@feigi/fleet-ctl 3.83.0 → 3.83.2

package/commands/run-merge-bot.md

@@ -226,7 +226,7 @@ For each labeled PR clearing the hold rule, lowest first:
      --out <scratch>/pr<N>/merge-bot-<n>/ci.json; rc=$?
    ```
 
-   `--pre` is the head you recorded at **The labelled head**; `--post` is the head step 1's rebase produced — omit it when no rebase ran, which is the same as passing `pre` twice. `pr<N>` is this PR and `merge-bot-<n>` is your own name, so the reading lands under a directory only you write, never in the scratch root by itself: `<scratch>` is the absolute path your dispatch prompt names, and that root is shared with every sibling. The gate is read-only — it runs the instrument re-check, `gh pr view <pr> --json labels,reviewDecision,headRefOid,body`, the main-gain check against that head in the main checkout, the rebase-carry proof when that head is neither `pre` nor `post`, and `ci-state.mjs --pr <pr>`, answers their conjunction, and never merges, labels, rebases or waits. Stdout is exactly one JSON line, `{pr, verdict, reason, head, pre, post, rebaseCarry, behind, instruments, mainGain, ci}`; stderr is its children's diagnostics, so never fold `2>&1` into the line you read. Read `rc` straight off the call, as above — never through a pipe.
+   `--pre` is the head you recorded at **The labelled head**; `--post` is the head step 1's rebase produced — omit it when no rebase ran, which is the same as passing `pre` twice. `pr<N>` is this PR and `merge-bot-<n>` is your own name, so the reading lands under a directory only you write, never in the scratch root by itself: `<scratch>` is the absolute path your dispatch prompt names, and that root is shared with every sibling. The gate is read-only — it runs the instrument re-check, `gh pr view <pr> --json labels,reviewDecision,headRefOid,body`, the main-gain check against that head in the main checkout, the rebase-carry proof when that head is neither `pre` nor `post`, and `ci-state.mjs --pr <pr>`, answers their conjunction, and never merges, labels, rebases or waits. Stdout is exactly one JSON line, `{pr, verdict, reason, head, bodyDigest, pre, post, rebaseCarry, behind, instruments, mainGain, ci}`; stderr is its children's diagnostics, so never fold `2>&1` into the line you read. Read `rc` straight off the call, as above — never through a pipe.
 
    **Run a plain `git fetch origin` in the main checkout before every gate run** — never `git fetch origin <src>:<dst>`, for the reason step 1's fallback gives. The main-gain check and the rebase-carry proof read `origin/main` and the head objects there as they stand and fetch nothing themselves: an unfetched head is `main-gain-unanswerable`, an unheld labelled or carried head is no carry, and a stale `origin/main` is a check against the wrong `main`.
 
@@ -236,7 +236,7 @@ For each labeled PR clearing the hold rule, lowest first:
    Each `reason` is a fact the gate now enforces, not a step you run:
 
