docs(backlog): add CI speed findings from math#174-177

docs/superpowers/README.md

@@ -106,7 +106,7 @@ Priority: **P1** a gate reported as blocking does not block; **P2** silently wro
 | P2 | `binary` zip extract leaves a truncated file on failure | `lib/src/atoms/binary/extract.rs:123-125` creates the destination before copying, so a checksum failure mid-copy leaves a partial binary; `plan()` then sees it exists and never retries. Same under zip 2 and zip 9 (bug-scan, 2026-10-17). Write to a temp file in the same directory and rename on success. |
 | P2 | Renovate has never run in this repo | Zero Renovate PRs and no Dependency Dashboard issue, all time (re-checked 2026-10-25). The original cause is fixed: `renovate.json` no longer extends the private ai-config preset, it extends `config:recommended` directly, and #138 set the schedule to `at any time`. It is still inert, so the remaining cause is outside the config — most likely the Renovate app is not installed on this repository. Confirm in the app's repository access settings. Until it runs, `pinDigests: true` and the `automerge-ok` hold in `ci.yml` govern nothing. |
 | P2 | `flatpak.install` | Install Flatpak apps from Flathub or other remotes. Needed to manage Steam (`com.valvesoftware.Steam`) and other Flatpak apps from etch-config. Fields: `app_id:`, `remote:` (default `flathub`), idempotent via `flatpak list`. |
-| P3 | Pin `--version` on every `cargo install` | 9 `cargo install --locked` calls across `ci.yml`, `release.yml`, `mutation-pr.yml`, `mutation-testing.yml` and `cargo-audit-scheduled.yml` name no version. `--locked` pins the tool's dependency tree, not the tool. Pin a release at least two weeks old and add a test requiring one version per tool repo-wide (math#165). |
+| P3 | Replace `cargo install` with a pinned `taiki-e/install-action` | 9 `cargo install --locked` calls across `ci.yml`, `release.yml`, `mutation-pr.yml`, `mutation-testing.yml` and `cargo-audit-scheduled.yml` name no version (`--locked` pins the tool's dependency tree, not the tool), and they are slow: on #142's run the installs took 316 s of the Test job (nextest 170, tarpaulin 117, machete 29), plus cargo-deny 122 s and cargo-semver-checks 287 s in their own jobs. Use `taiki-e/install-action` pinned by full SHA, exact `name@X.Y.Z`, and `fallback: none` (aborts instead of building or downloading unverified; downloads are sha256-checked). Add a test for the SHA pin, `fallback: none`, no `checksum: false`, and version parity with local installers (math#165, math#177). |
 | P3 | `make build` writes to `~/Downloads` | `make build` and `make build-linux` copy the binary to `~/Downloads`, a macOS leftover that fails on any machine without that directory. Build should write only inside the repo; add `make install` copying to `${XDG_BIN_HOME:-$HOME/.local/bin}` (math#166). |
 | P3 | `auto-merge` has no draft hold | The bot-hold step in `ci.yml` never checks `isDraft`, and math found `gh pr merge` refuses a draft, so a draft PR's `auto-merge` job goes red rather than holding green (math#162; not yet reproduced here). Fails closed, so no wrong merge. |
 | P3 | Make `cargo semver-checks` blocking | It runs today but cannot fail a PR: `ci.yml:195` sets `continue-on-error: true`, and `auto-merge` `needs: [test, cargo-audit, secret-scan, snyk-scan, docs-lint, docs-build]` excludes it. The blocker is `enum_variant_added` — `CLAUDE.md` documents that every new action adds a public enum variant, so the check is permanently red by construction. Fix is `#[non_exhaustive]` on the action enum (which makes variant addition non-breaking), then remove `continue-on-error` and add the job to `auto-merge needs:`. Not a config toggle — the `#[non_exhaustive]` change is itself semver-breaking and needs its own cycle. |
@@ -115,13 +115,16 @@ Priority: **P1** a gate reported as blocking does not block; **P2** silently wro
 | P3 | Two macOS `package` tests not hermetic | `package::remove::tests::plan_skips_package_not_installed_homebrew` (unwrap on `ENOENT`, `remove.rs:107`) and `package::repository::tests::plan_with_available_provider_adds_repository` fail on the Mac Studio under a non-login ssh shell, before and after etch-cli's chflags fix (2026-10-17). Likely depend on `brew` being on `PATH`; macOS-only, so Linux CI never runs them. |
 | P3 | Property tests for the roundtrip paths | `tdd.md:72` requires a property test for every invertible or idempotent operation. **1 of 5 `Cargo.toml` declares `proptest` and 1 `.rs` file uses `proptest!`**, against math's 11 of 11 and 12 files. etch-cli has qualifying roundtrips: manifest YAML/TOML deserialization, the state manifest's serialize/deserialize path, and `etch rollback`'s `restore(stash(x)) == x`. Wants its own cycle with real properties, not a trivial one added to satisfy a count. |
