@@ -5,10 +5,12 @@ These rules apply to `.github/` changes in addition to the root instructions.
 - Treat workflow changes as product changes. Run `bun run check:policy`; run `actionlint` when available.
 - `scripts/pr/change-policy.ts` is the source of truth for path-to-check routing. Do not duplicate the routing graph in advisory automation.
 - Routing is path prefixes plus the import graph from `scripts/pr/module-graph.ts`. Prefixes decide areas and every blocking rule; the graph only widens which surface checks run. When the graph cannot be built the run selects every surface rather than silently falling back to prefixes.
-- `nightly-quality.yml` runs every deterministic lane unconditionally and re-proves the module graph. It exists because per-PR selection can only ever cover what a diff reaches; do not move its jobs into the required PR gate. It is `workflow_dispatch` only — when to spend ~90 minutes of CI is the maintainer's call, and `pr-quality-workflow.test.ts` fails if a `schedule:` is added back.
+- `nightly-quality.yml` runs every deterministic lane unconditionally and re-proves the module graph. It exists because per-PR selection can only ever cover what a diff reaches; do not move its jobs into the required PR gate. It runs daily at 19:00 UTC and on `workflow_dispatch`; the maintainer chose that cadence, `pr-quality-workflow.test.ts` pins it, and changing it is the maintainer's call. Every job that runs runtime suites must install ripgrep first (also pinned there): agent discovery lists files through it.
 - Keep `pr-quality-gate` as the stable required status. Selected jobs must succeed and unselected jobs must be explicitly skipped; never convert failures into success.
 - Required PR jobs must remain offline and must not receive provider credentials or depend on paid/live services.
 - A `pull_request_target` workflow may inspect PR metadata using trusted base code, but must never execute the PR head, install PR-controlled dependencies, or expose secrets to contributor code.
 - Keep Bun aligned with `package.json#packageManager` and use frozen lockfile installs in required jobs.
 - Do not weaken coverage, test routing, CODEOWNERS, or branch protections to make another change pass. Maintainer override labels require an explicit, documented decision.
+- A PR authored by an individual CODEOWNER needs no `allow-cli-core-change` label (maintainer decision, 2026-10). Both `scope-plan` and `pr-triage.yml` read CODEOWNERS from the base branch, never the PR head. The other override labels are unchanged.
+- Never retry a failed test into a pass. `check:server` re-runs each failed file once to label it `FLAKY` or `FAILED`, and still fails the gate either way; fix the race, or quarantine with a reason and owner only as a last resort.
 - Repository settings, rulesets, secrets, and required-check changes require explicit user authorization; editing workflow files alone does not grant it.
@@ -24,7 +24,7 @@
 
 ## Risk
 
-- [ ] This PR does not touch CLI core paths, or it has maintainer approval for `allow-cli-core-change`.
+- [ ] This PR does not touch CLI core paths, is authored by a CODEOWNER, or has maintainer approval for `allow-cli-core-change`.
 - [ ] Production code changes include matching tests, or have maintainer approval for `allow-missing-tests`.
 - [ ] Coverage baseline/threshold changes have maintainer approval for `allow-coverage-baseline-change`.
 - [ ] Any quarantine-policy change has maintainer approval; deterministic provider/chat contract tests were not quarantined.
 
@@ -42,6 +42,10 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
+      # Agent and skill discovery lists files through ripgrep; without it the
+      # runtime suites see every created agent as missing (HTTP 500).
+      - name: Install ripgrep
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
       - name: Install root dependencies
         run: bun install --frozen-lockfile
       - name: Install desktop dependencies
@@ -57,7 +61,7 @@ jobs:
         run: bun run check:policy
       - name: Deterministic agent flow
         run: bun run check:agent-flow
-      - name: Agent loop against a mock LLM
+      - name: Agent loop against a mock LLM and recorded traffic
         run: bun run check:agent-e2e
       - name: Root runtime tests
         run: bun run check:server
 
@@ -58,10 +58,17 @@ jobs:
           REPOSITORY: ${{ github.repository }}
           PUSH_BEFORE: ${{ github.event.before }}
           PUSH_AFTER: ${{ github.sha }}
+          BASE_REF: ${{ github.base_ref }}
         run: |
+          : > author.txt
+          : > codeowners.txt
           if [ "$EVENT_NAME" = "pull_request" ]; then
             gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename' > changed-files.txt
             jq -r '.pull_request.labels[].name' "$GITHUB_EVENT_PATH" > labels.txt
+            # A CODEOWNER's own PR needs no maintainer-approval label. Owners come
+            # from the base branch, so a PR cannot add its author to the list.
+            jq -r '.pull_request.user.login' "$GITHUB_EVENT_PATH" > author.txt
+            git show "origin/${BASE_REF}:.github/CODEOWNERS" > codeowners.txt 2>/dev/null || : > codeowners.txt
           else
             # A push to main: scope the run to what the push brought in. A new branch
             # or a force push has no usable "before", so fall back to the last commit.
@@ -75,7 +82,7 @@ jobs:
 
       - name: Build deterministic scope plan
         id: policy
-        run: bun run scripts/pr/change-policy.ts --files changed-files.txt --labels-file labels.txt --plan-only
+        run: bun run scripts/pr/change-policy.ts --files changed-files.txt --labels-file labels.txt --author-file author.txt --codeowners-file codeowners.txt --plan-only
 
   policy-enforcement:
     name: policy-enforcement
@@ -247,7 +254,7 @@ jobs:
           bun-version-file: package.json
       - name: Install root dependencies
         run: bun install --frozen-lockfile
-      - name: Run the agent loop against a mock LLM
+      - name: Run the agent loop against a mock LLM and recorded traffic
         run: bun run check:agent-e2e
       - name: Upload agent e2e artifacts
         if: always()
 
