From 400b95c6fc056286f92995dbae4b0d3b875f2a09 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 19:33:47 +0000 Subject: [PATCH 1/2] tooling(pm): the half-state patrol reports a governed PR nobody was asked to review (H43) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A governed-surface PR could sit open for days with no review request or assignment to either `GOVERNED_APPROVERS` member, and no mechanical reading covered that state: the queue guard asks about an approval at enqueue time, the governed-merge audit is post-hoc, and every label-keyed row in this patrol is blind to pull requests. Seven of ten open governed PRs across the four repos were missing `os-zhuang` and two had asked nobody, until the maintainer asked why no review requests were showing up. H43 is one report-only row over the changed-file pages H36 already fetches, so it buys zero extra file requests. Coverage is the union of `requested_reviewers`, `assignees` and accounts that have already SUBMITTED a review — the third leg is load-bearing because GitHub drops a pending request the moment its review lands, and the second encodes the documented author-identity fallback (assign the approver who cannot be requested, request the other). Authorship alone is never read as coverage: that assumption is what produced zero. `GOVERNED_SURFACES`/`governedPathsIn` and `GOVERNED_APPROVERS` are imported, not restated, and loaded LAZILY: this file is copied verbatim into sibling repos that carry no governed pair, where a static import would end the whole patrol at module load instead of degrading one row. An absent register reports itself as NOT MEASURED with the remedy, and every other row is untouched. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox --- scripts/pm/check-half-states.mjs | 441 ++++++++++++++++++++++++++++++- 1 file changed, 440 insertions(+), 1 deletion(-) diff --git a/scripts/pm/check-half-states.mjs b/scripts/pm/check-half-states.mjs index 44331c47ba..472faf9a85 100644 --- a/scripts/pm/check-half-states.mjs +++ b/scripts/pm/check-half-states.mjs @@ -7764,6 +7764,243 @@ export function renderDanglingReferences(report, { markdown = false } = {}) { return head; } +// --------------------------------------------------------------------------- +// H43 — an open GOVERNED-SURFACE PR that has asked NEITHER approver to look +// (#14967). +// +// ## The state nothing could read, and the question that found it +// +// The maintainer asked, verbatim: 「pr清单中哪些是需要我审核的,比如adr这些,为什 +// 么我没看到审核请求,是skills的问题吗?」 — and the director sweep behind that +// question measured, across the four governed repos, TEN open PRs hitting the +// governed register, of which SEVEN had never asked `os-zhuang` and TWO had +// asked nobody at all. Two of them were ADR records. They had waited two days. +// +// ⭐ The protocol TEXT is not the defect and this row does not touch it: the +// dispatch skill's ACCEPT path already says to request BOTH accounts, and a +// request to `os-zhuang` succeeded during that same sweep. What was missing is +// a READING. The three instruments that look at governed PRs each answer a +// different question: the queue guard asks whether an AUTHORIZED APPROVAL +// exists at enqueue time (too late, and a governed PR is not supposed to reach +// the queue at all), the governed-merge audit is post-hoc, and every row in +// this file keyed on `pm:*` labels cannot see a pull request — PRs carry none. +// +// ## Why ONE requested account is worse than it looks, which is the whole row +// +// `hotlong` is also the login the maintainer's own sessions run as, AND the +// author of some governed PRs. A request addressed only to it either lands in +// the account that made it, or cannot be made at all — GitHub answers a review +// request naming the PR's own author with 422. Meanwhile the account the +// maintainer actually reads is never asked. So "requested one of the two" is +// not half a channel; on an approver-authored PR it is frequently zero. +// +// ⇒ Coverage here is a UNION over three fields, and each term is load-bearing: +// +// requested_reviewers the request itself, the channel the protocol names. +// assignees the DOCUMENTED FALLBACK for the author-identity case +// — assign the approver who cannot be requested, and +// request the other. ⛔ Authorship alone never counts: +// the fallback is covered only when it was TAKEN, which +// is exactly the case that silently produced