agent: tag the decoder states the port pins, and stop leaking credential config

Two fixes to push-work and the policy that goes with them.

**Tags.** The port's exporter depends on sylpheed-formats BY REVISION, so a
commit of ours is part of its build -- and the commit it pinned lived on one
auto/* branch and nowhere else. Deleting that branch orphans it; squash-merging
it is worse, because squash creates NEW commits, so main appears to contain the
work while the pinned sha becomes unreachable and the port stops building for a
fresh checkout. Silently, at their build, long after the breakage.

push-work now pushes with --follow-tags, which publishes annotated tags
reachable from the pushed commits, and MISSION.md says to tag whatever the port
needs. formats-pin-2026-08-29 at 7eeae30 is the first, created after the fact.

**Credentials.** This script set credential.helper as --local config, which
PERSISTS in the repository. The repo is a bind mount the host also uses, so the
host's git inherited a path that exists only inside the container and every host
push failed with "unable to get credential storage lock". Now applied with -c to
the single push. Same fix already landed on the port side; this copy still had
the bug and would have re-leaked on the next push.

Committed with a pathspec so the agent's in-flight work is untouched.

docker/agent/bin/push-work

@@ -16,7 +16,12 @@
 # `sylph-agent`). They are never printed, never logged, and never passed on a
 # command line.
 #
-#   push-work            push the current branch
+#   push-work            push the current branch, and any annotated tags on it
+#
+# --follow-tags publishes ANNOTATED tags reachable from the pushed commits. That
+# is what makes a pinned decoder state durable: the port depends on commits of
+# ours by revision, and a commit reachable only from a topic branch is orphaned
+# by a squash-merge. Lightweight tags are deliberately not pushed.
 #   push-work --dry-run  say what it would do
 set -euo pipefail
 
@@ -50,7 +55,17 @@ if [ ! -s "$HOME/.git-credentials" ]; then
 fi
 
 # `store` reads the file we mounted; nothing is written back (it is read-only).
-git config --local credential.helper "store --file=$HOME/.git-credentials"
+# Applied to THIS COMMAND ONLY, via `-c`, never `git config --local`.
+#
+# Writing it to --local config persists it in the repository, and this repo is a
+# bind mount the host also uses -- so the host's git inherited
+# `store --file=/sylph-home/re/.git-credentials`, a path that exists only inside
+# the container, and every host push then failed with
+# `unable to get credential storage lock: No such file or directory`.
+#
+# A tool that configures a shared repository to suit itself breaks every other
+# user of that repository. Keep it to the invocation.
+CRED_HELPER="store --file=$HOME/.git-credentials"
 
 ahead=$(git rev-list --count "origin/$branch..$branch" 2>/dev/null || git rev-list --count HEAD)
 echo "push-work: $branch — $ahead commit(s) to publish"
@@ -63,5 +78,5 @@ fi
 # --force-with-lease is deliberately NOT offered. If this is rejected as
 # non-fast-forward, someone else moved the branch: fetch and merge, do not
 # overwrite.
-git push --set-upstream origin "$branch"
+git -c "credential.helper=$CRED_HELPER" push --follow-tags --set-upstream origin "$branch"
 echo "push-work: pushed $branch"

docs/port/MISSION.md

@@ -271,6 +271,35 @@ answer is no-go by definition, not "try harder".
 **Then stop and write the go/no-go.** Do not start Ready Room work on your own
 authority.
 
+## Publishing a decoder state the port pins
+
+The port's exporter depends on `sylpheed-formats` **by revision**, so a commit of
+yours becomes part of its build. That creates an obligation that is easy to miss:
+
+⚠️ **A commit reachable only from an `auto/*` branch is not safe to pin.** If the
+branch is later deleted, or — worse — **squash-merged**, the object is orphaned.
+Squash creates *new* commits, so `main` appears to contain the work while the
+pinned sha becomes unreachable, and the port stops building for anyone doing a
+fresh checkout. Silently, at their build, long after the moment of breakage.
+
+**So when you land something the port needs, tag it:**
+
+```bash
+git tag -a formats-pin-$(date +%F) -m "what the port gets from this state"
+push-work            # --follow-tags publishes annotated tags with the branch
+```
+
+A tag is a permanent ref. It survives branch deletion and squash-merge, it is
+self-documenting in the port's `Cargo.toml`, and it fails loudly at *fetch* if it
+ever goes missing rather than silently at build.
+
+Then tell the port over the message channel that a new pin exists. It bumps
+deliberately, as its own commit — that is how it stays current without floating,
+which would only give it staleness it cannot see.
+
+`formats-pin-2026-08-29` at `7eeae30` is the first, created because the port had
+already pinned a commit that lived on one topic branch and nowhere else.
+
 ## Handing it over
 
