feat(ci): scheduled weekly lock bump + dispatch fast-lane (item 14 b+c)

.gitea/workflows/bump.yml: Mondays 05:17 UTC (+ workflow_dispatch for
security bumps), nix flake update — within the pinned release branches
by construction, never a release jump — gated by nix flake check
--no-build, then a pathspec-limited flake.lock commit pushed to main
with the update's change list as the body. That push triggers check.yml
as a second net. Red gate or push race = a visibly failed run, nothing
lands. v1 promotion stays human. py_compile/bash -n deliberately not in
the gate: they don't read the lock. Container recipe inherited from
check.yml (nixbld, sandbox=false, pinned Nix 2.31.5).

Verified: V0 (yq parse, bash -n per run block); the update/commit/push
logic simulated end-to-end in a scratch clone with a real nix flake
update and a bare remote (changed + unchanged branches, bystander file
stays uncommitted, push lands); today's bumped lock evals green.
Remains: the first real run (cron pickup + Actions-token push) is not
confirmable from a session — BACKLOG item 14 slimmed to that watch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,14 +26,17 @@ next, in what order*.
 
 ## NEXT
 
-### 14. Automated upstream lock bumps (maintainer CI, slices b+c) `[big]`
-ROADMAP § Automated upstream lock bumps — the scheduled half (the
-checks-on-push workflow shipped; see item 20 for the runner status):
-weekly job runs `nix flake update` (within pinned release branches) →
-full check suite → lands on `main` on green; `v1` promotion stays
-human. Plus the fast-lane note for security bumps. Note the current
-runner is eval-only (no KVM) — a green bump run guards eval, not the VM
-suite, until item 20's stretch runner exists.
+### 14. Automated lock bumps — confirm the first real run
+Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly
+schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security
+fast-lane; `nix flake update` → eval gate → pathspec-limited lock
+commit pushed to `main` on green (that push triggers check.yml as the
+second net). Update/commit/push logic simulated locally end-to-end in
+a scratch clone, incl. a real update; today's bumped lock evals green.
+Remaining (not confirmable from a session): the first scheduled or
+dispatched run must land — watch that the runner picks up the cron and
+that the Actions token can push. Then delete this item. Item 20's KVM
+runner later upgrades the gate from eval-only to the VM suite.
 
 ### 20. KVM runner → VM suite in CI `[human]`
 The remaining stretch of the CI item — checks-on-push is live and

agent/JOURNAL.md

@@ -17,6 +17,27 @@ Template:
 
 ---
 
+## 2026-07-05 — scheduled lock-bump workflow (iteration #26, item 14 b+c)
+- **Task:** BACKLOG NEXT#14 `[big]` — split: (a) checks-on-push shipped
+  earlier; this ships (b) the weekly bump + (c) the fast-lane as
+  workflow_dispatch on the same job.
+- **Did:** .gitea/workflows/bump.yml — Mon 05:17 UTC cron + dispatch:
+  nix flake update (pinned branches by construction) → gate `nix flake
+  check --no-build` (py_compile/bash -n skipped: they don't read the
+  lock) → commit --only flake.lock with the update's change list as
+  body → push main (triggers check.yml as second net). Red gate/push
+  race = failed run, nothing lands. Container recipe from check.yml.
+- **Verified:** V0 (yq parse + bash -n each run block); logic simulated
+  end-to-end in a scratch clone with a REAL nix flake update + bare
+  remote: changed/unchanged branches, bystander file stays uncommitted,
+  push lands; today's bumped lock evals green (Monday's baseline).
+  Gitea 1.25.4 confirmed (schedule supported). The real cron pickup +
+  token push are NOT confirmable from here → item 14 slimmed to
+  "confirm first run".
+- **Pending:** watch the first scheduled/dispatched bump run.
+- **Next suggestion:** #16 greeter theming (next codeable item; #15
+  needs its design pass written first).
+
 ## 2026-07-05 — color picker (iteration #25, item 13 final slice → item done)
 - **Task:** BACKLOG NEXT#13 last slice — hyprpicker → clipboard from
   the menu + a direct bind. Item 13 complete; deleted from BACKLOG.

agent/MEMORY.md

@@ -13,6 +13,9 @@ iteration would otherwise rediscover.
   `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs lazy-trees, no JS
   actions past node20) — learned over the legacy repo's 57 runs; read
   them before touching the workflow.
+- The Gitea instance is **1.25.4** — `on: schedule` workflows are
+  supported; bump.yml assumes the Actions token can push to `main`
+  (standard Gitea behaviour, but unconfirmed until the first run lands).
 - The git server is **Gitea** (gitea/act_runner via docker-compose), NOT
   Forgejo — workflows are read from `.gitea/workflows/` (or `.github/`),
   never `.forgejo/workflows/` (a whole push cycle was lost to that).