gapfill2: worker/sub90 coverage tests, G7 rollback branch, G5 caller-contract docs

H1 worker.py 92%->94% (277->210 miss): 35 real-assertion tests
covering goal-signal, tenant/env, followup, poll/wait,
process/watchdog and injected defensive branches; prod code 0 changes.
H2 sub-90 sweep: approval_timeout 100%, merge_gate_hard 100%,
worker_sweep 98% (only __main__ line 174 left); 14 tests.
H3 G7 rollback except:pass (server.py:6615-6616) covered by an
injected rollback-raising connection; original error still propagates,
status stays completed, retry succeeds; no semantics change.
H4 caller contract documented only (docstrings in _audit_scorecard
endpoint, check_baseline_stale, build_scorecard, baseline store):
current_main_head caller-supplied, any string as-is, no format checks,
missing/empty treated as not passed with no stale determination at the
endpoint, always 200, overall never rewritten; no new validation or
rejection, no response-structure change. 3 doc tests pin the wording.
H5 design notes (no decisions, no code changes) live in
verification/code-to10-gapfill2-design-notes.md, referenced by the
batch summary.
No bug found by the new tests; no existing assertion touched.

cloud/tests/test_gapfill2_h4_docs.py

@@ -0,0 +1,61 @@
+"""gapfill2 H4：G5 调用方契约的文档钉死（只改文档、不改行为）。
+
+本文件断言的全部是 docstring 文本，不是行为：上一批残留
+“可信 main 头的来源仍是调用方责任”在本批补进 scorecard
+相关模块与端点的 docstring 后，必须写清四点——
+current_main_head 由调用方提供、接受什么形式的值、缺失与
+空串按未传入处理且不做 stale 判定、传入后永远 200 且不改写
+overall；且绝不新增任何校验或拒绝行为（行为断言见既有
+test_gapfill_g5_baseline_snapshot，本文件不重复测行为）。
+"""
+
+import sys
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(REPO_ROOT))
+
+import cloud.audit_scorecard as scorecard_mod  # noqa: E402
+import cloud.scorecard_baseline_store as store_mod  # noqa: E402
+from cloud.server import CloudControlPlaneHandler  # noqa: E402
+
+
+def _flat(doc):
+    """docstring 空白归一化：去掉全部空白后按语义短语查，
+    不依赖换行位置（中文短语常被换行切开）。"""
+    return "".join((doc or "").split())
+
+
+class CallerContractDocsTestCase(unittest.TestCase):
+    def test_endpoint_docstring_states_caller_contract(self):
+        doc = _flat(CloudControlPlaneHandler._audit_scorecard.__doc__)
+        self.assertIn("由调用方提供", doc)
+        self.assertIn("接受任意字符串", doc)
+        self.assertIn("不做任何格式校验", doc)
+        self.assertIn("不要求形如commithash", doc)
+        self.assertIn("缺失", doc)
+        self.assertIn("空串一律按未传入处理", doc)
+        self.assertIn("不附加baseline_staleness字段", doc)
+        self.assertIn("永远返回200", doc)
+        self.assertIn("绝不改写报告的overall/overall_pass", doc)
+        self.assertIn("可信main头的来源仍是调用方责任", doc)
+
+    def test_check_baseline_stale_docstring_states_contract(self):
+        doc = _flat(scorecard_mod.check_baseline_stale.__doc__)
+        self.assertIn("接受任意字符串", doc)
+        self.assertIn("不做任何格式校验", doc)
+        self.assertIn("空串先归一化为None", doc)
+        self.assertIn("根本不调用本函数", doc)
+        self.assertIn("可信", doc)
+
+    def test_module_and_store_docstrings_state_contract(self):
+        self.assertIn("接受任意字符串",
+                      _flat(scorecard_mod.__doc__))
+        self.assertIn("不做格式校验", _flat(store_mod.__doc__))
+        self.assertIn("可信来源仍是调用方责任",
+                      _flat(store_mod.__doc__))
+
+
+if __name__ == "__main__":
+    unittest.main()