@@ -76,11 +76,12 @@ jobs:
         run: python3 scripts/ci-reuse-merge-group.py
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache instead of a raw actions/cache of the whole
@@ -127,7 +128,8 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -317,11 +319,13 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
@@ -488,11 +492,12 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
+        # rustup is pre-installed on GitHub-hosted runners. `toolchain
+        # install` with no name reads rust-toolchain.toml in the repo root,
+        # then installs the pinned channel + listed components if missing
+        # (retried past download blips; see the script). No third-party
         # action dependency needed for toolchain setup.
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
@@ -532,12 +537,12 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        # `rustup show` installs the rust-toolchain.toml channel + listed
-        # components; `rustup component add` adds the llvm-tools-preview
+        # `toolchain install` installs the rust-toolchain.toml channel +
+        # listed components; `component add` adds the llvm-tools-preview
         # bits cargo-llvm-cov needs to merge .profraw files into lcov.
         run: |
-          rustup show
-          rustup component add llvm-tools-preview
+          scripts/rustup-retry.sh toolchain install
+          scripts/rustup-retry.sh component add llvm-tools-preview
 
       - name: Install cargo-llvm-cov
         # taiki-e/install-action ships precompiled binaries — much faster
@@ -727,11 +732,11 @@ jobs:
           driver: docker
 
       - name: Install Rust
-        # `rustup show` consumes rust-toolchain.toml; the explicit
+        # `toolchain install` consumes rust-toolchain.toml; the explicit
         # `component add` covers llvm-tools-preview for cargo-llvm-cov.
         run: |
-          rustup show
-          rustup component add llvm-tools-preview
+          scripts/rustup-retry.sh toolchain install
+          scripts/rustup-retry.sh component add llvm-tools-preview
 
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@65851e10cd6c377f11a60e600abc07cb08643468 # v2.79.3
@@ -946,7 +951,8 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -1043,7 +1049,7 @@ jobs:
           - {os: 'ubuntu-latest', suite: 'e2e_redirect_bun_build e2e_vendor_bun_build mode_migration_bun', bun: '1.2.23', test_filter: '--include-ignored', ci_group: 'node20-1.2.23-13'}
           - {os: 'ubuntu-latest', bun: '1.3.14', suite: 'e2e_redirect_bun_build e2e_vendor_bun_build mode_migration_bun e2e_bun_lockb', cases: '[{"os":"ubuntu-latest","suite":"e2e_redirect_bun_build e2e_vendor_bun_build mode_migration_bun","bun":"1.3.14","test_filter":"--include-ignored"},{"os":"ubuntu-latest","suite":"e2e_bun_lockb","bun":"1.3.14","test_filter":"--include-ignored workspace_late_dependent"}]', ci_group: 'node20-1.3.14-14'}
           - {os: 'ubuntu-latest', suite: 'e2e_bun_lockb', bun: '1.0.36', test_filter: '--include-ignored', ci_group: 'node20-1.0.36-15'}
-          - {os: 'ubuntu-latest', suite: 'e2e_bun_lockb', bun: '1.4.2', test_filter: '--include-ignored text_migration workspace_late_dependent', ci_group: 'node20-1.4.2-16'}
+          - {os: 'ubuntu-latest', suite: 'e2e_bun_lockb', bun: '1.4.2', test_filter: '--include-ignored text_migration workspace_late_dependent binary_shared_bundled_record_hosted_pin_is_managed', ci_group: 'node20-1.4.2-16'}
           - {os: 'ubuntu-latest', vlt: '1.2.0', suite: 'e2e_redirect_vlt_build e2e_vendor_vlt_build mode_migration_vlt e2e_safety_vlt e2e_vlt e2e_redirect_pnpm_build', cases: '[{"os":"ubuntu-latest","suite":"e2e_redirect_vlt_build","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_vendor_vlt_build","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"mode_migration_vlt","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_safety_vlt","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_safety_vlt","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix","vlt_store_linker":"hardlink"},{"os":"ubuntu-latest","suite":"e2e_vlt","vlt":"1.2.0","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_redirect_pnpm_build","test_filter":"--ignored --skip pnpm_pinned_matrix"}]', ci_group: 'node24-1.2.0-17'}
           - {os: 'ubuntu-latest', suite: 'e2e_redirect_vlt_build', vlt: '0.0.0-16', test_filter: '--include-ignored vlt_pinned_matrix', ci_group: 'node24-0.0.0-16-18'}
           - {os: 'ubuntu-latest', vlt: '0.0.0-32', suite: 'e2e_redirect_vlt_build e2e_vendor_vlt_build mode_migration_vlt e2e_vlt', cases: '[{"os":"ubuntu-latest","suite":"e2e_redirect_vlt_build","vlt":"0.0.0-32","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_vendor_vlt_build","vlt":"0.0.0-32","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"mode_migration_vlt","vlt":"0.0.0-32","test_filter":"--include-ignored vlt_pinned_matrix"},{"os":"ubuntu-latest","suite":"e2e_vlt","vlt":"0.0.0-32","test_filter":"--include-ignored vlt_pinned_matrix"}]', ci_group: 'node24-0.0.0-32-19'}
@@ -1611,7 +1617,7 @@ jobs:
           driver: docker
 
