fix(ci): the staleness premise is false for CodeRabbit, so ship it off (#3312)

Fifth-round review of #3317. The `claimed-verdict` rule false-positives on 2 of
its 4 claimed fires, INCLUDING THE FLAGSHIP #3276, and the cause is a premise
this repo's primary reviewer does not honour: CODERABBIT SUBMITS NO REVIEW EVENT
AT ALL WHEN A RUN FINDS NOTHING ACTIONABLE. So "no review object naming the
head" is not "the head was not reviewed". Measured live 2026-08-26 on all four:

  #3276 head 1305f77 -- Review queued 14:09:52 -> in progress 14:09:55 ->
  success 14:12:27. A real 155 s cycle ON THE HEAD, and the walkthrough comment
  updated 14:12:25Z reads "No actionable comments were generated in the recent
  review" over "changes between c26e453 and 1305f77": the head, including the
  commit the rule called unreviewed. #3288 is identical (181 s, head named).
  BOTH FALSE.

  #3227 (14 s) and #2952 (9 s) are genuine -- their walkthroughs read "Reviews
  paused ... under active development", and CodeRabbit published
  `success / Review completed` regardless.

NOTHING IN THE STRUCTURED DATA SEPARATES THE TWO PAIRS. The status is
byte-identical across all four; CodeRabbit publishes no check RUN on any of
these heads, so there is no `conclusion` or `output.title` to read; and the
suggested narrowing -- "a completed review cycle on this head counts as review"
-- is not a narrowing but a deletion, because clause (b) already requires
`success` on the head and a `success` on the head IS a completed cycle, so it
silences #3227 and #2952 too. What is left is cycle DURATION, an unversioned
timing heuristic on a third party, and the reviewer's PROSE, which the config
rules out on purpose. It also contradicted this file's own stated hole: #3316
has success on its head, zero reviews, and is deliberately silent.

A rule that is wrong half the time cannot gate a PR and cannot be repaired with
a discriminator that does not exist, so the machinery, the three scopings and
the four worked examples all ship and `staleReviewPolicy` DEFAULTS TO `off`.
`off` is inert rather than merely silent -- it adjudicates nothing, so it
refuses nothing and does not pay for the paginated reviews walk -- and it NEVER
prints a pass: it prints `STALE_REVIEW not adjudicated` naming the knob.
#3227/#2952 stay catchable for whoever opts in. Verified live over #3276, #3288,
#3227, #2952, #3315, #3309, #2931 and #3316: `off` is silent on all eight, and
`claimed-verdict` still reproduces its 4-fire/4-silent table exactly.

A SUPPRESSED FINDING NO LONGER RENDERS AS A CLEAN PASS. With
`staleReviewSeverity: "fail"` and the shipped `reviewVerdictSeverity: "warn"`, a
rate-limited CodeRabbit with a stale review printed
`✅ No reviewer claims a verdict ... from a review of an older commit` and exited
0, while the same input under `configured-authors` printed `❌ STALE_REVIEW` and
exited 1: the `alreadyFlagged` dedup dropped the finding, so `stale.length === 0`
conflated "clean" with "suppressed" and the severity knob was inoperative.
`staleReviews` now returns the finding with `suppressedBy` set, and the caller
suppresses the SENTENCE, not the VERDICT -- one line naming what already
reported it, and the exit code still tracks the knob.

ORDERING IS `id` ALONE, and the old `(submitted_at, id)` was strictly worse: the
primary key was the one field that can be absent, so a review AT THE HEAD with
no timestamp sorted to `''`, lost to every dated review, and would have reported
a CURRENT PR as stale -- the finding the JSDoc promises is impossible. `id` is
always present (`UNREADABLE_REVIEW_ID` refuses otherwise) and removes the class
outright. `submitted_at` is still printed, no longer compared.

