merge research-structuralization (ROBOT_TOKEN in auto-version + canary contract update)

.gitea/workflows/auto-version.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Auto-bump if the PR did not carry a version bump
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
           RELEASE_SERVER_URL: ${{ gitea.server_url }}
           RELEASE_REPO: ${{ gitea.repository }}
           PR_TITLE: ${{ gitea.event.pull_request.title }}
@@ -126,20 +126,31 @@ jobs:
           drifts = []
           for rel, pat in checks:
               if rel not in edited:
-                  # unchanged surface: must ALREADY carry NEW
+                  # unchanged surface: must ALREADY carry NEW — if it carries a
+                  # DIFFERENT version (base drift, e.g. pyproject at 0.49.0 while
+                  # master is 0.54.1), RECOVER by force-editing to NEW. The gate
+                  # stays: nothing commits unless every surface carries NEW.
                   status, cur = api(f"/contents/{rel}?ref=master")
-                  text = base64.b64decode(cur.get("content", "")).decode("utf-8", "replace") if status == 200 else ""
+                  if status != 200:
+                      drifts.append(f"{rel}: unreadable ({status})")
+                      continue
+                  text = base64.b64decode(cur.get("content", "")).decode("utf-8", "replace")
                   hits = re.findall(pat, text)
                   if NEW not in hits:
-                      drifts.append(f"{rel}: unchanged but does not carry {NEW} (found {sorted(set(hits))})")
+                      fixed = re.sub(pat, lambda m: m.group(0).replace(m.group(1), NEW), text, count=1)
+                      if fixed != text:
+                          edited[rel] = (fixed, cur["sha"])
+                          print(f"  RECOVERED {rel}: base drift {sorted(set(hits))} -> {NEW}")
+                      else:
+                          drifts.append(f"{rel}: pattern present but unfixable (found {sorted(set(hits))})")
               else:
                   hits = re.findall(pat, edited[rel][0])
                   if NEW not in hits:
                       drifts.append(f"{rel}: edited content does not carry {NEW}")
           if drifts:
-              print("VERSION-SURFACE DRIFT — bump aborted, nothing committed:", file=sys.stderr)
+              print("VERSION-SURFACE DRIFT — bump aborted, nothing committed:")
               for d in drifts:
-                  print(f"  - {d}", file=sys.stderr)
+                  print(f"  - {d}")
               sys.exit(1)
 
           # Commit each surface DIRECTLY to master (bookkeeping, not reviewable code)
@@ -162,7 +173,7 @@ jobs:
           PYBUMP
       - name: Create release from merged pull request
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
           PR_TITLE: ${{ gitea.event.pull_request.title }}
           PR_BODY: ${{ gitea.event.pull_request.body }}
           RELEASE_API_URL: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases