diff --git a/scripts/pm/check-half-states.mjs b/scripts/pm/check-half-states.mjs index 44331c47ba..50f596f788 100644 --- a/scripts/pm/check-half-states.mjs +++ b/scripts/pm/check-half-states.mjs @@ -7764,6 +7764,243 @@ export function renderDanglingReferences(report, { markdown = false } = {}) { return head; } +// --------------------------------------------------------------------------- +// H43 — an open GOVERNED-SURFACE PR that has asked NEITHER approver to look +// (#14967). +// +// ## The state nothing could read, and the question that found it +// +// The maintainer asked, verbatim: 「pr清单中哪些是需要我审核的,比如adr这些,为什 +// 么我没看到审核请求,是skills的问题吗?」 — and the director sweep behind that +// question measured, across the four governed repos, TEN open PRs hitting the +// governed register, of which SEVEN had never asked `os-zhuang` and TWO had +// asked nobody at all. Two of them were ADR records. They had waited two days. +// +// ⭐ The protocol TEXT is not the defect and this row does not touch it: the +// dispatch skill's ACCEPT path already says to request BOTH accounts, and a +// request to `os-zhuang` succeeded during that same sweep. What was missing is +// a READING. The three instruments that look at governed PRs each answer a +// different question: the queue guard asks whether an AUTHORIZED APPROVAL +// exists at enqueue time (too late, and a governed PR is not supposed to reach +// the queue at all), the governed-merge audit is post-hoc, and every row in +// this file keyed on `pm:*` labels cannot see a pull request — PRs carry none. +// +// ## Why ONE requested account is worse than it looks, which is the whole row +// +// `hotlong` is also the login the maintainer's own sessions run as, AND the +// author of some governed PRs. A request addressed only to it either lands in +// the account that made it, or cannot be made at all — GitHub answers a review +// request naming the PR's own author with 422. Meanwhile the account the +// maintainer actually reads is never asked. So "requested one of the two" is +// not half a channel; on an approver-authored PR it is frequently zero. +// +// ⇒ Coverage here is a UNION over three fields, and each term is load-bearing: +// +// requested_reviewers the request itself, the channel the protocol names. +// assignees the DOCUMENTED FALLBACK for the author-identity case +// — assign the approver who cannot be requested, and +// request the other. ⛔ Authorship alone never counts: +// the fallback is covered only when it was TAKEN, which +// is exactly the case that silently produced zero. +// submitted reviews GitHub REMOVES a pending request the moment that +// reviewer submits a review, so without this leg the +// healthiest possible governed PR — one an approver has +// already reviewed — fires this row forever. Measured +// live while this row was written: one open governed PR +// carried `requested_reviewers = [hotlong]` with a +// submitted review by `os-zhuang`, and the two-field +// union alone reported it as unasked. +// +// ## Report-only, and pointedly so +// +// ⛔ Nothing can ship wrong through this gap: the queue guard still refuses an +// unapproved governed enqueue and a human merge is still the review record. The +// failure is THROUGHPUT and VISIBILITY — 「一个只有在被保护的人自己发现它缺席时 +// 才显形的治理通道,不是通道」 — so the remedy is a REQUEST (or the assign +// fallback), never a label written from here and never a gate. A governed PR +// sitting as a DRAFT is the CORRECT terminal state of this regime, so draft +// status neither fires this row nor silences it. +// +// ## The register is IMPORTED, never restated — and never fatally +// +// `GOVERNED_SURFACES`/`governedPathsIn` (the one file-list matcher, shared with +// the queue guard and with the pre-arm `--test` verdict a seat runs before it +// flips ready) and `GOVERNED_APPROVERS` (the 2026-08-27 authorized set) are the +// single source for both halves of this predicate. A