zero. +// submitted reviews GitHub REMOVES a pending request the moment that +// reviewer submits a review, so without this leg the +// healthiest possible governed PR — one an approver has +// already reviewed — fires this row forever. Measured +// live while this row was written: one open governed PR +// carried `requested_reviewers = [hotlong]` with a +// submitted review by `os-zhuang`, and the two-field +// union alone reported it as unasked. +// +// ## Report-only, and pointedly so +// +// ⛔ Nothing can ship wrong through this gap: the queue guard still refuses an +// unapproved governed enqueue and a human merge is still the review record. The +// failure is THROUGHPUT and VISIBILITY — 「一个只有在被保护的人自己发现它缺席时 +// 才显形的治理通道,不是通道」 — so the remedy is a REQUEST (or the assign +// fallback), never a label written from here and never a gate. A governed PR +// sitting as a DRAFT is the CORRECT terminal state of this regime, so draft +// status neither fires this row nor silences it. +// +// ## The register is IMPORTED, never restated — and never fatally +// +// `GOVERNED_SURFACES`/`governedPathsIn` (the one file-list matcher, shared with +// the queue guard and with the pre-arm `--test` verdict a seat runs before it +// flips ready) and `GOVERNED_APPROVERS` (the 2026-08-27 authorized set) are the +// single source for both halves of this predicate. A third matcher here would +// be a register that can drift from the one the guard enforces. +// +// ⚠️ But this file TRAVELS. Its adopt list is "copy these files, unchanged" +// into each sibling repo, and a sibling install carries the sweeper and its +// `invoked-as` helper and nothing else — measured while this row was written: +// objectui's `scripts/pm/` holds this file alone. A static `import` of the +// governed pair would therefore not degrade that install, it would KILL it: +// `ERR_MODULE_NOT_FOUND` at module load, exit 1, before a single predicate +// runs — which is precisely the incident the patrol workflow's own adopt list +// records against `invoked-as.mjs`, and it would take H1–H42 down with it to +// buy H43. So the register is loaded LAZILY and its absence is NAMED: this row +// alone reports NOT MEASURED, with the reason and the remedy, and the rest of +// the sweep is untouched. #4690's rule decides the wording — an input that +// could not be read must never render as an input that was clean. +// +// ## What it costs per run, and the two bounds +// +// ZERO extra changed-file requests: the pages are H36's, already fetched for +// the population this row needs (`h36NeedsFiles` is wider than governed). The +// one request this row buys is the submitted-review leg, and only for a +// governed PR whose request∪assignment union is ALREADY short — on the live +// board this landed against, 30 open PRs, 29 file pages already in hand, 8 +// governed, 5 review probes. Both bounds are honest about what they hide: a +// candidate past `H43_REVIEW_PROBE_CAP` (oldest-first, because the oldest +// unasked PR is the worst one) and a probe that failed both leave the row on +// the two-field union with a sentence that SAYS so, and a PR whose file page +// went unread is not judged here at all — the coverage clause carries both. +// --------------------------------------------------------------------------- + +/** + * The review pages this row reads per run, and one page's size. The cap is the + * request budget, not a render budget: the governed slice of an open board has + * been ~8 of 30 with ~5 short of coverage, so 25 is several times the measured + * worst case and still bounds a pathological board to one page each. + */ +export const H43_REVIEW_PROBE_CAP = 25; +export const H43_REVIEWS_PAGE_SIZE = 100; + +/** Approvers named inline before the sentence degrades to a count. */ +export const H43_SURFACE_LIST_CAP = 4; + +/** + * Why the register would not load, as a sentence a sibling install can act on. + * Pure, so the self-test pins the wording that a live absence would otherwise + * only produce on a repo nobody is looking at. + */ +export function governedRegisterFailure(err) { + if (String(err?.code ?? '') === 'ERR_MODULE_NOT_FOUND') { + return ( + 'the governed register is not installed beside this file — H43 needs `check-governed-merges.mjs` ' + + '(the `GOVERNED_SURFACES` matcher) and `check-governed-queue-guard.mjs` (`GOVERNED_APPROVERS`), ' + + 'which a sibling-repo copy of this sweeper does not carry. Copy the pair to enable this row; ' + + 'every other row is unaffected' + ); + } + return `the governed register would not load: ${String(err?.message ?? err ?? 