fix(review): plan dedup ranks a merged pair by what rule B counts, so reviewer order never lowers a blocker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/e2e-critic-diff-mode.sh

@@ -16,6 +16,10 @@
 #      (exit 0, REVISE); the bare gate exits 1 with PLAN_GATE_OPEN_MAJOR.
 #   8. git status --porcelain --untracked-files=all lists no snapshot; the
 #      round-1 snapshot file exists under .git/voyage/plan-snapshots/.
+#   9. Round 3 (plan unchanged, counted fully): a minor merged with its copy
+#      that claims a lowering from blocker, and a minor with a lowered_from
+#      that is not a severity (exit 0, BLOCK, two blockers); the bare gate
+#      exits 1 with PLAN_GATE_OPEN_BLOCKER.
 # Prints "e2e: ok" and exits 0, or names the failed check and exits 1.
 # bash 3.2 compatible, ASCII only.
 
@@ -144,5 +148,21 @@ echo "$st" | grep -q 'plan-snapshots' && fail "git status lists a snapshot: $st"
 [ "$st" = '?? plan.md' ] || fail "git status lists more than the plan: $st"
 [ -f "$REPO/.git/voyage/plan-snapshots/$H1.md" ] || fail "no round-1 snapshot under .git/voyage/plan-snapshots/"
 
+# ---- 9. round 3: a refused and a malformed lowering reach the gate as blockers ----
+
+M9='Step 1 never names the exit code its verify command expects'
+G9='The revert for step one is never run against a dirty tree'
+printf '{"plan_critic":{"findings":[{"file":"plan.md","line":%s,"rule_key":"step-quality","severity":"minor","text":"%s"}]},"scope_guardian":{"findings":[{"file":"plan.md","line":%s,"rule_key":"step-quality","severity":"minor","lowered_from":"blocker","caught_by":"npm test","text":"%s"},{"file":"plan.md","line":%s,"rule_key":"gap","severity":"minor","lowered_from":"high","caught_by":"npm test","text":"%s"}]}}\n' \
+  "$L1" "$M9" "$L1" "$M9" "$LO" "$G9" > "$TMP/r3.json"
+out="$(round "$TMP/r3.json")"
+rc=$?
+[ "$rc" -eq 0 ] || fail "9: round 3 --record: exit $rc, expected 0: $out"
+echo "$out" | grep -q '"verdict":"BLOCK"' || fail "9: round 3 is not BLOCK: $out"
+echo "$out" | grep -q '"blocker":2' || fail "9: round 3 does not count two blockers: $out"
+out="$(gate plan.md)"
+rc=$?
+[ "$rc" -eq 1 ] || fail "9: the bare gate exit $rc, expected 1: $out"
+echo "$out" | grep -q 'PLAN_GATE_OPEN_BLOCKER' || fail "9: no PLAN_GATE_OPEN_BLOCKER in: $out"
+
 echo "e2e: ok"
 exit 0

