[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

Why: Disabled IL2CPP checks could pass the source safety gate.

What:

• Require literal true when an IL2CPP option supplies a value.
• Check attribute aliases, numeric options, and named false values.
• Test literal and expression controls during every scan.

Refs #637

---

Note

Medium Risk
Changes CI safety-gate logic for IL2CPP options; mis-tuning could false-positive legitimate code or miss evasions, but scope is lint-only with expanded tests.

Overview
Tightens lint:unsafe-code so disabled IL2CPP runtime checks cannot slip past with disguised “enabled” values.

Il2CppSetOption handling now treats a value as safe only when it is omitted or the exact literal true (not !true, true != true, default(bool), or a const named like an option or True). The linter follows using aliases (including shortened Attribute names and @value / @option labels) when locating attribute sites, and flags numeric or unknown options paired with non-literal disabling expressions.

Gate honesty: each repository scan must hit two positive controls—a literal false and an expression disable (!true)—before a clean result is trusted. Contributing docs describe the stricter rule; contract tests cover the new red/green spellings.

^{Reviewed by Cursor Bugbot for commit 27743ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d4e7a66. Configure here.}

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

The original head 57d7128d passed all 28 checks (22 successful, six expected skips). All six acquired Unity jobs confirmed healthy license/lock cleanup; the fresh Unity 2022 native discovery report remains tracked in #343.

Per the user's session closeout instruction, this PR is now above #1020 in GitHub's native stack #1021. Its two commits were rebased without patch changes to 3675f6d67141504e903e0b9f3ecb06e515f66861; the combined tree exactly matches the independently computed union. No new implementation was added. Fresh CI and review on the stacked head must pass before merging. The already-dispatched diagnostic remains pinned to #1020's unchanged 91f2aca7 and will be checked through exact restoration and cleanup.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

The first stacked-head Unity attempt was cancelled before any Windows job started. Check annotations state: Canceling since a higher priority waiting request for unity-tests-1022 exists. The older base-retarget run 39006184891 (head 57d7128d) entered later and is now terminal; its supersession guard skipped licensed work. This is a classified Actions concurrency collision, not a failed test or missing cleanup.

With that older run terminal, I requested a retry of the failed/cancelled jobs in current-head run 39006197605. Hosted source checks and review continue on 3675f6d6. No code changed, no rule was bypassed, and the one-time diagnostic was not dispatched again.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

#1020 now includes the narrow denied-access recovery fix 7508f55a, prompted by the one-time diagnostic's CI feedback. This upper PR is restacked at 27743eeb1939fab3bec9142279ee0e4bb4662178. Both original commits remain patch-identical, and its combined tree matches the independently computed union (8c2fe44ff612428412a29ea7157a03f3adfe8d78). Native stack #1021 remains #1020 → #1022.

The previous stacked-head run 39006197605 is superseded by fresh run 39007870117; #1020 has fresh run 39007855641. Both current heads must pass CI and review before merge. The diagnostic is not being repeated: its original receipt proves the writable registry open failed before any flag write or phase, as recorded in #1020.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

The remaining first-attempt jobs were cancelled by Stuck Job Watchdog run 39014936214. Its log classified this progressing matrix as dispatcher-stuck at 07:47:27 and cancelled it as package export was being assigned. Three queued jobs never started; export was interrupted but confirmed healthy license cleanup and lock release. The regular Unity 6000.6 and Unity 2021 jobs had already passed. Their full logs were inspected; Unity 2021 retains one UNKNOWN discovery report, with healthy cleanup, for #343.

On unchanged head 27743eeb, GitHub accepted a retry of the four cancelled jobs and their dependent gates. The two successful version results are preserved with their original timestamps. No source, permission, or required-check policy changed, and the one-time shared-flag diagnostic is not being repeated. The watchdog scheduling race is recorded separately for later work.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

The watchdog race follow-up is #1023. It preserves the cancellation and licensed-cleanup evidence and requires protection for progressed Unity runs; implementation is deferred per the session wrap-up instruction.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

The replacement single-threaded and package-export jobs pass with confirmed healthy cleanup. Unity 6000.5 failed on the same pre-existing allocator-warning guard defect tracked in #393, now in SceneHelperLifetimeTests.LoadedSceneRetrievalBorrowsActiveAndNonactiveScenes(False,7) teardown (age=14). The failed XML/log artifact and checksum are preserved there. No C# or analyzer inputs changed; no warning was filtered and no test was skipped. Cleanup is confirmed healthy and the full log has no native crash headers.

The final Unity 2022 job is running. After the containing workflow becomes terminal, I will retry only the failed normal 6000.5 job on unchanged head 27743eeb. The allocator-warning investigation stays open even if that retry passes. This PR remains unmerged until current-head checks pass.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

Unity 2022 passed and confirmed healthy cleanup. Its UNKNOWN discovery report is preserved in #343. The workflow is now terminal with five successful Windows jobs and only the documented Unity 6000.5 allocator-warning failure. All acquired jobs have confirmed healthy cleanup, including the earlier watchdog-cancelled export.

After verifying the workflow was completed and head remained 27743eeb, GitHub accepted a retry of only job 117345529671. This is the first accepted single-job retry for this 6000.5 warning failure; the earlier retry recovered four watchdog-cancelled jobs. The five successful results will be retained. #393 and #1023 remain open; no source, test selection, warning policy, or runner permission changed.

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

Merged through GitHub native stack #1021 as e16099437044f8d534914b85391610e1d26b1028, atomically with #1020, after all 28 checks passed on 27743eeb and final review/feedback was clear. No rule was bypassed. Fetched main's tree equals the tested upper tree 8c2fe44ff612428412a29ea7157a03f3adfe8d78; worktrees are clean.

The final 6000.5 retry's fresh artifact 12095573638 matches SHA-256 ec83814fb66b56d7285ebb4faa076873f343bc34d5efd8d2433a74763774f110. XML explicitly passes the previously failed scene-lifetime case; counts are 16,547 passed, zero failed, 1,732 skipped and 23 inconclusive. Original failure evidence stays retained in #393. All acquired jobs confirm healthy cleanup, including the earlier cancelled export. The warning defect (#393), watchdog race (#1023), retained native reports (#343), and full #637 acceptance remain open.