chore(#3875): sweep the spent ack fragments and automate the sweep (#3877)

* chore(#3875): sweep the spent ack fragments and automate the sweep

next has been red on every push since a84f75630 (#3823) — 24 consecutive pushes
over two days — on two fully-spent emitted-drift-ack fragments nobody swept.

#3823 introduced guard-no-ack-on-next together with a 45-fragment sweep, but
computed that sweep as a static set of deletions fixed at its branch point.
#3809's fragment merged to next while #3823 was in flight, so the guard reds on
its own merge commit. The condition is evaluated dynamically at merge time and
remediated statically at branch time; on a moving branch the second can never
reliably satisfy the first.

- delete tests/emitted-drift-acks/3809-* and 3866-* (3034-* and 3172-* stay --
  the #3842 open-PR hold correctly defers them)
- runGuardNext returns `sweepable`, the set the guard actually reasoned about,
  plus `legacyPresent` for the legacy document, which is a fixed path rather
  than a fragment basename and would otherwise be invisible to any sweeper
- new --sweep-plan mode turns the guard into a work list: plan on stdout, prose
  on stderr, exit 0 so a non-empty plan does not fail the step that asked for it
- main() is injectable in BOTH lanes; a half-injected seam lets a test that
  passes cwd silently read the real repository instead of its fixture
- ack-fragment-sweep.yml derives its deletion list from that plan on a timer and
  opens a reviewable PR, so the sweep can no longer go stale between branch
  and merge

Hardening found in review, each verified against a live reproduction:

- git rm reads its arguments as PATHSPECS with wildmatch semantics, so a
  fragment named a bare-star .json name -- legal, and admitted by
  listFragmentFiles since it filters only on the suffix -- expanded to every
  fragment in the directory, including ones the #3842 hold withheld. Confirmed
  in a scratch repo: one such file deleted all three. Closed with a literal
  allowlist and a :(literal) pathspec, two independent layers.
- an apostrophe inside a heredoc nested in a command substitution is an
  unterminated quote and a hard syntax error at runtime, not just under bash -n.
- an empty plan no longer reports success unconditionally: the guard is re-run
  without the hold to tell "next is clean" from "everything is held", the
  commonest holder being the sweep PR from the previous run, which touches
  exactly the fragments it proposed to delete.
- a branch pushed by a run that died before it could open the PR wedged every
  later run on a non-fast-forward push; re-pointed under a lease instead.
- a guard crash in plan mode no longer reads as "nothing to sweep".

Refs #3875

* chore(#3875): regenerate CONTEXT-INDEX.json for the glossary entry

lint:generated-sync failed on CI: gen-context-index.cjs derives
docs/CONTEXT-INDEX.json from CONTEXT.md, and the RULESET.EMITTED_ATTRIBUTION
entry added in the previous commit left it stale.

Refs #3875

* chore(#3875): regenerate the example CONTEXT-INDEX for the glossary entry

CONTEXT.md feeds TWO committed indexes, not one: docs/CONTEXT-INDEX.json via
scripts/gen-context-index.cjs, and the examples/dynamic-context-management copy
that lint-example-parser-parity holds to a fresh parse. The previous commit
regenerated only the first, so the parity check stayed red.

Refs #3875

---------

Co-authored-by: sim <sim@local>

scripts/lint-emitted-drift-ack.cjs

@@ -732,11 +732,24 @@ function fetchOpenPrTouchedAckPaths({ cwd = REPO_ROOT, execGh = execGhDefault, l
  * @param {() => Set<string>} [opts.fetchOpenPrPaths] defaults to `fetchOpenPrTouchedAckPaths`.
  *   Injectable so a test can supply canned open-PR data (or a throwing stub, to exercise
  *   the fail-closed "hold everything" path) without shelling out to a real `gh`.
- * @returns {{ ok: boolean, lines: string[] }}
+ * `sweepable` is the fragment basenames the guard would have the caller `git rm` — the
+ * same set the prose names, already narrowed by the #3842 open-PR hold, so a held
+ * fragment never appears in it. Surfaced as DATA rather than left to be scraped back out
+ * of `lines`, because the sweeper (#3875) must act on exactly the set the guard reasoned
+ * about: a sweeper that re-derives the list, or greps it out of the message text, can
+ * drift from the guard and delete a fragment the hold was protecting.
+ * `legacyPresent` is reported separately from `sweepable` because the two are different
+ * KINDS of cruft with the same remedy: `sweepable` holds fragment basenames under
+ * `ACK_DIR_REPO_PATH`, whereas the legacy document is one fixed path. Folding it into
+ * `sweepable` would make a consumer prefix it with the fragment directory and try to
+ * delete a path that does not exist. Without it the sweeper would be blind to exactly
+ * one of the two ways this guard can red `next`.
+ * @returns {{ ok: boolean, lines: string[], sweepable: string[], legacyPresent: boolean }}
  */
 function runGuardNext({ argv = process.argv, cwd = REPO_ROOT, fetchOpenPrPaths = fetchOpenPrTouchedAckPaths } = {}) {
   const legacyFile = path.join(cwd, ...ACK_REPO_PATH.split('/'));
-  const legacy = assertAbsentOnNext(fs.existsSync(legacyFile));
+  const legacyPresent = fs.existsSync(legacyFile);
+  const legacy = assertAbsentOnNext(legacyPresent);
   const lines = [legacy.message];
 
