test(ci): cover duplicate runs and late legacy publication

[dnlrsls]

Draft: NO MERGE / NO ENQUEUE. This PR closes only the narrow regression-tracking child #1868, not the #1802 rollout. Keep #1802 and #1810 open. These local tests do not establish hosted late-legacy check consumption or authorize integration.

🔗 Linked Issue

Closes #1868
Refs #1802

🏷️ PR Type

• type:bug — Bug fix
• type:feature — New feature
• type:question — Question requiring tracked work
• type:docs — Documentation only
• type:refactor — Code refactoring
• type:chore — Maintenance, dependencies, tooling
• type:breaking-change — Breaking change

📝 Summary

• Cover selection of the newest admissible native run from an unordered listing, with valid per-run metadata and identity evidence for every candidate.
• Use a test-only promise barrier to reproduce an old legacy approval success publishing after a current native approval failure, then verify that native reevaluation still reads current unapproved labels.
• Pin existing behavior and its publication window without modifying production code, workflows, credentials, permissions, required contexts, legacy/queue writers or live fixtures. These tests do not emulate or prove GitHub's required-check selection.

📂 Changes

File	Change
.github/scripts/issue-refresh-router.test.mjs	Three unordered admissible runs; assert newest-ID-only admission/rerun and unchanged fixture metadata
.github/scripts/issue-validation-composed.test.mjs	Test-only shared label state and publication barrier; assert exact old publication, current native failure before/after, API calls and prohibited effects

The current diff is two test files only (106 additions, 2 deletions) at head 574aadc5436e141952ce9ae7bb6aa6240d8388b2, against merged main ebfc137c6376102ca293ff96c917fd6621cb207b. Merge commit 574aadc5 preserves upstream production policy, including the issue-assignee readiness rule; only the regression fixtures were adapted.

🧪 Test Plan

• Focused local regressions and upstream assignment guard: node --test --test-name-pattern='multiple admissible native runs|a paused legacy success|composed refresh publishes assignment failure' .github/scripts/issue-refresh-router.test.mjs .github/scripts/issue-validation-composed.test.mjs — 3/3 PASS, exit 0.
• Affected script suite: node --test .github/scripts/*.test.mjs — 294/294 PASS, exit 0; no failures, cancellations or skips.
• Merge resolution and structural checks — exact two-test scope against ebfc137c6376102ca293ff96c917fd6621cb207b, no remaining conflicts or unstaged changes, whitespace checks and public transient-artifact policy PASS. Private operational artifacts excluded.
• Local Go suite — N/A: only JavaScript tests changed. Full hosted CI, including Go Unit/E2E, passed on the current head in run 38511309417.
• Original regression coverage pinned existing behavior, not a production fix. During integration of current main, the native test fixture initially failed because it omitted required assignees metadata (focused RED: 2 passed, 1 failed). Adding an assigned owner only to that fixture produced GREEN: 3/3. The upstream unassigned-issue rejection test remains intact and passes; no production guard was weakened.

🤖 Automated Checks

Snapshot verified after the normal push of 574aadc5436e141952ce9ae7bb6aa6240d8388b2: all required contexts and applicable CI jobs passed. The results below refer to that completed head-specific observation, not a forecast for the automatic metadata validation triggered by this description edit. Performance Ratchet was skipped. CodeRabbit reported success but explicitly skipped review because this PR is draft; no review approval is claimed. No live approval mutation, fixture rerun or new acceptance probe is authorized.

Check	Status
Check Issue Reference	PASS — observed on 574aadc5
Check Issue Has status:approved	PASS — observed on 574aadc5
Check PR Has type:* Label	PASS — observed on 574aadc5
Check PR Has No Transient Artifacts	PASS — observed on 574aadc5
Unit Tests	PASS — observed on 574aadc5
E2E Tests	PASS — observed on 574aadc5
Plugin Tests	PASS — observed on 574aadc5
Lint	PASS — observed on 574aadc5
Windows Setup Test	PASS — observed on 574aadc5
Cloud Sync Wrapper Tests (Windows)	PASS — observed on 574aadc5