    - **`head-moved-after-label`** — the PR head is neither `pre` nor `post`, nor a head whose net change the gate proved identical to `pre`'s (`rebaseCarry`, which names both). **Any third SHA is a push that landed while you waited on CI, and no CI check can see it**: `ci-state.mjs` selects the run whose `headSha` equals the *current* PR head (`scripts/ci-state.mjs`, the `r.headSha === prHead` filter), so a member's push plus its own green run satisfies every CI check while the audit behind the label belongs to a tree that is gone. A carry is proven only for the head `gh pr view` read; a different head at `ci-state`'s own read is still this row. The remedy is a fresh finisher against the new head, label untouched.
-   - **`main-gain-removed:<path>`** — merging this head would remove lines `main` gained after the PR's work began: lines a later merge landed, deleted by a branch commit that every rebase since has replayed without a conflict, so no conflict preview and no `origin/main...HEAD` read is sure to show them. `mainGain.hits[]` names each file, the landing key (`#<n>` for a merged PR, else the landing commit's 12-character SHA), the removed lines, and the `ack` line to copy. Skip the PR, leave the label alone, and report `main-gain-removed:<path>-#<pr>` with the hit list and the keys. Never restore the lines yourself — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for every hit; the gate reads the body each run, so editing it is enough. An acknowledged removal is listed in `mainGain.acknowledged[]` and the gate passes it — name each one, with its reason, in your report.
+   - **`main-gain-removed:<path>`** — merging this head would remove lines `main` gained after the PR's work began: lines a later merge landed, deleted by a branch commit that every rebase since has replayed without a conflict, so no conflict preview and no `origin/main...HEAD` read is sure to show them. `mainGain.hits[]` names each file, the landing key (`#<n>` for a merged PR, else the landing commit's 12-character SHA), the removed lines, and the `ack` line to copy. Skip the PR, leave the label alone, and report `main-gain-removed:<path>-#<pr>` with the hit list and the keys. Never restore the lines yourself — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for every hit; the gate reads the body each run, so editing it is enough. An acknowledged removal is listed in `mainGain.acknowledged[]` and the gate passes it — name each one, with its reason, in your report. Your report's `refused[]` entry for the PR carries the gate's `reason` as it printed it, `main-gain-removed:<path>`, and the gate's `--out` file above stays where the gate wrote it: the controller parks the PR off that entry, at the `head` and `bodyDigest` that file records the gate refused, and no merge bot is dispatched on the PR's account until its head or its body changes — though a bot dispatched for another queued PR may still evaluate it again.
    - **`main-gain-unanswerable`** — the main-gain check could not answer: a head object the main checkout does not hold after `git fetch origin`, a merge that does not resolve cleanly, a blame that failed. `mainGain.reason` says which. Stop and report `main-gain-unanswerable-#<pr>` with it, label untouched.
    - **`behind:<n>`** — you are the only place currency is proven, and a sibling merge since your rebase expires it (the staleness below).
