@codyswann/lisa 4.54.13 → 4.55.0

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -345,6 +345,8 @@ export const VIOLATIONS = Object.freeze({
   reviewWaived: "review_evidence_waived",
   reviewUnsatisfied: "review_evidence_unsatisfied",
   reviewCarried: "review_evidence_carried_unreviewed",
+  reviewObjected: "review_evidence_objected",
+  reviewObjectionUnread: "review_evidence_objection_unread",
 });
 
 /**
@@ -395,10 +397,14 @@ export const REVIEW_DESCRIPTION_DEFAULTS = Object.freeze({
  * what any change here can achieve: **the description is not a function of
  * whether a review happened.** `proof` is matched whole-string, so a
  * reviewed-and-objected pull request still carrying `Review rate limited` can
- * never reach it. Settling the question needs a second input — `reviews` /
- * `reviewThreads` — which this script does not read and deliberately does not
- * fetch: that would make the claim checkable at the cost of turning a
- * description classifier into a network client (CodySwannGT/lisa#3827).
+ * never reach it. Settling the question needs a second input — the review
+ * OBJECTS — and that input now exists, in the one place it can exist without
+ * turning this classifier into a network client (CodySwannGT/lisa#3706, #3827):
+ * {@link readReviewObjection} fetches `pulls/{pr}/reviews` from the ALREADY
+ * network-bound {@link inspectVacuity} arm, beside the check, carried-batch and
+ * waive-rate reads it already makes, and {@link readObjectionAtHead} judges the
+ * result purely. Everything in THIS classifier still reads only a description,
+ * and still may not conclude from `rate limited` that nothing ran.
  *
  * So the phrase stays in `no_work` — denying credit on it remains correct and
  * remains the safe direction — and only the WORDING changes. For these phrases
@@ -482,6 +488,12 @@ export const NEVER_BLOCKING = Object.freeze([
   // constituents' own gates already went red, on branches no ruleset watches.
   // What was missing was that the batch rendered green anyway.
   VIOLATIONS.reviewCarried,
+  // "The objection probe could not read the reviews" is the ABSENCE of a
+  // reading, not a finding about the code. It is reported — and it caps the
+  // rendered verdict, see `reviewGateVerdict` — but reddening a build because
+  // one API call failed would punish an author for a network, which is the
+  // "gate that gets deleted" shape this file names three times already.
+  VIOLATIONS.reviewObjectionUnread,
 ]);
 
 /**
@@ -521,6 +533,7 @@ export const NEVER_BLOCKING = Object.freeze([
 export const REPORT_ONLY = Object.freeze([
   VIOLATIONS.reviewWaived,
   VIOLATIONS.reviewCarried,
+  VIOLATIONS.reviewObjectionUnread,
 ]);
 
 /**
@@ -534,6 +547,15 @@ export const REPORT_ONLY = Object.freeze([
  */
 export const REVIEW_GATE_BLOCKING = Object.freeze([
   VIOLATIONS.reviewUnsatisfied,
+  // A review that RAN AND OBJECTED is the one condition no waiver covers, and
+  // this file has said so in prose since #3221 while having no way to observe
+  // it: the objection lives in a review OBJECT, and until #3706 nothing here
+  // read one. MEASURED on this repository, 60 most recently updated merged
+  // pull requests: 2 carried a standing `CHANGES_REQUESTED` at the merged head
+  // and the gate published `REVIEWED — CodeRabbit reported "Review completed"`.
+  // Blocking on it is the same policy `reviewUnsatisfied` already carries, and
+  // it is armed by the same `--require-review-evidence` flag.
+  VIOLATIONS.reviewObjected,
 ]);
 
 /**
@@ -588,6 +610,36 @@ const REQUIRE_REVIEW_EVIDENCE_FLAG = "--require-review-evidence";
  */
 const WAIVE_RATE_SAMPLE_FLAG = "--waive-rate-sample";
 
