fix(routing): define hard cost-cap behavior when cost evidence is unknown

.github/scripts/enforce-pr-target.test.cjs

@@ -49,14 +49,16 @@ describe("enforce-pr-target workflow", () => {
     assert.match(workflow, /synchronize/);
   });
 
-  it("uses label events for GUI waivers and a trusted CodeRabbit status signal", () => {
+  it("uses label events for GUI waivers, hygiene sponsorship, and a trusted CodeRabbit status signal", () => {
     assert.doesNotMatch(workflow, /^  issue_comment:/m);
     assert.match(workflow, /- labeled/);
     assert.match(workflow, /- unlabeled/);
     assert.match(workflow, /^  status:/m);
     assert.match(workflow, /github\.event\.context == 'CodeRabbit'/);
     assert.match(workflow, /github\.event\.state == 'success'/);
     assert.match(workflow, /github\.event\.label\.name == 'gui-screenshot-waived'/);
+    assert.match(workflow, /github\.event\.label\.name == 'intake: hygiene-blocked'/);
+    assert.match(workflow, /github\.event\.label\.name == 'maintainer-sponsored'/);
     assert.match(workflow, /listPullRequestsAssociatedWithCommit/);
     assert.match(workflow, /candidate\.head\?\.sha === statusSha/);
     assert.match(workflow, /candidates\.length !== 1/);
@@ -180,6 +182,9 @@ describe("enforce-pr-target workflow", () => {
   it("loads pr-quality via require from the checked-out scripts", () => {
     assert.match(workflow, /pr-quality\.cjs/);
     assert.match(workflow, /collectPrQualityFailures/);
+    assert.match(workflow, /pr-hygiene\.cjs/);
+    assert.match(workflow, /collectDeterministicHygieneFailures/);
+    assert.match(workflow, /pulls\.listFiles/);
   });
 
   it("checks stacked bases via open PR heads before wrong_base enforcement", () => {

.github/scripts/issue-quality-core.cjs

@@ -66,45 +66,104 @@ function isPlaceholderOnlyValue(raw) {
  */
 function stripMediaTokens(text) {
   if (typeof text !== "string") return "";
-  // Indented code lines render as literal code in GitHub Markdown. Protect
-  // them first so neither the HTML nor the Markdown media stripper can
-  // remove example syntax; restore the lines afterwards.
+  // Fenced and indented code render literally in GitHub Markdown. Protect
+  // them first so neither media stripper can remove example syntax. The
+  // protector deliberately leaves indented children of an unindented HTML
+  // media block visible: those lines are HTML children, not Markdown code.
   const protectedText = protectIndentedCodeLines(text);
   const markdownStripped = stripMarkdownImages(stripHtmlMedia(protectedText.text));
   const referenceStripped = stripReferenceImages(markdownStripped);
-  return restoreIndentedCodeLines(referenceStripped, protectedText.lines);
+  return restoreIndentedCodeLines(referenceStripped, protectedText);
 }
 
 /**
- * Replace every indented code line (4+ leading spaces or a tab) with a
- * placeholder of equal length so media stripping cannot touch it. Returns the
- * masked text plus the original lines for restoration.
+ * Replace fenced code and indented code outside HTML media blocks with opaque
+ * tokens. Restoration is token-based rather than line-position-based because
+ * stripping a multiline media block may collapse or remove lines.
  */
 function protectIndentedCodeLines(text) {
   const lines = [];
+  let markerPrefix = "\u0000OCX_ISSUE_CODE_";
+  while (text.includes(markerPrefix)) markerPrefix += "_";
+  let mediaDepth = 0;
+  let pendingMediaTag = null;
+  let fence = null;
+
+  const mask = (line) => {
+    const index = lines.push(line) - 1;
+    return `${markerPrefix}${index}\u0000`;
+  };
+
   const masked = text.split("\n").map((line) => {
-    if (/^(?: {4,}|\t)/.test(line)) {
-      lines.push(line);
-      return "\u0000" + line.replace(/[^\n]/g, " ").slice(1);
+    if (fence) {
+      const closing = new RegExp(`^ {0,3}${fence.char}{${fence.length},}[ \\t]*$`);
+      if (closing.test(line)) fence = null;
+      return mask(line);
     }
-    lines.push(null);
+
+    const fenceStart = line.match(/^ {0,3}(`{3,}|~{3,})/);
+    if (fenceStart) {
+      fence = { char: fenceStart[1][0], length: fenceStart[1].length };
+      return mask(line);
+    }
+
+    // Four-space/tab lines inside an active unindented HTML media block are
+    // child markup or fallback text. Treating them as code would keep an
+    // otherwise media-only <picture>/<video> block alive.
+    if (mediaDepth === 0 && pendingMediaTag === null && /^(?: {4,}|\t)/.test(line)) {
+      return mask(line);
+    }
+
+    const mediaScan = htmlMediaDepthDelta(line, pendingMediaTag);
+    mediaDepth = Math.max(0, mediaDepth + mediaScan.delta);
+    pendingMediaTag = mediaScan.pendingTag;
     return line;
   });
-  return { text: masked.join("\n"), lines };
+  return { text: masked.join("\n"), lines, markerPrefix };
 }
 
