Triage: 6 open PRs

[dhanjit]

PM bring-up 2026-08-17: the Everything board now tracks the real backlog, and this issue is the triage parking spot for this repo's open PRs — most look like Claude-session artifacts. Merge or close each one; close this issue when the pile is clear.

Local clone at survey time: local dirty count is data churn (1340 files) — do not bulk-commit.

Open PRs

• Chore(deps-dev): Bump @tootallnate/once from 2.0.0 to 2.0.1 #23 - Chore(deps-dev): Bump @tootallnate/once from 2.0.0 to 2.0.1 (updated 2026-05-22)
• Chore(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 #22 - Chore(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 (updated 2026-04-07)
• Chore(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 #21 - Chore(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 (updated 2026-03-21)
• Chore(deps): Bump @tootallnate/once and jest-environment-jsdom #20 - Chore(deps): Bump @tootallnate/once and jest-environment-jsdom (updated 2026-03-21)
• Test: Comprehensive AI & Game Rules Validation #8 - Test: Comprehensive AI & Game Rules Validation (updated 2026-03-15)
• Polish: Custom Player Labels (YOU vs AI) #5 - Polish: Custom Player Labels (YOU vs AI) (updated 2026-03-15)

[dhanjit]

PR triage — 6 open PRs (read-only pass, 2026-09-11)

Nothing merged or closed here; these are recommendations only.

Caveat on every CLEAN below: the only workflow in this repo (deploy.yml) triggers on push to master and workflow_dispatch — never on pull requests. Every PR here shows an empty check list. npm test runs jest, but nothing runs it on a PR. So no PR in this repo has been verified by CI, including the dependency bumps.

The two human PRs are both already on master by other means — I checked the files rather than the titles:

PR	Bucket	Reason
#23 @tootallnate/once 2.0.0→2.0.1	MERGE	Transitive patch, lockfile-only.
#22 picomatch 2.3.1→2.3.2	MERGE	Transitive patch, lockfile-only.
#21 minimatch 3.1.2→3.1.5	MERGE	Transitive patch, lockfile-only.
#5 Polish: Custom Player Labels (YOU vs AI)	CLOSE	Already shipped. web/js/main.js:107-109 on master reads { P1: 'YOU', P2: 'DD' } for pvc mode, and web/js/ui.js:234 already special-cases 'YOU' to render "Your Turn". Master chose DD where this PR proposed AI — that looks like a deliberate later rename, not an omission. CONFLICTING for exactly that reason.
#8 Test: Comprehensive AI & Game Rules Validation	CLOSE	Superseded and outgrown. Its two tests — chain reaction, and AI-vs-random full game — are a strict subset of what master now has: tests/ai-chain-capture.test.js carries three chain-capture tests (2, 3, and run-to-exhaustion), and tests/ai-vs-ai.test.js carries five full-game simulations including a 10×10 stress test. Master's tests/ has grown from 1 file to 8. CONFLICTING.
#20 @tootallnate/once + jest-environment-jsdom 29.7.0→30.3.0	NEEDS THE HUMAN	The only bump here touching package.json, and it is a major — Jest 30 ships a large jsdom jump and changes default timer and expect behaviour. This repo's whole test suite runs on it, and no CI runs tests on PRs, so a break would land silently on master and only surface when someone runs npm test by hand. Run the suite against Jest 30 locally before deciding.

Recommended order of operations

1. Close Polish: Custom Player Labels (YOU vs AI) #5 and Test: Comprehensive AI & Game Rules Validation #8. Both are January-2026 session artifacts whose intent is already on master in better form. This clears the two oldest items and both conflicts.
2. Merge Chore(deps-dev): Bump minimatch from 3.1.2 to 3.1.5 #21, Chore(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 #22, Chore(deps-dev): Bump @tootallnate/once from 2.0.0 to 2.0.1 #23 — three transitive patches. One at a time; they share package-lock.json.
3. Chore(deps): Bump @tootallnate/once and jest-environment-jsdom #20 last, by hand. npm ci && npm test on the Jest 30 branch locally. Green → merge. Red → close it and pin jest-environment-jsdom to 29.x.
4. Worth considering separately: a PR-triggered workflow that just runs npm test. Three of the six PRs in this pile would have triaged themselves.

[dhanjit]

Addendum — #26

A seventh PR appeared while this pass was running (opened 2026-09-10, after the count in the issue body was taken). Triaging it to the same standard:

PR	Bucket	Reason
#26 Keep the line-ending policy off vendored node_modules	MERGE	Six lines in .gitattributes, one file, MERGEABLE/CLEAN, no conflict with anything else in this pile. It adds node_modules/** -text beneath the * text=auto eol=lf that #25 already landed. Purely defensive — it rewrites nothing today, and stops the policy rewriting upstream's vendored bytes if the local pre-rewrite history (5625 tracked node_modules files, 32 with CRLF, no common ancestor with origin) is ever reconciled. The verification is done the right way — byte-level git cat-file over every blob on origin/master, explicitly not git ls-files --eol, which reports post-attribute interpretation and gives false cleans.

Where it goes in the order: first, ahead of everything else. It touches a file nothing else in this pile touches, it carries no risk, and it closes out the dotdot half of dhanjit/brain#133.

Revised order: #26 → close #5 and #8 → merge #21, #22, #23 one at a time → decide #20 by hand.