#22275 cmux-next: the defaults snapshot is bot-only

schemas/defaults/cmux-next.json, the defaults snapshot, is now bot-only. No pull request commits it, and nothing fails a pull request over it. Part of #21946.

Before this change, every PR whose action exports, settings exports or Swift *Enabled flags moved failed cmux-next guards / defaults-snapshot ("schemas/defaults/cmux-next.json does not match the sources"). It stayed red until someone ran defaults_guard.py snapshot and committed the result. Each committed copy then conflicted with the next PR's: 19 of the 259 open PRs carry one.

Change

• Defaults guard (check): it now judges the merge base and the head by the defaults their exports and sources produce, computed with the same defaults() the snapshot comes from. It no longer reads a committed snapshot. The approval rule is unchanged, and a hand-edited snapshot can no longer hide a default change.
• PR checks: on pull_request, cmux-next guards / defaults-snapshot and cmux-next generated files run check-stamp (the settings exports match their sources) instead of check-fresh. Pushes, batches and dispatches still check the snapshot.
• PR autofix: pr-autofix-apply.sh leaves the snapshot out of the push and reports dropped:. The base autofix keeps rewriting it after each merge.

Still committed by PRs: the settings and action exports. The guard reads them, so they stay until the next step of the design on #21946.

Tests (committed red first)

• tests/test_defaults_guard.py:
  • test_a_head_that_does_not_commit_the_snapshot_is_judged_by_its_sources: the change is listed, and it passes with a call owner's approval.
  • test_a_hand_edited_snapshot_cannot_hide_a_default_change.
  • Both were red, and all 30 tests are green at the head.
• scripts/cmux-next/tests/pr-autofix.test.sh: the snapshot is left out of the push and the rest still applies. Red against the old apply script, green at the head.
• actionlint is clean on cmux-next.yml and cmux-next-guards.yml.

Conflicts with #22235 in pr-autofix-apply.sh; whichever lands second takes both.

Workflow files change. Leo waived Lawrence's code-owner sign-off for the deconflict work, and his coordinator was told.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Turns the defaults snapshot (schemas/defaults/cmux-next.json) bot-only, so pull requests no longer fail over a stale snapshot or commit copies that conflict with each other (19 of 259 open PRs carried one).

• The defaults guard judges the merge base and head by the defaults their exports and sources produce, never by a committed snapshot; a hand-edited snapshot can no longer hide a default change.
• CI runs check-stamp on every event (pull requests, base, batches, dispatches), never check-fresh, since the snapshot is stale between a merge and the base autofix's commit. check-fresh stays only as the command that reports the snapshot needs regenerating.
• pr-autofix-apply.sh drops the snapshot from its push and reports dropped:; the base autofix keeps rewriting it after each merge.

Part of #21946. The settings and action exports are still committed by PRs and still checked. Tests cover a head that omits the snapshot, a hand-edited snapshot hiding a change, and check-fresh still detecting staleness.