@feigi/fleet-ctl 3.79.5 → 3.80.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.5",
+  "version": "3.80.0",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/board-gather.mjs

@@ -34,7 +34,7 @@ import {
 import { readReceipt } from "./phase0-receipt.mjs";
 import { RECEIPT } from "./ledger-grammar.mjs";
 import { NAME, warnOnce, execRead } from "./board-common.mjs";
-import { mergedReadPrs } from "./compute-board.mjs";
+import { mergedReadPrs, issuesOfPrs } from "./compute-board.mjs";
 // The heartbeat's liveness mark and the controller record beside it, read here
 // and never written: the heartbeat is the mark's only writer and
 // `ledger.mjs rotate` the record's. stallOwner() reads the process table to
@@ -48,7 +48,7 @@ const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 // The "is this a plain JSON object" predicate and its kind word, one
 // copy for the reads in this file that reject a parsed-but-wrong payload
 // WHOLE — gather's `--prev` payload, gather's per-entry `tickets[i]` check,
-// and readMerged()'s `data.repository`. Each carried its own inline
+// and readStates()'s `data.repository`. Each carried its own inline
 // copy of both halves before, which is three places for one policy to drift in.
 //
 // TWO functions and not one, because `typeof` alone cannot name the fault the
@@ -155,48 +155,60 @@ function hitLimit(parsed, limit) {
   return Array.isArray(parsed) && parsed.length >= limit;
 }
 
-// Which of `prNums` gh calls MERGED, in ONE `gh api graphql` query —
-// one aliased `pullRequest(number:)` field per PR, on the cwd's repository
-// (gh's own `{owner}`/`{repo}` placeholders, the repo every other read here
-// resolves) — so a PR merged at any age is found, and ten PRs cost what one
-// does. It replaced `gh pr list --state merged --limit 100`, the repo's 100
-// most recent merges: about six days on 2026-09-25, so a row PR merged
-// before that and never seen MERGED rendered REVIEW, turned stale and
-// counted as claimed. Measured 2026-09-26: 400 aliases answer in one call.
+// The merged and closed states of `prNums`, and the CLOSED-ness of `issueNums`,
+// in ONE `gh api graphql` query — one aliased `pullRequest(number:)` field per
+// PR and one `issue(number:)` field per issue, on the cwd's repository (gh's own
+// `{owner}`/`{repo}` placeholders, the repo every other read here resolves) — so
+// a PR merged at any age is found, and ten PRs cost what one does. It replaced
+// `gh pr list --state merged --limit 100`, the repo's 100 most recent merges: about
+// six days on 2026-09-25, so a row PR merged before that and never seen MERGED
+// rendered REVIEW, turned stale and counted as claimed. Measured 2026-09-26: 400
+// aliases answer in one call.
 //
-// An empty `prNums` makes no read at all. `state` is checked, so an entry gh
-// does not call MERGED never makes a card MERGED on its own account.
+// An empty `prNums` makes no read at all. `state` is checked per alias, so an
+// entry gh does not call MERGED is never merged, and one it does not call CLOSED
+// is never closed; an issue not CLOSED is not CLOSED.
 //
 // A body with an object `data.repository` IS an answer even at exit 1:
-// GitHub resolves every alias it can and nulls the rest — a number that is
-// not a PR comes back null beside a NOT_FOUND error, and gh exits 1 with the
-// whole body on stdout (measured 2026-09-26, gh 2.101.0, which also names
-// the number on stderr). Refusing that body would let one such row — a
-// typo, or a row with no impl token keyed by an issue number — put every other
-// row PR back in REVIEW on every tick. A null alias reads as not merged,
-// which is what a failed read means for that one PR.
+// GitHub resolves every alias it can and nulls the rest — a number that is not
+// a PR (or, for an issue alias, not an issue) comes back null beside a
+// NOT_FOUND error, and gh exits 1 with the whole body on stdout (measured
+// 2026-09-26, gh 2.101.0, which also names the number on stderr). Refusing that
+// body would let one such row — a typo, or a row with no impl token keyed by an
+// issue number — put every other row PR back in REVIEW on every tick. A null
+// alias reads as not merged and not closed, which is what a failed read means
+// for that one number.
 //
-// Real GitHub always answers EVERY requested `p<N>` alias, null or an
-// object — never omits one — so an object naming NONE of `prNums` is not a
-// shape the API produces, only a corrupted or truncated one; `isJsonObject`
-// alone cannot tell that apart from a genuine "checked, nothing merged"
-// answer, so it is checked for too. Anything else is a failed read: `[]`,
-// and computeBoard()'s carry-forward rule takes it from there.
-async function readMerged(prNums) {
-  if (!prNums.length) return [];
-  const fields = prNums.map((n) => `p${n}:pullRequest(number:${n}){state}`).join(" ");
+// Real GitHub always answers EVERY requested PR alias, null or an object — never
+// omits one — so an object naming NONE of the PR numbers is not a shape the API
+// produces, only a corrupted or truncated one; `isJsonObject` alone cannot tell
+// that apart from a genuine "checked, nothing matched" answer, so it is checked
+// for too. Anything else is a failed read: every list empty, and
+// computeBoard()'s carry-forward rule takes it from there.
+async function readStates(prNums, issueNums) {
+  const none = { merged: [], closed: [], closedIssues: [] };
+  if (!prNums.length) return none;
+  const fields = [
+    ...prNums.map((n) => `p${n}:pullRequest(number:${n}){state}`),
+    ...issueNums.map((n) => `i${n}:issue(number:${n}){state}`),
+  ].join(" ");
   const r = await execRead("gh", ["api", "graphql", "-F", "owner={owner}", "-F", "name={repo}",
     "-f", `query=query($owner:String!,$name:String!){repository(owner:$owner,name:$name){${fields}}}`]);
   let repo;
   try { repo = JSON.parse(r.stdout)?.data?.repository; } catch {}
   if (!isJsonObject(repo) || !prNums.some((n) => Object.prototype.hasOwnProperty.call(repo, `p${n}`))) {
     // `how` as runCiState() spells it; never r.error.message, which repeats
-    // the whole query — one field per PR — into every failed tick's line.
+    // the whole query — one field per number — into every failed tick's line.
     const how = r.code ?? (r.signal ? `killed by ${r.signal}` : `exit ${r.status}`);
-    console.error(`${NAME}: gh api graphql merged read (${prNums.length} PR${prNums.length === 1 ? "" : "s"}) failed (${how}) with no usable answer; they read as not merged`);
-    return [];
+    const n = prNums.length;
+    console.error(`${NAME}: gh api graphql merged read (${n} PR${n === 1 ? "" : "s"}) failed (${how}) with no usable answer`);
+    return none;
   }
-  return prNums.filter((n) => repo[`p${n}`]?.state === "MERGED");
+  return {
+    merged: prNums.filter((n) => repo[`p${n}`]?.state === "MERGED"),
+    closed: prNums.filter((n) => repo[`p${n}`]?.state === "CLOSED"),
+    closedIssues: issueNums.filter((n) => repo[`i${n}`]?.state === "CLOSED"),
+  };
 }
 
