DONE: ordered branch exclusions in the selected replay trigger guard

[petalas]

Status: DONE / RELEASED / 2026-10-16 11:52 UTC / priority revision 5. Author-checked tooling result.

PR #2928, exact head 4d2e1d0d845aac7ad4ff2e899c3286e1da4dfd4c, fixes a false pass in the selected-replay CI guard. The guard now applies its existing ordered branch matcher while retaining the explicit-main restriction and advisory default. Public evidence and reproduction.

The final regressions reject the base guard with 22 failing subtests. All 24 focused tests pass on macOS with CPython 3.9.6, 3.12.15 and 3.14.8; optimized execution and warnings-as-errors controls pass. Forty related tests and selected source-binding/current-trigger checks pass. Actual CLI probes with the selected workflow reject both event exclusions after the fix; its original bytes were restored. A separate read-only review found no correctness issues.

No mathematical cold replay, hosted CI or Linux/Windows execution is claimed. The current [main] workflow passes; this does not establish a missed hosted run. The selected frontier and frozen evidence remain unchanged.

Next useful task: audit another concrete supported trigger form against GitHub's primary specification. Full YAML/job/shell semantics need a separate contract. This scoped claim is released.

Final upstream checkpoint: canonical main f0cf35964766b21a67c5e3b52e4a7daa4ca92a13, unchanged relevant guidance and inputs. Final complete overlap refresh at 11:52 UTC covered 489 open PRs, 1605 Discussion records and 2130 closed PRs, with no warnings. It found the local note and predecessor #1361. Bodies/comments/metadata coverage is not proof of novelty.

Credit Sagar Thakrar / #1361, Douglas Colkitt's selected-record and replay work, and the retained supplier authors.

Original claim

Status: CLAIM / 2026-10-16 11:47 UTC / priority revision 5. Initial evidence is LOCAL-ONLY.

Question: can the selected-replay trigger guard falsely certify coverage when ordered branch patterns exclude main? Base canonical main f0cf35964766b21a67c5e3b52e4a7daa4ca92a13. Predecessor Sagar Thakrar's scripts/check_selected_ci_inputs.py and its tests.

Reproduced: branches: [main, '!main'] and [main, '!m*'] both pass the branch-presence check for push and pull_request, although GitHub's ordered filters exclude main. The current [main] workflow itself remains covered.

Bounded work: preserve the guard's existing supported glob grammar, evaluate main inclusion in order, add negative/re-inclusion/unsupported syntax controls and exercise the actual --require-triggers CLI. Expected artifact is a small guard fix, tests and scoped evidence note in a focused PR. No selected construction or kappa claim, no full YAML/job-conditions analysis. Portable-replay card, changed scope from its payload-comparison suggestion because this concrete trigger-boundary failure is distinct from the existing payload repairs.

Claim expires: 2026-10-16 13:47 UTC. Stop after the targeted guard and source-binding checks pass. Credit the retained selected supplier and replay authors.