+/**
+ * How many waivers in the sample escalate a waiver from `neutral` to `failure`.
+ *
+ * ## Unset by default, and that is the whole safety property
+ *
+ * CodySwannGT/lisa#3706 asks a question this script cannot answer for a
+ * repository: "should N waivers in a row stop being tolerated?" The waiver
+ * itself is the repository owner's ruling on CodySwannGT/lisa#3221 — a pull
+ * request author cannot fix a vendor entitlement — and that ruling stands until
+ * an owner replaces it. What was missing was not the judgement but the LEVER:
+ * the rate was already computed, printed, and acted on by nothing.
+ *
+ * So this ships the lever and leaves it down. With the flag absent, every
+ * waiver renders exactly as it did before, and no workflow in this tree passes
+ * it. Passing `--waive-rate-escalate=N` is a deliberate act with a number
+ * attached, and the number is measurable first: the same run prints the rate it
+ * would be compared against.
+ *
+ * ## It escalates the RENDERING, not the exit code
+ *
+ * {@link VIOLATIONS.reviewWaived} stays in {@link NEVER_BLOCKING} and in
+ * {@link REPORT_ONLY} whatever this is set to. Those two arrays ARE the #3221
+ * ruling, and a flag that reached through them would repeal an owner's decision
+ * from a command line. What escalation changes is the conclusion published on
+ * the check run — the one surface a merge decision reads — from `neutral` to
+ * `failure`. Whether that red can block anything is a separate, deliberate,
+ * human act: promoting the context in the live ruleset.
+ */
+const WAIVE_RATE_ESCALATE_FLAG = "--waive-rate-escalate";
+
 /**
  * The one call the waive-rate sample makes.
  *
@@ -2082,6 +2134,166 @@ export function evaluateReviewGate(declaration, checks, options = {}) {
   return { violations, states, conditions, descriptions, checked };
 }
 