 // labels: gh emits an array of {name,...} objects, but a malformed row can
@@ -692,7 +704,7 @@ export async function gather({ ledgerFile, prevFile, stateFile = null, scriptDir
       // JSON.parse SUCCEEDS on `null`, a bare number, a string and an array,
       // none of which is a board; `null` in particular is absent, not an
       // object, and `typeof null` alone would let it through. Same check and
-      // same wording as readMerged()'s `data.repository` read, which is this
+      // same wording as readStates()'s `data.repository` read, which is this
       // repo's precedent for rejecting a parsed-but-wrong payload at its own
       // read — literally the same, both calling the shared predicate.
       const p = JSON.parse(readFileSync(prevFile, "utf8"));
@@ -711,7 +723,7 @@ export async function gather({ ledgerFile, prevFile, stateFile = null, scriptDir
         // (drop the bad entry, keep the rest) would make this a new, fourth policy for
         // one payload class in this file — mapCi's null-only guard and tryParse's
         // unguarded read are the other two — rather than the reject-whole-payload
-        // policy this guard already shares with readMerged()'s own read.
+        // policy this guard already shares with readStates()'s own read.
         const bad = p.tickets.findIndex((t) => !isJsonObject(t));
         if (bad !== -1)
           throw new TypeError(`expected tickets[${bad}] to be a JSON object, got ${jsonKind(p.tickets[bad])}`);
@@ -805,11 +817,13 @@ export async function gather({ ledgerFile, prevFile, stateFile = null, scriptDir
   // <sha>`, and the open list above drops a PR the moment it merges. It is
   // asked only about mergedReadPrs()'s set — row PRs absent from the open
   // list, with no token, not carried forward — in one batched read
-  // that answers whatever their merge age; see readMerged(). A failed read
-  // is `[]`, and the carry-forward in computeBoard() covers exactly the
-  // PRs this set leaves out, so a failure costs only a PR never yet seen
-  // MERGED, which reads REVIEW.
-  const merged = await readMerged(mergedReadPrs({ ledger, prs, prev }));
+  // that answers whatever their merge age; see readStates(). A failed read
+  // leaves every list empty, and the carry-forward in computeBoard() covers
+  // exactly the PRs this set leaves out, so a failure costs only a PR never
+  // yet seen MERGED, which reads REVIEW — and flags no pr-closed, since the
+  // closed lists are empty too.
+  const asked = mergedReadPrs({ ledger, prs, prev });
+  const { merged, closed, closedIssues } = await readStates(asked, issuesOfPrs({ ledger, prs: asked }));
 