third matcher here would +// be a register that can drift from the one the guard enforces. +// +// ⚠️ But this file TRAVELS. Its adopt list is "copy these files, unchanged" +// into each sibling repo, and a sibling install carries the sweeper and its +// `invoked-as` helper and nothing else — measured while this row was written: +// objectui's `scripts/pm/` holds this file alone. A static `import` of the +// governed pair would therefore not degrade that install, it would KILL it: +// `ERR_MODULE_NOT_FOUND` at module load, exit 1, before a single predicate +// runs — which is precisely the incident the patrol workflow's own adopt list +// records against `invoked-as.mjs`, and it would take H1–H42 down with it to +// buy H43. So the register is loaded LAZILY and its absence is NAMED: this row +// alone reports NOT MEASURED, with the reason and the remedy, and the rest of +// the sweep is untouched. #4690's rule decides the wording — an input that +// could not be read must never render as an input that was clean. +// +// ## What it costs per run, and the two bounds +// +// ZERO extra changed-file requests: the pages are H36's, already fetched for +// the population this row needs (`h36NeedsFiles` is wider than governed). The +// one request this row buys is the submitted-review leg, and only for a +// governed PR whose request∪assignment union is ALREADY short — on the live +// board this landed against, 30 open PRs, 29 file pages already in hand, 8 +// governed, 5 review probes. Both bounds are honest about what they hide: a +// candidate past `H43_REVIEW_PROBE_CAP` (oldest-first, because the oldest +// unasked PR is the worst one) and a probe that failed both leave the row on +// the two-field union with a sentence that SAYS so, and a PR whose file page +// went unread is not judged here at all — the coverage clause carries both. +// --------------------------------------------------------------------------- + +/** + * The review pages this row reads per run, and one page's size. The cap is the + * request budget, not a render budget: the governed slice of an open board has + * been ~8 of 30 with ~5 short of coverage, so 25 is several times the measured + * worst case and still bounds a pathological board to one page each. + */ +export const H43_REVIEW_PROBE_CAP = 25; +export const H43_REVIEWS_PAGE_SIZE = 100; + +/** Approvers named inline before the sentence degrades to a count. */ +export const H43_SURFACE_LIST_CAP = 4; + +/** + * Why the register would not load, as a sentence a sibling install can act on. + * Pure, so the self-test pins the wording that a live absence would otherwise + * only produce on a repo nobody is looking at. + */ +export function governedRegisterFailure(err) { + if (String(err?.code ?? '') === 'ERR_MODULE_NOT_FOUND') { + return ( + 'the governed register is not installed beside this file — H43 needs `check-governed-merges.mjs` ' + + '(the `GOVERNED_SURFACES` matcher) and `check-governed-queue-guard.mjs` (`GOVERNED_APPROVERS`), ' + + 'which a sibling-repo copy of this sweeper does not carry. Copy the pair to enable this row; ' + + 'every other row is unaffected' + ); + } + return `the governed register would not load: ${String(err?.message ?? err ?? 'unknown error')}`; +} + +/** + * The register, resolved once per process and never fatally. Injectable so a + * caller can drive it without touching the filesystem; the default resolves + * both specifiers relative to THIS file, which is what makes the sibling-repo + * absence a catchable `ERR_MODULE_NOT_FOUND` rather than a load-time death. + */ +export async function loadGovernedRegister(load = (specifier) => import(specifier)) { + try { + const [merges, guard] = await Promise.all([ + load('./check-governed-merges.mjs'), + load('./check-governed-queue-guard.mjs'), + ]); + const matcher = merges?.governedPathsIn; + const approvers = guard?.GOVERNED_APPROVERS; + if (typeof matcher !