@biffo/cli 0.297.0 → 0.297.2

package/dist/index.js

@@ -573,7 +573,25 @@ import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync15, rmSync as rmSync5 } from "fs";
 import { join as join16, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
-import { execa as execa3 } from "execa";
+
+// src/lib/exec.ts
+import { execa as rawExeca } from "execa";
+var execTimeoutMs = () => {
+  const raw = process.env.BIFFO_EXEC_TIMEOUT_MS;
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 9e5;
+};
+var execa = (file, args, options) => {
+  const opts = options ?? {};
+  const supplied = "stdin" in opts || "input" in opts;
+  return rawExeca(file, args ?? [], {
+    ...supplied ? {} : { stdin: "ignore" },
+    timeout: execTimeoutMs(),
+    ...opts
+  });
+};
+
+// src/commands/core-upgrade.ts
 import { Command as Command3 } from "commander";
 
 // src/adapters/git/index.ts
@@ -581,7 +599,6 @@ import { randomUUID } from "crypto";
 import { existsSync as existsSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join6 } from "path";
-import { execa as execa2 } from "execa";
 
 // src/lib/core-upgrade.ts
 import { isUtf8 } from "buffer";
@@ -597,7 +614,6 @@ import {
 } from "fs";
 import { tmpdir } from "os";
 import { dirname as dirname3, join as join5 } from "path";
-import { execa } from "execa";
 import { z as z4 } from "zod";
 