   // CI per open PR. On failure, carry the previous board's value for that PR.
   const prevCi = new Map((prev?.tickets || []).filter((t) => t.pr != null).map((t) => [t.pr, t.ci]));
@@ -869,7 +883,7 @@ export async function gather({ ledgerFile, prevFile, stateFile = null, scriptDir
   // stalled, so a healthy board reads none. computeBoard() words it.
   const now = Date.now();
   const stallOwnerOf = isStalled(assessBeat({ beat, ticked, acted, controller, now })) ? stallOwner(controller, NAME) : null;
-  return { ledger, issues, prs, merged, ci, prev, repo, repoUrl, workspace, port, spend, beat, ticked, acted, controller, stallOwner: stallOwnerOf, poolOk,
+  return { ledger, issues, prs, merged, closed, closedIssues, ci, prev, repo, repoUrl, workspace, port, spend, beat, ticked, acted, controller, stallOwner: stallOwnerOf, poolOk,
     poolCapped, prsCapped,
     now, interval };
 }

package/scripts/compute-board.mjs

@@ -197,7 +197,8 @@ export function parseRow(row) {
   const alive = live.filter((e) => !settled.has(e.name));
   const implOutcome = lastImpl ? (implOutcomes.get(lastImpl.name) ?? null) : null;
   const prM = implOutcome && /^PR#(\d+)$/.exec(implOutcome);
-  let pr = prM ? Number(prM[1]) : null;
+  const implPr = prM ? Number(prM[1]) : null;
+  let pr = implPr;
   // A row with NO impl token — a malformed one still
   // counts, since that row's key is a ticket — is keyed, once THIS row
   // carries a PR-bound signal, the way fleet-tick.mjs's rowPr-then-
@@ -217,6 +218,7 @@ export function parseRow(row) {
     excluded,
     impl: lastImpl?.name ?? null,
     implOutcome,
+    implPr,
     agent: alive.length ? alive[alive.length - 1].name : null,
     pr,
     merged: !!mergedM,
@@ -287,8 +289,12 @@ export function deriveFlags(parsed, ctx) {
   if (ctx.finisher?.startsWith("halted:") && ctx.column === "REVIEW") flags.push(ctx.finisher);
   if (ctx.finisher === "labelled" && ctx.column === "REVIEW") flags.push("unlabelled");
   if ((ctx.finisher === "failed" || ctx.finisher === "killed") && ctx.column === "REVIEW") flags.push(`finisher:${ctx.finisher}`);
+  // A closed-unmerged PR's card reads `pr-closed` in place of `stale`: the
+  // closed PR is what a reader has to act on, not how long the card has sat.
+  const prClosed = ctx.prClosed === true && ctx.column === "REVIEW";
+  if (prClosed) flags.push("pr-closed");
   const limit = STALE_MS[ctx.column];
-  if (limit != null && ctx.sinceEnteredStage != null && ctx.now - ctx.sinceEnteredStage > limit) {
+  if (!prClosed && limit != null && ctx.sinceEnteredStage != null && ctx.now - ctx.sinceEnteredStage > limit) {
     flags.push("stale");
   }
   return flags;
@@ -315,7 +321,7 @@ function titleFor(issue, pr, issues) {
 }
 
 const FLAG_SEVERITY = {
-  "red-ci": 5, "ledger-error": 5, killed: 4, "tier-mismatch": 4, blocked: 4, "sha-off-branch": 4, unlabelled: 4,
+  "red-ci": 5, "ledger-error": 5, killed: 4, "tier-mismatch": 4, "pr-closed": 4, blocked: 4, "sha-off-branch": 4, unlabelled: 4,
   "finisher:failed": 4, "finisher:killed": 4,
   ...Object.fromEntries(HALT_CAUSES.map((c) => [`halted:${c}`, 4])),
   stale: 1,
@@ -432,6 +438,20 @@ export function mergedReadPrs({ ledger, prs, prev }) {
   return [...need].sort((a, b) => a - b);
 }
 