`fetchCheckRunDescriptions` now walks `--paginate --slurp` through
`flattenCheckRunPages`, which refuses a partial walk. It was not live (31 check
runs on the largest head measured, against a 100 page size) but the failure mode
was the bad one: under `claimed-verdict` a missing context is adjudicated by
SILENCE, so truncation was a false negative, not a failure.

And the gate's own unit tests now RUN. Neither test file was reached by any
workflow -- test.yml names its script tests one by one and this pair was never
added, and check-test-glob-coverage audits package globs, not `scripts/`.

10 mutations run against the guards; 10 of 10 caught, and the tenth only after
adding the WIRING test the sweep proved was missing: replacing
`flattenCheckRunPages(...)` with an inline `pages.flatMap(p => p.check_runs ?? [])`
survived the entire suite, because the helper's refusal was tested and its USE
was not. Every mutation restored by inverse edit, byte-identity asserted.

Refs #3312

Claude-Session: https://claude.ai/code/session_01QPHChk3Ve9N519A4kY7436

Author: BIMvoice

.github/workflows/pr-review-signal.yml

@@ -113,6 +113,18 @@ jobs:
       # because the fan-out boundary produces a ~1 s window in which every
       # published lane is terminal and more are still coming -- so the
       # genuine-absence path costs 60 s, not the whole budget.
+      # THE GATE'S OWN UNIT TESTS, RUN BEFORE THE GATE. Neither
+      # `scripts/check-pr-review-signal.test.mjs` nor
+      # `scripts/lib/pr-review-signal.test.mjs` was reached by any workflow: the
+      # test.yml lanes name their script files one by one and this pair was
+      # never added, and `check-test-glob-coverage` audits package globs, not
+      # `scripts/`. A gate whose fail-closed refusals, severity knobs and
+      # policy scopings are asserted only on a developer's machine is a gate
+      # nobody is checking, which is the shape this whole workflow exists to
+      # reject. Same job, no `pnpm install` -- node builtins only, like the gate.
+      - name: Unit-test the gate itself
+        run: node --test scripts/check-pr-review-signal.test.mjs scripts/lib/pr-review-signal.test.mjs
+
       - name: Check required lanes ran and reviews produced a verdict
         env:
           GH_TOKEN: ${{ github.token }}