    - **`instrument-set-changed` / `instruments-unanswerable`** — the instrument re-check the controller runs before its own gates (`run-team/SKILL.md`, **You read your instruments out of a tree every member can write to**), taken at this seat because nothing dispatches a merge bot to read that rule. Report `<reason>-#<pr>` with what the gate printed, leave the label alone, and do **not** re-run the gate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.83.0",
+  "version": "3.83.2",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/fleet-event.mjs

@@ -72,9 +72,15 @@
 //       A settle that refuses on `ready-to-merge` — missing from the PR or from the read-back — is the case the tick's `DISPATCH finisher PR#<M>` catches next: settle it `ledger.mjs settle finisher-pr-<M>=labelled` as reported, and `ledger.mjs filed <N> "<subject>"` for each `unrecorded` entry.
 //   merge-bot-report <merge-bot-n>
 //       `ledger.mjs token <pr> held-behind:#<behind>` for each `held[]` entry
-//       of the report the PR's rows do not already carry, then `settle
-//       --from-report`. The reap and the reclaim run under the tick's
-//       `--apply`.
+//       of the report the PR's rows do not already carry, then `ledger.mjs
+//       token <pr> parked=<head>:<body digest>:<reason>` for each `refused[]`
+//       entry whose reason is `main-gain-removed:<path>`, bound to the head
+//       and body digest the bot's gate reading `<scratch>/pr<pr>/<merge-bot-n>/ci.json`
+//       records it refused, unless the rows already carry it (a reading that
+//       is missing or is not that refusal is a NEED, nothing written), then
+//       `settle --from-report`.
+//       Every other refusal reason writes nothing. The reap and the reclaim
+//       run under the tick's `--apply`.
 //       The verdict moves no label and leaves nothing in the repo, so the row is the only place the tick can read a `held-behind` from.
 //       The reap and the reclaim run once for every merge bot settled `done`, always, even when the pass merged nothing, and again on the next tick after an `APPLY FAILED` line, and on every tick while this run has no controller record to remember the pass by.
 //       The bot may also have written `conflict-hold:#<pr>` onto a held PR's own row earlier in the same pass, before reporting: a token the bot wrote in that pass, never one `reap.sh` writes.
@@ -188,7 +194,7 @@ import { FleetDirUnresolvable, fleetFile } from "./fleet-dir.mjs";
 import { gitEnv } from "./git-env.mjs";
 import { isCLI } from "./is-cli.mjs";
 import { BRIEFS, REVIEW, REVIEWED, REVIEWER, memberTokens, nextReviewerName, parseDispatchedEntry, parseMember, parseToken, readRetired, rowNums } from "./ledger-grammar.mjs";
-import { NO_TRANSCRIPT_AFTER_DEFAULT, controllerState, dispositionsToken, foldLedger } from "./fleet-tick.mjs";
+import { NO_TRANSCRIPT_AFTER_DEFAULT, PARKS, controllerState, dispositionsToken, foldLedger, parkedToken } from "./fleet-tick.mjs";
 import { phase0Gate, readRunReceipt, tickCaps } from "./phase0-receipt.mjs";
 import { defaultScratch, readReportIn, reportsDir } from "./report-files.mjs";
 import { readState, statePath } from "./fleet-state.mjs";
@@ -636,9 +642,46 @@ function mergeBotReport(ev, member) {
     if (r.status === 0) ev.note(`#${pr} ${tok}`);
     else ev.refuse(`token #${pr} ${tok}`, r);
   }
+  for (const { pr, reason } of read.state === "ok" ? read.report.refused : []) {
+    if (PARKS.test(reason)) park(ev, member, pr, reason);
+  }
   ev.settle(member);
 }
 
