@codyswann/lisa 4.54.13 → 4.55.0

package/all/copy-contents/.gitattributes

@@ -26,4 +26,12 @@
 # failure this ledger exists to make impossible.
 .lisa/WITHDRAWN.jsonl merge=union
 
+# Short-lived operational hazards, appended by any session that declares
+# one (CodySwannGT/lisa#3681). Same append-only JSONL shape as the
+# tombstones above and the same built-in union driver — a default line
+# merge would drop a hazard, and a hazard nobody is told about is the
+# collision this ledger exists to prevent. Entries carry an expiry and
+# stop applying on their own, so the file drains without an editor.
+.lisa/HAZARDS.jsonl merge=union
+
 # END: AI GUARDRAILS

package/all/copy-overwrite/scripts/check-orphaned-branches.mjs

@@ -86,6 +86,11 @@
 import { spawnSync } from "node:child_process";
 
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+// Downstream both files land flat in one `scripts/` directory, so this
+// resolves there exactly as it does here. Imported rather than reimplemented:
+// a second lane parser is a second answer to `whose is this?`, and two
+// answers is the state this report exists to end.
+import { parseLaneId, workItemLines } from "./lisa-work-item.mjs";
 
 /** Branch name prefixes that are never work-in-flight. */
 const IGNORED_PREFIXES = Object.freeze(["backup/", "gh-readonly-queue/"]);
@@ -254,9 +259,23 @@ export function branchesAhead(remote = "origin", base = "main") {
  * The work-item reference a branch is bound to, and how strongly.
  *
  * The trailer is asked first because it is the same binding the commit gate
- * enforces. It is routinely absent — the branch that motivated this check
- * carried no trailer at all — so the branch name is the fallback, reported as
- * an inference rather than as a fact.
+ * enforces — and it is read the way the gate reads it, through the exported
+ * `workItemLines`, over each commit's whole message.
+ *
+ * This used to ask git: `--format=%(trailers:key=Work-Item,valueonly)`. That is
+ * the obvious tool and it is the wrong one. Git's parser sees only a message's
+ * FINAL contiguous block of `Key: value` lines, and this fleet's convention
+ * puts `🤖 Generated with Claude Code` boilerplate below the trailer, which
+ * ends the block. Measured over non-merge commits that name an item: on a
+ * single multi-agent branch git found none on 47 of 51; over full
+ * default-branch history it missed 477 of 1,730. So the claim this docstring
+ * used to make — "it is routinely absent" — was mostly a property of the
+ * reader, not of the branches, and every one of those branches was ruled on
+ * from a branch-name INFERENCE while its canonical binding sat in the message
+ * unread. See the `work-item-trailer-definition` rule (#3747).
+ *
+ * The branch name remains the fallback for a branch that genuinely carries no
+ * trailer, reported as an inference rather than as a fact.
  * @param {string} branch Short branch name.
  * @param {string} base Default branch name.
  * @param {string} remote Remote name.
@@ -264,15 +283,12 @@ export function branchesAhead(remote = "origin", base = "main") {
  * @returns {{ref: string, refSource: string} | undefined} The reference.
  */
 export function workItemRef(branch, base, remote = "origin", exec = run) {
-  const trailers = exec("git", [
+  const messages = exec("git", [
     "log",
-    "--format=%(trailers:key=Work-Item,valueonly,separator=%x2C)",
+    "--format=%B",
     `${remote}/${base}..${remote}/${branch}`,
   ]);
-  const fromTrailer = trailers
-    ?.split(/[\n,]/u)
-    .map(value => value.trim())
-    .find(value => value.length > 0);
+  const [fromTrailer] = workItemLines(messages ?? "");
   if (fromTrailer) {
     const digits = REF_IN_TRAILER.exec(fromTrailer);
     if (digits) return { ref: digits[1], refSource: REF_SOURCE.TRAILER };
@@ -455,6 +471,38 @@ export function divergences(branches, base, remote = "origin", exec = run) {
   return counts;
 }
 