scripts/check-pr-review-signal.mjs

@@ -107,12 +107,23 @@
  *     WHICH REVIEWS COUNT IS A POLICY CALL AND IS DELIBERATELY NOT SETTLED HERE.
  *     It is `staleReviewPolicy` in the config, validated like
  *     `reviewVerdictSeverity` — an unrecognised value is `BAD_CONFIG`, never a
- *     silent downgrade. The shipped default `claimed-verdict` is the narrowest
- *     rule that still catches #3276. The lib documents the measurements that
- *     rule out the two obvious alternatives, both of which are wrong against
- *     this repository's data: dropping `COMMENTED` makes the check a no-op, and
- *     treating "no review at the head" as staleness fires on PRs where the
- *     reviewer never submitted a review object at all.
+ *     silent downgrade. `claimed-verdict` is the narrowest rule that still
+ *     catches #3276. The lib documents the measurements that rule out the two
+ *     obvious alternatives, both of which are wrong against this repository's
+ *     data: dropping `COMMENTED` makes the check a no-op, and treating "no
+ *     review at the head" as staleness fires on PRs where the reviewer never
+ *     submitted a review object at all.
+ *
+ *     AND THE SHIPPED DEFAULT IS `off`, BECAUSE THE PREMISE IS FALSE FOR THIS
+ *     REPO'S PRIMARY REVIEWER. CodeRabbit submits NO REVIEW EVENT when a run
+ *     finds nothing actionable, so "no review object naming the head" is not
+ *     "the head was not reviewed": #3276 and #3288 each show a real 155 s /
+ *     181 s review cycle ON THE HEAD and a walkthrough naming the head, and
+ *     they are false fires; #3227 and #2952 are genuine ("Reviews paused"). No
+ *     structured field separates the two pairs — see the lib and the config for
+ *     the measurements and for why the obvious narrowing deletes the rule
+ *     instead. So it ships OFF, it NEVER prints a pass while off, and the knob
+ *     opts back in. #3227 and #2952 stay catchable for whoever sets it.
  *
  *     SEVERITY `warn`, same `@unwired-by-design` ruling as part 2: whether a bot
  *     has re-reviewed the newest push is transient GitHub state, not a fact
@@ -147,6 +158,7 @@ import {
   expandJobNames,
   flattenReviewPages,
   missingLanes,
+  flattenCheckRunPages,
   noVerdictReviews,
   pollForLanes,
   staleReviews,
@@ -436,22 +448,21 @@ function fetchStatusDescriptions(opts) {
  * @param {{ repo: string, sha: string }} opts
  */
 function fetchCheckRunDescriptions(opts) {
-  const data = gh(
+  // `--paginate --slurp`, for the same reason as the reviews walk and one that
+  // is worse here: a truncated check-run read drops a reviewer CONTEXT, and a
+  // dropped context is adjudicated by silence, not by a failure. `--jq` is not
+  // available alongside `--slurp`, so the `.check_runs` projection moves into
+  // `flattenCheckRunPages`, where the partial-walk refusal is testable.
+  const pages = gh(
     [
       'api',
+      '--paginate',
+      '--slurp',
       `repos/${opts.repo}/commits/${opts.sha}/check-runs?per_page=100`,
-      '--jq',
-      '.check_runs',
     ],
     `check runs for ${opts.sha}`,
   );
-  if (!Array.isArray(data)) {
-    throw new ReviewSignalError(
-      'NO_CHECK_RUNS',
-      `The check-runs API returned a non-array for ${opts.sha}. Refusing to read that as ` +
-        '"no reviewer said anything".',
-    );
-  }
+  const data = flattenCheckRunPages(pages, `check runs for ${opts.sha}`);
   return data.map((c) => ({
     name: c.name ?? '',
     state: String(c.conclusion ?? '').toLowerCase(),
@@ -598,7 +609,28 @@ export function evaluate({ required, lanes, reviewChecks, reviews, headSha, isFo
     // specific of the two. Saying it twice is noise, not diligence.
     alreadyFlagged: findings.map((f) => f.name),
   });
-  if (stale.length === 0) {
+  // THREE STATES, NOT TWO. `clean`, `found`, and `not adjudicated` -- and only
+  // the first of them may print a tick. An empty finding list used to mean both
+  // "nobody is stale" and "the finding was deduped away", so a suppressed
+  // finding rendered as a pass the gate had not earned. That is the exact
+  // defect class this file exists to remove, so a suppressed finding now prints
+  // its own line and still moves the exit code.
+  const reported = stale.filter((f) => f.suppressedBy === null);
+  const suppressed = stale.filter((f) => f.suppressedBy !== null);
+  if (cfg.staleReviewPolicy === 'off') {
+    // NOT a tick. `off` means this question was not asked; saying "no reviewer
+    // claims a verdict from an older review" would be an answer nobody
+    // computed. See the config for why `off` is the shipped default.
+    lines.push(
+      '➖ STALE_REVIEW not adjudicated: `staleReviewPolicy` is "off", so this gate does NOT ' +
+        'tell you whether a',
+      '   review of an older commit is standing in for a review of the head. That is a hole, ' +
+        'stated rather than',
+      '   papered over with a tick — see the config for the measured premise defect that turned ' +
+        'it off, and the',
+      '   knob that opts back in.',
+    );
+  } else if (stale.length === 0) {
     lines.push(
       `✅ No reviewer claims a verdict on ${headSha.slice(0, 8)} from a review of an older commit ` +
         `(policy: ${cfg.staleReviewPolicy}).`,
@@ -607,14 +639,33 @@ export function evaluate({ required, lanes, reviewChecks, reviews, headSha, isFo
     const fatal = cfg.staleReviewSeverity === 'fail';
     if (fatal) ok = false;
     const mark = fatal ? '❌' : '⚠️ ';
-    for (const f of stale) {
+    for (const f of reported) {
       lines.push(
         `${mark} STALE_REVIEW: \`${f.context ?? f.login}\` reads as having reviewed this PR, but ` +
           `${f.login}'s newest review is of ${f.reviewedSha.slice(0, 8)}` +
           `${f.submittedAt ? ` (${f.submittedAt})` : ''}, not of the head ` +
           `${headSha.slice(0, 8)}.`,
       );
     }
+    // The SENTENCE is the duplicate, not the finding. Part 2 has already
+    // quoted this reviewer verbatim and the remedy is identical, so this says
+    // so in one line rather than repeating the whole paragraph — and the
+    // severity knob above has already been applied to it.
+    for (const f of suppressed) {
+      lines.push(
+        `${mark} STALE_REVIEW: \`${f.context ?? f.login}\` is ALSO stale — its newest review is ` +
+          `of ${f.reviewedSha.slice(0, 8)}, not ${headSha.slice(0, 8)} — reported above as ` +
+          `\`${f.suppressedBy}\`; same remedy, so it is not restated.`,
+      );
+    }
+    if (reported.length === 0) {
+      lines.push(
+        '   Re-run the reviewer on the head. Everything pushed since that commit is unreviewed ' +
+          'code under a passing signal.',
+      );
+    }
+  }
+  if (reported.length > 0) {
     lines.push(
       '   A review whose `commit_id` is not the PR head has not reviewed the PR (#3312). ' +
         'Everything pushed since',
@@ -719,12 +770,20 @@ function main() {
     ...fetchStatusDescriptions({ repo, sha: state.sha }),
     ...fetchCheckRunDescriptions({ repo, sha: state.sha }),
   ];
-  const reviews = fetchReviews({ repo, pr: args.pr });
+  // `off` READS NOTHING. The policy adjudicates nothing, so paying for a
+  // paginated walk — and, worse, letting its REVIEWS_TRUNCATED refusal take the
+  // gate down — over a question this run does not ask would be noise. Parts 1
+  // and 2 are untouched.
+  const reviews = cfg.staleReviewPolicy === 'off' ? [] : fetchReviews({ repo, pr: args.pr });
 