'unknown error')}`; +} + +/** + * The register, resolved once per process and never fatally. Injectable so a + * caller can drive it without touching the filesystem; the default resolves + * both specifiers relative to THIS file, which is what makes the sibling-repo + * absence a catchable `ERR_MODULE_NOT_FOUND` rather than a load-time death. + */ +export async function loadGovernedRegister(load = (specifier) => import(specifier)) { + try { + const [merges, guard] = await Promise.all([ + load('./check-governed-merges.mjs'), + load('./check-governed-queue-guard.mjs'), + ]); + const matcher = merges?.governedPathsIn; + const approvers = guard?.GOVERNED_APPROVERS; + if (typeof matcher !== 'function' || !Array.isArray(approvers) || approvers.length === 0) { + return { + available: false, + matcher: null, + approvers: [], + reason: + 'the governed register loaded but did not export what this row reads — `governedPathsIn` ' + + 'and a non-empty `GOVERNED_APPROVERS`. A rename is the likely cause, and this row is the ' + + 'reader that noticed', + }; + } + return { available: true, matcher, approvers, reason: null }; + } catch (err) { + return { available: false, matcher: null, approvers: [], reason: governedRegisterFailure(err) }; + } +} + +/** + * Resolved at module evaluation, so the offline self-test can drive the real + * register rather than a fabricated approver list — a rename in either sibling + * reddens HERE, where a reader is looking, instead of going quiet on the four + * scheduled runs a day that nobody watches. + */ +export const GOVERNED_REGISTER = await loadGovernedRegister(); + +/** + * The two fields a PR LIST row already carries. No request buys this, which is + * why the review leg below is bought only when this set is already short. + */ +export function h43CheapCoverage(pr) { + const logins = new Set(); + for (const u of pr?.requested_reviewers ?? []) if (u?.login) logins.add(String(u.login)); + for (const u of pr?.assignees ?? []) if (u?.login) logins.add(String(u.login)); + return logins; +} + +/** + * The gathering policy, H16's idiom: answerable from the LIST row plus the + * file page already in hand, and never NARROWER than the population it feeds. + * A governed PR whose two cheap fields already cover every approver is DECIDED + * — no row can fire — so its review page is a request nobody needs. + */ +export function h43NeedsReviewProbe(pr, governedCount, approvers) { + if (!(governedCount > 0)) return false; + const cheap = h43CheapCoverage(pr); + return (approvers ?? []).some((a) => !cheap.has(a)); +} + +/** + * The row. `governed` is the matched slice from the imported matcher (empty ⇒ + * out of scope); `reviewed` is the logins that have SUBMITTED a review, or + * `null` when that leg was not read — three input states, never two (#4690): + * covered, uncovered, and uncovered-on-the-cheap-union-alone, which says so. + */ +export function h43GovernedReviewRequestGap(pr, governed, approvers, reviewed = null) { + const surfaces = governed ?? []; + const list = approvers ?? []; + if (surfaces.length === 0 || list.length === 0) return null; + const cheap = h43CheapCoverage(pr); + const submitted = reviewed == null ? null : new Set([...reviewed].map((l) => String(l))); + const missing = list.filter((a) => !cheap.has(a) && !(submitted?.has(a) ?? false)); + if (missing.length === 0) return null; + + const author = String(pr?.user?.login ?? ''); + const hits = surfaces.reduce((n, s) => n + (s.files?.length ?? 0), 0); + const named = surfaces + .slice(0, H43_SURFACE_LIST_CAP) + .map((s) => `\`${s.glob}\`×${s.files?.length ?? 