adaptive/must: 342 of 415 repos cannot merge a clean PR without --admin (unsatisfiable required contexts)

[hyperpolymath]

Measured 2026-08-28, during the label-tooling rollout

A clean, verified, identical payload was merged into 415 repos in two passes:

• Pass 1 (--no-admin): 73 merged, 342 failed — a 17.6% unaided pass rate
• Pass 2 (--admin): the remainder landed with zero payload refusals

So 82.4% of the estate cannot merge a green PR without an admin override. The payload was constant across all repos; the variable is each repo's required-context configuration.

Root-cause classes already identified (each with a verified instance)

1. Required context produced only on main, never on PRs — standards required check-score, a job in scorecard-enforcer.yml which has no pull_request: trigger. (Fixed for tags in the 5-repo sweep below; the PR-blocking variant likely exists elsewhere.)
2. Required context from a workflow that startup-fails — burble required governance / Validate Hypatia Baseline while governance.yml died as a path-named run (no check run at all) since 2026-08-24.
3. Ruleset stacks unrelated to CI health — .git-private-farm requires signed commits, a github-pages deployment, CodeQL threshold-all, and 95% coverage; each alone forces --admin.
4. Tag-target variant (FIXED 2026-08-28): 5 repos (standards, a2ml-ecosystem, neurophone, ubicity, wordpress-tools) required PR-only checks (Codacy/CodeFactor/CodeQL/CodeRabbit) on tags, blocking all releases since ~June. Fixed by per-repo measurement of satisfiable contexts; backups in dev-notes/ruleset-backups/.

Proposed remediation shape (not started, per issues-first doctrine)

Per repo: enumerate active ruleset required contexts → compare against contexts actually produced on recent PR heads → classify each as satisfiable / phantom / startup-failed → fix by the matching class (add pull_request: trigger, repair the lockfile drift, or drop the context). The 5-repo tag sweep is the working precedent, including the per-repo measurement approach (drop-lists differed 1–4 per repo).

Evidence artefacts: merge-label-tooling.sh logs (pass 1/2), .git-private-farm docs/LABELS.adoc.

🤖 Generated with Claude Code

[hyperpolymath]

Measured Standards instance repaired on 2026-08-29 while merging #688. The active Optimus-Branch ruleset contained six unsatisfiable/phantom conditions: (1) github-pages required before merge although both Pages workflows deploy only from main; (2) integration-bound Gitar, stuck on an old head and absent from the current head; (3) integration-bound CodeRabbit, whose rate-limited legacy status had no matching integration identity; (4) 95% coverage with no coverage producer for this PR; (5) Scorecard code-scanning enforcement with no Scorecard analysis on the PR; and (6) an unconditional update restriction permitting only bypass actors. It also required code-owner approval while the author was the primary code owner and the nominal approval count was zero. I removed only those contradictions, retaining signed commits, PR-only delivery, resolved-thread enforcement, deletion protection, CodeQL/Hypatia, and every status context actually produced on the current head. #688 then merged normally without --admin, providing a positive control for this remediation shape.