   console.log(`PR #${args.pr} @ ${state.sha}${state.isFork ? ' (fork)' : ''}`);
   console.log(`Required lanes derived from ${args.workflow}: ${required.length}`);
   console.log(`Rollup lanes seen: ${state.lanes.length}`);
-  console.log(`Review events read: ${reviews.length}`);
+  console.log(
+    cfg.staleReviewPolicy === 'off'
+      ? 'Review events read: none (staleReviewPolicy is "off")'
+      : `Review events read: ${reviews.length}`,
+  );
   console.log('');
 
   const { ok, lines } = evaluate({

scripts/check-pr-review-signal.test.mjs

@@ -616,11 +616,25 @@ const STATE_3276 = (commitId) => ({
   headSha: HEAD_3276,
 });
 
+/**
+ * PART 3 OPTED IN.
+ *
+ * The SHIPPED default is `off` — see the config's premise note: CodeRabbit
+ * submits no review event when a run finds nothing actionable, so 2 of
+ * `claimed-verdict`'s 4 live fires were false. The rule still ships, and every
+ * test below that exercises it therefore says so explicitly rather than
+ * inheriting a default. The `off` behaviour is asserted separately.
+ */
+const ON = (patch = {}, tag = 'part3-on') => [
+  '--config',
+  cfgWith({ staleReviewPolicy: 'claimed-verdict', ...patch }, tag),
+];
+
 /** The staleness knob forced to `fail`, as `FATAL` does for part 2. */
-const FATAL_STALE = () => ['--config', cfgWith({ staleReviewSeverity: 'fail' }, 'fatal-stale')];
+const FATAL_STALE = () => ON({ staleReviewSeverity: 'fail' }, 'fatal-stale');
 
