@cleocode/core 2026.10.25 → 2026.10.26

package/dist/release/ci-evidence.js

@@ -50,7 +50,7 @@
  * @task T12634
  */
 import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isGitWorkTree } from '../git/work-tree.js';
 import { checkPrTaskLinkage, isDocumentArtifact, linkedPrChange, } from '../tasks/evidence.js';
@@ -96,6 +96,51 @@ export function readCiSatisfies(projectRoot) {
     const evidence = readProjectContextFile(projectRoot)?.evidence;
     return evidence?.ciSatisfies === true;
 }
+/**
+ * The `evidence.ciSatisfies` remedy for a project that has GitHub workflows
+ * but has not opted in (T13096), or null when it has, or has no workflows.
+ *
+ * Without the setting, `cleo complete` cannot stand a merged PR's CI in for
+ * `testsPassed`/`qaPassed` (`ci:<pr>`), so a scoped run recorded before the
+ * merge leaves only a full local suite. The remedy is a ready-to-paste
+ * `evidence` block whose `ciChecks` are the default branch's required checks
+ * ({@link resolveRequiredWorkflowsDetailed}, read-only: nothing is cached).
+ *
+ * @param root - The project checkout (its `.cleo/project-context.json` and `.github/workflows`).
+ * @param opts - Branch-protection fetcher override (tests).
+ * @returns The remedy text, or null.
+ * @task T13096
+ */
+export async function ciSatisfiesRemedy(root, opts = {}) {
+    if (readCiSatisfies(root))
+        return null;
+    let workflows;
+    try {
+        workflows = readdirSync(join(root, '.github', 'workflows')).filter((f) => /\.ya?ml$/.test(f));
+    }
+    catch {
+        return null;
+    }
+    if (workflows.length === 0)
+        return null;
+    const required = await resolveRequiredWorkflowsDetailed({ storeRoot: root, executionRoot: root }, {
+        projectContext: readProjectContextFile(root),
+        readOnly: true,
+        ...(opts.fetchGhBranchProtection
+            ? { fetchGhBranchProtection: opts.fetchGhBranchProtection }
+            : {}),
+    });
+    const checks = required.source.tier === 'unknown' ? [] : required.workflows;
+    // ci:<pr> attests a gate only through its declared ciChecks list (T12634).
+    const listed = checks.length > 0 ? checks : ['<required check>'];
+    const block = { ciSatisfies: true, ciChecks: { tests: listed, qa: listed } };
+    return (`This project has GitHub workflows (.github/workflows) but does not set evidence.ciSatisfies, ` +
+        "so a merged PR's CI cannot stand in for testsPassed/qaPassed (ci:<pr>). Add to " +
+        `.cleo/project-context.json: "evidence": ${JSON.stringify(block)}` +
+        (checks.length > 0
+            ? ` (required checks from ${describeRequiredWorkflowsSource(required.source)}; narrow ciChecks.tests/qa to the checks that run tests and QA).`
+            : `, replacing <required check> with the required checks that run tests and QA (none were found: ${describeRequiredWorkflowsSource(required.source)}).`));
+}
 /**
  * The checks that attest each gate (`evidence.ciChecks`, T12634).
  *
@@ -330,17 +375,46 @@ export function evaluateJobs(globs, checks, sha, scope, onlyEvent) {
     }
     return reasons.length > 0 ? { ok: false, reasons } : { ok: true, jobs };
 }
-function pinMatches(check, pin) {
+/**
+ * Whether a run comes from a check's pinned app and workflow (T13017):
+ * `unknown` when the response left out an identity field the pin names (a
+ * check run whose workflow run was not listed yet), so the run is neither
+ * counted nor reported as posted by another app.
+ */
+function pinMatch(check, pin) {
     if (!pin)
-        return true;
+        return 'match';
+    let unknown = false;
     if (pin.app !== undefined) {
-        const ok = typeof pin.app === 'number' ? check.appId === pin.app : check.appSlug === pin.app;
-        if (!ok)
-            return false;
-    }
-    if (pin.workflow !== undefined && check.workflowPath !== pin.workflow)
-        return false;
-    return true;
+        const actual = typeof pin.app === 'number' ? check.appId : check.appSlug;
+        if (actual === undefined)
+            unknown = true;
+        else if (actual !== pin.app)
+            return 'mismatch';
+    }
+    if (pin.workflow !== undefined) {
+        if (check.workflowPath === undefined)
+            unknown = true;
+        else if (check.workflowPath !== pin.workflow)
+            return 'mismatch';
+    }
+    return unknown ? 'unknown' : 'match';
+}
+function pinMatches(check, pin) {
+    return pinMatch(check, pin) === 'match';
+}
+/**
+ * Whether a fetch left a required check's run without the identity its pin
+ * names (T13017), so the fetch is retried before anything is judged.
