[finding] plugins/uberdev/lib/premerge-findings.py — 6 findings #770

first = value.split('/',1)[0]; if first in ('..','.git') rejects .git/config but admits sub/.git. Before this PR the only paths reaching _repo_path came from the built-in reviewer; --carry-blocked now routes agent-chosen blocked_on_file values through it. A submodule's .git is a regular file, so it survives _beneath_repo_root and os.path.isfile, becomes a first-class wave member with severity blocker, and lands in fix-waves-<NN>.json - from which the fix-commit fence derives its entire committable set. No submodules exist in this repo today, which is exactly the reasoning _beneath_repo_root's own docstring rejects for the symlink case.

SKILL.md 2a makes the controller hand-write blocked-on-<NN>.json with an attempt field, but nothing reads it - a dead contract field. _read_attempt, the module's designated fail-closed reader, checks schema_version, both arrays, pr_number AND run_id precisely because a field it waves through is a field that crashes somewhere downstream instead of refusing here. A controller that writes blocked-on-02.json when it meant 03, or a run dir reused across two /premerge runs, silently widens the wrong attempt's wave plan with paths from a different stack - up to MAX_BLOCKED_ON agent-chosen files added to the committable set, with BLOCKED=n reporting it as legitimate.

_read_blocked_on sets fingerprint on each carried row, and _BLOCKED_ON_SUMMARY's 25-line comment block exists solely to keep that fingerprint stable across attempts. But _blocker_fingerprints now continues on _is_carried, _growth_ratio skips carried rows on both sides, cmd_assert_green filters them out and cmd_defer excludes them from _object_rows - so nothing reads the field. Either drop it, or drop the comment's claim that it drives STOP_NO_PROGRESS.

grep over SKILL.md, commands/premerge.md, docs/rfc/0021 and references/common-mistakes.md returns zero hits for the new term. All four say the stop fires on 'two consecutive measured rounds at or above the ceiling'; the shipped predicate additionally refuses any round that reduced the reviewer-raised blocker count. RFC 0021 states GROWTH(N) = |{...}| / |blockers(N)| but _growth_ratio now excludes blocked_on_carry rows from BOTH sides. A maintainer reading SKILL.md's emphatic 'Do not reduce the requirement to a single round' has no record that the non-reduction term exists and can delete it as unexplained.

cmd_converge calls _blocker_fingerprints(current) before _growth_ratio. That function already raises on any blocker whose fingerprint is not 16 hex chars, and a non-dict row yields value None, so it refuses first - the branch can never be taken. It also contradicts _scope_key's own docstring, which explains that _repo_path was replaced there because cmd_converge is the one place where failing closed is WRONG. If the ordering ever changes, this line becomes exit 74 out of the loop's decision step.

The PREMERGE_TRIAGE print at 1863 carries an explicit comment that the first five fields are a pinned prefix and to append, never reorder or insert; ＃755 correctly appended BLOCKED= at the end. The converge line got the opposite treatment: WAIT=, MAXREPAIRS= and REASONS= all shift one field right. Nothing parses this line positionally today, so the break is latent rather than live, but the run summary transcribes it by hand and any future awk '{print $8}' reader silently reads the wrong field.