 test('the #3276 shape: lanes clean, no-verdict clean, and the review still names an older commit', () => {
-  const r = run(STATE_3276(OLD_3276));
+  const r = run(STATE_3276(OLD_3276), ON());
   assert.match(r.output, /All 3 required lane\(s\)/);
   assert.match(r.output, /none reports a passing state over a review it did not perform/);
   assert.match(r.output, /STALE_REVIEW: `CodeRabbit`/);
@@ -633,7 +647,7 @@ test('the #3276 shape: lanes clean, no-verdict clean, and the review still names
 test('ANTI-VACUITY: the identical PR with the review AT the head reports no staleness', () => {
   // #3315, #3309 and #2931 live. Without this, an implementation that always
   // reports stale passes the test above.
-  const r = run(STATE_3276(HEAD_3276));
+  const r = run(STATE_3276(HEAD_3276), ON());
   assert.doesNotMatch(r.output, /STALE_REVIEW/);
   assert.match(r.output, /No reviewer claims a verdict on 1305f778 from a review of an older commit/);
   assert.match(r.output, /policy: claimed-verdict/);
@@ -650,35 +664,77 @@ test('ESCALATION: `staleReviewSeverity: fail` turns the same finding red', () =>
   assert.equal(green.code, 0, green.output);
 });
 
-test('the SHIPPED default for part 3 is `warn`, asserted once', () => {
+test('the SHIPPED default for part 3 is `off`, and `off` NEVER prints a tick', () => {
   const cfg = JSON.parse(readFileSync(CONFIG, 'utf8'));
   assert.equal(cfg.staleReviewSeverity, 'warn');
-  assert.equal(cfg.staleReviewPolicy, 'claimed-verdict');
+  assert.equal(cfg.staleReviewPolicy, 'off');
+
+  // #3276's own shape, the one `claimed-verdict` fires on, under the shipped
+  // config. It must say the question was not asked — not answer it.
+  const r = run(STATE_3276(OLD_3276));
+  assert.doesNotMatch(r.output, /No reviewer claims a verdict/, 'a tick nobody earned');
+  assert.doesNotMatch(r.output, /STALE_REVIEW: /);
+  assert.match(r.output, /STALE_REVIEW not adjudicated/);
+  assert.match(r.output, /`staleReviewPolicy` is "off"/);
+  assert.equal(r.code, 0, r.output);
+
+  // MUTATION GUARD: `off` is inert, not merely silent. Under `claimed-verdict`
+  // each of these is a refusal (asserted below); under `off` the gate does not
+  // fall over on a question it never asks.
+  const inert = runRaw({ required: HEALTHY, lanes: HEALTHY.map((n) => LANE(n)) });
+  assert.equal(inert.code, 0, inert.output);
+  assert.match(inert.output, /STALE_REVIEW not adjudicated/);
+  assert.doesNotMatch(inert.output, /NO_REVIEWS|NO_HEAD_SHA/);
 });
 
 test('NO NAG: a reviewer with no review event and a `Review completed` status is silent', () => {
   // #3316 and #3205 verbatim: `CodeRabbit :: success / Review completed` and
   // zero review events. A stated hole, not an oversight.
-  const r = run({ ...STATE_3276(OLD_3276), reviews: [] });
+  const r = run({ ...STATE_3276(OLD_3276), reviews: [] }, ON());
   assert.doesNotMatch(r.output, /STALE_REVIEW/);
   assert.equal(r.code, 0, r.output);
 });
 