   // The fragment half (#3078). CI always passes `--base-ref` (the pre-push tip of `next`,
@@ -776,20 +789,58 @@ function runGuardNext({ argv = process.argv, cwd = REPO_ROOT, fetchOpenPrPaths =
   const sweep = assertNoAllSpentFragments(fragments, { openPrTouchedPaths });
   lines.push(sweep.message);
 
-  return { ok: legacy.ok && sweep.ok, lines };
+  return { ok: legacy.ok && sweep.ok, lines, sweepable: sweep.sweepable, legacyPresent };
 }
 
-function main() {
-  if (process.argv.includes('--guard-next')) {
-    const result = runGuardNext();
-    for (const line of result.lines) console.log(line);
+/**
+ * CLI entry. Dependencies are injectable so the `--guard-next` / `--sweep-plan` argv
+ * routing is testable in-process: `main()` otherwise reads `process.argv` and writes
+ * through `console`, and the only way to observe it would be a subprocess run against
+ * the REAL repository — which cannot exhibit an arbitrary sweep set on demand, so the
+ * interesting cases would go uncovered.
+ *
+ * `cwd`, `out` and `err` are honoured by BOTH lanes, not just the guard lane. A seam
+ * that is injected halfway is worse than one that is not injected at all: a test
+ * passing `cwd` to the validation lane would silently read the real repository and
+ * report on whatever happens to be checked in, which is a pass-always test wearing the
+ * costume of a real one.
+ */
+function main({
+  argv = process.argv,
+  cwd = REPO_ROOT,
+  out = console.log,
+  err = console.error,
+  guard = runGuardNext,
+} = {}) {
+  if (argv.includes('--guard-next')) {
+    const result = guard({ argv });
+
+    // `--sweep-plan` (#3875) turns the guard from a VERDICT into a WORK LIST. The
+    // sweeper workflow needs the exact set the guard reasoned about, so the plan goes
+    // to stdout alone and the prose is diverted to stderr — a caller doing
+    // `xargs git rm` on stdout must never receive an explanatory sentence as a
+    // filename. Plan mode also exits 0 even when the verdict is a failure: a
+    // non-empty plan is the NORMAL case it exists to report, and a non-zero exit
+    // would fail the workflow step before it could act on the very list it asked for.
+    if (argv.includes('--sweep-plan')) {
+      for (const line of result.lines) err(line);
+      // The legacy document leads the plan: it is a fixed path rather than a name
+      // under the fragment directory, and `assertAbsentOnNext` reds `next` on its
+      // PRESENCE alone. Omitting it would leave the sweeper able to fix only one of
+      // the two conditions that make this guard fail.
+      if (result.legacyPresent) out(ACK_REPO_PATH);
+      for (const name of result.sweepable) out(`${ACK_DIR_REPO_PATH}/${name}`);
+      return;
+    }
+
+    for (const line of result.lines) out(line);
     if (!result.ok) process.exitCode = 1;
     return;
   }
 
-  const legacyFile = path.join(REPO_ROOT, ...ACK_REPO_PATH.split('/'));
+  const legacyFile = path.join(cwd, ...ACK_REPO_PATH.split('/'));
 
-  const fragmentsDir = path.join(REPO_ROOT, ...ACK_DIR_REPO_PATH.split('/'));
+  const fragmentsDir = path.join(cwd, ...ACK_DIR_REPO_PATH.split('/'));
   const sources = [
     { label: ACK_REPO_PATH, raw: readIfPresent(legacyFile) },
     ...listFragmentFiles(fragmentsDir).map((name) => ({
@@ -835,9 +886,9 @@ function main() {
   }
 
   if (problems.length) {
-    console.error(`lint-emitted-drift-ack: ${problems.length} problem(s)\n`);
-    for (const e of problems) console.error(`  - ${e}`);
-    console.error(
+    err(`lint-emitted-drift-ack: ${problems.length} problem(s)\n`);
+    for (const e of problems) err(`  - ${e}`);
+    err(
       '\nThis blocks the merge on purpose. The base-side reader fails loudly on a document '
       + 'it cannot parse, so a broken one on the base branch reds every PR that carries an '
       + 'acknowledgment, and a duplicate across two sources is exactly the silent-drift class '
@@ -847,7 +898,7 @@ function main() {
     return;
   }
 
-  console.log(
+  out(
     anyPresent
       ? 'ok lint-emitted-drift-ack: all acknowledgment sources are well-formed'
       : 'ok lint-emitted-drift-ack: no acknowledgment sources present (the healthy steady state)',
@@ -881,4 +932,5 @@ module.exports = {
   GITHUB_MAX_PR_FILES,
   GH_TIMEOUT_MS,
   runGuardNext,
+  main,
 };