@@ -88,7 +88,25 @@ jobs:
               }
             }
 
-            if (cliCoreFiles.length > 0 && !currentLabels.has('allow-cli-core-change')) {
+            // A CODEOWNER's own PR is already maintainer-approved; owners come from the
+            // base branch so the PR cannot add its author. Mirrors scripts/pr/change-policy.ts.
+            let codeOwners = new Set()
+            try {
+              const { data } = await github.rest.repos.getContent({ owner, repo, path: '.github/CODEOWNERS', ref: context.payload.pull_request.base.ref })
+              const text = Buffer.from(data.content || '', 'base64').toString('utf8')
+              codeOwners = new Set(text.split(/\r?\n/)
+                .map((line) => line.replace(/#.*$/, '').trim())
+                .filter(Boolean)
+                .flatMap((line) => line.split(/\s+/).slice(1))
+                .filter((token) => /^@[A-Za-z0-9-]+$/.test(token))
+                .map((token) => token.slice(1).toLowerCase()))
+            } catch (error) {
+              core.warning(`Could not read base CODEOWNERS: ${error.message}`)
+            }
+            const authorIsCodeOwner = codeOwners.has(String(context.payload.pull_request.user?.login || '').toLowerCase())
+            const cliCoreApproved = currentLabels.has('allow-cli-core-change') || authorIsCodeOwner
+
+            if (cliCoreFiles.length > 0 && !cliCoreApproved) {
               areas.add('needs-maintainer-approval')
             }
 
@@ -221,9 +239,11 @@ jobs:
 
             const marker = '<!-- pr-quality-triage -->'
             const areaText = [...areas].filter((label) => label.startsWith('area:')).sort().join(', ') || 'none'
-            const approvalText = cliCoreFiles.length > 0 && !currentLabels.has('allow-cli-core-change')
+            const approvalText = cliCoreFiles.length > 0 && !cliCoreApproved
               ? 'Blocked by policy until a maintainer applies `allow-cli-core-change` and approves the PR.'
-              : 'No CLI-core policy block detected.'
+              : cliCoreFiles.length > 0 && authorIsCodeOwner && !currentLabels.has('allow-cli-core-change')
+                ? 'CLI-core change authored by a CODEOWNER; no override label needed.'
+                : 'No CLI-core policy block detected.'
             const missingTestText = missingTestSignals.length > 0 && !currentLabels.has('allow-missing-tests')
               ? 'Blocked by policy until a maintainer applies `allow-missing-tests` or matching tests are added.'
               : 'No missing-test policy block detected.'
 
@@ -40,7 +40,6 @@ const NON_PROSE_ELEMENTS = new Set(['kbd', 'Keycap', 'code', 'pre', 'style', 'sc
  */
 const LANGUAGE_NEUTRAL: Record<string, string[]> = {
   'components/agentTeams/AgentTeamsCanvas.tsx': ['zZ'], // a sleeping agent's glyph
-  'components/agentTeams/AgentTeamsWorkbench.tsx': ['Agent Teams ·'], // product name, kept in every locale
   'components/chat/MermaidRenderer.tsx': ['mermaid'], // the diagram language, as a code block labels it
   'components/chat/ToolCallBlock.tsx': ['bash', 'powershell'], // shell names, as a code block labels them
   'components/layout/H5ConnectionView.tsx': ['https://chat.example.com'], // example URL
 
@@ -7,7 +7,8 @@ vi.mock('../../lib/desktopRuntime', () => ({
   getServerBaseUrl: () => 'http://127.0.0.1:4321',
 }))
 
-const openPreviewLink = vi.hoisted(() => vi.fn())
+// The router reports whether it could place the link; a card the router places opens.
+const openPreviewLink = vi.hoisted(() => vi.fn(() => true))
 vi.mock('../../lib/openPreviewLink', () => ({ openPreviewLink }))
 vi.mock('../../i18n', () => ({ useTranslation: () => (key: string) => key }))
 
 
@@ -95,9 +95,10 @@ describe('RawRequestTab', () => {
     render(<RawRequestTab sessionId="s1" row={ROW} />)
 
     expect(await screen.findByText(/Closest captured call by time/)).toBeInTheDocument()
+    // The detail fetches the call in its own effect, so only its rendered body proves the request was made.
+    expect(await screen.findByText('Response from the model')).toBeInTheDocument()
     // The record locator reaches calls beyond the capture's indexed window.
     expect(getTraceCall).toHaveBeenCalledWith('s1', 'match', '9000-12000')
-    expect(await screen.findByText('Response from the model')).toBeInTheDocument()
     // Where the call went and with which model sit at the top.
     expect(screen.getByTestId('trajectory-request-endpoint')).toHaveTextContent(/POST\s*https:\/\/api\/v1\/messages/)
     expect(screen.getByTestId('trajectory-request-model')).toHaveTextContent('claude-x')
 
@@ -40,7 +40,7 @@ describe('General settings ordinary SubAgent concurrency', () => {
     expect(input).toHaveAttribute('inputmode', 'numeric')
     expect(input).toHaveAttribute('placeholder', '不限（默认）')
     expect(screen.getByText(/限制同一会话的普通前台和后台 SubAgent/)).toHaveTextContent('达到上限时拒绝新启动，等已有任务完成后再启动')
-    expect(screen.getByText(/主 Agent、Agent Teams、Workflow 不计入/)).toHaveTextContent('运行中的会话也会生效，无需重启')
+    expect(screen.getByText(/主 Agent、智能体团队、Workflow 不计入/)).toHaveTextContent('运行中的会话也会生效，无需重启')
 
     fireEvent.change(input, { target: { value: '37' } })
     expect(settingsApi.updateUser).not.toHaveBeenCalled()