== 'function' || !Array.isArray(approvers) || approvers.length === 0) { + return { + available: false, + matcher: null, + approvers: [], + reason: + 'the governed register loaded but did not export what this row reads — `governedPathsIn` ' + + 'and a non-empty `GOVERNED_APPROVERS`. A rename is the likely cause, and this row is the ' + + 'reader that noticed', + }; + } + return { available: true, matcher, approvers, reason: null }; + } catch (err) { + return { available: false, matcher: null, approvers: [], reason: governedRegisterFailure(err) }; + } +} + +/** + * Resolved at module evaluation, so the offline self-test can drive the real + * register rather than a fabricated approver list — a rename in either sibling + * reddens HERE, where a reader is looking, instead of going quiet on the four + * scheduled runs a day that nobody watches. + */ +export const GOVERNED_REGISTER = await loadGovernedRegister(); + +/** + * The two fields a PR LIST row already carries. No request buys this, which is + * why the review leg below is bought only when this set is already short. + */ +export function h43CheapCoverage(pr) { + const logins = new Set(); + for (const u of pr?.requested_reviewers ?? []) if (u?.login) logins.add(String(u.login)); + for (const u of pr?.assignees ?? []) if (u?.login) logins.add(String(u.login)); + return logins; +} + +/** + * The gathering policy, H16's idiom: answerable from the LIST row plus the + * file page already in hand, and never NARROWER than the population it feeds. + * A governed PR whose two cheap fields already cover every approver is DECIDED + * — no row can fire — so its review page is a request nobody needs. + */ +export function h43NeedsReviewProbe(pr, governedCount, approvers) { + if (!(governedCount > 0)) return false; + const cheap = h43CheapCoverage(pr); + return (approvers ?? []).some((a) => !cheap.has(a)); +} + +/** + * The row. `governed` is the matched slice from the imported matcher (empty ⇒ + * out of scope); `reviewed` is the logins that have SUBMITTED a review, or + * `null` when that leg was not read — three input states, never two (#4690): + * covered, uncovered, and uncovered-on-the-cheap-union-alone, which says so. + */ +export function h43GovernedReviewRequestGap(pr, governed, approvers, reviewed = null) { + const surfaces = governed ?? []; + const list = approvers ?? []; + if (surfaces.length === 0 || list.length === 0) return null; + const cheap = h43CheapCoverage(pr); + const submitted = reviewed == null ? null : new Set([...reviewed].map((l) => String(l))); + const missing = list.filter((a) => !cheap.has(a) && !(submitted?.has(a) ?? false)); + if (missing.length === 0) return null; + + const author = String(pr?.user?.login ?? ''); + const hits = surfaces.reduce((n, s) => n + (s.files?.length ?? 0), 0); + const named = surfaces + .slice(0, H43_SURFACE_LIST_CAP) + .map((s) => `\`${s.glob}\`×${s.files?.length ?? 0}`) + .join(', '); + const more = surfaces.length > H43_SURFACE_LIST_CAP ? `, +${surfaces.length - H43_SURFACE_LIST_CAP} more` : ''; + const named43 = missing.map((a) => `\`${a}\``).join(', '); + const asked = + missing.length === list.length + ? `has asked NOBODY — none of the ${list.length} account(s) in \`GOVERNED_APPROVERS\` (${named43}) ` + + 'is requested, assigned, or has submitted a review' + : `has not asked ${named43} — not requested, not assigned, no submitted review`; + const authorClause = missing.includes(author) + ? ` ⭐ \`${author}\` is this PR's own AUTHOR, so a review request naming it is IMPOSSIBLE — GitHub ` + + 'answers that with 422 — and the documented fallback is the one that was not taken: ASSIGN ' + + `\`${author}\` and request the other approver. Authorship alone is never read as coverage here, ` + + 'because "the author would surely look" is exactly the assumption that produced zero.' + : ''; + const legClause = + submitted == null + ? ' ⚠️ The submitted-review leg was NOT read for this