+/**
+ * The lane that produced each branch's tip commit.
+ *
+ * Every session in this fleet pushes under ONE git identity, so `author.login`
+ * is a constant here and answers nothing: it is the same name on a branch a
+ * live session is still working and on one whose session ended days ago. The
+ * lane stamp is the only thing in the record that differs between them, which
+ * makes it the only thing this report can route on.
+ *
+ * A branch with no stamp is reported as unrouted rather than omitted. Silence
+ * about attribution reads as "nobody made this", and the sweep that motivated
+ * the stamp already reached two wrong conclusions that way.
+ * @param {ReadonlyArray<string>} branches Branch names, without the remote.
+ * @param {string} remote Remote the branches live on.
+ * @param {(command: string, args: string[]) => (string|undefined)} [exec] Runner.
+ * @returns {Map<string, string>} Lane id by branch, absent where none is stamped.
+ */
+export function branchLanes(branches, remote = "origin", exec = run) {
+  const lanes = new Map();
+  for (const branch of branches) {
+    const message = exec("git", [
+      "log",
+      "-1",
+      "--format=%B",
+      `${remote}/${branch}`,
+    ]);
+    const lane = message === undefined ? undefined : parseLaneId(message);
+    if (lane !== undefined) lanes.set(branch, lane);
+  }
+  return lanes;
+}
+
 /**
  * Branches carrying commits that no pull request has ever covered, each with
  * the tracker's verdict on whether the WORK survived.
@@ -467,12 +515,14 @@ export function divergences(branches, base, remote = "origin", exec = run) {
  * @param {Set<string>} inputs.submitted Branch names that have a pull request.
  * @param {Map<string, WorkItem>} [inputs.items] Work-item states by branch.
  * @param {Map<string, Divergence>} [inputs.divergence] Two-sided counts by branch.
+ * @param {Map<string, string>} [inputs.lanes] Lane id by branch.
  * @returns {ReadonlyArray<Candidate>} The candidates, each carrying a verdict.
  */
 export function orphanedBranches({
   ahead,
   divergence = new Map(),
   items = new Map(),
+  lanes = new Map(),
   submitted,
 }) {
   return ahead
@@ -488,6 +538,7 @@ export function orphanedBranches({
         baseLeads: sides ? sides.baseAhead > 0 : undefined,
         branch: row.branch,
         divergence: sides,
+        lane: lanes.get(row.branch),
         ref: item?.ref,
         refSource: item?.refSource,
         route: item?.route,
@@ -516,6 +567,7 @@ export function main(argv = process.argv.slice(2), probe = {}) {
   const {
     collectAhead = branchesAhead,
     collectDivergence = divergences,
+    collectLanes = branchLanes,
     collectSubmitted = branchesWithPullRequests,
     collectWorkItems = workItemStates,
     log = console.log,
@@ -553,6 +605,7 @@ export function main(argv = process.argv.slice(2), probe = {}) {
     ahead,
     divergence: collectDivergence(candidates, base, remote),
     items: collectWorkItems(candidates, base, remote),
+    lanes: collectLanes(candidates, remote),
     submitted,
   });
   log(
@@ -624,9 +677,25 @@ function renderRow(row, base) {
   lines.push(
     `      ${row.ahead} commit(s) ahead of ${base}${direction(row, base)}`
   );
+  lines.push(`      ${routing(row)}`);
   return lines;
 }
 
+/**
+ * Who this branch can be handed back to.
+ *
+ * The lane is a one-way digest of an id the agent runtime supplied: it names
+ * no session, no URL and no person, and a live session recognises its own work
+ * by deriving the same token rather than by being told whose it is.
+ * @param {Candidate} row A row from `orphanedBranches`.
+ * @returns {string} The routing clause.
+ */
+function routing(row) {
+  if (row.lane === undefined)
+    return "no lane on the tip commit, so this cannot be routed to a session — it predates the stamp, or was made outside a Lisa hook";
+  return `produced by ${row.lane} — a session confirms this is its own with \`node scripts/lisa-work-item.mjs lane\``;
+}
+
 /**
  * The conflict-direction clause for one candidate.
  *