+// The ticket issues whose row's latest settled impl PR is one of `prs`, sorted
+// and once each. gather() reads their state in the same call as the PR read;
+// computeBoard() takes the CLOSED ones as `closedIssues`. An Exclusion is none.
+// An issue number outside Number.isSafeInteger is left out for the reason
+// mergedReadPrs() leaves such a PR out: its `i1e+21` alias would fail the
+// whole batched query, PR aliases included.
+export function issuesOfPrs({ ledger, prs }) {
+  const set = new Set(prs);
+  const issues = (ledger.rows || []).map(parseRow).filter(Boolean)
+    .filter((p) => !p.excluded && p.implPr != null && set.has(p.implPr) && Number.isSafeInteger(p.issue))
+    .map((p) => p.issue);
+  return [...new Set(issues)].sort((a, b) => a - b);
+}
+
 // `merged` is gh's list of merged PR numbers, consulted only for a row
 // PR absent from the open list `prs`; absent means none known, and a PR in
 // neither list (closed unmerged, or a failed read) keeps REVIEW — unless
@@ -441,10 +461,16 @@ export function mergedReadPrs({ ledger, prs, prev }) {
 // this carry-forward — only the "absent from both `prs` and (maybe)
 // `merged`" branch below ever consults it. gather() asks gh only about
 // mergedReadPrs()'s set, so `merged` never lists more than that.
+// `closed` is the same read's CLOSED PRs, and `closedIssues` the CLOSED issues
+// among issuesOfPrs(). A pr-closed flag needs both: a missing `closed`
+// flags nothing, and a failed issue read reads as not CLOSED, as closedTickets()
+// reads its own failed probe.
 export function computeBoard(inputs) {
   const { ledger, issues, prs, ci, prev, now } = inputs;
   const prByNum = new Map(prs.map((p) => [p.number, p]));
   const mergedPrs = new Set(inputs.merged || []);
+  const closedPrs = new Set(inputs.closed || []);
+  const closedIssues = new Set(inputs.closedIssues || []);
   const prevByIssue = new Map((prev?.tickets || []).map((t) => [t.issue, t]));
   const ruledByPr = new Map();
   for (const r of ledger.ruled || []) {
@@ -501,7 +527,8 @@ export function computeBoard(inputs) {
     rowIssues.add(p.issue);
     const sinceEnteredStage = stageEntry(prevTicket, column, now);
     const ciState = p.pr != null ? (ci[p.pr] ?? "unknown") : null;
-    const flags = deriveFlags(p, { ci: ciState, column, sinceEnteredStage, now, finisher: latestFinishers.get(p.pr) });
+    const prClosed = pr === undefined && p.implPr != null && closedPrs.has(p.pr) && !closedIssues.has(p.issue);
+    const flags = deriveFlags(p, { ci: ciState, column, sinceEnteredStage, now, finisher: latestFinishers.get(p.pr), prClosed });
     tickets.push({
       issue: p.issue,
       title: titleFor(p.issue, pr, issues),

