@mmnto/totem 2.5.0 → 2.7.0

package/dist/merge-ready.test.js

@@ -2,18 +2,25 @@
  * merge-ready (mmnto-ai/totem#2800) — the gate's invariants, driven by the
  * checked-in fixtures under `gate-fixtures/merge-ready/`.
  *
- * FOUR of those fixtures are REAL `gh api graphql` captures taken with the
- * exported {@link MERGE_READY_QUERY} (R4): three PR captures —
+ * FIVE of those fixtures are REAL `gh api graphql` captures taken with the
+ * exported {@link MERGE_READY_QUERY} (R4): four PR captures —
  * mmnto-ai/liquid-city#363 (green rollup, one unresolved HIGH inline),
- * mmnto-ai/totem-strategy#1251, and mmnto-ai/totem#2827 (the comment that
- * re-pointed to the head) — plus the benign corpus, every bot inline thread on
- * mmnto-ai/totem#2820-2839, which measures the severity read's ADR-109
- * false-positive budget. The other 44 are synthetic and labelled `synthetic-`
- * in their names — one per invariant the captures cannot exercise (all three
- * PRs are merged, so GitHub answers `mergeStateStatus: UNKNOWN` for each and no
- * capture can carry a BEHIND / DIRTY / BLOCKED head, or a resolved HIGH thread);
- * the five PR-round-1 rows (mmnto-ai/totem#2844) cover the strict connection
- * reads and the predicate order ahead of the unreadable-commit arm.
+ * mmnto-ai/totem-strategy#1251, mmnto-ai/totem#2827 (the comment that
+ * re-pointed to the head) and mmnto-ai/totem#2871 (a HIGH resolved through the
+ * disposition path while its anchor survives on the head — the discharge
+ * specimen, mmnto-ai/totem#2861) — plus the benign corpus, every bot inline
+ * thread on mmnto-ai/totem#2820-2839, which measures the severity read's
+ * ADR-109 false-positive budget. The other 72 are synthetic and labelled
+ * `synthetic-` in their names — one per invariant the captures cannot
+ * exercise (all four PRs are merged, so GitHub answers `mergeStateStatus:
+ * UNKNOWN` for each and no capture can carry a BEHIND / DIRTY / BLOCKED head,
+ * or a bare-resolved HIGH thread); the five PR-round-1 rows
+ * (mmnto-ai/totem#2844) cover the strict connection reads and the predicate
+ * order ahead of the unreadable-commit arm; the ten mmnto-ai/totem#2861 rows
+ * cover the discharge read — its two evidence arms, the bare-resolve negative
+ * control in the field shape, the required resolve, the per-thread split, the
+ * second comments page, the incomplete window with and without evidence, the
+ * deleted-account reply and the strict PR comments connection.
  * The README beside them lists every file with its sha256 and instant, and a
  * test recomputes those receipts from the files on disk.
  *
@@ -25,7 +32,7 @@ import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, expect, it } from 'vitest';
 import { TotemError } from './errors.js';
-import { evaluateMergeReady, hasHighSeverityMarker, MERGE_READY_BRANCH_QUERY, MERGE_READY_OVERRIDE_ENV, MERGE_READY_QUERY, MERGE_READY_SOURCE, mergeReadyEvaluator, parseMergeReadyPayload, } from './merge-ready.js';
+import { dispositionedRootIds, evaluateMergeReady, hasHighSeverityMarker, MERGE_READY_BRANCH_QUERY, MERGE_READY_OVERRIDE_ENV, MERGE_READY_QUERY, MERGE_READY_SOURCE, mergeReadyEvaluator, parseMergeReadyPayload, } from './merge-ready.js';
 const FIXTURE_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), 'gate-fixtures', 'merge-ready');
 function loadFixture(name) {
     return JSON.parse(fs.readFileSync(path.join(FIXTURE_DIR, name), 'utf-8'));
@@ -76,6 +83,7 @@ describe('merge-ready — the fixture README matches the fixtures', () => {
         'benign-corpus-bot-inlines.json',
         'liquid-city-363.json',
         'totem-2827.json',
+        'totem-2871.json',
         'totem-strategy-1251.json',
     ];
     it('every sha256 in the README is the sha256 of the file it names', () => {
@@ -111,8 +119,8 @@ describe('merge-ready — the fixture README matches the fixtures', () => {
         const synthetic = files.filter((f) => f.startsWith('synthetic-'));
         const captures = files.filter((f) => !f.startsWith('synthetic-'));
         expect(captures.sort()).toEqual(CAPTURES);
-        expect(synthetic.length).toBe(44);
-        expect(files.length).toBe(48);
+        expect(synthetic.length).toBe(72);
+        expect(files.length).toBe(77);
     });
     it('the README query sha is the sha of the exported query (round 4, F7)', () => {
         // A receipt for the QUERY, re-derived like the file receipts: change the
@@ -134,7 +142,13 @@ describe('merge-ready — the checked-in captures', () => {
         expect(e.verdict.disposition).toBe('deny');
         expect(e.verdict.provenance.ref).toBe('unresolved-bot-threads');
         expect(e.verdict.provenance.source).toBe(MERGE_READY_SOURCE);
-        expect(e.detail.checks).toEqual({ total: 6, success: 6, pending: 0, failing: 0 });
+        expect(e.detail.checks).toEqual({
+            total: 6,
+            success: 6,
+            pending: 0,
+            failing: 0,
+            superseded: 0,
+        });
         expect(e.detail.threads.unresolvedBot).toBe(1);
         // The root comment is GCA's, spelled WITHOUT the `[bot]` suffix on the
         // GraphQL surface — the trap `bot-identity.ts` exists to hold.