package/all/copy-overwrite/scripts/check-third-party-action-pins.mjs

@@ -160,8 +160,24 @@ const NO_VERSION = "missing-version-comment";
  * `uses: <owner>/<repo>[/<subpath>]@<ref>` with anything after it captured, so
  * a trailing `# v1.2.3` can be read. Local (`./path`) and container
  * (`docker://`) references have no owner and never match.
+ *
+ * The value may be QUOTED, and that is not a stylistic detail here. YAML
+ * accepts `uses: "owner/repo@ref"` and `uses: 'owner/repo@ref'` as the same
+ * scalar GitHub Actions resolves identically, but a value class that excluded
+ * quotes could not begin matching at one — so a quoted reference did not fail
+ * the scan, it left it entirely, and the gate reported clean over an entry it
+ * had never inspected. A pin checker that silently skips a spelling is a
+ * vacuous pass on every reference written that way, which is the failure this
+ * gate exists to close rather than to reproduce.
+ *
+ * The closing quote is matched by back-reference so `"a'` cannot read as a
+ * quoted value, and it is consumed by the match so the trailing `# v1.2.3` is
+ * still found by the slice in `findActionRefs`. An unquoted value binds the
+ * group to the empty string, where the back-reference matches empty and the
+ * pattern behaves exactly as it did before.
  */
-const USES_RE = /^[ \t]*(?:-[ \t]*)?uses:[ \t]*(?<value>[^\s"'#]+)/;
+const USES_RE =
+  /^[ \t]*(?:-[ \t]*)?uses:[ \t]*(?<quote>["']?)(?<value>[^\s"'#]+)\k<quote>/;
 
 /** A well-formed action owner. Anchored, so matching is linear. */
 const OWNER_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/;

package/all/copy-overwrite/scripts/lib/process-tree-runner.mjs

@@ -11,6 +11,20 @@
  * This small asynchronous supervisor is invoked through a synchronous parent:
  * it owns the process-group id, applies the deadline, terminates the group, and
  * only then lets the parent continue.
+ *
+ * ## Interrupting a run
+ *
+ * The deadline was never the only way a run ends early. An operator — or an
+ * agent told to free a contended machine — kills the gate runner, and because
+ * this supervisor holds the ONLY handle to the detached group it started,
+ * killing its parent used to leave it reparented to pid 1 with the whole tree
+ * still executing. Measured: the kill reported success, `pgrep` for the runner
+ * returned nothing, and eleven processes carried on (CodySwannGT/lisa#3829).
+ *
+ * So the supervisor watches for the run it serves going away, tears the tree
+ * down through the same single reap the deadline uses, and SAYS SO. A silent
+ * teardown would be the same defect wearing a different face: the operator who
+ * asked for the run to stop cannot tell a stop from a survival either way.
  * @module scripts/lib/process-tree-runner
  */
 
@@ -22,6 +36,16 @@ const KILL_GRACE_MS = 750;
 const REAP_POLL_MS = 25;
 const WINDOWS_TIMEOUT_EXIT_CODE = 255;
 const TERMINATING_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+
+/**
+ * How often the supervisor asks whether the run it serves is still there.
+ *
+ * Four times a second. This is a liveness poll, not a budget: the cost of
+ * asking is one `kill(pid, 0)` per watched pid, and the cost of asking too
+ * rarely is measured in whole test suites that keep running for a machine
+ * nobody is watching any more.
+ */
+const ORPHAN_POLL_MS = 250;
 const DEFAULT_REAP_CONTROLS = Object.freeze({
   kill: killTree,
   exists: treeExists,
@@ -41,17 +65,126 @@ export function timeoutVerdictForPlatform(platform) {
     : { code: null, signal: "SIGKILL" };
 }
 
