fix: re-extract sticky v2 canonical copy from ADR 0030 §9 — heals red main

[Antawari]

Root cause

Merged PR #3 replaced the sticky block in the kit's own CLAUDE.md with the v2 text (the Seven Pillars), but did NOT update the canonical packaged data file src/cf_quality/data/sticky-intro.md, which still carried the v1 text. canonical_text() loads that data file via importlib.resources and compares byte-identical (line-ending normalization only), so the gate held v1 as canonical and graded the mounted v2 block STICKY_INTRO_ABSENT — self-ci on main (c2c7765) is red at the cf-sticky-check check . step. ADR 0030 (the Seven Pillars ADR, ratified 2026-06-11) is the canon parent; per the declared-mirror convention in sticky-intro.SOURCE.md ('update the canon first, then re-extract here'), the canon was updated — this PR is the re-extraction.

What changed

• src/cf_quality/data/sticky-intro.md — re-extracted programmatically and byte-faithful (content between the ```markdown fence and the closing fence, exactly; fences excluded) from candyfactory-canon decisions/0030-bubblegum-v2-seven-pillars.md §9 at canon main `00d6822`.
• src/cf_quality/data/sticky-intro.SOURCE.md — provenance: parent is now ADR 0030 §9; lineage note keeps ADR 0029 (its body retains the v1 copy, immutable, as history); extraction date 2026-06-11; new content sha recorded.
• src/cf_quality/sticky_check.py — MIRROR_HEADER now writes the ratified ADR 0029 + ADR 0030 one-liner (matches the header PR DO-NOT-MERGE · BubbleGum v2 sticky — awaits ADR 0030 ratification #3 merged into the kit's own CLAUDE.md).
• tests/test_sticky_check.py — DECLARED_SHA256 re-anchored to the v2 content hash; the header pin test updated; the two tamper fixtures re-anchored from v1-only phrases (≤ 500\n → ≤ 500 lines, Budgets, not vibes: → Budgets come from) with an added must-differ assert so a silent no-op replace can never fake a tamper fixture again.
• Stale ADR 0029-only provenance strings updated: README.md, src/cf_quality/__init__.py docstring, the self-ci.yml mirror-skip notice.

Byte-faithfulness proof

• sha256(src/cf_quality/data/sticky-intro.md) = 7dc04712c33f98318563bb2a1b9e60c753b83e257ed5aa403c406911d7d45e07 (raw bytes == LF-normalized; same convention as the v1 recording, verified against the v1 blob: 11e941b1…).
• The extracted block is byte-identical (after \r\n→\n normalization only) to the sticky block PR DO-NOT-MERGE · BubbleGum v2 sticky — awaits ADR 0030 ratification #3 merged into the kit's own CLAUDE.md (everything below the one-line mirror header). Verified programmatically; zero diff.

Verification — the full self-ci battery, locally, in order (fresh venv, pip install -e '.[dev]' + pyyaml)

Step	Result
ruff check .	PASS
ruff format --check .	PASS (22 files already formatted)
cf-sticky-check check .	PASS, exit 0 (the failing step on main)
cf-file-budget check	PASS (clean)
cf-mirror-check	SKIPPED — no MIRRORS.md yet (same visible-notice path as CI)
cf-recursion-check src	PASS
cf-exemptions	PASS (2 entries / frozen_count 2)
cf-import-contract --root .	PASS
mypy src	PASS (0 issues, 9 files, bare/zero-baseline)
pytest	310 passed, 0 failed

Pre-registration (the CandyFactory Method)

Prediction: self-ci goes green on this branch. Anchor: the local run of the identical battery above, every step green. Main's red self-ci run at c2c7765 is the failing oracle this PR is predicted to flip.

Open items for the maintainer

1. Consumer repos already mounted with the v1 block will now fail check as TAMPERED/ABSENT against the v2 canonical until re-mounted — that is the ratchet working as designed, but the re-mount wave is not this PR. check mode never reads the mirror header, so consumers carrying the old ADR 0029-only header are NOT broken by the MIRROR_HEADER constant change (it only affects what future mount writes); no consumer-breaking logic was touched.
2. ADR 0030 §9 says 'splitting a file is design, not evasion' migrates to the kit's long-form doc — that sentence is not yet anywhere in this repo (DESIGN.md included). Left for a docs pass.
3. DESIGN.md §1 still says the mirror parent is 'ADR 0029's fenced block' — left untouched here (history-flavored design narrative); flag if you want it refreshed in the same docs pass.

🤖 Generated with Claude Code