[hivecommons-hive]

Description

Pins the false arm of the branchHasOwners guard that precedes requestReviewersIfDue in the delayed-reviewers loop of src/cronJobs/sweep.ts (line 80): a pull request that is due for delayed blunderbuss but whose base branch carries no OWNERS files must be left alone — no timeline read, no review read, no requested_reviewers write.

Files/functions claimed (both new, so #558 __tests__/cronJobTest/sweep.test.ts, #559 / #555 __tests__/bundle/blunderbussDelay.test.ts, #553 auth.ts, #556 e2e floor and #557 tide.test.ts are untouched):

file	case	asserts
__tests__/cronJobTest/sweepDelayWithoutOwners.test.ts	blunderbuss.delay: 1h, empty master tree, one PR created/updated 70 min ago	sweep resolves { candidates: [], merged: [], enqueued: [], failures: [] }; git/trees/master read; timeline, reviews and requested_reviewers handlers never called
__tests__/bundle/blunderbussDelayWithoutOwners.test.ts	the same scenario through dist/index.js on the schedule event	exit 0, no ::error::, sweep: 0 candidates updated since, sweep: 1 more checked for delayed reviewers, exactly one git/trees/master?recursive=true read, zero timeline/review reads, zero non-GET requests, and the only non-config requests are the pull list and the tree read

Source under test is unchanged.

Fixes #560

Mutation check

if (await branchHasOwners(...)) → if (await branchHasOwners(...) || true) in src/cronJobs/sweep.ts:

• unit case fails: sweep: 1 pull request(s) failed: #1 (blunderbuss: [MSW] Cannot bypass a request …) — the mutant reaches an endpoint the test deliberately does not serve
• bundle case (after npm run pack:coverage, run with PROW_BUNDLE_PATH=.coverage-bundle/index.js) fails: ::error::… sweep: 1 pull request(s) failed: #1 (blunderbuss: could not read the timeline: HttpError: Not Found (fake))

Before this PR the same mutant is accepted by all 46 cases of sweep.test.ts and by the whole bundle suite.

Coverage evidence

• Unit, npm run test:coverage on main@e3119ad (2330 tests, 99.92 % lines / 99.35 % branches): sweep.ts 98.33 / 92.3; coverage/lcov.info has BRDA:80,4,1,0. With this PR the same record reads BRDA:80,4,1,1.
• End-to-end, npm run test:coverage:e2e on main@e3119ad (528 tests, 100 % lines / 99.46 % branches): sweep.ts 100 / 94.87, uncovered 80-85,208; coverage-e2e/lcov.info has BRDA:80,4,1,0. With this PR it reads BRDA:80,4,1,1. Lines 85 and 208 are test(sweep): pin the inclusive due-window bounds and the timeline-read failure of delayed reviewers #558's and test(sweep): pin that a second delayed sweep leaves the first run's requested reviewers alone #559's and are not touched here.
• The two runs are read separately on purpose (docs/contributing.md: their statement/branch maps come from different transforms and do not combine).

Testing

• npx vitest run __tests__/cronJobTest/sweepDelayWithoutOwners.test.ts — 1 passed
• npx vitest run __tests__/bundle/blunderbussDelayWithoutOwners.test.ts — 1 passed (against committed dist/index.js)
• npm run pack:coverage && PROW_BUNDLE_PATH=.coverage-bundle/index.js npx vitest run __tests__/bundle/blunderbussDelayWithoutOwners.test.ts — 1 passed
• npx eslint on both files — clean

Checklist

• Commits are signed off (DCO)
• No new dependencies
• No dist/ change (tests only)
• Self-reviewed

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Read both new test files against src/cronJobs/sweep.ts at merge-base. The guard being pinned is real and the assertions match it:

• sweep.ts:80-82: in the delayed-only loop, branchHasOwners gates requestReviewersIfDue, so on an OWNERS-less base branch a due PR produces no timeline read, no reviews read, and no requested_reviewers POST — exactly what both cases assert from opposite directions (unit: ObserveRequest.notCalled on served-but-unused handlers; bundle: requestsMatching empty plus a whitelist of the only two non-config requests).
• The fixtures (created/updated 70 min ago, delay: 1h, default lookback) correctly land the PR in delayedOnly (updated_at < since at sweep.ts:69), so the sweep: 0 candidates updated since / sweep: 1 more checked for delayed reviewers stdout assertions line up with sweep.ts:70-73.
• sweep resolving { candidates: [], …, failures: [] } is right: the skip is silent, not a failure (sweep.ts:80 just falls through).

The mutation check in the body (|| true on the guard) is a genuine regressor for both cases. Not a duplicate of #558/#559 — both files are new and pin a different arm (guard false) than those PRs (window bounds, idempotence). Test-only, source unchanged, CI green. Looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[mrbobbytables]

Consolidated into #589 (commit cherry-picked unchanged, author and DCO sign-off preserved).