-test('DEDUPE: a rate-limited CodeRabbit is reported by part 2 only, not twice', () => {
-  const r = run(
-    {
-      ...STATE_3276(OLD_3276),
-      reviewChecks: [
-        { name: 'CodeRabbit', state: 'success', description: 'Review rate limited' },
-      ],
-    },
+test('DEDUPE: a suppressed finding is said ONCE and still moves the exit code', () => {
+  // RED, verbatim, before the fix: this exact input with `staleReviewSeverity`
+  // forced to `fail` printed
+  //   ✅ No reviewer claims a verdict on 1305f778 from a review of an older commit
+  // and exited 0, while the same input under `configured-authors` printed
+  //   ❌ STALE_REVIEW: `CodeRabbit` …
+  // and exited 1. The dedupe made the severity knob inoperative and rendered a
+  // suppressed finding as a clean pass — the defect class this gate exists to
+  // remove.
+  const rateLimited = {
+    ...STATE_3276(OLD_3276),
+    reviewChecks: [{ name: 'CodeRabbit', state: 'success', description: 'Review rate limited' }],
+  };
+  const r = run(rateLimited, FATAL_STALE());
+  assert.match(r.output, /NO_VERDICT: `CodeRabbit`/);
+  // A tick is the one thing it must never print here.
+  assert.doesNotMatch(r.output, /No reviewer claims a verdict/);
+  // Said once: the full three-line staleness paragraph is NOT repeated…
+  assert.doesNotMatch(r.output, /reads as having reviewed this PR/);
+  // …but the finding is stated, and it names what already reported it.
+  assert.match(r.output, /STALE_REVIEW: `CodeRabbit` is ALSO stale/);
+  assert.match(r.output, /reported above as `CodeRabbit`/);
+  assert.match(r.output, /Re-run the reviewer on the head/);
+  // And the knob is operative: `fail` is red.
+  assert.equal(r.code, 1, r.output);
+
+  // ANTI-VACUITY, both ways. Same rate-limited input with the review AT the
+  // head is genuinely clean and prints the tick it earned…
+  const clean = run(
+    { ...rateLimited, reviews: [REVIEW_3276(HEAD_3276)] },
     FATAL_STALE(),
   );
-  assert.match(r.output, /NO_VERDICT: `CodeRabbit`/);
-  assert.doesNotMatch(r.output, /STALE_REVIEW/);
-  // Part 2 is `warn` by default, part 3 was forced to `fail` — so a leaked
-  // duplicate would have shown up as a non-zero exit as well as a second line.
-  assert.equal(r.code, 0, r.output);
+  assert.match(clean.output, /No reviewer claims a verdict/);
+  assert.doesNotMatch(clean.output, /STALE_REVIEW/);
+  assert.equal(clean.code, 0, clean.output);
+  // …and at the shipped `warn` the suppressed finding is a warning, not red,
+  // so the exit code tracks the knob rather than the branch.
+  const warned = run(rateLimited, ON());
+  assert.match(warned.output, /STALE_REVIEW: `CodeRabbit` is ALSO stale/);
+  assert.equal(warned.code, 0, warned.output);
 });
 
 // ------------------------------------------------- fail-closed, as a process
@@ -688,21 +744,27 @@ test('FAIL CLOSED: a state file that omits `reviews` gets NO_REVIEWS, not a succ
   // path, and the last defect in this file was exactly that path quietly
   // supplying a value (`timedOut: false`) the real path computes. Defaulting
   // `reviews` to `[]` inside the gate would repeat it.
-  const r = runRaw({ required: HEALTHY, lanes: HEALTHY.map((n) => LANE(n)), headSha: HEAD_3276 });
+  const r = runRaw(
+    { required: HEALTHY, lanes: HEALTHY.map((n) => LANE(n)), headSha: HEAD_3276 },
+    ON(),
+  );
   assert.equal(r.code, 1, r.output);
   assert.match(r.output, /NO_REVIEWS/);
   assert.doesNotMatch(r.output, /No reviewer claims a verdict/);
 });
 
