chore(ci)(deps): bump actions/checkout from 4 to 6

.github/workflows/agent-runner-docker.yml

@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3

.github/workflows/auto-merge-ready-prs.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Find ready PRs
         id: find-ready

.github/workflows/brain-seal-refresh.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run experience aggregation
         run: |

.github/workflows/build-paper.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install LaTeX dependencies
         run: |

.github/workflows/build-vivado-image.yml

@@ -39,7 +39,7 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Vivado installer from release asset
         env:

.github/workflows/check-now-freshness.yml

@@ -8,7 +8,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check freshness
         run: |

.github/workflows/coq-kernel.yml

@@ -15,8 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Flocq (opam)
         run: |

.github/workflows/coq-proofs.yml

@@ -15,9 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Coq Interval
         run: |

.github/workflows/deploy-api.yml

@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -34,7 +34,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3

.github/workflows/fpga-build.yml

@@ -25,7 +25,7 @@ jobs:
   fpga-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -80,7 +80,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -141,7 +141,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -250,7 +250,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -295,7 +295,7 @@ jobs:
     needs: fpga-synthesis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -411,7 +411,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -480,7 +480,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable

.github/workflows/l1-traceability.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Checkout repository
         if: env.IS_BOT != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/notebook-gate.yml

@@ -21,7 +21,7 @@ jobs:
     name: 🔒 NotebookLM notebook required
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check for .notebook_id
         id: check

.github/workflows/notebook-sync.yml

@@ -46,7 +46,7 @@ jobs:
       event_type: ${{ steps.event_type.outputs.type }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract issue info
         id: issue
@@ -120,7 +120,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -238,7 +238,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check if activity.md changed
         id: check
@@ -270,7 +270,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/now-sync-gate.yml

@@ -21,7 +21,7 @@ jobs:
         run: |
           echo "Trusted bot PR -- gate passes as no-op. Closes 1031."
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: env.IS_BOT != 'true'
         with:
           fetch-depth: 0

.github/workflows/phi-loop-ci.yml

@@ -8,7 +8,7 @@ jobs:
   phi-loop-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: PHI Loop identity check
         run: |

.github/workflows/pr-dashboard.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get PR status
         id: pr-status

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -84,7 +84,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: actions-rs/toolchain@v1
@@ -157,7 +157,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable

.github/workflows/rings-rust.yml

@@ -41,7 +41,7 @@ jobs:
       count: ${{ steps.gen.outputs.count }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Generate matrix
         id: gen
         run: |
@@ -59,13 +59,14 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: rust:1.83-bookworm
+      options: --user root
     continue-on-error: true
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Show toolchain
         run: |

.github/workflows/sandbox-docker.yml

@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3

.github/workflows/schema-validation.yml

@@ -8,7 +8,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Validate schemas
         run: |

.github/workflows/seal-coverage.yml

@@ -10,7 +10,7 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Run coverage
         run: |

.github/workflows/secret-scan.yml

@@ -16,7 +16,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Block Solana keypair files anywhere in the tree
         run: |

.github/workflows/vivado-synth.yml

@@ -64,7 +64,7 @@ jobs:
           remove-haskell: 'true'
           remove-codeql: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
 

.github/workflows/zenodo-publish.yml

@@ -8,7 +8,7 @@ jobs:
   zenodo:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Upload to Zenodo
         uses: megasanjay/upload-to-zenodo@v2.0.1

docs/NOW.md

@@ -2,6 +2,13 @@
 
 Last updated: 2026-06-14
 
+## ci-checkout6-container-root -- fix checkout@v6 EACCES inside container jobs (Closes #1031)
+
+- **WHERE** (CI only): `.github/workflows/coq-kernel.yml`, `.github/workflows/coq-proofs.yml`, `.github/workflows/rings-rust.yml`. Added `options: --user root` to each `container:` block. `actions/checkout@v6` runs on Node 24; inside container jobs the runner-injected `_temp/_runner_file_commands/save_state_*` files are root-owned but the action ran as a non-root container user, so the Post-checkout `save_state` failed with `EACCES: permission denied`, failing the job. Running the container as root lets the action write those state files. `vivado-synth.yml` already had `options: --user 0`; `build-vivado-image.yml` has no real container job. No source/specs/codegen/conformance/`gen/` touched.
+- **Why**: completes the actions/checkout 4->6 bump (#1044). Required gates unaffected; container build/proof jobs (coq, rings-rust) no longer fail on the EACCES Post step. Human PRs remain fully gated. L6/L5 untouched; L4 not applicable (workflow YAML). Closes #1031.
+- **Anchor**: phi^2 + phi^-2 = 3
+
+
 ## conformance: catalog-count CI gate + WP-18 corpus-integrity gate + P3109 4-param cross-walk (this PR)
 
 - **WHAT**: the count-drift follow-up to #1064. The #1064 parser fix landed; this PR adds the CI guards that keep the catalog count and the conformance corpus honest going forward, plus the P3109 re-anchor docs. Per the repo constitution (L2 GENERATION), gen/ is DERIVED and is NOT hand-committed here; the count-gate regenerates fresh against the SSOT instead of diffing committed gen/.