Each of the three was merged on evidence I could not reach myself. This
replaces that trust with a test that runs on every platform, on every CI run.
1. Windows lock (#1261). The no-sentinel fix was unverifiable on POSIX —
msvcrt is None, so the branch never executes and a regression would be
invisible to Linux and macOS CI. tests/test_windows_lock_no_sentinel.py
swaps the module-level fcntl/msvcrt handles for stubs and drives the
Windows branch anywhere, asserting behaviour (an empty file stays empty,
the first ledger append succeeds and verify_chain passes) rather than
'was locking() called'. Restoring the sentinel in all three lock sites
fails 3 of the 4 tests, including the first-append regression itself.
2. Dividend cash column (#1356). A dividend row has no quantity and no price,
so 'amount or qty * price' collapses to 0.0 when the export books the
payout under a cash-movement heading instead of the fill column. That is a
silent zero — the shape #1207 item 15 is about. Dividend rows now also try
发生金额 / 资金发生额 / 红利金额 / 实发金额 / 税后金额 and Futu's net-amount
columns, across all four parsers; anything still zero is counted into a new
dividend_rows_missing_cash profile field so the caller can SEE that the
journal was read but the money was not.
3. Docker action majors (#1359). The v4/v6/v7 bump had never executed in this
repository: docker-build.yml is workflow_dispatch only, total_runs=0. Every
input the workflow passes was checked against each new major's action.yml
at the pinned SHA (13 inputs, all present; the two setup actions take none).
A validate-build job now runs the SAME pins with push: false on any change
to the Dockerfile, this workflow, or pyproject, and the publish job is
gated to workflow_dispatch so the new triggers cannot publish an image.
That gate is one 'if:' line, so it is pinned too — removing it, flipping
validate-build to push: true, or unpinning an action each fail a test.
The file comment claiming these majors were 'a deliberate, separately testable
bump, not a drive-by change here' contradicted the file after #1359 and is
replaced by what is actually true now.