@@ -171,6 +185,54 @@ describe('merge-ready — the checked-in captures', () => {
         expect(e.detail.highInline).toBe(1);
         expect(e.verdict.disposition).toBe('deny');
     });
+    it('mmnto-ai/totem#2871 (capture): a CodeRabbit Major resolved THROUGH THE DISPOSITION PATH while its anchor survives on the head is discharged (mmnto-ai/totem#2861)', () => {
+        // The real specimen of predicate 4's own territory: the finding was
+        // declined with reason in the round disposition (a PR-level comment that
+        // post-dates the thread's root), the thread resolved by
+        // `totem resolve-threads --apply`, and the anchored line never changed —
+        // so `comment.commit.oid` IS the head and, before the cure, this read
+        // `deny · high-severity-inline · highInline 1` (calibration row
+        // mmnto-ai/totem#2871 on the issue). Read straight off the capture first,
+        // so the shape stays a statement about GitHub's data.
+        const fixture = loadFixture('totem-2871.json');
+        const body = fixture.pages[0].body;
+        const pr = body.data.repository.pullRequest;
+        const onHead = pr.reviewThreads.nodes.filter((t) => t.comments.nodes[0].commit?.oid === pr.headRefOid &&
+            hasHighSeverityMarker(t.comments.nodes[0].body));
+        expect(onHead).toHaveLength(1);
+        const thread = onHead[0];
+        expect(thread.isResolved).toBe(true);
+        expect(thread.comments.nodes[0].author?.login).toBe('coderabbitai');
+        const rootAt = Date.parse(thread.comments.nodes[0].createdAt);
+        const humanAfterRoot = pr.comments.nodes.filter((c) => c.author?.__typename !== 'Bot' && Date.parse(c.createdAt) > rootAt);
+        expect(humanAfterRoot.length).toBeGreaterThan(0);
+        // A human comment after the root NAMES the thread on a `disposition:`
+        // line — the calibration replay line posted on the PR under the 2026-09-16
+        // ruling — asserted through the SHIPPED predicate, never a copy (r2-f8).
+        const rootId = thread.comments.nodes[0].databaseId;
+        expect(rootId).toBe(4000747291);
+        expect(humanAfterRoot.some((c) => dispositionedRootIds(c.body).includes(rootId))).toBe(true);
+        const e = evaluate('totem-2871.json', { tier: 'pilot' });
+        // 17 runs under 16 names on the 2026-09-18 re-capture: one name ran twice
+        // (both SUCCESS) and is judged by its later run (mmnto-ai/totem#2879) — a
+        // live specimen of the collapse inside the discharge specimen.
+        expect(e.detail.checks).toEqual({
+            total: 16,
+            success: 16,
+            pending: 0,
+            failing: 0,
+            superseded: 1,
+        });
+        expect(e.detail.threads.unresolvedBot).toBe(0);
+        expect(e.detail.highInline).toBe(0);
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 0, prLevelDisposition: 1 });
+        // Merged, so GitHub answers UNKNOWN: the read lands on the arm that is
+        // reachable ONLY when predicates 1–4 have passed — the replay's witness.
