From 2c03a204a2b73f94bf3dc52d6ce6f6ac8590233d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 22 Sep 2026 23:13:50 +0100
Subject: [PATCH] docs: Tier 3 gate probe (positive control, doc-only)

---
 docs/tier3-gate-probe.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 docs/tier3-gate-probe.md

diff --git a/docs/tier3-gate-probe.md b/docs/tier3-gate-probe.md
new file mode 100644
index 00000000..f7d07a29
--- /dev/null
+++ b/docs/tier3-gate-probe.md
@@ -0,0 +1,20 @@
+# Tier 3 gate probe
+
+Positive control for ruleset 23359343 `Optimus-Branch`, armed 2026-09-22.
+
+This file exists only to give the gate something to evaluate. It is
+documentation-only by design: it touches no workflow, no action pin and no
+registry, so a red result here is a fault in the gate, not in the change.
+
+What this probe is meant to establish:
+
+1. The four required contexts (`CodeQL`, `SonarCloud Code Analysis`,
+   `governance / Code quality + docs`, `uses ⊆ actions.lock`) all reach a
+   terminal state on a real pull-request head.
+2. Whether the `code_scanning` rule passes when Scorecard has published no
+   analysis to `refs/pull/N/merge` — measured at 2 of 696 pull-ref analyses,
+   so this is the expected case rather than an edge case.
+3. That `mergeStateStatus` reflects the ruleset, now that
+   `current_user_can_bypass` reads `never`.
+
+Delete the branch once read. The measurement lives in `dev-notes`, not here.