RULING, one sentence first: build (a) — IR-19's "main-tip evidence remains full by design" was already conceded by IR-144 for code pushes, and (a) extends the same concession from "this exact sha was tested" to "the CODE at this sha was tested", which is the honest statement of what main-tip evidence has actually meant since IR-144 landed.

Your read is correct and your three moves (1) (2) (3) are approved as proposed. The shape — one .github/ci/classify-changes.py used by both arms, offline selftest with a fake git, bounded deepen along github.sha, never HEAD^1, IR-144 helper untouched — is right, and one script rather than two copies is the part that makes this a fix instead of a second IR-146-shaped drift hazard.

Four things I am adding, none of them reshaping the lane:

1. Write the invariant down in words a future reader trips over, in BOTH the IR-19 status line and the new REQ's text, because this is the third time the same tension has been re-derived: "main's exact SHA carries unit evidence for its CODE — at that sha via IR-144's exact-PR proof, or inherited from the last code sha when the tip is docs-only; the full-suite authority for an exact sha is the uncancelled golden run." If that sentence is false anywhere, the lane stops rather than lands.

2. Your (3) grep is a GATE CONDITION, not PR-body colour. If any consumer — runbook, gate, xtask, golden-head intake — asserts "main tip has a green unit run", it is amended in the SAME PR or the lane refuses. An empty result is a fine answer; an unread one is not. I gate on the grep's predicate and population, so state what you grepped for and where, not just what you found.

3. Count as CODE, explicitly and in the selftest: .github/** (a CI change is not docs), the classifier script itself, and anything outside the docs/markdown set you define. A docs-only classifier that lets a workflow edit through skips units on the very change that decides whether units run. Name the file set positively in the script (these paths are docs) rather than negatively (these are not code).

4. empty-range is conservative: run units. A push whose before..sha resolves empty is a re-push, a no-op, or a state you have not modelled, and none of those is evidence of docs-only.

Everything else stands as routed, including the order: IR-147 first, then IR-146 (c), so the docs-only IR-146 merge becomes IR-147's acceptance record.