+/**
+ * The review-OBJECT state that means a reviewer objected.
+ *
+ * A review object, never a status description. The two are different data and
+ * the distinction is the entire content of CodySwannGT/lisa#3706: measured on
+ * #3762, `CodeRabbit` reported `success` with the description
+ * `Review rate limited` on a pull request it HAD reviewed, posting
+ * `CHANGES_REQUESTED` that found a real defect. The same string, on a different
+ * pull request the same week, meant nobody had read anything. A classifier
+ * reading the string collapses those two, and it collapses them PERMISSIVELY.
+ */
+export const REVIEW_OBJECTION_STATE = "CHANGES_REQUESTED";
+
+/**
+ * Whether an objection STANDS at this head, from the review objects.
+ *
+ * ## Filtered to the head, in both directions
+ *
+ * A review is counted only when its `commit_id` is this head. Leaving the
+ * filter out breaks the gate in whichever direction the data happens to point:
+ * a stale `CHANGES_REQUESTED` from three pushes ago would block work a newer
+ * head already fixed (CodySwannGT/lisa#3720), and that is a false RED, which
+ * this file argues repeatedly is the expensive kind to introduce while chasing
+ * a false green. A review with no `commit_id` is dropped for the same reason —
+ * unknown is not "at this head".
+ *
+ * MEASURED on the 60 most recently updated merged pull requests in this
+ * repository: 4 carried a `CHANGES_REQUESTED` from the reviewer, and only 2 of
+ * those were at the merged head. An unfiltered read would have reddened the
+ * other two for objections their authors had already addressed.
+ *
+ * ## Reported, never inferred
+ *
+ * This says only what the review objects say. It does NOT consult the status
+ * description, and nothing about a waiver, a rate limit or an entitlement
+ * reaches it — that is the point of having a second input at all.
+ * @param {ReadonlyArray<{state?: string, commitSha?: string, author?: string}>} reviews - Review objects
+ * @param {string|undefined} headSha - The head commit under inspection
+ * @returns {{objected: boolean, reviewers: string[], staleDropped: number}} What stands at head
+ */
+export function readObjectionAtHead(reviews, headSha) {
+  const all = reviews ?? [];
+  const atHead =
+    headSha === undefined || headSha === ""
+      ? []
+      : all.filter(review => review?.commitSha === headSha);
+  const objections = atHead.filter(
+    review =>
+      String(review?.state ?? "").toUpperCase() === REVIEW_OBJECTION_STATE
+  );
+  return {
+    objected: objections.length > 0,
+    reviewers: [
+      ...new Set(objections.map(review => String(review?.author ?? "unknown"))),
+    ].sort((left, right) => left.localeCompare(right)),
+    staleDropped: all.length - atHead.length,
+  };
+}
+
+/**
+ * Reads the review objects on one pull request.
+ *
+ * REST rather than the rollup, for the reason the description read is REST:
+ * `gh pr checks` and `gh pr view --json statusCheckRollup` cannot see a review
+ * object at all, so neither can say whether an objection stands. The endpoint
+ * carries `commit_id`, which is what makes the staleness filter possible.
+ * @param {string|number} pr - The pull request
+ * @param {string} [repo] - `OWNER/NAME`; defaults to the current repository
+ * @returns {Array<{state: string, commitSha: string, author: string}>} Review objects
+ * @throws {Error} When the slug cannot be resolved or `gh` cannot answer
+ */
+export function fetchPullRequestReviews(pr, repo) {
+  const slug = resolveRepoSlug(repo);
+  if (slug === undefined) {
+    throw new Error(
+      `check-skipped-required-checks: cannot read the reviews on PR ${pr} without an OWNER/NAME. Pass \`--repo=OWNER/NAME\`, or set GITHUB_REPOSITORY.`
+    );
+  }
+  return ghApiPaginatedArray(
+    `repos/${slug}/pulls/${pr}/reviews?per_page=100`,
+    "[.[] | {state: .state, commitSha: .commit_id, author: .user.login}]"
+  );
+}
+
+/**
+ * Reads and judges whether a review objection stands at this head.
+ *
+ * FAILING TO READ IS NOT PASSING, the same way {@link readCarriedReview} means
+ * it: an unreadable reviews endpoint reports UNREAD, which caps the rendered
+ * verdict below `REVIEWED` rather than reporting a clean one nothing looked at.
+ * It does not redden the build — see {@link NEVER_BLOCKING} — because the
+ * failure is the gate's own, not the author's.
+ * @param {string|number} pr - The pull request under inspection
+ * @param {string|undefined} repo - `OWNER/NAME`; defaults to the current repository
+ * @param {string|undefined} headSha - The head commit under inspection
+ * @param {{fetchReviews?: Function}} [options] - Injection seam
+ * @returns {{violations: object[], objected: boolean, reviewers: string[], staleDropped: number, unread?: string}} Findings and the standing
+ */
+export function readReviewObjection(pr, repo, headSha, options = {}) {
+  const read = options.fetchReviews ?? fetchPullRequestReviews;
+  let reviews;
+  try {
+    reviews = read(pr, repo);
+  } catch (error) {
+    const why = error instanceof Error ? error.message : String(error);
+    return {
+      violations: [
+        {
+          kind: VIOLATIONS.reviewObjectionUnread,
+          token: "objection",
+          contexts: [],
+          message: `The review objects on this pull request could not be read (${why}), so this run cannot say whether a reviewer OBJECTED at ${headSha ?? "the head commit"}. A status description cannot answer it: the same phrase has been observed on a pull request nothing reviewed and on one a reviewer objected to. Refusing to report a clean review nothing looked at.`,
+        },
+      ],
+      objected: false,
+      reviewers: [],
+      staleDropped: 0,
+      unread: why,
+    };
+  }
+  const standing = readObjectionAtHead(reviews, headSha);
+  if (!standing.objected) return { ...standing, violations: [] };
+  return {
+    ...standing,
+    violations: [
+      {
+        kind: VIOLATIONS.reviewObjected,
+        condition: REVIEW_GATE_CONDITIONS.objected,
+        token: "objection",
+        contexts: [],
+        message: `A review RAN AND OBJECTED at ${headSha ?? "this head"}: ${standing.reviewers.join(", ")} submitted ${REVIEW_OBJECTION_STATE}. READ THE OBJECTION. This is the one condition no waiver covers, and it is invisible in the check's conclusion and in its description alike — both have been observed reading exactly as they do on a pull request nobody reviewed.${citeHeadSha(headSha)}`,
+      },
+    ],
+  };
+}
+
+/**
+ * Whether a sampled waive rate has reached the escalation threshold.
+ *
+ * Three refusals, and each one is a direction an escalation could go wrong:
+ *
+ * - **No threshold** — nobody asked. The shipped default, and the reason this
+ *   change moves no merge.
+ * - **No rate** — the sample failed. {@link sampleWaiveRate} is best-effort by
+ *   construction, so an unreachable API must cost a sentence, never a red. An
+ *   escalation on an unmeasured rate would be a verdict from a measurement that
+ *   never happened, which is the family of defect this whole file is about.
+ * - **Nothing sampled** — a zero denominator. `0 >= 0` is true and would
+ *   escalate every waiver on an empty sample.
+ * @param {{waived?: number, sampled?: number}|undefined} rate - The sampled tally
+ * @param {number|undefined} threshold - Waivers at or above which to escalate
+ * @returns {boolean} Whether the waiver escalates
+ */
+export function waiverEscalates(rate, threshold) {
+  if (!Number.isInteger(threshold) || threshold <= 0) return false;
+  if (rate === undefined) return false;
+  if (!Number.isInteger(rate.sampled) || rate.sampled <= 0) return false;
+  return Number(rate.waived) >= threshold;
+}
+
 /**
  * How many carried pull requests this will account for before it gives up.
  *
@@ -2244,6 +2456,21 @@ function waiveRateSuffix(rate) {
     : ` · waived on ${rate.waived} of the last ${rate.sampled} merged pull requests`;
 }
 
