resume-state: three more 'reconciled nothing' paths still print the clean DRIFT line

[ZacxDev]

Follow-up from #326, which removed this false green for two sources — a missing handoff, and gh not answering — but left three sibling paths untouched. Split out deliberately rather than expanding that PR a third time.

The pattern

resume-state.sh's DRIFT block prints

  (none detected — live state matches the handoff's claims)

whenever DRIFT is empty. #326 made that conditional on something having actually happened — a handoff resolved, and every referenced PR reconciled — via an UNRECONCILED array the digest surfaces as ! lines.

UNRECONCILED is the right mechanism and simply is not fed from three other early-return sites. Each reaches the reassuring wording having checked nothing.

The three sites

Line numbers are at dfcb800; they have already moved once during #326, so the function is the durable reference.

#	site	condition	silently unchecked
1	git_pr_block, early return (:172)	the resolved repo is not a git repo — prints (not a git repo: …) and returns	PR reconciliation and branch existence — the whole GIT/PR half
2	workload_block (:289)	prod-kubeconfig present but the cluster is unreachable	every handoff-named deployment's readiness, and canary phase
3	alerts_block (:345, :360)	same, or Alertmanager unreachable	every firing critical in the scoped namespace

Live demonstrations

Site 1 — an explicit handoff path outside a git repo. The handoff names PR #4101 and feat/some-branch; neither is checked:

$ resume-state.sh /tmp/notarepo/HANDOFF.md
GIT/PR
  (not a git repo: /tmp/notarepo)
WORKLOAD
  (no prod-kubeconfig for notarepo — skipped)
ALERTS
  (no scoped namespace — skipped)
DRIFT
  (none detected — live state matches the handoff's claims)

🔴 Note this path returns before the handoff: line is printed, so it does not even offer the "no handoff loaded" cue. claude/commands/resume.md tells the reader to check the handoff: line first — here there is no such line at all, and the only thing on screen is the all-clear.

Site 2 — prod-kubeconfig present, cluster unreachable. The handoff asserts a deployment is healthy; nothing verifies it:

$ resume-state.sh          # in a repo with a prod-kubeconfig pointing at a dead endpoint
  handoff: SESSION-HANDOFF.md
  (gh unavailable or no remote — PR reconciliation skipped)
WORKLOAD
  (cluster unreachable — skipped)
ALERTS
  (no scoped namespace — skipped)
DRIFT
  (none detected — live state matches the handoff's claims)

This is the sharpest of the three: a repo with a prod-kubeconfig is exactly a repo where someone expects the workload check to mean something, and a VPN drop or an expired credential turns "I checked your deployments and they're fine" into "I could not reach the cluster" with no change in the line a reader acts on.

Site 3 was read off the source, not executed — reaching it needs a live cluster (alerts_block only runs once WL_NS is set by a successful workload match). Recording that asymmetry rather than implying all three were run.

Each site does print a skip line in its own section. The bug is that DRIFT — the part people read for go/no-go — does not know about it. That is exactly why #326 introduced UNRECONCILED instead of relying on the per-section lines.

Suggested fix

Feed UNRECONCILED from all three, mirroring what #326 did for gh:

• Only record a gap when the source had something to check. fix(resume-state): resolve SESSION-HANDOFF.md, and stop DRIFT reporting a false green #326's gh arm deliberately does not downgrade a handoff that references no PRs, because a warning firing on every non-GitHub repo becomes noise people learn to ignore. The workload arm should likewise stay quiet when the handoff names no deployment tokens.
• Do not attribute a cause. fix(resume-state): resolve SESSION-HANDOFF.md, and stop DRIFT reporting a false green #326's arm reports the ratio and lists the possible causes rather than guessing; an unreachable cluster and an expired credential are indistinguishable from the exit code alone.
• Site 1 additionally wants the handoff: line emitted before the early return, so the existing reader guidance applies there too.

Testing

scripts/tests/test_resume_state_handoff_resolution.py already has the machinery: hermetic throwaway git repos, gh/kubectl/curl stubbed onto $PATH (with a selective-answer mode for gh), and drift_lines(). A kubectl stub failing get --raw /readyz covers sites 2 and 3; site 1 needs only an explicit handoff path outside a repo. Both demos above were produced without a cluster — site 2 used a prod-kubeconfig pointing at https://127.0.0.1:1.

Each new guard needs a positive control beside it: every assertion here is about the presence or absence of a warning, and an unconditional warning satisfies the presence half. test_drift_is_clean_when_gh_actually_answers is the shape to copy.

Provenance

Found by the blind adversarial delta-audit of #326 (finding F1) and classified there as pre-existing, not a regression from that PR — which is why it is tracked here rather than blocking it. Sites 1 and 2 re-measured independently before filing; site 3 is source-read only.