0}`) + .join(', '); + const more = surfaces.length > H43_SURFACE_LIST_CAP ? `, +${surfaces.length - H43_SURFACE_LIST_CAP} more` : ''; + const named43 = missing.map((a) => `\`${a}\``).join(', '); + const asked = + missing.length === list.length + ? `has asked NOBODY — none of the ${list.length} account(s) in \`GOVERNED_APPROVERS\` (${named43}) ` + + 'is requested, assigned, or has submitted a review' + : `has not asked ${named43} — not requested, not assigned, no submitted review`; + const authorClause = missing.includes(author) + ? ` ⭐ \`${author}\` is this PR's own AUTHOR, so a review request naming it is IMPOSSIBLE — GitHub ` + + 'answers that with 422 — and the documented fallback is the one that was not taken: ASSIGN ' + + `\`${author}\` and request the other approver. Authorship alone is never read as coverage here, ` + + 'because "the author would surely look" is exactly the assumption that produced zero.' + : ''; + const legClause = + submitted == null + ? ' ⚠️ The submitted-review leg was NOT read for this PR (probe budget or a failed request), so ' + + 'this row stands on the request∪assignment union alone — an approver who has already SUBMITTED ' + + 'a review would clear it, and that reading is missing rather than negative.' + : ''; + return ( + `open and GOVERNED (${hits} changed file(s) on the register: ${named}${more}), and ${asked}. ` + + 'Being a DRAFT is neither why this fires nor why it would go quiet — a governed PR waiting as a ' + + 'draft for the human merge is the CORRECT terminal state of this regime, and it is still a state ' + + 'in which nobody has been asked to look.' + + authorClause + + ' Report-only patrol INPUT, not a verdict and not a gate: nothing can ship through this gap (the ' + + 'queue guard still refuses an unapproved governed enqueue), so what is missing is only that the ' + + 'person the regime protects was never asked. Remedy is the request itself, or the assign fallback ' + + 'above — ⛔ never a label, and ⛔ never an approving review from a seat.' + + legClause + ); +} + // --------------------------------------------------------------------------- // Report rendering — pure over (findings, counts), so `--self-test` pins both // media offline. The live sweep below picks a renderer and prints it; nothing @@ -8168,6 +8405,22 @@ export function summaryLine(counts, findingCount) { `Shared-file holds (H36): changed-file page read on ${counts.sharedFileProbed ?? 0} of ` + `${counts.sharedFileCandidates ?? 0} open PR(s) — a pair needs both sides read, so a shortfall ` + 'can only MISS a hold, never invent one. ' + + // H43's coverage clause (#14967). It is UNCONDITIONAL, like every other + // window's: this row can be quiet for three different reasons — no governed + // PR is short of coverage, no file page was read, or the register itself + // did not load — and only the first is a clean board. The register's own + // availability leads the clause because it is the one that silences the + // whole row rather than bounding it. + `Governed review requests (H43): ${ + counts.governedRegisterReason + ? `NOT MEASURED — ${counts.governedRegisterReason}` + : `${counts.governedPrs ?? 0} of the open PR(s) whose changed-file page was read hit the ` + + `governed register, and the submitted-review leg answered on ${counts.governedReviewProbed ?? 0} ` + + `of ${counts.governedReviewCandidates ?? 0} that the request/assignment union already left ` + + `short (oldest-first, ${H43_REVIEW_PROBE_CAP} per run). An unread review leg leaves its row ` + + 'standing on the two cheap fields and the row says so; a PR whose file page went unread is ' + + 'not judged by this item at all' + }. ` + `Family folds (H37): ${counts.liveFolds ?? 0} live shared branch(es) claimed by more than their ` + `own chain head, and a member comment page read on ${counts.memberReadProbed ?? 0} of ` + `${counts.memberReadCandidates ?? 0} open \`pm:queue\` card(s) — that second read is bought ONLY ` + @@ -8246,6 +8499,7 @@ export const SUMMARY_CLAUSE_ANCHORS = [ ['h32Seats', 'Seat liveness (H32): '], ['h35GatePatrol', 'Gate-removal patrol (H35): '], ['h36SharedFiles', 'Shared-file holds (H36): '], + ['h43GovernedReviews', 'Governed review requests (H43): '], ['h37Folds', 'Family folds (H37): '], ['h40References', 'Dangling references (H40): '], ['reportOnly', 'Report-only: '], @@ -8562,7 +8816,8 @@ export const UNREGISTERED_FAMILY_BAND = 'unregistered'; * stall the card is stopped and no later sweep frees it: a block that * outlived or mis-names its blocker (H19/H26/H28), a dispatch that * never reached a branch or whose claimant is gone (H20/H27/H33), - * a PR that cannot land (H12/H16/H36), a seat or lane not moving + * a PR that cannot land (H12/H16/H36), a governed PR that nobody + * was asked to look at (H43), a seat or lane not moving * (H32/H38), a `pm:blocked` card with no machine-readable line at * all (H4). * state the board contradicts itself on a live card, and the repair is @@ -8590,6 +8845,7 @@ export const HALF_STATE_FAMILY_BAND = Object.freeze({ H33: 'stall', H36: 'stall', H38: 'stall', + H43: 