 /**
- * Restore masked indented-code lines from their original content. Placeholder
- * lines are identified by the leading \u0000 marker and matched positionally.
+ * Count opening/closing block-media tags while carrying an unfinished opening
+ * tag across lines until `>`. Self-closing tags do not create a block. This
+ * scanner only decides whether indentation belongs to HTML; stripHtmlMedia
+ * remains the authority for removing media.
  */
-function restoreIndentedCodeLines(text, lines) {
-  const out = text.split("\n").map((line, i) => {
-    if (lines[i] !== null && line.startsWith("\u0000")) {
-      return lines[i];
+function htmlMediaDepthDelta(line, pendingTag = null) {
+  let delta = 0;
+  let cursor = 0;
+
+  const completeTag = (tag) => {
+    if (/^<\s*\//.test(tag)) delta -= 1;
+    else if (!/\/\s*>$/.test(tag)) delta += 1;
+  };
+
+  if (pendingTag !== null) {
+    const end = line.indexOf(">");
+    if (end === -1) return { delta, pendingTag: `${pendingTag}\n${line}` };
+    completeTag(`${pendingTag}\n${line.slice(0, end + 1)}`);
+    pendingTag = null;
+    cursor = end + 1;
+  }
+
+  const opening = /<(\/)?(picture|video|audio)\b/gi;
+  opening.lastIndex = cursor;
+  for (let match = opening.exec(line); match !== null; match = opening.exec(line)) {
+    const end = line.indexOf(">", opening.lastIndex);
+    if (end === -1) {
+      pendingTag = line.slice(match.index);
+      break;
     }
-    return line;
-  });
-  return out.join("\n");
+    completeTag(line.slice(match.index, end + 1));
+    opening.lastIndex = end + 1;
+  }
+  return { delta, pendingTag };
+}
+
+/** Restore protected code from ordered tokens, independent of line count. */
+function restoreIndentedCodeLines(text, protection) {
+  const escapedPrefix = protection.markerPrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const token = new RegExp(`${escapedPrefix}(\\d+)\\u0000`, "g");
+  return text.replace(token, (_match, rawIndex) => protection.lines[Number(rawIndex)] ?? "");
 }
 
 /**
@@ -131,12 +190,19 @@ function stripHtmlMedia(text) {
         .replace(/<[^>]+>/g, " ")
         .replace(/[\s_*~`]+/g, " ")
         .trim();
-      return innerStripped.length === 0 ? " " : match;
+      // Only GitHub's exact generated "No response" value is empty here.
+      // Whole-field stand-ins such as TBD/N/A/None are valid media captions.
+      return innerStripped.length === 0 || isGitHubNoResponseMediaPlaceholder(inner) ? " " : match;
     },
   );
   return s;
 }
 
+function isGitHubNoResponseMediaPlaceholder(inner) {
+  const text = inner.replace(/<[^>]+>/g, " ");
+  return /^[\s_*~`]*No response[\s_*~`]*$/.test(text);
+}
+
 /**
  * Remove Markdown image tokens `![alt](dest "title")` using a small
  * balanced scanner instead of a regex, because destinations may contain

