@codyswann/lisa 3.33.8 → 3.35.0

package/plugins/src/base/scripts/intake-blocker-reprobe.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/**
+ * Blocker re-probe gate for pre-work build-intake candidates.
+ *
+ * A blocker is a claim with a timestamp, not a fact. It is written once, and it
+ * decays the moment its condition goes true — a dependency lands on trunk, a
+ * CVE gets patched, a package publishes. Nothing in the old intake loop ever
+ * re-read one, so a discharged blocker held its item out of the queue forever.
+ *
+ * This module decides, per candidate, whether intake may select it. It never
+ * probes anything itself: the caller runs the probe and hands back the result,
+ * which keeps the decision auditable and testable apart from the network.
+ */
+
+import { isPreWorkLaneType } from "./intake-prework-denominator.mjs";
+
+/** Marker a writer stamps on an item a human deliberately parked. */
+export const HUMAN_GATE_MARKER = "[lisa-human-gate]";
+
+/** Default label naming a block only a human can clear. */
+export const DEFAULT_HUMAN_NEEDED_LABEL = "human-needed";
+
+/**
+ * @param {unknown} labels
+ * @returns {readonly string[]}
+ */
+function normalizeLabels(labels) {
+  return (Array.isArray(labels) ? labels : [])
+    .map(label =>
+      typeof label === "string"
+        ? label
+        : typeof label?.name === "string"
+          ? label.name
+          : ""
+    )
+    .map(label => label.trim().toLowerCase())
+    .filter(label => label.length > 0);
+}
+
+/**
+ * @param {{ labels?: unknown, body?: unknown, humanNeededLabel?: unknown }} input
+ * @returns {boolean}
+ */
+function isHumanGated(input) {
+  const configured = String(
+    input.humanNeededLabel ?? DEFAULT_HUMAN_NEEDED_LABEL
+  )
+    .trim()
+    .toLowerCase();
+  if (
+    configured.length > 0 &&
+    normalizeLabels(input.labels).includes(configured)
+  ) {
+    return true;
+  }
+
+  return String(input.body ?? "").includes(HUMAN_GATE_MARKER);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimmedString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+/**
+ * @param {{ discharged?: unknown, evidence?: unknown }} probe
+ * @returns {{ selectable: boolean, reason: string, evidence: string }}
+ */
+function judgeProbe(probe) {
+  const evidence = trimmedString(probe.evidence);
+
+  if (probe.discharged !== true) {
+    return {
+      selectable: false,
+      reason: "blocker-holds",
+      evidence,
+    };
+  }
+  if (evidence.length === 0) {
+    return {
+      selectable: false,
+      reason: "blocker-discharge-unevidenced",
+      evidence,
+    };
+  }
+
+  return { selectable: true, reason: "blocker-discharged", evidence };
+}
+
+/**
+ * Decide whether a pre-work item may be selected as a build candidate.
+ *
+ * Order is load-bearing. The human gate is checked before anything else, so no
+ * probe result — however conclusive — can promote an item a human parked.
+ *
+ * @param {{
+ *   laneType?: unknown
+ *   labels?: unknown
+ *   body?: unknown
+ *   humanNeededLabel?: unknown
+ *   statedBlocker?: unknown
+ *   probe?: { discharged?: unknown, evidence?: unknown } | null
+ * }} input
+ * @returns {{ selectable: boolean, reason: string, humanGated: boolean, evidence: string }}
+ */
+export function classifyPreWorkCandidate(input = {}) {
+  if (isHumanGated(input)) {
+    return {
+      selectable: false,
+      reason: "human-gate",
+      humanGated: true,
+      evidence: "",
+    };
+  }
+  if (!isPreWorkLaneType(input.laneType)) {
+    return {
+      selectable: false,
+      reason: "not-pre-work",
+      humanGated: false,
+      evidence: "",
+    };
+  }
+  if (trimmedString(input.statedBlocker).length === 0) {
+    return {
+      selectable: true,
+      reason: "no-blocker",
+      humanGated: false,
+      evidence: "",
+    };
+  }
+  if (!input.probe || typeof input.probe !== "object") {
+    return {
+      selectable: false,
+      reason: "blocker-unprobed",
+      humanGated: false,
+      evidence: "",
+    };
+  }
+
+  return { ...judgeProbe(input.probe), humanGated: false };
+}
+
+/** Plain-English wording for each verdict, for the note left on the item. */
+const REASON_COPY = Object.freeze({
+  "human-gate": "A person parked this one on purpose, so intake left it alone.",
+  "not-pre-work": "This item is not sitting in a not-yet-started lane.",
+  "no-blocker": "No blocker was written on this item, so it is buildable.",
+  "blocker-unprobed":
+    "This item states a blocker that was not re-checked this cycle, so it stays put.",
+  "blocker-holds":
+    "The blocker was re-checked and still holds, so it stays put.",
+  "blocker-discharge-unevidenced":
+    "The blocker looked clear but no proof was recorded, so it stays put.",
+  "blocker-discharged":
+    "The blocker was re-checked and no longer applies, so this item is buildable again.",
+});
+
+/**
+ * Render the re-probe result to leave on the item, so the next cycle reads the
+ * answer instead of deriving it again.
+ *
+ * @param {{
+ *   statedBlocker?: unknown
+ *   checkedAt?: string | Date
+ * }} candidate
+ * @param {{ reason: string, evidence?: string }} verdict
+ * @returns {string}
+ */
+export function formatReprobeNote(candidate = {}, verdict) {
+  const checkedAt =
+    candidate.checkedAt instanceof Date
+      ? candidate.checkedAt.toISOString()
+      : trimmedString(candidate.checkedAt) || new Date().toISOString();
+  const lines = [
+    "**Blocker re-check**",
+    "",
+    `- What has to be true: ${trimmedString(candidate.statedBlocker) || "(none written on this item)"}`,
+    `- What we found: ${REASON_COPY[verdict.reason] ?? verdict.reason}`,
+  ];
+  const evidence = trimmedString(verdict.evidence);
+  if (evidence.length > 0) {
+    lines.push(`- Proof: ${evidence}`);
+  }
+  lines.push(`- Checked at: ${checkedAt}`);
+
+  return lines.join("\n");
+}

