fix(sync): converge delivery in stable reviewed PRs

.github/scripts/__tests__/runtime-ac-merge-guard.test.js

@@ -60,6 +60,42 @@ test('blocks exact runtime AC labels', async () => {
   );
 });
 
+test('blocks mutable generated deliveries outside the sealed Maint 71 lane', async () => {
+  const labels = [{ name: 'sync:delivery-staging' }];
+  await assert.rejects(
+    () => assertRuntimeAcMergeAllowed({
+      owner: 'stranske',
+      repo: 'Ready',
+      prNumber: 900,
+      labels,
+      source: 'generic merger',
+    }),
+    (error) => error.code === 'generated_delivery_staging',
+  );
+  assert.deepEqual(await assertRuntimeAcMergeAllowed({
+    owner: 'stranske',
+    repo: 'Ready',
+    prNumber: 900,
+    labels,
+    source: 'maint-71',
+    allowSealedSyncDelivery: true,
+  }), { allowed: true, labels: [] });
+});
+
+test('sealed delivery exception does not bypass runtime acceptance labels', async () => {
+  await assert.rejects(
+    () => assertRuntimeAcMergeAllowed({
+      owner: 'stranske',
+      repo: 'Ready',
+      prNumber: 901,
+      labels: [{ name: 'sync:delivery-staging' }, { name: 'runtime-ac' }],
+      source: 'maint-71',
+      allowSealedSyncDelivery: true,
+    }),
+    (error) => error.code === 'runtime_ac_merge_blocked',
+  );
+});
+
 test('blocks prefixed labels using Orchestrator suffix semantics', () => {
   const requirement = runtimeAcRequirement([
     { name: 'verify:runtime-checks' },

.github/scripts/__tests__/sync_pr_lease_contract.test.js

@@ -6,6 +6,7 @@ const {
   DELIVERY_RECORD_SCHEMA,
   formatDeliveryRecord,
   parseDeliveryRecord,
+  replaceDeliveryRecord,
   mergeEligibility,
 } = require('../sync_pr_lease_contract');
 const { selectMergeEligibleSyncPr } = require('../sync_pr_merge_contract');
@@ -26,7 +27,15 @@ const current = {
 test('an unexpired matching delivery record is merge eligible', () => {
   const marker = formatDeliveryRecord(current);
   const parsed = parseDeliveryRecord(`summary\n${marker}`);
-  assert.deepEqual(parsed, { ...current, terminal_disposition: '' });
+  assert.deepEqual(parsed, {
+    ...current,
+    delivery_state: '',
+    review_started_at: '',
+    sealed_at: '',
+    sealed_head_sha: '',
+    review_evidence: {},
+    terminal_disposition: '',
+  });
   assert.deepEqual(mergeEligibility(parsed, {
     now: '2026-08-01T22:00:00Z',
     planId: 'plan-abc',
@@ -39,6 +48,47 @@ test('an unexpired matching delivery record is merge eligible', () => {
   assert.equal(mergeEligibility(parsed, { now: '2026-08-01T22:00:00Z', desiredTreeHash: 'other' }).reason, 'desired_tree_mismatch');
 });
 
+test('stable delivery is mergeable only after its exact head is sealed', () => {
+  const staging = { ...current, delivery_state: 'staging' };
+  assert.equal(mergeEligibility(staging, {
+    now: '2026-08-01T22:00:00Z',
+    requireSealed: true,
+    headSha: 'head-abc',
+  }).reason, 'delivery_not_sealed:staging');
+
+  const reviewingBody = replaceDeliveryRecord(formatDeliveryRecord(staging), {
+    delivery_state: 'reviewing',
+    review_started_at: '2026-08-01T21:30:00Z',
+  });
+  const sealedBody = replaceDeliveryRecord(reviewingBody, {
+    delivery_state: 'sealed',
+    sealed_at: '2026-08-01T21:45:00Z',
+    sealed_head_sha: 'head-abc',
+    review_evidence: { reason: 'review_quorum_met' },
+  });
+  const sealed = parseDeliveryRecord(sealedBody);
+  assert.equal(mergeEligibility(sealed, {
+    now: '2026-08-01T22:00:00Z',
+    requireSealed: true,
+    headSha: 'head-abc',
+  }).eligible, true);
+  assert.equal(mergeEligibility(sealed, {
+    now: '2026-08-01T22:00:00Z',
+    requireSealed: true,
+    headSha: 'head-other',
+  }).reason, 'sealed_head_mismatch');
+});
+
+test('delivery marker replacement treats dollar sequences as literal data', () => {
+  const body = `summary\n${formatDeliveryRecord(current)}`;
+  const replaced = replaceDeliveryRecord(body, {
+    generation: 'candidate-$&-$`-$\'',
+  });
+
+  assert.equal(parseDeliveryRecord(replaced).generation, 'candidate-$&-$`-$\'');
+  assert.equal((replaced.match(/sync-pr-delivery-record:v1/g) || []).length, 1);
+});
+
 test('only the newest matching generation is selected for merge', () => {
   const old = {
     number: 10,