+ *
+ * @param checks - Checks fetched for one commit.
+ * @param required - Required check names.
+ * @param pins - Required-name to app/workflow pin.
+ * @returns True when a required run's identity is incomplete.
+ * @task T13017
+ */
+export function hasIncompleteIdentity(checks, required, pins) {
+    return checks.some((c) => required.includes(c.name) && pinMatch(c, pins[c.name]) === 'unknown');
 }
 function describeApp(check) {
     return check.appSlug ?? (check.appId !== undefined ? `app ${check.appId}` : 'an unknown app');
@@ -402,17 +476,20 @@ export function evaluateMergeCommitChecks(required, checks, mergeCommitSha, opts
                 continue;
             }
         }
-        const impostor = named.find((c) => !pinMatches(c, pins[name]));
+        const impostor = named.find((c) => pinMatch(c, pins[name]) === 'mismatch');
+        const unidentified = named.some((c) => pinMatch(c, pins[name]) === 'unknown');
         const elsewhere = pinned.find((c) => c.headSha !== mergeCommitSha &&
             c.headSha !== treeEquivalentSha &&
             c.headSha !== descendantSha);
-        reasons.push(onMerge.verdict === 'missing' && impostor && pinned.length === 0
-            ? `${name}: posted by ${describeApp(impostor)}${impostor.workflowPath ? ` (${impostor.workflowPath})` : ''}, not the pinned ${describePin(pins[name])}`
-            : onMerge.verdict === 'missing' && elsewhere
-                ? `${name}: ran on ${elsewhere.headSha.slice(0, 12)}, not the merge commit ${mergeCommitSha.slice(0, 12)}`
-                : onMerge.verdict === 'missing'
-                    ? `${name}: not found on merge commit ${mergeCommitSha.slice(0, 12)}`
-                    : `${name}: ${onMerge.verdict} on merge commit ${mergeCommitSha.slice(0, 12)}`);
+        reasons.push(onMerge.verdict === 'missing' && unidentified && pinned.length === 0
+            ? `${name}: pending (GitHub has not reported its run's app or workflow yet) on merge commit ${mergeCommitSha.slice(0, 12)}`
+            : onMerge.verdict === 'missing' && impostor && pinned.length === 0
+                ? `${name}: posted by ${describeApp(impostor)}${impostor.workflowPath ? ` (${impostor.workflowPath})` : ''}, not the pinned ${describePin(pins[name])}`
+                : onMerge.verdict === 'missing' && elsewhere
+                    ? `${name}: ran on ${elsewhere.headSha.slice(0, 12)}, not the merge commit ${mergeCommitSha.slice(0, 12)}`
+                    : onMerge.verdict === 'missing'
+                        ? `${name}: not found on merge commit ${mergeCommitSha.slice(0, 12)}`
+                        : `${name}: ${onMerge.verdict} on merge commit ${mergeCommitSha.slice(0, 12)}`);
     }
     return reasons.length > 0 ? { ok: false, reasons } : { ok: true, checks: matched };
 }
@@ -588,11 +665,13 @@ function lateRun(run, nextMainCommitAt) {
  * @param ancestors - First-parent ancestors of the merge, nearest first, with their checks.
  * @param pins - Required-name to app/workflow pin.
  * @param nextMainCommitAt - When the next default-branch commit after the merge landed, if known.
+ * @param untested - Failing jobs with no failed test, a runner cancellation or a worker crash (T14049, T14074): never the PR's, so never blamed.
  * @returns The required names to stand in for and the inherited jobs, or why not.
