fix(gate): an outage of ours must not block a customer's merge #5580

Three places where an AI outage — or a dead worker — was charged to the customer. One sentence covers all of them: "we could not look" is not "we looked and it was bad", and it isn't "we looked and it was fine" either.

1. "AI Review" as a required check blocked every merge, forever

The gate already fails open — it records the check skipped with "not blocking the merge". But passingCheckNames() re-read that persisted row and admitted only passed/repaired, so a repo that made AI Review a required check was hard-blocked the moment the Anthropic balance hit zero, with no override, on both the merge button and the API. The required-checks UI suggests that exact string.

Fixed with a discriminator, not a blanket rule. gate_runs.details has existed since migration 0001 and been NULL for every row ever written; it now carries {skipReason}. A skipped row satisfies a required check only when it's AI Review skipped as ai_unavailable.

Every exclusion is load-bearing:

A new status value was rejected deliberately: eight status enumerators would have silently mis-bucketed it, and ai-loop.ts would have started treating it as not green — the opposite of the intent.

2. Two functions read the same comment and disagreed

aiCommentLooksApproved() returned false for "AI review unavailable" while ai-review.ts returned not-blocking — so an outage silently stalled every auto-merge under requireAiApproval. It now uses the same tri-state expression as the manual merge button and the gated chain.

Two quieter bugs go with it: the old path used .some(), so a stale approving comment outvoted a newer blocking one, and it returned false when there was no review comment at all.

3. abandoned wasn't classified as infrastructure

reapStuckRuns writes it for a run whose worker died holding it. classifyRun() returned "other", so a dead container counted against the repo in successRateExcludingInfra — the one statistic the module exists to protect — and the merge gate told the author "CI failed (abandoned)". Separating platform failure from your failure is a stated product promise; this was a regression against it.

Also

The required-checks UI hint suggested Secret Scan and Type Check. The gate emits Secret scan (lowercase s) and no type check at all — so anyone who followed the hint gave themselves a required check that could never pass. Now lists only names the gate actually emits.

Tests

Pinned name by name and reason by reason, including that NULL details on every historical row grants nothing and that malformed JSON isn't a licence to pass.

Verified by mutation: removing the gate-name scope credits Security scan, GateTest and Merge check on an AI outage — and fails the suite. 76 pass across the eight suites touching these files.