'stall', H1: 'state', H2: 'state', @@ -9893,6 +10149,14 @@ async function sweep(options = {}) { // mode as H16's detail pass, so it owes the same `read X of Y`. sharedFileCandidates: 0, sharedFileProbed: 0, + // H43's coverage triple (#14967) — the governed slice of the PRs whose + // file page H36 already read, how many of those the cheap union left + // short, and how many review pages answered. `governedRegisterReason` is + // the fourth state: the row did not run at all, and why. + governedPrs: 0, + governedReviewCandidates: 0, + governedReviewProbed: 0, + governedRegisterReason: null, fallbackCandidates: 0, fallbackProbed: 0, // H9's coverage pair — `pm:on-hold` cards whose verdict the comment @@ -11365,6 +11629,70 @@ async function sweepInto(findings, seen, seenPrs, seenMerged, seenUnscoped, seen findings.push([pr, 'H36', hold36]); } + // H43 (#14967) — the governed-surface review-request gap, read off the SAME + // changed-file pages H36 just fetched: this row buys ZERO extra file + // requests. Its own request is the submitted-review leg, and only for a + // governed PR whose request/assignment union is already short — without that + // leg a PR an approver has ALREADY reviewed fires forever, because GitHub + // drops the pending request the moment the review lands. + // + // A register that would not load skips the pass and NAMES itself on the + // summary line (#4690): a sibling-repo copy of this sweeper carries no + // governed pair, and the alternative — a static import — would end that + // install's whole patrol at module load rather than this one row. + if (!GOVERNED_REGISTER.available) { + stats.governedRegisterReason = GOVERNED_REGISTER.reason; + } else { + const governedByPr = new Map(); + for (const pr of seenPrs.values()) { + const files = filesByPr.get(pr.number); + if (!files) continue; + const governed = GOVERNED_REGISTER.matcher(files.paths ?? []); + if (governed.length > 0) governedByPr.set(pr.number, governed); + } + stats.governedPrs = governedByPr.size; + + // Oldest-first, because the PR nobody has asked about for longest is the + // one the cap must not be the reason nobody hears about. + const shortOfCoverage = [...seenPrs.values()] + .filter((pr) => + h43NeedsReviewProbe(pr, governedByPr.get(pr.number)?.length ?? 0, GOVERNED_REGISTER.approvers), + ) + .sort((a, b) => String(a.created_at ?? '').localeCompare(String(b.created_at ?? ''))); + stats.governedReviewCandidates = shortOfCoverage.length; + + const reviewedByPr = new Map(); + for (const pr of shortOfCoverage.slice(0, H43_REVIEW_PROBE_CAP)) { + let reviews; + try { + reviews = await rest(`/repos/${OWNER_REPO}/pulls/${pr.number}/reviews?per_page=${H43_REVIEWS_PAGE_SIZE}`); + } catch { + // Per-PR and never fatal, H16's posture: the row still fires, carrying + // the sentence that says this leg is MISSING rather than negative. An + // all-failed pass needs no rethrow here — unlike H16's and H36's, this + // row's finding survives the failure instead of vanishing with it. + continue; + } + stats.governedReviewProbed = (stats.governedReviewProbed ?? 0) + 1; + reviewedByPr.set( + pr.number, + (Array.isArray(reviews) ? reviews : []).map((r) => String(r?.user?.login ?? '')).filter(Boolean), + ); + } + + for (const pr of seenPrs.values()) { + const governed = governedByPr.get(pr.number); + if (!governed) continue; + const gap = h43GovernedReviewRequestGap( + pr, + governed, + GOVERNED_REGISTER.approvers, + reviewedByPr.get(pr.number) ?? null, + ); + if (gap) findings.push([pr, 'H43', gap]); + } + } + // H8 — one bounded merged-PR listing (window note at the helper), matched // against the already-collected open `pm:dispatched` cards; no per-card fetch. // @@ -16997,6 +17325,117 @@ function selfTest() { t('H40 summary: a bare line renders numbers, never `undefined`', saidBy('h40References', summaryLine({}, 0)).includes('undefined'), false); t('H40 summary: every count key rides the enumerated contract', ['refDistinct', 'refCards', 'refThreads', 'refFree', 'refAttempted', 'refResolved', 'refDangling', 'refUnjudged', 'refDeferred', 'refFloor', 'refBeyond'].every((k) => SWEEP_COUNT_KEYS.includes(k)), true); + // -- H43 — the governed-surface review-request gap (#14967, report-only) --- + // + // The predicate is driven with the governed slice AS DATA and with the + // approver set INJECTED, which is also the point: no account name and no + // surface path is hardcoded in the predicate, so a case can prove the row is + // fully register-driven. The real register is pinned separately, below. + const h43pr = (number, extra = {}) => ({ + number, + html_url: `https://github.com/o/r/pull/${number}`, + draft: extra.draft ?? true, + created_at: extra.created_at ?? '2026-09-01T10:00:00Z', + user: { login: extra.author ?? 