  * @task T13453
  * @task T14026
+ * @task T14049
  */
-export function inheritedOnMerge(required, checks, mergeCommitSha, ancestors, pins, nextMainCommitAt = null) {
+export function inheritedOnMerge(required, checks, mergeCommitSha, ancestors, pins, nextMainCommitAt = null, untested = new Set()) {
     const scope = pinnedScope(required, pins);
     const onMerge = latestRuns(checks, mergeCommitSha, scope);
     const pending = onMerge.find((c) => c.status !== 'completed');
@@ -602,7 +681,7 @@ export function inheritedOnMerge(required, checks, mergeCommitSha, ancestors, pi
             reason: `${pending.name}: pending on merge commit ${mergeCommitSha.slice(0, 12)}`,
         };
     }
-    const failing = onMerge.filter((c) => !HARMLESS_CONCLUSIONS.has(c.conclusion ?? ''));
+    const failing = onMerge.filter((c) => !HARMLESS_CONCLUSIONS.has(c.conclusion ?? '') && !untested.has(c.id));
     if (failing.length === 0)
         return { ok: false, reason: 'no job failed on the merge commit' };
     const inherited = [];
@@ -713,11 +792,18 @@ const RUN_DIED = /Worker exited unexpectedly|Worker terminated due to reaching m
  * quarantine, a file that failed to load, or counts that do not add up
  * (per-file `(N tests | M failed)` lines included).
  *
+ * With `unretriedTimeouts` (T14086, later runs only), a failing test whose
+ * error is vitest's own "Test timed out in N ms" also qualifies: the budget
+ * stopped the run before its rerun-once flake rule (T13145) could judge it,
+ * so the timeout decided nothing. An assertion failure never qualifies.
+ *
  * @param log - The job's plain-text log (ANSI colour codes allowed).
+ * @param opts - `unretriedTimeouts`: accept unretried timeouts too.
  * @returns Whether the job failed only on the quarantine budget.
  * @task T13809
+ * @task T14086
  */
-export function isQuarantineBudgetOnlyLog(log) {
+export function isQuarantineBudgetOnlyLog(log, opts = {}) {
     const text = log.replace(/\u001b\[[0-9;]*m/g, '');
     // The script's own verdict is the last heading, with its count line under it
     // (a test's fixture output may carry the heading too).
@@ -748,9 +834,19 @@ export function isQuarantineBudgetOnlyLog(log) {
         ...text.slice(heading).matchAll(new RegExp(`- \`(${testPath})\` > (.+)$`, 'gm')),
     ].map((m) => ({ file: m[1] ?? '', title: normTitle(m[2] ?? '') }));
     const failing = new Map();
+    const timedOut = new Set();
     for (const m of run.matchAll(new RegExp(`\\bFAIL\\s{2,}(?:\\S+\\s+)?(${testPath}) > (.+)$`, 'gm'))) {
         const entry = { file: m[1] ?? '', title: normTitle(m[2] ?? '') };
-        failing.set(`${entry.file}\u0000${entry.title}`, entry);
+        const key = `${entry.file}\u0000${entry.title}`;
+        failing.set(key, entry);
+        // The failure's own error is the first line after its FAIL header.
+        const next = run
+            .slice((m.index ?? 0) + m[0].length)
+            .split('\n')
+            .map((l) => l.replace(/^\S*Z\s/, '').trim())
+            .find((l) => l !== '');
+        if (next && /^Error: Test timed out in \d+ms\b/.test(next))
+            timedOut.add(key);
     }
     if (failing.size !== failedTests)
         return false;
@@ -758,7 +854,8 @@ export function isQuarantineBudgetOnlyLog(log) {
         return false;
     if (!perFile.every((p) => [...failing.values()].some((f) => f.file === p.file)))
         return false;
-    return [...failing.values()].every((f) => quarantined.some((q) => q.title === f.title && q.file.endsWith(f.file)));
+    return [...failing.entries()].every(([key, f]) => quarantined.some((q) => q.title === f.title && q.file.endsWith(f.file)) ||
+        (opts.unretriedTimeouts === true && timedOut.has(key)));
 }
 /**
  * Whether every failure on a commit's CI is a non-test failure (T13809): each
@@ -774,10 +871,11 @@ export function isQuarantineBudgetOnlyLog(log) {
  * @param pins - Required-name to app/workflow pin.
  * @param fetchJobLog - Plain-text log of one job.
  * @param cwd - Repository work tree for `gh`.
+ * @param opts - `unretriedTimeouts` for a later run (T14086, {@link isQuarantineBudgetOnlyLog}).