PR (probe budget or a failed request), so ' + + 'this row stands on the request∪assignment union alone — an approver who has already SUBMITTED ' + + 'a review would clear it, and that reading is missing rather than negative.' + : ''; + return ( + `open and GOVERNED (${hits} changed file(s) on the register: ${named}${more}), and ${asked}. ` + + 'Being a DRAFT is neither why this fires nor why it would go quiet — a governed PR waiting as a ' + + 'draft for the human merge is the CORRECT terminal state of this regime, and it is still a state ' + + 'in which nobody has been asked to look.' + + authorClause + + ' Report-only patrol INPUT, not a verdict and not a gate: nothing can ship through this gap (the ' + + 'queue guard still refuses an unapproved governed enqueue), so what is missing is only that the ' + + 'person the regime protects was never asked. Remedy is the request itself, or the assign fallback ' + + 'above — ⛔ never a label, and ⛔ never an approving review from a seat.' + + legClause + ); +} + // --------------------------------------------------------------------------- // Report rendering — pure over (findings, counts), so `--self-test` pins both // media offline. The live sweep below picks a renderer and prints it; nothing @@ -7872,6 +8109,15 @@ export const SWEEP_COUNT_KEYS = [ 'conflictProbed', 'sharedFileCandidates', 'sharedFileProbed', + // H43's coverage triple and its fourth state (#14967) — the register that + // did not load. `governedRegisterReason` is a STRING, not a counter, and it + // rides the same contract for the same reason: without it the clause would + // render a NOT-MEASURED row as `0 of 0`, which is the exact confusion the + // enumeration above exists to end. + 'governedPrs', + 'governedReviewCandidates', + 'governedReviewProbed', + 'governedRegisterReason', 'liveFolds', 'memberReadCandidates', 'memberReadProbed', @@ -8168,6 +8414,22 @@ export function summaryLine(counts, findingCount) { `Shared-file holds (H36): changed-file page read on ${counts.sharedFileProbed ?? 0} of ` + `${counts.sharedFileCandidates ?? 0} open PR(s) — a pair needs both sides read, so a shortfall ` + 'can only MISS a hold, never invent one. ' + + // H43's coverage clause (#14967). It is UNCONDITIONAL, like every other + // window's: this row can be quiet for three different reasons — no governed + // PR is short of coverage, no file page was read, or the register itself + // did not load — and only the first is a clean board. The register's own + // availability leads the clause because it is the one that silences the + // whole row rather than bounding it. + `Governed review requests (H43): ${ + counts.governedRegisterReason + ? `NOT MEASURED — ${counts.governedRegisterReason}` + : `${counts.governedPrs ?? 0} of the open PR(s) whose changed-file page was read hit the ` + + `governed register, and the submitted-review leg answered on ${counts.governedReviewProbed ?? 0} ` + + `of ${counts.governedReviewCandidates ?? 0} that the request/assignment union already left ` + + `short (oldest-first, ${H43_REVIEW_PROBE_CAP} per run). An unread review leg leaves its row ` + + 'standing on the two cheap fields and the row says so; a PR whose file page went unread is ' + + 'not judged by this item at all' + }. ` + `Family folds (H37): ${counts.liveFolds ?? 0} live shared branch(es) claimed by more than their ` + `own chain head, and a member comment page read on ${counts.memberReadProbed ?? 0} of ` + `${counts.memberReadCandidates ?? 