Unable to resolve action hyperpolymath/k9-validate-action,\n repository not found\n```\n\n`gh api` returns **404** for both `hyperpolymath/k9-validate-action` and\n`hyperpolymath/a2ml-validate-action`. Neither has ever existed, so\n**neither job has ever validated anything** — both failed at *Set up\njob*, pinned to a SHA in a repository that isn't there.\n\nThe canonical implementations are RSR template files. Installed from\n`rsr-template-repo` `origin/main` (byte-identical to the copies\nlithoglyph already carries) and wired in directly — they take the same\n`INPUT_PATH`/`INPUT_STRICT` interface the actions were passed.\n\n| validator | result |\n|---|---|\n| A2ML | 0 errors, 3 warnings → **pass** |\n| K9 | 1 error → **a real finding**, see below |\n\n## 2. The K9 error was a validator limitation, not a bad file\n\n```\nverisimdb/connectors/test-infra/deploy.k9.ncl:1\nPedigree block missing 'name' field\n```\n\nThe file is **correct**. It builds the pedigree separately and attaches\nit:\n\n```nickel\nlet component_pedigree = {\n metadata = { name = \"verisimdb-test-infra\", version = \"0.1.0\", ... },\n} in\n{ pedigree = component_pedigree, ... }\n```\n\nThe validator is line-oriented: it starts brace-counting at `pedigree =\n...`, but `pedigree = component_pedigree,` carries **no brace**, so\ndepth never rises, the block reads as empty and `name` is invisible.\n\nRewriting the file to satisfy a grep would have been the wrong direction\n— and especially here: this is a **Hunt-level** component that spawns\nseven database containers and binds eleven ports. It's the last file to\nrestructure casually.\n\nSo the validator now resolves a **one-hop** `let` indirection. Proved it\nfixes the scanner rather than blinding it:\n\n| | |\n|---|---|\n| name present | 0 errors, exit 0 |\n| name removed | `Pedigree block missing 'name' field`, **exit 1** |\n\nOne hop only — chasing aliases needs a real evaluator, and `nickel\ntypecheck` is unavailable because the mandatory `K9!` magic line isn't\nvalid Nickel. **Belongs upstream in `rsr-template-repo`**; the same fix\nis applied to lithoglyph's copy in its PR #9 so the two stay identical\n(`02845a4c`).\n\n## 3. `boj-build.yml` used `secrets` in a job-level `if:` —\nstartup_failure\n\nEvery push produced a **0-second failed run named after the file path**\nrather than the workflow's `name:`, with no jobs and no check run.\n\n```yaml\nif: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}\n```\n\n**`secrets` is not available in a job-level conditional** — GitHub\nexposes that context only in `env:`, `with:` and step-level expressions.\nThe file is valid YAML (`yaml.safe_load` parses it happily), so nothing\nlocal caught it and the workflow linter didn't either. Actions rejected\nthe whole file at load time.\n\nPre-existing on `main`, not introduced by #58.\n\nThe guard was redundant as well as fatal — the step already does `if [\n-z \"$BOJ_URL\" ]; then … exit 0`, and resolves the secret in `env:` where\nthat context is legal. The workflow's own header calls it \"a no-op if\nBOJ_SERVER_URL is not set\"; now it actually is one.\n\n## 4. `verisimdb/playground/package.json` removed\n\n`deno.json` sits beside it carrying every task and dependency, with\n`node build.mjs` correctly rewritten to `deno run -A build.mjs`. Nothing\nreferences the `package.json`. npm manifests are banned estate-wide.\n\n## Verification\n\n| Check | Result |\n|---|---|\n| `validate-a2ml.sh` | **PASS** (was: job never ran) |\n| `validate-k9.sh` | **PASS** (was: job never ran) |\n| K9 still fails on a real fault | **exit 1** ✅ |\n| `boj-build.yml` parses + no `secrets` in job `if:` | **PASS** |\n| Actions resolving | **all** |\n| `package.json` / `.ts` / `.tsx` | **0 / 0 / 0** |\n\n## Still red, and honestly so\n\n**`Language / package anti-pattern policy`** — 44 `.res` files remain:\n`verisimdb/` (40) and `typeql-experimental/` (4). Both are legacy\ndirectories awaiting the same extraction `lithoglyph/` just completed,\nand porting their ReScript is the AffineScript m