✅ Contributor Checklist

• Linked approved regression-tracking child question(ci): regression coverage for duplicate runs and late legacy publication #1868; parent feat(ci): refresh linked PR validation when issue approval changes #1802 is reference-only
• Exactly one canonical PR type label requested at creation: type:chore
• Recorded actual focused and affected test commands/outcomes
• Recorded additional local structural checks and missing hosted evidence
• Documentation changes N/A: no production or contributor-facing behavior changed; test comment explicitly limits the modeled publication window
• Conventional commit without Co-Authored-By trailers
• Every changed path checked against the public transient-artifact policy; private operational notes/scripts excluded

💬 Notes for Reviewers

The late-publication test deliberately shows that a legacy success MAY be published after a native failure because evaluation and publication are not atomic. It does not claim that stale publication is prevented, that GitHub chooses a particular duplicate check, or that a required gate stays blocked under arbitrary completion orders. Reconciliation is eventual, not an atomic/no-stale-success guarantee.

Prior basic fork evidence remains in #1802 (comment). Duplicate/late-legacy hosted check consumption, changed-head/rapid-event races, merge-queue compatibility and actual manual recovery remain separate acceptance work. Keep legacy validators and #1810 blocked.

Publication authorizes this commit/fork push/draft PR and normal PR CI only. No merge, enqueue, auto-merge, issue closure, live fixture mutation, additional probe, manual workflow rerun or cleanup. Retain #1858/#1859 and #1865/#1866 unchanged.

Native assessment of the current committed range against ebfc137c6376102ca293ff96c917fd6621cb207b: medium, two files/108 diff lines, reviewDue false (under budget); writer self-verification stands. No native review approval is claimed. Risk: none for production behavior (test-only changes).

Metadata-validation observation (post-linkage)

Observed after relinking to #1868: native issue validation passed, but transitional API check 115673830187 failed with PR #1867: issue #1868 unavailable (fetch failed). No historical workflow rerun was executed because its original PR/event binding could not be established. That earlier note triggered a normal covered PR edit; the later assignee-readiness and branch-conflict blockers were resolved by assigning #1868 to dnlrsls and merging current main. Fresh native, legacy and transitional API checks then passed on 574aadc5. This history is not proof of the manual recovery route or hosted late-legacy check selection. The PR remains draft, without merge/enqueue authorization; #1802 and #1810 remain open.

Summary by CodeRabbit

• Tests
  • Expanded automated coverage for selecting the highest-ID eligible workflow run when runs are listed out of order.
  • Added coverage for approval changes during check publication, verifying that current approval status is reflected in native policy evaluation while an already-captured publication result remains consistent.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: Gentleman-Programming/engram/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3ceb0cd8-3fee-4a78-92bf-e1fa397a53c3

📥 Commits

Reviewing files that changed from the base of the PR and between ebfc137 and 574aadc.

📒 Files selected for processing: 2

• .github/scripts/issue-refresh-router.test.mjs
• .github/scripts/issue-validation-composed.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The pull request adds tests for selecting the newest admissible native workflow run and for evaluating native approval while legacy check publication is paused. It changes test code only.

Changes: Issue validation regression tests

Layer / File(s)	Summary
Newest admissible run selection .github/scripts/issue-refresh-router.test.mjs	A test supplies runs in an unordered listing and verifies that run 92 alone is inspected and rerun. It also checks returned metadata and unchanged fixture data.
Late legacy publication timing .github/scripts/issue-validation-composed.test.mjs	The test harness supports mutable approval state and a hook before check creation. A timed test verifies that native policy evaluation reports the current approval failure while the earlier legacy publication still records its successful snapshot. It checks requests, results, and unchanged approval and pull-request metadata.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: gentleman-programming

Merge Risk: ⚪ Minimal · up to 574aa

This PR adds regression tests only and does not change production behavior. No actionable merge-blocking risk is evident.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately identifies the two regression-test areas: duplicate native runs and late legacy publication. It is concise and specific.
Linked Issues check		Direct issue #1868 requires two local regression tests, local script tests, ordinary PR CI, and no production or workflow changes. .github/scripts/issue-refresh-router.test.mjs adds the unordered mu…
Out of Scope Changes check		The changes remain within issue #1868. The modified files are the two authorized test files. The added mutable approval state and publication hook support the required test-only ordering model. No pro…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}