0} open \`pm:queue\` card(s) — that second read is bought ONLY ` + @@ -8246,6 +8508,7 @@ export const SUMMARY_CLAUSE_ANCHORS = [ ['h32Seats', 'Seat liveness (H32): '], ['h35GatePatrol', 'Gate-removal patrol (H35): '], ['h36SharedFiles', 'Shared-file holds (H36): '], + ['h43GovernedReviews', 'Governed review requests (H43): '], ['h37Folds', 'Family folds (H37): '], ['h40References', 'Dangling references (H40): '], ['reportOnly', 'Report-only: '], @@ -8562,7 +8825,8 @@ export const UNREGISTERED_FAMILY_BAND = 'unregistered'; * stall the card is stopped and no later sweep frees it: a block that * outlived or mis-names its blocker (H19/H26/H28), a dispatch that * never reached a branch or whose claimant is gone (H20/H27/H33), - * a PR that cannot land (H12/H16/H36), a seat or lane not moving + * a PR that cannot land (H12/H16/H36), a governed PR that nobody + * was asked to look at (H43), a seat or lane not moving * (H32/H38), a `pm:blocked` card with no machine-readable line at * all (H4). * state the board contradicts itself on a live card, and the repair is @@ -8590,6 +8854,7 @@ export const HALF_STATE_FAMILY_BAND = Object.freeze({ H33: 'stall', H36: 'stall', H38: 'stall', + H43: 'stall', H1: 'state', H2: 'state', @@ -9893,6 +10158,14 @@ async function sweep(options = {}) { // mode as H16's detail pass, so it owes the same `read X of Y`. sharedFileCandidates: 0, sharedFileProbed: 0, + // H43's coverage triple (#14967) — the governed slice of the PRs whose + // file page H36 already read, how many of those the cheap union left + // short, and how many review pages answered. `governedRegisterReason` is + // the fourth state: the row did not run at all, and why. + governedPrs: 0, + governedReviewCandidates: 0, + governedReviewProbed: 0, + governedRegisterReason: null, fallbackCandidates: 0, fallbackProbed: 0, // H9's coverage pair — `pm:on-hold` cards whose verdict the comment @@ -11365,6 +11638,70 @@ async function sweepInto(findings, seen, seenPrs, seenMerged, seenUnscoped, seen findings.push([pr, 'H36', hold36]); } + // H43 (#14967) — the governed-surface review-request gap, read off the SAME + // changed-file pages H36 just fetched: this row buys ZERO extra file + // requests. Its own request is the submitted-review leg, and only for a + // governed PR whose request/assignment union is already short — without that + // leg a PR an approver has ALREADY reviewed fires forever, because GitHub + // drops the pending request the moment the review lands. + // + // A register that would not load skips the pass and NAMES itself on the + // summary line (#4690): a sibling-repo copy of this sweeper carries no + // governed pair, and the alternative — a static import — would end that + // install's whole patrol at module load rather than this one row. + if (!GOVERNED_REGISTER.available) { + stats.governedRegisterReason = GOVERNED_REGISTER.reason; + } else { + const governedByPr = new Map(); + for (const pr of seenPrs.values()) { + const files = filesByPr.get(pr.number); + if (!files) continue; + const governed = GOVERNED_REGISTER.matcher(files.paths ?? []); + if (governed.length > 0) governedByPr.set(pr.number, governed); + } + stats.governedPrs = governedByPr.size; + + // Oldest-first, because the PR nobody has asked about for longest is the + // one the cap must not be the reason nobody hears about. + const shortOfCoverage = [...seenPrs.values()] + .filter((pr) => + h43NeedsReviewProbe(pr, governedByPr.get(pr.number)?.length ?? 0, GOVERNED_REGISTER.approvers), + ) + .sort((a, b) => String(a.created_at ?? '').localeCompare(String(b.created_at ?? ''))); + stats.governedReviewCandidates = shortOfCoverage.length; + + const reviewedByPr = new Map(); + for (const pr of shortOfCoverage.slice(0, H43_REVIEW_PROBE_CAP)) { + let reviews; + try { + reviews = await rest(`/repos/${OWNER_REPO}/pulls/${pr.number}/reviews?per_page=${H43_REVIEWS_PAGE_SIZE}`); + } catch { + // Per-PR and never fatal, H16's posture: the row still fires, carrying + // the sentence that says this leg is MISSING rather than negative. An + // all-failed pass needs no rethrow here — unlike H16's and H36's, this + // row's finding survives the failure instead of vanishing with it. + continue; + } + stats.governedReviewProbed = (stats.governedReviewProbed ?? 