+// `ledger.mjs token <pr> parked=<head>:<body digest>:<reason>` for a refusal
+// only a human edit clears, bound to the head and body the gate refused: the
+// bot's own gate reading, `<scratch>/pr<pr>/<member>/ci.json` (run-merge-bot.md
+// step 3's `--out`), never a read taken now, so a push or a body edit landing
+// after the refusal is never what gets parked. Skipped when the PR's rows
+// already carry that token. A reading that cannot be read, is not JSON, is not
+// this refusal, or carries no full head and body digest is a NEED naming
+// which, nothing written: a park bound to no refused head would never lift.
+function park(ev, member, pr, reason) {
+  const file = join(ev.scratch, `pr${pr}`, member, "ci.json");
+  let g;
+  try {
+    g = JSON.parse(readFileSync(file, "utf8"));
+  } catch (e) {
+    ev.need(`park PR #${pr} ${reason} — the gate reading ${file} ${e instanceof SyntaxError ? "is not JSON" : `cannot be read (${e.code ?? e.message})`}; nothing parked`);
+    return;
+  }
+  const off = g === null || typeof g !== "object" ? "is not a JSON object"
+    : g.pr !== pr || g.verdict !== "blocked" || g.reason !== reason ? `is not this refusal (pr ${g.pr}, verdict ${g.verdict}, reason ${g.reason})`
+    : null;
+  const tok = off === null ? parkedToken(g.head, g.bodyDigest, reason) : null;
+  if (tok === null) {
+    ev.need(`park PR #${pr} ${reason} — the gate reading ${file} ${off ?? `carries no full head and body digest (head ${g.head}, bodyDigest ${g.bodyDigest})`}; nothing parked`);
+    return;
+  }
+  if (prWords(ev.ledger, pr).includes(tok)) {
+    ev.note(`#${pr} already ${tok}`);
+    return;
+  }
+  const w = node("ledger.mjs", ["token", String(pr), tok]);
+  if (w.status === 0) ev.note(`#${pr} ${tok}`);
+  else ev.refuse(`token #${pr} ${tok}`, w);
+}
+
 // `p` with its symlinks resolved, or as written when it does not exist yet.
 function real(p) {
   try {

package/scripts/fleet-tick.mjs

@@ -30,7 +30,9 @@
 //             unsettled `fix-pr-`), the merge bot (`## Dispatched`), merge
 //             holds (`held-behind:#M`, and `conflict-hold:#<pr>`, written by
 //             the merge bot or by the controller off a `CONFLICT` line),
-//             tier mismatches and the drain marker
+//             merge parks (`parked=<head>:<body digest>:<reason>`, written by
+//             `fleet-event.mjs merge-bot-report`), tier mismatches and the
+//             drain marker
 //             all come off it, and so does the ledger half of the In-flight
 //             count: every claimed ticket whose newest `impl-` member is live,
 //             or settled `killed`/`tier-mismatch` and so owed a replacement,
@@ -47,20 +49,22 @@
 //             nothing. Missing or unparsable is depth 0 and a
 //             refresh, never a refusal: the depth only ever bounds PULLs
 //             downward. A file with no `dropped` names no drops.
-//   gh        The open PRs, by label, by whether they close an issue and by
-//             GitHub's `mergeable` — the merge queue, which PRs are owed a
-//             review, which conflict, and the PR half of the In-flight count:
+//   gh        The open PRs, by label, by whether they close an issue, by
+//             GitHub's `mergeable`, and by head and body — the merge queue,
+//             which PRs are owed a review, which conflict, which queued PR
+//             still matches the head and body it was parked at, and the PR
+//             half of the In-flight count:
 //             every open PR that closes an issue, whoever opened it and
 //             whatever its state. Also, for each in-flight `review=` token
 //             whose PR the open list does not carry, and for each ticket's
 //             latest settled `impl-*=PR#<M>` PR the open list does not carry,
-//             that PR's state (`gh pr view`, once per PR): a review cannot
-//             be running against a finished PR, so its dangling token is not
-//             a review unit, and a PR CLOSED unmerged prints an ESCALATE line
-//             for its ticket. And, for each ticket holding the implementer
-//             row on a tier mismatch, owed a replacement, or whose keyed PR
-//             read CLOSED or unread, whether its issue is CLOSED (`gh issue
-//             view`): a closed ticket's mismatch holds nothing, its owed
+//             that PR's state (one `gh api graphql` read per hundred PRs): a
+//             review cannot be running against a finished PR, so its dangling
+//             token is not a review unit, and a PR CLOSED unmerged prints an
+//             ESCALATE line for its ticket. And, for each ticket holding the
+//             implementer row on a tier mismatch, owed a replacement, or whose
+//             keyed PR read CLOSED or unread, whether its issue is CLOSED (`gh
+//             issue view`): a closed ticket's mismatch holds nothing, its owed
 //             replacement is not in flight, and its PR prints no line.
 //   main      The main checkout against the run-start baseline
 //             `.fleet/main-checkout.sha`, through main-checkout.mjs.
@@ -445,14 +449,23 @@ function reviewers(s) {
 
