docs(planning): correct Phase 0.1 row — pair 7d4765a with 675116a (the actual fix)

The Phase 0.1 row's ✅ marker referenced only commit 7d4765a (the action
v3→v4 bump), which was a forward-compat fix but did NOT make
validate-and-package.yml green. The workflow had been failing at the
"Set up Bash environment" step (sudo-less apt-get) for 30+ consecutive
runs since 2026-03-22 (commit 219355e).

Caught during Step 5 of the user's "1-5 in steps" sweep when verifying
CI green claims. Commit 675116a (2026-05-15) removes the broken bash
step entirely; this commit updates the row to cite both fixes and
explain the original marker's incompleteness.

The "Updated:" header is not bumped — Phase 0.1's status didn't change
(still ✅), only the explanatory text is now accurate.

Author: wildleo91

docs/PUBLIC_RELEASE_PLAN.md

@@ -64,7 +64,7 @@ CLAUDE.md split. Purely internal; no external dependencies.
 | # | Task | Acceptance | Est. |
 |---|------|------------|------|
 | 0.0 | **De-risk Phase 1 FIRST** — install `splunk-appinspect` locally (`pip install splunk-appinspect`), run against the current `.spl` with both `cloud` and `splunk-platform-standalone` profiles, record findings. Decides whether Phase 1 is "trivial" or "multi-week refactor" BEFORE committing the rest of Phase 0. If findings are catastrophic, escalate to user before continuing. | Findings summary written; Phase 1 effort-class estimated | 30-60 min |
-| 0.1 ✅ 2026-05-14 (commit 7d4765a) | Fix `validate-and-package.yml` — bump `actions/upload-artifact` v3→v4 (also `actions/checkout` v3→v4 same file; audited all 10 workflows in `.github/workflows/` — none of the other 9 still on v3) | Workflow green on next push | 15 min |
+| 0.1 ✅ 2026-05-15 (commits `7d4765a` + `675116a` — see correction note) | Fix `validate-and-package.yml`. **Commit `7d4765a` (2026-05-14)** bumped `actions/upload-artifact` v3→v4 and `actions/checkout` v3→v4 — necessary for forward-compat with the 2026 GitHub Actions deprecation, audited all 10 workflows in `.github/workflows/` confirming none of the other 9 still on v3. **But this fix was cosmetic** and did NOT unblock the workflow: the FIRST step in the YAML, "Set up Bash environment", had been running `apt-get install bash` without sudo since 2026-03-22 (commit `219355e`, when the workflow file was originally added), which fails on `ubuntu-latest` runners — so the workflow never reached the action-version-pinned steps. `gh run list --workflow=validate-and-package.yml` showed 0 success runs in 30+ historical attempts. **Commit `675116a` (2026-05-15)** removes the broken step entirely (bash is pre-installed on the runner image; the apt-get step was unnecessary as well as broken) and adds an inline comment documenting the 2-month-long failure pattern. The original ✅ marker on this row was therefore incorrect; corrected as part of the Step-5+ Phase 0.1 redo. | Workflow green on next push | 15 min |
 | 0.2 ⚠️ 2026-05-14 (PARTIAL — see note) | Fix `ci.yml` + `integration-tests.yml` pytest/Python mismatch (pytest 9.x requires Python ≥3.10; CI uses 3.9). **PARTIAL FIX:** bumped Python 3.9 → 3.11 in 4 places (ci.yml × 2, integration-tests.yml, release.yml) in commit `1fe4f92`; fixed 2 unmasked mock bugs in `tests/unit/test_limits.py` in commit `c5c08d1`. **Result on c5c08d1:** `ci.yml` GREEN (4/4 jobs); `integration-tests.yml` STILL FAILING — 23 fails + 220 errors. The integration-tests failures are NOT the Python mismatch alone; the round-7 install failure was masking a large body of pre-existing infrastructure debt: Splunk container 10-s curl-timeout under chaos load, KV-state pollution between tests, rate-limit state leaking across the suite, and one Python-version issue (pytest 9 dropped `pytest.skip(msg=dict)`). These need their own phase — see new Phase 0.2.1. | Both workflows green. Decision documented: cap pytest at ≤8.4.x OR upgrade workflow Python to 3.10+ | 30 min (Phase 0.2 estimate accurate for the mismatch fix itself; 0.2.1 scope much larger) |
 | 0.2.1 ✅ 2026-05-14 (first green at `26933aa`; `53876d4` final QA-clean) | Fix `integration-tests.yml` red — separate from 0.2's Python bump. Triage: (a) `pytest.skip(msg=dict)` → `pytest.skip(reason=str)` migrations (pytest 9 API), (b) chaos-test docker curl timeout 10s → ≥30s for GitHub-Actions runners, (c) container_state fixture KV/sentinel cleanup race (Ring 2 Day 7 work), (d) rate-limit state pollution between RBAC-matrix tests. **FIX:** commit `b7e3429` replaced bind-mount-busting `rm -rf $LOOKUPS_DIR` with `find $LOOKUPS_DIR -mindepth 1 -delete` in `tests/integration/conftest.py :: _restore_container_state` — eliminated all 220 teardown errors. Commit `ccb37fc` closed the remaining 4 categories of failures (audit-POST 401 swallow, baseline-set skip, RBAC permission-string variants, chaos timing tolerance). Commit `26933aa` (QA #11 HIGH) replaced timeout bump with state-poll in `test_chaos_fim_dual_store.py :: test_kv_missing_silent_rebuild_from_fs`. Commit `53876d4` (QA #12 MEDIUM) dropped redundant `import time as _time` style nit. **Result:** 7 consecutive `integration-tests.yml` green runs from `26933aa` through current HEAD `035a390` (last red: `ccb37fc`). Acceptance: 358 passed, 8 skipped, 0 errors, 0 failed. | `integration-tests.yml` green on 2 consecutive pushes | 4-8 hr |
 | 0.3 ⚠️ 2026-05-15 (PARTIAL — see note) | Fix `e2e-smoke.yml` Playwright `undefined` env var failure (Windows binary path appears on Linux runner). **PARTIAL FIX:** commit `e47ad78` replaces the hard-coded `process.env.LOCALAPPDATA + "/ms-playwright/chromium-1208/chrome-win64/chrome.exe"` constant in `tests/e2e/lib_helpers.cjs` and `tests/e2e/test_task8_modularization.mjs` with a platform-aware `resolveChromiumExecutable()` (honors `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` → Windows-with-`LOCALAPPDATA` path → `undefined` so playwright-core auto-resolves). Also pins `e2e-smoke.yml` / `e2e-full.yml` / `a11y-audit.yml` to `npx playwright@1.59.1 install ...` so the installed chromium revision matches `playwright-core@1.59.1`. **Result on e47ad78:** workflow run `25920807221` — Smoke 1 ✅ + Smoke 2 ✅ (chromium launch verified working on Linux runner), Smoke 3 ❌ failing at a *different* point: `LC01`/`LC02` rejected by the admin-settings gate ("Creating detection rules is not permitted. An admin must enable it in the Control Panel"), then `bPage.waitForSelector("table.wl-table tbody tr")` at line 155 times out because pending table is empty. This is test-seed pollution analogous to Phase 0.2.1's KV/rate-limit pollution — `setup_test_env.sh` provisions the wladmin1 user/role but doesn't seed `allow_admin_create_rule = true` / `allow_admin_create_csv = true` in Admin Settings. Belongs in a follow-up — see new Phase 0.3.1. | Workflow green | 1-2 hr (env-var fix accurate; test-seed work much larger) |