OpenCode model-unavailable fallback reviews satisfied the required review check with no model verdict #2335

Defect

When the OpenCode model pool is exhausted (model=none), the model-unavailable evidence fallback posts a deterministic CHANGES_REQUESTED "blocker" review ("OpenCode could not approve from deterministic current-head evidence … model-unavailable evidence fallback …"). Two gates counted that fallback review as a model verdict:

1. The required opencode-review bootstrap (opencode-review.yml, "Fail closed without a current-head OpenCode verdict") accepted any CHANGES_REQUESTED from opencode-agent. The required check went green with no model verdict.
2. scripts/ci/opencode_review_receipt_gate.py is_formal_receipt filtered fallback markers only for APPROVED. A fallback CHANGES_REQUESTED counted as a formal receipt and suppressed the scheduler wake that would retry a real review.

Impact: this is an observability hole, not an approval hole. Merges stayed blocked by the CHANGES_REQUESTED review decision and the independent-approval requirement. But from the 2026-08-27 gateway switch until the /v1 fix (#2333), OpenCode produced zero model verdicts while required checks showed green. Example: run 34931908846 had its model pool exhausted, model=none, and still ended in success via the fallback.

Owner

dot-github lead (orchestration run_b22de9a1c59d).

Acceptance

• A review carrying any fallback marker (either state) never satisfies the required opencode-review check. The step fails with an explicit MODEL_OUTPUT_UNAVAILABLE error.
• A fallback review (either state) is not a formal receipt, so the scheduler keeps waking a real review for that head.
• A later model-backed APPROVED/CHANGES_REQUESTED review on the same head still passes both gates.
• Regression tests fail on main and pass with the fix.
• After fix(review): point OpenCode at the gateway's /v1 routes and split failure classes #2333 lands, at least one hosted run shows a model-backed verdict (not fallback) satisfying the required check.