 function mergeBot(s) {
   // Cap is 1 by invariant, not by configuration.
-  const row = mkRow("merge-bot", s.mergeBotLive, 1, `merge-queue=${s.mergeQueue} held=${s.mergeHeld}`);
+  const parked = s.mergeParked;
+  const row = mkRow("merge-bot", s.mergeBotLive, 1,
+    `merge-queue=${s.mergeQueue} held=${s.mergeHeld}${parked.length > 0 ? ` parked=${parked.length}` : ""}`);
   if (s.mergeBotLive >= 1) return row("AT CAP");
   if (s.mergeQueue === 0) return row("IDLE OK");
   // `ready-to-merge` is the author's sign-off and nothing more. A bot
   // dispatched against a queue whose candidates are all held — behind a lower
-  // open PR, or on a conflict merge-bot already refused to force —
-  // spends a whole member re-deriving a verdict already recorded.
-  if (s.mergeQueue - s.mergeHeld <= 0) {
+  // open PR, or on a conflict merge-bot already refused to force — or parked
+  // on a refusal only a human edit clears spends a whole member re-deriving a
+  // verdict already recorded.
+  if (s.mergeQueue - s.mergeHeld - parked.length <= 0) {
+    if (parked.length > 0) {
+      return row(`HOLD (parked ${parked.map((p) => `#${p.pr} ${p.reason}`).join(", ")})`, {
+        extra: "a park clears on a PR-body acknowledgement `main-gain-removal: <path> <key> - <why>` or a new head"
+          + (s.mergeHeld > 0 ? `; ${s.mergeHeld} more held` : ""),
+      });
+    }
     const why = s.mergeConflictHeld ? "behind a lower PR or on a merge conflict no fix-pr has cleared" : "behind a lower PR";
     return row("HOLD", { extra: `every queued candidate is held ${why}` });
   }
@@ -565,6 +578,39 @@ export const HELD = /^held-behind[:-]#?(\d+)$/;
 // spelled like `held-behind` so the two read alike. Distinct from an
 // Exclusion, which gates a ticket's claim; this gates a PR's merge.
 export const CONFLICT_HOLD = /^conflict-hold[:-]#?(\d+)$/;
+// The durable record that a merge bot refused a PR on a main-gain hit — a
+// refusal only a human edit clears — written onto the PR's own row by
+// `fleet-event.mjs merge-bot-report`: `parked=<head>:<body digest>:<reason>`,
+// the head and the body digest those the merge gate read when it refused, and
+// the reason the gate's `main-gain-removed:<path>` percent-encoded with
+// encodeURI, and `#` as `%23`, so the token stays one word and carries no
+// `#<n>` a row would read as a PR mention. It parks the PR only while its head
+// and body still match: a new head or an edited body lifts it, with no write.
+export const PARKED = /^parked=([0-9a-f]{40}):([0-9a-f]{12}):(main-gain-removed:\S+)$/;
+// The only gate reason that parks: every other refusal clears without a
+// human edit to the PR. A path is any non-empty text, a newline included.
+export const PARKS = /^main-gain-removed:./s;
+// The digest a park binds a PR body by: gh's `body` string, as gh prints it.
+// merge-gate.mjs computes the same digest of the body it read into its
+// payload's `bodyDigest`, which is where a park's digest comes from.
+export const bodyDigest = (body) => createHash("sha256").update(body).digest("hex").slice(0, 12);
+// The park token for a refusal `reason` at `head` with body digest `digest`,
+// or null when the reason does not park, the head is not a full commit SHA or
+// the digest is not a body digest.
+export function parkedToken(head, digest, reason) {
+  if (!PARKS.test(reason)) return null;
+  const tok = `parked=${String(head).toLowerCase()}:${digest}:${encodeURI(reason).replaceAll("#", "%23")}`;
+  return PARKED.test(tok) ? tok : null;
+}
+// A park token's reason as the gate printed it; a hand-written one that does
+// not decode is shown as written.
+function parkedReason(encoded) {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    return encoded;
+  }
+}
 // tier-check.mjs's verdict on an implementer, `tier-ok=<member>:<def>`
 // or `tier-mismatch=<member>:<def>` — or `tier-unverifiable=<member>:no-transcript`
 // for a settled member whose transcript was never written.
@@ -803,7 +849,7 @@ export function foldLedger({ rows, dispatched }, open, { lenient = false } = {})
       inFlight: false, reviewedAny: false, survived: 0, unverified: 0, reviewFixed: false,
       fixMembers: new Set(), fixLanded: new Set(), conflictLanded: new Set(), held: [],
       conflictOpen: false, reviewedHead: null, reviewedRun: null, pastPinHalt: false, dispositions: [], workers: new Set(),
-      finishers: new Set(),
+      finishers: new Set(), parked: [],
     };
     // The finisher-pr token currently deciding `pastPinHalt`, picked by
     // retry suffix ("" < "b" < "c" …) — never by row-text position. A
@@ -906,6 +952,10 @@ export function foldLedger({ rows, dispatched }, open, { lenient = false } = {})
       } else {
         const h = HELD.exec(tok);
         if (h) st.held.push(Number(h[1]));
+        // Every park the PR's rows carry: the tick matches each against the
+        // PR's current head and body, so a stale one is never cleared here.
+        const k = PARKED.exec(tok);
+        if (k) st.parked.push({ head: k[1], digest: k[2], reason: parkedReason(k[3]) });
         const c = CONFLICT_HOLD.exec(tok);
         if (c) {
           // Bound to the row's own PR: a hold naming another PR is a
@@ -958,7 +1008,7 @@ export function foldLedger({ rows, dispatched }, open, { lenient = false } = {})
 export const pastPinDue = (st, head) => st !== undefined && st.pastPinHalt && !st.inFlight && st.reviewedHead !== null
   && !String(head).toLowerCase().startsWith(st.reviewedHead);
 