package/plugins/src/base/scripts/intake-prework-denominator.mjs

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+/**
+ * Pre-work denominator for build-queue intake scanners.
+ *
+ * A build-intake cycle that reports an empty lane is only as trustworthy as the
+ * set of lanes it swept. Sweeping by lane NAME (`Backlog`, `Todo`, `Ready`)
+ * omits every pre-work lane a team invented — most commonly a `Blocked` lane,
+ * which is not a distinct Linear state type at all: teams model it as
+ * `unstarted`, i.e. work that was never started. Items parked there carry a
+ * written blocker that nothing ever re-reads, so the lane reads as terminal
+ * while it is in fact a queue.
+ *
+ * This module fixes both halves: lanes are selected by TYPE, never by name, and
+ * the swept set is reported alongside the total so a wrong denominator is
+ * visible on inspection instead of silent forever.
+ */
+
+/** Lane types that hold work which has not started. Both belong to intake. */
+export const PRE_WORK_LANE_TYPES = Object.freeze(["backlog", "unstarted"]);
+
+/** Loop ids whose `nothing-needed` runs must state their denominator. */
+export const DENOMINATOR_REQUIRED_LOOP_IDS = Object.freeze(["intake-tickets"]);
+
+/**
+ * Vendor lane-type vocabularies normalized onto Linear's five-value type set.
+ * JIRA exposes the same idea as `statusCategory` (key or display name); GitHub
+ * has no type field at all, so its callers pass a type explicitly.
+ */
+const LANE_TYPE_ALIASES = Object.freeze({
+  backlog: "backlog",
+  unstarted: "unstarted",
+  started: "started",
+  completed: "completed",
+  canceled: "canceled",
+  cancelled: "canceled",
+  new: "unstarted",
+  indeterminate: "started",
+  done: "completed",
+  "to do": "unstarted",
+  "in progress": "started",
+});
+
+/**
+ * Map a vendor lane type onto the normalized vocabulary.
+ *
+ * @param {unknown} type
+ * @returns {string | null} normalized type, or null when unrecognized
+ */
+export function normalizeLaneType(type) {
+  if (typeof type !== "string") {
+    return null;
+  }
+  return LANE_TYPE_ALIASES[type.trim().toLowerCase()] ?? null;
+}
+
+/**
+ * @param {unknown} type
+ * @returns {boolean} whether this lane holds not-yet-started work
+ */
+export function isPreWorkLaneType(type) {
+  const normalized = normalizeLaneType(type);
+  return normalized !== null && PRE_WORK_LANE_TYPES.includes(normalized);
+}
+
+/**
+ * @param {unknown} lane
+ * @returns {{ name: string, type: string | null, count: number, position: number } | null}
+ */
+function normalizeLane(lane) {
+  if (!lane || typeof lane !== "object") {
+    return null;
+  }
+  const name = String(lane.name ?? "").trim();
+  if (name.length === 0) {
+    return null;
+  }
+  const rawCount = Number(lane.count ?? 0);
+  const rawPosition = Number(lane.position ?? Number.POSITIVE_INFINITY);
+
+  return {
+    name,
+    type: normalizeLaneType(lane.type ?? lane.statusCategory),
+    count: Number.isFinite(rawCount) && rawCount > 0 ? Math.trunc(rawCount) : 0,
+    position: Number.isFinite(rawPosition)
+      ? rawPosition
+      : Number.POSITIVE_INFINITY,
+  };
+}
+
+/**
+ * @param {{ position: number, name: string }} left
+ * @param {{ position: number, name: string }} right
+ * @returns {number}
+ */
+function compareLanes(left, right) {
+  if (left.position !== right.position) {
+    return left.position - right.position;
+  }
+  return left.name.localeCompare(right.name);
+}
+
+/**
+ * Select every lane holding not-yet-started work, by type.
+ *
+ * Deliberately name-blind: a team that adds `Blocked`, `Triaged`, or `Icebox`
+ * as an `unstarted` state gets it swept without a code change, and no hardcoded
+ * roster can fall behind the board.
+ *
+ * @param {readonly unknown[]} lanes
+ * @returns {readonly {name: string, type: string, count: number, position: number}[]}
+ */
+export function selectPreWorkLanes(lanes) {
+  return (Array.isArray(lanes) ? lanes : [])
+    .map(normalizeLane)
+    .filter(lane => lane !== null && isPreWorkLaneType(lane.type))
+    .sort(compareLanes);
+}
+
+/**
+ * Build the denominator a scanner must report with its verdict.
+ *
+ * `totalOpen` is the count of open items on the queue, independent of lanes —
+ * supplying it is what makes an omitted lane arithmetically visible.
+ *
+ * @param {{ lanes?: readonly unknown[], totalOpen?: number }} input
+ * @returns {{