  * @returns The quarantine-only jobs, or why the commit failed for real.
  * @task T13809
  */
-export async function nonTestFailuresOn(checks, sha, required, pins, fetchJobLog, cwd) {
+export async function nonTestFailuresOn(checks, sha, required, pins, fetchJobLog, cwd, opts = {}) {
     const latest = latestRuns(checks, sha, pinnedScope(required, pins));
     const jobs = [];
     for (const c of latest) {
@@ -790,7 +888,7 @@ export async function nonTestFailuresOn(checks, sha, required, pins, fetchJobLog
         if (c.source === 'workflow-run' || required.includes(c.name))
             continue;
         const log = c.conclusion === 'failure' ? await fetchJobLog(c.id, cwd) : null;
-        if (log === null || !isQuarantineBudgetOnlyLog(log)) {
+        if (log === null || !isQuarantineBudgetOnlyLog(log, opts)) {
             return {
                 ok: false,
                 reason: `${c.name}: ${c.conclusion} on ${sha.slice(0, 12)}${log === null && c.conclusion === 'failure' ? ' (its log could not be read)' : ''} — not the flaky-quarantine budget alone`,
@@ -846,11 +944,111 @@ export async function cancelledWithoutTestFailure(checks, sha, required, pins, f
         return false;
     if (runs.some((r) => r.conclusion !== 'cancelled' && r.conclusion !== 'success'))
         return false;
-    const noTestFailed = (log) => {
-        const text = log.replace(/\u001b\[[0-9;]*m/g, '');
-        return !/\bFAIL\s{2,}|\d+ failed/.test(text) && !RUN_DIED.test(text);
-    };
-    return ((await everyFailedJobLog(checks, sha, required, pins, fetchJobLog, cwd, noTestFailed)) !== null);
+    return ((await everyFailedJobLog(checks, sha, required, pins, fetchJobLog, cwd, noTestFailedLog)) !==
+        null);
+}
+/** Whether a job log names no failed test and no dead vitest run (T13809). */
+function noTestFailedLog(log) {
+    const text = log.replace(/\u001b\[[0-9;]*m/g, '');
+    return !/\bFAIL\s{2,}|\d+ failed/.test(text) && !RUN_DIED.test(text);
+}
+/** The errors GitHub prints when the runner, not the job, stopped a step (T14049). */
+const RUNNER_CANCEL_ERROR = /##\[error\](?:The operation was canceled\.|The runner has received a shutdown signal\b.*)\s*$/;
+/**
+ * Whether a job log shows only a runner cancellation (T14049): every
+ * `##[error]` line is GitHub's own "The operation was canceled." (or the
+ * runner shutdown notice before it), and no test failed. GitHub then reports
+ * the job, and the aggregate check that needs it, as `failure`, though
+ * nothing the PR changed failed.
+ *
+ * @param log - The job's plain-text log (ANSI colour codes allowed).
+ * @returns Whether the job failed only because its runner was cancelled.
+ * @task T14049
+ */
+export function isRunnerCancelOnlyLog(log) {
+    const text = log.replace(/\u001b\[[0-9;]*m/g, '');
+    const errors = text.split('\n').filter((line) => line.includes('##[error]'));
+    return (errors.some((line) => /##\[error\]The operation was canceled\./.test(line)) &&
+        errors.every((line) => RUNNER_CANCEL_ERROR.test(line)) &&
+        noTestFailedLog(text));
+}
+/** A vitest summary or failure line naming a failed test or file. */
+const FAILED_TEST = /\bFAIL\s{2,}|\d+ failed/;
+/**
+ * Whether a job log shows only an unattributable vitest worker crash
+ * (T14074): no test or file failed, every `Unhandled Error` vitest reports is
+ * its own pool's "Worker forks emitted error" (a fork that exited
+ * unexpectedly, e.g. a native addon abort), and the only `##[error]` is the
+ * step's non-zero exit. Such a run never showed a test of the change failing.
+ *
+ * @param log - The job's plain-text log (ANSI colour codes allowed).
+ * @returns Whether the job failed only on a worker crash.