package/scripts/release-ticket.sh

@@ -1,9 +1,20 @@
 #!/bin/sh
-# Release a claim that was never dispatched: drop the in-progress label, remove
-# the worktree, delete the branch — but only when the claim provably carries no
-# work. The inverse of claim-ticket.sh.
+# Release a claim: drop the in-progress label, remove the worktree, delete the
+# branch — but only when the claim provably carries no work. The inverse of
+# claim-ticket.sh. Two claim shapes release, told apart by the branch on origin:
 #
-# Dry-run by default; --apply mutates the tracker and the filesystem.
+# - Never dispatched: no branch on origin. The branch must carry no commit
+#   beyond origin/main and no commit unique to it.
+# - Closed unmerged: the branch is on origin, and every PR of this repository
+#   whose head is that branch reads CLOSED — none OPEN, none MERGED, at least
+#   one present. The local branch must sit at the tip origin holds. Under
+#   --apply origin's tip is read again right before the remote branch is
+#   deleted, and that delete runs before the label drops. It is a plain one,
+#   not leased on the tip: a push landing between the re-read and the delete
+#   goes with the branch. A branch on origin with no PR, or with a PR list that
+#   cannot be read, blocks.
+#
+# Dry-run by default; --apply mutates the tracker, the remote and the filesystem.
 #
 # reap.sh will not do this: no merge happened, so no remote branch was ever
 # deleted, so the branch is not [gone] and reap's for-each-ref filter never
@@ -15,8 +26,10 @@
 # Every precondition is recomputed inside THIS invocation rather than trusted
 # from an earlier tool call, for the reason reap.sh gives: the dangerous
 # direction is a worktree that gained work after it was checked. Two of them are
-# recomputed a second time at the moment of the delete, which is why both
-# deletes run before the label is dropped rather than after.
+# recomputed a second time at the moment of the delete, and in closed mode
+# origin's tip is re-read at the remote delete as well, which is why every
+# delete — the remote one included — runs before the label is dropped rather
+# than after.
 #
 # The dirty check's second opinion is git's own — that is what `worktree remove`
 # without --force is for. It covers the live-directory case ONLY: `worktree
@@ -27,7 +40,8 @@
 #
 # The commit check's is this script's own: the compare-and-swap delete refuses
 # only a ref that moved, so the `ahead` count is re-run against $base right
-# before it. Why not `-d`, and what that recount does and does not cover, is
+# before it — in closed mode, a compare of the local tip against the tip origin
+# held instead. Why not `-d`, and what that recount does and does not cover, is
 # argued once at the delete site below — don't restate it here.
 set -eu
 
@@ -854,6 +868,44 @@ if [ -z "$wt" ] && [ -n "$stray" ]; then
   fi
 fi
 
+# A pushed branch — work that survives the local delete and that a PR may
+# already point at. Live query, so this one cannot be stale; a failure here is
+# an unknown answer, never a "no".
+# stderr stays on stderr, never folded into the value: the emptiness of $remote
+# IS the answer, so an SSH host-key notice on a successful query used to read as
+# a branch that exists. git's own message is more useful on the terminal anyway.
+# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
+# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
+# is the shorten-only override this lookup shares with the fleet's fetches — but
+# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
+# and nothing else, so shortening this one does not shorten that one. The rule
+# is net_budget's, in net.sh.
+ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
+ls_rc=0
+remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
+if [ "$ls_rc" -ne 0 ]; then
+  # A killed lookup and a refused one are different facts and get different
+  # words. Both leave the same verdict — the answer is unknown, so nothing is
+  # released — but only one of them names a cause this script observed.
+  if net_stalled "$ls_rc"; then
+    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
+  fi
+  die "git ls-remote failed, so whether $branch was pushed is unknown"
+fi
+
+# The tip origin holds, split off ls-remote's `<sha><TAB><ref>` line on the tab
+# itself rather than on a `[:space:]` class, which would put a locale-sensitive
+# construct under the `export LC_ALL=C` paragraph above that says there is none.
+# Whether this pushed branch is the one that releases is a tracker question,
+# asked below once nothing local blocks.
+tab=$(printf '\t')
+remote_sha=
+if [ -n "$remote" ]; then
+  remote_sha=${remote%%"$tab"*}
+  [ "${remote#*"$tab"}" = "refs/heads/$branch" ] ||
+    die "git ls-remote did not answer with refs/heads/$branch for $branch, so whether it was pushed is unknown"
+fi
+
 # An Orphaned worktree directory: this claim's directory still on disk with its
 # registration already cleared. `stray` cannot see it BY CONSTRUCTION — it is
 # awk over git's registry, and there is no registration left to match — so the
@@ -893,7 +945,10 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
     block "worktree directory $orphan is this claim's and has no registration — inspect it and remove the directory by hand"
   elif ! gone "$orphan"; then
     block "cannot tell whether an orphaned worktree directory is at $orphan, so whether #$issue can be released is unknown"
-  elif [ "$has_branch" = false ] && [ -z "$blockers" ]; then
+  elif [ "$has_branch" = false ] && [ -z "$blockers" ] && [ -z "$remote" ]; then
+    # A branch of this name on origin proves the slug right, so the die below
+    # does not fire: a closed-PR claim whose local branch is already gone
+    # releases from the remote alone.
     # A mistyped <slug>/<type> names a branch that does not exist, and without
     # this die the run would drop the label off a ticket whose real claim is
     # untouched — invisible to candidates.mjs and still in-flight. Refuse
@@ -927,7 +982,18 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
   fi
 fi
 
