refactor(tests): drop the circular half of the sibling declaration

[Polichinel]

Follows the expert-code-review of PR #229's design. Verdict was SIMPLIFY, not revert — the win and the two bug fixes stand; roughly a quarter of the machinery guarded the machinery.

The finding, measured rather than argued

.public          read in exactly one place — rule G3
.public_checked  read in exactly one place — rule G8
G3's private-branch:  vacuous, no private sibling is checked out

So public existed to be verified by G3, and G3 existed to protect public's verifiability. The field and its guard justified each other and nothing else. Deleting both changes no behaviour.

public_checked was worse than useless: nothing could confirm the check had actually happened, so it manufactured confidence rather than recording a fact. And G8 — its only reader — cried wolf on its first CI run, over a timezone. ADR-014 §3 says prefer a false negative to a false alarm; that rule was the clause's own worked example.

What changed

	before	after
guard file	552 lines	448
rules	8	6 (G1, G2, G4, G5, G6, G7)
Sibling fields	5	3 (env, ci_checkout, note)

Visibility now lives in a sibling's note, as prose — because nothing here can verify it in any case, and prose is honest about that. What survives without the flag needs no field: a repository CI cannot read simply fails to download, and G5 keeps that failure loud.

Every surviving rule has an incident behind it, not a hypothesis: G6 for the 745 lint findings when a sibling landed outside _siblings/; G7 for views-appwrite's default branch being development rather than main.

Re-proven against the real workflow after the cut. Worth noting: my first G7 mutation passed, and the guard was right — the replacement had hit a comment mentioning ref: main rather than an actual step.

The ADR is rewritten, and the reason matters

You couldn't follow the previous version past §4. That was the design, not the prose: §5–§7 were second-order — rules protecting an argument rather than protecting the code. "G3 exists so that the claim in §5 stays true" is not a sentence anyone should have to parse.

It now:

• opens with the decision in four sentences;
• gives each rule the incident behind it in one table;
• states plainly in §7 that a broken sibling repository can block merging here, with the reasoning — previously asserted rather than argued;
• records what was removed and why, because the deleted design is more tempting than it looks and this document once argued for it.

On §7, since it was the reviewer's strongest objection

Nygard's point was that this puts two external repositories on the critical path of shipping, and that merging to main here is the release. That is true and now stated rather than buried. Kept blocking rather than reporting, for three reasons written into the ADR: the problem being fixed was that these checks were invisible, and a check that cannot block is invisible again; a red build in that situation is correct; and the maintainer administers this repository and can merge over a failing check when something is genuinely urgent.

Verification

ruff check .        # clean
pytest -q           # 399 passed, 40 xfailed

🤖 Generated with Claude Code