+ *   swept: readonly {name: string, type: string, count: number}[]
+ *   omitted: readonly {name: string, type: string | null, count: number}[]
+ *   sweptCount: number
+ *   totalOpen: number
+ *   unsweptCount: number
+ * }}
+ */
+export function buildIntakeDenominator(input = {}) {
+  const normalized = (Array.isArray(input.lanes) ? input.lanes : [])
+    .map(normalizeLane)
+    .filter(lane => lane !== null)
+    .sort(compareLanes);
+  const swept = normalized.filter(lane => isPreWorkLaneType(lane.type));
+  const omitted = normalized.filter(lane => !isPreWorkLaneType(lane.type));
+  const sweptCount = swept.reduce((total, lane) => total + lane.count, 0);
+  const laneTotal = normalized.reduce((total, lane) => total + lane.count, 0);
+  const rawTotalOpen = Number(input.totalOpen);
+  const totalOpen =
+    Number.isFinite(rawTotalOpen) && rawTotalOpen >= 0
+      ? Math.trunc(rawTotalOpen)
+      : laneTotal;
+
+  return {
+    swept: swept.map(({ name, type, count }) => ({ name, type, count })),
+    omitted: omitted.map(({ name, type, count }) => ({ name, type, count })),
+    sweptCount,
+    totalOpen,
+    unsweptCount: Math.max(totalOpen - sweptCount, 0),
+  };
+}
+
+/**
+ * Render the denominator for a non-technical operator.
+ *
+ * @param {ReturnType<typeof buildIntakeDenominator>} denominator
+ * @returns {string}
+ */
+export function formatIntakeDenominator(denominator) {
+  const lanes = denominator?.swept ?? [];
+  const listed =
+    lanes.length > 0
+      ? lanes.map(lane => `${lane.name} (${lane.count})`).join(", ")
+      : "no pre-work lanes found";
+
+  return `Looked in every lane holding work that has not started — ${listed} — ${denominator.sweptCount} items checked out of ${denominator.totalOpen} still open.`;
+}
+
+/**
+ * Render the full operator-readable one-liner for a dry build lane.
+ *
+ * @param {ReturnType<typeof buildIntakeDenominator>} denominator
+ * @param {{ queue?: string }} [context]
+ * @returns {string}
+ */
+export function summarizeDryLane(denominator, context = {}) {
+  const queue =
+    typeof context.queue === "string" && context.queue.trim().length > 0
+      ? ` on ${context.queue.trim()}`
+      : "";
+
+  return `Nothing ready to build${queue}. ${formatIntakeDenominator(denominator)}`;
+}
+
+/**
+ * @param {unknown} loopId
+ * @param {unknown} outcome
+ * @returns {boolean} whether this run must carry a denominator
+ */
+export function requiresDenominator(loopId, outcome) {
+  return (
+    outcome === "nothing-needed" &&
+    DENOMINATOR_REQUIRED_LOOP_IDS.includes(String(loopId ?? "").trim())
+  );
+}
+
+/**
+ * @param {unknown} denominator
+ * @returns {string | null} the reason it is unusable, or null when valid
+ */
+function findDenominatorDefect(denominator) {
+  if (!denominator || typeof denominator !== "object") {
+    return "no denominator was supplied";
+  }
+  if (!Array.isArray(denominator.swept) || denominator.swept.length === 0) {
+    return "it names no swept lanes";
+  }
+  if (!Number.isInteger(denominator.sweptCount)) {
+    return "its swept count is not a whole number";
+  }
+  if (!Number.isInteger(denominator.totalOpen)) {
+    return "its open-item total is not a whole number";
+  }
+  if (denominator.sweptCount > denominator.totalOpen) {
+    return "it claims to have swept more items than are open";
+  }
+  return null;
+}
+
+/**
+ * Refuse to record a dry build lane that does not say what it looked at.
+ *
+ * Thirty-one consecutive cycles reported an empty lane against a queue holding
+ * unswept pre-work rows. Every record was honest and every conclusion was
+ * false, because none of them stated a denominator. This turns that silent
+ * wrong answer into a loud one.
+ *
+ * @param {{ loopId?: unknown, outcome?: unknown, denominator?: unknown }} input
+ * @throws {Error} when a denominator is required and missing or malformed
+ */
+export function assertDenominatorReported(input = {}) {
+  if (!requiresDenominator(input.loopId, input.outcome)) {
+    return;
+  }
+  const defect = findDenominatorDefect(input.denominator);
+  if (defect === null) {
+    return;
+  }
+
+  throw new Error(
+    `A "nothing-needed" run for loop "${String(input.loopId).trim()}" must state the lanes it swept, and ${defect}. ` +
+      `Pass a denominator built by buildIntakeDenominator() so an omitted lane is visible instead of silent.`
+  );
+}