 [`HANDOFF.md`](HANDOFF.md) is the single page the port agent reads. Keep it

docs/re/METHOD.md

@@ -880,3 +880,19 @@ agent's loop prompt, i.e. nowhere durable. See [`README.md`](README.md) for the
   stuck before it was timed. If the change under test is not in the mesh path,
   `build-reborn t -p <crate>` scopes around it — note that `build-reborn test`
   itself passes `--workspace` and will ignore a `-p`.
+
+* **Never measure a file another process is still writing.** `ffprobe` on a
+  half-written transcode reported 33 s against a 137 s source — the shape of
+  catastrophic truncation, with no error and no warning, and it nearly became a
+  filed bug. The tell was the mtime and a climbing packet count, not anything in
+  the tool's output. Before comparing an artifact you did not produce, check that
+  whoever produces it has finished; across two agents sharing a repo this is a
+  race, not an edge case.
+
+* **A difference-signal RMS means nothing until the two are aligned.** Comparing a
+  transcode against its source gave source RMS −25.3 dB and difference RMS
+  −34.2 dB — only ~9 dB down, which looks like a failure. It is inconclusive: a
+  one-sample offset makes the difference nearly as loud as the source. Any such
+  test needs cross-correlation to align first and an agreed downmix, and only then
+  is a pass mark like ">40 dB down" meaningful. Reporting the 9 dB as a result
+  would have been a confident wrong number.

docs/re/data/movie-audio-layouts.csv

@@ -0,0 +1,97 @@
+ADV.wmv,wmapro,48000,6,5.1
+RT01A.wmv,wmav2,48000,2,unknown
+RT01B.wmv,wmav2,48000,2,unknown
+RT01C_1.wmv,wmav2,48000,2,unknown
+RT01C_2.wmv,wmav2,48000,2,unknown
+RT02A.wmv,wmav2,48000,2,unknown
+RT02B.wmv,wmav2,48000,2,unknown
+RT02C.wmv,wmav2,48000,2,unknown
+RT02D_1.wmv,wmav2,48000,2,unknown
+RT02D_2.wmv,wmav2,48000,2,unknown
+RT03A.wmv,wmav2,48000,2,unknown
+RT03B.wmv,wmav2,48000,2,unknown
+RT03C.wmv,wmav2,48000,2,unknown
+RT03D.wmv,wmav2,48000,2,unknown
+RT04A.wmv,wmav2,48000,2,unknown
+RT04B.wmv,wmav2,48000,2,unknown
+RT05A.wmv,wmav2,48000,2,unknown
+RT05B.wmv,wmav2,48000,2,unknown
+RT05C.wmv,wmav2,48000,2,unknown
+RT06A.wmv,wmav2,48000,2,unknown
+RT06B.wmv,wmav2,48000,2,unknown
+RT06C.wmv,wmav2,48000,2,unknown
+RT06D.wmv,wmav2,48000,2,unknown
+RT07A.wmv,wmav2,48000,2,unknown
+RT07B.wmv,wmav2,48000,2,unknown
+RT07C.wmv,wmav2,48000,2,unknown
+RT08A.wmv,wmav2,48000,2,unknown
+RT08B.wmv,wmav2,48000,2,unknown
+RT08C.wmv,wmav2,48000,2,unknown
+RT09A.wmv,wmav2,48000,2,unknown
+RT09B.wmv,wmav2,48000,2,unknown
+RT09C.wmv,wmav2,48000,2,unknown
+RT09D.wmv,wmav2,48000,2,unknown
+RT10A.wmv,wmav2,48000,2,unknown
+RT10B.wmv,wmav2,48000,2,unknown
+RT11A.wmv,wmav2,48000,2,unknown
+RT11B.wmv,wmav2,48000,2,unknown
+RT11C.wmv,wmav2,48000,2,unknown
+RT12A.wmv,wmav2,48000,2,unknown
+RT12B_1.wmv,wmav2,48000,2,unknown
+RT12B_2.wmv,wmav2,48000,2,unknown
+RT13A.wmv,wmav2,48000,2,unknown
+RT13B_1.wmv,wmav2,48000,2,unknown
+RT13B_2.wmv,wmav2,48000,2,unknown
+RT14A.wmv,wmav2,48000,2,unknown
+RT14B.wmv,wmav2,48000,2,unknown
+RT14C.wmv,wmav2,48000,2,unknown
+RT15A.wmv,wmav2,48000,2,unknown
+RT15B.wmv,wmav2,48000,2,unknown
+RT15C.wmv,wmav2,48000,2,unknown
+RT16C.wmv,wmav2,48000,2,unknown
+S00A.wmv,wmapro,48000,6,5.1
+S01A.wmv,wmapro,48000,6,5.1
+S02A.wmv,wmapro,48000,6,5.1
+S02B.wmv,wmapro,48000,6,5.1
+S02C.wmv,wmapro,48000,6,5.1
+S03A.wmv,wmapro,48000,6,5.1
+S04A.wmv,wmapro,48000,6,5.1
+S04B.wmv,wmapro,48000,6,5.1
+S05A.wmv,wmapro,48000,6,5.1
+S06A.wmv,wmapro,48000,6,5.1
+S06B.wmv,wmapro,48000,6,5.1
+S07A.wmv,wmapro,48000,6,5.1
+S07B.wmv,wmapro,48000,6,5.1
+S09B.wmv,wmapro,48000,6,5.1
+S10B.wmv,wmapro,48000,6,5.1
+S11A.wmv,wmapro,48000,6,5.1
+S11C.wmv,wmapro,48000,6,5.1
+S12A.wmv,wmapro,48000,6,5.1
+S12B.wmv,wmapro,48000,6,5.1
+S12C.wmv,wmapro,48000,6,5.1
+S13A.wmv,wmapro,48000,6,5.1
+S13B.wmv,wmapro,48000,6,5.1
+S14A.wmv,wmapro,48000,6,5.1
+S15A.wmv,wmapro,48000,6,5.1
+S15B.wmv,wmapro,48000,6,5.1
+S15C.wmv,wmapro,48000,6,5.1
+S16A.wmv,wmapro,48000,6,5.1
+hokyu_DS_s02A.wmv,wmav2,48000,2,unknown
+hokyu_DS_s07A.wmv,wmav2,48000,2,unknown
+hokyu_DS_s07H.wmv,wmav2,48000,2,unknown
+hokyu_DS_s08A.wmv,wmav2,48000,2,unknown
+hokyu_DS_s13A.wmv,wmav2,48000,2,unknown
+hokyu_DS_s14H.wmv,wmav2,48000,2,unknown
+hokyu_LS_s02A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s02H.wmv,wmav2,48000,2,unknown
+hokyu_LS_s03A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s03H.wmv,wmav2,48000,2,unknown
+hokyu_LS_s06A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s06H.wmv,wmav2,48000,2,unknown
+hokyu_LS_s09A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s09H.wmv,wmav2,48000,2,unknown
+hokyu_LS_s11A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s14A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s15A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s24A.wmv,wmav2,48000,2,unknown
+hokyu_LS_s27A.wmv,wmav2,48000,2,unknown