+ * @task T14074
+ */
+export function isWorkerCrashOnlyLog(log) {
+    const text = log.replace(/\u001b\[[0-9;]*m/g, '');
+    const crashes = text.match(/Error: \[vitest-pool\]: Worker forks emitted error\./g)?.length ?? 0;
+    const unhandled = text.match(/⎯+ Unhandled Error ⎯+/g)?.length ?? 0;
+    const errors = text.split('\n').filter((line) => line.includes('##[error]'));
+    return (crashes > 0 &&
+        unhandled === crashes &&
+        /Caused by: Error: Worker exited unexpectedly/.test(text) &&
+        !FAILED_TEST.test(text) &&
+        errors.every((line) => /##\[error\]Process completed with exit code \d+\.\s*$/.test(line)));
+}
+/**
+ * Why a failing job's log shows no failed test, or `null` when it may have
+ * failed on the change: a runner cancellation ({@link isRunnerCancelOnlyLog})
+ * or a worker crash ({@link isWorkerCrashOnlyLog}).
+ *
+ * @param log - The job's plain-text log.
+ * @returns The cause, or `null`.
+ * @task T14074
+ */
+export function untestedFailureCause(log) {
+    if (isRunnerCancelOnlyLog(log))
+        return 'runner-cancel';
+    if (isWorkerCrashOnlyLog(log))
+        return 'worker-crash';
+    return null;
+}
+/**
+ * The failing jobs of a pinned workflow on `sha` (the required aggregate and
+ * workflow runs excluded) that failed without a failed test: a runner
+ * cancellation (T14049) or a worker crash (T14074), by
+ * {@link untestedFailureCause}. A pending job or an unreadable log is never
+ * one, so `all` is then false.
+ *
+ * @param checks - Checks fetched for `sha`.
+ * @param sha - The commit judged.
+ * @param required - Required check names.
+ * @param pins - Required-name to app/workflow pin.
+ * @param fetchJobLog - Plain-text log of one job.
+ * @param cwd - Repository work tree for `gh`.
+ * @returns Those jobs, and whether they are every failure.
+ * @task T14049
+ * @task T14074
+ */
+export async function untestedJobFailures(checks, sha, required, pins, fetchJobLog, cwd) {
+    const jobs = [];
+    let all = true;
+    for (const c of latestRuns(checks, sha, pinnedScope(required, pins))) {
+        if (c.source === 'workflow-run' || required.includes(c.name))
+            continue;
+        if (c.status !== 'completed') {
+            all = false;
+            continue;
+        }
+        if (HARMLESS_CONCLUSIONS.has(c.conclusion ?? ''))
+            continue;
+        const log = c.conclusion === 'failure' ? await fetchJobLog(c.id, cwd) : null;
+        const cause = log === null ? null : untestedFailureCause(log);
+        if (cause)
+            jobs.push({ name: c.name, mergeRunId: c.id, cause });
+        else
+            all = false;
+    }
+    return { jobs, ids: new Set(jobs.map((j) => j.mergeRunId)), all: all && jobs.length > 0 };
 }
 /**
  * Whether a job log shows a failure in a setup step before any test ran
@@ -964,16 +1162,28 @@ export async function findGreenDescendant(input) {
     });
     let inherited;
     let nonTest;
+    let untested;
+    let untestedIds = new Set();
+    const unproven = () => required.filter((name) => !judgeOnSha(input.checks.filter((c) => c.name === name && pinMatches(c, pins[name])), merge).ok);
+    if (!superseded.ok && input.fetchJobLog) {
+        // T14049, T14074: a job that failed with no failed test (a runner
+        // cancellation, or a vitest worker crash) decided nothing, though GitHub
+        // reports it and the aggregate as `failure`: it is superseded, as a
+        // cancelled run is. A job with any failed test never is.
+        const found = await untestedJobFailures(input.checks, merge, required, pins, input.fetchJobLog, cwd);
+        untestedIds = found.ids;
+        if (found.all) {
+            untested = found.jobs;
+            superseded = { ok: true, names: unproven() };
+        }
+    }
     if (!superseded.ok && input.fetchJobLog) {
         // T13809: a merge-commit run red only because main's flaky quarantine was
         // over budget (every test passed) failed no test of the PR's.