'claude[bot]' }, + requested_reviewers: (extra.requested ?? []).map((login) => ({ login })), + assignees: (extra.assigned ?? []).map((login) => ({ login })), + }); + const APP43 = ['os-zhuang', 'hotlong']; + const GOV43 = [{ id: 'adr', glob: 'docs/adr/**', what: 'architecture decision records', files: ['docs/adr/0121-x.md'] }]; + const h43row = (...args) => String(h43GovernedReviewRequestGap(...args) ?? ''); + + // ① The healthy governed PR: both accounts asked. This is the case the row + // must stay quiet on forever, or the anchor grows a permanent row. + t('H43: both approvers requested -> clean', h43GovernedReviewRequestGap(h43pr(1, { requested: APP43 }), GOV43, APP43, []), null); + t('H43: …assignment covers just as well as a request', h43GovernedReviewRequestGap(h43pr(1, { assigned: APP43 }), GOV43, APP43, []), null); + t('H43: …and a mix of the two fields covers', h43GovernedReviewRequestGap(h43pr(1, { requested: ['os-zhuang'], assigned: ['hotlong'] }), GOV43, APP43, []), null); + + // ② One account asked — the measured majority shape (7 of 10 governed PRs at + // the director sweep). The row must NAME the account nobody asked. + t('H43: one approver requested -> finding', typeof h43GovernedReviewRequestGap(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []), 'string'); + t('H43: …naming the account that was never asked', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`os-zhuang`'), true); + t('H43: …and NOT accusing the one that was', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`hotlong`'), false); + t('H43: …and naming the register hit that makes it governed', h43row(h43pr(2, { requested: ['hotlong'] }), GOV43, APP43, []).includes('`docs/adr/**`×1'), true); + + // ③ Nobody asked at all — two of the ten, both ADR records. + t('H43: nobody requested -> finding', typeof h43GovernedReviewRequestGap(h43pr(3), GOV43, APP43, []), 'string'); + t('H43: …and it says NOBODY rather than listing a partial gap', h43row(h43pr(3), GOV43, APP43, []).includes('has asked NOBODY'), true); + t('H43: …still naming BOTH accounts, so the remedy needs no lookup', /`os-zhuang`[\s\S]*`hotlong`/.test(h43row(h43pr(3), GOV43, APP43, [])), true); + + // ④ + ⑤ The author-identity case, which is the one that silently produces + // ZERO coverage: a request naming the PR's own author is a 422, so the + // documented fallback is to ASSIGN that account and request the other. + t('H43: approver-authored WITH the assign fallback taken -> clean', h43GovernedReviewRequestGap(h43pr(4, { author: 'hotlong', assigned: ['hotlong'], requested: ['os-zhuang'] }), GOV43, APP43, []), null); + t('H43: approver-authored WITHOUT it -> finding', typeof h43GovernedReviewRequestGap(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []), 'string'); + t('H43: …⛔ authorship alone is never coverage', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('`hotlong`'), true); + t('H43: …and the sentence says the request is impossible, not forgotten', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('422'), true); + t('H43: …naming the fallback that WAS documented and was not taken', h43row(h43pr(5, { author: 'hotlong' }), GOV43, APP43, []).includes('ASSIGN'), true); + // The other half of the same PR: the non-author approver is an ordinary miss + // and must not inherit the author sentence. + t('H43: a non-author approver gets no 422 clause', h43row(h43pr(6, { author: 'someone-else', requested: ['hotlong'] }), GOV43, APP43, []).includes('422'), false); + + // ⑥ A SUBMITTED review counts as coverage — and it must, because GitHub + // removes the pending request the moment the review lands. Measured live + // while this row was written: an open governed PR requesting `hotlong` with a + // submitted review by `os-zhuang` reads as fully covered, and the two-field + // union alone called it unasked. + t('H43: a submitted review covers its author\'s approver slot', h43GovernedReviewRequestGap(h43pr(7, { requested: ['hotlong'] }), GOV43, APP43, ['os-zhuang']), null); + t('H43: …and an unrelated reviewer covers nothing', typeof