feat(engine): REMOTE-SYNC — a tag that exists only in one clone

VERSION-TAG reads LOCAL tags, so a manifest claiming 1.0.0 against an unpushed
v1.0.0 reads as a clean pass while no stranger can resolve that version.
portfolio-optimiser read OK until this check existed; it now reads ERROR, which
is the finding the gate was blind to rather than a new demand on the repo.

Measured across all 21 registered clones: exactly one has an unpushed tag, and
none is behind the forge. One subject is what got BRANCH-STALE rejected — the
difference is that an unpushed tag is never one of two legitimate conventions
the way tag-only releasing is, the remedy moves no published ref, and it
recurs at every release rather than once.

The reverse direction is deliberately not a finding: a clone that has not
fetched lately is behind the forge and nothing about the repository is wrong.

211 tests (was 205).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WWc4piM4QW6Jxfky2Rw4Z8

scripts/repo-standard-check.test.mjs

@@ -42,6 +42,7 @@ import {
   groupSkips,
   skipsOf,
   checkReleaseCurrent,
+  checkRemoteSync,
 } from './repo-standard-check.mjs';
 
 const REGISTER = {
@@ -2084,3 +2085,54 @@ test('a release ahead of every known tag is not reported as stale', () => {
   const f = checkReleaseCurrent({ forgeTagsSelf: ['v1.0.0'], releases: ['v1.1.0'] });
   assert.equal(f[0].level, 'OK');
 });
+
+// ------------------------------------------------------------- REMOTE-SYNC
+//
+// Measured 2026-08-12 across all 21 registered clones: exactly one repo has a
+// local tag the forge does not (portfolio-optimiser, v1.0.0), and none is
+// behind. One subject is what got BRANCH-STALE rejected — the difference is
+// that an unpushed tag is never a legitimate convention, and that the gate
+// currently says the WRONG thing about it: VERSION-TAG reads LOCAL tags, so a
+// manifest claiming 1.0.0 against an unpushed v1.0.0 reads as OK while no
+// stranger can resolve it.
+
+test('a local tag the forge does not have is an ERROR naming the tag', () => {
+  const f = checkRemoteSync({ tags: ['v0.1.0', 'v1.0.0'], forgeTagsSelf: ['v0.1.0'] });
+  assert.equal(f[0].level, 'ERROR');
+  assert.equal(f[0].code, 'REMOTE-SYNC');
+  assert.equal(f[0].bucket, 'broken');
+  assert.match(f[0].msg, /v1\.0\.0/);
+});
+
+test('being behind the forge is NOT a finding — a stale fetch is not a defect', () => {
+  // The reverse direction must never fire. Every clone that has not fetched
+  // lately would fail, and nothing is wrong with the repository.
+  const f = checkRemoteSync({ tags: ['v0.1.0'], forgeTagsSelf: ['v0.1.0', 'v0.2.0'] });
+  assert.equal(f[0].level, 'OK');
+});
+
+test('refs that could not be read are a SKIP, never a pass', () => {
+  const f = checkRemoteSync({ tags: ['v1.0.0'], forgeTagsSelf: null });
+  assert.equal(f[0].level, 'SKIP');
+  assert.equal(f[0].skip, 'notRun');
+});
+
+test('no local tags is an OK — there is nothing that could be unpushed', () => {
+  const f = checkRemoteSync({ tags: [], forgeTagsSelf: [] });
+  assert.equal(f[0].level, 'OK');
+  assert.equal(f[0].code, 'REMOTE-SYNC');
+});
+
+test('every local tag present on the forge is an OK', () => {
+  const f = checkRemoteSync({ tags: ['v0.1.0', 'v0.2.0'], forgeTagsSelf: ['v0.1.0', 'v0.2.0'] });
+  assert.equal(f[0].level, 'OK');
+});
+
+test('several unpushed tags are reported in version order, in one finding', () => {
+  // The remedy is safe for all of them — pushing a tag moves no published ref —
+  // so unlike TAG-ANNOTATED-HISTORY there is no reason to collapse them to a
+  // count. Order is the engine's, so v0.10.0 does not sort under v0.9.0.
+  const f = checkRemoteSync({ tags: ['v0.9.0', 'v0.10.0'], forgeTagsSelf: [] });
+  assert.equal(f.length, 1);
+  assert.match(f[0].msg, /v0\.9\.0.*v0\.10\.0/);
+});