 // src/lib/core-ownership-guard.ts
@@ -953,7 +969,7 @@ var GitAdapter = class {
   async configuredIdentity(cwd) {
     const read2 = async (key) => {
       try {
-        const { stdout } = await execa2("git", ["config", "--get", key], cwd ? { cwd } : {});
+        const { stdout } = await execa("git", ["config", "--get", key], cwd ? { cwd } : {});
         return stdout.trim() || null;
       } catch {
         return null;
@@ -963,7 +979,7 @@ var GitAdapter = class {
   }
   async isGitRepo(cwd) {
     try {
-      await execa2("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
+      await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
       return true;
     } catch {
       return false;
@@ -988,7 +1004,7 @@ var GitAdapter = class {
     const dir = mkdtempSync2(join6(tmpdir2(), `${namePrefix}-${randomUUID().slice(0, 8)}-`));
     const cloneUrl = token ? injectToken(repoUrl, token) : repoUrl;
     try {
-      await execa2("git", ["clone", "--depth", "1", cloneUrl, dir]);
+      await execa("git", ["clone", "--depth", "1", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
       throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
@@ -1011,7 +1027,7 @@ var GitAdapter = class {
     const dir = mkdtempSync2(join6(tmpdir2(), `${namePrefix}-${randomUUID().slice(0, 8)}-`));
     const cloneUrl = token ? injectToken(repoUrl, token) : repoUrl;
     try {
-      await execa2("git", ["clone", cloneUrl, dir]);
+      await execa("git", ["clone", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
       throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
@@ -1035,26 +1051,26 @@ var GitAdapter = class {
    * repo uses (#559).
    */
   async init(cwd, initialBranch = "dev") {
-    await execa2("git", ["init", "-b", initialBranch], { cwd });
+    await execa("git", ["init", "-b", initialBranch], { cwd });
   }
   /** Adds a remote. Fails if a remote with this name already exists. */
   async addRemote(cwd, name, url) {
-    await execa2("git", ["remote", "add", name, url], { cwd });
+    await execa("git", ["remote", "add", name, url], { cwd });
   }
   async add(cwd, paths) {
-    await execa2("git", ["add", ...paths], { cwd });
+    await execa("git", ["add", ...paths], { cwd });
   }
   async commit(cwd, message) {
-    await execa2("git", ["commit", "-m", message], { cwd });
+    await execa("git", ["commit", "-m", message], { cwd });
   }
   /** The current branch name (e.g. "dev"). */
   async currentBranch(cwd) {
-    const { stdout } = await execa2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd });
+    const { stdout } = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd });
     return stdout.trim();
   }
   /** True if the working tree or index has uncommitted changes. */
   async hasUncommittedChanges(cwd) {
-    const { stdout } = await execa2("git", ["status", "--porcelain"], { cwd });
+    const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
     return stdout.trim().length > 0;
   }
   /** Best-effort fetch of the tracking remote, so the ahead/behind check below
@@ -1062,13 +1078,13 @@ var GitAdapter = class {
    * offline or a missing remote must not block an upgrade on its own — the
    * ahead/behind check that follows simply works from whatever is local. */
   async fetch(cwd, remote = "origin") {
-    await execa2("git", ["fetch", "--quiet", remote], { cwd, reject: false });
+    await execa("git", ["fetch", "--quiet", remote], { cwd, reject: false });
   }
   /** HEAD's position relative to its upstream. `hasUpstream` is false when the
    * branch tracks nothing (or HEAD is detached), in which case currency cannot
    * be established and ahead/behind are 0 (#394). */
   async aheadBehind(cwd) {
-    const { stdout, exitCode } = await execa2(
+    const { stdout, exitCode } = await execa(
       "git",
       ["rev-list", "--left-right", "--count", "HEAD...@{upstream}"],
       { cwd, reject: false }
@@ -1079,7 +1095,7 @@ var GitAdapter = class {
   }
   /** The fetch URL of a remote (default "origin"). */
   async getRemoteUrl(cwd, remote = "origin") {
-    const { stdout } = await execa2("git", ["remote", "get-url", remote], { cwd });
+    const { stdout } = await execa("git", ["remote", "get-url", remote], { cwd });
     return stdout.trim();
   }
   /**
@@ -1092,7 +1108,7 @@ var GitAdapter = class {
    * SHA as an honest "could not determine", never as license to invent one.
    */
   async resolveDefaultBranchSha(repoUrl) {
-    const { stdout, exitCode } = await execa2("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
+    const { stdout, exitCode } = await execa("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
       reject: false
     });
     if (exitCode !== 0) return null;
@@ -1110,7 +1126,7 @@ var GitAdapter = class {
    * equally best-effort call.
    */
   async fetchPrune(cwd, remote = "origin") {
-    await execa2("git", ["fetch", "--quiet", "--prune", remote], { cwd, reject: false });
+    await execa("git", ["fetch", "--quiet", "--prune", remote], { cwd, reject: false });
   }
   /**
    * Is `cwd` the primary checkout, rather than a linked worktree?
@@ -1127,8 +1143,8 @@ var GitAdapter = class {
   async isPrimaryWorktree(cwd) {
     const opts = { cwd, reject: false };
     const [dir, common] = await Promise.all([
-      execa2("git", ["rev-parse", "--absolute-git-dir"], opts),
-      execa2("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], opts)
+      execa("git", ["rev-parse", "--absolute-git-dir"], opts),
+      execa("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], opts)
     ]);
     if (dir.exitCode !== 0 || common.exitCode !== 0) return true;
     return dir.stdout.trim() === common.stdout.trim();
@@ -1140,7 +1156,7 @@ var GitAdapter = class {
    * annotations vary, and this has to survive paths with spaces.
    */
   async listWorktrees(cwd) {
-    const { stdout, exitCode } = await execa2("git", ["worktree", "list", "--porcelain"], {
+    const { stdout, exitCode } = await execa("git", ["worktree", "list", "--porcelain"], {
       cwd,
       reject: false
     });
@@ -1158,7 +1174,7 @@ var GitAdapter = class {
   }
   /** How many commits `branch` is behind `base`; null when it cannot be measured. */
   async countBehind(cwd, branch, base) {
-    const { stdout, exitCode } = await execa2("git", ["rev-list", "--count", `${branch}..${base}`], {
+    const { stdout, exitCode } = await execa("git", ["rev-list", "--count", `${branch}..${base}`], {
       cwd,
       reject: false
     });
@@ -1168,7 +1184,7 @@ var GitAdapter = class {
   }
   /** A file's contents at a ref, or null when it is absent there. */
   async showFileAtRef(cwd, ref, path) {