.github/scripts/issue-quality.test.cjs

@@ -396,12 +396,71 @@ describe("validateIssue - feature", () => {
       false,
     );
     assert.equal(isMediaOnly('<picture><source srcset="x.webp"><img src="x.png"></picture>'), true);
+    assert.equal(isMediaOnly('<video>No response</video>'), true);
+    assert.equal(isMediaOnly('<audio> _No response_ </audio>'), true);
+    assert.equal(isMediaOnly('<video><p><em>No response</em></p></video>'), true);
+    assert.equal(clean('<video>No response</video>'), "");
+    for (const caption of [
+      "TBD",
+      "N/A",
+      "None",
+      "설명 없음",
+      "🎬",
+      "demo.mp4",
+      "https://example.com/demo.mp4",
+    ]) {
+      const media = `<video>${caption}</video>`;
+      assert.equal(stripMediaTokens(media), media, `caption must survive: ${caption}`);
+      assert.equal(isMediaOnly(media), false, `caption must be substantive: ${caption}`);
+      assert.equal(clean(media), media, `caption must survive cleaning: ${caption}`);
+    }
+    assert.equal(
+      isMediaOnly('<picture>\n    <source srcset="x.webp">\n    <img src="x.png">\n</picture>'),
+      true,
+    );
+    assert.equal(
+      isMediaOnly('<video>\n    <source src="clip.mp4">\n    Real fallback caption\n</video>'),
+      false,
+    );
+    assert.equal(
+      isMediaOnly([
+        "<picture",
+        '    data-kind="responsive"',
+        ">",
+        '    <source srcset="x.webp">',
+        '    <img src="x.png">',
+        "</picture>",
+      ].join("\n")),
+      true,
+    );
     assert.equal(isMediaOnly('<video src="clip.mp4"></video>'), true);
     assert.equal(isMediaOnly('<img src="x.png" />\nCaption text'), false);
     assert.equal(isMediaOnly("Some real description."), false);
     assert.equal(stripMediaTokens('<img src="x.png" />').trim(), "");
     assert.equal(stripMediaTokens('![alt](url "title")').trim(), "");
     assert.equal(stripMediaTokens('before ![alt](url) after').replace(/\s+/g, " ").trim(), "before after");
+
+    const fencedMediaExample = [
+      "```html",
+      "<video>No response</video>",
+      "```",
+    ].join("\n");
+    assert.equal(stripMediaTokens(fencedMediaExample), fencedMediaExample);
+    assert.equal(isMediaOnly(fencedMediaExample), false);
+
+    const protectedAroundMedia = [
+      "    ![before](url)",
+      "<video>",
+      '    <source src="clip.mp4">',
+      "</video>",
+      "    ![after](url)",
+    ].join("\n");
+    const strippedAroundMedia = stripMediaTokens(protectedAroundMedia);
+    assert.ok(strippedAroundMedia.includes("    ![before](url)"));
+    assert.ok(strippedAroundMedia.includes("    ![after](url)"));
+    assert.equal(strippedAroundMedia.includes("<video>"), false);
+    assert.equal(strippedAroundMedia.includes("<source"), false);
+    assert.equal(strippedAroundMedia.includes("\u0000"), false);
   });
 
   it("accepts a concise but actionable feature", () => {

.github/scripts/pr-hygiene.cjs

@@ -1,5 +1,7 @@
 "use strict";
 
+const { assessSponsoredSurface } = require("./pr-sponsored-surface.cjs");
+
 const GENERATED_PREFIXES = [
   "gui/dist/",
   "dist/",
@@ -218,9 +220,76 @@ function assessHygiene({ files = [], labels = [] }) {
   return failures;
 }
 
+/**
+ * Human-readable one-liners for each deterministic hygiene failure code.
+ * Shared by the hygiene workflow comment and the PR quality gate actions.
+ */
+const HYGIENE_FAILURE_HINTS = {
+  missing_regression_test:
+    "Behavior changed under `src/` or `gui/src/` without a test change. Add focused coverage or obtain `test-exception-approved`.",
+  generated_output:
+    "Generated build output is committed. Remove it or obtain `generated-change-approved`.",
+  orphan_lockfile:
+    "`bun.lock` changed without `package.json`. Revert accidental churn or obtain `dependency-change-approved`.",
+  new_suppression:
+    "A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain `suppression-approved`.",
+  focused_or_skipped_test:
+    "A focused or skipped test was added. Restore the complete suite or obtain `test-exception-approved`.",
+  empty_catch:
+    "An empty catch block was added. Handle, report, or deliberately propagate the error.",
+  unsponsored_surface:
+    "This changes an authentication, workflow, release-automation, or dependency surface. `MAINTAINERS.md` requires security review for these; ask a maintainer to apply `maintainer-sponsored` once they have reviewed it.",
+};
+
+/**
+ * Labels that can clear or reinstate a hygiene failure. The quality gate must
+ * wake on these so READY / DRAFT tracks sponsorship and exception approvals
+ * without waiting for an unrelated synchronize.
+ */
+const HYGIENE_GATE_LABELS = [
+  "intake: hygiene-blocked",
+  "maintainer-sponsored",
+  "test-exception-approved",
+  "suppression-approved",
+  "generated-change-approved",
+  "dependency-change-approved",
+];
+
+/**
+ * Combine patch-hygiene and sponsored-surface failures into one list so the
+ * hygiene workflow and the PR quality gate cannot disagree about Ready.
+ */
+function collectDeterministicHygieneFailures({
+  files = [],
+  labels = [],
+  authorHasPushPermission = false,
+}) {
+  // Renames must keep the source path: moving a restricted file to a
+  // non-restricted destination must not drop the sponsorship requirement.
+  const changedFiles = [
+    ...new Set(
+      files.flatMap((file) => [
+        file.filename,
+        ...(file.previous_filename ? [file.previous_filename] : []),
+      ]),
+    ),
+  ];
+  return [
+    ...assessHygiene({ files, labels }),
+    ...assessSponsoredSurface({
+      authorHasPushPermission,
+      changedFiles,
+      labels,
+    }),
+  ];
+}
+
 module.exports = {
   addedLines,
   assessHygiene,
+  collectDeterministicHygieneFailures,
+  HYGIENE_FAILURE_HINTS,
+  HYGIENE_GATE_LABELS,
   hasEmptyCatch,
   hasDeletions,
   isBehaviorPath,