+        expect(e.verdict.provenance.ref).toBe('unevaluable');
+        expect(e.verdict.reason).toMatch(/mergeStateStatus: UNKNOWN/);
+        expect(e.notices.some((n) => n.includes('1 HIGH/Major bot inline(s) on the head commit discharged'))).toBe(true);
+    });
     it('sends the exported query, as argv, with no shell string anywhere', () => {
         const e = evaluate('liquid-city-363.json');
         expect(e.calls[0]).toEqual(['--version']);
@@ -191,7 +253,13 @@ describe('merge-ready — predicate 1 (checks)', () => {
         expect(e.verdict.disposition).toBe('deny');
         expect(e.verdict.provenance.ref).toBe('checks');
         expect(e.verdict.reason).toContain('Totem Lint');
-        expect(e.detail.checks).toEqual({ total: 2, success: 1, pending: 0, failing: 1 });
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 1,
+            pending: 0,
+            failing: 1,
+            superseded: 0,
+        });
     });
     it('a still-running check denies and names it', () => {
         const e = evaluate('synthetic-pending-check.json');
@@ -203,11 +271,275 @@ describe('merge-ready — predicate 1 (checks)', () => {
     it('R5 — zero checks passes predicate 1 as a FACT, with the count and ONE stderr line', () => {
         const e = evaluate('synthetic-zero-checks.json');
         expect(e.verdict.disposition).toBe('allow');
-        expect(e.detail.checks).toEqual({ total: 0, success: 0, pending: 0, failing: 0 });
+        expect(e.detail.checks).toEqual({
+            total: 0,
+            success: 0,
+            pending: 0,
+            failing: 0,
+            superseded: 0,
+        });
         const zeroLines = e.notices.filter((n) => n.includes('ZERO status checks'));
         expect(zeroLines).toHaveLength(1);
         expect(zeroLines[0]).toMatch(/branch protection/i);
     });
+    // ─── Same-named runs are judged by the LATEST run (mmnto-ai/totem#2879) ──
+    //
+    // The rollup lists EVERY check run on the head, a concurrency group's
+    // cancelled duplicate beside the run that superseded it, and its order is
+    // not chronological (mmnto-ai/totem#2877's head listed the later D1 run
+    // first). The latest run is the greatest `databaseId`. Two fixtures list
+    // the greater id in opposite positions so that neither "first listed" nor
+    // "last listed" survives as a mutant.
+    it('2879 — a concurrency-cancelled run beside the LATER success of the same name passes predicate 1, listed order notwithstanding', () => {
+        // The later (success) run is listed FIRST; a last-listed-wins read would
+        // judge the cancelled one and deny.
+        const e = evaluate('synthetic-check-superseded-cancelled.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 2,
+            pending: 0,
+            failing: 0,
+            superseded: 1,
+        });
+        const lines = e.notices.filter((n) => n.includes('times on the head commit'));
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('check "Auto-close required check (D1)" from "github-actions/CI" ran 2 times on the head commit — judged by its latest run 5003 (success)');
+        expect(lines[0]).toContain('1 superseded run(s) not counted (mmnto-ai/totem#2879)');
+    });
+    it('2879 — a success and then a LATER cancelled run of the same name DENIES naming the check: the earlier success does not stand in', () => {
+        // The greater id (cancelled) is listed SECOND; a first-listed-wins read
+        // would judge the success and allow.
+        const e = evaluate('synthetic-check-cancelled-after-success.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('checks');
+        expect(e.verdict.reason).toContain('1 of 2 status checks are failing (Auto-close required check (D1))');
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 1,
+            pending: 0,
+            failing: 1,
+            superseded: 1,
+        });
+    });
+    it('2879 — ONE cancelled run with no later run of its name still denies: the negative that must hold', () => {
+        const e = evaluate('synthetic-check-single-cancelled.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('checks');
+        expect(e.verdict.reason).toContain('Auto-close required check (D1)');
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 1,
+            pending: 0,
+            failing: 1,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit/);
+    });
+    it('2879 — two runs of one name where one carries no readable databaseId is UNREADABLE at both tiers, never the first or the last one listed', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-duplicate-id-missing.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('no readable databaseId');
+            expect(e.verdict.reason, tier).toContain('Auto-close required check (D1)');
+            expect(e.detail.checks, tier).toEqual({
+                total: 0,
+                success: 0,
+                pending: 0,
+                failing: 0,
+                superseded: 0,
+            });
+        }
+    });
+    it('2879 — the query selects databaseId on CheckRun, so the judgment reads what gh answers', () => {
+        expect(MERGE_READY_QUERY).toContain('... on CheckRun { name status conclusion databaseId checkSuite { databaseId app { slug } workflowRun { workflow { databaseId name } } } }');
+    });
+    // ─── Bot round 1 (Greptile P1, P2): the producer is part of the key, and
+    // an id must be a SAFE integer ────────────────────────────────────────────
+    it('2879 — two INDEPENDENT checks that share a name never collapse: a later success from another workflow does not hide a failure (bot round 1, Greptile P1)', () => {
+        const e = evaluate('synthetic-check-same-name-two-producers.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('checks');
+        expect(e.verdict.reason).toContain('1 of 3 status checks are failing (test)');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 2,
+            pending: 0,