h43GovernedReviewRequestGap(h43pr(7, { requested: ['hotlong'] }), GOV43, APP43, ['some-dev']), 'string'); + + // ⑦ Not governed: out of scope entirely, however empty the request list is. + t('H43: a non-governed PR with nobody requested -> clean', h43GovernedReviewRequestGap(h43pr(8), [], APP43, []), null); + + // Three input states, never two (#4690): the review leg can be MISSING, and + // a row that stands on the cheap union alone says so rather than asserting. + t('H43: an unread review leg is declared, not assumed negative', h43row(h43pr(9), GOV43, APP43, null).includes('NOT read'), true); + t('H43: …and a read one makes no such claim', h43row(h43pr(9), GOV43, APP43, []).includes('NOT read'), false); + + // Draft status decides nothing in either direction — a governed PR waiting as + // a draft for the human merge is the regime's CORRECT terminal state. + t('H43: a ready governed PR fires the same as a draft', h43row(h43pr(10, { draft: false }), GOV43, APP43, []), h43row(h43pr(10, { draft: true }), GOV43, APP43, [])); + t('H43: …and the row says being a draft is not the point', h43row(h43pr(10), GOV43, APP43, []).includes('DRAFT'), true); + + // ⛔ No name and no surface is hardcoded: an entirely different approver set + // drives the row, which is what "imported, never restated" has to mean. + t('H43: the approver set is INJECTED, never baked in', h43GovernedReviewRequestGap(h43pr(11, { requested: ['some-other-account'] }), GOV43, ['some-other-account'], []), null); + t('H43: an empty approver set can never fire', h43GovernedReviewRequestGap(h43pr(11), GOV43, [], []), null); + + // The gathering policy: a request is bought only for a governed PR the cheap + // fields already leave short. Never narrower than the population it feeds. + t('H43 policy: a non-governed PR buys no review page', h43NeedsReviewProbe(h43pr(12), 0, APP43), false); + t('H43 policy: a governed PR already covered buys none either', h43NeedsReviewProbe(h43pr(12, { requested: APP43 }), 1, APP43), false); + t('H43 policy: a governed PR short of coverage does', h43NeedsReviewProbe(h43pr(12, { requested: ['hotlong'] }), 1, APP43), true); + t('H43 policy: …and one with nobody asked, obviously', h43NeedsReviewProbe(h43pr(12), 1, APP43), true); + t('H43: the cheap union reads BOTH list fields', [...h43CheapCoverage(h43pr(13, { requested: ['a'], assigned: ['b'] }))].sort().join(','), 'a,b'); + + // The row is a `stall`, not a gate: nothing ships wrong through this gap — + // the queue guard still refuses an unapproved governed enqueue — but the PR + // is stopped and no other sweep moves it. + t('H43 band: registered as a stall', familyBand('H43'), 'stall'); + t('H43 band: …and the sweep really pushes it, so the registry sees it', familyRegistryCoverage().emitted.includes('H43'), true); + t('H43: the row states its report-only posture', h43row(h43pr(14), GOV43, APP43, []).includes('not a verdict and not a gate'), true); + + // The REGISTER, pinned against the real imported modules rather than a + // fabricated pair. ⚠️ This is the positive control that a rename in either + // sibling reddens here instead of going quiet on four unattended runs a day; + // an install that copied this sweeper WITHOUT the governed pair answers with + // its own NOT MEASURED reason instead, which is the correct signal for it. + const register43 = GOVERNED_REGISTER.available + ? `${GOVERNED_REGISTER.matcher(['docs/adr/0121-x.md']).length > 0}/${GOVERNED_REGISTER.matcher(['packages/core/src/x.ts']).length > 0}/${GOVERNED_REGISTER.approvers.length >= 2}` + : `NOT MEASURED — ${GOVERNED_REGISTER.reason}`; + t('H43 register: the imported matcher answers governed and clear, and the approver set is non-empty', register43, 'true/false/true'); + t('H43 register: the load is three-state — resolved, or a NAMED reason, never silently absent', GOVERNED_REGISTER.available || typeof GOVERNED_REGISTER.reason === 'string', true); + t('H43 register: a missing sibling names the two files to copy', governedRegisterFailure({ code: 'ERR_MODULE_NOT_FOUND' }).includes('check-governed-queue-guard.mjs'), true); + t('H43 register: …and says the rest of the sweep is unaffected', governedRegisterFailure({ code: 'ERR_MODULE_NOT_FOUND' }).includes('every other row is unaffected'), true); + t('H43 register: any other load failure carries its own message', governedRegisterFailure(new Error('boom')).includes('boom'), true); + + // The coverage clause, both branches, cut