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -110,7 +110,7 @@ The only legitimate reasons to stop early:
 
 - Missing repo or required configuration. Surface the missing value and exit.
 - Label namespace not adopted (no issue carries any of `$READY` / `$CLAIMED` / `$DONE`). Surface a label-convention error and exit (this is setup, not a normal idle cycle — see "Adoption" at the bottom).
-- Empty ready set. Exit cleanly with `"No GitHub issues labeled $READY in <org>/<repo>. Nothing to do."`
+- Empty pre-work set. Exit cleanly on the denominator-stated summary from `summarizeDryLane` — which names every lane swept, its count, and the open total. A bare "nothing to do" is not an acceptable exit: it is indistinguishable from a wrong denominator (#2657).
 
 ## Lifecycle assumed
 
@@ -166,7 +166,57 @@ gh label list --repo <org>/<repo> --json name \
       '[.[] | .name | select(. == $r or . == $c or (. as $n | $d | index($n)))] | length'
 ```
 
-If none of the configured role labels exist on the repo → label convention not adopted, surface a setup error and exit. If the role labels exist but none are `$READY` on any open issue matching the resolved assignee filter (or any open issue when the filter is empty) → genuinely empty queue, exit cleanly with `"No GitHub issues labeled $READY. Nothing to do."`
+If none of the configured role labels exist on the repo → label convention not adopted, surface a setup error and exit.
+
+#### 2a. Sweep every pre-work lane, and state the denominator
+
+GitHub Issues has no state-type field, so labels are the only lane available here — a constraint of
+GitHub's data model, not a preference (see "Why labels" above). That makes the omission risk
+*higher*, not lower: there is no `type` to fall back on, so the pre-work set must be derived from
+**configured roles**, never from a hardcoded roster of label names. The pre-work lanes are:
+
+- the configured `$READY` label — the human-flipped lane, worked first;
+- the configured `$BLOCKED` label (`github.labels.build.blocked`) — items that were *never started*,
+  each carrying a written blocker that nothing re-read until Phase 2.5;
+- open issues carrying **no** build role label — which this scanner must see anyway in order to
+  determine and stamp their repo.
+
+Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
+number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+lane type explicitly, since there is none to read:
+
+```text
+buildIntakeDenominator({ lanes: [{name: "$READY", type: "unstarted", count: <n>},
+                                 {name: "$BLOCKED", type: "unstarted", count: <n>},
+                                 {name: "(no role label)", type: "backlog", count: <n>},
+                                 {name: "$CLAIMED", type: "started", count: <n>}, …],
+                         totalOpen: <open issue count> })
+summarizeDryLane(denominator, { queue: "<org>/<repo>" })
+```
+
+Every candidate outside `$READY` must clear Phase 2.5 before it is treated as a candidate at all. If
+nothing survives, exit on the denominator-stated summary from `summarizeDryLane` — never a bare
+"nothing to do". The run recorder rejects a dry build-intake run that does not name what it swept
+(see `automation-runbook-contract`).
+
+#### 2a.1 Re-probe the blockers instead of inheriting them
+
+A blocker is a **claim with a timestamp, not a fact** — it goes stale the moment its condition comes
