fix(engine): the affirmative TAGS-SIGNED was suppressed by its own exemption OK

Gated on `findings.length === 0`, so a TAG-SIGNED-PREPOLICY OK silenced it —
and every repo in the org has pre-policy tags, which made the affirmative
verdict near-unreachable in practice.

Caught by dogfooding v0.11.0: this repo signed the first tag the check ever
judged, and the gate did not say so. Status was green either way, which is
exactly why it was worth fixing — a reader could not tell "signed its new tag"
from "has cut no tag since the policy". Two different facts wearing one
silence, which is the defect this engine already refuses to ship one check
over, where an exemption nobody can see reads like a check that stopped
running.

Keys the affirmative on the JUDGED findings only. Measured after: 18 repos
emit both codes, 3 NONE, still 0 ERROR / 0 WARN. 243 tests, from 241.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XsPsVsvhrSaejK3cLPmnN2

scripts/repo-standard-check.mjs

@@ -839,11 +839,16 @@ export function checkTagSigned({ tagObjects }, register) {
     });
   }
 
-  if (findings.length === 0 && inScope.length > 0) {
-    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` });
-  }
-  if (findings.length === 0) {
-    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
+  // The affirmative verdict is gated on the JUDGED findings only, never on
+  // `findings.length`. Gating on the whole list suppressed it the moment a
+  // pre-policy OK was present — which is every repo in the org, so this OK was
+  // near-unreachable in practice, and a reader could not tell "signed its new
+  // tag" from "has cut no tag since the policy". Two different facts, both green.
+  const judged = findings.some((f) => f.level === 'ERROR' || f.level === 'WARN');
+  if (!judged) {
+    findings.push(inScope.length > 0
+      ? { level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` }
+      : { level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
   }
   return findings;
 }

scripts/repo-standard-check.test.mjs

@@ -1004,6 +1004,35 @@ test('tags predating the policy are never judged — and say so as an OK, not si
   assert.match(ok.msg, /2026-08-13/);
 });
 
+// Caught by dogfooding the v0.11.0 release: the affirmative verdict was
+// suppressed whenever ANY pre-policy tag existed — which is every repo in the
+// org, so `TAGS-SIGNED` would have been near-unreachable in practice. The
+// reader could then not tell "this repo signed its new tag" from "this repo has
+// cut no tag since the policy". Both are OK-status, and they are not the same
+// fact. The exemption OK must not silence the judged one.
+test('the affirmative OK survives alongside the pre-policy OK — they are two different facts', () => {
+  const f = checkTagSigned({ tagObjects: [
+    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
+    { name: 'v1.0.0', annotated: true, signed: true, date: '2026-08-14' },
+  ] }, SIGN_REG);
+  assert.equal(f.some((x) => x.level === 'ERROR' || x.level === 'WARN'), false);
+  assert.equal(f.some((x) => x.code === 'TAG-SIGNED-PREPOLICY'), true);
+  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
+  assert.equal(ok.level, 'OK');
+  assert.match(ok.msg, /\b1 tag/);
+});
+
+// The other half of the same distinction: nothing cut since the policy is a
+// DIFFERENT sentence from "what was cut is signed", and it must not borrow the
+// affirmative one's wording.
+test('a repo with only pre-policy tags says nothing has been cut yet, not that anything passed', () => {
+  const f = checkTagSigned({ tagObjects: [
+    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
+  ] }, SIGN_REG);
+  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
+  assert.match(ok.msg, /no tag has been cut/);
+});
+
 test('a tag cut exactly ON the policy date is in scope — the policy starts that day', () => {
   const f = checkTagSigned({ tagObjects: [
     { name: 'v1.0.0', annotated: true, signed: false, date: '2026-08-13' },