+/**
+ * Whether a pid is worth watching for disappearance.
+ *
+ * `1` is excluded on purpose rather than by accident. It is both the pid an
+ * orphan is reparented ONTO and a process that never exits, so watching it
+ * would arm a condition that can never fire while looking exactly like a
+ * watch that is working.
+ * @param {unknown} value A candidate pid.
+ * @returns {boolean} Whether it names a process that can meaningfully die.
+ */
+export function isWatchablePid(value) {
+  return Number.isInteger(value) && value > 1;
+}
+
+/**
+ * Parse the pids this supervisor was asked to outlive nobody but.
+ * @param {readonly string[]} argv Raw arguments.
+ * @returns {number[]} Watchable pids, in the order given, without duplicates.
+ */
+export function parseWatchPids(argv) {
+  const prefix = "--watch-pid=";
+  const pids = argv
+    .filter(value => value.startsWith(prefix))
+    .map(value => Number(value.slice(prefix.length)))
+    .filter(pid => isWatchablePid(pid));
+  return [...new Set(pids)];
+}
+
 function parseArguments(argv) {
   const timeoutArg = argv.find(value => value.startsWith("--timeout-ms="));
   const separator = argv.indexOf("--");
   const timeoutMs = Number(timeoutArg?.slice("--timeout-ms=".length));
+  const flags = separator >= 0 ? argv.slice(0, separator) : argv;
   const command = separator >= 0 ? argv.slice(separator + 1).join(" ") : "";
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || !command) {
     throw new Error(
-      "usage: process-tree-runner.mjs --timeout-ms=<positive-ms> -- <command>"
+      "usage: process-tree-runner.mjs --timeout-ms=<positive-ms> " +
+        "[--watch-pid=<pid>]... -- <command>"
     );
   }
-  return { command, timeoutMs };
+  return { command, timeoutMs, watchPids: parseWatchPids(flags) };
+}
+
+/**
+ * Whether a pid no longer names a live process.
+ *
+ * Fail-CLOSED, matching every other liveness question in this file: only the
+ * kernel's `ESRCH` proves absence. An `EPERM` — a pid that outlived the run and
+ * was reused by another user's process — means the question was refused, not
+ * answered, and refusing to answer must never be read as "the run is over".
+ * That direction matters here more than anywhere else in the module: a wrong
+ * "gone" tears down a gate run that was still executing correctly.
+ * @param {number} pid The process to ask about.
+ * @param {typeof process.kill} probe Injectable process probe.
+ * @returns {boolean} Whether the process is provably absent.
+ */
+export function pidIsGone(pid, probe = process.kill) {
+  try {
+    probe(pid, 0);
+    return false;
+  } catch (error) {
+    return isAbsentProcessError(error);
+  }
+}
+
+/**
+ * Why this supervisor should stop, if it should.
+ *
+ * Two separable questions, deliberately answered in one place so the report
+ * can name WHICH one fired:
+ *
+ * 1. **Orphaning.** The process that started this supervisor is gone, so the
+ *    verdict this run would produce has no one left to receive it. Detected by
+ *    comparing the parent pid captured at start against the live one — a
+ *    reparented process reads `1` (or a subreaper) instead of its launcher.
+ * 2. **A watched pid died.** The caller named a process further up the chain —
+ *    a git hook, say — whose death means the run is moot even though this
+ *    supervisor's own parent is still alive.
+ *
+ * Watch-pid absence is proved with `pidIsGone`, which fails closed; the
+ * orphan check needs no such care because a changed parent pid is a fact the
+ * kernel reports directly and cannot be refused.
+ * @param {object} options Inputs.
+ * @param {number} options.launchParentPid Parent pid captured at start.
+ * @param {number} options.currentParentPid Parent pid right now.
+ * @param {readonly number[]} [options.watchPids] Pids to outlive nobody but.
+ * @param {(pid: number) => boolean} [options.gone] Injectable absence probe.
+ * @returns {string|null} An operator-readable reason, or null to keep running.
+ */
+export function interruptionReason({
+  launchParentPid,
+  currentParentPid,
+  watchPids = [],
+  gone = pidIsGone,
+}) {
+  if (isWatchablePid(launchParentPid) && currentParentPid !== launchParentPid) {
+    return `the run that started it (pid ${launchParentPid}) exited`;
+  }
+  const dead = watchPids.find(pid => gone(pid));
+  if (dead !== undefined) return `the run it serves (pid ${dead}) exited`;
+  return null;
+}
+
+/**
+ * The line an interrupted supervisor leaves behind.
+ *
+ * A silent teardown reintroduces the defect in a different form: the operator
+ * who asked for the run to stop gets the same silence whether it stopped or
+ * kept running. So this states three things — that the run was INTERRUPTED
+ * rather than completed, why, and what was terminated — and it goes to stderr,
+ * which the gate runner inherits.
+ * @param {string} reason Why the supervisor stopped.
+ * @param {number} pid The process-group leader that was reaped.
+ * @returns {string} One line, for stderr.
+ */
+export function interruptionReport(reason, pid) {
+  return (
+    `🛑 gate command INTERRUPTED — ${reason}; terminated its process tree ` +
+    `(group ${pid}) and every descendant. Nothing was proved by it.`
+  );
 }
 