+true, and nothing re-read one before this phase. For each `$BLOCKED` candidate:
+
+1. **Human gate first, and it is absolute.** An issue carrying the configured human-needed label
+   (`github.labels.build.human_needed`, default `human-needed`) or a `[lisa-human-gate]` marker in
+   its body is **never** auto-selected, whatever any probe says.
+2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
+   version on trunk, a published package, a CI run history, an advisory's patched status — rot
+   fastest and are cheapest to check. A human decision is not machine-testable; leave it.
+3. **Classify with `classifyPreWorkCandidate(...)`** from `scripts/intake-blocker-reprobe.mjs`. A
+   discharge with no recorded evidence is not a discharge, and neither is a candidate nothing
+   probed this cycle — the helper refuses both.
+4. **Record the result on the issue either way** via `formatReprobeNote(...)` as a comment, so the
+   next cycle reads the answer rather than re-deriving it. Keep it idempotent.
+5. **On `selectable: true`**, relabel `$BLOCKED → $READY` with the discharging evidence in the same
+   comment, and treat it as an ordinary candidate. On anything else, leave it where it is.
 
 #### 2b. Lifecycle-label trust resolution (bot-authored labels are not signals)
 
@@ -251,7 +301,7 @@ GitHub Issues live in one repo by definition, so the scanned repo's issues are u
    - **Container visibility is allowed.** A multi-repo Epic / Story / Spike may legitimately carry multiple `repo:<name>` labels for operator visibility. Do not split or claim it here; leave the repo markers intact and fall through to the leaf-only gate, which repairs the stale build-ready label instead of dispatching the container.
    - **Multi-repo leaf → split, never claim.** Run the `repo-scope-split` work-time procedure into single-repo siblings, each created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
    - **Single-repo leaf for the current repo** → fall through to 3a (leaf-only gate) and 3b (claim).
-4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the ready set is exhausted — exit cleanly with `"No ready issues for repo <current>. Nothing to do."`.
+4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the candidate set is exhausted — exit cleanly on the denominator-stated summary, naming the current repo alongside the swept lanes.
 
 #### 3a. Leaf-only claim gate (repair containers)
 

package/plugins/src/base/skills/lisa-intake/SKILL.md

@@ -126,7 +126,7 @@ matches the mode this cycle ran in: **`intake-prd`** (PRD-side dispatch) or **`i
 
 | This cycle's exit path | Run outcome |
 |---|---|
-| Empty `Ready` set — the idle case (step 3), nothing to claim | `nothing-needed` |
+| Empty pre-work set — the idle case (step 3), nothing to claim. **Must state its denominator** (see below) | `nothing-needed` |
 | A PRD routed to `Blocked` (clarifying questions) or `Ticketed`; a build ticket claimed and dispatched | `candidate-proposed` |
 | A build cycle that shipped and verified (merged PR + evidence), or a shipped PRD moved to `verified` | `change-proved` |
 | A protected deployment (or other autonomy boundary the lifecycle hits) waiting on a human approval | `approval-requested` |
@@ -151,6 +151,22 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/automation-run-record.mjs" \
   --runbook .lisa/automations/intake-tickets.runbook.md [--ref <item-url>]...
 ```
 