-    const { stdout, exitCode } = await execa2("git", ["show", `${ref}:${path}`], {
+    const { stdout, exitCode } = await execa("git", ["show", `${ref}:${path}`], {
       cwd,
       reject: false
     });
@@ -1176,7 +1192,7 @@ var GitAdapter = class {
   }
   /** Every local branch with its upstream and tracking state (#758). */
   async listBranchRefs(cwd) {
-    const { stdout, exitCode } = await execa2(
+    const { stdout, exitCode } = await execa(
       "git",
       ["for-each-ref", `--format=${BRANCH_REF_FORMAT}`, "refs/heads"],
       { cwd, reject: false }
@@ -1194,12 +1210,12 @@ var GitAdapter = class {
    * passes branches whose upstream git reports as gone.
    */
   async deleteBranch(cwd, branch) {
-    const { exitCode } = await execa2("git", ["branch", "-D", branch], { cwd, reject: false });
+    const { exitCode } = await execa("git", ["branch", "-D", branch], { cwd, reject: false });
     return exitCode === 0;
   }
   /** Create and switch to a new branch. Fails if it already exists. */
   async createBranch(cwd, branch) {
-    await execa2("git", ["switch", "-c", branch], { cwd });
+    await execa("git", ["switch", "-c", branch], { cwd });
   }
   /**
    * Switch to an existing branch. Fails if it does not exist, and — deliberately
@@ -1208,7 +1224,7 @@ var GitAdapter = class {
    * putting back.
    */
   async switchBranch(cwd, branch) {
-    await execa2("git", ["switch", branch], { cwd });
+    await execa("git", ["switch", branch], { cwd });
   }
   /**
    * Push the current HEAD to `branch` on the remote. When `token` is given and
@@ -1232,7 +1248,7 @@ var GitAdapter = class {
       if (authed !== url) target = authed;
     }
     try {
-      await execa2("git", ["push", target, `HEAD:refs/heads/${branch}`], { cwd });
+      await execa("git", ["push", target, `HEAD:refs/heads/${branch}`], { cwd });
     } catch (err) {
       throw gitFailure(`Failed to push branch '${branch}' to remote '${remote}'`, err, [opts.token]);
     }
@@ -1283,9 +1299,9 @@ var GitAdapter = class {
    */
   async setUpstreamAfterPush(cwd, branch, remote) {
     const opts = { cwd, reject: false };
-    await execa2("git", ["update-ref", `refs/remotes/${remote}/${branch}`, "HEAD"], opts);
-    await execa2("git", ["config", `branch.${branch}.remote`, remote], opts);
-    await execa2("git", ["config", `branch.${branch}.merge`, `refs/heads/${branch}`], opts);
+    await execa("git", ["update-ref", `refs/remotes/${remote}/${branch}`, "HEAD"], opts);
+    await execa("git", ["config", `branch.${branch}.remote`, remote], opts);
+    await execa("git", ["config", `branch.${branch}.merge`, `refs/heads/${branch}`], opts);
   }
 };
 function injectToken(repoUrl, token) {
@@ -4296,7 +4312,7 @@ var defaultRunCommand = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa3(bin, args, {
+    await execa(bin, args, {
       cwd,
       // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
       //
@@ -8707,7 +8723,6 @@ import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
-import { execa as execa4 } from "execa";
 import { join as join28 } from "path";
 var PluginMigrationsAdapter = class {
   /**
@@ -8732,7 +8747,7 @@ var PluginMigrationsAdapter = class {
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join28(cwd, "services", "api") });
+      result = await execa("uv", args, { cwd: join28(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -8751,7 +8766,6 @@ var PluginMigrationsAdapter = class {
 // src/lib/plugin-provenance.ts
 import { existsSync as existsSync28, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
 import { join as join29 } from "path";
-import { execa as execa5 } from "execa";
 var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
 function isPluginProvenance(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -8813,7 +8827,7 @@ function resolveRegistryProvenance(repoUrl, sha) {
 }
 async function isGitWorkingTree(dir) {
   try {
-    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
@@ -8821,7 +8835,7 @@ async function isGitWorkingTree(dir) {
 }
 async function tryGit(cwd, args) {
   try {
-    const { stdout } = await execa5("git", args, { cwd });
+    const { stdout } = await execa("git", args, { cwd });
     return stdout.trim() || null;
   } catch {
     return null;
@@ -8870,7 +8884,6 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
 import { basename, dirname as dirname9, join as join31 } from "path";
-import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -8904,14 +8917,14 @@ async function copyPluginSource(sourceDir, targetDir) {
 }
 async function isGitWorkingTree2(dir) {
   try {
-    await execa6("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
   }
 }
 async function listGitFiles(dir) {
-  const { stdout } = await execa6(
+  const { stdout } = await execa(
     "git",
     ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
     { cwd: dir }
@@ -9851,7 +9864,6 @@ import { cpSync as cpSync6, existsSync as existsSync36, mkdirSync as mkdirSync12
 import { join as join38, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
-import { execa as execa7 } from "execa";
 import inquirer7 from "inquirer";
 var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
@@ -10180,7 +10192,7 @@ var defaultRunCommand2 = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa7(bin, args, {
+    await execa(bin, args, {
       cwd,
       // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
       //
@@ -10590,7 +10602,6 @@ import { Command as Command24 } from "commander";
 // src/scripts/check-adr-numbering.ts
 import { existsSync as existsSync39 } from "fs";
 import { join as join40 } from "path";
-import { execa as execa8 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
 import { existsSync as existsSync38, readdirSync as readdirSync15, readFileSync as readFileSync29 } from "fs";
@@ -10664,7 +10675,7 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const adrDir = join40(root, "docs", "ADR");
   if (!existsSync39(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
@@ -10705,7 +10716,6 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa9 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -10832,7 +10842,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa9("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10963,9 +10973,6 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
-// src/scripts/check-claim-invocation.ts
-import { execa as execa10 } from "execa";
-
 // src/lib/claim-invocation-parity.ts
 import { existsSync as existsSync40, readFileSync as readFileSync30, readdirSync as readdirSync16 } from "fs";
 import { join as join41 } from "path";
@@ -11090,7 +11097,7 @@ function formatParityViolations(violations) {
 