+/**
+ * The unread-objection sentence appended to a verdict title, or nothing.
+ *
+ * Only when the probe FAILED. A probe that ran and found nothing standing is a
+ * reading, and a title that announced it on every clean pull request would be
+ * the noise that gets a sentence skimmed past on the one run it mattered.
+ * @param {{unread?: string}|undefined} objection - The objection standing
+ * @returns {string} The sentence, or an empty string
+ */
+function objectionSuffix(objection) {
+  return objection?.unread === undefined
+    ? ""
+    : " · whether a reviewer OBJECTED at this head was NOT read";
+}
+
 /**
  * The carried-batch sentence appended to a verdict title, or nothing.
  *
@@ -2289,10 +2516,18 @@ function carriedSuffix(carried) {
  * out: every state above is read from THIS pull request's head, which is the
  * one commit a batch integration pull request does not speak for.
  *
- * @param {{states?: Record<string, string>, conditions?: Record<string, string>, descriptions?: Record<string, string>, refusal?: {kind: string}|null, waiveRate?: {waived: number, sampled: number}, carried?: {unreviewed?: readonly string[], reviewed?: number, unread?: string}}} reading -
+ * AND AN OBJECTION OUTRANKS ALL OF IT (#3706). Every state above is read from a
+ * vendor's status DESCRIPTION, and the description has been measured saying the
+ * opposite of the truth in both directions on the same string: `Review rate
+ * limited` on a pull request nothing read, and `Review rate limited` on one the
+ * reviewer read and objected to. `reading.objection` is the second input that
+ * settles it, and it comes from review OBJECTS.
+ *
+ * @param {{states?: Record<string, string>, conditions?: Record<string, string>, descriptions?: Record<string, string>, refusal?: {kind: string}|null, waiveRate?: {waived: number, sampled: number}, carried?: {unreviewed?: readonly string[], reviewed?: number, unread?: string}, objection?: {objected?: boolean, reviewers?: readonly string[], unread?: string}, escalate?: number}} reading -
  *   The gate's per-check states and conditions, the descriptions they were read
- *   from, any refusal, an optional sampled waive rate, and the tally for the
- *   pull requests this one CARRIES
+ *   from, any refusal, an optional sampled waive rate, the tally for the pull
+ *   requests this one CARRIES, whether a review objection stands at this head,
+ *   and any waive-rate escalation threshold this repository set
  * @returns {{verdict: string, conclusion: string, title: string}} What to publish
  */
 /**
@@ -2323,7 +2558,27 @@ export function reviewGateVerdict(reading = {}) {
   const descriptions = reading.descriptions ?? {};
   const names = Object.keys(states);
   const carried = carriedSuffix(reading.carried);
-  const suffix = `${carried}${waiveRateSuffix(reading.waiveRate)}`;
+  const suffix = `${carried}${objectionSuffix(reading.objection)}${waiveRateSuffix(reading.waiveRate)}`;
+
+  // FIRST, AND ABOVE EVERY STATE READ FROM A DESCRIPTION (#3706). An objection
+  // is the one thing here read from review OBJECTS rather than from a vendor
+  // sentence, and it is the only reading that establishes a review HAPPENED and
+  // said no. Every branch below it is settled by a description, and the
+  // description has now been measured saying the opposite of the truth in both
+  // directions on the same string. So an objection outranks a waiver — which
+  // would otherwise merge a pull request a reviewer objected to, the permissive
+  // collapse this ticket is about — and it outranks `undetermined`, because a
+  // gate that stopped waiting has observed nothing while this has observed
+  // something.
+  if (reading.objection?.objected === true) {
+    return {
+      verdict: REVIEW_GATE_STATES.unsatisfied,
+      conclusion: REVIEW_VERDICT_CONCLUSIONS.unsatisfied,
+      title: fitTitle(
+        `OBJECTED — a review RAN and requested changes at this head: ${reading.objection.reviewers.join(", ")} submitted ${REVIEW_OBJECTION_STATE}. This is NOT a waiver case and NOT an unreviewed one — READ THE OBJECTION${suffix}`
+      ),
+    };
+  }
 