tests/validators/plan-gate-diff-mode.test.mjs

@@ -1110,3 +1110,88 @@ test('29: a lowered_from that is not a severity reaches the gate and counts as b
     assert.equal(g0.lowering_refused, undefined);
   }
 });
+
+// ---- 30 ------------------------------------------------------------------------
+
+test('30: a merged pair counts the same in either reviewer order, and a blocker claim survives a merge', () => {
+  const p0 = buildPlan();
+  const X = at(p0, S1_CHANGES);
+  const TEXT = 'Step 1 never names the exit code its verify command expects';
+  const CAUGHT = { caught_by: 'tests/mod1.test.mjs' };
+  const cases = [
+    {
+      name: '(a) minor vs a refused blocker lowering',
+      a: f('minor', X, TEXT),
+      b: f('minor', X, TEXT, { lowered_from: 'blocker', ...CAUGHT }),
+      severity: 'blocker', refused: 'rule B never lowers a blocker',
+    },
+    {
+      name: '(b) plain major vs a refused blocker lowering',
+      a: f('major', X, TEXT),
+      b: f('minor', X, TEXT, { lowered_from: 'blocker', ...CAUGHT }),
+      severity: 'blocker', refused: 'rule B never lowers a blocker',
+    },
+    {
+      name: '(c) minor vs a major lowering with no caught_by',
+      a: f('minor', X, TEXT),
+      b: f('minor', X, TEXT, { lowered_from: 'major' }),
+      severity: 'major',
+    },
+    {
+      name: '(d) minor vs a security-keyed major lowering, merged by text',
+      a: f('minor', X, TEXT),
+      b: f('minor', X, TEXT, { rule_key: 'SECURITY_INJECTION', lowered_from: 'major', ...CAUGHT }),
+      severity: 'major', refused: 'rule B never lowers a security finding',
+    },
+    {
+      name: '(e) control: plain major vs a granted major lowering',
+      a: f('major', X, TEXT),
+      b: f('minor', X, TEXT, { lowered_from: 'major', ...CAUGHT }),
+      severity: 'major', refused: undefined,
+    },
+    {
+      name: '(f) minor vs a lowered_from that is not a severity',
+      a: f('minor', X, TEXT),
+      b: f('minor', X, TEXT, { lowered_from: 'high', ...CAUGHT }),
+      severity: 'blocker', refused: 'rule B: lowered_from is not a severity; counted as blocker',
+    },
+  ];
+  for (const c of cases) {
+    for (const [order, payload] of [['a first', { pc: [c.a], sg: [c.b] }], ['b first', { pc: [c.b], sg: [c.a] }]]) {
+      const d = dd(payload);
+      assert.equal(d.findings.length, 1, `${c.name}, ${order}: the pair is merged: ${JSON.stringify(d.findings)}`);
+      const v = rec(p0, d).verdict;
+      const g = byText(v, TEXT);
+      assert.equal(g.severity, c.severity, `${c.name}, ${order}: counts ${c.severity}: ${JSON.stringify(g)}`);
+      if ('refused' in c) {
+        assert.equal(g.lowering_refused, c.refused, `${c.name}, ${order}: lowering_refused`);
+      }
+      assert.deepEqual([...g.raised_by].sort(), ['plan-critic', 'scope-guardian'], `${c.name}, ${order}: both raisers kept`);
+    }
+  }
+});
+
+// ---- architecture: dedup never imports critic-diff or plan-gate --------------------
+
+/** Every `from '...'`, `import('...')` and `require('...')` specifier naming critic-diff or plan-gate. */
+function dedupImportViolations(source) {
+  const re = /\bfrom\s*(['"`])([^'"`]+)\1|\bimport\s*\(\s*(['"`])([^'"`]+)\3\s*\)|\brequire\s*\(\s*(['"`])([^'"`]+)\5\s*\)/g;
+  const out = [];
+  for (const m of String(source).matchAll(re)) {
+    const spec = m[2] ?? m[4] ?? m[6];
+    if (/(^|\/)(critic-diff|plan-gate)\.mjs$/.test(spec)) out.push(spec);
+  }
+  return out;
+}
+
+test('architecture: plan-review-dedup imports neither critic-diff nor plan-gate (planted imports caught)', () => {
+  const DEDUP_SRC = join(ROOT, 'lib', 'review', 'plan-review-dedup.mjs');
+  assert.ok(existsSync(DEDUP_SRC), 'lib/review/plan-review-dedup.mjs exists');
+  const src = readFileSync(DEDUP_SRC, 'utf-8');
+  assert.deepEqual(dedupImportViolations(src), [], 'the real source passes');
+  const plantedDiff = `${src}\nimport { countRound } from './critic-diff.mjs';\n`;
+  assert.deepEqual(dedupImportViolations(plantedDiff), ['./critic-diff.mjs'], 'a planted critic-diff import fails');
+  const plantedGate = `${src}\nawait import('../validators/plan-gate.mjs');\n`;
+  assert.deepEqual(dedupImportViolations(plantedGate), ['../validators/plan-gate.mjs'], 'a planted plan-gate import fails');
+  assert.deepEqual(dedupImportViolations(src), [], 'the real source passes again');
+});