 | P3 | Maintainability pass | The ai-config maintainability gate has shipped (`maintainability-review` skill). Run a worldclass pass in this repo against its thresholds — not scheduled yet. |
+| P3 | Run coverage as its own job | The Test job runs nextest (201 s including the build), then rebuilds instrumented for `Check coverage` (255 s), then a third time for the masked `Coverage with network tests` step (248 s). Move tarpaulin to a parallel job, add it to `auto-merge` `needs:` and the required checks, and drop or allow-list the informational step (see the P1 `continue-on-error` row). math pi-rs went from 884 s to 43 s for its test job (math#177). |
+| P3 | No gate measures test time | `.config/nextest.toml` sets no `slow-timeout` and `ci.yml` sets no `timeout-minutes`, so a hung test waits for GitHub's 360-minute job limit. Slowest test on #142's CI run is 4.6 s (`prune_limits_stash_count_to_three`); `slow-timeout = { period = "10s", terminate-after = 3 }` fails a hang by name at 30 s. Add a job-level `timeout-minutes` too (math#177). |
 | P4 | Narrow `zip` to `deflate` | zip 9 default features pull AES/pbkdf2/sha, bzip2, lzma, ppmd and zstd stacks that `extract.rs` does not need for release-binary zips. `default-features = false, features = ["deflate"]` shrinks the dependency surface and retires the `bzip2-1.0.6` licence allow, at the cost of rejecting zips with other entry methods. Kept out of the 2026-10-17 advisory PR as a behaviour change. |
 | P4 | `file.flags` example lacks `privileged` | `examples/file/flags.yaml` shows only unprivileged entries; add a `privileged: true` one (e.g. a root-owned path) noting that only the managed flags that change are passed to `chflags`, so other flags survive (etch-cli#132). |
 | P4 | Flip `missing_docs` to `warn` | 402 undocumented public items as of 2026-08-02 (`make docs-debt` rechecks), concentrated in `etch-lib` — the only crate in either repo with a real cross-crate consumer and published metadata. Shipped at `allow` with a dated comment; this row is its expiry. Incidentally, `make docs-debt` is the only standing evidence that lint output is being produced at all — once the 45 `Debug` derives land, every `warn` lint finds zero again, so `docs-debt` is the one command in either repo whose output is non-zero. If a toolchain change silently stopped promoting `warn` to error, both `warn` lints would go green and stay green; a `docs-debt` count that drops to 0 without anyone documenting anything is the signal. |
 | P4 | Rust edition 2024 and an MSRV | All three crates are `edition = "2021"` and no `rust-version` is declared anywhere. Move to 2024 and declare the MSRV CI actually builds with (math queue item). |
 | P4 | Hoist lints to `[workspace.lints]` | `app`, `lib` and `jsonschemagen` carry byte-identical `[lints]` tables today. `[workspace.lints]` plus `lints.workspace = true` prevents future drift (math#167-#169 analogue). |
 | P4 | Release tags off `main` | `v0.12.0`-`v0.14.0` point at CHANGELOG commits never merged to `main` (see the P2 release row). Harmless to builds; re-pointing published tags is destructive and needs an operator decision. Leave until the release workflow is fixed. |
 | P4 | `cargo deny` and Dependabot read different advisory corpora | `cargo deny check advisories` reads **RustSec**; Dependabot reads the **GitHub Advisory Database**. Verified: `GHSA-fr8x-3vfx-f45h` and `GHSA-pg4w-g64p-qwhj` carry **no RUSTSEC ID**, so the `cargo-audit` CI job — which is in `auto-merge`'s `needs:` and therefore blocking — reports `advisories ok` on a tree with 23 open high alerts. The gate is sound about RustSec and silent about GHSA. Fleet-wide: every Rust repo gated only on cargo-deny has this blind spot. Cross-cutting, so `rust.md`'s Security Scanning section is the likely destination. Open Dependabot alerts were 0 on 2026-10-25, so nothing is hidden today; the row belongs in ai-config. |
+| P4 | Rollback tests sleep for second-resolution timestamps | Four tests in `lib/src/rollback/mod.rs` (lines 453, 484, 530, 609) and `app/tests/rollback.rs` sleep 1.1 s per stash so names differ by a second; they hold 3 of the 5 slowest tests (2.2-4.6 s each; the other two are `decrypt` tests at 4.2-4.4 s). An injectable clock or sub-second stash names would remove about 14 s of test time; nextest runs them in parallel, so the wall-clock gain is small. |
 
 ---