docs/re/structures/movie-audio-channels.md

@@ -0,0 +1,47 @@
+# ✅ The disc ships movies in **two** audio profiles — and one of them is 5.1
+
+**Status:** ✅ `DECODED`, disc-wide (97 of 97 movies probed). Found while checking
+a transcode, not while looking for it.
+
+## The split
+
+```
+$ ffprobe -select_streams a -show_entries stream=codec_name,sample_rate,channels,channel_layout
+```
+
+| profile | count | codec | rate | channels | which |
+|---|---|---|---|---|---|
+| **surround** | **28** | `wmapro` | 48 kHz | **6 (5.1)** | `ADV.wmv` + every `S*.wmv` story cutscene |
+| stereo | 69 | `wmav2` | 48 kHz | 2 | every `RT*.wmv` and `hokyu_*.wmv` |
+
+Full list in [`data/movie-audio-layouts.csv`](../data/movie-audio-layouts.csv).
+
+The split is not arbitrary: the **cinematics** are 5.1 and the **in-mission radio
+chatter** is stereo. `ADV.wmv` (137.714 s) and `S00A.wmv` — the boot/attract intro
+and the new-game intro, i.e. **both movies the menu milestone needs** — are in the
+surround group.
+
+## ⚠️ Why this matters to anything that transcodes
+
+A single `ffmpeg` command over `dat/movie/` produces **two different kinds of
+result** and records neither:
+
+* the 69 stereo files pass through channel-wise unchanged;
+* the 28 surround files are **downmixed 5.1 → stereo by ffmpeg's default matrix**,
+  folding centre-channel dialogue into L/R at a weighting nobody chose.
+
+That default is a *content* decision — it sets how loud the dialogue is against
+the music — and it is **not stable across ffmpeg versions**. A pipeline that wants
+a reproducible result has to state the downmix explicitly rather than inherit it,
+and record it beside the command.
+
+🟡 Whether the game itself plays these in surround, and with what downmix when the
+console is set to stereo, is **not established here**. This page is about what is
+on the disc.
+
+## How it was found, and the trap next to it
+
+Checking a transcode against its source, `ffprobe` reported the output as 33 s
+against the source's 137 s — which reads as catastrophic truncation and is not:
+the file was **being written at that moment**. Measuring a live write produces a
+confident wrong answer with no error. See [`../METHOD.md`](../METHOD.md).