 // src/scripts/check-claim-invocation.ts
 async function runClaimInvocationCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const docs = distributedAgentsDocs(root);
   console.log(
     `audited ${docs.length} distributed AGENTS.md (${docs.map((d) => d.path).join(", ") || "none"}) under ${root}`
@@ -11112,7 +11119,6 @@ async function runClaimInvocationCheck() {
 // src/scripts/check-codeql-suppression.ts
 import { existsSync as existsSync41 } from "fs";
 import { join as join43, relative as relative8 } from "path";
-import { execa as execa11 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
 import { readdirSync as readdirSync17, readFileSync as readFileSync31, statSync as statSync9 } from "fs";
@@ -11183,7 +11189,7 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const scanRoot = join43(root, "cli", "src");
   if (!existsSync41(scanRoot)) {
     console.log(
@@ -11208,9 +11214,6 @@ async function runCodeqlSuppressionCheck() {
   console.log("\u2713 codeql-suppression guard: no dead `codeql[...]` suppression comment found");
 }
 
-// src/scripts/check-cognito-invite-template.ts
-import { execa as execa12 } from "execa";
-
 // src/lib/cognito-invite-template-guard.ts
 import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
 import { join as join44 } from "path";
@@ -11316,7 +11319,7 @@ function checkCognitoInviteTemplates(repoRoot) {
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -11339,7 +11342,6 @@ async function runCognitoInviteTemplateCheck() {
 
 // src/scripts/check-core-direct-paths.ts
 import { join as join46 } from "path";
-import { execa as execa13 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
 import { existsSync as existsSync42, readFileSync as readFileSync33, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
@@ -11667,7 +11669,7 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
   const frontendSrcDir = opts.frontendSrc ?? join46(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
@@ -11721,7 +11723,6 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa14 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -11732,7 +11733,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -11748,7 +11749,7 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
       const { readFileSync: readFileSync45, existsSync: existsSync54 } = await import("fs");
@@ -11760,18 +11761,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa14("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa14("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa14("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa14("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -11852,9 +11853,6 @@ ${BOLD}If the divergence is deliberate${OFF}
   process.exit(1);
 }
 
-// src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa15 } from "execa";
-
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
 import { join as join47 } from "path";
@@ -12030,7 +12028,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -12069,7 +12067,6 @@ async function runEventBridgeLogPermissionCheck() {
 // src/scripts/check-instance-adoption.ts
 import { existsSync as existsSync43 } from "fs";
 import { join as join48 } from "path";
-import { execa as execa16 } from "execa";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -12083,7 +12080,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
   const instanceLabel = opts.instance ?? join48(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
@@ -12106,9 +12103,6 @@ async function runInstanceAdoptionCheck(opts = {}) {
   process.exit(1);
 }
 
-// src/scripts/check-lambda-output.ts
-import { execa as execa17 } from "execa";
-
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync36 } from "fs";
 import { join as join50 } from "path";
@@ -12269,7 +12263,7 @@ function checkLambdaOutput(repoRoot) {
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12291,7 +12285,6 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { execa as execa18 } from "execa";
 import { existsSync as existsSync45 } from "fs";
 import { join as join51 } from "path";
 