+            failing: 1,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit/);
+    });
+    it('2879 — two runs of one name where one carries no readable producer are UNREADABLE at both tiers: reruns cannot be told from independent checks (bot round 1, Greptile P1)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-duplicate-producer-missing.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('no readable producer');
+            expect(e.verdict.reason, tier).toContain('Auto-close required check (D1)');
+        }
+    });
+    it('2879 — an id beyond the safe-integer range does not read: a rerun group carrying one is UNREADABLE, never ordered on a rounded number (bot round 1, Greptile P2)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-duplicate-id-unsafe.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('no readable databaseId');
+            expect(e.verdict.reason, tier).toContain('from "github-actions/Auto-close guard"');
+        }
+    });
+    // ─── The re-armed leg's F1 and F6: the producer is the workflow's ID, and
+    // two same-named runs in one suite fail closed ─────────────────────────────
+    it('2879 — two workflow FILES sharing a display name are two producers: their same-named jobs are both judged and the failure denies (re-armed leg F1)', () => {
+        const e = evaluate('synthetic-check-same-name-two-workflow-files.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('checks');
+        expect(e.verdict.reason).toContain('1 of 3 status checks are failing (build)');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 2,
+            pending: 0,
+            failing: 1,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit/);
+    });
+    it('2879 — two same-named jobs of ONE workflow run share a check suite: independent checks the key cannot tell apart, UNREADABLE at both tiers (re-armed leg F1)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-two-jobs-one-suite.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('sit in one check suite');
+            expect(e.verdict.reason, tier).toContain('check "test" from "github-actions/CI"');
+        }
+    });
+    it('2879 — a rerun group where one run has no readable check-suite id is UNREADABLE at both tiers (fourth leg F2)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-rerun-suite-id-missing.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('no readable check-suite id');
+            expect(e.verdict.reason, tier).toContain('check "Auto-close required check (D1)" from "github-actions/Auto-close guard"');
+        }
+    });
+    it('2879 — an Actions run with no readable workflow id in a same-named group is a producer that did not read: UNREADABLE at both tiers, never one producer for every workflow (fourth leg F2, third leg F5)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-actions-workflow-id-missing.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('no readable producer');
+            expect(e.verdict.reason, tier).toContain('the workflow id of an Actions run');
+            expect(e.verdict.reason, tier).toContain('Auto-close required check (D1)');
+        }
+    });
+    it('2879 — a non-Actions app that posts two same-named runs in its one suite is UNREADABLE at both tiers, and the reason names the suite, not a workflow run (fourth leg F4)', () => {
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-check-app-two-runs-one-suite.json', { tier });
+            expect(e.verdict.disposition, tier).toBe(tier === 'pilot' ? 'warn' : 'deny');
+            expect(e.verdict.provenance.ref, tier).toBe('unevaluable');
+            expect(e.verdict.reason, tier).toContain('check "lint" from "some-ci-app"');
+            expect(e.verdict.reason, tier).toContain('two runs of one app');
+        }
+    });
+    it('2879 — two same-named checks from different producers where one has no id are both judged: the id orders reruns and nothing else (re-armed leg F6)', () => {
+        const e = evaluate('synthetic-check-two-producers-one-null-id.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 3,
+            pending: 0,
+            failing: 0,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit|could not derive/);
+    });
+    // ─── The fold of the leg's F1–F4, F7: arithmetic and tolerances, not only
+    // the two-run happy path ─────────────────────────────────────────────────
+    it('2879 — superseded counts RUNS, one disclosure line per name, and an earlier FAILED run is superseded like a cancelled one (leg F1, F2, F7)', () => {
+        // Three D1 runs (FAILURE, CANCELLED, SUCCESS) beside two Totem Lint runs:
+        // a mutant counting NAMES would say 2; the lines carry their whole names.
+        const e = evaluate('synthetic-check-three-runs-two-names.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 3,
+            pending: 0,
+            failing: 0,
+            superseded: 3,
+        });
+        const lines = e.notices.filter((n) => n.includes('times on the head commit'));
+        expect(lines).toHaveLength(2);
+        expect(lines[0]).toContain('check "Auto-close required check (D1)" from "github-actions/CI" ran 3 times on the head commit — judged by its latest run 5004 (success)');
+        expect(lines[0]).toContain('2 superseded run(s) not counted');
+        expect(lines[1]).toContain('check "Totem Lint" from "github-actions/CI" ran 2 times on the head commit — judged by its latest run 5006 (success)');
+        expect(lines[1]).toContain('1 superseded run(s) not counted');
+        for (const line of lines)
+            expect(line).not.toContain('…');
+    });
+    it('2879 — a check that ran ONCE with no readable databaseId is judged on its conclusion, in BOTH directions: the id orders same-named runs and nothing else (leg F3, r2-F7)', () => {
+        // Two lone null-id runs: one SUCCESS, one FAILURE. The over-strict mutant
+        // (any unreadable id is unevaluable) would say "could not derive"; the
+        // lenient mutant (a lone null-id run reads as success) would allow.