+**A dry build lane must say what it looked in.** A `nothing-needed` run on `intake-tickets`
+additionally passes `--denominator` — the JSON from `buildIntakeDenominator()` in
+`scripts/intake-prework-denominator.mjs` — and the recorder **refuses the row without it**. This is
+not decoration: 31 consecutive cycles reported a dry lane against a queue holding 61 unswept
+pre-work rows, and every one of those records was honest. A missing row is noisy on inspection; a
+wrong denominator is silent forever and looks exactly like a healthy dry queue. Stating the swept
+set is what turns the silent wrong answer into an inspectable one (#2657).
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/scripts/automation-run-record.mjs" \
+  --loop-id intake-tickets --outcome nothing-needed \
+  --summary "Nothing ready to build on team ENG. Looked in every lane holding work that has not started — Backlog (20), Todo (17), Ready (2), Blocked (61) — 100 items checked out of 343 still open." \
+  --denominator "$DENOMINATOR_JSON" \
+  --runbook .lisa/automations/intake-tickets.runbook.md
+```
+
 If `${CLAUDE_PLUGIN_ROOT}` is unset, resolve the plugin scripts directory directly — the built copy
 `plugins/lisa/scripts/automation-run-record.mjs` or the source
 `plugins/src/base/scripts/automation-run-record.mjs`. If recording still fails, **degrade, never

package/plugins/src/base/skills/lisa-jira-build-intake/SKILL.md

@@ -85,7 +85,7 @@ The only legitimate reasons to stop early:
 
 - Missing project key / JQL or required configuration. Surface the missing value and exit.
 - Workflow misconfigured (pre-flight check finds `$CLAIMED` or `$DONE` not reachable, or `$READY` status absent). Surface and exit.
-- Empty ready set. Exit cleanly with `"No tickets with Status=$READY. Nothing to do."`
+- Empty pre-work set. Exit cleanly on the denominator-stated summary from `summarizeDryLane` — which names every lane swept, its count, and the open total. A bare "nothing to do" is not an acceptable exit: it is indistinguishable from a wrong denominator (#2657).
 
 ## Lifecycle assumed
 
@@ -130,11 +130,59 @@ JQL="${BASE_JQL} ORDER BY priority DESC, created ASC"
 
 4. Confirm the configured Atlassian site by invoking `lisa-atlassian-access` `operation: list-sites` (it enforces connection match against `.lisa.config.json`).
 