         const result = await nonTestFailuresOn(input.checks, merge, required, pins, input.fetchJobLog, cwd);
         if (result.ok) {
             nonTest = result.jobs;
-            superseded = {
-                ok: true,
-                names: required.filter((name) => !judgeOnSha(input.checks.filter((c) => c.name === name && pinMatches(c, pins[name])), merge).ok),
-            };
+            superseded = { ok: true, names: unproven() };
         }
     }
     if (!superseded.ok && input.firstParentOf) {
@@ -991,7 +1201,7 @@ export async function findGreenDescendant(input) {
                 break;
             ancestors.push({ sha: at, checks: fetched.checks });
         }
-        const result = inheritedOnMerge(required, input.checks, merge, ancestors, pins, input.nextMainCommitAt?.(merge, input.ref, cwd) ?? null);
+        const result = inheritedOnMerge(required, input.checks, merge, ancestors, pins, input.nextMainCommitAt?.(merge, input.ref, cwd) ?? null, untestedIds);
         if (result.ok) {
             superseded = { ok: true, names: result.names };
             inherited = result.inherited;
@@ -1043,6 +1253,7 @@ export async function findGreenDescendant(input) {
         ["the PR's files", input.changedPaths],
         [`a CI definition (${ciPaths.join(', ')})`, ciPaths],
     ];
+    const passedOver = [];
     for (const sha of candidates.slice(0, CI_DESCENDANT_MAX_CANDIDATES)) {
         if (sha === merge || !input.isAncestor(merge, sha, cwd))
             continue;
@@ -1067,9 +1278,17 @@ export async function findGreenDescendant(input) {
             // T13809: a later run red only for the quarantine budget, cancelled with
             // no test failing, or failed before any test ran decides nothing; look on.
             // Any other failure still refuses: a green run is never shopped for past a real one.
-            const quarantineOnly = await nonTestFailuresOn(fetched.checks, sha, required, pins, input.fetchJobLog, cwd);
-            if (quarantineOnly.ok)
+            // T14086: in such a run, a test that only timed out was never retried, so
+            // it decided nothing either; an assertion failure still refuses.
+            const quarantineOnly = await nonTestFailuresOn(fetched.checks, sha, required, pins, input.fetchJobLog, cwd, { unretriedTimeouts: true });
+            if (quarantineOnly.ok) {
+                passedOver.push({
+                    sha,
+                    jobs: quarantineOnly.jobs.map((j) => j.name),
+                    reason: 'the flaky-quarantine budget stopped the run before its flake rerun',
+                });
                 continue;
+            }
             if (await cancelledWithoutTestFailure(fetched.checks, sha, required, pins, input.fetchJobLog, cwd)) {
                 continue;
             }
@@ -1096,6 +1315,8 @@ export async function findGreenDescendant(input) {
             ...(head ? { prHeadSha: head } : {}),
             ...(inherited ? { inherited } : {}),
             ...(nonTest ? { nonTest } : {}),
+            ...(untested ? { untested } : {}),
+            ...(passedOver.length > 0 ? { passedOver } : {}),
         };
     }
     return {
@@ -1431,6 +1652,26 @@ async function defaultFetchJobLog(jobId, cwd) {
         return null;
     }
 }
+/**
+ * Fetch once more when a required check's run came back without the identity
+ * its pin names (T13017): GitHub lists a job before its workflow run, and a
+ * run judged from that response would read as another app's. A run still
+ * incomplete after the retry is judged pending, never as a mismatch.
+ *
+ * @param fetchChecks - The underlying check fetch.
+ * @param required - Required check names.
+ * @param pins - Required-name to app/workflow pin.
+ * @returns The same fetch, retried once on incomplete identity.