+        const e = evaluate('synthetic-check-single-null-id.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('checks');
+        expect(e.verdict.reason).toContain('1 of 3 status checks are failing (Totem Doctor (--strict))');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 2,
+            pending: 0,
+            failing: 1,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit|could not derive/);
+    });
+    it('2879 — a check name longer than the evidence bound is disclosed WHOLE: the notice is sanitised, never sliced (r2-F1)', () => {
+        const e = evaluate('synthetic-check-long-name-superseded.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 2,
+            pending: 0,
+            failing: 0,
+            superseded: 1,
+        });
+        const lines = e.notices.filter((n) => n.includes('times on the head commit'));
+        expect(lines).toHaveLength(1);
+        const longName = 'spine-adopt harnesses on ubuntu-latest (specimens, seed20, matrix shard 7 of 12, reusable workflow harness/run-adopt.yml @ main, with the full fixture corpus and the extended timeout budget for cold-store starts)';
+        expect(longName.length).toBeGreaterThan(160);
+        expect(lines[0]).toContain(`check ${JSON.stringify(longName)} from "github-actions/CI" ran 2 times on the head commit`);
+        expect(lines[0]).not.toContain('…');
+    });
+    it("2879 — two runs whose name did not read are two checks, never one that ran twice (r2-F4; the first leg's F10)", () => {
+        const e = evaluate('synthetic-check-unnamed-runs.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 3,
+            success: 3,
+            pending: 0,
+            failing: 0,
+            superseded: 0,
+        });
+        expect(e.notices.join('\n')).not.toMatch(/times on the head commit|could not derive/);
+    });
+    it('2879 — same-named runs on different pages of the checks connection are judged together, after the last page (leg F4)', () => {
+        const e = evaluate('synthetic-check-duplicate-across-pages.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.checks).toEqual({
+            total: 2,
+            success: 2,
+            pending: 0,
+            failing: 0,
+            superseded: 1,
+        });
+        const graphql = e.calls.filter((c) => c[0] === 'api');
+        expect(graphql).toHaveLength(2);
+        expect(graphql[1]).toContain('checksAfter=checks-page-1');
+        const lines = e.notices.filter((n) => n.includes('times on the head commit'));
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('judged by its latest run 5003 (success)');
+    });
     // ─── The rollup must BELONG to the head commit (fold F7) ────────────────
     //
     // Predicate 1 reads `commits(last: 1)`. Every way that node can fail to be
@@ -314,15 +646,209 @@ describe('merge-ready — predicates 2 and 4 (bot threads)', () => {
         expect(e.verdict.disposition).toBe('allow');
         expect(e.detail.highInline).toBe(0);
     });
-    it('a RESOLVED HIGH inline that still applies to the HEAD commit denies at predicate 4', () => {
-        // Predicate 4's own territory (ruled, fold F2): a human resolved the thread
-        // without changing the code, so predicate 2 passes and the finding still
-        // applies to what would merge. Resolution is IGNORED here by design.
+    it('the NEGATIVE CONTROL — a RESOLVED HIGH inline still on the HEAD commit with no disposition on record denies at predicate 4 (mmnto-ai/totem#2861)', () => {
+        // Predicate 4's own territory (fold F2 of mmnto-ai/totem#2800, narrowed by
+        // the 2861 ruling), in the FIELD shape the legs constructed (f1, r2-f1): a
+        // bare UI resolve on a PR that keeps accumulating human comments. The only
+        // disposition naming this thread (root id 1001) PRE-dates the root; after
+        // it come a Bot's summary, a `[bot]`-suffixed login carrying the line (a
+        // counterfactual shape — GraphQL answers `Bot` for every App — kept to
+        // exercise the suffix arm), human chatter, and a later round's disposition
+        // that names ANOTHER thread (9999) and says so; the only in-thread reply is
+        // the bot's own. Predicate 2 passes, nothing discharges, the finding still
+        // applies, and the reason names the line it looked for AHEAD of the quoted
+        // body so it survives the matched bound (f6).
         const e = evaluate('synthetic-head-commit-high-inline.json');
         expect(e.verdict.disposition).toBe('deny');
         expect(e.verdict.provenance.ref).toBe('high-severity-inline');
         expect(e.detail.threads.unresolvedBot).toBe(0); // predicate 2 did NOT fire
         expect(e.detail.highInline).toBe(1);
+        expect(e.detail.dischargedHigh).toBe(0);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 0, prLevelDisposition: 0 });
+        // The reason names the LINE the read looked for — with this thread's own
+        // id — never "no disposition exists" (r2-f3: a round disposition that
+        // answered other threads is a real event).
