second guard. A shared wide
+pass an explicit content-hash build argument as a second guard; a shared wide
 context silently couples every stage to every input directory.
 
 Every open Bluefin PR is discovered by the lab's five-minute PR poller. The lab
@@ -90,8 +91,7 @@ runs smoke QA against `bluefin:testing` and sends bounded
 `repository_dispatch` lifecycle events to `.github/workflows/lab-check.yml`.
 That workflow must exist on the default branch and uses a short-lived
 MergeRaptor installation token to update one `testing-lab / bluefin` Check Run
-for the exact PR head SHA. Do not duplicate the result in a PR comment or commit
-status.
+for the exact PR head SHA. Do not duplicate the result in a PR comment or commit status.
 
 The MergeRaptor installation on `projectbluefin` also needs **Checks: write**
 for `lab-check.yml`; see [MergeRaptor checks](references/mergeraptor-checks.md).
diff --git a/docs/skills/ci/references/failure-modes.md b/docs/skills/ci/references/failure-modes.md
index 05b645a03..dc5f225e3 100644
--- a/docs/skills/ci/references/failure-modes.md
+++ b/docs/skills/ci/references/failure-modes.md
@@ -7,9 +7,22 @@
 | Workflow did not trigger | Event, branch, and path filters in the YAML |
 | Promotion is blocked | Exact digest, required check, and merge-group state |
 | Shared action behaves incorrectly | Reusable workflow source and its callers |
+| Tests update but E2E setup stays stale | Compare the reusable workflow `uses` ref with its test checkout ref |
 
 Always inspect the failed run logs before changing a workflow.
 
+## A reusable testsuite workflow has two independent refs
+
+`uses` selects the workflow definition; `test_ref` selects the test tree that
+workflow checks out. They move separately, so a managed `test_ref` is not
+evidence that workflow-level fixes — VM disk sizing, runner setup, anything in
+the workflow body — are current. Those arrive only when `uses` moves.
+
+This is a stable-promotion trap: `test_ref: v1` reads as "tests are current"
+and says nothing about the workflow running them. Keep both layers on the
+documented managed ref, and verify the nested workflow shown in the run log
+rather than the ref written in the caller.
+
 ## Reading a failed `post-testing-e2e` run
 
 `promote-to-testing` in `.github/workflows/post-testing-e2e.yml` needs
@@ -45,3 +58,342 @@ That step is `continue-on-error: true`, so it produces a red `##[error]` line in
 the log without failing the job. Runs that pass `:testing` by tag (for example
 `nightly.yml`) do not show it at all. Do not report it as the cause of a
 `post-testing-e2e` failure; find the behave summary instead.
+
+## Stable promotion blocker set (issue #929) — re-verified 2026-08-10
+
+`Execute Release` has failed on every attempt since July 20 (tracked in #929).
+The failing legs move over time; re-check the current run rather than trusting
+an older triage comment. State as of run
+[31355954836](https://github.com/projectbluefin/bluefin/actions/runs/31355954836)
+(2026-08-10T04:35Z, candidate `bluefin:testing` ->
+`sha256:bf615b200faefc44b50232ecc8a3eb21490e88dd9316b528b27f54472122611d`):
+
+| Leg | Status | Notes |
+|---|---|---|
+| `bluefin` / `smoke-a` | failing | Dash to Dock / Firefox / AT-SPI session lookups fail (`gdbus ... Extensions.GetExtensionInfo` returns `UnknownMethod`, Firefox/Settings not found via AT-SPI). No open PR claims this; see prior findings on #929. |
+| `bluefin` / `common-b` | failing (new) | `ujust toggle-updates` non-interactive scenario — see below. |
+| `bluefin-nvidia` / `common-b` | failing (new) | Same `ujust toggle-updates` failure, identical error, on the NVIDIA variant. |
+| `bluefin` / `bluefin-nvidia` smoke-b, common-a | passing | The composefs `cap_net_raw` regression tracked in `testsuite#524` / `dakota#841` **no longer appears** in this run — treat that blocker as resolved unless a fresh run shows it again. |
+
+### New: `ujust toggle-updates` fails with a `gum` TTY error, not a skip
+
+`tests/common/features/common_ujust.feature:30` (`projectbluefin/testsuite`)
+exercises `projectbluefin/common`'s non-interactive `toggle-updates ACTION=`
+contract (shipped in `common#966`, 2026-08-09). The `@requires_toggle_action`
+gate in `tests/common/features/environment.py` probes with
+`ujust toggle-updates cancel` and only runs the scenario when that exits `0` —
+so the scenario ran here, meaning the probe found ACTION support present, but
+the actual `enable`/`disable` exchange still failed:
+
+```
+ASSERT FAILED: SSH command exited 1, expected 0
+stderr: unable to pick selection: could not open a new TTY: open /dev/tty: no such device or address
+```
+
+That message comes only from `gum choose` in the recipe's `*` (unmatched
+`ACTION`) branch — the `enable`/`disable`/`cancel` branches never call `gum`.
+Reproducing `common@main`'s current `update.just` locally with plain `just`
+(1.58.0) resolves `enable`/`disable`/`cancel` correctly with no `gum`
+invocation, so the recipe logic on `common@main` is not the bug by itself.
+Two explanations remain open, and neither could be checked here — this
+runtime has no podman/skopeo/container toolchain to inspect the actual layered
+image or reach the ephemeral test VM:
+
+1. The specific `bluefin`/`bluefin-nvidia` image digest above was built
+   against a `common` base layer resolved before `common#966` propagated, so
+   it still runs the old body (this predicts both variants failing
+   identically, which matches).
+2. Something in the SSH/session harness (not the recipe) causes `gum` to be
+   invoked regardless of `ACTION` in this environment specifically.
+
+Next step: confirm which `common` digest is actually layered into the
+`bluefin:testing` image tested above (e.g. via `skopeo inspect` /
+`rpm-ostree status` on a real or lab VM, not just the source repo), and if it
+already includes `common#966`, escalate as a `projectbluefin/common` or
+`projectbluefin/testsuite` bug rather than assuming a stale layer will
+self-resolve on the next build.
+## `:testing` can silently freeze for weeks, invalidating every downstream triage (#929)
+
+`build-image-testing.yml` never moves the mutable `:testing` tag itself
+(`publish_stream_tag: "false"`); only `promote-to-testing` in
+`post-testing-e2e.yml` does, and only when every `run-e2e` matrix leg passes.
+If one leg (for example `smoke-a`) fails on every run, `promote-to-testing`
+is `skipped` every time and `:testing` stops advancing — silently, with no
+failed check on the tag itself, because the workflow that would have moved
+it never runs the promotion job at all.
+
+This means `Execute Release`'s `gh api .../manifests/testing` lookup can
+resolve to a build that is *days or weeks* old relative to `main`/`testing`
+HEAD, even though intervening fixes merged and built successfully as
+version-alias tags. Triaging a stable-promotion failure by only reading the
+latest `Execute Release` log reproduces the same symptoms release after
+release and looks like the fixes "didn't work," when the real problem is
+that the tested image predates them. Confirm the actual age of the image
+under test before attributing a release-gate failure to a specific fix:
+
+```bash
+# What Execute Release actually tested (image ref appears in the job env / log)
+gh run view RUN_ID --repo projectbluefin/bluefin --log | grep 'IMAGE:'
+
+# Resolve current :testing to its digest and check when that build ran
+TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:projectbluefin/bluefin:pull" \
+  | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
+curl -sI -H "Authorization: Bearer $TOKEN" \
+  -H "Accept: application/vnd.oci.image.manifest.v1+json" \
+  "https://ghcr.io/v2/projectbluefin/bluefin/manifests/testing" \
+  | grep -i docker-content-digest
+
+# Confirm promote-to-testing's real status, not just the workflow conclusion —
+# a failing leg elsewhere still shows the workflow as "failure" while masking
+# that the promotion job specifically never even attempted to run
+gh run view RUN_ID --repo projectbluefin/bluefin --json jobs \
+  --jq '.jobs[] | select(.name=="promote-to-testing") | .conclusion'
+```
+
+If `promote-to-testing` has been `skipped` across many consecutive runs, the
+single failing leg blocking it is the actual root cause of the stable
+promotion backlog, not whatever else changed between the frozen digest and
+`main` HEAD. Fixing only the other legs' known issues will not move
+`:testing` or unblock `Execute Release` until that leg passes.
