ci(tidy): fail when a translation unit is read by no clang-tidy lane or excepted (ADR-1142)

[lusoris]

Summary

Every tracked C, C++, CUDA, HIP, Objective-C++ and Metal translation unit is now read by a clang-tidy lane or listed with a reason and an expiry, and a check fails when one is neither (ADR-1762, popup "Gated debt first", 2026-10-05). This is the second half of #2101, which moved the readable units into lanes.

• scripts/ci/check-tidy-coverage.py (pre-commit hooks check-tidy-coverage and test-tidy-coverage) compares the tracked units with the measured_sources of every scripts/ci/tidy-baseline-*.json and with the exception list. It reads the list through scripts/ci/lint_exceptions.py (no second format) and the tracked files through the same helper.
• .config/lint-exceptions.d/clang-tidy-coverage.toml: 56 entries, each with a reason and an expiry (the 17 .metal kernels: upstream clang-tidy has no Metal language mode, checked against LLVM main LangStandard.h, Types.def, FrontendOptions.h on 2026-10-05; 12 MATLAB MEX sources; 11 HISS fixtures; the Pelorus mirror, one entry per file, by reference to scripts/ci/pelorus-mirror-paths.txt; the eBPF program; Windows-only, Rust-only and standalone files; core/test/test_colorspace.c (needs libzimg) and ffmpeg-patches/test/fault_inject_sycl_import.c (no meson target)).
• cpu lane: 16 units that landed since ci(tidy): read every translation unit with a clang-tidy lane or list it with a reason (ADR-1142) #2101 recorded (0 findings).
• write-compile-commands.py exports objc_COMPILER / objcpp_COMPILER when the project declares the languages; without them the macOS lane's compile database held no .mm file (the first hosted run measured 5 of 26 units).
• macOS metal lane: tidy-metal.yml gains a fix dispatch input that applies clang-tidy's own fixes on the runner and uploads them as a patch. First measurement of the Objective-C++ host code: 1640 findings; after 1095 automatic fixes the macOS build compiles and the lane measures 939. tidy-baseline-metal.json records them; the ratchet refuses growth. The remaining findings are tracked as T-TIDY-METAL-HOST-FINDINGS-2026-10-05 (they need an Apple device to compile-test).

Type

• build / ci — tooling / infra

Checklist

• Commits follow Conventional Commits.
• Lint: black and ruff clean on the new Python; lint_exceptions.py check 0 findings; tidy: cpu 16 units 0 findings (scripts/dev/tidy-lane.sh --write --only, clang-tidy 22.1.8).
• Tests: test_check_tidy_coverage.py (14 cases: the planted .c outside every lane, an expired entry, an entry for a unit a lane reads, a missing file, a bad date, the Pelorus mirror only through its entry, the real tree), test_write_compile_commands.py (fails without the Objective-C rules).
• No SIMD or GPU code path changed in behaviour; no score moves (the Metal host-code edits are clang-tidy's nullptr, const, std::cmp_* and loop fixes).
• New files carry SPDX headers.
• Not breaking.
• ADR: ADR-1762 (ci(tidy): read every translation unit with a clang-tidy lane or list it with a reason (ADR-1142) #2101) covers the decision.

Bug-status hygiene

• docs/state.md: T-TIDY-UNREAD-TRANSLATION-UNITS-2026-10-05 closed here; T-TIDY-METAL-HOST-FINDINGS-2026-10-05 opened for the 939 findings left in the Metal host code.

Netflix golden-data gate

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables

• Research digest — no digest needed: tooling.
• Decision matrix — ADR-1762 ## Alternatives considered.
• AGENTS.md invariant note — no rebase-sensitive invariants beyond the rebase note.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/changed/tidy-coverage-check.md.
• Rebase note — docs/rebase-notes.md, "The tidy coverage check".

Reproducer

python3 scripts/ci/check-tidy-coverage.py                       # every tracked translation unit is read or excepted
python3 -m unittest scripts/ci/tests/test_check_tidy_coverage.py # includes the planted .c outside every lane
gh workflow run tidy-metal.yml --ref <branch>                   # macOS lane; -f fix=true for the autofix patch

Planted defect, run in this tree: a new tracked core/src/interop/planted_outside_every_lane.c makes the check print "read by no clang-tidy lane and not in the exception list" and exit 1; without it the check exits 0.

Known follow-ups

• The Metal baseline (939) was measured on the head before the rebase onto current master; two Metal files changed on master since (fix(cambi): copy 10-bit planes row by row so full_ref with a wider source scores the right rows #2111-era edits to integer_adm_metal.mm and integer_cambi_metal.mm, where this branch took master's side of the conflicting hunks), so the first Tidy Metal run on master may ask for a baseline update. The workflow is not a required check.
• The remaining 939 findings: misc-const-correctness (second fix=true pass), misc-use-anonymous-namespace (312, file-scope statics), pointer findings. See the state row.
• chore(review): adversarial code review of cpp23 wave (PRs #41-#58) #78 in VMAFx/pelorus (tidy fixes at the source) is open with its checks queued; fix(interop): re-vendor Pelorus with the x265 CSV column indices initialised (HISS-10) #2154 re-vendored Pelorus at 42cb17106a2d.

Breaking changes / migration

None.