+        expect(e.verdict.reason).toContain('"disposition: 1001 <verb>"');
+        expect(e.verdict.reason).toMatch(/and no non-bot reply in its thread/);
+        expect(e.verdict.reason).toMatch(/a round disposition that did not name this thread/);
+        // The id survives the 160-character bound on `matched` because the line
+        // LEADS the clause (r3-f3: a clause that led with prose cut it off).
+        expect(e.verdict.provenance.matched).toContain('"disposition: 1001 <verb>"');
+        expect(e.notices.some((n) => n.includes('discharged'))).toBe(false);
+        // The fixture really carries the post-dating human chatter the field has.
+        const fixture = loadFixture('synthetic-head-commit-high-inline.json');
+        const pr = fixture.pages[0].body.data.repository.pullRequest;
+        const humanAfterRoot = pr.comments.nodes.filter((c) => c.author.__typename === 'User' && c.createdAt > '2026-09-08T03:00:00Z');
+        // Three post-dating User-typed nodes: the `[bot]`-suffixed login NAMING
+        // this thread (skipped by the suffix arm, not by content), the human
+        // chatter, and the other round's disposition naming 9999 — asserted
+        // through the shipped predicate. The last is the r2-f1 shape: under a
+        // round-keyed read it discharged; under the id it cannot.
+        const suffixed = humanAfterRoot.filter((c) => /\[bot\]$/i.test(c.author.login));
+        const humans = humanAfterRoot.filter((c) => !/\[bot\]$/i.test(c.author.login));
+        expect(suffixed.length).toBe(1);
+        expect(dispositionedRootIds(suffixed[0].body)).toContain(1001);
+        expect(humans.length).toBe(2);
+        expect(humans.every((c) => !dispositionedRootIds(c.body).includes(1001))).toBe(true);
+        expect(humans.some((c) => dispositionedRootIds(c.body).includes(9999))).toBe(true);
+    });
+    // ─── The discharge read (mmnto-ai/totem#2861) ────────────────────────────
+    //
+    // A HIGH on the head whose thread was RESOLVED through the disposition path
+    // — the resolve-threads evidence rule on the same read — no longer applies.
+    // The bare resolve above is the fail-closed arm; these are the two evidence
+    // arms and the edges of each.
+    it('a resolved HIGH on the head with a non-bot PR-level disposition line naming it AFTER its root is discharged', () => {
+        const e = evaluate('synthetic-high-inline-discharged-pr-level.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.highInline).toBe(0);
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 0, prLevelDisposition: 1 });
+        // The audit breadcrumb: what the predicate RELEASED, and by which arm, is
+        // on stderr.
+        const line = e.notices.find((n) => n.includes('discharged through the disposition path'));
+        expect(line).toBeDefined();
+        expect(line).toContain('1 HIGH/Major bot inline(s)');
+        expect(line).toContain('1 by a PR-level disposition line naming the thread');
+        expect(line).toContain('mmnto-ai/totem#4242');
+    });
+    it('a resolved HIGH on the head with a non-bot IN-THREAD reply and no PR-level comment is discharged', () => {
+        const e = evaluate('synthetic-high-inline-discharged-in-thread.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.highInline).toBe(0);
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 1, prLevelDisposition: 0 });
+        expect(e.notices.join('\n')).toContain('1 by a non-bot in-thread reply');
+    });
+    it('a root with no readable databaseId is a thread no line can name — it stays applying, and the page stays readable (r3-f4)', () => {
+        // The schema types `databaseId` nullable. A page-scoped refusal would
+        // route the PR into the unevaluable class, which pilot maps to `warn` —
+        // the same downgrade fold 1 removed for the incomplete window. So the
+        // thread alone fails closed, at both tiers, and the reason says why.