 test('FAIL CLOSED: a state file that omits `headSha` gets NO_HEAD_SHA', () => {
-  const r = runRaw({ required: HEALTHY, lanes: HEALTHY.map((n) => LANE(n)), reviews: [] });
+  const r = runRaw(
+    { required: HEALTHY, lanes: HEALTHY.map((n) => LANE(n)), reviews: [] },
+    ON(),
+  );
   assert.equal(r.code, 1, r.output);
   assert.match(r.output, /NO_HEAD_SHA/);
   assert.doesNotMatch(r.output, /No reviewer claims a verdict/);
 });
 
 test('FAIL CLOSED: an unreadable `commit_id` refuses instead of comparing an older review', () => {
-  const r = run({ ...STATE_3276(OLD_3276), reviews: [REVIEW_3276('c26e453d')] });
+  const r = run({ ...STATE_3276(OLD_3276), reviews: [REVIEW_3276('c26e453d')] }, ON());
   assert.equal(r.code, 1, r.output);
   assert.match(r.output, /UNREADABLE_COMMIT_ID/);
 });
@@ -748,6 +810,39 @@ test('FAIL CLOSED: an empty or malformed `reviewAuthors` refuses', () => {
   assert.match(l.output, /needs a non-empty `login`/);
 });
 
+test('WIRING: both API walks are paginated AND flattened through the refusing helper', () => {
+  // NOT reachable through `--state-file`, which is exactly why it is asserted
+  // over the source. A mutation that replaced `flattenCheckRunPages(pages, …)`
+  // with an inline `pages.flatMap((p) => p.check_runs ?? [])` survived the
+  // whole suite: the helper's refusal is tested, its USE was not. Both walks
+  // are covered, because the same hole existed on the reviews side.
+  const src = readFileSync(GATE, 'utf8');
+  const fn = (name) => {
+    const at = src.indexOf(`function ${name}(`);
+    assert.ok(at > 0, `${name} exists`);
+    return src.slice(at, src.indexOf('\n}\n', at));
+  };
+  for (const [name, helper] of [
+    ['fetchCheckRunDescriptions', 'flattenCheckRunPages'],
+    ['fetchReviews', 'flattenReviewPages'],
+  ]) {
+    // Comments in these bodies legitimately NAME the fields, so compare code.
+    const body = fn(name)
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('//'))
+      .join('\n');
+    // A truncated walk drops rows silently — a false NEGATIVE for part 2 and a
+    // false POSITIVE for part 3 — so neither may rest on a `per_page` guess.
+    assert.match(body, /'--paginate'/, `${name} must paginate`);
+    // `--slurp` is what keeps the page boundaries visible, and it is the only
+    // reason the helper can tell a short page from a stopped walk.
+    assert.match(body, /'--slurp'/, `${name} must slurp`);
+    assert.match(body, new RegExp(`${helper}\\(`), `${name} must flatten via ${helper}`);
+    // …and must not hand-roll the flatten around it.
+    assert.doesNotMatch(body, /flatMap|\.check_runs\b/, `${name} must not inline the flatten`);
+  }
+});
+
 test('POLICY: `all-authors` is reachable through the config and changes the answer', () => {
   // Proves the knob is wired end to end rather than merely validated: the same
   // state file, clean under the default, is a finding under `all-authors`.
@@ -766,7 +861,10 @@ test('POLICY: `all-authors` is reachable through the config and changes the answ
     ],
     headSha: HEAD_3276,
   };
-  const dflt = run(state);
+  // Clean under `claimed-verdict` (no configured context claims a verdict) —
+  // compared against `claimed-verdict` explicitly, not against the shipped
+  // `off`, which would make the contrast trivially true for the wrong reason.
+  const dflt = run(state, ON());
   assert.doesNotMatch(dflt.output, /STALE_REVIEW/);
 
   const all = run(state, ['--config', cfgWith({ staleReviewPolicy: 'all-authors' }, 'all')]);