.github/scripts/__tests__/sync_pr_merge_contract.test.js

@@ -15,8 +15,11 @@ const {
   classifySyncPrChecks,
   collectDeletableSyncBranches,
   evaluatePostPushReviewWindow,
+  evaluateReviewerSettlement,
   generatedDeliveryLane,
   isBlockingSyncSystemFailure,
+  isReviewerCapacitySignal,
+  isStableSyncBranchName,
   isTrustedGeneratedDeliveryPr,
   isTrustedSyncPr,
   normalizeSyncHash,
@@ -32,7 +35,11 @@ const {
   validateCanaryEvidence,
 } = require('../sync_pr_merge_contract');
 const { assertRuntimeAcMergeAllowed } = require('../runtime_ac_merge_guard');
-const { run } = require('../maint71_merge_sync_prs');
+const {
+  collectReviewerEvidence,
+  normalizeReviewPolicy,
+  run,
+} = require('../maint71_merge_sync_prs');
 
 const pr = (number, ref, created_at) => ({
   number,
@@ -183,6 +190,12 @@ test('maint71 recovers exact-head evidence from an already-merged candidate PR',
     graphql: async () => ({
       repository: {
         pullRequest: {
+          state: 'MERGED',
+          mergedAt: mergedCandidate.merged_at,
+          headRefOid: mergedCandidate.head.sha,
+          body: mergedCandidate.body,
+          createdAt: mergedCandidate.created_at,
+          updatedAt: mergedCandidate.updated_at,
           reviewThreads: { pageInfo: { hasNextPage: false }, nodes: [] },
         },
       },
@@ -349,6 +362,112 @@ test('post-push review window fails closed until seven full minutes elapse', ()
     true,
   );
   assert.equal(evaluatePostPushReviewWindow({}, '2026-08-11T13:09:00Z').ready, false);
+
+  const backdatedHead = evaluatePostPushReviewWindow({
+    head: { pushed_at: '2026-08-11T12:00:00Z' },
+    updated_at: '2026-08-11T13:08:00Z',
+  }, '2026-08-11T13:14:59Z');
+  assert.equal(backdatedHead.ready, false);
+  assert.equal(backdatedHead.anchor_at, '2026-08-11T13:08:00.000Z');
+});
+
+test('reviewer settlement never requires every configured reviewer', () => {
+  const base = {
+    reviewStartedAt: '2026-08-11T13:00:00Z',
+    configuredReviewers: ['copilot', 'codex', 'coderabbit'],
+    minimumResponses: 1,
+    quietPeriodMs: 7 * 60 * 1000,
+    maxWaitMs: 15 * 60 * 1000,
+  };
+  assert.equal(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:08:00Z',
+    respondedReviewers: ['copilot'],
+  }).reason, 'review_quorum_met');
+  assert.equal(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:08:00Z',
+    unavailableReviewers: ['copilot', 'codex', 'coderabbit'],
+  }).reason, 'review_capacity_degraded');
+  assert.equal(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:16:00Z',
+  }).reason, 'review_timeout_degraded');
+  assert.equal(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:06:59Z',
+    respondedReviewers: ['copilot'],
+  }).ready, false);
+  assert.deepEqual(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:08:00Z',
+  }), {
+    ready: false,
+    reason: 'review_quorum_pending',
+    eligible_at: '2026-08-11T13:15:00.000Z',
+    responded: [],
+    unavailable: [],
+  });
+  assert.equal(evaluateReviewerSettlement({
+    ...base,
+    now: '2026-08-11T13:08:00Z',
+    quietPeriodMs: Number.NaN,
+    maxWaitMs: Number.NaN,
+    minimumResponses: Number.NaN,
+  }).reason, 'review_quorum_pending');
+  assert.equal(isReviewerCapacitySignal('Reviewer unavailable: quota exceeded', ['quota']), true);
+  assert.equal(isReviewerCapacitySignal('Reviewer hit a rate-limit', ['rate-limit']), true);
+  assert.equal(isReviewerCapacitySignal('Reviewer hit a rate-limit', ['rate[ -]?limit']), false);
+});
+
+test('review policy normalizes invalid numeric values to finite defaults', () => {
+  const policy = normalizeReviewPolicy({
+    minimum_responses: 'invalid',
+    quiet_period_minutes: Number.NaN,
+    maximum_wait_minutes: -1,
+    reviewers: 'invalid',
+    capacity_patterns: null,
+  });
+  assert.equal(policy.minimum_responses, 1);
+  assert.equal(policy.quiet_period_minutes, 7);
+  assert.equal(policy.maximum_wait_minutes, 15);
+  assert.deepEqual(policy.reviewers, []);
+  assert.deepEqual(policy.capacity_patterns, []);
+});
+
+test('reviewer evidence query retries and fails closed when GraphQL is unavailable', async () => {
+  const warnings = [];
+  let retryCalls = 0;
+  const result = await collectReviewerEvidence({
+    owner: 'stranske',
+    repo: 'Ready',
+    number: 99,
+    reviewStartedAt: '2026-08-11T13:00:00Z',
+    withRetry: async (operation) => {
+      retryCalls += 1;
+      return operation({
+        graphql: async () => {
+          throw new Error('rate limited');
+        },
+      });
+    },
+    core: { warning: (message) => warnings.push(message) },
+  });
+  assert.equal(retryCalls, 1);
+  assert.deepEqual(result, { responded: [], unavailable: [], truncated: true });
+  assert.match(warnings[0], /Unable to read reviewer evidence/);
+});
+
+test('stable delivery branches and strict branch-update failures are recognized', () => {
+  assert.equal(isStableSyncBranchName('sync/workflows-candidate'), true);
+  assert.equal(isStableSyncBranchName('sync/workflows-delivery'), true);
+  assert.equal(isStableSyncBranchName('sync/workflows-deadbeef'), false);
+  assert.equal(requiresStrictGateBranchUpdate({
+    pr: { mergeable_state: 'behind' },
+    requiredContexts: new Set(['Gate / gate']),
+    willMerge: true,
+  }), true);
+  assert.equal(isBlockingSyncSystemFailure('pr_refresh_failed'), true);
 });
 
