nflib: Gh.pr_list's default=[] makes a failed call indistinguishable from an empty result nf-s6ul ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/493 by tools/beads/import_github.py's reconcile pass.

Filed unclaimed and unlabelled from design 001 piece 6 (#492). Backlog, for a future triage round — not part of the periphery chunk.

nflib.gh.Gh.pr_list ends with:

```python return self.json(argv, default=[]) or [] ```

and Gh.json returns default for a failed call as well as an empty one. So a caller cannot tell "GitHub said there are no open PRs" from "gh exited non-zero". Same shape on issue_list, pr_comments, inline_comments.

That is a fail-open default, and it is the right one for most of the tier: poll.py printing a short digest when gh hiccups is better than a tick that dies. gh.py's own docstring already makes the sharper version of this argument for the not result.ok branch — a failed call must not be reported as *data*.

Where it stops being safe is a caller that ACTS on emptiness. rebuild_f5 is the first one. Since #400 an empty PR queue means "f5/integration = main", which resets the branch and force-pushes it — so a conflated failure would discard the entire integrated frontier and report success. #492 works around it by reading gh unchecked and raising its own QueueUnknown rather than using pr_list at all.

Worth noting the shell got this right for free and by accident: set -e killed the script at the assignment, before any interpretation could happen. The port inherits no such thing, so every future caller has to remember — which is the shape of defect this tier is supposed to be deleting rather than redistributing.

Options

• A: an explicit failure signal in the library. An on_error="raise" keyword, or a sentinel distinct from [], so a caller that acts on emptiness opts into knowing. Keeps the fail-open default for everyone else.
• B: leave the library and document the trap at pr_list, pointing at rebuild_f5.QueueUnknown as the pattern to copy. Cheapest; relies on the next author reading it.
• C: nothing. One caller, already handled, and the fail-open default is load-bearing everywhere else.

No recommendation — this wants an nflib owner's judgement, and #484 ("I wonder if we've painted ourselves into a complicated corner") is arguably the frame for it. Recording the hazard so that the second caller which acts on emptiness does not have to rediscover it destructively.