   if (reading.refusal || names.length === 0) {
     return {
@@ -2399,6 +2654,11 @@ export function reviewGateVerdict(reading = {}) {
     name => states[name] === REVIEW_GATE_STATES.waived
   );
   if (waived.length > 0) {
+    // The lever from #3706, and it is DOWN unless a repository set it. See
+    // `WAIVE_RATE_ESCALATE_FLAG`: the waiver's severity is the owner's ruling on
+    // #3221 and stays report-only in the exit code either way; what a threshold
+    // changes is the conclusion published where a merge decision reads it.
+    const escalated = waiverEscalates(reading.waiveRate, reading.escalate);
     // AND THE TITLE IS WHERE THE CLAIM IS READ (#3706). "This pull request is
     // UNREVIEWED" is the sentence an operator quotes into a merge disclosure,
     // and it was printed unconditionally — measured false on 7 of the last 34
@@ -2406,17 +2666,18 @@ export function reviewGateVerdict(reading = {}) {
     // head. Severity does not move: both leads publish `neutral`, and the
     // waiver's rationale is untouched. Only the claim changes, and only when
     // EVERY waived check saw review activity, so one genuinely silent check
-    // alongside a reviewed one still leads with UNREVIEWED.
+    // alongside a reviewed one still leads with UNREVIEWED. Orthogonal to the
+    // escalation above: the rate decides the LEAD, this decides the CLAIM.
     const allWithReview = waived.every(
       name => conditions[name] === REVIEW_GATE_CONDITIONS.waivedWithReview
     );
     return {
       verdict: REVIEW_GATE_STATES.waived,
-      conclusion: REVIEW_VERDICT_CONCLUSIONS.waived,
+      conclusion: escalated
+        ? REVIEW_VERDICT_CONCLUSIONS.unsatisfied
+        : REVIEW_VERDICT_CONCLUSIONS.waived,
       title: fitTitle(
-        allWithReview
-          ? `WAIVED — the review check could not review, and merging is a decision taken on that basis; but this pull request DOES carry review activity that raised no objection, so do NOT record it as unreviewed: ${waived.map(quote).join("; ")}${suffix}`
-          : `WAIVED — this pull request is UNREVIEWED and merging it is a decision taken on that basis: ${waived.map(quote).join("; ")}${suffix}`
+        `${escalated ? "WAIVED, AND THE WAIVER RATE HAS PASSED THE THRESHOLD THIS REPOSITORY SET" : "WAIVED"} — ${allWithReview ? "the review check could not review, and merging is a decision taken on that basis; but this pull request DOES carry review activity that raised no objection, so do NOT record it as unreviewed" : "this pull request is UNREVIEWED and merging it is a decision taken on that basis"}: ${waived.map(quote).join("; ")}${suffix}`
       ),
     };
   }
@@ -2443,6 +2704,22 @@ export function reviewGateVerdict(reading = {}) {
     };
   }
 