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-high-inline-root-id-missing.json', { tier });
+            expect(e.verdict.disposition, tier).toBe('deny');
+            expect(e.verdict.provenance.ref, tier).toBe('high-severity-inline');
+            expect(e.verdict.reason, tier).toMatch(/no line can name it/);
+            expect(e.detail.highInline, tier).toBe(1);
+            expect(e.detail.dischargedHigh, tier).toBe(0);
+            expect(e.notices.join('\n'), tier).not.toMatch(/could not derive/);
+        }
+    });
+    it('evidence FOUND discharges even when the thread window is incomplete (f7)', () => {
+        // The window is incomplete (`hasNextPage`) and carries only the bot's own
+        // reply, but the PR-level disposition after the root is on record: the
+        // completeness test never precedes the evidence tests.
+        const e = evaluate('synthetic-high-inline-discharged-window-incomplete.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 0, prLevelDisposition: 1 });
+    });
+    it('a deleted-account reply (author: null) is a human reply — the resolve-threads rule', () => {
+        const e = evaluate('synthetic-high-inline-deleted-author-reply.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.dischargedHigh).toBe(1);
+    });
+    it('an UNRESOLVED HIGH with a post-dating disposition is NOT discharged: the resolve is required, predicate 2 denies first', () => {
+        const e = evaluate('synthetic-high-inline-unresolved-with-disposition.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('unresolved-bot-threads');
+        expect(e.detail.highInline).toBe(1);
+        expect(e.detail.dischargedHigh).toBe(0);
+    });
+    it('discharge is judged PER THREAD: one discharged beside one bare denies at predicate 4 naming the bare one', () => {
+        const e = evaluate('synthetic-high-inline-mixed-discharge.json');
+        expect(e.verdict.disposition).toBe('deny');
+        expect(e.verdict.provenance.ref).toBe('high-severity-inline');
+        expect(e.detail.highInline).toBe(1);
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.dischargedBy).toEqual({ inThreadReply: 1, prLevelDisposition: 0 });
+        expect(e.verdict.reason).toContain('coderabbitai');
+        expect(e.verdict.reason).toContain('"disposition: 1002 <verb>"');
+        expect(e.verdict.reason).toMatch(/a round disposition that did not name this thread/);
+    });
+    it('the pr-level fixture disposition names root 1001 on its line, read through the shipped predicate', () => {
+        // Read straight off the fixture rather than only through the verdict: the
+        // negative control's post-dating comments name nothing but 9999 (asserted
+        // above), while the pr-level fixture's disposition body names the thread.
+        const pr = loadFixture('synthetic-high-inline-discharged-pr-level.json').pages[0].body.data.repository.pullRequest;
+        const human = pr.comments.nodes.filter((c) => c.author.__typename === 'User');
+        expect(human).toHaveLength(1);
+        expect(dispositionedRootIds(human[0].body)).toEqual([1001]);
+    });
+    it('the disposition line is read at line start anywhere in the body, fenced included, and never inside an HTML comment, a quote, a list or a span', () => {
+        const line = 'disposition: 4000747291 declined';
+        // The skills render machine lines inside text fences; a fenced line counts.
+        expect(dispositionedRootIds(`## Round 1 disposition\n\n\`\`\`text\n${line}\n\`\`\`\n`)).toEqual([4000747291]);
+        expect(dispositionedRootIds(`prose\n\n${line}`)).toEqual([4000747291]);
+        expect(dispositionedRootIds(`   ${line}`)).toEqual([4000747291]);
+        expect(dispositionedRootIds(`\t${line}`)).toEqual([4000747291]);
+        expect(dispositionedRootIds(`## Round 1 disposition\r\n\r\n${line}\r\n`)).toEqual([4000747291]);
+        // Several lines, in order, without duplicates; a verb is not required.
+        expect(dispositionedRootIds('disposition: 11 fixed\ndisposition: 22 declined\ndisposition: 11 nit\ndisposition: 33')).toEqual([11, 22, 33]);
+        // Not at line start: an inline span mid-sentence, a blockquote, a list
+        // item, a table cell. Not the token: a prose sentence, a different key.
+        expect(dispositionedRootIds(`as recorded: \`${line}\`.`)).toEqual([]);
+        expect(dispositionedRootIds(`> ${line}`)).toEqual([]);
+        expect(dispositionedRootIds(`- ${line}`)).toEqual([]);
+        expect(dispositionedRootIds(`| ${line} |`)).toEqual([]);
+        expect(dispositionedRootIds('the disposition: 4000747291 was declined')).toEqual([]);
+        expect(dispositionedRootIds('dispositions: 4000747291 declined')).toEqual([]);
+        // An HTML comment is stripped before the read — terminated, or left open
+        // to the end of the body the way a renderer hides it (r3-f9).