@@ -12348,11 +12341,11 @@ var GREEN = "\x1B[32m";
 var YELLOW2 = "\x1B[33m";
 var OFF2 = "\x1B[0m";
 async function showAt(ref, path, cwd) {
-  const result = await execa18("git", ["show", `${ref}:${path}`], { cwd, reject: false });
+  const result = await execa("git", ["show", `${ref}:${path}`], { cwd, reject: false });
   return result.exitCode === 0 ? result.stdout : null;
 }
 async function runMigrationBodyChangeCheck(argv) {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   if (isInstanceRepo(root)) {
     console.log(
       `\u2713 migration body-change guard: skipped \u2014 this is an instance (${INSTANCE_CORE_FILE} present). Its migrations/versions/ is a carried, user-owned copy, not the template source this guard protects.`
@@ -12368,8 +12361,8 @@ async function runMigrationBodyChangeCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  await execa18("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa18(
+  await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa(
     "git",
     [
       "diff",
@@ -12463,7 +12456,6 @@ ${BOLD2}What to do${OFF2}
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
 import { join as join52, relative as relative9 } from "path";
-import { execa as execa19 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -12575,7 +12567,7 @@ function shellFiles(root) {
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -12601,9 +12593,6 @@ async function runPipeTrapCheck() {
   console.log(`\u2713 Pipe-trap guard: no status-bearing command is piped away`);
 }
 
-// src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa20 } from "execa";
-
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync38 } from "fs";
 import { join as join53 } from "path";
@@ -12713,7 +12702,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12740,7 +12729,6 @@ async function runPluginAllowlistConventionCheck() {
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync47 } from "fs";
 import { join as join55 } from "path";
-import { execa as execa21 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
 import { existsSync as existsSync46, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
@@ -12810,7 +12798,7 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const servicesDir = join55(root, "services");
   if (!existsSync47(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
@@ -12828,9 +12816,6 @@ async function runPluginCollisionCheck() {
   console.log("\u2713 plugin collision guard: OK");
 }
 
-// src/scripts/check-plugin-terraform.ts
-import { execa as execa22 } from "execa";
-
 // src/lib/plugin-terraform-guard.ts
 import { existsSync as existsSync48, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
 import { dirname as dirname10, join as join56, relative as relative10, sep as sep4 } from "path";
@@ -12902,7 +12887,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12915,7 +12900,6 @@ async function runPluginTerraformCheck() {
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync50 } from "fs";
 import { join as join58 } from "path";
-import { execa as execa23 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
 import { existsSync as existsSync49, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
@@ -13867,7 +13851,7 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
   const pluginsRoot = join58(root, "services", "_plugins");
   if (!existsSync50(pluginsRoot)) {
@@ -13946,9 +13930,6 @@ async function runPluginToolSupplyCheck() {
   }
 }
 
-// src/scripts/check-release-subject.ts
-import { execa as execa24 } from "execa";
-
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
 var SUBJECT = /^([a-z]+)(?:\([^)]*\))?(!)?:\s+\S/;
@@ -13984,7 +13965,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa24(
+  const { stdout } = await execa(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -14020,7 +14001,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa24("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -14028,9 +14009,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa24("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa24("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -14283,7 +14264,6 @@ async function runSharedFileReductionCheck(args) {
 // src/scripts/check-skeleton-drift.ts
 import { existsSync as existsSync51, readdirSync as readdirSync27 } from "fs";
 import { join as join60 } from "path";
-import { execa as execa25 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
@@ -14412,7 +14392,7 @@ function discoverSkeletons(root) {
   return entries.filter((name) => existsSync51(join60(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa25("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
@@ -14444,9 +14424,8 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa26 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa26("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.297.0",
+  "version": "0.297.2",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/claim.sh