+## `:testing` can carry a stream tag even when `promote-to-testing` is skipped
+
+Do not assume the bare `:testing` tag only ever moves through
+`promote-to-testing` in `post-testing-e2e.yml`. `build-image-testing.yml`
+passes `publish_stream_tag: "false"` to
+`projectbluefin/actions/.github/workflows/reusable-build.yml@v1` specifically
+so a `main`/`testing`-branch build does not publish the bare stream tag ahead
+of the e2e gate — but this repo does not control whether that input is
+actually honored by the push step in that reusable workflow.
+
+Reported on #989 (2026-08-07): the digest tagged `:testing` in the registry
+was the exact digest a `run-e2e` run had just failed against, in a run where
+`promote-to-testing` was `skipped`. That means either `compute-push-tags`'
+excluded-tag output was not honored by the later push step, or something else
+in the reusable workflow re-tags after the fact (for example `just
+tag-images` tagging `DEFAULT_TAG` locally and a later step publishing all
+local tags regardless of the computed set).
+
+Before trusting `promote-to-testing: skipped` as proof `:testing` is still
+the last known-good digest, verify what the registry actually serves:
+
+```bash
+skopeo inspect docker://ghcr.io/projectbluefin/bluefin:testing
+```
+
+Compare the returned digest against the `IMAGE:` value logged by the most
+recent `run-e2e` run for that digest. A mismatch, or a match against a
+*failing* run, means the leak reproduced again. The fix (making
+`publish_stream_tag: "false"` actually prevent the bare-tag push, plus a
+regression guard) belongs in `projectbluefin/actions`, not here — this repo
+only supplies the input; it does not control the push step that is supposed
+to honor it.
+## `promote-testing-to-main` fails with `GH006` while another run is enqueuing
+
+`.github/workflows/promote-testing-to-main.yml` calls
+`projectbluefin/actions/.github/workflows/reusable-promote-squash.yml@v1`,
+which force-pushes the rebuilt squash branch and then calls the
+`enqueuePullRequest` GraphQL mutation because `use_merge_queue: true`. If two
+triggers land close together (a `push` to `testing` and the daily `schedule`,
+or two pushes to `testing` moments apart), one run can finish enqueuing before
+the other's force-push lands, and the later run fails with:
+
+```
+remote: error: GH006: Protected branch update failed for refs/heads/auto/promote-testing-to-main.
+remote: - A pull request for this branch has been added to a merge queue. Branches that
+remote:   are queued for merging cannot be updated. To modify this branch, dequeue the
+remote:   associated pull request.
+```
+
+This is noise, not a lost promotion: the workflow's `concurrency` group
+serializes runs, and the earlier run already reached the intended state
+(branch pushed, PR enqueued). Confirm with the promotion PR's timeline before
+treating the failed run as a real blocker:
+
+```bash
+gh pr view <promotion-pr> --repo projectbluefin/bluefin --json number \
+  --jq '.number' | xargs -I{} gh api repos/projectbluefin/bluefin/issues/{}/timeline \
+  --jq '.[] | select(.event | test("force_pushed|merge_queue")) | [.event, .created_at]'
+```
+
+Interleaved `head_ref_force_pushed` / `added_to_merge_queue` events around the
+same minute confirm this benign race. The retry logic that would need to
+change (retry the enqueue instead of failing outright) lives in
+`reusable-promote-squash.yml` in `projectbluefin/actions`, not in this repo's
+thin caller — do not add push-retry logic here.
+
+The GitHub merge queue itself removes a queued PR once its required checks
+resolve, including the release-gate check that re-runs the E2E suite against
+the squashed result. A promotion PR that cycles `added_to_merge_queue` then
+`removed_from_merge_queue` roughly two hours later, day after day, means the
+release gate is genuinely failing on the squashed content — diagnose the
+underlying E2E failure (see above), not the promotion workflow, in that case.
+## `:testing` promotion blocker set (issue #989) — re-verified 2026-08-27
+
+`run-e2e / smoke,common / GNOME 50 — smoke-a` has failed on essentially every
+`post-testing-e2e` run since 2026-06-25, making `promote-to-testing` `skipped`
+(it needs `run-e2e.result == 'success'`). The root cause and fix are **owned by
+`projectbluefin/testsuite`**, not this repo — bluefin ships Firefox as an
+unmodified RPM and no bluefin-side change correlates with the regression
+window. Do not attempt to work around this from `bluefin` by adding
+`always()`, `continue-on-error`, or dropping `run-e2e` from
+`promote-to-testing`'s `needs:` — that would promote an unverified digest.
+
+State as of Nightly E2E run
+[33036921142](https://github.com/projectbluefin/bluefin/actions/runs/33036921142)
+(2026-08-27T03:37Z):
+
+- All six `firefox.feature` scenarios still fail deterministically, through
+  both `@retry` passes. The initial run and both retries report zero Firefox
+  scenarios passed, with `AssertionError: Firefox address bar not found` (and
+  the matching tab-list / "still visible" assertions for the Ctrl+T / Ctrl+W /
+  Ctrl+Q scenarios).
+- `testsuite#692` (merged 2026-08-07, in the current `v1` tag) fixed the
+  original bug: Firefox launched without `GNOME_ACCESSIBILITY=1`, so its
+  AT-SPI subtree never populated, and `_firefox_window()` falsely accepted a
+  bare `filler` node as a healthy window. That fix is real but **incomplete**:
+  the "main window is accessible" step now passes because the window exposes
+  *some* populated chrome (for example a toolbar or push button), but the
+  address-bar `entry` node specifically still never appears, so
+  `_address_bar()` still raises.
+- `testsuite#741` merged 2026-08-26 and is conclusively **not** the remaining
+  fix. The run above resolved both the reusable workflow and `test_ref` to
+  testsuite commit `ee82d53`, which contains `#741`'s merge commit, yet the
+  failure reproduced unchanged. That PR forwards `FIREFOX_A11Y_ENV` through
+  exported Flatpak desktop launches, but testsuite checks the `firefox` command
+  before its Flatpak candidates. Bluefin's base package manifest and image
+  validation require the Firefox RPM, so that command candidate is available
+  first; the Flatpak-export path changed by `#741` is not selected.
+- Continue the fix in `projectbluefin/testsuite`: log the selected
+  `context.firefox_launch_target` and dump the Firefox AT-SPI subtree on
+  failure, then correct the RPM-command path from that live evidence. Do not
+  guess at another Bluefin workflow bypass or treat a later `#741` merge as
+  evidence that the gate is fixed.
+- A post-testing rerun has not yet validated the updated testsuite because
+  every qualifying `Testing Images` run since 2026-08-12 has failed before E2E
+  (tracked separately in `#995`). The first successful push build will trigger
+  `post-testing-e2e.yml` automatically.
+- Unblock criterion: one green `Post-Testing E2E` run with
+  `promote-to-testing: success` after the testsuite fix lands closes this
+  issue. There is nothing to change in `bluefin` itself beyond re-verifying
+  that run.
+
+## `Testing Images` itself has been failing since 2026-08-12 — `post-testing-e2e` now skips before e2e even runs
+
+The AT-SPI/`firefox.feature` blocker documented above (issue #989,
+re-verified 2026-08-10) is no longer the proximate blocker on `:testing`.
+Every `Testing Images` run from
+[31607601482](https://github.com/projectbluefin/bluefin/actions/runs/31607601482)
+(2026-08-12T14:35Z) through
+[32753582407](https://github.com/projectbluefin/bluefin/actions/runs/32753582407)
+(2026-08-24T16:54Z–18:01Z, re-verified live) has failed before there is an
+image to test — 9 consecutive failures over 12 days, zero successes.
+Confirmed run IDs: `31607601482`, `31727537250`, `31892823167`,
+`32190444084`, `32190579865`, `32257399479`, `32341452980`, `32346294695`,
+`32753582407`.
+
+Both `bluefin` and `bluefin-nvidia` (`main`/`nvidia` flavor) fail identically,
+on every retry within a run, at the same step — the `extension-builder` stage
+in `Containerfile` (`dnf5 -y install glib2-devel meson sassc cmake
+dbus-devel`, right after the `base-common` stage completes):
+
+```
+error: rpmdb: damaged header #1808 retrieved -- skipping.
