The remote runner caught three families this branch caused. W028 moves the
generated health table to 35 rows / 32 rules, so gen-health-docs.test.cjs
is updated in both its assertion and its title - a title carrying the old
count is a test that lies about what it checks.
The three negative-proof rows no longer match a literal report substring.
They assert the typed signal instead: buildShadowReport reports
not_shadowed, renderShadowReport returns no lines, and stderr contains
none of those lines. That takes the new allow-test-rule annotations to
zero rather than lifting the ceiling to fit them.
health.md's growth is acknowledged at its existing key. A second fragment
on the same key is a duplicate-ack error, and the re-arm path only fires
on a reworded reason at the same key.
Refs #2873
Closes the issue's explicit acceptance criterion: "health.md's tables
are generated rather than hand-maintained, closing the 16-vs-30+
documentation gap structurally." The published roster listed 16 codes
against 30+ actually emitted; W010-W017 and W020-W023 had never been
documented.
Adds description/repairable as static fields on Rule (health-diagnostic-types.cts)
— generation needs a fixed, human-readable summary per code, distinct
from the dynamic per-instance Diagnostic.message a rule's check()
produces. repairable is true only when --repair will actually apply
the remedy: false for ADVISE-only rules AND for DESTRUCTIVE-risk rules
(regenerateState/resetConfig), which are described but never
auto-applied — matches verify.cts's diagnosticToIssueEntry semantics
exactly, after fixing E004/E005's static field to agree with it (both
were wrongly true, an inconsistency caught during this same commit's
own review, not left for later).
New scripts/gen-health-docs.cjs (--write/--check, wired into
lint:generated-sync) regenerates the two tagged table regions in
gsd-core/workflows/health.md from RULES (31 rules) plus the 3
pre-checks that stay outside the rule table by design (E001, E010,
I010) plus a small static Effect/Risk lookup for the 6 real repair
actions — including addAiIntegrationPhaseKey, live in code since an
earlier phase but never documented until now. 34 error-code rows, 6
repair-action rows. The table's old "grep verify.cts for the next free
number" footnote is rewritten to point at the rule table and its lint
guard instead.