0) + 1; + reviewedByPr.set( + pr.number, + (Array.isArray(reviews) ? reviews : []).map((r) => String(r?.user?.login ?? '')).filter(Boolean), + ); + } + + for (const pr of seenPrs.values()) { + const governed = governedByPr.get(pr.number); + if (!governed) continue; + const gap = h43GovernedReviewRequestGap( + pr, + governed, + GOVERNED_REGISTER.approvers, + reviewedByPr.get(pr.number) ?? null, + ); + if (gap) findings.push([pr, 'H43', gap]); + } + } + // H8 — one bounded merged-PR listing (window note at the helper), matched // against the already-collected open `pm:dispatched` cards; no per-card fetch. // @@ -16997,6 +17334,124 @@ function selfTest() { t('H40 summary: a bare line renders numbers, never `undefined`', saidBy('h40References', summaryLine({}, 0)).includes('undefined'), false); t('H40 summary: every count key rides the enumerated contract', ['refDistinct', 'refCards', 'refThreads', 'refFree', 'refAttempted', 'refResolved', 'refDangling', 'refUnjudged', 'refDeferred', 'refFloor', 'refBeyond'].every((k) => SWEEP_COUNT_KEYS.includes(k)), true); + // -- H43 — the governed-surface review-request gap (#14967, report-only) --- + // + // The predicate is driven with the governed slice AS DATA and with the + // approver set INJECTED, which is also the point: no account name and no + // surface path is hardcoded in the predicate, so a case can prove the row is + // fully register-driven. The real register is pinned separately, below. + const h43pr = (number, extra = {}) => ({ + number, + html_url: `https://github.com/o/r/pull/${number}`, + draft: extra.draft ?? true, + created_at: extra.created_at ?? '2026-09-01T10:00:00Z', + user: { login: extra.author ?? 'claude[bot]' }, + requested_reviewers: (extra.requested ?? []).map((login) => ({ login })), + assignees: (extra.assigned ?? []).map((login) => ({ login })), + }); + const APP43 = ['os-zhuang', 'hotlong']; + const GOV43 = [{ id: 'adr', glob: 'docs/adr/**', what: 'architecture decision records', files: ['docs/adr/0121-x.md'] }]; + const h43row = (...args) => String(h43GovernedReviewRequestGap(...args) ?? ''); + + // ① The healthy governed PR: both accounts asked. This is the case the row + // must stay quiet on forever, or the anchor grows a permanent row. + t('H43: both approvers requested -> clean', h43GovernedReviewRequestGap(h43pr(1, { requested: APP43 }), GOV43, APP43, []), null); + t('H43: …assignment covers just as well as a request', h43GovernedReviewRequestGap(h43pr(1, { assigned: APP43 }), GOV43, APP43, []), null); + t('H43: …and a mix of the two fields covers', h43GovernedReviewRequestGap(h43pr(1, { requested: ['os-zhuang'], assigned: ['hotlong'] }), GOV43, APP43, []), null); + + // ② One account asked — the measured majority shape (7 of 10 governed PRs at + // the director sweep). The row must NAME the account nobody asked. + t('H43: one approver requested -> finding', typeof h43GovernedReviewRequestGap(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []), 'string'); + t('H43: …naming the account that was never asked', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`os-zhuang`'), true); + t('H43: …and NOT accusing the one that was', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`hotlong`'), false); + t('H43: …and naming the register hit that makes it governed', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`docs/adr/**`×1'), true); + + // ③ Nobody asked at all — two of the ten, both ADR records. + t('H43: nobody requested -> finding', typeof h43GovernedReviewRequestGap(h43pr(3), GOV43, APP43, []), 'string'); + t('H43: …and it says NOBODY rather than listing a partial gap', h43row(h43pr(3), GOV43, APP43, []).includes('has asked NOBODY'), true); + t('H43: …still naming BOTH accounts, so the remedy needs no lookup', /`os-zhuang`[\s\S]*`hotlong`/.test(h43row(h43pr(3), GOV43, APP43, [])), true); + + // ④ + ⑤ The author-identity case, which is the one that silently produces + // ZERO coverage: a request naming the PR's own author is a 422, so the + // documented