+error: SELECT hnum, blob FROM 'Packages': 11: database disk image is malformed
+Transaction failed: Rpm transaction failed.
+```
+
+The damaged header number is not perfectly stable (`#1808` on 08-20,
+`#1809` on the 08-24 re-check), so this is not one static, byte-identical
+cached blob being replayed forever — treat it as "reliably corrupts the same
+way," not "the exact same bytes every time," when investigating.
+
+`Containerfile` and `image-versions.yml` have not changed since 2026-08-07
+(before the last known-good build on 2026-08-10), which rules out a
+script/pin regression as the direct trigger — something external to those
+files changed between the 08-10 success and the 08-12 failure.
+
+Because `post-testing-e2e.yml`'s `e2e` job requires
+`github.event.workflow_run.conclusion == 'success'`, every `Post-Testing E2E`
+run since 08-12 reports `skipped` for `e2e`, `run-e2e`, and
+`promote-to-testing` — not `failure`. The AT-SPI triage above still describes
+a real, unfixed bug, but it is not what is currently stopping `:testing` from
+advancing: the pipeline no longer gets far enough to reach it.
+
+**Unconfirmed prime suspect** (flag for whoever picks this up next; not
+proven here — this runtime has no CI trigger access and per policy
+documentation changes should not run expensive image builds to test it):
+the registry-based buildah layer cache. `Justfile`'s `build` recipe computes
+`cache_ref="ghcr.io/{{ repo_organization }}/${image_name}"`, keyed only by
+flavor (`bluefin` / `bluefin-nvidia`), not by tag, and both `--cache-from`
+(every build) and `--cache-to` (every non-PR push) target that one ref. A
+`testing`-branch push and the `main`-branch push that
+`promote-testing-to-main` triggers minutes later both build the `main` flavor
+and can run concurrently, writing `--cache-to` the identical ref; a bad
+interleaving there could plausibly corrupt a cached `base-common` layer that
+every later `--cache-from` then keeps replaying, matching the observed
+determinism across flavors and retries (the damaged-header number drifting
+by one between checks is consistent with a stable corrupted layer plus
+normal package-set churn, not proof against this). Before assuming this: get
+a maintainer to trigger one build with the registry cache disabled
+(`--cache-from`/`--cache-to` both suppressed, not just `REGISTRY_CACHE_WRITE=0`,
+which still reads the poisoned cache) and compare.
+
+```bash
+# Reproduce the census
+gh run list --repo projectbluefin/bluefin --workflow "Testing Images" -L 20 \
+  --json conclusion,createdAt,headBranch,databaseId
+
+# Confirm post-testing-e2e is skipping, not failing, e2e
+gh run view RUN_ID --repo projectbluefin/bluefin --json jobs \
+  --jq '.jobs[] | [.name, .status, .conclusion] | @tsv'
+```
+
+### Update 2026-08-28 — registry-cache suspect disproven; failure is a WAL-mode rpmdb read across the stage-commit boundary
+
+Full-log forensics across the good/bad boundary correct two claims above and
+retire the prime suspect:
+
+- **The census conflates two failure modes.** Run `31607601482` (08-12) built
+  every stage successfully — including the `extension-builder` dnf install —
+  and failed only while *pushing* (GHCR secondary rate limit, HTTP 403, on
+  both the cache push and the image push). The rpmdb-malformed signature
+  starts with `31727537250` (08-13) and appears in every failing run from
+  then on. Last good *build* is therefore 08-12, not 08-10.
+- **The registry-cache-replay suspect is disproven.** The failing step's
+  parent (`base-common`) rebuilds fresh in the failing runs — its `FROM`
+  digest is re-resolved daily, so its cache key changes daily, and run
+  `32924887367` (08-26) demonstrably executed Stage 1 live (new
+  `BUILD_FILES_SHA`, full 251-package install in the log) and still failed.
+  Seven distinct daily base digests (08-13 → 08-26) all fail identically; no
+  stale cached layer is involved. Do not ask a maintainer for a cache-disabled
+  run; that experiment answers a question this evidence already settles.
+- **Environment is constant across the boundary.** Last-good (08-12) and
+  first-bad (08-13) runs used the identical runner image (`20260720.247.2`),
+  identical podman/buildah/crun from Ubuntu resolute
+  (5.7.0 / 1.42.1 / 1.21), a `projectbluefin/actions` delta touching only
+  sync-branches/renovate workflows, and a bluefin delta touching only
+  `20-tests.sh` (runs in Stage 2, after the failing step).
+- **The base composes are package-identical.** `44.20260812.0` (works) and
+  `44.20260813.0` (fails) have byte-identical `rpm -qa` sets and
+  byte-identical shipped `rpmdb.sqlite-shm`/`-wal` sidecars. Only the
+  `rpmdb.sqlite` bytes and layer packing differ.
+- **What is actually failing:** the Fedora bootc bases ship
+  `/usr/lib/sysimage/rpm/rpmdb.sqlite` in SQLite **WAL journal mode** with
+  stale `-shm`/`-wal` sidecars, and every dnf transaction in a build stage
+  leaves the database in WAL mode with fresh sidecars. The
+  `extension-builder` failure is the next stage's *first read* of that
+  committed WAL state (`SELECT hnum, blob FROM 'Packages'` is the rpmdb
+  Packages table): under CI's rootful buildah 1.42.1 overlay it reports
+  SQLITE_CORRUPT, while the same image and same read succeed under local
+  rootless podman 5.8.4 — the residual trigger is in the
+  buildah-version/overlay interaction with post-0812 rpmdb bytes, not in any
+  input this repo pins.
+- **Fix applied in this repo:** `build_files/shared/checkpoint-rpmdb.sh`
+  checkpoints the WAL, converts the rpmdb to the default rollback-journal
+  mode, and removes the sidecars; `Containerfile` runs it as the last step of
+  Stage 1 and Stage 2, so every committed layer (and the shipped image)
+  carries a single self-contained `rpmdb.sqlite`. Validated locally: with the
+  checkpoint in place, a two-stage build on the failing-era base commits a
+  sidecar-free `journal_mode=delete` database that the next stage reads and
+  installs against cleanly; without it, a stage's dnf write always re-enables
+  WAL, which is why the script must run per-stage, not once.
diff --git a/docs/skills/ci/references/mergeraptor-checks.md b/docs/skills/ci/references/mergeraptor-checks.md
index 1e7119204..0ba2b7f87 100644
--- a/docs/skills/ci/references/mergeraptor-checks.md
+++ b/docs/skills/ci/references/mergeraptor-checks.md
@@ -5,12 +5,70 @@ installation already holds; anything else fails the run with `The permissions
 requested are not granted to this installation.` The MergeRaptor installation
 on `projectbluefin` therefore needs **Checks: write** for `lab-check.yml`, in
 addition to the contents/pull-requests/workflows grants `track-common.yml`
-uses. Confirm the current grants before debugging the workflow YAML:
+uses.
+
+## Diagnose before fixing: App definition vs. installation
+
+A permission lives at two levels, and the same error message covers both. Check
+both before touching anything — the fix differs, and the installation-level fix
+is a dead end when the App itself has not declared the permission.
+
+**1. What the App declares** — the menu of permissions it is allowed to ask for:
+
+```bash
+gh api /apps/mergeraptor --jq '{owner: .owner.login, permissions}'
+```
+
+**2. What this org's installation grants** — what it actually holds:
 
 ```bash
 gh api orgs/projectbluefin/installations \
   --jq '.installations[] | select(.app_slug == "mergeraptor") | .permissions'
 ```
 
+Both commands need an org-owner token (`admin:org`); a contributor token returns
+`404`/`Not Found`, which is not evidence either way.
+
+Read the two together:
+
+| `checks` in App permissions | `checks` in installation permissions | What it means |
+|---|---|---|
+| absent | absent | The App cannot request it yet. **Both steps below are required.** Re-installing or re-approving does nothing — there is no pending request to approve. |
+| present | absent | Only step 2 — an org owner approves the pending permission request. |
+| present | `write` | Grant is in place; `lab-check.yml` should mint its token. Investigate elsewhere. |
+
+## The fix (UI only — there is no REST endpoint for this)
+
+**Step 1 — declare it on the App.** Organization settings → Developer settings →
+GitHub Apps → **MergeRaptor** → Permissions & events → Repository permissions →
+**Checks: Read and write** → Save. Skipping this is the common failure: it is a
+*different screen* from the installation page, and until it is done the
+installation page offers nothing to approve.