-if [ "$has_branch" = true ]; then
+# A closed PR's commits are the branch's whole content, so `ahead` and the `git
+# cherry` count below would refuse every one — and the PR states that tell a
+# closed-PR claim from any other pushed branch are not read until the blockers
+# below are known. So a branch on origin is held to one check here: the local
+# branch must sit at the tip origin holds. Any commit it carries beyond that is
+# unpushed, and the local delete would take it with the branch.
+if [ "$has_branch" = true ] && [ -n "$remote" ]; then
+  local_tip=$(git rev-parse --verify "refs/heads/$branch") ||
+    die "cannot read $branch's tip, so whether it matches origin's is unknown"
+  [ "$local_tip" = "$remote_sha" ] ||
+    block "$branch is not at the tip origin holds — unpushed work would be lost"
+elif [ "$has_branch" = true ]; then
   # Commits ahead — a member that did work. Measured on the branch ref rather
   # than the worktree's HEAD: the worktree above was located BY that ref, so the
   # two agree, and this still runs when the worktree is already gone.
@@ -951,32 +1017,6 @@ if [ "$has_branch" = true ]; then
   [ "$uniq" -eq 0 ] || block "$uniq commit(s) unique to $branch (git cherry)"
 fi
 
-# A pushed branch — work that survives the local delete and that a PR may
-# already point at. Live query, so this one cannot be stale; a failure here is
-# an unknown answer, never a "no".
-# stderr stays on stderr, never folded into the value: the emptiness of $remote
-# IS the answer, so an SSH host-key notice on a successful query used to read as
-# a branch that exists. git's own message is more useful on the terminal anyway.
-# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
-# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
-# is the shorten-only override this lookup shares with the fleet's fetches — but
-# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
-# and nothing else, so shortening this one does not shorten that one. The rule
-# is net_budget's, in net.sh.
-ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
-ls_rc=0
-remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
-if [ "$ls_rc" -ne 0 ]; then
-  # A killed lookup and a refused one are different facts and get different
-  # words. Both leave the same verdict — the answer is unknown, so nothing is
-  # released — but only one of them names a cause this script observed.
-  if net_stalled "$ls_rc"; then
-    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
-  fi
-  die "git ls-remote failed, so whether $branch was pushed is unknown"
-fi
-[ -z "$remote" ] || block "branch $branch exists on origin"
-
 # `-d`, because a directory that is not there holds no uncommitted work. Deleted
 # by hand, a worktree leaves its admin files registered, so `worktree list
 # --porcelain` keeps listing the entry and the status below ran against a path
@@ -1197,10 +1237,52 @@ if [ -n "$wt" ]; then
   fi
 fi
 