fallback is to ASSIGN that account and request the other. + t('H43: approver-authored WITH the assign fallback taken -> clean', h43GovernedReviewRequestGap(h43pr(4, { author: 'hotlong', assigned: ['hotlong'], requested: ['os-zhuang'] }), GOV43, APP43, []), null); + t('H43: approver-authored WITHOUT it -> finding', typeof h43GovernedReviewRequestGap(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []), 'string'); + t('H43: …⛔ authorship alone is never coverage', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('`hotlong`'), true); + t('H43: …and the sentence says the request is impossible, not forgotten', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('422'), true); + t('H43: …naming the fallback that WAS documented and was not taken', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('ASSIGN'), true); + // The other half of the same PR: the non-author approver is an ordinary miss + // and must not inherit the author sentence. + t('H43: a non-author approver gets no 422 clause', h43row(h43pr(6, { author: 'someone-else', requested: ['hotlong'] }), GOV43, APP43, []).includes('422'), false); + + // ⑥ A SUBMITTED review counts as coverage — and it must, because GitHub + // removes the pending request the moment the review lands. Measured live + // while this row was written: an open governed PR requesting `hotlong` with a + // submitted review by `os-zhuang` reads as fully covered, and the two-field + // union alone called it unasked. + t('H43: a submitted review covers its author\'s approver slot', h43GovernedReviewRequestGap(h43pr(7, { requested: ['hotlong'] }), GOV43, APP43, ['os-zhuang']), null); + t('H43: …and an unrelated reviewer covers nothing', typeof h43GovernedReviewRequestGap(h43pr(7, { requested: ['hotlong'] }), GOV43, APP43, ['some-dev']), 'string'); + + // ⑦ Not governed: out of scope entirely, however empty the request list is. + t('H43: a non-governed PR with nobody requested -> clean', h43GovernedReviewRequestGap(h43pr(8), [], APP43, []), null); + + // Three input states, never two (#4690): the review leg can be MISSING, and + // a row that stands on the cheap union alone says so rather than asserting. + t('H43: an unread review leg is declared, not assumed negative', h43row(h43pr(9), GOV43, APP43, null).includes('NOT read'), true); + t('H43: …and a read one makes no such claim', h43row(h43pr(9), GOV43, APP43, []).includes('NOT read'), false); + + // Draft status decides nothing in either direction — a governed PR waiting as + // a draft for the human merge is the regime's CORRECT terminal state. + t('H43: a ready governed PR fires the same as a draft', h43row(h43pr(10, { draft: false }), GOV43, APP43, []), h43row(h43pr(10, { draft: true }), GOV43, APP43, [])); + t('H43: …and the row says being a draft is not the point', h43row(h43pr(10), GOV43, APP43, []).includes('DRAFT'), true); + + // ⛔ No name and no surface is hardcoded: an entirely different approver set + // drives the row, which is what "imported, never restated" has to mean. + t('H43: the approver set is INJECTED, never baked in', h43GovernedReviewRequestGap(h43pr(11, { requested: ['some-other-account'] }), GOV43, ['some-other-account'], []), null); + t('H43: an empty approver set can never fire', h43GovernedReviewRequestGap(h43pr(11), GOV43, [], []), null); + + // The gathering policy: a request is bought only for a governed PR the cheap + // fields already leave short. Never narrower than the population it feeds. + t('H43 policy: a non-governed PR buys no review page', h43NeedsReviewProbe(h43pr(12), 0, APP43), false); + t('H43 policy: a governed PR already covered buys none either', h43NeedsReviewProbe(h43pr(12, { requested: APP43 }), 1, APP43), false); + t('H43 policy: a governed PR short of coverage does', h43NeedsReviewProbe(h43pr(12, { requested: ['hotlong'] }), 1, APP43), true); + t('H43 policy: …and one with nobody asked, obviously', h43NeedsReviewProbe(h43pr(12), 