out of the summary line so only + // H43's own words can answer for H43. + t('H43 summary: the triple is reported', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('8 of the open PR(s)'), true); + t('H43 summary: …with the review leg named as a subset', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('answered on 5 of 5'), true); + t('H43 summary: an unloadable register reports NOT MEASURED, never 0 of 0', saidBy('h43GovernedReviews', summaryLine({ governedRegisterReason: 'the pair is not installed' }, 0)).includes('NOT MEASURED — the pair is not installed'), true); + t('H43 summary: …and then claims no governed population at all', saidBy('h43GovernedReviews', summaryLine({ governedRegisterReason: 'the pair is not installed' }, 0)).includes('hit the governed register'), false); + // -- The `[::]` collapse (#12090): behaviour-preserving, asserted as such --- // The class held U+003A TWICE, never the fullwidth U+FF1A its shape implied. // These cases pin that the collapse changed nothing a reader could observe. From f69210e4e9bfe9425e8f125181f6ad4537cb0e6b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 19:42:41 +0000 Subject: [PATCH 2/2] tooling(pm): forward H43's coverage counters into the summary contract MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first live sweep of the new row rendered "0 of the open PR(s) whose changed-file page was read hit the governed register … 0 of 0" while filing FOUR H43 findings. The counters were computed on `stats` and never copied into `counts`, which is exactly the failure `SWEEP_COUNT_KEYS` was enumerated to end: `counts.x ?? 0` renders a missing key and a genuine zero identically, so the one mechanism whose job is to prove a pass examined something can go quiet with no evidence that it did. `governedRegisterReason` rides the same list although it is a string, not a counter — without it a NOT MEASURED row would render as `0 of 0`, which is the same confusion one layer down. A self-test case now pins all four against the contract rather than against a rendered sentence. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox --- scripts/pm/check-half-states.mjs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/scripts/pm/check-half-states.mjs b/scripts/pm/check-half-states.mjs index 472faf9a85..50f596f788 100644 --- a/scripts/pm/check-half-states.mjs +++ b/scripts/pm/check-half-states.mjs @@ -8109,6 +8109,15 @@ export const SWEEP_COUNT_KEYS = [ 'conflictProbed', 'sharedFileCandidates', 'sharedFileProbed', + // H43's coverage triple and its fourth state (#14967) — the register that + // did not load. `governedRegisterReason` is a STRING, not a counter, and it + // rides the same contract for the same reason: without it the clause would + // render a NOT-MEASURED row as `0 of 0`, which is the exact confusion the + // enumeration above exists to end. + 'governedPrs', + 'governedReviewCandidates', + 'governedReviewProbed', + 'governedRegisterReason', 'liveFolds', 'memberReadCandidates', 'memberReadProbed', @@ -17431,6 +17440,13 @@ function selfTest() { // The coverage clause, both branches, cut out of the summary line so only // H43's own words can answer for H43. + // ⚠️ The forwarding contract, and the reason this case exists at all: the + // live sweep on the day this row landed rendered `0 of the open PR(s) …` + // while filing FOUR H43 rows, because the counters were computed and never + // copied into `counts`. That is the documented failure this enumeration was + // built to end — `counts.x ?? 0` renders a missing key and a real zero + // identically — and it reappears the moment a new row forgets the list. + t('H43: every count key rides the enumerated forwarding contract', ['governedPrs', 'governedReviewCandidates', 'governedReviewProbed', 'governedRegisterReason'].every((k) => SWEEP_COUNT_KEYS.includes(k)), true); t('H43 summary: the triple is reported', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('8 of the open PR(s)'), true); t('H43 summary: …with the review leg named as a subset', saidBy('h43GovernedReviews', summaryLine({ governedPrs: 8, governedReviewCandidates: 5, governedReviewProbed: 5 }, 0)).includes('answered on 5 of 5'), true); t('H43 summary: an unloadable register reports NOT MEASURED, never 0 of 0', saidBy('h43GovernedReviews', summaryLine({ governedRegisterReason: 'the pair is not installed' }, 0)).includes('NOT MEASURED — the pair is not installed'), true);