docs: preserve fork-label rationale

.github/workflows/labels.yml

@@ -119,7 +119,8 @@ jobs:
     # same-repository PRs. Fork-headed PRs are excluded because this Forgejo
     # gives their pull_request_target run a read-only token (#241); fork_head
     # records which reconciliation waits for the sweep and that path-derived
-    # scope labels are not applied there.
+    # scope labels are not applied there. Non-PR events include workflow_dispatch:
+    # excluding it would make a dispatched labels caller silently do nothing.
     #
     # LOUD on failure — never `|| true`: a red trigger is the
     # misconfiguration alarm. A consumer that bumps the pin without adding

docs/CONSUMERS.md

@@ -434,14 +434,14 @@ name: labels-sweep
 on:
   # The consumer owns this cadence (#203). Hourly is the recommended default
   # when no other engine drives board state: the cron is then the sweep's only
-  # wake for a review verdict landing (no
-  # pull_request_review trigger on the labels caller), blocker:ci-red
+  # wake for a review verdict landing (the labels caller has no
+  # pull_request_review trigger), blocker:ci-red
   # set/cleared, blocker:conflict when another PR merges under this one, and
   # time-based stale / 48h claim-reclaim, plus every state, blocker, and handoff
   # transition for a fork-headed PR on this Forgejo. The sweep never applies
   # path-derived scope labels. Issue events and same-repo PR events carry the
-  # rest in seconds, one trigger-job dispatch away. Hourly
-  # trades ≤1h of latency on the scheduled classes while cutting nominal
+  # rest in seconds, one trigger-job dispatch away. Hourly trades ≤1h of
+  # latency on the scheduled classes while cutting nominal
   # sweeps from four an hour to one at GitHub's 1-minute floor. Do not delete
   # the cron: it is their discovery path. If another engine writes some of
   # those transitions, only the classes with no other writer bound the cadence;

test/labels-triggers.test.sh

@@ -154,8 +154,8 @@ check "pull_request_target keeps the labeled handoff wake" 0 "labeled" \
 # Same-repo heads keep the existing immediate scope + sweep-dispatch path. A
 # fork-headed pull_request_target run must attempt no write: both write-capable
 # jobs exclude it, while one successful job explains exactly what the scheduled
-# sweep does and does not supply. Compare the whole normalised expressions: a
-# substring guard also accepts a future negation that inverts the gate.
+# sweep does and does not supply. Require each full normalised expression to
+# appear intact, so deleting or inverting one of its clauses fails the guard.
 job_if_expression() { # $1 = file, $2 = job
   yq -r ".jobs.$2.if // \"\"" "$1" |
     tr '\n' ' ' |