Manual intervention points: explicit credential bridging into the validation shell, a committed clone-local no-promotion override, and a follow-up rerun after the .local/work/ path-protection fix before carrying the summary into this tracked note
Task registration still points at the repository root: not exercised through Windows Task Scheduler in this record; radar schedule render targeted the isolated validation clone root as expected
Safe no-promotion override used: yes; the isolated validation clone used a local no-promotion threshold override so the weekly pass could exercise the schedule path without live promotion side effects
Any local environment drift noticed: yes; at the time of the first run, a validation clone rooted under .local/work/ was not suitable for live radar experimentation because RepoWorkspaceAdapter protected repositories whose root path contained .local, which blocked writes to docs/radar/experiments/
Follow-up action needed: completed after this record; RepoWorkspaceAdapter now checks protected path parts relative to the repo root, and a post-fix rerun from .local/work/ (radar-3ff238e283e9447cb6af7b4cbac2035c) advanced to the experiment branch instead of failing with Path is protected
Additional safety note: this isolated run used a local no-promotion threshold override to avoid remote side effects, so promotion push behavior was intentionally not exercised in this record