-// The states `gh pr view --json state` answers: anything else is no answer.
+// The states a PR-state probe answers: anything else is no answer.
 const PR_STATES = ["OPEN", "MERGED", "CLOSED"];
 
 export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed = new Set(), prStates = new Map()) {
@@ -1007,7 +1057,7 @@ export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed
   // A mismatch on the keyed member itself is no replacement of M and still
   // prints. A keyed PR the open list carries is normal flow; one it does not
   // is named in `prKeyed` for the caller's state probe, `prStates` its
-  // answers (null for a probe that could not answer, none by default).
+  // answers (none for a PR whose probe could not answer, as by default).
   // CLOSED escalates, an unanswered probe escalates as unchecked, OPEN and
   // MERGED say nothing, and a ticket whose issue the caller found CLOSED
   // (`closed`) says nothing either way.
@@ -1052,6 +1102,15 @@ export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed
   const state = (n) => byPr.get(n);
   const heldBehind = (st) => (st?.held ?? []).some((n) => open.has(n));
   const conflictHeld = (st) => st !== undefined && st.conflictOpen;
+  const mergeHeldOn = (p) => heldBehind(state(p.number)) || conflictHeld(state(p.number));
+  // The latest park on a queued PR whose head and body still match it, or
+  // undefined: a new head or an edited body lifts every earlier park.
+  const parkOn = (p) => {
+    const parks = state(p.number)?.parked ?? [];
+    if (parks.length === 0) return undefined;
+    const digest = bodyDigest(p.body);
+    return parks.findLast((k) => k.head === p.headRefOid.toLowerCase() && k.digest === digest);
+  };
   const anyLive = (names) => [...names].some((n) => members.get(n).outcome === null);
   const fixRunning = (st) => anyLive(st.fixMembers);
   // An open PR the ledger tracks that GitHub reads CONFLICTING — no other
@@ -1144,9 +1203,15 @@ export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed
     // MERGED or CLOSED, the same lift rule as a `behind-pr` Exclusion. A
     // conflict hold lifts only once a fix-applier after it has SETTLED
     // `applied:`/`no-op` — never on dispatch alone.
-    mergeHeld: queued.filter((p) => heldBehind(state(p.number)) || conflictHeld(state(p.number))).length,
+    mergeHeld: queued.filter(mergeHeldOn).length,
     // How many of those are conflict holds — the HOLD row's wording, no field.
     mergeConflictHeld: queued.filter((p) => conflictHeld(state(p.number))).length,
+    // Each queued PR no hold counts that a park still matches, `{pr, reason}`
+    // ascending: the merge bot would only refuse it again.
+    mergeParked: queued.flatMap((p) => {
+      const k = mergeHeldOn(p) ? undefined : parkOn(p);
+      return k === undefined ? [] : [{ pr: p.number, reason: k.reason }];
+    }).sort((a, b) => a.pr - b.pr),
     // Finishers settled `labelled` on an open PR without the label.
     unlabelled: unlabelledFinishers({ rows, dispatched },
       new Set(prs.filter((p) => !isQueued(p)).map((p) => p.number))),
@@ -1493,6 +1558,7 @@ import { isCLI } from "./is-cli.mjs";
 import { parseArgs } from "node:util";
 import { makeDie, isDigits } from "./arg.mjs";
 import { gitEnv } from "./git-env.mjs";
+import { ghAliasedRead } from "./gh-aliased-read.mjs";
 import { fleetFile, FleetDirUnresolvable, scratchRoot } from "./fleet-dir.mjs";
 import { statePath, readState, writeState, assessBeat, isStalled, isReported, stallReport, stallOwner } from "./fleet-state.mjs";
 import { checkMainCheckout, describe } from "./main-checkout.mjs";
@@ -1621,7 +1687,7 @@ function openPrs() {
   let out;
   try {
     out = execFileSync("gh", ["pr", "list", "--state", "open", "--limit", String(PR_LIMIT),
-      "--json", "number,labels,closingIssuesReferences,headRefOid,mergeable"], { encoding: "utf8", timeout: GH_TIMEOUT_MS });
+      "--json", "number,labels,closingIssuesReferences,headRefOid,mergeable,body"], { encoding: "utf8", maxBuffer: MAX_BUFFER, timeout: GH_TIMEOUT_MS });
   } catch (e) {
     // Never interpolates e.stderr or e.message: execFileSync already forwarded
     // the child's stderr to ours, and Node builds e.message out of it, so
@@ -1641,12 +1707,12 @@ function openPrs() {
   // would leave that ticket's implementer counted twice. headRefOid likewise
   // — absent, a `halted:past-pin` PR would read as moved forever — and
   // mergeable: absent or outside GitHub's MergeableState enum, no PR would ever
-  // read CONFLICTING.
+  // read CONFLICTING. body too: absent, no park could ever be matched or lifted.
   if (!Array.isArray(prs) || prs.some((p) => !p || typeof p.number !== "number"
     || !Array.isArray(p.labels) || !Array.isArray(p.closingIssuesReferences)
     || !p.closingIssuesReferences.every((r) => r && Number.isInteger(r.number))
-    || typeof p.headRefOid !== "string" || !MERGEABLE_STATES.includes(p.mergeable))) {
-    die("gh pr list did not return {number,labels,closingIssuesReferences[{number}],headRefOid,mergeable} rows, mergeable one of MERGEABLE, CONFLICTING, UNKNOWN");
+    || typeof p.headRefOid !== "string" || !MERGEABLE_STATES.includes(p.mergeable) || typeof p.body !== "string")) {
+    die("gh pr list did not return {number,labels,closingIssuesReferences[{number}],headRefOid,mergeable,body} rows, mergeable one of MERGEABLE, CONFLICTING, UNKNOWN");
   }
   if (prs.length === PR_LIMIT) {
     die(`exactly ${PR_LIMIT} open PRs — the list is capped and may be truncated. Raise PR_LIMIT; a backlog that silently drops PRs is not a reconcile.`);
@@ -1815,34 +1881,36 @@ function closedTickets(mismatched, owed, surfacing) {
   return closed;
 }
 
