fix(2242): Done is a Status an override may name, so a repo that deploys nothing can say so

[LukasWodka]

Unblocks backend#2242. Prerequisite for tracebloc/rfcs#41 — that PR cannot merge
until this has reached this repo's main.

The blocker, measured

backend#2242's option 2 — give rfcs a .kanban.yml mapping its branches to Done
— was recorded as unblocked by backend#2243 (one shared mapping both writers read).
It unblocked half of it. backend#2324, landing the same day, made an undeclared
Status a refusal, and ENV_FOR_STATUS declared the five deploy columns only —
so the semantically correct override was the one shape the new guard rejected:

# the mapper live on this repo's `main` today, given rfcs' .kanban.yml
develop -> REFUSED (exit 1)
::error::.kanban.yml maps `develop` to 'Done', which names a Status this mapping
does not declare. ...

Both refusals are right on their own terms; together they leave a repo that deploys
nothing with no way to say so. The accept list should be the set of Statuses a
merge can legitimately mean, not the set of stages a deploy passes through.

The change

One row: "Done": "none".

none is a real option on the board's Deploy environment field (measured on
project #2, 2026-08-22 — none, Active, dev, staging, prod, Cancelled), and it is
the one that agrees with Done. The dict's contract is that acceptance carries its
own environment, so a deploy env here would leave the two board fields contradicting
each other — a card in Done stamped dev, the backend#1277 shape.

Three consumers checked first, because Done is terminal and nothing else here is

consumer	verdict
advance-deploy-env.yml	rank() already scores Done 11, above Prod's 10 — the monotonic guard advances into it and nothing demotes out. A push re-carrying an old commit is a no-op, not an un-shipping.
kanban-closure-router.yml	its STATUS_NAME = "Done" guard refuses to write Doneover a deploy state. A merged PR's card sits in Code review, which classify_column places below On dev and returns no for — so the write lands, and the guard still protects the case it was built for.
kanban-reconcile.yml	its weekly sweep pulls non-terminal columns only, so it never sees these cards.

The first two are already asserted by kanban-deploy-state-selftest.py (Code review → no, Done → no), so this PR adds no case for them — it cites them.

The third one was load-bearing and unasserted, so it is a check now

Reconcile's drift-to-prod arm writes Prod for any merged PR whose sha reached the
prod branch, and consults no .kanban.yml at all — deliberately, because
resolve_prod_branch refuses to trust a repo-controlled file (D27-L4). The sweep
filter is the only thing standing between that arm and every overridden card, once a
week, silently. Done is outside the filter today; nothing said it had to be.

branch-status-map-selftest.py now:

• derives the filter by parsing it out of kanban-reconcile.yml — a hand-copied
  list here would agree with itself while the workflow moved (rule 1);
• fails loudly on a filter it cannot recognise, because an empty set makes the
  assertion vacuously true, and that is the one outcome indistinguishable from a
  clean tree (rule 3); plus an anchor assertion so a partial parse is caught too;
• keys the invariant on the environment, not on a hand-listed set of terminal
  names: a Status declaring none deployed nothing, so a sweep arm that writes a
  deploy column must never be able to reach it. Deploy-stage Statuses stay in the
  sweep on purpose — On dev and Ready for prod are in it and must be;
• runs the assertion and both mutation directions through the same predicate
  (rule 9), so a guard that returns [] for every input cannot pass as a satisfied
  invariant.

Mutation-proved: adding "Done" to reconcile's sweep list — anchor verified
applied, grep -c = 1 — gives 168 passed, 1 failed, naming Done. Restored.

Evidence

scripts/tests/branch-status-map-selftest.py 169 passed, 0 failed
scripts/tests/kanban-deploy-state-selftest.py 27 passed, 0 failed
scripts/kanban-columns-check.py All 12 written Status name(s) exist
on the board (Done <- branch_status_map.py)
make check green

Deliberately not in this PR

repo-inventory.yml. rfcs' entries for these two callers are still exempt, and
that file's own note says to land the caller first and flip the entry after — its
audit branch for rfcs is the default branch (main, since rfcs is not on the
train), so the flip has to wait until rfcs#41 has been promoted there. Its
advance-deploy-env exemption text is separately wrong today — it reads "this repo
has no develop", and rfcs has one that receives merges (#32–#36, #38) — and
correcting that belongs with the flip rather than with a change that would put the
inventory out of step with reality and redden the conformance gate.

