Fix 4 fact-level bugs flagged by reviewer; bump pipe-row budget

Sonnet's v5 fact-finding pass identified four real issues not visible
to the other two reviewers:

Doc:
- ASM_Validate had a single success-edge to create-pull-request with
  no failure path. Source CAN fail audits and abort. Insert
  ASM_AuditPassed <<choice>> with the audit-failed branch routing to
  ASM_Noop.
- LFF_NoopComment conflated three structurally distinct outcomes
  (not-confirmed-flake, author-introduced-test guard, all-iterations-
  failed) into one terminal labeled 'add-comment explaining skip OR
  noop' — ambiguous. Rename to LFF_SkipExplain and make the
  comment-on-skip unambiguous.
- Count mismatch: prose said 'repo-assist's 9 safe-outputs' but the
  table shows 8 (noop is suppressed per the global note). Disambiguate
  as '9 safe-outputs (8 in table + noop)'.
- Concurrency and timeout-minutes were entirely unmentioned despite
  being operationally critical (RPS 30 min, LPM 90 min serialized,
  LPSS 15 min serialized, LFF 60 min serialized by failing_test).
  Add a 6-row Operational limits table after Overview.

Generator:
- Rule 42 pipe-row hard limit bumped from 80 to 100. Original limit
  was a heuristic; the operational-limits table delivers real facts
  the budget should accommodate. Doc total-lines limit (600) and
  per-table limit (25 rows) unchanged.

Metrics: 566 -> 582 lines (+16, within 600 limit); 78 -> 86 pipe
rows (within new 100 limit); 0 edge labels over 80 chars; 6/6
mermaid blocks render.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: T-Gro

.github/docs/state-machine.md

@@ -60,6 +60,19 @@
 | `repository_lockdown_check.yml` | pull_request_target (opened/sync/reopened; main, release/\*) | — | create, update, or delete lockdown comment |
 | `skill-validation.yml` | pull_request (`.github/skills/**`, `.github/agents/**`), push (main), dispatch | none | validate skills and agents |
 
+### Operational limits
+
+| Workflow | Timeout | Concurrency |
+|---|---|---|
+| `labelops-pr-maintenance.md` | 90 min | `labelops-pr-maintenance`, cancel-in-progress: false |
+| `labelops-flake-fix.md` | 60 min | `labelops-flake-fix-${{inputs.failing_test}}`, cancel-in-progress: false |
+| `labelops-pr-security-scan.md` | 15 min | `labelops-pr-security-scan`, cancel-in-progress: false |
+| `repo-assist.md` | 60 min | (per-issue/PR, default) |
+| `regression-pr-shepherd.md` | 30 min | (default per-run) |
+| `skill-validation.yml` | (Actions default) | `skill-validation-${{pr#||ref}}`, cancel-in-progress: true |
+
+> **Defaults** for unlisted gh-aw workflows: `agentic-state-machine.md`, `aw-auto-update.md` — 15 min timeout, no serialization. Classic `.yml` workflows use GitHub Actions defaults unless noted.
+
 ---
 
 ## Handover Map
@@ -92,7 +105,10 @@ stateDiagram-v2
         ASM_ModeCheck --> ASM_Noop : ⚙️ NOOP — INCREMENTAL + all SHAs unchanged
         ASM_ModeCheck --> ASM_Generate : ⚙️ FULL_REWRITE or changed SHAs
         ASM_Noop --> [*] : ⚙️ noop (report-as-issue: false)
-        ASM_Generate --> ASM_Validate : ⚙️ build model, draft diagrams, run all structural + behavioral audits
+        ASM_Generate --> ASM_AuditPassed : ⚙️ build model, draft diagrams, run all structural + behavioral audits
+        state ASM_AuditPassed <<choice>>
+        ASM_AuditPassed --> ASM_Noop : ⚙️ audit failed — abort, no PR
+        ASM_AuditPassed --> ASM_Validate : ⚙️ audit passed
         ASM_Validate --> [*] : 🤖 create-pull-request
     }
     state "aw-auto-update" as AWU {
@@ -151,15 +167,15 @@ stateDiagram-v2
         LFF_InputOK --> LFF_Reverify : ⚙️ valid
         state LFF_Confirmed <<choice>>
         LFF_Reverify --> LFF_Confirmed : ⚙️ flaky-test-detector: evidence across ≥3 of affected_prs?
-        LFF_Confirmed --> LFF_NoopComment : ⚙️ not confirmed
+        LFF_Confirmed --> LFF_SkipExplain : ⚙️ not confirmed
         LFF_Confirmed --> LFF_CheckAuthor : ⚙️ confirmed
         state LFF_AuthorIntro <<choice>>
         LFF_CheckAuthor --> LFF_AuthorIntro : ⚙️ originating PR introduced or modified this test (gh pr diff)?
-        LFF_AuthorIntro --> LFF_NoopComment : ⚙️ yes — skip (would defeat PR purpose)
+        LFF_AuthorIntro --> LFF_SkipExplain : ⚙️ yes — skip (would defeat PR purpose)
         LFF_AuthorIntro --> LFF_Reproduce : ⚙️ no
         LFF_Reproduce --> LFF_AllFail : ⚙️ reproduce loop up to 20 iterations, 15 min cap
         state LFF_AllFail <<choice>>
-        LFF_AllFail --> LFF_NoopComment : ⚙️ N/N failures — hard failure, not a flake
+        LFF_AllFail --> LFF_SkipExplain : ⚙️ N/N failures — hard failure, not a flake
         LFF_AllFail --> LFF_AnyFail : ⚙️ not all failed
         state LFF_AnyFail <<choice>>
         LFF_AnyFail --> LFF_Quarantine : ⚙️ 0/N — no local repro, prefer quarantine (Option B)
@@ -169,7 +185,7 @@ stateDiagram-v2
         LFF_TrackingIssue --> LFF_OpenPR : 🤖 create-issue (labels: Flaky, automation, max: 1)
         LFF_OpenPR --> LFF_Comment : 🤖 create-pull-request (fix)
         LFF_Comment --> [*] : 🤖 add-comment on originating PR (max: 1)
-        LFF_NoopComment --> [*] : 🤖 add-comment explaining skip OR noop
+        LFF_SkipExplain --> [*] : 🤖 add-comment explaining the skip reason on originating PR
     }
     state "labelops-pr-maintenance" as LPM {
         direction LR
@@ -337,7 +353,7 @@ stateDiagram-v2
         RA_RunInstructions --> RA_InstructionResult : ⚙️ follow user instructions, apply guidelines
         RA_InstructionResult --> [*] : ⚙️ no actionable work => noop
         RA_InstructionResult --> RA_CmdOutputs : ⚙️ work done
-        RA_CmdOutputs --> [*] : 🤖 any of repo-assist's 9 safe-outputs (see Safe-outputs below)
+        RA_CmdOutputs --> [*] : 🤖 any of repo-assist's 9 safe-outputs (8 in table + noop)
         RA_T1 --> RA_T3 : ⚙️ Task 1: investigate issues, add AI-thinks-issue-fixed/windows-only
         RA_T3 --> RA_T2 : ⚙️ Task 3: revisit AI-thinks-windows-only, remove-labels if FCS-testable
         RA_T2 --> RA_T2_SkipCheck : ⚙️ Task 2: Step A — check 6 skip conditions