-# Report the blockers before asking GitHub anything. The answer cannot change —
-# every artefact stays put either way — and reaching for the tracker first turns
-# an offline blocked claim into an unanswerable one, burying the finding the
-# caller actually needs. "label":null says it was never read.
+# The one pushed branch that releases: every PR of this repository whose head
+# is $branch reads CLOSED, and there is at least one. Read live, and failing
+# closed — a PR list that cannot be read is an unknown answer, as the lookup
+# above is. Any other pushed branch blocks, as it always did.
+#
+# Asked only once every local check has had its say and none blocked, for the
+# reason the report below gives: a claim already blocked is answered, and a
+# tracker that cannot be reached must not turn it into an exit 2 with no
+# receipt. Such a claim names its pushed branch as one more blocker instead,
+# without the PR states nothing asked for.
+closed_pr=false
+pr_seen=
+if [ -n "$remote" ] && [ -n "$blockers" ]; then
+  block "branch $branch exists on origin"
+elif [ -n "$remote" ]; then
+  # One `number:state` token per PR, so the loop below needs no JSON parser.
+  # --limit 1000: gh's default page of 30 would hide a later OPEN PR.
+  # `--head` matches a head branch NAME, from any fork, so a fork's PR whose
+  # branch shares this one's name is dropped before it is counted — the filter
+  # delete-merged-branch.sh applies to its own `--head` lookup. Without it, a
+  # fork's closed PR would read as this branch's and release a branch no PR of
+  # ours names.
+  prs=$(gh pr list --state all --head "$branch" --limit 1000 --json number,state,isCrossRepository \
+    --jq '.[] | select(.isCrossRepository | not) | "\(.number):\(.state)"') ||
+    die "gh pr list failed for $branch, so whether its PR closed unmerged is unknown"
+  pr_bad=
+  for pr in $prs; do
+    pr_seen="$pr_seen #${pr%%:*} ${pr#*:};"
+    case ${pr#*:} in
+      CLOSED) ;;
+      *) pr_bad="$pr_bad #${pr%%:*} ${pr#*:};" ;;
+    esac
+  done
+  if [ -z "$pr_seen" ]; then
+    block "branch $branch exists on origin and no PR names it"
+  elif [ -n "$pr_bad" ]; then
+    block "branch $branch exists on origin and its PR(s) are not closed unmerged:$pr_bad"
+  else
+    closed_pr=true
+  fi
+fi
+
+# Report the blockers before asking GitHub anything more. The answer cannot
+# change — every artefact stays put either way — and reaching for the tracker
+# first turns an offline blocked claim into an unanswerable one, burying the
+# finding the caller actually needs. "label":null says it was never read.
 if [ -n "$blockers" ]; then
   echo "$NAME: #$issue NOT released — nothing was touched" >&2
   printf '{"issue":%s,"branch":"%s","branchRewritten":%s,"worktree":"%s","worktreeRewritten":%s,"label":null,"released":false,"applied":%s,"blockers":[%s]}\n' \
@@ -1242,6 +1324,10 @@ if [ "$apply" = false ]; then
   [ "$has_label" = true ] && echo "    would: gh issue edit $issue --remove-label in-progress" >&2
   [ -n "$wt" ] && printf '    would: git worktree remove %s\n' "$wt" >&2
   [ "$has_branch" = true ] && echo "    would: git update-ref -d refs/heads/$branch <its current tip>" >&2
+  if [ "$closed_pr" = true ]; then
+    echo "    PR states on $branch:$pr_seen" >&2
+    echo "    would: git push origin --delete refs/heads/$branch (origin read at $remote_sha)" >&2
+  fi
 else
   # Label LAST. The two local deletes are the ones that refuse — that refusal is
   # the dirty check recomputed by git at the moment of the delete, so it is
@@ -1249,7 +1335,10 @@ else
   # left in-progress already gone: with the worktree still standing the ticket
   # read free to candidates.mjs while re-claiming failed on the existing branch.
   # Run them first and a refusal leaves the claim exactly as it was, label and
-  # all, which reads as still taken — the direction that costs nothing.
+  # all, which reads as still taken — the direction that costs nothing. Closed
+  # mode's remote delete runs after them, and ahead of the label for the same
+  # reason.
+
   if [ -n "$wt" ]; then
     # No --force, ever. A refusal is a finding to report, never something to
     # force past. Quote git's own reason: this fires precisely when something
@@ -1294,8 +1383,16 @@ else
       halt "cannot read $branch's tip at the delete"
     n=$(git rev-list --count "$base_rev..$tip") ||
       halt "cannot recount commits on $branch against $base at the delete"
-    [ "$n" -eq 0 ] ||
-      halt "$branch gained $n commit(s) since the checks — not deleted"
+    if [ "$closed_pr" != true ]; then
+      [ "$n" -eq 0 ] ||
+        halt "$branch gained $n commit(s) since the checks — not deleted"
+    else
+      # A closed PR's commits are the whole content of the branch, so the
+      # recount above refuses every one of them. What holds instead: the local
+      # tip has not moved off the tip origin held when the checks read it.
+      [ "$tip" = "$remote_sha" ] ||
+        halt "$branch is no longer at the tip origin holds — not deleted"
+    fi
 
     # What the CAS does not give back: `git update-ref` is ref-only plumbing
     # and, unlike `-D`, consults no worktree at all — so the one guard the CAS
@@ -1371,6 +1468,47 @@ else
     done_branch=true
   fi
 