+ * @task T13017
+ */
+export function refetchIncompleteIdentity(fetchChecks, required, pins) {
+    return async (sha, cwd) => {
+        const first = await fetchChecks(sha, cwd);
+        if (!first.ok || !hasIncompleteIdentity(first.checks, required, pins))
+            return first;
+        return fetchChecks(sha, cwd);
+    };
+}
 /**
  * Drop runs a schedule started from every fetch (T13623). A nightly run that
  * happens to land on a merge commit tests main at that hour, not the merge:
@@ -1755,7 +1996,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     ];
     const editedWorkflows = pinnedWorkflows.filter((w) => pr.changedPaths.includes(w));
     const mainOnly = editedWorkflows.length > 0;
-    const fetchChecks = withoutScheduledRuns(opts.fetchChecks ?? defaultFetchChecks);
+    const fetchChecks = refetchIncompleteIdentity(withoutScheduledRuns(opts.fetchChecks ?? defaultFetchChecks), required.workflows, pins);
     const fetched = await fetchChecks(pr.mergeCommitSha, roots.executionRoot);
     if (!fetched.ok)
         return { ok: false, reason: fetched.reason, codeName: 'E_EVIDENCE_TOOL_FAILED' };
@@ -1829,7 +2070,9 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 ...(treeEqualHead ? { treeEquivalentSha: treeEqualHead } : {}),
                 pins,
                 descendantSha: found.sha,
-                ...(found.inherited || found.nonTest ? { inheritedFailures: true } : {}),
+                ...(found.inherited || found.nonTest || found.untested
+                    ? { inheritedFailures: true }
+                    : {}),
             });
             if (rejudged.ok) {
                 checks = withDescendant;
@@ -1840,6 +2083,8 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                     ...(found.prHeadSha ? { prHeadSha: found.prHeadSha } : {}),
                     ...(found.inherited ? { inherited: found.inherited } : {}),
                     ...(found.nonTest ? { nonTest: found.nonTest } : {}),
+                    ...(found.untested ? { untested: found.untested } : {}),
+                    ...(found.passedOver ? { passedOver: found.passedOver } : {}),
                 };
             }
             else {
@@ -1898,19 +2143,22 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     }
     if (!judgedChecks.ok) {
         const waiting = judgedChecks.reasons.some((r) => /pending|not found|missing/.test(r));
+        const merge12 = pr.mergeCommitSha.slice(0, 12);
+        // T14042: the decisive reason and the next step lead; the detail follows,
+        // so a truncated refusal still says what to do.
+        const lead = mainOnly
+            ? `PR #${prNumber} edits the pinned workflow ${editedWorkflows.join(', ')}, so only main's push CI attests it (T13174)` +
+                (waiting
+                    ? `: wait for the push run on ${merge12} (or a later main commit) to finish, then verify again. No local run is needed.`
+                    : `, and it is not green: ${judgedChecks.reasons[0]}.`)
+            : `Required CI on PR #${prNumber}'s merge commit ${merge12} is not green: ${judgedChecks.reasons[0]}` +
+                (waiting ? '; wait for it to finish, then verify again.' : '.');
         return {
             ok: false,
             codeName: 'E_EVIDENCE_TESTS_FAILED',
-            reason: `Required CI on PR #${prNumber}'s merge commit ${pr.mergeCommitSha.slice(0, 12)} is not green ` +
-                `(source: ${describeRequiredWorkflowsSource(required.source)}):\n  - ${judgedChecks.reasons.join('\n  - ')}` +
+            reason: `${lead}\n  Required checks (source: ${describeRequiredWorkflowsSource(required.source)}):\n  - ${judgedChecks.reasons.join('\n  - ')}` +
                 (descendantReason ? `\n  No later main run stands in: ${descendantReason}` : '') +
-                (currentHeadReason ? `\n  No current-HEAD run stands in: ${currentHeadReason}` : '') +
-                (mainOnly
-                    ? `\n  PR #${prNumber} edits the pinned workflow ${editedWorkflows.join(', ')}, so only main's push CI attests it (T13174)` +
-                        (waiting
-                            ? `: wait for the push run on ${pr.mergeCommitSha.slice(0, 12)} (or a later main commit) to finish, then verify again. No local run is needed.`
-                            : '.')
-                    : ''),
+                (currentHeadReason ? `\n  No current-HEAD run stands in: ${currentHeadReason}` : ''),
         };
     }
     // Round 2 (skipped tests): the aggregate counts skipped jobs as a pass. For a
@@ -2023,6 +2271,8 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                     ...(descendant.prHeadSha ? { descendantPrHeadSha: descendant.prHeadSha } : {}),
                     ...(descendant.inherited ? { inheritedFailures: descendant.inherited } : {}),
                     ...(descendant.nonTest ? { nonTestFailures: descendant.nonTest } : {}),
+                    ...(descendant.untested ? { untestedFailures: descendant.untested } : {}),
+                    ...(descendant.passedOver ? { passedOverRuns: descendant.passedOver } : {}),
                 }
                 : {}),
             ...(workspaceWide ? { workspaceWide } : {}),