 /** Whether a failed POSIX process-group operation proved the group is absent. */
@@ -265,7 +398,32 @@ export async function reapTree(pid, controls = DEFAULT_REAP_CONTROLS) {
   throw new Error(`gate process tree ${pid} survived SIGKILL`);
 }
 
-export function supervise(command, timeoutMs, reap = reapTree) {
+/**
+ * Run one command as a supervised process tree.
+ *
+ * The supervisor answers to three ways a run can end early — its deadline, a
+ * terminating signal, and now the run it serves going away — and all three
+ * share one reap, because a tree reaped twice is a tree whose second kill
+ * lands on a recycled pid.
+ * @param {string} command Shell source to supervise.
+ * @param {number} timeoutMs Deadline for the whole tree.
+ * @param {typeof reapTree} [reap] Injectable group reaper.
+ * @param {object} [options] Interrupt-watch seams, injectable for tests.
+ * @param {readonly number[]} [options.watchPids] Pids whose death ends this run.
+ * @param {typeof interruptionReason} [options.detect] Interrupt predicate.
+ * @param {number} [options.pollMs] How often to ask.
+ * @param {(line: string) => void} [options.report] Where the report goes.
+ * @param {number} [options.launchParentPid] Parent pid captured at start.
+ * @returns {Promise<{code: number|null, signal: string|null}>} The verdict.
+ */
+export function supervise(command, timeoutMs, reap = reapTree, options = {}) {
+  const {
+    watchPids = [],
+    detect = interruptionReason,
+    pollMs = ORPHAN_POLL_MS,
+    report = line => process.stderr.write(`${line}\n`),
+    launchParentPid = process.ppid,
+  } = options;
   return new Promise((resolve, reject) => {
     const shell =
       process.platform === "win32"
@@ -336,6 +494,7 @@ export function supervise(command, timeoutMs, reap = reapTree) {
     };
     const cleanup = () => {
       clearDeadline();
+      clearInterval(interruptWatch);
       clearSignalHandlers();
     };
     // Every exit path shares one reap. A signal that arrives while the direct
@@ -376,17 +535,43 @@ export function supervise(command, timeoutMs, reap = reapTree) {
       );
     };
 
-    const relaySignal = signal => {
-      if (terminating) return;
+    // Both early-stop paths below end the same way: reap the tree ONCE, say
+    // what was terminated, then take the signal-shaped exit. `stopWith` exists
+    // so the reporting cannot drift between them — a signal that tears the
+    // tree down silently and a watch that reports is the same defect twice.
+    const stopWith = (reason, signal) => {
+      if (terminating || settled) return;
       terminating = true;
       settling = true;
       clearDeadline();
+      clearInterval(interruptWatch);
       reapOnce().then(() => {
         cleanup();
+        report(interruptionReport(reason, pid));
         // Restore the signal-shaped exit after the detached tree is gone.
         process.kill(process.pid, signal);
       }, failReap);
     };
+    const relaySignal = signal => {
+      stopWith(`it received ${signal}`, signal);
+    };
+    // The wiring this module always had the means for and nothing invoked.
+    // Without it, killing the gate runner leaves this supervisor reparented to
+    // pid 1 with its whole detached tree still executing — measured, and the
+    // reason the tree survives is precisely that this supervisor holds the
+    // only handle to it. Nothing else on the machine knows the group id.
+    const interruptWatch = setInterval(() => {
+      if (terminating || settling || settled) return;
+      const reason = detect({
+        launchParentPid,
+        currentParentPid: process.ppid,
+        watchPids,
+      });
+      // SIGTERM rather than the signal nobody sent: this supervisor was not
+      // signalled, it outlived its purpose, and SIGTERM is the vocabulary the
+      // gate runner already reads as "terminated, therefore no verdict".
+      if (reason !== null) stopWith(reason, "SIGTERM");
+    }, pollMs);
     const deadline = setTimeout(() => {
       timedOut = true;
       terminating = true;
@@ -432,8 +617,10 @@ export function supervise(command, timeoutMs, reap = reapTree) {
 }
 
 async function main() {
-  const { command, timeoutMs } = parseArguments(process.argv.slice(2));
-  const result = await supervise(command, timeoutMs);
+  const { command, timeoutMs, watchPids } = parseArguments(
+    process.argv.slice(2)
+  );
+  const result = await supervise(command, timeoutMs, reapTree, { watchPids });
   if (result.signal) {
     process.kill(process.pid, result.signal);
   } else {