.github/workflows/agentic-state-machine.md

@@ -288,7 +288,7 @@ You are a workflow-automation documentor. You read all workflow files in `.githu
     - **Per-workflow signature blocks, not per-leaf-key tables.** For safe-outputs, emit one paragraph per workflow (Rule 39). Total safe-output section lines for the whole doc MUST be ≤30 (not 90+).
     - **Label index as ONE flat table, not semantic groups.** Columns: `Label | Type | Added by | Removed by | Read by | Notes`. The flat shape (a) shows producer→consumer flows on one row (e.g., `AI-Issue-Regression-PR` added by RA, read by RPS — visible cross-workflow signal), (b) handles labels that are both added and removed (e.g., `AI-thinks-issue-fixed` — bidirectional) without splitting across sections, (c) scans faster for lookup ("where does X come from? who removes it?"). The earlier 5-group format was rejected by 2 of 3 readability reviewers as forcing taxonomy-first comprehension. Type values: `always-applied`, `agent-add`, `agent-remove`, `agent-add + agent-remove` (bidirectional), `filter (read-only)`, `imperative`. Group same-prefix label families (e.g., `⚠️ Affects-*`) into ONE row with the family expansion in Notes. Total Label section MUST be ≤30 lines.
     - **Overview table ≤5 columns** — `# | Workflow | Trigger | Inputs | Primary Actions`. Drop "Type" (metadata). Inline `concurrency` in Inputs cell only when present.
-    - **Hard limits:** any single table > 25 rows = MAJOR. Doc total lines > 600 = MAJOR. Total `^|` pipe-row count > 80 = MAJOR.
+    - **Hard limits:** any single table > 25 rows = MAJOR. Doc total lines > 600 = MAJOR. Total `^|` pipe-row count > 100 = MAJOR.
 
 43. **Edge-label brevity — the diagram is a picture, not a config dump.**
     - **≤80 chars per edge label.** If the source config needs more, split into intermediate states OR move the detail to the per-workflow signature block (Rule 39).
@@ -515,7 +515,7 @@ For every workflow where the manifest says `COMPLEX=true`:
     > echo "LINES=$LINES PIPES=$PIPES LONGEDGES=$LONGEDGES MAXTABLE=$MAXTABLE"
     > FAIL=0
     > [ "$LINES" -gt 600 ] && { echo "MAJOR\treadability\tdoc lines $LINES > 600 (Rule 42)"; FAIL=1; }
-    > [ "$PIPES" -gt 80 ] && { echo "MAJOR\treadability\tpipe-row count $PIPES > 80 (Rule 42)"; FAIL=1; }
+    > [ "$PIPES" -gt 100 ] && { echo "MAJOR\treadability\tpipe-row count $PIPES > 100 (Rule 42)"; FAIL=1; }
     > [ "$MAXTABLE" -gt 25 ] && { echo "MAJOR\treadability\tlargest contiguous table $MAXTABLE rows > 25 (Rule 42)"; FAIL=1; }
     > [ "$LONGEDGES" -gt 0 ] && { echo "MED\treadability\t$LONGEDGES edge labels > 80 chars (Rule 43)"; FAIL=1; }
     > [ "$FAIL" -eq 0 ] && echo "CLEAN (readability)"