@@ -107,6 +107,21 @@
 #   - **Excludes the branch being pushed, and any PR whose head IS that
 #     branch**, from counting as a conflict. Without this, pushing your own
 #     branch a second time blocks you on your own work.
+#   - **Excludes a SUPERSEDED PREDECESSOR** — a remote branch naming the same
+#     issue whose every commit is already carried by the branch being pushed,
+#     which is what a rebase leaves behind. An issue number has no lineage, so
+#     the number-only comparison could not tell that branch from a rival
+#     session's, and a dead predecessor blocked every later push naming the
+#     issue (tabsii-com/tabsii-platform#1112). Decided from the object graph by
+#     `branch_is_absorbed` below, which fails CLOSED — anything it cannot
+#     positively demonstrate stays a conflict, INCLUDING a candidate carrying
+#     no commits of its own. A branch sitting at `dev`'s tip is a reservation
+#     (AGENTS.md asks for exactly that: "push your branch as soon as it
+#     exists"), and "every commit on it is already carried" is vacuously true
+#     of a branch with no commits — so without that requirement the discount
+#     waved through the most ordinary rival there is. Note the discount applies
+#     to the BRANCH signal only: an OPEN PR is a live claim regardless of
+#     lineage and is never discounted.
 #   - **A real conflict — another branch or another open PR naming the same
 #     issue — exits 1**, naming what was found. AGENTS.md permits stealing a
 #     claim that is over an hour stale, with a comment; the message points
@@ -308,6 +323,146 @@ derive_branch_issue() {
   printf '%s' "$_dbi_n" | sed 's/^0*\([0-9]\)/\1/'
 }
 