+  # Closed mode only: the remote branch goes after the local one and before the
+  # label drops, for the same reason as the local deletes above.
+  #
+  # Origin is read again first, so a push that landed since the checks halts
+  # the release here rather than going with the branch. Here, beside the remote
+  # delete, and not inside the local branch delete: a closed-PR claim whose
+  # local branch is already gone releases from the remote alone, and has no
+  # local delete to hang the re-read on. The delete itself is a plain one: a
+  # push landing in the gap between that re-read and this call is deleted with
+  # the branch. A lease would close that gap, but this file spells no form of
+  # force, so the gap stays.
+  #
+  # A non-zero rc does not say the delete failed to land: the watchdog can kill
+  # the push after origin applied it. So a failed push is followed by a read of
+  # origin, as delete-merged-branch.sh does, and the halt names what origin
+  # holds rather than calling every non-zero rc a refusal. A branch already gone
+  # from origin is the outcome this step exists for, whoever removed it.
+  if [ "$closed_pr" = true ]; then
+    recheck=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+      halt "cannot re-read origin's $branch before the delete — not deleted"
+    [ "${recheck%%"$tab"*}" = "$remote_sha" ] ||
+      halt "origin's $branch moved since the checks — not deleted"
+
+    # $ls_budget: a ref-only `push --delete` moves no objects either, so it
+    # shares the lookup's budget, as delete-merged-branch.sh's own push does.
+    echo "\$ git push origin --delete refs/heads/$branch" >&2
+    push_rc=0
+    net_git "" "$ls_budget" push origin --delete "refs/heads/$branch" >&2 || push_rc=$?
+    if [ "$push_rc" -ne 0 ]; then
+      echo "\$ git ls-remote --heads origin refs/heads/$branch" >&2
+      back=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+        halt "git push --delete exited $push_rc and origin could not be read back, so whether origin still holds $branch is unknown"
+      if [ -n "$back" ] && net_stalled "$push_rc"; then
+        halt "git push --delete did not finish within ${ls_budget}s and was killed — origin still holds $branch"
+      elif [ -n "$back" ]; then
+        halt "git push --delete refused $branch on origin (rc $push_rc) — origin still holds it"
+      fi
+    fi
+    done_branch=true
+  fi
+
   if [ "$has_label" = true ]; then
     echo "\$ gh issue edit $issue --remove-label in-progress" >&2
     gh issue edit "$issue" --remove-label in-progress >/dev/null ||

package/skills/run-team/references/reaping.md

@@ -58,10 +58,12 @@ So nothing in the run cleans it up. Next run, the in-flight probe's local-worktr
 
 - **`ahead` + dirty catch a member that did work.** `ahead` against `origin/main`. Not redundant with `git cherry`: commit already cherry-picked upstream is upstream-equivalent (`-` line, not `+`), and only `ahead` still sees it. Pinned by a test.
 - **`git cherry` catches commits that exist only locally.** Against `origin/main`, never a local main — same trap reap has.
-- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server.
+- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server. A pushed branch blocks unless it is the closed-unmerged shape below.
 - **Label read first, `gh` failure fatal.** Worktree and branch gone with `in-progress` left behind hides the ticket from `candidates.mjs` entirely — worse than not releasing. All three artefacts or none.
 
-**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
+**One pushed branch releases: a claim whose PR closed unmerged.** Every PR of this repository whose head is the branch reads CLOSED — none OPEN, none MERGED, at least one present. Read with `gh pr list` only once no local check blocks, so a blocked claim still reports without asking GitHub; a list that cannot be read, or names no PR, blocks. `ahead` and `git cherry` do not apply — a closed PR's commits are the branch's whole content — so the local branch must sit at the tip origin holds instead, re-checked at the local delete. The remote branch is a fourth artefact: `--apply` deletes it after the local deletes and before the label drops, re-reading origin's tip first and halting if it moved. A plain delete, not leased on that tip, so a push landing between the re-read and the delete goes with the branch. A delete whose `git push` fails is read back from origin: gone counts as done.
+
+**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. In the closed-unmerged shape the tip-at-origin check and its re-check at the delete stand in for `ahead`, `git cherry` and the recount; the worktree check stays. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
 
 **A checkout that lands between that fresh check and the delete halts the release after it.** `git worktree add` of an existing branch does not move the ref, so the compare-and-swap succeeds under it. The same `wt_recheck_delete` reap uses then finds the worktree, recreates the branch at the tip, and the release halts with exit 2, `released:false` and a blocker naming that worktree — the shape of a holder caught before the delete. A restore that fails halts the same way, with the tip and the repair command in the blocker.