1, APP43), true); + t('H43: the cheap union reads BOTH list fields', [...h43CheapCoverage(h43pr(13, { requested: ['a'], assigned: ['b'] }))].sort().join(','), 'a,b'); + + // The row is a `stall`, not a gate: nothing ships wrong through this gap — + // the queue guard still refuses an unapproved governed enqueue — but the PR + // is stopped and no other sweep moves it. + t('H43 band: registered as a stall', familyBand('H43'), 'stall'); + t('H43 band: …and the sweep really pushes it, so the registry sees it', familyRegistryCoverage().emitted.includes('H43'), true); + t('H43: the row states its report-only posture', h43row(h43pr(14), GOV43, APP43, []).includes('not a verdict and not a gate'), true); + + // The REGISTER, pinned against the real imported modules rather than a + // fabricated pair. ⚠️ This is the positive control that a rename in either + // sibling reddens here instead of going quiet on four unattended runs a day; + // an install that copied this sweeper WITHOUT the governed pair answers with + // its own NOT MEASURED reason instead, which is the correct signal for it. + const register43 = GOVERNED_REGISTER.available + ? `${GOVERNED_REGISTER.matcher(['docs/adr/0121-x.md']).length > 0}/${GOVERNED_REGISTER.matcher(['packages/core/src/x.ts']).length > 0}/${GOVERNED_REGISTER.approvers.length >= 2}` + : `NOT MEASURED — ${GOVERNED_REGISTER.reason}`; + t('H43 register: the imported matcher answers governed and clear, and the approver set is non-empty', register43, 'true/false/true'); + t('H43 register: the load is three-state — resolved, or a NAMED reason, never silently absent', GOVERNED_REGISTER.available || typeof GOVERNED_REGISTER.reason === 'string', true); + t('H43 register: a missing sibling names the two files to copy', governedRegisterFailure({ code: 'ERR_MODULE_NOT_FOUND' }).includes('check-governed-queue-guard.mjs'), true); + t('H43 register: …and says the rest of the sweep is unaffected', governedRegisterFailure({ code: 'ERR_MODULE_NOT_FOUND' }).includes('every other row is unaffected'), true); + t('H43 register: any other load failure carries its own message', governedRegisterFailure(new Error('boom')).includes('boom'), true); + + // The coverage clause, both branches, cut out of the summary line so only + // H43's own words can answer for H43. + // ⚠️ The forwarding contract, and the reason this case exists at all: the + // live sweep on the day this row landed rendered `0 of the open PR(s) …` + // while filing FOUR H43 rows, because the counters were computed and never + // copied into `counts`. That is the documented failure this enumeration was + // built to end — `counts.x ?? 0` renders a missing key and a real zero + // identically — and it reappears the moment a new row forgets the list. + t('H43: every count key rides the enumerated forwarding contract', ['governedPrs', 'governedReviewCandidates', 'governedReviewProbed', 'governedRegisterReason'].every((k) => SWEEP_COUNT_KEYS.includes(k)), true); + t('H43 summary: the triple is reported', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('8 of the open PR(s)'), true); + t('H43 summary: …with the review leg named as a subset', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('answered on 5 of 5'), true); + t('H43 summary: an unloadable register reports NOT MEASURED, never 0 of 0', saidBy('h43GovernedReviews', summaryLine({ governedRegisterReason: 'the pair is not installed' }, 0)).includes('NOT MEASURED — the pair is not installed'), true); + t('H43 summary: …and then claims no governed population at all', saidBy('h43GovernedReviews', summaryLine({ governedRegisterReason: 'the pair is not installed' }, 0)).includes('hit the governed register'), false); + // -- The `[::]` collapse (#12090): behaviour-preserving, asserted as such --- // The class held U+003A TWICE, never the fullwidth U+FF1A its shape implied. // These cases pin that the collapse changed nothing a reader could observe.