+
+**Step 2 — approve it on the installation.** Saving step 1 raises a permission
+request to org owners. Accept it under Organization settings → GitHub Apps →
+MergeRaptor → **Review request**.
+
+Then re-run the check with the step-2 command above; `checks` must read `write`.
+Dispatch a `lab-check` repository event (or wait for the next `track-common` QA
+run) and confirm `testing-lab / <product>` is created or updated.
+
+## Rules
+
 Granting an app permission is org-admin administration in the GitHub UI, not a
-repository change. Never work around a missing grant with a PAT.
+repository change. Never work around a missing grant with a PAT, and never add a
+fallback that lets `lab-check.yml` pass without reporting: a check that silently
+skips is worse than one that fails loudly, because the gap stops being visible.
+`lab-check.yml` requests exactly `permission-checks: write` and
+`permission-contents: read`, which is the minimum the check-run API needs.
+
+## Reading a failed run
+
+The job summary shows **`Get MergeRaptor token: success`** directly above a
+failing diagnostic step. That is not a second bug and the mint did not
+half-succeed. `continue-on-error: true` makes a step report *conclusion*
+`success` while its *outcome* stays `failure`; the diagnostic keys off
+`outcome`, which is correct. Confirm the real result in the step log — a denied
+mint logs `##[error]The permissions requested are not granted to this
+installation` and an HTTP `422` from
+`POST /app/installations/{id}/access_tokens`.
diff --git a/docs/skills/dependency-automation/SKILL.md b/docs/skills/dependency-automation/SKILL.md
index b86263747..2fedb7eed 100644
--- a/docs/skills/dependency-automation/SKILL.md
+++ b/docs/skills/dependency-automation/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: dependency-automation
-version: "1.1"
-last_updated: 2026-08-07
+version: "1.2"
+last_updated: 2026-08-16
 id: dependency-automation
 one_line_purpose: Review Renovate configuration and automated dependency updates.
 entry_point: docs/skills/dependency-automation/SKILL.md
@@ -30,8 +30,10 @@ metadata:
    workflow. Do not add another supported Renovate config filename: Renovate
    stops at the first match and would silently shadow the canonical file.
 2. Validate configuration changes with the repository's configured validator.
-3. Preserve the configured authentication model; never add personal access
-   tokens or credentials.
+3. Preserve the configured authentication model: pass the MergeRaptor App
+   credentials to the reusable auto-merge workflow. A merge performed with
+   `GITHUB_TOKEN` suppresses the resulting `push` workflow, so testing images
+   would not build. Never add personal access tokens or user credentials.
 4. Confirm the pull request targets the development branch.
 5. Run the default gate.
 
diff --git a/docs/skills/issue-lifecycle/SKILL.md b/docs/skills/issue-lifecycle/SKILL.md
index b946c5fd6..95f679841 100644
--- a/docs/skills/issue-lifecycle/SKILL.md
+++ b/docs/skills/issue-lifecycle/SKILL.md
@@ -37,6 +37,17 @@ metadata:
    repository's default branch `main`, which the base-branch guard rejects).
 6. Respond to review feedback; do not self-approve or self-merge.
 
+`Closes #NNN` only auto-closes the issue once its commit reaches the
+repository's default branch (`main`), because GitHub evaluates the closing
+keyword against the default branch regardless of which branch the PR merged
+into. Merging to `testing` does not close the issue immediately; the issue
+stays open until `promote-testing-to-main.yml` carries that commit to `main`.
+Do not read a `Closes`-linked issue still being open after a `testing` merge
+as a bug in the PR, the automation, or the link itself — confirm whether the
+commit has reached `main` yet before concluding anything is wrong. See
+[`projectbluefin/bluefin#995`](https://github.com/projectbluefin/bluefin/issues/995)
+for a case where this produced exactly that confusion.
+
 Automation applies and repairs the seven canonical workflow labels. Agents do
 not use slash commands as state transitions, do not add or remove workflow
 labels, and do not manufacture queue state. If blocked, describe the exact
diff --git a/docs/skills/release-artifacts/SKILL.md b/docs/skills/release-artifacts/SKILL.md
index 608a9fdec..7fe6289f4 100644
--- a/docs/skills/release-artifacts/SKILL.md
+++ b/docs/skills/release-artifacts/SKILL.md
@@ -33,6 +33,18 @@ metadata:
 4. Never bypass a failed trust or verification gate.
 5. Report the run ID and exact verification commands.
 
+## Weekly stable promotion window
+
+`.github/workflows/promote-testing-to-main.yml` keeps its push and daily
+schedule triggers so the testing-to-main promotion PR and its gates stay fresh.
+Only a Tuesday UTC scheduled run enables the merge-queue enqueue step. A
+`workflow_dispatch` run remains an explicit hotfix escape hatch; push events
+and non-Tuesday scheduled runs refresh the PR without releasing stable.
+
+The release window is enforced before the reusable promotion workflow receives
+`use_merge_queue`; do not make that input unconditional or remove the daily
+heartbeat when changing the caller.
+
 ```bash
 gh run list --repo projectbluefin/bluefin --limit 20
 gh run view RUN_ID --repo projectbluefin/bluefin --log-failed
diff --git a/docs/workflow.md b/docs/workflow.md
index bb34635b0..6037d86ed 100644
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -46,7 +46,10 @@ issue and stop.
 4. Run the relevant validation.
 5. Update the matching documentation when a reusable fact changes.
 6. Open a pull request targeting `testing` containing `Closes #NNN`; normal
-   feature work must not target `main`.
+   feature work must not target `main`. That keyword only auto-closes the
+   issue once the commit reaches the default branch `main` — see
+   [issue-lifecycle](skills/issue-lifecycle/SKILL.md) — so the issue stays
+   open through the `testing` merge until `promote-testing-to-main.yml` runs.
 
 Do not self-approve or self-merge. Automation applies `4-review`; a human
 reviews.
diff --git a/image-versions.yml b/image-versions.yml
index d10f25858..6b45e2210 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -2,8 +2,8 @@ images:
   - name: common
     image: ghcr.io/projectbluefin/common
     tag: latest
-    digest: sha256:fb943c87866292fb74eb74610e9cd08a1a91fe42e763e28473f3f57cf18f26a5
+    digest: sha256:4cf1be94367c4f8887be9a2ab615995bcb0e0e2cf0118db111a5d0122c268f6a
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:8f952ae54585db9f855a306ef365e13609ed7c7944b12b823ba7d5ce8e1a145b
+    digest: sha256:bed056871da6edd8c6ee455a274283ae83bf269461dcad758a7729aaad018401
diff --git a/scripts/check-renovate-automerge-auth.py b/scripts/check-renovate-automerge-auth.py
new file mode 100644
index 000000000..ff523e0b1
--- /dev/null
+++ b/scripts/check-renovate-automerge-auth.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Require Renovate merges to use MergeRaptor instead of GITHUB_TOKEN."""
+
+from pathlib import Path
+
+import yaml
+
+
+WORKFLOW = Path(".github/workflows/renovate-automerge.yml")
+
+REUSABLE_WORKFLOW = (
+    "projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@v1"
+)
+REQUIRED_SECRETS = {
+    "app_id": "${{ secrets.MERGERAPTOR_APP_ID }}",
+    "private_key": "${{ secrets.MERGERAPTOR_PRIVATE_KEY }}",
+}
+
+
+def main() -> int:
+    try:
+        workflow = yaml.safe_load(WORKFLOW.read_text(encoding="utf-8"))
+    except yaml.YAMLError:
+        workflow = None
+
+    job = (
+        workflow.get("jobs", {}).get("automerge", {})
+        if isinstance(workflow, dict)
+        else {}
+    )
+    if (
+        not isinstance(job, dict)
+        or job.get("uses") != REUSABLE_WORKFLOW
+        or job.get("secrets") != REQUIRED_SECRETS
+    ):
+        print("Renovate auto-merge authentication contract failed:")
+        print(
+            "The automerge job must pass the adjacent app_id and private_key "
+            "MergeRaptor secrets so the resulting testing-branch push can "
+            "trigger image builds."
