From 514aa725357770195fc41ea91f13b9283b60f4b9 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Sun, 5 Jul 2026 14:27:29 -0700
Subject: [PATCH] fix(config): restore main's typecheck and clear an
 injection-detector false positive

Two independent issues surfaced by #3635 merging concurrently with
#1958's own review.finding_categories addition:

- main's typecheck is currently broken: #3635's new compile-time
  exhaustiveness map (test/unit/focus-manifest.test.ts) predates
  review.finding_categories and is missing that key, which the
  `satisfies Record<...>` check requires. Documents the field in
  .gittensory.yml.example and adds the missing map entry, mirroring
  the review.changed_files_summary entry immediately above it.

- "override of the synthesis merge rule" (added by #3635) matches
  gittensory's own INJECTION_SOURCE pattern for "override ... the
  ... rule", so the review pipeline redacted it to
  [external-instruction-redacted] before the AI reviewer ever saw
  it -- correctly, since the redaction can't tell a benign config
  override from a real one without the surrounding context a human
  has. Rewording "rule" to "mode" preserves the exact meaning and
  clears the false positive; confirmed via a direct regex test
  against the full file that no other phrase matches.
---
 .gittensory.yml.example          | 7 ++++++-
 test/unit/focus-manifest.test.ts | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.gittensory.yml.example b/.gittensory.yml.example
index aad1273ad2..7b5d331e01 100644
--- a/.gittensory.yml.example
+++ b/.gittensory.yml.example
@@ -310,7 +310,7 @@ gate:
     # only -- not floor-clamped like onMerge below, since the three strategies aren't
     # ordered by strictness.
     combine: null
-    # Per-repo override of the synthesis merge rule (#2567): "either" is STRICTER (any
+    # Per-repo override of the synthesis merge mode (#2567): "either" is STRICTER (any
     # one reviewer's blocker blocks/holds); "both" is more permissive (every reviewer
     # must agree). either | both, or null. Default: null (the operator's own plan). A
     # repo may only TIGHTEN the operator's floor -- it can never loosen "either" down
@@ -746,6 +746,11 @@ settings:
 #   # deterministic "Changed files" summary: one row per file category, with counts and +/- totals. Bool
 #   # or null. Default: null/false.
 #   changed_files_summary: false
+#   # When true, an inline finding is ALSO tagged with a category (security/correctness/performance/
+#   # maintainability/tests/style) -- the AI reviewer self-categorizes, with a deterministic path/keyword
+#   # fallback for whatever it omits. Only takes effect when inline_comments is already on. Bool or null.
+#   # Default: null/false.
+#   finding_categories: false
 #   # Maintainer-declared DETERMINISTIC content assertions (title/description must contain a phrase, a
 #   # label must be present), optionally gated to a path glob. A failed check is advisory by default;
 #   # `enforce: true` makes it a hard gate blocker. Empty/default ⇒ no finding (no AI judgment involved).
diff --git a/test/unit/focus-manifest.test.ts b/test/unit/focus-manifest.test.ts
index 940f51226a..c08468f2c2 100644
--- a/test/unit/focus-manifest.test.ts
+++ b/test/unit/focus-manifest.test.ts
@@ -349,6 +349,7 @@ describe(".gittensory.yml.example field-exhaustiveness (#1670)", () => {
     inlineComments: "inline_comments:",
     suggestions: "suggestions:",
     changedFilesSummary: "changed_files_summary:",
+    findingCategories: "finding_categories:",
     pathInstructions: "path_instructions:",
     instructions: "instructions:",
     excludePaths: "exclude_paths:",