Refs backend#2242, backend#2243, backend#2324

---

Note

Medium Risk
Changes weekly kanban reconcile writes for closed issues, including a new path that can move cards to terminal Done. Guards keep it off deploy columns, but a mapping or case-arm mistake would stall or misplace cards.

Overview
Lets a repo that deploys nothing (e.g. rfcs) map a merge to Done instead of a deploy column. ENV_FOR_STATUS now accepts "Done": "none", so the unknown-Status refusal no longer rejects the only correct override.

Reconcile’s router-miss backstop gains a "Done" arm so those cards are not left in an active column when the closure router misses. Selftests now parse the weekly sweep filter and DEST case from kanban-reconcile.yml and assert: no none Status is swept (so drift-to-prod cannot overwrite the override), and every declared Status that has an option id also has a write arm.

^{Reviewed by Cursor Bugbot for commit 8e569cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8e569cf. Configure here.}

[saqlainsyed007]

Reviewed all three files against the code — and the change is more than the "one row" the summary suggests, in the right way. It's the prerequisite for rfcs#41 (which needs Done to be an accept-list Status), and it lands the row together with the two things that make the row safe.

• branch_status_map.py — "Done": "none". The accept list was the five deploy columns; the board's vocabulary is wider, and a repo that ships nothing (rfcs, RFC-BACKEND-1405 D8) merges to Done, "completed, nothing deployed". none is a real Deploy environment option that agrees with Done, so the two board fields don't contradict (backend#1277). The three terminal-status consumers are each checked — advance-deploy-env's rank scores Done above Prod (monotonic, no un-shipping), the closure-router's guard won't write Done over a deploy state, and reconcile's sweep excludes it.
• kanban-reconcile.yml — adds the "Done") OPT="$DONE_OPT" arm to the router-miss backstop. This is the half Bugbot caught: widening the accept list without this arm would drop exactly the override repos out of the weekly backstop (router miss → skip → card stuck in an active column), the invariant .github#127 fixed everywhere else. $DONE_OPT was already in scope; Staging (agent review) / Ready for prod are deliberately armless (no option id resolved — read-only / human /fr-pass).
• branch-status-map-selftest.py — two invariants, each derived from the workflow, both-direction mutation-tested, and failing loud on an unrecognized parse (an empty set would pass vacuously): (1) no none-env Status sits inside reconcile's sweep, keyed on the environment so the drift-to-prod arm can't overwrite an override weekly; (2) every Status reconcile has an option id for has a DEST arm. The option-id extractor is a depth-counted, quote-aware scanner rather than a regex, precisely because Bugbot (High) showed the naive regex stopped at the first ) and silently missed FR on staging — the anchor assertion now names that opt_either case so a broken parser can't pass it.

Green, no open threads. Approving.

[saadqbal]

Approving — and the selftest is the part worth saying something about, because it clears the bar the accept-list change needs it to.

Both new invariants are derived from kanban-reconcile.yml rather than restated beside it, both fail loudly on a parse they no longer describe (the alternative being two empty sets that look exactly like a clean tree), and both run their assertion and their mutations through one shared predicate — so a guard that has stopped working can't present as a pass. The anchors are the good bit: picking FR on staging because it is reachable only through opt_either, whose argument list is the one containing a ), means the anchor is one the broken extractor could not have satisfied. An anchor a broken parser passes isn't an anchor, and Done alone was exactly that.

I also checked the thing that would have made me push back — armless keyed on "declared and has an option id" rather than "declared", so Staging (agent review) and Ready for prod having no arm stays silent. That's the deliberate case, and it's asserted as silent rather than left to be inferred, which is the difference between a guard and a coincidence.

I traced _arglist by hand: depth counting with a quote flag, ) inside a quoted name is part of the name, unterminated call and end-of-line both return "" and are treated as a parse failure. Correct for every shape in that file. The one thing it doesn't model is a backslash-escaped quote inside a quoted argument ("a\"b") — the flag would clear early and a later ) could be miscounted. Not reachable with the board's column names, so I'd leave it; worth knowing only because this file's whole job is extractor correctness.

One sequencing note, which is really about rfcs#41 rather than this PR: ENV_FOR_STATUS on main does not declare Done yet, and rfcs#41's .kanban.yml names it. This PR has to land first or that one's runs refuse. I've said so over there.

[LukasWodka]

/fr-pass