-// The state of each PR the tick asks gh about, one `gh pr view --json state`
-// per PR however many readings need it: `reviews`, the PRs whose review the
-// ledger reads as in flight yet the open list does not carry, and `keyed`,
-// each ticket's keyed PR the open list does not carry (deriveRun's
-// `prKeyed`). The answer is OPEN, MERGED or CLOSED, or null for a probe that
-// could not answer — a nonzero exit, a reply carrying no state, a state that
-// is none of the three — which is disclosed with what it leaves standing.
+// The state of each PR the tick asks gh about, one aliased `gh api graphql`
+// read per hundred PRs however many readings need them: `reviews`, the PRs
+// whose review the ledger reads as in flight yet the open list does not carry,
+// and `keyed`, each ticket's keyed PR the open list does not carry (deriveRun's
+// `prKeyed`). The answer is OPEN, MERGED or CLOSED. A probe that could not
+// answer — a failed call, an alias GitHub errored on or answered with nothing,
+// a node carrying no state, a state that is none of the three — leaves its PR
+// out of the map and is disclosed, per PR, with what it leaves standing; a
+// call killed at GH_TIMEOUT_MS is disclosed with that bound.
 function prStates(reviews, keyed) {
   const states = new Map();
   const reviewed = new Set(reviews);
   // Two tickets can be keyed on one PR: each is named, on its one probe.
   const ticketsOf = new Map();
   for (const k of keyed) ticketsOf.set(k.pr, [...(ticketsOf.get(k.pr) ?? []), k.n]);
-  for (const number of [...new Set([...reviews, ...ticketsOf.keys()])].sort((a, b) => a - b)) {
+  const numbers = [...new Set([...reviews, ...ticketsOf.keys()])].sort((a, b) => a - b);
+  const read = ghAliasedRead(numbers, { field: "pullRequest", selection: "{state}", timeoutMs: GH_TIMEOUT_MS });
+  for (const number of numbers) {
+    const r = read.get(number);
+    const st = r.node?.state;
+    if (PR_STATES.includes(st)) {
+      states.set(number, st);
+      continue;
+    }
     const unconfirmed = [
       ...(reviewed.has(number) ? [`review on PR#${number} unconfirmed finished, its unit stands`] : []),
       ...(ticketsOf.get(number) ?? []).map((n) => `#${n}'s PR#${number} unconfirmed closed, printed as pr-unchecked`),
     ].join("; ");
-    states.set(number, null);
-    const r = spawnSync("gh", ["pr", "view", String(number), "--json", "state"], { encoding: "utf8", timeout: GH_TIMEOUT_MS, env: gitEnv({ GH_REPO: "" }) });
-    if (r.error || r.status !== 0) {
-      console.error(`${NAME}: ${failure(r, `gh pr view ${number}`)} — ${unconfirmed}`);
-      continue;
-    }
-    let st = null;
-    try { st = JSON.parse(r.stdout).state; } catch { /* no state: disclosed below */ }
-    if (PR_STATES.includes(st)) states.set(number, st);
-    else console.error(`${NAME}: gh pr view ${number} printed no PR state — ${unconfirmed}`);
+    const why = r.unreachable === "ETIMEDOUT" ? TIMED_OUT : r.unreachable ?? (r.notFound ? "no such pull request" : "no PR state");
+    console.error(`${NAME}: gh api graphql gave no answer for PR#${number} (${why}) — ${unconfirmed}`);
   }
   return states;
 }