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -832,6 +832,37 @@ if [ "$notice_due" -eq 1 ]; then
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# One evaluation per guard per tool call
+#
+# The guards below are also registered individually by the plugin manifest, so
+# on a machine where both channels are live each one runs twice for a single
+# tool call. `guard-dedupe.bash`, sourced by each guard, lets the second copy
+# replay the first copy's ALLOW instead of recomputing it — and only when the
+# two copies are byte-identical, on the identical payload, within the identical
+# tool call. Nothing above is de-registered for it, because plugin-hook liveness
+# is not observable from disk and standing down on a disk guess is how this
+# dispatcher once switched enforcement off silently (CodySwannGT/lisa#3814).
+#
+# What is handed down here is only the state directory. `$notice_temp_base` has
+# already been resolved physically and had every parent checked for ownership
+# and mode, so the eight guards this loop spawns inherit that work instead of
+# repeating it eight times. A guard reached by the plugin channel has no such
+# parent and resolves its own; a guard that finds this variable unusable does
+# the same. Exported only when the chain was trusted, so an untrusted TMPDIR
+# hands down nothing rather than handing down a bad path.
+if [ -n "$notice_temp_base" ] && [ "$notice_state_trusted" -eq 1 ]; then
+  guard_memo_dir="$notice_temp_base/lisa-guard-memo-$notice_uid"
+  if [ ! -e "$guard_memo_dir" ] && [ ! -L "$guard_memo_dir" ]; then
+    (umask 077 && mkdir "$guard_memo_dir") 2>/dev/null || true
+  fi
+  if [ -d "$guard_memo_dir" ] && [ ! -L "$guard_memo_dir" ] && \
+    [ -O "$guard_memo_dir" ]; then
+    export LISA_GUARD_MEMO_DIR="$guard_memo_dir"
+    export LISA_GUARD_MEMO_UID="$notice_uid"
+  fi
+fi
+
 # ---------------------------------------------------------------------------
 # Dispatch
 status=0

package/all/copy-overwrite/scripts/lisa-hooks/block-blind-automerge.sh

@@ -165,6 +165,27 @@ set -euo pipefail
 
 input="$(cat)"
 
+# Evaluate once per tool call when this guard is registered on both channels.
+#
+# Lisa reaches an agent through the repository dispatcher AND the plugin
+# manifest, and where both are live the harness runs this guard twice for one
+# tool call. `guard-dedupe.bash` short-circuits the second run ONLY when a
+# byte-identical copy already ALLOWED this exact payload on this exact tool
+# call; a differing vintage, a refusal, and a host with one channel all
+# evaluate exactly as before. Nothing is de-registered by it
+# (CodySwannGT/lisa#3814).
+#
+# Absent library means no dedupe, which is the pre-existing behaviour, so an
+# older channel copy that predates it is unaffected.
+lisa_guard_hook_dir="${BASH_SOURCE[0]%/*}"
+lisa_guard_dedupe_lib="$lisa_guard_hook_dir/guard-dedupe.bash"
+if [ -r "$lisa_guard_dedupe_lib" ]; then
+  # shellcheck source=guard-dedupe.bash
+  . "$lisa_guard_dedupe_lib"
+  trap 'lisa_guard_dedupe_record $?' EXIT
+  lisa_guard_dedupe block-blind-automerge "$input"
+fi
+
 # Both interpreters are probed BEFORE use, and a missing one is ANNOUNCED
 # rather than swallowed. Under `set -e` an absent jq would abort with 127, and
 # Claude Code treats any non-2 exit as a non-blocking hook error — so the guard
@@ -247,9 +268,41 @@ PULL_REQUEST_ID_PATTERN = re.compile(
 NODE_ID_PATTERN = re.compile(r"^[A-Za-z0-9_=-]+$")
 