+        )
+        return 1
+
+    print("Renovate auto-merge authentication contract passed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx b/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx
index 86676ab49..ffeb15cdd 160000
--- a/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx
+++ b/system_files/shared/usr/share/gnome-shell/extensions/blur-my-shell@aunetx
@@ -1 +1 @@
-Subproject commit 86676ab49c578ce1d42226d3be9b4224d504b60f
+Subproject commit ffeb15cddc88818a968c05800647387de8759b3c
diff --git a/system_files/shared/usr/share/gnome-shell/extensions/gradia-integration@alexandervanhee.github.io b/system_files/shared/usr/share/gnome-shell/extensions/gradia-integration@alexandervanhee.github.io
index 9e441493a..f70a2127d 160000
--- a/system_files/shared/usr/share/gnome-shell/extensions/gradia-integration@alexandervanhee.github.io
+++ b/system_files/shared/usr/share/gnome-shell/extensions/gradia-integration@alexandervanhee.github.io
@@ -1 +1 @@
-Subproject commit 9e441493a132e9f38d3a7fdf5d7f0d55a0a36369
+Subproject commit f70a2127d0a9acc3c9d4d8198361fc9f4e14818f
diff --git a/system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/12-framework-amd-kargs-cleanup.sh b/system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/12-framework-amd-kargs-cleanup.sh
new file mode 100644
index 000000000..ee6d0d04c
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/12-framework-amd-kargs-cleanup.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/bash
+# Removes the stale module_blacklist=hid_sensor_hub kernel argument from
+# AMD Framework laptops. This karg was set by an older image version that
+# incorrectly applied an Intel-specific rule to all Framework hardware.
+# On AMD Framework systems this module has no known purpose on the blacklist
+# and may suppress unrelated USB HID sensor functionality.
+#
+# This is a one-time migration cleanup. The kernel driver fix for battery
+# charge threshold control on AMD Framework is in fw-charge-control.conf
+# (bluefin#879); this script only removes a stale karg side-effect.
+
+# shellcheck source=/dev/null
+source /usr/lib/ublue/setup-services/libsetup.sh
+
+version-script framework-amd-kargs-cleanup privileged 1 || exit 0
+
+set -euo pipefail
+
+VENDOR_PATH="/sys/devices/virtual/dmi/id/chassis_vendor"
+PRODUCT_PATH="/sys/devices/virtual/dmi/id/product_name"
+STALE_KARG="module_blacklist=hid_sensor_hub"
+
+if [[ ! -r "${VENDOR_PATH}" || ! -r "${PRODUCT_PATH}" ]]; then
+    echo "Framework AMD kargs cleanup: DMI information not available, skipping."
+    exit 0
+fi
+
+vendor="$(<"${VENDOR_PATH}")"
+product_name="$(<"${PRODUCT_PATH}")"
+
+# Only run on Framework hardware
+[[ "${vendor}" == "Framework" ]] || exit 0
+
+# Positive AMD match: only act on Framework laptops that name AMD in the product
+# string.  This avoids mutating boot config on Intel or future unknown Framework
+# hardware.
+[[ "${product_name}" =~ AMD ]] || exit 0
+
+if ! command -v rpm-ostree >/dev/null 2>&1; then
+    echo "Warning: rpm-ostree not found; unable to clean up stale AMD Framework kargs."
+    exit 0
+fi
+
+if ! rpm-ostree kargs | grep -Fq "${STALE_KARG}"; then
+    echo "AMD Framework: ${STALE_KARG} not present — nothing to do."
+    exit 0
+fi
+
+rpm-ostree kargs --delete="${STALE_KARG}"
+echo "Removed stale AMD Framework karg: ${STALE_KARG}. Reboot to activate."
diff --git a/system_files/shared/usr/share/ublue-os/user-setup.hooks.d/20-framework.sh b/system_files/shared/usr/share/ublue-os/user-setup.hooks.d/20-framework.sh
deleted file mode 100644
index ef6a46bba..000000000
--- a/system_files/shared/usr/share/ublue-os/user-setup.hooks.d/20-framework.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/bash
-# Per-vendor user setup for Framework laptops.
-# Installs the Framework EC tool via Homebrew for hardware management.
-
-# shellcheck source=/dev/null
-source /usr/lib/ublue/setup-services/libsetup.sh
-
-version-script 20-framework user 1 || exit 0
-
-set -euo pipefail
-
-CHASSIS_VENDOR_PATH="/sys/devices/virtual/dmi/id/chassis_vendor"
-BREW_PREFIX="/home/linuxbrew/.linuxbrew"
-
-# Only run on Framework hardware
-[[ -r "${CHASSIS_VENDOR_PATH}" ]] || exit 0
-chassis_vendor="$(cat "${CHASSIS_VENDOR_PATH}")"
-[[ "${chassis_vendor}" == "Framework" ]] || exit 0
-
-echo "Framework laptop detected — running Framework-specific user setup"
-
-# Guard: brew must be available
-if ! command -v brew >/dev/null 2>&1; then
-    echo "Warning: brew not found — skipping Framework setup"
-    exit 0
-fi
-
-# Guard: user must have write access to the Homebrew prefix
-if [[ ! -w "${BREW_PREFIX}" ]]; then
-    echo "Warning: user lacks write permission to ${BREW_PREFIX} — skipping Framework setup"
-    exit 0
-fi
-
-# Install a package only when it is not already present
-install_if_missing() {
-    local pkg="$1"
-    if brew list "${pkg}" >/dev/null 2>&1; then
-        echo "${pkg} already installed, skipping"
-    else
-        echo "Installing ${pkg}..."
-        brew install "${pkg}"
-    fi
-}
-
-# Framework EC tool for hardware management (fan curves, battery charge limit, etc.)
-install_if_missing "fw-ectool"
diff --git a/tests/test_lab_check.py b/tests/test_lab_check.py
new file mode 100644
index 000000000..fbb27d834
--- /dev/null
+++ b/tests/test_lab_check.py
@@ -0,0 +1,195 @@
+"""Tests for the check-run reporting script in lab-check.yml.
+
+The workflow has never run to completion in CI -- every dispatch so far dies at
+the MergeRaptor token mint (bluefin#939) -- so the script below is exercised
+here against a stub ``gh`` instead.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import tempfile
+import textwrap
+import unittest
+from pathlib import Path
+
+
+WORKFLOW = Path(__file__).parents[1] / ".github" / "workflows" / "lab-check.yml"
+STEP = "      - name: Create or update lab check\n"
+REPOSITORY = "projectbluefin/bluefin"
+CHECK_NAME = "testing-lab / bluefin"
+SHA = "a" * 40
+
+# Stands in for `gh api`: serves the check-runs listing from GH_STUB_CHECK_RUNS
+# with the same semantics as the real endpoint -- newest first, truncated to
+# per_page, filtered by check_name when asked -- and records every request.
+STUB_GH = '''#!/usr/bin/env python3
+import json
+import os
+import subprocess
+import sys
+
+arguments = sys.argv[1:]
+method = "GET"
+fields = {}
+jq_expression = None
+endpoint = None
+
+index = 0
+while index < len(arguments):
+    argument = arguments[index]
+    if argument == "--method":
+        method = arguments[index + 1]
+        index += 2
+    elif argument in ("-f", "--raw-field"):
+        key, _, value = arguments[index + 1].partition("=")
+        fields[key] = value
+        index += 2
+    elif argument == "--jq":
+        jq_expression = arguments[index + 1]
+        index += 2
+    elif argument == "--input":
+        index += 2
+    elif argument == "api" or argument.startswith("-"):
+        index += 1
+    else:
+        endpoint = argument
+        index += 1
+
+
+def record(entry):
+    with open(os.environ["GH_STUB_LOG"], "a", encoding="utf-8") as log:
+        log.write(json.dumps(entry) + "\\n")
+
+
+if method in ("POST", "PATCH"):
+    record({"method": method, "endpoint": endpoint,
+            "body": json.loads(sys.stdin.read())})
+    print(json.dumps({"id": 0}))
+    sys.exit(0)
+
+if endpoint.endswith("/check-runs"):
+    runs = json.loads(os.environ["GH_STUB_CHECK_RUNS"])
+    name = fields.get("check_name")
+    if name is not None:
+        runs = [run for run in runs if run["name"] == name]
+    page = runs[: int(fields.get("per_page", 30))]
+    record({"method": method, "endpoint": endpoint, "check_name": name,
+            "returned": len(page)})
+    payload = json.dumps({"total_count": len(runs), "check_runs": page})
+    if jq_expression is None:
+        print(payload)
+        sys.exit(0)
+    result = subprocess.run(["jq", "-r", jq_expression], input=payload,
+                            capture_output=True, text=True)
+    sys.stdout.write(result.stdout)
+    sys.stderr.write(result.stderr)
+    sys.exit(result.returncode)
+
+record({"method": method, "endpoint": endpoint})
+print("{}")
+'''
+
+
+def report_script() -> str:
+    """Return the shell body of the 'Create or update lab check' step."""