-### Phase 2 — Find ready tickets
+### Phase 2 — Sweep every pre-work status by CATEGORY
 
-Invoke `lisa-atlassian-access` `operation: search-issues jql: "<JQL>"`. Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), labels, components.
+**Sweep by `statusCategory`, never by a roster of status names.** JIRA groups statuses into three
+categories — `To Do` (`new`), `In Progress` (`indeterminate`), `Done` (`done`) — and a `Blocked`
+status is not a fourth category: a project that wants one models it under **`To Do`**, i.e. work
+that was never started. Keying the candidate set on status *names* therefore omits every pre-work
+lane a project invented, and the scanner reports an empty queue over a full one. The same defect on
+the Linear side produced 31 consecutive false "dry lane" cycles (#2657).
 
-If empty, report `"No tickets with Status=$READY. Nothing to do."` and exit. This is the common idle case.
+1. Run the ready query first: `lisa-atlassian-access` `operation: search-issues jql: "<JQL>"`. This
+   is the human-flipped lane and it is worked first.
+2. Then sweep the rest of pre-work with the same base JQL, swapping the status clause for
+   `statusCategory = "To Do"`, and read the **total open** count (`statusCategory != Done`). The
+   open total is what makes an omitted lane arithmetically visible.
+3. Page to exhaustion — a single unpaged `search-issues` call is not a count.
+
+Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), status (with
+its category), labels, components.
+
+Build the denominator with the shared helper, which owns the pre-work vocabulary so no two
+scanners can disagree about what counts:
+
+```text
+buildIntakeDenominator({ lanes: [{name: "<status>", type: "<statusCategory>", count: <rows>}, …],
+                         totalOpen: <statusCategory != Done count> })
+summarizeDryLane(denominator, { queue: "<project key>" })
+```
+
+The helper accepts JIRA's category vocabulary directly (`new` / `To Do` normalize to pre-work).
+
+**Every candidate outside `$READY` must clear Phase 2.5 before it is treated as a candidate at
+all.** If nothing survives, exit on the denominator-stated summary from `summarizeDryLane` — never a
+bare "nothing to do". The run recorder rejects a dry build-intake run that does not name what it
+swept (see `automation-runbook-contract`).
+
+### Phase 2.5 — Re-probe the blockers instead of inheriting them
+
+A blocker is a **claim with a timestamp, not a fact** — it goes stale the moment its condition comes
+true, and nothing re-read one before this phase. For each pre-work candidate outside `$READY`:
+
+1. **Human gate first, and it is absolute.** A ticket carrying the configured human-needed label
+   (`jira.labels.human_needed`, default `Human Needed`) or a `[lisa-human-gate]` marker in its
+   description is **never** auto-selected, whatever any probe says.
+2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
+   version on trunk, a published package, a CI run history, an advisory's patched status — rot
+   fastest and are cheapest to check. A human decision is not machine-testable; leave it.
+3. **Classify with `classifyPreWorkCandidate(...)`** from
+   `scripts/intake-blocker-reprobe.mjs`. A discharge with no recorded evidence is not a discharge,
+   and neither is a candidate nothing probed this cycle — the helper refuses both.
+4. **Record the result on the ticket either way** via `formatReprobeNote(...)` as a comment, so the
+   next cycle reads the answer rather than re-deriving it. Keep it idempotent.
+5. **On `selectable: true`**, transition the ticket to `$READY` with the discharging evidence in the
+   same comment, and treat it as an ordinary candidate. On anything else, leave it where it is.
 
 ### Phase 3 — Process the first eligible ready ticket
 
@@ -149,7 +197,7 @@ A JIRA project can oversee multiple repos (`frontend` / `backend` / `infrastruct
    - **Unlabeled** → determine the target repo(s) from the ticket (description, AC, technical approach) confirmed against the code surfaces, then **stamp** `repo:<name>` via `lisa-atlassian-access` `operation: write-ticket` (add the label / set the component) so later cycles filter cheaply; re-apply with the now-known repo.
    - **Multi-repo leaf → split, never claim.** Run the `repo-scope-split` work-time procedure to break it into single-repo siblings, each created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
    - **Single-repo leaf for the current repo** → fall through to 3a (leaf-only gate) and 3b (claim).
-4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the ready set is exhausted — exit cleanly with `"No ready tickets for repo <current>. Nothing to do."`.
+4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the candidate set is exhausted — exit cleanly on the denominator-stated summary, naming the current repo alongside the swept lanes.
 
 #### 3a. Leaf-only claim gate (skip / safe-block containers)