+  // A review ran and nothing here read whether it OBJECTED. Capped at `waived`
+  // for the reason the carried branch is: `REVIEWED` would report a clean
+  // review on the strength of a probe that failed, and the two states this file
+  // exists to keep apart are "a review said nothing was wrong" and "nothing
+  // established that". It blocks nothing — the failed read is the gate's, not
+  // the author's — and it stops looking like a pass.
+  if (reading.objection?.unread !== undefined) {
+    return {
+      verdict: REVIEW_GATE_STATES.waived,
+      conclusion: REVIEW_VERDICT_CONCLUSIONS.waived,
+      title: fitTitle(
+        `REVIEWED, OBJECTION STANDING UNKNOWN — the review ran, and whether it requested changes at this head could not be read: ${names.map(quote).join("; ")}${suffix}`
+      ),
+    };
+  }
+
   return {
     verdict: REVIEW_GATE_STATES.satisfied,
     conclusion: REVIEW_VERDICT_CONCLUSIONS.satisfied,
@@ -3615,6 +3892,13 @@ export function inspectVacuity(argv, declaration, options = {}) {
   const carried = requireReviewEvidence
     ? readCarriedReview(declaration, pr, repo, options)
     : undefined;
+  // #3706. Everything above is settled by a vendor's status DESCRIPTION, and
+  // the description does not answer the question the gate is asking. This is
+  // the second input — the review OBJECTS — and it is armed by the same flag as
+  // the carried arm, so an ordinary run pays no read it did not ask for.
+  const objection = requireReviewEvidence
+    ? readReviewObjection(pr, repo, read.headSha, options)
+    : undefined;
   // Sampled ONLY when this pull request is itself waived. The rate answers
   // "is this the exception or the rule?", a question that only arises once a
   // waiver is on the table, and every other run keeps the sampler's network
@@ -3639,6 +3923,7 @@ export function inspectVacuity(argv, declaration, options = {}) {
       ...absent.violations,
       ...gate.violations,
       ...(carried?.violations ?? []),
+      ...(objection?.violations ?? []),
     ],
     absent: absent.absent,
     gateStates: gate.states,
@@ -3646,12 +3931,15 @@ export function inspectVacuity(argv, declaration, options = {}) {
     gateDescriptions: gate.descriptions,
     waiveRate,
     carried,
+    objection,
     verdict: reviewGateVerdict({
       states: gate.states,
       conditions: gate.conditions,
       descriptions: gate.descriptions,
       waiveRate,
       carried,
+      objection,
+      escalate: readIntegerFlag(argv, WAIVE_RATE_ESCALATE_FLAG, undefined),
     }),
     settled: read.settled,
     refusal: null,