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       # No `actions/cache` here intentionally. This job builds Docker
       # images and would be flagged by zizmor's cache-poisoning audit.
@@ -1688,7 +1694,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
@@ -1735,7 +1741,8 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
@@ -1842,15 +1849,16 @@ jobs:
           tar -xf target/e2e-bin.tar -C target/e2e-bin
           rm target/e2e-bin.tar
       - name: Install Rust
-        run: rustup show
+        shell: bash
+        run: scripts/rustup-retry.sh toolchain install
       - name: Install the cargo under test
         # bash, not the Windows default pwsh: in PowerShell
         # "$CARGO_TEST_TOOLCHAIN" is an (unset) PowerShell variable, so the
         # windows-latest leg ran `rustup toolchain install ""`.
         shell: bash
         env:
           CARGO_TEST_TOOLCHAIN: ${{ matrix.toolchain }}
-        run: rustup toolchain install "$CARGO_TEST_TOOLCHAIN" --profile minimal
+        run: scripts/rustup-retry.sh toolchain install "$CARGO_TEST_TOOLCHAIN" --profile minimal
       - name: Real-cargo hosted/vendored + manifest-less VEX
         # The e2e-build binaries, run from the package root as `cargo test`
         # would (see the e2e job's staging step).
@@ -1966,7 +1974,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
       - name: Pull the old cargos under test
         if: needs.clippy.outputs.reuse != 'true'
         run: |
@@ -2078,7 +2086,7 @@ jobs:
 
       - name: Install Rust
         if: steps.gate.outputs.run == 'true'
-        run: rustup show
+        run: scripts/rustup-retry.sh toolchain install
 
       - name: Cache cargo
         if: steps.gate.outputs.run == 'true'
 
@@ -43,6 +43,8 @@ on:
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
       - 'scripts/ci-vlt-proof-suites.py'
+      - 'scripts/vlt-compat-gate.py'
+      - 'scripts/tests/test_vlt_compat_gate.py'
       - '.github/workflows/ci.yml'
       - 'scripts/tests/test_ci_vlt_rows.py'
   push:
@@ -84,6 +86,8 @@ on:
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
       - 'scripts/ci-vlt-proof-suites.py'
+      - 'scripts/vlt-compat-gate.py'
+      - 'scripts/tests/test_vlt_compat_gate.py'
       - '.github/workflows/ci.yml'
       - 'scripts/tests/test_ci_vlt_rows.py'
   schedule:
@@ -136,8 +140,41 @@ jobs:
       - name: Every era, suite and OS is covered
         run: python3 -B -m unittest scripts/tests/test_ci_vlt_rows.py -v
 
-  build:
+  # Both filters list ci.yml for its vlt `e2e` rows, which install-proof
+  # leaves out. A PR or push whose only matching change is ci.yml, with
+  # those rows untouched, would rerun the matrix exactly as on the base:
+  # matrix-coverage above still checks it, the rest is skipped.
+  changes:
     if: github.event.pull_request.draft != true
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.gate.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          # A PR's merge commit has the base it was merged onto as parent 1.
+          fetch-depth: 2
+      - id: gate
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+          case "$EVENT_NAME" in
+            pull_request) base=HEAD^1 ;;
+            push) base="$PUSH_BEFORE" ;;
+            *) base='' ;;
+          esac
+          if [ -n "$base" ] && ! git rev-parse --verify --quiet "$base^{commit}" >/dev/null; then
+            git fetch --quiet --depth 1 origin "$base" || true
+          fi
+          python3 -B scripts/vlt-compat-gate.py --event "$EVENT_NAME" --base "$base" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: changes
+    if: needs.changes.outputs.matrix == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -373,7 +410,8 @@ jobs:
     steps: *install-proof-steps
 
   plan:
-    if: github.event.pull_request.draft != true
+    needs: changes
+    if: needs.changes.outputs.matrix == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -468,8 +506,8 @@ jobs:
           retention-days: 14
 
   lock-diff:
-    needs: native
-    if: ${{ !cancelled() }}
+    needs: [changes, native]
+    if: ${{ !cancelled() && needs.changes.outputs.matrix == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps: