@cleocode/core 2026.10.27 → 2026.11.1-canary.10

package/dist/release/ci-evidence.js

@@ -47,21 +47,47 @@
  * merge stands in, whatever the merge's own run concluded and whatever later
  * commits touched. See {@link findGreenCurrentHead}.
  *
+ * A fifth (T14434, owner decision D11241, extending D11192): the same
+ * current-head run stands in for a SCOPED change too, when the merge commit's
+ * red or cancelled run is not the PR's (the T12742, T13453, T13809 and T14049
+ * judgements), the PR head's own CI was green, and every hunk the PR added is
+ * still there at the stand-in. It runs today's CI definition: the owner
+ * accepted that a later change weakening a check also releases the tasks
+ * waiting behind it. A failure that is the PR's still refuses.
+ *
  * @task T12634
  */
 import { execFileSync } from 'node:child_process';
 import { readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isGitWorkTree } from '../git/work-tree.js';
-import { checkPrTaskLinkage, isDocumentArtifact, linkedPrChange, } from '../tasks/evidence.js';
+import { checkPrTaskLinkage, isDocumentArtifact, linkedPrChange, reviewedDirectiveLinkage, } from '../tasks/evidence.js';
 import { ghQueryTimeoutMs, isGhCliAvailable } from './github-pr.js';
 import { describeRequiredWorkflowsSource, readRequiredCheckPins, resolvePrEvidenceAtom, resolveRequiredWorkflowsDetailed, } from './pr-evidence.js';
 /** First-parent ancestors searched for a decided base verdict of a failing job (T13453). */
 export const CI_INHERITED_MAX_ANCESTORS = 10;
+/**
+ * What a targeted `test-run:` report must cover, worded once for the
+ * validator's refusal and for every hint that offers a targeted run (T14119),
+ * so a hint never offers a route the validator refuses.
+ *
+ * @task T14119
+ */
+export const TARGETED_RUN_COVERAGE = 'every affected package that has tests — each changed package and each package that ' +
+    'depends on one, the set tool:test-affected runs';
 /** Most later default-branch commits examined for a green stand-in run (T12742). */
 export const CI_DESCENDANT_MAX_CANDIDATES = 20;
 /** Latest committer time after the merge commit a stand-in may have (T12742): 7 days. */
 export const CI_DESCENDANT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+/**
+ * What a `ci:` refusal says while the current-head stand-in is still open
+ * (T14032, T14434): nothing on the merge commit is the PR's to fix, and the
+ * task closes once the default branch's head has green CI. The merge sweep
+ * reads it to keep waiting instead of refusing.
+ *
+ * @task T14434
+ */
+export const CURRENT_HEAD_STAND_IN_OPEN = 'a green push run of the required checks on the default branch head will stand in';
 /** Merge-commit verdicts a later green main run may stand in for (T12742). */
 const SUPERSEDED_VERDICTS = new Set(['cancelled', 'skipped']);
 /** Conclusions that never indicate a real failure on the merge commit (T12742). */
@@ -156,54 +182,36 @@ export function readCiChecks(projectRoot) {
     const list = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string' && x.trim() !== '')
         ? v.map((x) => x.trim())
         : undefined;
-    const { tests, qa, jobs, covering } = raw;
+    const { tests, qa, jobs } = raw;
     const jobLists = typeof jobs === 'object' && jobs !== null
         ? jobs
         : undefined;
     const jobTests = list(jobLists?.tests);
     const jobQa = list(jobLists?.qa);
-    const coverRules = (v) => {
-        if (!Array.isArray(v))
-            return undefined;
-        const rules = v.flatMap((r) => {
-            if (typeof r !== 'object' || r === null)
-                return [];
-            const { paths, jobs: ruleJobs } = r;
-            const p = list(paths);
-            const j = list(ruleJobs);
-            return p && j ? [{ paths: p, jobs: j }] : [];
-        });
-        // A malformed rule voids the whole list: a half-read mapping must not widen coverage.
-        return rules.length === v.length && rules.length > 0 ? rules : undefined;
-    };
-    const coverLists = typeof covering === 'object' && covering !== null
-        ? covering
-        : undefined;
-    const coverTests = coverRules(coverLists?.tests);
-    const coverQa = coverRules(coverLists?.qa);
     return {
         ...(list(tests) ? { tests: list(tests) } : {}),
         ...(list(qa) ? { qa: list(qa) } : {}),
         ...(jobTests || jobQa
             ? { jobs: { ...(jobTests ? { tests: jobTests } : {}), ...(jobQa ? { qa: jobQa } : {}) } }
             : {}),
-        ...(coverTests || coverQa
-            ? {
-                covering: {
-                    ...(coverTests ? { tests: coverTests } : {}),
-                    ...(coverQa ? { qa: coverQa } : {}),
-                },
-            }
-            : {}),
     };
 }
+/**
+ * The package code roots (T14260): every path under them is code for CI's
+ * `code` change filter (so a template `.md` runs the unit shards) and for
+ * evidence (so a filter skip never stands in for their tests). The CI filter
+ * is pinned to this list by a test in `__tests__/ci-evidence.test.ts`.
+ *
+ * @task T14260
+ */
+export const PACKAGE_CODE_ROOTS = ['packages/', 'crates/'];
 /**
  * Top-level directories whose files are code for the `ci:` skip decision even
  * when they are Markdown or text: a `.md` under `packages/**` can be a runtime
  * template (CLEO-INJECTION.md is injected into every agent), and the CI `code`
  * path filter plus the scripts, crates and workflow filters cover these roots.
  */
-const CI_CODE_ROOTS = ['packages/', 'crates/', 'scripts/', '.github/'];
+const CI_CODE_ROOTS = [...PACKAGE_CODE_ROOTS, 'scripts/', '.github/'];
 /**
  * Stricter than `pr:`'s {@link isDocumentArtifact}: a documentation artifact
  * that lives outside every code root. Only a diff made entirely of these may
@@ -224,68 +232,61 @@ function globToRegExp(glob) {
         .join('.*')}$`);
 }
 /**
- * Path glob to an anchored regular expression (T13175): `**` followed by `/` is
- * any number of whole directories (including none), a trailing `/` followed by
- * `**` is everything below, `*` any run of characters within one segment, `?`
- * one character within a segment. Everything else is literal.
+ * Whether a check run's name is the job a configured glob names (T14148). A
+ * matrix job's `name:` is a template (`Type Check${{ matrix.node … }}`), and a
+ * job skipped before its matrix expands reports that raw template as its check
+ * name; its static prefix (`Type Check`) is the job's name, so the skip counts
+ * as the job's, the same job its rendered variants run as.
  *
- * @param glob - Repo-relative path glob.
- * @returns The anchored expression.
+ * @param re - The configured job glob, anchored.
+ * @param name - The check run's name.
+ * @returns True when the run belongs to the job.
+ * @task T14148
  */
-export function pathGlobToRegExp(glob) {
-    let out = '';
-    for (let i = 0; i < glob.length; i++) {
-        const ch = glob[i];
-        if (ch === '*' && glob[i + 1] === '*') {
-            if (glob[i + 2] === '/') {
-                out += '(?:.*/)?';
-                i += 2;
-            }
-            else {
-                out += '.*';
-                i++;
-            }
-        }
-        else if (ch === '*')
-            out += '[^/]*';
-        else if (ch === '?')
-            out += '[^/]';
-        else
-            out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
-    }
-    return new RegExp(`^${out}$`);
+export function jobNameMatches(re, name) {
+    if (re.test(name))
+        return true;
+    const expression = name.indexOf('${{');
+    return expression > 0 && re.test(name.slice(0, expression).trimEnd());
 }
 /**
- * Judge a gate's required jobs with the covering rules (T13175): accepted only
+ * Judge a gate's required jobs as skipped by CI's own change filter (T14260):
+ * accepted only for a diff entirely outside the {@link PACKAGE_CODE_ROOTS},
  * when each required glob either succeeded or had every latest run completed
- * `skipped` (never cancelled, failed, pending or missing), at least one was
- * skipped, every changed path matches a rule, and every job glob of each rule
- * used has run and succeeded on `sha`.
+ * `skipped` (never cancelled, failed, pending or missing) and at least one
+ * was skipped. The caller has already found the required checks (the `CI`
+ * aggregate) green, so the skip is CI's verdict that the change touches
+ * nothing those jobs test.
  *
  * @param globs - The gate's required job globs (`evidence.ciChecks.jobs`).
- * @param rules - The gate's covering rules.
  * @param changedPaths - The PR's changed paths.
  * @param checks - Every check reported for the commit.
  * @param sha - Commit being judged.
  * @param scope - The app and workflow files the jobs must come from.
- * @returns The covering job names, or why coverage does not apply.
- * @task T13175
+ * @returns The jobs that ran and the ones the filter skipped, or why the skip does not count.
+ * @task T14260
  */
-export function evaluateCoveringJobs(globs, rules, changedPaths, checks, sha, scope) {
+export function evaluateFilterSkippedJobs(globs, changedPaths, checks, sha, scope) {
+    if (changedPaths.length === 0)
+        return { ok: false, reason: 'the PR has no known changed paths' };
+    const code = changedPaths.find((p) => PACKAGE_CODE_ROOTS.some((root) => p.startsWith(root)));
+    if (code !== undefined)
+        return {
+            ok: false,
+            reason: `${code} is package code, so a filter skip never stands in for its tests`,
+        };
     const inScope = checks.filter((c) => c.source === 'check-run' &&
         c.headSha === sha &&
         c.workflowPath !== undefined &&
         scope.workflows.includes(c.workflowPath) &&
         (scope.app === undefined ||
             (typeof scope.app === 'number' ? c.appId === scope.app : c.appSlug === scope.app)));
-    // Each required glob either succeeded (kept) or was SKIPPED by its filter
-    // on every run (covered below); anything else refuses.
     const ran = [];
-    let skipped = false;
+    const skipped = [];
     for (const glob of globs) {
         const re = globToRegExp(glob);
         const latest = new Map();
-        for (const c of inScope.filter((c) => re.test(c.name))) {
+        for (const c of inScope.filter((c) => jobNameMatches(re, c.name))) {
             const key = `${c.name}\u0000${c.event ?? ''}`;
             const prev = latest.get(key);
             if (!prev || c.id > prev.id)
@@ -305,23 +306,11 @@ export function evaluateCoveringJobs(globs, rules, changedPaths, checks, sha, sc
                 reason: `job ${notSkipped.name} is ${notSkipped.status !== 'completed' ? notSkipped.status : notSkipped.conclusion}, not skipped by its filter`,
             };
         }
-        skipped = true;
+        skipped.push(...new Set(runs.map((c) => c.name)));
     }
-    if (!skipped)
+    if (skipped.length === 0)
         return { ok: false, reason: 'no required job was skipped' };
-    if (changedPaths.length === 0)
-        return { ok: false, reason: 'the PR has no known changed paths' };
-    const used = new Set();
-    for (const path of changedPaths) {
-        const rule = rules.find((r) => r.paths.some((g) => pathGlobToRegExp(g).test(path)));
-        if (!rule)
-            return { ok: false, reason: `${path} is covered by no evidence.ciChecks.covering rule` };
-        used.add(rule);
-    }
-    const jobs = evaluateJobs([...new Set([...used].flatMap((r) => r.jobs))], checks, sha, scope);
-    return jobs.ok
-        ? { ok: true, jobs: [...new Set([...ran, ...jobs.jobs])] }
-        : { ok: false, reason: jobs.reasons.join('; ') };
+    return { ok: true, jobs: ran, skipped };
 }
 /**
  * An {@link evaluateJobs} reason saying the job never ran on that SHA — not
@@ -354,7 +343,7 @@ export function evaluateJobs(globs, checks, sha, scope, onlyEvent) {
     const jobs = [];
     for (const glob of globs) {
         const re = globToRegExp(glob);
-        const matched = inScope.filter((c) => re.test(c.name));
+        const matched = inScope.filter((c) => jobNameMatches(re, c.name));
         if (matched.length === 0) {
             reasons.push(`job ${glob}: not found in ${scope.workflows.join(', ')} on ${sha.slice(0, 12)}`);
             continue;
@@ -462,10 +451,14 @@ export function evaluateMergeCommitChecks(required, checks, mergeCommitSha, opts
             }
         }
         // T12742: only a superseded (cancelled/skipped) merge-commit verdict may
-        // be stood in for, and only by a later main commit's own push runs.
+        // be stood in for, and only by a later main commit's own push runs. A
+        // check that never ran in a cancelled or skipped run of its pinned
+        // workflow (T14103, T14144) is superseded.
         if (descendantSha !== undefined &&
             descendantSha !== mergeCommitSha &&
             (SUPERSEDED_VERDICTS.has(onMerge.verdict) ||
+                (onMerge.verdict === 'missing' &&
+                    neverRanInSupersededRun(checks, mergeCommitSha, pins[name])) ||
                 opts.currentHead === true ||
                 (opts.inheritedFailures === true &&
                     onMerge.verdict !== 'missing' &&
@@ -575,7 +568,9 @@ function firstRealFailure(checks, sha, scope) {
  * SUPERSEDED there (T12742): its latest merge-commit verdict is `cancelled`
  * or `skipped`, and no run of a required check or of a job in a pinned
  * workflow on the merge commit — any attempt — concluded with a failure. A
- * failed, timed-out, pending or missing check is never superseded. Pure.
+ * failed, timed-out or pending check is never superseded, nor is a missing
+ * one unless its pinned workflow's run on the merge commit was cancelled or
+ * skipped, so it never ran (T14103, T14144). Pure.
  *
  * @param required - Required check names.
  * @param checks - Every check fetched for the merge commit (and PR head).
@@ -605,6 +600,11 @@ export function supersededOnMerge(required, checks, mergeCommitSha, opts = {}) {
             judgeOnSha(pinned, treeEquivalentSha, 'pull_request').ok) {
             continue;
         }
+        if (onMerge.verdict === 'missing' &&
+            neverRanInSupersededRun(checks, mergeCommitSha, pins[name])) {
+            names.push(name);
+            continue;
+        }
         if (!SUPERSEDED_VERDICTS.has(onMerge.verdict)) {
             return {
                 ok: false,
@@ -617,6 +617,28 @@ export function supersededOnMerge(required, checks, mergeCommitSha, opts = {}) {
         ? { ok: true, names }
         : { ok: false, reason: 'no required check was superseded on the merge commit' };
 }
+/**
+ * Whether a required check with no run on `sha` belongs to a pinned workflow
+ * run there that was cancelled or skipped (T14103, T14144). A cancelled run
+ * never starts the jobs it had not reached — a run cancelled while still
+ * queued starts none — so GitHub records no check run for them: such a check
+ * was superseded, not failed. A check that ran and failed is refused before
+ * this is asked ({@link firstRealFailure}); one whose workflow is unpinned, or
+ * whose workflow run finished any other way, stays unproven.
+ */
+function neverRanInSupersededRun(checks, sha, pin) {
+    if (pin?.workflow === undefined)
+        return false;
+    const runs = checks.filter((c) => c.headSha === sha &&
+        c.source === 'workflow-run' &&
+        c.workflowPath === pin.workflow &&
+        c.event === 'push' &&
+        pinMatches(c, pin));
+    if (runs.length === 0)
+        return false;
+    const latest = runs.reduce((a, b) => (b.id > a.id ? b : a));
+    return latest.status === 'completed' && SUPERSEDED_VERDICTS.has(latest.conclusion ?? '');
+}
 /** Latest completed run per (name, source, event) on `sha` within `scope`. */
 function latestRuns(checks, sha, scope) {
     const latest = new Map();
@@ -1012,6 +1034,11 @@ export function untestedFailureCause(log) {
         return 'worker-crash';
     return null;
 }
+/** How a passed-over run names each {@link UntestedFailureCause} (T14176). */
+const UNTESTED_CAUSE_TEXT = {
+    'runner-cancel': 'the runner was cancelled',
+    'worker-crash': 'a test worker crashed',
+};
 /**
  * The failing jobs of a pinned workflow on `sha` (the required aggregate and
  * workflow runs excluded) that failed without a failed test: a runner
@@ -1062,18 +1089,53 @@ export async function untestedJobFailures(checks, sha, required, pins, fetchJobL
  * @task T13809
  */
 export function isSetupStepFailureLog(log) {
-    const lines = log.replace(/\u001b\[[0-9;]*m/g, '').split('\n');
-    if (lines.some((l) => /\bRUN\s+v\d|\bTest Files\s{2,}\d|\bFAIL\s{2,}/.test(l)))
+    const text = log.replace(/\u001b\[[0-9;]*m/g, '');
+    if (text.split('\n').some((l) => /\bRUN\s+v\d|\bTest Files\s{2,}\d|\bFAIL\s{2,}/.test(l)))
         return false;
+    const step = failedStepOf(text);
+    return step !== null && /^[\w.-]+\/[\w./-]+@\S+$/.test(step);
+}
+/**
+ * The step a job failed in (T14252): the `Run …` header of the group the
+ * log's first `##[error]` line belongs to, trimmed; `null` when the log names
+ * no error or no step. Two runs that fail in the same step failed the same way
+ * even when no test ran (a gate script, a bundle budget).
+ *
+ * @param log - The job's plain-text log (ANSI colour codes allowed).
+ * @returns The step's command line, or `null`.
+ * @task T14252
+ */
+export function failedStepOf(log) {
+    const lines = log.replace(/\u001b\[[0-9;]*m/g, '').split('\n');
     const error = lines.findIndex((l) => l.includes('##[error]'));
-    if (error < 0)
-        return false;
     for (let i = error - 1; i >= 0; i--) {
         const step = /##\[group\]Run (.*)$/.exec(lines[i] ?? '');
         if (step)
-            return /^[\w.-]+\/[\w./-]+@\S+\s*$/.test(step[1] ?? '');
+            return (step[1] ?? '').trim();
+    }
+    return null;
+}
+/** The marker the CI test step prints before it re-runs the files that failed (T13145). */
+const RERUN_MARKER = /Re-running \d+ file\(s\) with failing tests/;
+/**
+ * The test files that failed a job and decided it (T14252), as
+ * `<project>:<file>` from vitest's `FAIL  <project> <file>` lines. When the
+ * job re-ran its failing files once (T13145), only the files that failed
+ * again count; a first-run failure the re-run cleared never blocked the job.
+ *
+ * @param log - The job's plain-text log (ANSI colour codes allowed).
+ * @returns The blocking test identities, sorted.
+ * @task T14252
+ */
+export function blockingTestIds(log) {
+    const text = log.replace(/\u001b\[[0-9;]*m/g, '');
+    const rerun = RERUN_MARKER.exec(text);
+    const decided = rerun ? text.slice(rerun.index) : text;
+    const ids = new Set();
+    for (const m of decided.matchAll(/\bFAIL\s{2,}(\S+)\s+(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\b/g)) {
+        ids.add(`${m[1]}:${m[2]}`);
     }
-    return false;
+    return [...ids].sort();
 }
 /**
  * Whether a later commit's CI failed before any test ran (T13809): every
@@ -1147,8 +1209,10 @@ function ciDefinitionPaths(required, pins) {
  *    failed job of a pinned workflow) refuses, and a PENDING run refuses with
  *    "wait for <sha>" — a later green run is never shopped for past one that
  *    is red or may still go red. Only cancelled, skipped and missing
- *    (never-started) runs, and a run red only for the flaky-quarantine budget
- *    (T13809), move on to the next candidate.
+ *    (never-started) runs, a run red only for the flaky-quarantine budget
+ *    (T13809), and a run whose every failing job tested nothing — its runner
+ *    was cancelled or a test worker crashed, no test failed (T14176) — move
+ *    on to the next candidate.
  *
  * @param input - Merge-commit checks, pins, changed paths, PR head and injected I/O.
  * @returns The stand-in SHA, its checks and proven range, or the refusal reason.
@@ -1233,19 +1297,26 @@ export async function findGreenDescendant(input) {
             return { ok: false, reason: onHead.reason };
         headChecks = onHead.checks;
     }
-    for (const name of head ? supersededNames : []) {
-        const pinned = headChecks.filter((c) => c.name === name && pinMatches(c, pins[name]));
-        const verdict = judgeOnSha(pinned, head, 'pull_request');
-        if (!verdict.ok) {
-            return {
-                ok: false,
-                reason: `${name}: ${verdict.verdict === 'missing' ? 'no pull_request run' : verdict.verdict} on PR head ${head.slice(0, 12)} — a later main run never stands in for a PR whose own CI was not green`,
-            };
-        }
+    const redHead = head ? notGreenOnPrHead(supersededNames, headChecks, head, pins) : null;
+    if (redHead !== null) {
+        return {
+            ok: false,
+            reason: `${redHead} — a later main run never stands in for a PR whose own CI was not green`,
+        };
     }
+    // T14434: from here only the walk can refuse; what was proven above lets the
+    // caller try the current-head stand-in.
+    const cleared = {
+        ...(head ? { prHeadSha: head } : {}),
+        headChecks,
+        ...(inherited ? { inherited } : {}),
+        ...(nonTest ? { nonTest } : {}),
+        ...(untested ? { untested } : {}),
+    };
+    const refuse = (reason) => ({ ok: false, reason, cleared });
     const candidates = input.listDescendants(merge, input.ref, cwd);
     if (candidates === null) {
-        return { ok: false, reason: `cannot list commits on ${input.ref} after ${merge.slice(0, 12)}` };
+        return refuse(`cannot list commits on ${input.ref} after ${merge.slice(0, 12)}`);
     }
     const scope = pinnedScope(required, pins);
     const ciPaths = ciDefinitionPaths(required, pins);
@@ -1254,6 +1325,7 @@ export async function findGreenDescendant(input) {
         [`a CI definition (${ciPaths.join(', ')})`, ciPaths],
     ];
     const passedOver = [];
+    let lastUndecided;
     for (const sha of candidates.slice(0, CI_DESCENDANT_MAX_CANDIDATES)) {
         if (sha === merge || !input.isAncestor(merge, sha, cwd))
             continue;
@@ -1261,18 +1333,27 @@ export async function findGreenDescendant(input) {
         for (const [what, paths] of guarded) {
             const touching = input.touchingCommits(merge, sha, paths, cwd);
             if (touching === null)
-                return { ok: false, reason: `cannot read history ${range}` };
+                return refuse(`cannot read history ${range}`);
             const first = touching[0];
-            if (first) {
-                return {
-                    ok: false,
-                    reason: `${what} changed on ${input.ref} by ${first.parents > 1 ? 'merge' : 'commit'} ${first.sha.slice(0, 12)} in ${range}, so a later run no longer tests what the PR merged`,
-                };
+            if (!first)
+                continue;
+            const by = `${first.parents > 1 ? 'merge' : 'commit'} ${first.sha.slice(0, 12)}`;
+            if (paths !== input.changedPaths) {
+                return refuse(`${what} changed on ${input.ref} by ${by} in ${range}, so a later run no longer tests what the PR merged`);
+            }
+            // T14119: later edits elsewhere in the PR's files leave its change
+            // standing; the run still tests it while every hunk it added is there.
+            const missing = input.missingPrHunk(merge, sha, paths, cwd);
+            if (missing !== null) {
+                return refuse(`the PR's change is no longer intact at ${sha.slice(0, 12)}: ${missing} (the PR's files ` +
+                    `changed on ${input.ref} from ${by} in ${range}), so a later run no longer tests what ` +
+                    'the PR merged. Prove testsPassed on a main HEAD with tool:test-affected, or a ' +
+                    `test-run there covering ${TARGETED_RUN_COVERAGE}`);
             }
         }
         const fetched = await input.fetchChecks(sha, cwd);
         if (!fetched.ok)
-            return { ok: false, reason: fetched.reason };
+            return refuse(fetched.reason);
         const failedJob = firstRealFailure(fetched.checks, sha, scope);
         if (failedJob && input.fetchJobLog) {
             // T13809: a later run red only for the quarantine budget, cancelled with
@@ -1295,18 +1376,31 @@ export async function findGreenDescendant(input) {
             if (await failedBeforeAnyTest(fetched.checks, sha, required, pins, input.fetchJobLog, cwd)) {
                 continue;
             }
+            // T14176: a run whose every failing job tested nothing (its runner was
+            // cancelled, or a test worker crashed with no test failed) cannot show
+            // the PR failing either; look on, recording it. A failed test still refuses.
+            const untestedHere = await untestedJobFailures(fetched.checks, sha, required, pins, input.fetchJobLog, cwd);
+            if (untestedHere.all) {
+                passedOver.push({
+                    sha,
+                    jobs: untestedHere.jobs.map((j) => j.name),
+                    reason: `its failing jobs ran no test to completion (${[
+                        ...new Set(untestedHere.jobs.map((j) => UNTESTED_CAUSE_TEXT[j.cause])),
+                    ].join(', ')})`,
+                });
+                continue;
+            }
         }
         if (failedJob) {
-            return {
-                ok: false,
-                reason: `${failedJob.name}: ${failedJob.conclusion} on later ${input.ref} commit ${sha.slice(0, 12)}`,
-            };
+            return refuse(`${failedJob.name}: ${failedJob.conclusion} on later ${input.ref} commit ${sha.slice(0, 12)}`);
         }
         const verdict = judgeStandIn(fetched.checks, sha, supersededNames, pins, input.jobs, input.ref);
-        if (verdict === 'undecided')
+        if ('undecided' in verdict) {
+            lastUndecided ??= `${sha.slice(0, 12)}: ${verdict.undecided}`;
             continue;
+        }
         if (!verdict.ok)
-            return verdict;
+            return refuse(verdict.reason);
         return {
             ok: true,
             sha,
@@ -1317,12 +1411,25 @@ export async function findGreenDescendant(input) {
             ...(nonTest ? { nonTest } : {}),
             ...(untested ? { untested } : {}),
             ...(passedOver.length > 0 ? { passedOver } : {}),
+            cleared,
         };
     }
-    return {
-        ok: false,
-        reason: `no later ${input.ref} commit (first ${CI_DESCENDANT_MAX_CANDIDATES} within 7 days) has a completed push run of ${supersededNames.join(', ')}`,
-    };
+    return refuse(`no later ${input.ref} commit (first ${CI_DESCENDANT_MAX_CANDIDATES} within 7 days) has a completed push run of ${supersededNames.join(', ')}` +
+        (lastUndecided ? ` that ran the gates' jobs (first one passed over: ${lastUndecided})` : ''));
+}
+/**
+ * The first of `names` whose latest `pull_request` run on the PR head is not
+ * green, described; null when every one is (T12742, T14434).
+ */
+function notGreenOnPrHead(names, headChecks, head, pins) {
+    for (const name of names) {
+        const pinned = headChecks.filter((c) => c.name === name && pinMatches(c, pins[name]));
+        const verdict = judgeOnSha(pinned, head, 'pull_request');
+        if (!verdict.ok) {
+            return `${name}: ${verdict.verdict === 'missing' ? 'no pull_request run' : verdict.verdict} on PR head ${head.slice(0, 12)}`;
+        }
+    }
+    return null;
 }
 /**
  * Judge one later default-branch commit's own `push` runs as a stand-in
@@ -1330,7 +1437,8 @@ export async function findGreenDescendant(input) {
  * green (T13846). A pending run refuses with "wait"; a failed one refuses —
  * a green run is never shopped for past one that is red or may still go red.
  * Cancelled, skipped and missing (never-started) runs leave it undecided, so
- * the caller looks at the next candidate.
+ * the caller looks at the next candidate; the undecided verdict says why, and
+ * whether CI's own change filter skipped the gates' jobs (T14177).
  */
 function judgeStandIn(checks, sha, names, pins, jobs, ref) {
     for (const name of names) {
@@ -1345,7 +1453,11 @@ function judgeStandIn(checks, sha, names, pins, jobs, ref) {
             };
         }
         if (verdict.verdict === 'missing' || SUPERSEDED_VERDICTS.has(verdict.verdict)) {
-            return 'undecided';
+            return {
+                undecided: `${name}: ${verdict.verdict === 'missing' ? 'no push run' : verdict.verdict} on ${sha.slice(0, 12)}`,
+                filterSkipped: false,
+                neverRan: verdict.verdict === 'missing',
+            };
         }
         return {
             ok: false,
@@ -1353,7 +1465,7 @@ function judgeStandIn(checks, sha, names, pins, jobs, ref) {
         };
     }
     // T13846: the gates' own jobs must have run on the stand-in too.
-    let decided = true;
+    const notRun = [];
     for (const job of jobs ?? []) {
         const onSha = evaluateJobs(job.globs, checks, sha, job.scope, 'push');
         if (onSha.ok)
@@ -1368,9 +1480,17 @@ function judgeStandIn(checks, sha, names, pins, jobs, ref) {
         const decisive = onSha.reasons.find((r) => !JOB_NOT_RUN.test(r));
         if (decisive)
             return { ok: false, reason: `${decisive} (later ${ref} commit)` };
-        decided = false;
+        notRun.push(...onSha.reasons);
     }
-    return decided ? { ok: true } : 'undecided';
+    if (notRun.length === 0)
+        return { ok: true };
+    return {
+        undecided: `its required checks are green but the gates' jobs did not run (${notRun.join('; ')})`,
+        // A push run's change filter diffs against the previous head, so a job it
+        // skipped is CI's own verdict that this commit changed nothing it tests.
+        filterSkipped: notRun.every((r) => r.endsWith(`: skipped on ${sha.slice(0, 12)}`)),
+        neverRan: false,
+    };
 }
 /**
  * Find the green required-CI push run on the default branch's CURRENT head
@@ -1385,12 +1505,18 @@ function judgeStandIn(checks, sha, names, pins, jobs, ref) {
  *
  * Candidates are HEAD, then its first parents while they differ from HEAD only
  * in documentation ({@link isCiDocumentPath}, the T13784 rule: nothing a test
- * reads moved), up to {@link CI_DESCENDANT_MAX_CANDIDATES}. Each must descend
+ * reads moved), or while every commit stepped past had green required checks
+ * and its gates' jobs skipped by CI's own change filter (T14177: the filter
+ * judged its change untested), up to {@link CI_DESCENDANT_MAX_CANDIDATES}. Each must descend
  * from the merge commit. The first decisive verdict decides, as in
  * {@link findGreenDescendant}: every required check green on its own `push`
  * runs (and the gates' jobs run, T13846) accepts; a failed or pending one
  * refuses; cancelled, skipped or missing runs move to the parent.
  *
+ * The same run stands in for a scoped change (T14434, owner decision D11241)
+ * once the caller has shown the merge commit's failure is not the PR's, the PR
+ * head's own CI was green and the PR's hunks are intact at the stand-in.
+ *
  * @param input - Required checks, pins, merge commit and injected I/O.
  * @returns The stand-in commit, its checks and the head, or the refusal reason.
  * @task T14032
@@ -1400,7 +1526,17 @@ export async function findGreenCurrentHead(input) {
     const head = input.defaultBranchHead(ref, cwd);
     if (!head)
         return { ok: false, reason: `cannot read the current head of ${ref}` };
+    if (head === merge) {
+        return {
+            ok: false,
+            reason: `${ref} HEAD ${head.slice(0, 12)} is the merge commit itself, so no later push run exists yet`,
+        };
+    }
     let sha = head;
+    // T14177: the first commit stepped past whose run decided nothing for a
+    // reason other than CI's change filter skipping the gates' jobs.
+    let blocking;
+    let headWhy;
     for (let n = 0; n < CI_DESCENDANT_MAX_CANDIDATES && sha; n++) {
         const at = sha === head ? `${ref} HEAD ${head.slice(0, 12)}` : `${sha.slice(0, 12)}`;
         if (sha === merge || !input.isAncestor(merge, sha, cwd)) {
@@ -1417,10 +1553,16 @@ export async function findGreenCurrentHead(input) {
                 return { ok: false, reason: `cannot diff ${sha.slice(0, 12)}..${head.slice(0, 12)}` };
             }
             const testInput = moved.find((p) => !isCiDocumentPath(p));
-            if (testInput) {
+            // Every commit stepped past had its gates' jobs skipped by CI's own
+            // change filter, so nothing it changed is a test input (T14177).
+            if (testInput && blocking) {
+                const range = `${sha.slice(0, 12)}..${head.slice(0, 12)} changes ${testInput}, so an earlier run does not test HEAD${headSkipped(head, headWhy)}`;
                 return {
                     ok: false,
-                    reason: `${ref} HEAD ${head.slice(0, 12)} has no completed push run of the required checks, and ${sha.slice(0, 12)}..${head.slice(0, 12)} changes ${testInput}, so an earlier run does not test HEAD — wait for HEAD's push CI to finish, then verify again`,
+                    reason: blocking.sha === head && headWhy?.neverRan
+                        ? `${ref} HEAD ${head.slice(0, 12)} has no completed push run of the required checks (${headWhy.undecided}), and ${range} — wait for HEAD's push CI to finish, then verify again`
+                        : `${ref} commit ${blocking.sha.slice(0, 12)} decided nothing: ${blocking.why.undecided}; ${range}. ` +
+                            `Prove testsPassed on ${ref} HEAD with tool:test-affected, or a test-run there covering ${TARGETED_RUN_COVERAGE}`,
                 };
             }
         }
@@ -1428,18 +1570,31 @@ export async function findGreenCurrentHead(input) {
         if (!fetched.ok)
             return { ok: false, reason: fetched.reason };
         const verdict = judgeStandIn(fetched.checks, sha, input.required, input.pins, input.jobs, ref);
-        if (verdict !== 'undecided') {
+        if (!('undecided' in verdict)) {
             if (!verdict.ok)
                 return verdict;
             return { ok: true, sha, checks: fetched.checks, range: `${merge}..${sha}`, head };
         }
+        if (sha === head)
+            headWhy = verdict;
+        if (!verdict.filterSkipped)
+            blocking ??= { sha, why: verdict };
         sha = input.firstParentOf(sha, cwd);
     }
     return {
         ok: false,
-        reason: `no commit within ${CI_DESCENDANT_MAX_CANDIDATES} first parents of ${ref} HEAD ${head.slice(0, 12)} has a completed push run of ${input.required.join(', ')}`,
+        reason: `no commit within ${CI_DESCENDANT_MAX_CANDIDATES} first parents of ${ref} HEAD ${head.slice(0, 12)} has a completed push run of ${input.required.join(', ')} that ran the gates' jobs${headSkipped(head, headWhy)}`,
     };
 }
+/**
+ * The note a current-HEAD refusal adds when HEAD's own run is complete but
+ * its gates' jobs were skipped (T14177): waiting for HEAD cannot help.
+ */
+function headSkipped(head, why) {
+    return why?.filterSkipped
+        ? ` (HEAD ${head.slice(0, 12)}'s push run is complete and ${why.undecided}, so waiting for it will not help)`
+        : '';
+}
 /**
  * Default {@link ResolveCiEvidenceOptions.listDescendants} (T12742): the
  * first-parent commits of `ref` that descend from `mergeSha`, oldest first,
@@ -1508,6 +1663,96 @@ export function listPathTouchingMainCommits(from, to, paths, cwd) {
         return { sha: sha, parents: parents.length };
     });
 }
+/**
+ * Default {@link ResolveCiEvidenceOptions.missingPrHunk} (T14119): the first
+ * hunk the PR added (`git diff -U0 <merge>^1 <merge>`) whose added lines no
+ * longer appear, contiguous and in order, in that file at `at`. A binary file
+ * counts as missing once its blob differs. Lines the PR removed are not
+ * checked: a later commit cannot un-test a deletion. A git error is reported
+ * as missing, never as present.
+ *
+ * @param merge - The PR's merge commit (its first parent is the base).
+ * @param at - The later commit whose run would stand in.
+ * @param paths - The PR's changed paths.
+ * @param cwd - Repository work tree.
+ * @returns The missing hunk, described, or null when every hunk is present.
+ * @task T14119
+ */
+export function missingPrHunk(merge, at, paths, cwd) {
+    const read = (args) => {
+        try {
+            return execFileSync('git', args, {
+                cwd,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                maxBuffer: 64 * 1024 * 1024,
+            });
+        }
+        catch {
+            return null;
+        }
+    };
+    const diff = read([
+        'diff',
+        '-U0',
+        '--no-renames',
+        '--no-color',
+        '--no-ext-diff',
+        `${merge}^1`,
+        merge,
+        '--',
+        ...paths,
+    ]);
+    if (diff === null)
+        return `the PR's diff (${merge.slice(0, 12)}) cannot be read`;
+    const files = new Map();
+    const linesAt = (path) => {
+        if (!files.has(path))
+            files.set(path, read(['show', `${at}:${path}`])?.split('\n') ?? null);
+        return files.get(path) ?? null;
+    };
+    const hunks = [];
+    let path = null;
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('diff --git '))
+            path = null;
+        else if (line.startsWith('+++ '))
+            path = line === '+++ /dev/null' ? null : line.slice(6);
+        else if (line.startsWith('Binary files ') && line.endsWith(' differ')) {
+            const bin = /^Binary files (?:a\/(.+)|\/dev\/null) and (?:b\/(.+)|\/dev\/null) differ$/.exec(line);
+            const target = bin?.[2];
+            if (target &&
+                read(['rev-parse', `${merge}:${target}`]) !== read(['rev-parse', `${at}:${target}`]))
+                return `binary file ${target} differs from the PR's version`;
+        }
+        else if (line.startsWith('@@') && path !== null)
+            hunks.push({ path, header: line.replace(/^(@@ [^@]* @@).*$/, '$1'), added: [] });
+        else if (line.startsWith('+') && path !== null)
+            hunks.at(-1)?.added.push(line.slice(1));
+    }
+    for (const { path: file, header, added } of hunks) {
+        if (added.length === 0)
+            continue;
+        const lines = linesAt(file);
+        const at0 = lines === null ? -1 : indexOfRun(lines, added);
+        if (at0 < 0) {
+            const first = added.find((l) => l.trim() !== '') ?? added[0] ?? '';
+            const quoted = first.trim().length > 60 ? `${first.trim().slice(0, 57)}...` : first.trim();
+            return `hunk ${file} ${header} ("${quoted}") ${lines === null ? 'is gone with its file' : 'was rewritten or removed'}`;
+        }
+    }
+    return null;
+}
+/** Index of the first contiguous occurrence of `run` in `lines`, or -1. */
+function indexOfRun(lines, run) {
+    outer: for (let i = 0; i + run.length <= lines.length; i++) {
+        for (let j = 0; j < run.length; j++)
+            if (lines[i + j] !== run[j])
+                continue outer;
+        return i;
+    }
+    return -1;
+}
 /** Default {@link ResolveCiEvidenceOptions.treeOf}: `git rev-parse <sha>^{tree}`. */
 function defaultTreeOf(sha, cwd) {
     return gitRead(cwd, ['rev-parse', '--verify', '--quiet', `${sha}^{tree}`]);
@@ -1599,7 +1844,8 @@ async function defaultWorkspaceWideReason(root, paths) {
     const need = testRunRequirement(root, paths);
     return need.kind === 'full' ? need.reason : null;
 }
-function defaultFirstParentOf(sha, cwd) {
+/** The first parent of `sha` in `cwd`'s git, or `null` when unknown. */
+export function defaultFirstParentOf(sha, cwd) {
     return gitRead(cwd, ['rev-parse', '--verify', '--quiet', `${sha}^1`]);
 }
 function gitRead(cwd, args) {
@@ -1630,7 +1876,7 @@ function ghApi(path, cwd) {
     }
 }
 /** Default {@link ResolveCiEvidenceOptions.fetchJobLog}: the job's plain-text log via `gh` (T13809). */
-async function defaultFetchJobLog(jobId, cwd) {
+export async function defaultFetchJobLog(jobId, cwd) {
     if (!isGitWorkTree(cwd) || !isGhCliAvailable())
         return null;
     try {
@@ -1695,7 +1941,7 @@ export function withoutScheduledRuns(fetchChecks) {
  * runs for a SHA. Workflow runs carry their event and workflow file; a check
  * run inherits both from the workflow run of its check suite.
  */
-async function defaultFetchChecks(sha, cwd) {
+export async function defaultFetchChecks(sha, cwd) {
     if (!isGitWorkTree(cwd) || !isGhCliAvailable()) {
         return { ok: false, reason: `gh cannot query checks from ${cwd} (no work tree or gh CLI).` };
     }
@@ -1762,14 +2008,69 @@ async function defaultFetchChecks(sha, cwd) {
     }
     return { ok: true, checks };
 }
+/**
+ * Every attempt's jobs of the GitHub Actions `event` runs on `sha` (T14253):
+ * `commits/<sha>/check-runs` keeps only each job's latest attempt, so a
+ * rerun would replace the evidence; `actions/runs/<id>/attempts/<n>/jobs`
+ * keeps each attempt, with its run id, attempt number and times.
+ *
+ * @param sha - The commit.
+ * @param cwd - Repository work tree for `gh`.
+ * @param event - The triggering event (`push` for main).
+ * @returns The jobs of every attempt, or why they could not be read.
+ * @task T14253
+ */
+export async function defaultFetchRunAttemptJobs(sha, cwd, event = 'push') {
+    if (!isGitWorkTree(cwd) || !isGhCliAvailable()) {
+        return { ok: false, reason: `gh cannot query runs from ${cwd} (no work tree or gh CLI).` };
+    }
+    const wf = ghApi(`repos/{owner}/{repo}/actions/runs?head_sha=${sha}&event=${event}&per_page=100`, cwd);
+    if (wf === null)
+        return { ok: false, reason: `gh api workflow runs for ${sha} failed` };
+    const checks = [];
+    for (const run of wf.workflow_runs ?? []) {
+        const runId = Number(run.id ?? 0);
+        const attempts = typeof run.run_attempt === 'number' ? run.run_attempt : 1;
+        const path = typeof run.path === 'string' ? run.path.replace(/@.*$/, '') : undefined;
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+            for (let page = 1; page <= 5; page++) {
+                const body = ghApi(`repos/{owner}/{repo}/actions/runs/${runId}/attempts/${attempt}/jobs?per_page=100&page=${page}`, cwd);
+                if (body === null)
+                    return { ok: false, reason: `gh api jobs of run ${runId} attempt ${attempt} failed` };
+                const jobs = body.jobs ?? [];
+                for (const j of jobs) {
+                    checks.push({
+                        name: String(j.name ?? ''),
+                        source: 'check-run',
+                        status: String(j.status ?? ''),
+                        conclusion: typeof j.conclusion === 'string' ? j.conclusion : null,
+                        headSha: String(j.head_sha ?? sha),
+                        id: Number(j.id ?? 0),
+                        appSlug: 'github-actions',
+                        event,
+                        runId,
+                        runAttempt: typeof j.run_attempt === 'number' ? j.run_attempt : attempt,
+                        ...(path ? { workflowPath: path } : {}),
+                        ...(typeof j.started_at === 'string' ? { startedAt: j.started_at } : {}),
+                        ...(typeof j.completed_at === 'string' ? { completedAt: j.completed_at } : {}),
+                    });
+                }
+                if (jobs.length < 100)
+                    break;
+            }
+        }
+    }
+    return { ok: true, checks };
+}
 /**
  * Re-check, at `cleo complete`, a `ci:` atom that leaned on a later main
  * commit (T12742). A completed conclusion is NOT immutable: a GitHub re-run
  * adds a newer attempt that can go red. Every check judged on the
  * descendant is re-fetched and its latest `push` attempt (same app and
  * workflow) must still be `success`; each such check's latest
- * `pull_request` attempt on the recorded PR head must be too. Atoms without
- * `descendantSha` pass untouched.
