[acamarata]

Healthy Forgejo stacks no longer print a failed check for a runner the plugin no longer ships. The published environment table and command help now describe external runners on separate CI nodes.

Verified against fresh origin/main at c2eac4eb5661d1f17ac952e8c3ed447d0f9df162; each row still applies. AGENTS.md is a dangling link to the absent .claude/CLAUDE.md, so the supplied task rules apply.

• D-0945 — FIXED. Replace removed FORGEJO_RUNNER_* settings with the current manifest/environment variables, including closed-by-default registration. Link the README isolation, trust and migration guidance. Replace the retired network example with the existing owned-network fixture.
• D-0944 — FIXED. Remove the Docker runner probe and --runner flag from the legacy command, update the manifest and both embedded/captured help copies, and normalize future captures to preserve the correction. Drop obsolete Forgejo parity fixtures and their stub/server setup, documenting the intentional divergence from frozen core. The existing V15 server-only check and the legacy gate's exit behavior remain. Rationale: free/forgejo/README.md expressly assigns arbitrary workflow execution and runner management to a separate CI node, so local runner existence cannot determine forge health. Tests prove a healthy server succeeds without Docker, an unavailable server still warns, and the removed flag is rejected.
• D-0950 — BLOCKED in-flight: fix(ci): close run lifecycle debt (D-1309, D-0998, D-1036, D-0970, D-1103, D-1017) #512 is open and changes the same free/ci/cmd/v15.go and run-lifecycle code. CancelRun still persists only attempt intents and preparePlan still precedes coordinator policy resolution. No cancellation, policy-order, run-alias or acceptance-fixture changes are included, following the task's instruction to stop for an existing PR touching these files.

Validation (Go 1.27.3, darwin/arm64; Go commands from free/ci, with an isolated scratch GOCACHE):

• Before fixes: bash free/forgejo/tests/wiki-env-docs.sh fails on the stale table/description/network example; go test -mod=vendor ./internal/forgejo with the new regressions fails because a healthy server reports a missing runner and Docker is invoked.
• After fixes: documentation regression and bash scripts/lint-compose-network-literals.sh PASS (68 fragments, 12 fixtures).
• go build -mod=vendor ./... and go vet -mod=vendor ./... PASS.
• go test -mod=vendor ./internal/forgejo ./internal/surface PASS; the whole cmd package also passes in the module run.
• Normalizing clean origin/main captures reproduces all three updated golden files byte for byte: PASS.
• bash -n on the changed shell scripts, python3 scripts/ci/check-file-size.py, and git diff --check PASS.

go test -mod=vendor -p 2 ./... completed: all packages pass except three unrelated tests. Each failure reproduces on a clean archive of the baseline commit using the same Go cache:

• cmd/agent: TestServeStdioExitsNonZeroWithE663OnAProdStackMarker returns code 0 and empty stderr.
• internal/legacy: TestSecretsEnvLiveKeyGateTrackedValueOnly cannot track .environments/prod/.env because the worker Git ignore rules ignore it.
• internal/nodes/provision: TestInstallRunnerInstance_InheritedXtraceDoesNotLeak reports that tracing was not on (out="").

Baseline comparison commands: go test -mod=vendor ./cmd/agent -run '^TestServeStdioExitsNonZeroWithE663OnAProdStackMarker$', go test -mod=vendor ./internal/legacy -run '^TestSecretsEnvLiveKeyGateTrackedValueOnly$', and go test -mod=vendor ./internal/nodes/provision -run '^TestInstallRunnerInstance_InheritedXtraceDoesNotLeak$'. All reproduce their respective failures.

The initial shared Go cache had missing build artifacts; validation was repeated with a private scratch cache. No versions, releases, production configuration, hq files or repository settings changed. No hook exclusions were needed.

[acamarata]

Fixed review finding CHANGES-1: made free/forgejo/tests/wiki-env-docs.sh executable and added a 'Wiki env docs consistency' step to .github/workflows/forgejo-smoke.yml (installs jq, runs the script). Verified locally: script exits 0 on current tree. Pushed as 944e2ce.