+# --- lineage: is remote branch tip $1 already carried by local branch $2? -----
+#
+# The branch check below compares ISSUE NUMBERS, and a number has no lineage.
+# So it could not tell a genuine RIVAL CLAIMANT -- another session working the
+# same issue -- from the pusher's OWN SUPERSEDED PREDECESSOR, the branch they
+# abandoned and rebased away from. Measured live on tabsii-platform:
+# `fix/1050-1033-1061-upstream-carry` is still on the remote at 5b1b8977 while
+# its successor `fix/1050-1033-1061-carry-rebased` was auto-deleted on merge,
+# so every future push naming 1050 is refused by a dead branch
+# (tabsii-com/tabsii-platform#1112).
+#
+# **`git merge-base --is-ancestor` is not the primitive.** A rebase rewrites
+# every commit, so the predecessor's tip stops being an ancestor of its own
+# successor -- verified by experiment (`is-ancestor` rc=1 on exactly the pair
+# `git cherry` reports as fully equivalent). Ancestry answers a strictly
+# narrower question and would have caught none of the reported case.
+#
+# So the question asked here is not "is this branch mine?" -- identity is not a
+# trustworthy signal in this estate and this script never compares it -- but the
+# stronger, decidable one:
+#
+#   **does the candidate carry any work the branch being pushed does not
+#   already have?**
+#
+# If it does not, there is nothing to collide over whoever made it: pushing
+# cannot duplicate or lose work that is already in hand. That is a property of
+# the object graph, not of a name, and it is what makes the discount safe to
+# grant automatically rather than via a hand-maintained skip list.
+#
+# **A claim reserves FUTURE work; a content test can only see PAST work.**
+# This is the predicate's structural limit, and the next reader should have it
+# rather than rediscover it. `git cherry` compares commits that exist; a claim
+# is about commits that do not exist yet. So no content-subset test can ever be
+# complete, and the only safe posture is the one taken here: discount ONLY on
+# positive evidence that the candidate is a replay of work already in hand, and
+# read everything else -- including its own silence -- as a rival.
+#
+# It FAILS CLOSED at every step -- each `return 1` means "conflict", and the
+# only route to `return 0` is positive evidence:
+#
+#   1. Both refs must be known. No local tip, no candidate sha, no discount.
+#   2. The candidate's objects must be present LOCALLY. A branch this machine
+#      has never fetched cannot be shown to be superseded, and absence of
+#      evidence is not evidence of supersession.
+#   3. The candidate must carry AT LEAST ONE COMMIT OF ITS OWN. Step 5 asks
+#      "does the candidate carry work this push does not already have?", and
+#      that question is VACUOUSLY TRUE of a candidate with no commits at all --
+#      a branch pointing at `dev`'s tip, or at anything else already reachable
+#      from the pusher. `git cherry` then emits nothing, no `+` line is found,
+#      and a LIVE RESERVATION is discounted while the notice calls it a
+#      superseded predecessor. Reproduced: with `fix/1050-other-agent` pushed
+#      at `dev`'s tip, `--guard fix/1050-mine` printed `discounted
+#      fix/1050-other-agent` and exited 0.
+#
+#      That is the LIKELY rival shape, not an exotic one. AGENTS.md asks for
+#      exactly it -- "push your branch as soon as it exists. The claim is a
+#      reservation; the branch is the evidence" -- so an agent that stakes an
+#      issue before writing code produces a commitless branch by following the
+#      documented protocol. It is also symmetric: two sessions staking one
+#      issue seconds apart both sit at `dev`'s tip and would each discount the
+#      other, which is the 2026-08-03 collision shape. Nothing else catches it
+#      either -- a commitless branch has no open PR to find, and `--guard`
+#      deliberately never reads the `in-progress` label.
+#
+#      **Own commits are counted against the branch being pushed, not against
+#      `dev`** -- `git rev-list <candidate> --not <local tip>`, i.e. the
+#      commits on the candidate's side of the merge base with this push. Three
+#      reasons that is the right base:
+#        - It is the SAME frame of reference steps 4 and 5 already use, so the
+#          three cannot disagree about what "beyond" means. A second base would
+#          be a second authority, which is this estate's most-repeated defect.
+#        - `dev` is not knowable here. `--guard` is handed one branch name by a
+#          pre-push hook, is never told the integration branch, and a candidate
+#          need not derive from it anyway.
+#        - It answers the question actually being asked. Every candidate that
+#          must not be discounted counts zero against it: at `dev`'s tip, at
+#          the pusher's own tip (the symmetric race), and at any older ancestor
+#          -- all are already reachable, so none carries anything of its own.
+#      A candidate whose only commits are MERGES counts non-zero here and is
+#      refused by step 4 instead; this step is deliberately not the one that
+#      decides that case.
+#   4. No unmerged MERGE COMMIT. `git cherry` compares non-merge commits by
+#      patch id and omits merges entirely -- verified: a candidate carrying one
+#      merge commit had that commit listed by neither `+` nor `-`, so an evil
+#      merge's own resolution would be invisible. Refuse rather than guess.
+#   5. `git cherry <local tip> <candidate>` must emit no `+` line. `-` means an
+#      equivalent patch is already present (what a rebase produces); `+` means
+#      the candidate carries something this push does not.
+#
+# Known FALSE POSITIVES (still blocks, conservatively):
+#   - a predecessor that was SQUASHED or amended rather than replayed -- the
+#     patch ids differ, so it reads as a rival. Verified: `git merge --squash`
+#     of the predecessor produces `+` on both of its commits.
+#   - a predecessor whose objects are not in this clone (fresh machine).
+#   - a candidate carrying a merge commit.
+#   - a predecessor left pointing at a commit already reachable from this push
+#     (someone reset it back onto `dev`). It carries nothing of its own, so
+#     step 3 refuses it -- correctly, because that branch is indistinguishable
+#     from a rival's fresh reservation.
+#
+# Known FALSE NEGATIVES (discounts something that was not ours):
+#   - a genuine rival that has committed real work, EVERY commit of which has
+#     a patch-id equivalent already in the pushed branch (a cherry-pick of
+#     exactly this work and nothing more), AND whose objects happen to be in
+#     this clone. Their work is then already fully in hand, so there is no
+#     duplicated effort left to warn about -- the discount is right for the
+#     wrong reason. This is the residual gap. Step 3 narrows it to rivals who
+#     have actually duplicated this push's content, rather than leaving it open
+#     to anyone who merely staked a branch, but it cannot close it: see the
+#     future/past limit at the top of this comment.
+#   - the reverse of (4) cannot happen: a merge is refused, never absorbed.
+branch_is_absorbed() {
+  _abs_cand="$1"
+  _abs_tip="$2"
+
+  [ -n "$_abs_cand" ] || return 1
+  [ -n "$_abs_tip" ] || return 1
+
+  git cat-file -e "${_abs_cand}^{commit}" 2>/dev/null || return 1
+
+  # Step 3 (see above): zero own commits is a RESERVATION, never a
+  # supersession. Counted against the branch being pushed, which is the same
+  # base the two checks below use. A count that cannot be computed, or that
+  # comes back non-numeric, is a cannot-tell and fails closed like everything
+  # else here -- `[` itself returns non-zero on a non-integer operand, so the
+  # `|| return 1` covers that without a second parse.
+  _abs_own=$(git rev-list --count "$_abs_cand" --not "$_abs_tip" 2>/dev/null) || return 1
+  [ -n "$_abs_own" ] || return 1
+  [ "$_abs_own" -gt 0 ] 2>/dev/null || return 1
+
+  _abs_merges=$(git rev-list --merges --count "$_abs_cand" --not "$_abs_tip" 2>/dev/null) || return 1
+  [ "$_abs_merges" = "0" ] || return 1
+
+  _abs_cherry=$(git cherry "$_abs_tip" "$_abs_cand" 2>/dev/null) || return 1
+  if printf '%s\n' "$_abs_cherry" | grep -q '^+'; then
+    return 1
+  fi
+  return 0
+}
+
 # --- the structural claim predicate (#1411, class #1362 instance 8) ---------
 #
 # "Does this open PR claim issue $1?" used to be answered independently at
@@ -467,6 +622,12 @@ if [ -n "$GUARD_BRANCH" ]; then
   conflict=0
   findings=""
   cannot_tell_reasons=""
+  absorbed_branches=""
+
+  # The local tip of the branch being pushed, resolved once. Empty when it
+  # cannot be resolved (the caller named a branch this repo does not have), and
+  # `branch_is_absorbed` then discounts nothing -- exactly today's behaviour.
+  guard_tip=$(git rev-parse --verify --quiet "refs/heads/$GUARD_BRANCH^{commit}" 2>/dev/null) || guard_tip=""
 