+ * `pull_request` attempt on the recorded PR head must be too; for a
+ * `currentHead` atom (T14434) every required check on that head must be.
+ * Atoms without `descendantSha` pass untouched.
  *
  * @param atom - The recorded `ci:` atom.
  * @param cwd - Repository work tree for `gh`.
@@ -1808,7 +2109,9 @@ export async function recheckCiDescendantAtom(atom, cwd, fetchChecks = defaultFe
                 reason: `cannot re-check ci:${atom.prNumber} on ${sha.slice(0, 12)}: ${fetched.reason}`,
             };
         }
-        for (const c of stoodIn) {
+        // T14434: a current-head atom rests on every required check of the PR
+        // head, not only on those the head run stood in for.
+        for (const c of event === 'pull_request' && atom.currentHead ? atom.checks : stoodIn) {
             const verdict = judgeOnSha(fetched.checks.filter((run) => sameSource(run, c)), sha, event);
             if (!verdict.ok) {
                 return {
@@ -1904,7 +2207,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
         return { ok: false, reason: pr.reason, codeName: pr.codeName };
     // T12634: the same task linkage `pr:` enforces — never any merged PR for any
     // task. T12671: through the component PR when the atom names one.
-    const linked = await linkedPrChange(prNumber, pr, roots, opts.componentPrNumber, opts.viewComponentPr);
+    const linked = await linkedPrChange(prNumber, pr, roots, opts.componentPrNumber, opts.viewComponentPr, context.task.id);
     if (!linked.ok) {
         return {
             ok: false,
@@ -1914,7 +2217,11 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 : 'E_EVIDENCE_INSUFFICIENT',
         };
     }
-    const unlinked = checkPrTaskLinkage(linked.prNumber, linked.pr, context);
+    // T14259: on the merge sweep's path, the Closes:/Refs: line and the
+    // non-author verdicts are the linkage.
+    const reviewed = context.reviewedLinkage === true &&
+        (await reviewedDirectiveLinkage(prNumber, pr.body, pr.headRefOid, roots.storeRoot, context.task.id));
+    const unlinked = checkPrTaskLinkage(linked.prNumber, linked.pr, context, pr.mergedAt, reviewed);
     if (unlinked) {
         return {
             ok: false,
@@ -2038,6 +2345,8 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     // or a CI definition. That run proves the DESCENDANT's tree, not the merge's.
     let descendant;
     let descendantReason;
+    // T14434: set when only the walk refused, so the current-head run may stand in.
+    let cleared;
     // T13846: a code task's gates need their jobs to have run, so the stand-in
     // must be a later main run where they did — not merely the first one whose
     // required checks are green (a scripts-only merge skips the test jobs).
@@ -2059,6 +2368,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             fetchChecks,
             listDescendants: opts.listDescendants ?? listMainDescendants,
             touchingCommits: opts.touchingCommits ?? listPathTouchingMainCommits,
+            missingPrHunk: opts.missingPrHunk ?? missingPrHunk,
             isAncestor: opts.isAncestor ?? defaultIsAncestor,
             firstParentOf: opts.firstParentOf ?? defaultFirstParentOf,
             fetchJobLog: opts.fetchJobLog ?? defaultFetchJobLog,
@@ -2089,10 +2399,12 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             }
             else {
                 descendantReason = `later commit ${found.sha.slice(0, 12)} was green, but re-judging with it still fails: ${rejudged.reasons.join('; ')}`;
+                cleared = found.cleared;
             }
         }
         else {
             descendantReason = found.reason;
+            cleared = found.cleared;
         }
     }
     // T14032 (owner decision D11192): a workspace-wide change, which only a full
@@ -2100,12 +2412,33 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     // check on the default branch's current head, descending from the merge,
     // whatever the merge's own run concluded and whatever later commits touched:
     // that run tested the merged change as it is now (as the T13673 test-run
-    // stand-in does). A scoped change keeps the T12742 rule alone.
+    // stand-in does).
+    // T14434 (owner decision D11241, extending D11192): the same run stands in
+    // for a scoped change too, when the walk above showed the merge commit's
+    // failure is not the PR's and the PR head's own CI was green (`cleared`),
+    // and every hunk the PR added is still there at the stand-in.
     let workspaceWide;
+    let currentHead = false;
     let currentHeadReason;
-    if (!judgedChecks.ok && onDefault.ref !== null && !docsOnlyDiff) {
-        const wide = await (opts.workspaceWideReason ?? defaultWorkspaceWideReason)(cwd, pr.changedPaths);
-        if (wide !== null) {
+    // Whether a later green head can still close this: the route applies and only its run is missing.
+    let standInOpen = false;
+    if (!judgedChecks.ok && onDefault.ref !== null) {
+        const wide = docsOnlyDiff
+            ? null
+            : await (opts.workspaceWideReason ?? defaultWorkspaceWideReason)(cwd, pr.changedPaths);
+        // D11241 asks that the PR head's own required CI was green: every required
+        // check there, not only those the walk stood in for. A main-only PR has no
+        // PR-head run to consult (T13174), so it never takes the scoped route.
+        const scopedHead = wide === null ? cleared?.prHeadSha : undefined;
+        const scoped = cleared && scopedHead ? { ...cleared, prHeadSha: scopedHead } : undefined;
+        const redHead = scoped
+            ? notGreenOnPrHead(required.workflows, scoped.headChecks, scoped.prHeadSha, pins)
+            : null;
+        const scopedLead = `the merge commit's run is not the PR's failure, so a green push run of the required checks on the current ${onDefault.ref} HEAD would stand in (D11241), but `;
+        if (redHead !== null) {
+            currentHeadReason = `${scopedLead}${redHead}: the PR head's own required CI was not green`;
+        }
+        else if (wide !== null || scoped) {
             const found = await findGreenCurrentHead({
                 ...(jobSpecs.length > 0 ? { jobs: jobSpecs } : {}),
                 required: required.workflows,
@@ -2119,8 +2452,22 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 firstParentOf: opts.firstParentOf ?? defaultFirstParentOf,
                 isAncestor: opts.isAncestor ?? defaultIsAncestor,
             });
-            const rejudged = found.ok
-                ? evaluateMergeCommitChecks(required.workflows, [...checks, ...found.checks], pr.mergeCommitSha, {
+            // The run that is accepted can sit on a parent of the tip (the tip
+            // differs from it only in documentation, or CI's filter skipped it): the
+            // PR's hunks must be intact at both.