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -22,10 +22,20 @@
  * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
- * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /
+ * ({ file, key, reason, until }). Honored ONLY from the baseline side (HEAD /
  * merge-base), never from the change under review — an agent cannot grant
  * itself an exception in the same change that weakens a gate. `key: "*"`
- * allows every key in the file.
+ * allows every key in the file, and reports as file-wide so it is not mistaken
+ * for a key-scoped one.
+ *
+ * Exemptions END (#3856). `until` is a `YYYY-MM-DD` day the entry is live
+ * through; past it the entry stops exempting and the weakening it permitted is
+ * refused again, naming the entry, its scope, its reason and the remedy. An
+ * entry naming no evaluable condition still exempts — that keeps a project
+ * mid-migration off a red wall — but is reported on every run until somebody
+ * gives it a condition or deletes it. Modelled on `_thresholdsDivergence` in
+ * `stryker.conf.json`, the sibling exemption that already stops exempting when
+ * it goes stale; see `threshold-ratchet-families.mjs` `ALLOW_STATE`.
  *
  * One exception, and only one: a PROMOTION between deploy-chain branches
  * (`--base` + `--head`, both named in `deploy.branches`, head upstream of
@@ -49,6 +59,7 @@ import {
 import {
   applyAllowList,
   compareFile,
+  describeAllowList,
   formatReport,
 } from "./threshold-ratchet-compare.mjs";
 
@@ -390,6 +401,13 @@ function run(mode, baseRef, onlyFiles, headRef) {
     );
   }
 
+  const allow = resolveAllowList(
+    root,
+    plan.baselineRef,
+    mode,
+    baseRef,
+    headRef
+  );
   const findings = watched.flatMap(f =>
     compareFile(
       f,
@@ -397,28 +415,60 @@ function run(mode, baseRef, onlyFiles, headRef) {
       plan.readCurrent(f)
     )
   );
-  if (findings.length === 0) return 0;
+  // The allow-list inventory is printed whether or not the change produced
+  // findings. An exemption that has outlived its condition is dead weight the
+  // moment the condition passes, and reporting it only when something else has
+  // already failed is how a list nobody reads stays a list nobody reads.
+  if (findings.length === 0) {
+    reportAllowList(allow.entries, []);
+    return 0;
+  }
+  return reportFindings(findings, allow, mode);
+}
 
-  const allow = resolveAllowList(
-    root,
-    plan.baselineRef,
-    mode,
-    baseRef,
-    headRef
-  );
+/**
+ * Print the allow entries a human has to act on, minus the ones a refusal is
+ * about to name in full.
+ * @param {object[]} entries The resolved allow list
+ * @param {Array<{ message: string }>} expired Refusals already being printed
+ * @returns {void}
+ */
+function reportAllowList(entries, expired) {
+  for (const line of describeAllowList(entries)) {
+    if (expired.some(item => item.message.startsWith(line))) continue;
+    process.stdout.write(`threshold-ratchet: ${line}\n`);
+  }
+}
+
+/**
+ * Print the verdict for a change that produced findings.
+ * @param {object[]} findings Findings from every watched file
+ * @param {{ entries: object[], promotion: boolean, note: string | null }} allow
+ *   The resolved allow list and its provenance
+ * @param {"hook"|"staged"|"base"} mode Comparison mode
+ * @returns {number} Process exit code (2 for hook mode, 1 otherwise; 0 clean)
+ */
+function reportFindings(findings, allow, mode) {
   const split = partitionCarriedEntries(findings, allow.promotion);
-  const { blocked, allowed } = applyAllowList(split.rest, allow.entries);
+  const { blocked, allowed, expired } = applyAllowList(
+    split.rest,
+    allow.entries
+  );
   if (allow.note) process.stdout.write(`${allow.note}\n`);
+  reportAllowList(allow.entries, expired);
   for (const finding of split.carried) {
     process.stdout.write(
       `threshold-ratchet: carried forward by this promotion, approved upstream — ${finding.message}\n`
     );
   }
-  for (const finding of allowed) {
+  for (const item of allowed) {
     process.stdout.write(
-      `threshold-ratchet: allowed by .lisa.config.json exception — ${finding.message}\n`
+      `threshold-ratchet: ${item.message} (.lisa.config.json exception)\n`
     );
   }
+  for (const item of expired) {
+    process.stderr.write(`threshold-ratchet: refused — ${item.message}\n`);
+  }
   if (blocked.length === 0) return 0;
   process.stderr.write(`${formatReport(blocked)}\n`);
   return mode === "hook" ? 2 : 1;