+        expect(dispositionedRootIds(`<!--\n${line}\n-->`)).toEqual([]);
+        expect(dispositionedRootIds(`<!-- note\n${line}`)).toEqual([]);
+        expect(dispositionedRootIds(`${line}\n<!-- note`)).toEqual([4000747291]);
+        // The id is the exact decimal the seat copied: a longer run of digits is
+        // a different id, and nothing coerced — a leading zero, a fraction, a
+        // glued letter or dash is not this id (r3-f5: `Number()` had equated
+        // `01001`, `1001.5` and `1001x` to 1001).
+        expect(dispositionedRootIds('disposition: 40007472911 declined')).toEqual([40007472911]);
+        for (const lenient of [
+            'disposition: 04000747291 declined',
+            'disposition: 4000747291.0 declined',
+            'disposition: 4000747291.5 declined',
+            'disposition: 4000747291x declined',
+            'disposition: 4000747291-fixed',
+            'disposition: +4000747291 declined',
+            'disposition:4000747291 declined',
+            'Disposition: 4000747291 declined',
+        ]) {
+            expect(dispositionedRootIds(lenient), lenient).toEqual([]);
+        }
+        expect(dispositionedRootIds('disposition: 4000747291')).toEqual([4000747291]);
+        expect(dispositionedRootIds('disposition: 4000747291\r\n')).toEqual([4000747291]);
+        expect(dispositionedRootIds('no line at all')).toEqual([]);
+        // A fenced QUOTE of a prior disposition names the same ids it named — the
+        // disclosed residue of accepting fenced lines; it can only re-name threads
+        // an earlier disposition already named.
+        expect(dispositionedRootIds(`For the record, the round disposition read:\n\n\`\`\`\n${line}\n\`\`\``)).toEqual([4000747291]);
+    });
+    it('PR-level evidence on the SECOND comments page is found, with the cursor sent', () => {
+        const e = evaluate('synthetic-comments-second-page-evidence.json');
+        expect(e.verdict.disposition).toBe('allow');
+        expect(e.detail.dischargedHigh).toBe(1);
+        expect(e.detail.threads.pagesRead).toBe(2);
+        expect(e.calls[2]).toContain('commentsAfter=CURSOR-C1');
+    });
+    it('a resolved HIGH with more comments than the window and no evidence in what was read is a bare resolve that DENIES at both tiers, the reason naming the window (f2)', () => {
+        // Pre-cure this shape was a predicate-4 FACT that denied at every tier; a
+        // first fold routed it to the unevaluable class, which pilot maps to
+        // `warn` — a downgrade the first leg caught (f2). It is a fact-side deny
+        // again, judged on what was read, and the reason says the window was
+        // incomplete rather than calling the thread unanswered outright.
+        for (const tier of ['strict', 'pilot']) {
+            const e = evaluate('synthetic-high-inline-resolved-window-incomplete.json', { tier });
+            expect(e.verdict.disposition, tier).toBe('deny');
+            expect(e.verdict.provenance.ref, tier).toBe('high-severity-inline');
+            expect(e.verdict.reason, tier).toMatch(/no non-bot reply in the ten comments read \(the thread has more/);
+            expect(e.verdict.reason, tier).toContain('"disposition: 1001 <verb>"');
+            // The id sits inside the 160-character bound on `matched` (r3-f3).
+            expect(e.verdict.provenance.matched, tier).toContain('"disposition: 1001 <verb>"');
+            expect(e.detail.highInline, tier).toBe(1);
+            expect(e.detail.dischargedHigh, tier).toBe(0);
+            expect(e.notices.join('\n'), tier).not.toMatch(/could not derive/);
+        }
     });
     it('reads comment.commit (where the finding applies NOW), never originalCommit', () => {
         // The falsifier for the inert predicate this fold removed: both fixtures
@@ -627,6 +1153,8 @@ describe('merge-ready — pagination and the unevaluable class', () => {
             ['synthetic-reviews-connection-missing.json', /reviews connection was missing/],
             ['synthetic-threads-connection-missing.json', /review threads connection was missing/],
             ['synthetic-threads-pageinfo-missing.json', /review threads connection carried no pageInfo/],
+            // The evidence surface (mmnto-ai/totem#2861) is held to the same bar.
+            ['synthetic-comments-connection-missing.json', /PR comments connection was missing/],
         ]) {
             const strict = evaluate(file);
             expect(strict.verdict.disposition, file).toBe('deny');
@@ -671,6 +1199,7 @@ describe('merge-ready — pagination and the unevaluable class', () => {
             'synthetic-pagination-second-page-fails.json',
             'synthetic-head-moved.json',
             'synthetic-merge-state-unknown.json',
+            'synthetic-comments-connection-missing.json',
         ]) {
             for (const tier of ['strict', 'pilot']) {
                 const e = evaluate(file, { tier });