+            let missing = null;
+            for (const at of found.ok && scoped ? new Set([found.sha, found.head]) : []) {
+                const hunk = (opts.missingPrHunk ?? missingPrHunk)(pr.mergeCommitSha, at, pr.changedPaths, cwd);
+                if (hunk !== null) {
+                    missing = { at, hunk };
+                    break;
+                }
+            }
+            const withHead = found.ok
+                ? [...checks, ...found.checks, ...(scoped?.headChecks ?? [])]
+                : checks;
+            const rejudged = found.ok && missing === null
+                ? evaluateMergeCommitChecks(required.workflows, withHead, pr.mergeCommitSha, {
                     ...(treeEqualHead ? { treeEquivalentSha: treeEqualHead } : {}),
                     pins,
                     descendantSha: found.sha,
@@ -2128,21 +2475,51 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 })
                 : null;
             if (found.ok && rejudged?.ok) {
-                checks = [...checks, ...found.checks];
+                checks = withHead;
                 judgedChecks = rejudged;
-                descendant = { sha: found.sha, range: found.range };
-                workspaceWide = wide;
+                descendant = {
+                    sha: found.sha,
+                    range: found.range,
+                    ...(scoped?.prHeadSha ? { prHeadSha: scoped.prHeadSha } : {}),
+                    ...(scoped?.inherited ? { inherited: scoped.inherited } : {}),
+                    ...(scoped?.nonTest ? { nonTest: scoped.nonTest } : {}),
+                    ...(scoped?.untested ? { untested: scoped.untested } : {}),
+                };
+                if (wide !== null)
+                    workspaceWide = wide;
+                else
+                    currentHead = true;
             }
             else {
-                const why = found.ok
-                    ? `${found.sha.slice(0, 12)} was green, but re-judging with it still fails: ${rejudged && !rejudged.ok ? rejudged.reasons.join('; ') : ''}`
-                    : found.reason;
-                currentHeadReason = `the change is workspace-wide (${wide}), so a green push run of the required checks on the current ${onDefault.ref} HEAD would stand in (T14032), but ${why}`;
+                standInOpen = !found.ok;
+                const why = !found.ok
+                    ? found.reason
+                    : missing !== null
+                        ? `the PR's change is no longer intact at ${missing.at.slice(0, 12)}: ${missing.hunk}`
+                        : `${found.sha.slice(0, 12)} was green, but re-judging with it still fails: ${rejudged && !rejudged.ok ? rejudged.reasons.join('; ') : ''}`;
+                currentHeadReason =
+                    (wide !== null
+                        ? `the change is workspace-wide (${wide}), so a green push run of the required checks on the current ${onDefault.ref} HEAD would stand in (T14032), but `
+                        : scopedLead) + why;
             }
         }
     }
     if (!judgedChecks.ok) {
-        const waiting = judgedChecks.reasons.some((r) => /pending|not found|missing/.test(r));
+        // T14434: a check "not found" beside one that finished red never ran, so
+        // only an unfinished run, or no run at all, is worth waiting for.
+        const waiting = judgedChecks.reasons.some((r) => r.includes('pending')) ||
+            judgedChecks.reasons.every((r) => /pending|not found|missing/.test(r));
+        // T14434: name what still closes the task, never the atom just refused.
+        const targeted = gateLists
+            .map((g) => g.gate === 'testsPassed'
+            ? `a test-run covering ${TARGETED_RUN_COVERAGE}, for testsPassed`
+            : "a qa-run of typecheck and lint over the change's roots (or tool:lint;tool:typecheck) for qaPassed")
+            .join(' and ');
+        const next = waiting
+            ? ''
+            : standInOpen
+                ? ` Next: ${CURRENT_HEAD_STAND_IN_OPEN}; verify again once ${onDefault.ref} HEAD's CI is green.`
+                : ` Next: no later run stands in for it; on ${onDefault.ref} after the merge, record ${targeted}.`;
         const merge12 = pr.mergeCommitSha.slice(0, 12);
         // T14042: the decisive reason and the next step lead; the detail follows,
         // so a truncated refusal still says what to do.
@@ -2156,7 +2533,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
         return {
             ok: false,
             codeName: 'E_EVIDENCE_TESTS_FAILED',
-            reason: `${lead}\n  Required checks (source: ${describeRequiredWorkflowsSource(required.source)}):\n  - ${judgedChecks.reasons.join('\n  - ')}` +
+            reason: `${lead}${next}\n  Required checks (source: ${describeRequiredWorkflowsSource(required.source)}):\n  - ${judgedChecks.reasons.join('\n  - ')}` +
                 (descendantReason ? `\n  No later main run stands in: ${descendantReason}` : '') +
                 (currentHeadReason ? `\n  No current-HEAD run stands in: ${currentHeadReason}` : ''),
         };
@@ -2171,6 +2548,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     // (`cleo update --labels docs`) and must never excuse skipped jobs.
     const isCode = !docsOnlyDiff;
     const jobsByGate = {};
+    const filterSkipped = {};
     const fetchJobLog = opts.fetchJobLog ?? defaultFetchJobLog;
     let mergeNonTest;
     if (isCode) {
@@ -2230,16 +2608,17 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                         judgedJobs = onPrHead;
                 }
             }
-            // T13175: required jobs skipped by their change filter, with every
-            // changed path covered by a declared job that ran and succeeded.
-            const rules = readCiChecks(roots.storeRoot).covering?.[g.key];
-            let coverNote = '';
-            if (!judgedJobs.ok && rules && rules.length > 0) {
-                const covered = evaluateCoveringJobs(globs, rules, pr.changedPaths, checks, descendant?.sha ?? pr.mergeCommitSha, scope);
-                if (covered.ok)
-                    judgedJobs = covered;
+            // T14260: required jobs CI's own change filter skipped, on a diff
+            // outside the package code roots, with the required checks green.
+            let skipNote = '';
+            if (!judgedJobs.ok) {
+                const skip = evaluateFilterSkippedJobs(globs, pr.changedPaths, checks, descendant?.sha ?? pr.mergeCommitSha, scope);
+                if (skip.ok) {
+                    judgedJobs = { ok: true, jobs: skip.jobs };
+                    filterSkipped[g.gate] = skip.skipped;
+                }
                 else
-                    coverNote = `\n  Covering jobs do not apply: ${covered.reason}`;
+                    skipNote = `\n  A filter skip does not stand in: ${skip.reason}`;
             }
             if (!judgedJobs.ok) {
                 return {
@@ -2247,7 +2626,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                     codeName: 'E_EVIDENCE_TESTS_FAILED',
                     reason: `${g.gate} for code task ${context.task.id} needs its jobs to have run on PR #${prNumber}:\n  - ` +
                         judgedJobs.reasons.join('\n  - ') +
-                        coverNote,
+                        skipNote,
                 };
             }
             jobsByGate[g.gate] = judgedJobs.jobs;
@@ -2276,7 +2655,9 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 }
                 : {}),
             ...(workspaceWide ? { workspaceWide } : {}),
+            ...(currentHead ? { currentHead: true } : {}),
             ...(mainOnly ? { mainOnly: true } : {}),
+            ...(Object.keys(filterSkipped).length > 0 ? { filterSkippedJobs: filterSkipped } : {}),
             requiredSource: required.source.tier,
             taskId: context.task.id,
             gateChecks,