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    step = workflow.split(STEP, 1)[1].split("\n      - name: ", 1)[0]
+    return textwrap.dedent(step.split("        run: |\n", 1)[1])
+
+
+def check_run(identifier: int, name: str = CHECK_NAME,
+              slug: str = "mergeraptor") -> dict:
+    return {"id": identifier, "name": name, "app": {"slug": slug}}
+
+
+class LabCheckReportTests(unittest.TestCase):
+    def run_report(self, existing: list[dict], check: dict) -> list[dict]:
+        """Run the step against `existing` check runs, newest first."""
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            root = Path(temporary_directory)
+            stub = root / "gh"
+            stub.write_text(STUB_GH, encoding="utf-8")
+            stub.chmod(0o755)
+            log = root / "requests.jsonl"
+            log.touch()
+
+            environment = dict(os.environ)
+            environment.update(
+                PATH=f"{root}{os.pathsep}{environment['PATH']}",
+                GITHUB_REPOSITORY=REPOSITORY,
+                SHA=SHA,
+                CHECK_JSON=json.dumps(check),
+                GH_TOKEN="stub-token",
+                GH_STUB_LOG=str(log),
+                GH_STUB_CHECK_RUNS=json.dumps(existing),
+            )
+
+            result = subprocess.run(
+                ["bash", "-c", report_script()],
+                env=environment,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            return [
+                json.loads(line)
+                for line in log.read_text(encoding="utf-8").splitlines()
+            ]
+
+    def test_updates_existing_check_buried_past_the_first_page(self) -> None:
+        # A commit that has collected more check runs than one page holds: the
+        # lab check is the oldest, so an unfiltered listing would never see it.
+        existing = [check_run(9000 + index, name="e2e") for index in range(150)]
+        existing.append(check_run(1234))
+
+        requests = self.run_report(
+            existing,
+            {"state": "completed", "conclusion": "success",
+             "summary": "All lab suites passed."},
+        )
+
+        writes = [r for r in requests if r.get("method") in ("POST", "PATCH")]
+        self.assertEqual(len(writes), 1)
+        self.assertEqual(writes[0]["method"], "PATCH")
+        self.assertTrue(writes[0]["endpoint"].endswith("/check-runs/1234"))
+        # head_sha is immutable on an existing run; sending it is rejected.
+        self.assertNotIn("head_sha", writes[0]["body"])
+        self.assertEqual(writes[0]["body"]["conclusion"], "success")
+
+        listing = next(r for r in requests if r["endpoint"].endswith("check-runs"))
+        self.assertEqual(listing["check_name"], CHECK_NAME)
+
+    def test_creates_check_when_the_commit_has_none(self) -> None:
+        requests = self.run_report(
+            [check_run(9001, name="e2e")],
+            {"state": "in_progress", "title": "Lab validation",
+             "summary": "Lab run started.",
+             "details_url": "https://lab.example/run/7"},
+        )
+
+        writes = [r for r in requests if r.get("method") in ("POST", "PATCH")]
+        self.assertEqual(len(writes), 1)
+        self.assertEqual(writes[0]["method"], "POST")
+        body = writes[0]["body"]
+        self.assertEqual(body["name"], CHECK_NAME)
+        self.assertEqual(body["head_sha"], SHA)
+        self.assertEqual(body["status"], "in_progress")
+        self.assertNotIn("conclusion", body)
+        self.assertEqual(body["details_url"], "https://lab.example/run/7")
+
+    def test_ignores_a_same_named_check_from_another_app(self) -> None:
+        requests = self.run_report(
+            [check_run(4321, slug="some-other-app")],
+            {"state": "completed", "conclusion": "failure",
+             "summary": "Lab run failed."},
+        )
+
+        writes = [r for r in requests if r.get("method") in ("POST", "PATCH")]
+        self.assertEqual(writes[0]["method"], "POST")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_renovate_automerge_auth.py b/tests/test_renovate_automerge_auth.py
new file mode 100644
index 000000000..6e64f923b
--- /dev/null
+++ b/tests/test_renovate_automerge_auth.py
@@ -0,0 +1,36 @@
+import importlib.util
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+SCRIPT = ROOT / "scripts" / "check-renovate-automerge-auth.py"
+
+
+def load_checker():
+    spec = importlib.util.spec_from_file_location("renovate_auth", SCRIPT)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class RenovateAutomergeAuthTests(unittest.TestCase):
+    def test_accepts_semantically_correct_flow_style_secrets(self) -> None:
+        checker = load_checker()
+        workflow = """\
+name: Renovate Auto-merge
+jobs:
+  automerge:
+    uses: projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@v1
+    secrets: {app_id: "${{ secrets.MERGERAPTOR_APP_ID }}", private_key: "${{ secrets.MERGERAPTOR_PRIVATE_KEY }}"}
+"""
+        with tempfile.TemporaryDirectory() as directory:
+            checker.WORKFLOW = Path(directory) / "renovate-automerge.yml"
+            checker.WORKFLOW.write_text(workflow, encoding="utf-8")
+            self.assertEqual(checker.main(), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/12-framework-amd-kargs-cleanup_test.bats b/tests/unit/12-framework-amd-kargs-cleanup_test.bats
new file mode 100644
index 000000000..8cf639d06
--- /dev/null
+++ b/tests/unit/12-framework-amd-kargs-cleanup_test.bats
@@ -0,0 +1,147 @@
+#!/usr/bin/env bats
+# Unit tests for system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/12-framework-amd-kargs-cleanup.sh
+# Run with: bats tests/unit/12-framework-amd-kargs-cleanup_test.bats
+
+SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")" && pwd)"
+HOOK_SCRIPT="${SCRIPT_DIR}/../../system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/12-framework-amd-kargs-cleanup.sh"
+
+setup() {
+    TEST_ROOT="${SCRIPT_DIR}/.bats-sandbox/12-framework-amd-kargs-cleanup.${BATS_TEST_NUMBER:-0}.$$"
+    STUB_BIN="${TEST_ROOT}/stub-bin"
+    mkdir -p "${STUB_BIN}"
+    export PATH="${STUB_BIN}:${PATH}"
+
+    # Default rpm-ostree stub: kargs returns no blacklist entry, deletes log calls
+    cat > "${STUB_BIN}/rpm-ostree" <<'EOF'
+#!/usr/bin/bash
+echo "rpm-ostree $*" >> "${STUB_BIN}/rpm-ostree.log"
+if [[ "$1" == "kargs" && "$#" -eq 1 ]]; then
+    echo "quiet rhgb"
+    exit 0
+fi
+exit 0
+EOF
+    chmod +x "${STUB_BIN}/rpm-ostree"
+
+    PATCHED_SCRIPT="${TEST_ROOT}/12-framework-amd-kargs-cleanup-patched.sh"
+    sed \
+        -e "s|source /usr/lib/ublue/setup-services/libsetup.sh|version-script() { return 0; }|g" \
+        -e "s|/sys/devices/virtual/dmi/id/chassis_vendor|${TEST_ROOT}/chassis_vendor|g" \
+        -e "s|/sys/devices/virtual/dmi/id/product_name|${TEST_ROOT}/product_name|g" \
+        "${HOOK_SCRIPT}" > "${PATCHED_SCRIPT}"
+    chmod +x "${PATCHED_SCRIPT}"
+    export PATCHED_SCRIPT TEST_ROOT STUB_BIN
+}
+
+teardown() {
+    rm -rf "${TEST_ROOT}"
+}
+
+@test "12-framework-amd-kargs-cleanup: non-Framework systems are skipped" {
+    echo "ACME Corp" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 13 (AMD Ryzen 7040 Series)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [ ! -f "${STUB_BIN}/rpm-ostree.log" ]
+}
+
+@test "12-framework-amd-kargs-cleanup: Intel Framework systems are skipped" {
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 13 (Intel Core Ultra Series 1)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [ ! -f "${STUB_BIN}/rpm-ostree.log" ]
+}
+
+@test "12-framework-amd-kargs-cleanup: unknown Framework product is skipped" {
+    # Positive AMD match: a future Framework SKU with no AMD in the name must not
+    # have its boot config mutated.