 test('strict required checks update behind branches before a generated merge', () => {
@@ -519,6 +638,20 @@ test('selectActiveSyncPr can target the stable canary candidate branch', () => {
   assert.deepEqual(selection.stale.map((item) => item.number), [2]);
 });
 
+test('selectActiveSyncPr never marks another generated-delivery lane stale', () => {
+  const selection = selectActiveSyncPr(
+    [
+      pr(1, 'sync/workflows-candidate', '2026-04-25T01:00:00Z'),
+      pr(2, 'sync/workflows-old-wave', '2026-04-25T02:00:00Z'),
+      pr(3, 'deps/sync-dev-versions-wave', '2026-04-25T03:00:00Z'),
+    ],
+    'candidate',
+  );
+
+  assert.equal(selection.active.number, 1);
+  assert.deepEqual(selection.stale.map((item) => item.number), [2]);
+});
+
 test('selectActiveSyncPr reports missing target without marking stale PRs', () => {
   const selection = selectActiveSyncPr(
     [pr(1, 'sync/workflows-other', '2026-04-25T01:00:00Z')],
@@ -574,10 +707,18 @@ test('buildMergeReport provides machine-readable summary counts', () => {
     checks_pending: 0,
     candidate_evidence_required: 0,
     review_window_pending: 0,
+    review_window_started: 0,
+    reviewer_settlement_pending: 0,
+    delivery_review_not_started: 0,
+    delivery_sealed_checks_pending: 0,
+    sealed_head_mismatch: 0,
+    stable_base_refresh_required: 0,
     head_changed: 0,
     review_blocked: 0,
     ready: 0,
     dry_run_merge: 1,
+    dry_run_review_start: 0,
+    dry_run_seal: 0,
     merge_blocked_runtime_ac: 0,
     merged: 0,
     merge_failed: 0,