fix: fail closed on incomplete weekly image and CVE surveys

.claude/skills/upgrade-all/SKILL.md

@@ -143,12 +143,31 @@ ssh cc-ci 'export PATH=/run/current-system/sw/bin:$PATH; R=<r>; \
   script -qec "abra recipe upgrade $R -m -n" /dev/null; \
   git -C ~/.abra/recipes/$R stash pop >/dev/null 2>&1 || true'
 ```
-Build `RECIPES_TO_UPGRADE` = recipes with **≥1 available upgrade** (after the stash, so the untracked
-overlay doesn't count as dirty). Others go to `SKIPPED_UPFRONT` with a reason (`dirty-worktree` only for
-real TRACKED edits, `up-to-date`, `not-fetchable`). **A `tag and digest … not supported` parse FATA is
-NOT `not-fetchable`** — per box item 4, catch it and resolve availability via the direct upstream-tag
-check; only `not-fetchable` when the mirror genuinely can't be fetched (network/auth), never for a
-digest-pinned image.
+**Mandatory registry cross-check for EVERY recipe and EVERY image, even if abra says current:** after
+reconciling the mirror and refreshing the recipe checkout, run
+`python3 /srv/cc-ci/cc-ci-plan/resolve-images.py <recipe> --recipe-dir /root/.abra/recipes`
+on cc-ci. Read the JSON `images`, `upgrades_available`, `unresolved`, and `all_resolved` fields.
+The candidate list is the **union** of abra's upgrades and the resolver's upgrades. CryptPad's
+`version-YYYY.M.D` app tag is a known counterexample: abra only reports a parse warning, while the
+resolver finds the newer image. A warning is never evidence that an image is current. Inspect both
+`newest_same_shape` and `newest_within_major`; a newer major is still a candidate for planning,
+though it must not be applied without a compatibility check.
+
+Build `RECIPES_TO_UPGRADE` from every recipe with at least one candidate. Only label a recipe
+`up-to-date` if abra completed successfully **and** the resolver checked every relevant image
+(`all_resolved: true`) **and** neither found a candidate. If an image is unresolved, templated,
+floating, or lacks comparable tags, investigate it directly and record the evidence. Otherwise
+record `unverified` with the image and reason; never fold it into `up-to-date`. `dirty-worktree`
+applies only to real tracked edits. A tag+digest parse failure is not `not-fetchable`.
+
+Run `python3 /srv/cc-ci/cc-ci-plan/audit-sources.py --security-sources` once for the full inventory
+and include any `NO VERIFIED CVE SOURCE` recipes or failed advisory sources in the weekly summary.
+Do not describe their CVE count as clean. This audit is a coverage check, not a substitute for
+`advisory-scan.py` on each actual upgrade window.
+Before the audit, check `test -s /srv/cc-ci/.github-token`. If it is missing, record that GitHub
+advisory checks are subject to the anonymous 60-request/hour limit; any resulting HTTP 403 is a
+failed source and must become `?` in the report. Never replace it with `0` or silently retry from
+model memory. The file is a read-only GitHub token location; never print its contents.
 
 **Reconcile every candidate's mirror during the survey** (even the up-to-date ones), so merged-upstream
 PRs are closed and every mirror `main` tracks true upstream — fleet-wide, not just where there's a new