   # --- an open PR referencing the issue, excluding our own branch's PR --------
   slug=$(repo_slug)
@@ -502,22 +663,49 @@ if [ -n "$GUARD_BRANCH" ]; then
     # derived (#1672), and compare the two normalised numbers -- not a
     # substring search for $guard_issue inside the candidate's raw text. See
     # `derive_branch_issue` above for why that asymmetry was the defect.
-    other_branch=$(printf '%s\n' "$raw_branches" |
-      sed 's|.*refs/heads/||' |
-      grep -v -x "$GUARD_BRANCH" |
-      while IFS= read -r _cand; do
+    # Each candidate that names the same issue is then classified by LINEAGE
+    # (see `branch_is_absorbed`): `rival` is a conflict, `absorbed` is this
+    # pusher's own superseded predecessor and is reported but not blocked.
+    # The candidate's SHA -- `git ls-remote`'s first, tab-separated field -- is
+    # what makes that question answerable, so it is no longer thrown away by a
+    # `sed` that kept only the name.
+    _classified=$(printf '%s\n' "$raw_branches" |
+      while IFS= read -r _line; do
+        case "$_line" in
+          *"refs/heads/"*) ;;
+          *) continue ;;
+        esac
+        _cand=${_line##*refs/heads/}
         [ -n "$_cand" ] || continue
+        [ "$_cand" = "$GUARD_BRANCH" ] && continue
         _cand_issue=$(derive_branch_issue "$_cand")
-        if [ -n "$_cand_issue" ] && [ "$_cand_issue" = "$guard_issue" ]; then
-          printf '%s\n' "$_cand"
+        [ -n "$_cand_issue" ] || continue
+        [ "$_cand_issue" = "$guard_issue" ] || continue
+        _cand_sha=$(printf '%s\n' "$_line" | cut -f1)
+        if branch_is_absorbed "$_cand_sha" "$guard_tip"; then
+          printf 'absorbed %s\n' "$_cand"
+        else
+          printf 'rival %s\n' "$_cand"
         fi
-      done | head -1)
+      done)
+
+    other_branch=$(printf '%s\n' "$_classified" | sed -n 's/^rival //p' | head -1)
+    absorbed_branches=$(printf '%s\n' "$_classified" | sed -n 's/^absorbed //p')
     if [ -n "$other_branch" ]; then
       conflict=1
       findings="${findings}  ${RED}branch${OFF}     $other_branch\n"
     fi
   fi
 
+  # A discount a guard grants silently is a guard nobody can audit, so say so
+  # -- on stderr, only when it actually fired, and whether or not a real rival
+  # was also found.
+  if [ -n "$absorbed_branches" ]; then
+    printf '%b' "${DIM}claim --guard: discounted $(printf '%s' "$absorbed_branches" | tr '\n' ' ') ${OFF}" >&2
+    echo "${DIM}-- every commit on it is already carried by $GUARD_BRANCH, so it is a${OFF}" >&2
+    echo "${DIM}superseded predecessor rather than a rival claim (#1112).${OFF}" >&2
+  fi
+
   if [ "$conflict" -eq 1 ]; then
     printf '%b' "${RED}claim --guard: issue #$guard_issue looks claimed by someone else.${OFF}\n$findings"
     echo