 # The probe that resolves a node id to the same fields `gh pr view` returns.
+#
+# `statusCheckRollup` is in here because the RE-TARGET path needs it and this
+# is the only probe a GraphQL `updatePullRequest` can use. Without it
+# `failing_check_names` read an absent key, found no failing check, and the
+# guard announced the re-target as the sanctioned green-PR batching case —
+# for a pull request that might be failing every check it has. The porcelain
+# path asked the right question and the API path could not, so the identical
+# act was guarded through `gh pr edit --base` and waved through as GraphQL:
+# a bypass that needs no permission, only a different spelling.
+#
+# The nodes are reshaped by `--jq` below into the flat list `gh pr view
+# --json statusCheckRollup` returns, so one reader serves both probes.
 NODE_QUERY = (
     "query($id:ID!){node(id:$id){... on PullRequest"
-    "{number url reviewDecision state baseRefName}}}"
+    "{number url reviewDecision state baseRefName "
+    "commits(last:1){nodes{commit{statusCheckRollup{contexts(first:100){nodes{"
+    "__typename ... on CheckRun{name conclusion} "
+    "... on StatusContext{context state}"
+    "}}}}}}}}}"
+)
+
+# Reshape the envelope into the porcelain's shape: unwrap `.data.node`, hoist
+# the last commit's rollup contexts to a top-level `statusCheckRollup` list,
+# and drop the `commits` scaffolding that carried it.
+# `has("commits")` rather than an unconditional default, and the distinction is
+# the point: a node that CARRIES the scaffolding and no contexts is a PR with no
+# checks, which is genuinely not failing and gets an empty list. A node without
+# the scaffolding is a probe that never asked, and it must leave the key absent
+# so the re-target path can tell the two apart instead of reading both as green.
+NODE_JQ = (
+    "if .data.node == null then null else .data.node as $n "
+    "| if ($n | has(\"commits\")) then ($n | del(.commits)) "
+    "+ {statusCheckRollup: "
+    "((($n.commits.nodes[0].commit.statusCheckRollup.contexts.nodes)) // [])} "
+    "else $n end end"
 )
 
 # What a probe spec asks for. `view` and `node` differ only in how the PR is
@@ -728,7 +781,7 @@ def probe_args(kind, subject, repo_args, fields):
             "gh", "api", "graphql",
             "-f", "query=" + NODE_QUERY,
             "-f", "id=" + subject,
-            "--jq", ".data.node",
+            "--jq", NODE_JQ,
         ]
     args = ["gh", "pr", "view"]
     if subject is not None:
@@ -969,6 +1022,20 @@ Do one of these instead:
   - leave the PR on its covered base and merge it there.
 """
 
+RETARGET_CHECKS_UNREADABLE = """Blocked: re-targeting %s onto "%s" cannot be judged, because this guard could
+not read the pull request's checks.
+
+That ref has ZERO required status checks, so the one thing standing between the
+move and a permission-free gate bypass is whether the PR is currently failing —
+and the probe returned no `statusCheckRollup` at all. An absent rollup is not an
+empty one. Reporting the move as the sanctioned green-PR batching case here
+would be a verdict about a question that was never asked.
+
+Re-target through `gh pr edit --base` instead, which reads the checks, or fix
+the probe. Do not report the PR as batched until something has actually looked.
+"""
+
+
 UNCOVERED_RETARGET_NOTICE = (
     "block-blind-automerge: %s is being re-targeted onto \"%s\", a ref with ZERO "
     "required status checks; its gates will run but cannot block a merge\n"
@@ -1039,6 +1106,18 @@ for act, kind, subject, repo_args, target_ref in acts:
         # nothing can block it", which holds whatever base it came from.
         if not base_is_uncovered(payload, repo_args, target_ref):
             continue
+        # Fails CLOSED, and only here. Everywhere else in this file an
+        # unanswerable question degrades and continues, because the guard being
+        # unable to run must not become the reason a command is refused. This
+        # branch is different: the base has already been confirmed to have zero
+        # required checks, so an empty `failing` list is the whole basis for
+        # allowing the move, and an ABSENT rollup produces the identical empty
+        # list. Passing on it would be a measurement that could not fail.
+        if not isinstance(payload.get("statusCheckRollup"), list):
+            sys.stderr.write(
+                RETARGET_CHECKS_UNREADABLE % (pr_name(payload), target_ref)
+            )
+            sys.exit(1)
         failing = failing_check_names(payload)
         if not failing:
             # A green PR moving onto a stack base is the sanctioned batching