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 15 (RISC-V Edition)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [ ! -f "${STUB_BIN}/rpm-ostree.log" ]
+}
+
+@test "12-framework-amd-kargs-cleanup: AMD Framework without stale karg exits cleanly" {
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 13 (AMD Ryzen 7040 Series)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"nothing to do"* ]]
+    ! grep -q -- "--delete" "${STUB_BIN}/rpm-ostree.log" 2>/dev/null
+}
+
+@test "12-framework-amd-kargs-cleanup: AMD Framework with stale karg deletes it" {
+    # Stub: kargs output includes the stale blacklist entry
+    cat > "${STUB_BIN}/rpm-ostree" <<'EOF'
+#!/usr/bin/bash
+echo "rpm-ostree $*" >> "${STUB_BIN}/rpm-ostree.log"
+if [[ "$1" == "kargs" && "$#" -eq 1 ]]; then
+    echo "quiet rhgb module_blacklist=hid_sensor_hub"
+    exit 0
+fi
+exit 0
+EOF
+    chmod +x "${STUB_BIN}/rpm-ostree"
+
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 16 (AMD Ryzen 7040 Series)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    grep -q "kargs --delete=module_blacklist=hid_sensor_hub" "${STUB_BIN}/rpm-ostree.log"
+    [[ "$output" == *"Removed stale AMD Framework karg"* ]]
+}
+
+@test "12-framework-amd-kargs-cleanup: AMD Ryzen AI product name is matched" {
+    cat > "${STUB_BIN}/rpm-ostree" <<'EOF'
+#!/usr/bin/bash
+echo "rpm-ostree $*" >> "${STUB_BIN}/rpm-ostree.log"
+if [[ "$1" == "kargs" && "$#" -eq 1 ]]; then
+    echo "quiet rhgb module_blacklist=hid_sensor_hub"
+    exit 0
+fi
+exit 0
+EOF
+    chmod +x "${STUB_BIN}/rpm-ostree"
+
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 13 (AMD Ryzen AI 300 Series)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    grep -q "kargs --delete=module_blacklist=hid_sensor_hub" "${STUB_BIN}/rpm-ostree.log"
+}
+
+@test "12-framework-amd-kargs-cleanup: missing rpm-ostree exits with warning" {
+    rm -f "${STUB_BIN}/rpm-ostree"
+    export PATH="${STUB_BIN}:/usr/bin:/bin"
+
+    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
+    echo "Laptop 13 (AMD Ryzen 7040 Series)" > "${TEST_ROOT}/product_name"
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Warning: rpm-ostree not found"* ]]
+}
+
+@test "12-framework-amd-kargs-cleanup: missing DMI info exits cleanly" {
+    # Neither chassis_vendor nor product_name file exists
+
+    run bash "${PATCHED_SCRIPT}"
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"DMI information not available"* ]]
+}
diff --git a/tests/unit/20-framework_test.bats b/tests/unit/20-framework_test.bats
deleted file mode 100644
index bd30fd671..000000000
--- a/tests/unit/20-framework_test.bats
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/usr/bin/env bats
-# Unit tests for system_files/shared/usr/share/ublue-os/user-setup.hooks.d/20-framework.sh
-# Run with: bats tests/unit/20-framework_test.bats
-
-SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")" && pwd)"
-HOOK_SCRIPT="${SCRIPT_DIR}/../../system_files/shared/usr/share/ublue-os/user-setup.hooks.d/20-framework.sh"
-
-setup() {
-    TEST_ROOT="${SCRIPT_DIR}/.bats-sandbox/20-framework.${BATS_TEST_NUMBER:-0}.$$"
-    STUB_BIN="${TEST_ROOT}/stub-bin"
-    mkdir -p "${STUB_BIN}"
-    mkdir -p "${TEST_ROOT}/linuxbrew"
-    export PATH="${STUB_BIN}:${PATH}"
-
-    # Stub brew — log calls, report packages as not installed
-    cat > "${STUB_BIN}/brew" <<EOF
-#!/usr/bin/bash
-echo "brew \$*" >> "${STUB_BIN}/brew.log"
-# 'list --cask' returns 1 (not installed) so install path is exercised
-[[ "\$1" == "list" ]] && exit 1
-exit 0
-EOF
-    chmod +x "${STUB_BIN}/brew"
-
-    # Patch: stub libsetup.sh, redirect chassis_vendor, and make BREW_PREFIX writable
-    PATCHED_SCRIPT="${TEST_ROOT}/20-framework-patched.sh"
-    sed \
-        -e "s|source /usr/lib/ublue/setup-services/libsetup.sh|version-script() { return 0; }|g" \
-        -e "s|/sys/devices/virtual/dmi/id/chassis_vendor|${TEST_ROOT}/chassis_vendor|g" \
-        -e "s|BREW_PREFIX=\"/home/linuxbrew/\.linuxbrew\"|BREW_PREFIX=\"${TEST_ROOT}/linuxbrew\"|g" \
-        "${HOOK_SCRIPT}" > "${PATCHED_SCRIPT}"
-    chmod +x "${PATCHED_SCRIPT}"
-    export PATCHED_SCRIPT TEST_ROOT STUB_BIN
-}
-
-teardown() {
-    rm -rf "${TEST_ROOT}"
-}
-
-@test "20-framework: brew never called for non-Framework vendor" {
-    echo "ACME Corp" > "${TEST_ROOT}/chassis_vendor"
-    run bash "${PATCHED_SCRIPT}"
-    [ "$status" -eq 0 ]
-    [ ! -f "${STUB_BIN}/brew.log" ]
-}
-
-@test "20-framework: brew install called when vendor is Framework" {
-    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
-    run bash "${PATCHED_SCRIPT}"
-    [ "$status" -eq 0 ]
-    grep -q "install" "${STUB_BIN}/brew.log"
-}
-
-@test "20-framework: missing brew exits cleanly" {
-    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
-    rm -f "${STUB_BIN}/brew"
-    export PATH="${STUB_BIN}:/usr/bin:/bin"
-
-    run bash "${PATCHED_SCRIPT}"
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"Warning: brew not found"* ]]
-}
-
-@test "20-framework: non-writable brew prefix skips install with warning" {
-    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
-    chmod 555 "${TEST_ROOT}/linuxbrew"
-
-    run bash "${PATCHED_SCRIPT}"
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"user lacks write permission"* ]]
-    [ ! -f "${STUB_BIN}/brew.log" ]
-}
-
-@test "20-framework: installed casks are skipped without install calls" {
-    cat > "${STUB_BIN}/brew" <<EOF
-#!/usr/bin/bash
-echo "brew \$*" >> "${STUB_BIN}/brew.log"
-[[ "\$1" == "list" ]] && exit 0
-exit 0
-EOF
-    chmod +x "${STUB_BIN}/brew"
-    echo "Framework" > "${TEST_ROOT}/chassis_vendor"
-
-    run bash "${PATCHED_SCRIPT}"
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"already installed, skipping"* ]]
-    ! grep -q "install" "${STUB_BIN}/brew.log"
-}
diff --git a/tests/unit/20-tests_test.bats b/tests/unit/20-tests_test.bats
index 565dec12b..4ff71875b 100644
--- a/tests/unit/20-tests_test.bats
+++ b/tests/unit/20-tests_test.bats
@@ -11,6 +11,7 @@ setup() {
     mkdir -p "${STUB_BIN}"
     mkdir -p "${TEST_ROOT}/etc/containers" \
         "${TEST_ROOT}/usr/bin" \
+        "${TEST_ROOT}/usr/libexec" \
         "${TEST_ROOT}/usr/share/ublue-os/just" \
         "${TEST_ROOT}/usr/share/ublue-os/homebrew" \
         "${TEST_ROOT}/usr/share/flatpak/preinstall.d" \
@@ -36,8 +37,10 @@ setup() {
     touch "${TEST_ROOT}/usr/share/ublue-os/homebrew/preinstall.d/bluefinctl.Brewfile" \
         "${TEST_ROOT}/usr/share/ublue-os/homebrew/preinstall.d/system-cli.Brewfile" \
         "${TEST_ROOT}/usr/lib/systemd/user/brew-preinstall.service"
-    touch "${TEST_ROOT}/usr/bin/brew-preinstall"
-    chmod +x "${TEST_ROOT}/usr/bin/brew-preinstall"
+    touch "${TEST_ROOT}/usr/bin/brew-preinstall" \
+        "${TEST_ROOT}/usr/libexec/brew-preinstall"
+    chmod +x "${TEST_ROOT}/usr/bin/brew-preinstall" \
+        "${TEST_ROOT}/usr/libexec/brew-preinstall"
     echo 'enable brew-preinstall.service' \
         > "${TEST_ROOT}/usr/lib/systemd/user-preset/01-brew-preinstall.preset"
     cat > "${TEST_ROOT}/etc/containers/policy.json" <<'EOF'
@@ -98,6 +101,32 @@ teardown() {
     [ "$status" -eq 0 ]
 }
 
+@test "20-tests: rejects an image missing a required IMPORTANT_PACKAGES entry" {
+    # #965 item 1: fzf was missing from the image, breaking `ujust --choose` on
+    # first boot. #1057 added fzf to IMPORTANT_PACKAGES, but nothing asserted
+    # that the script actually fails when rpm reports it (or any other
+    # required package) absent — the existing "unwanted package" test below
+    # only exercises the UNWANTED_PACKAGES list. Guard the missing-package path
+    # directly so a future edit can't silently drop an entry with no coverage.
+    cat > "${STUB_BIN}/rpm" <<'EOF'
+#!/usr/bin/bash
+if [[ "$*" == *"%{VENDOR}"* ]]; then
+    echo "negativo17.org"
+    exit 0
+fi
+case "$*" in
+    *fedora-flathub-remote*|*fedora-logos*|*fedora-third-party*|*gnome-software*|*podman-docker*) exit 1 ;;
+    *fzf*) exit 1 ;;
+esac
+exit 0
+EOF
+    chmod +x "${STUB_BIN}/rpm"
+
+    run bash "${PATCHED_SCRIPT}"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"Missing package: fzf"* ]]
+}
+
 @test "20-tests: rejects an unwanted package" {
     cat > "${STUB_BIN}/rpm" <<'EOF'
 #!/usr/bin/bash
@@ -149,6 +178,17 @@ EOF
     [ "$status" -ne 0 ]
 }
 
+@test "20-tests: rejects an image whose brew-preinstall trampoline has no payload" {
+    # /usr/bin/brew-preinstall is `exec /usr/libexec/brew-preinstall`. Dropping
+    # the payload leaves the trampoline, the unit and the preset all intact, so
+    # every other assertion here still passes -- the build ships and the service
+    # dies with 127 at first login. That silent shape is the one #965 reported.
+    rm -f "${TEST_ROOT}/usr/libexec/brew-preinstall"
+
+    run bash "${PATCHED_SCRIPT}"
+    [ "$status" -ne 0 ]
+}
+
 @test "20-tests: rejects a preset that does not enable brew-preinstall" {
     # A shipped-but-disabled preset is the silent failure mode: every file is
     # present, the service just never starts for the user.
diff --git a/tests/unit/checkpoint-rpmdb_test.bats b/tests/unit/checkpoint-rpmdb_test.bats
new file mode 100644
index 000000000..6c4b998c7
--- /dev/null
+++ b/tests/unit/checkpoint-rpmdb_test.bats
@@ -0,0 +1,88 @@
+#!/usr/bin/env bats
+# Unit tests for build_files/shared/checkpoint-rpmdb.sh.
+# Run with: bats tests/unit/checkpoint-rpmdb_test.bats
+
+SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")" && pwd)"
+CHECKPOINT_RPMDB="${SCRIPT_DIR}/../../build_files/shared/checkpoint-rpmdb.sh"
+
+setup() {
+    TEST_ROOT="${SCRIPT_DIR}/.bats-sandbox/checkpoint-rpmdb.${BATS_TEST_NUMBER:-0}.$$"
+    mkdir -p "${TEST_ROOT}"
+    RPMDB_PATH="${TEST_ROOT}/rpmdb.sqlite"
+    export RPMDB_PATH
+
+    # A real WAL-mode database with live sidecars, like the one a dnf
+    # transaction leaves behind at the end of a build stage.
+    python3 - "${RPMDB_PATH}" <<'PYEOF'
+import sqlite3
+import sys
+
+db = sqlite3.connect(sys.argv[1])
+db.execute("PRAGMA journal_mode=WAL")
+db.execute("CREATE TABLE Packages (hnum INTEGER PRIMARY KEY, blob BLOB)")
+db.execute("INSERT INTO Packages (hnum, blob) VALUES (1, x'c0ffee')")
+db.commit()
+# Leave the connection open state behind us without checkpointing so the
+# -wal file still holds the committed frames, then close.
+db.close()
+PYEOF
+}
+
+teardown() {
+    rm -rf "${TEST_ROOT}"
+}
+
+journal_mode() {
+    python3 -c '
+import sqlite3
+import sys
+
+db = sqlite3.connect(f"file:{sys.argv[1]}?mode=ro", uri=True)
+print(db.execute("PRAGMA journal_mode").fetchone()[0])
+' "${RPMDB_PATH}"
+}
+
+@test "checkpoint-rpmdb: converts the database to rollback-journal mode" {
+    run "${CHECKPOINT_RPMDB}"
+    [ "$status" -eq 0 ]
+
+    run journal_mode
+    [ "$status" -eq 0 ]
+    [ "$output" = "delete" ]
+}
+
+@test "checkpoint-rpmdb: removes the -shm and -wal sidecar files" {
+    # Recreate the stale-sidecar state the base images ship with.
+    touch "${RPMDB_PATH}-shm" "${RPMDB_PATH}-wal"
+
+    run "${CHECKPOINT_RPMDB}"
+    [ "$status" -eq 0 ]
+
+    [ ! -e "${RPMDB_PATH}-shm" ]
+    [ ! -e "${RPMDB_PATH}-wal" ]
+}
+
+@test "checkpoint-rpmdb: preserves the database contents" {
+    run "${CHECKPOINT_RPMDB}"
+    [ "$status" -eq 0 ]
+
+    run python3 -c '
+import sqlite3
+import sys
+
+db = sqlite3.connect(f"file:{sys.argv[1]}?mode=ro", uri=True)
+print(db.execute("SELECT hnum, hex(blob) FROM Packages").fetchone())
+' "${RPMDB_PATH}"
+    [ "$status" -eq 0 ]
+    [ "$output" = "(1, 'C0FFEE')" ]
+}
+
+@test "checkpoint-rpmdb: fails loudly when the database is missing" {
+    rm -f "${RPMDB_PATH}"
+
+    run "${CHECKPOINT_RPMDB}"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"no rpmdb at"* ]]
+    # The failed run must not have created a stray empty database.
+    [ ! -e "${RPMDB_PATH}" ]
+}
diff --git a/tests/unit/containerfile_contexts_test.bats b/tests/unit/containerfile_contexts_test.bats
index 54e2cec39..7611f003a 100644
--- a/tests/unit/containerfile_contexts_test.bats
+++ b/tests/unit/containerfile_contexts_test.bats
@@ -58,6 +58,7 @@ expected = {
     "/build_files/base/19-initramfs.sh",
     "/build_files/base/20-tests.sh",
     "/build_files/shared/build-gnome-extensions.sh",
+    "/build_files/shared/checkpoint-rpmdb.sh",
     "/build_files/shared/clean-stage.sh",
     "/build_files/shared/disable-repos.sh",
     "/build_files/shared/finalize-gnome-extensions.sh",