package/scripts/gh-aliased-read.mjs

@@ -0,0 +1,95 @@
+// One GraphQL read of the current repository for many numbers at once: each
+// number is an aliased `<field>(number:N){…}` of the one query, a hundred to a
+// call, so a caller that would ask `gh` about every number one `gh … view` at a
+// time asks once per hundred instead. The caller names the field
+// (`pullRequest`, `issueOrPullRequest`) and what to select on it; what an
+// answer means is the caller's.
+//
+// `gh api graphql` exits 1 when any one alias errors yet still prints the full
+// body, `data.repository` holding every alias GitHub answered and `errors[]`
+// naming each failed one by `path: ["repository", "<alias>"]`. So a body that
+// carries an object `data.repository` is read alias by alias at any exit
+// status, never as "the whole call failed".
+//
+// `-F owner={owner} -F name={repo}` is filled in from the environment gh sees:
+// an inherited GH_REPO outranks the repository the cwd is bound to, and a
+// GIT_DIR naming another repository moves it too. gitEnv({ GH_REPO: "" })
+// scrubs both, so the read is of the repository the cwd is in.
+
+import { spawnSync } from "node:child_process";
+import { gitEnv } from "./git-env.mjs";
+
+const BATCH = 100;
+const MAX_BUFFER = 64 * 1024 * 1024;
+
+/** A child that did not answer, as one short reason. */
+export function how(r) {
+  if (r.error) return r.error.code ?? r.error.message;
+  if (r.signal) return `killed by ${r.signal}`;
+  const said = String(r.stderr ?? "").trim().split("\n").at(-1);
+  return said ? `exit ${r.status}: ${said}` : `exit ${r.status}`;
+}
+
+/**
+ * What GitHub says of each of `numbers`, as a Map keyed by number:
+ *
+ *   `{ node }`         — the alias GitHub answered with an object, as parsed.
+ *   `{ notFound }`     — null with a NOT_FOUND error naming the alias at path
+ *                        length 2: GitHub's own "this number names nothing".
+ *   `{ unreachable }`  — no usable answer, with the reason. Any other error
+ *                        naming an alias, an error naming no alias (it may
+ *                        belong to any of the batch), a null no NOT_FOUND
+ *                        explains, a missing alias, and an unparseable or
+ *                        absent body all land here: a failed lookup is not an
+ *                        answer.
+ *
+ * `field` and `selection` build each alias, `n<N>:<field>(number:<N>)<selection>`;
+ * `timeoutMs` bounds each `gh` call.
+ */
+export function ghAliasedRead(numbers, { field, selection, timeoutMs }) {
+  const out = new Map();
+  for (let i = 0; i < numbers.length; i += BATCH) {
+    const batch = numbers.slice(i, i + BATCH);
+    const fields = batch.map((n) => `n${n}:${field}(number:${n})${selection}`).join(" ");
+    const r = spawnSync("gh", ["api", "graphql", "-F", "owner={owner}", "-F", "name={repo}",
+      "-f", `query=query($owner:String!,$name:String!){repository(owner:$owner,name:$name){${fields}}}`], {
+      encoding: "utf8", maxBuffer: MAX_BUFFER, timeout: timeoutMs, env: gitEnv({ GH_REPO: "" }),
+    });
+    let body;
+    let unparseable;
+    try {
+      body = JSON.parse(r.stdout);
+    } catch (e) {
+      if (r.status === 0) unparseable = e.message;
+    }
+    const repo = body?.data?.repository;
+    const errors = body?.errors ?? [];
+    const answered = repo !== null && typeof repo === "object" && !Array.isArray(repo) && Array.isArray(errors);
+    const nothing = new Set();
+    const refused = new Map();
+    let batchWide;
+    if (answered) {
+      for (const e of errors) {
+        const path = e?.path;
+        const alias = Array.isArray(path) && path[0] === "repository" && typeof path[1] === "string" ? path[1] : null;
+        const said = `${e?.type ?? "error"}${e?.message ? `: ${e.message}` : ""}`;
+        if (alias === null) batchWide ??= said;
+        else if (e.type === "NOT_FOUND" && path.length === 2) nothing.add(alias);
+        else refused.set(alias, said);
+      }
+    }
+    for (const n of batch) {
+      const alias = `n${n}`;
+      const gone = (why) => out.set(n, { unreachable: why });
+      if (!answered) gone(unparseable === undefined ? how(r) : `${how(r)}: unparseable body: ${unparseable}`);
+      else if (refused.has(alias)) gone(refused.get(alias));
+      else if (batchWide !== undefined) gone(batchWide);
+      else if (!Object.hasOwn(repo, alias)) gone(how(r));
+      else if (repo[alias] === null) {
+        if (nothing.has(alias)) out.set(n, { notFound: true });
+        else gone("null with no NOT_FOUND error");
+      } else out.set(n, { node: repo[alias] });
+    }
+  }
+  return out;
+}

package/scripts/ledger.mjs

@@ -54,7 +54,7 @@ import { spawnSync, execFileSync } from "node:child_process";
 import { makeDie, isFlagLike, hasEqualsForm, isDigits, writeAll } from "./arg.mjs";
 import { fleetFile, FleetDirUnresolvable } from "./fleet-dir.mjs";
 import { parseMember, parseToken, memberTokens, nextMergeBot, nextRetry, liveOnLedger, retiredOnLedger, retiredName, readRetired, agentDefinition, CELL, tierValues, rowPr, rowWriteRefusal, isReviewToken, addedReviewToken, newSplitRow, splitRowClause, added, premisesOf, MEMBER_FAMILIES, HALT_CAUSES, ROWS, DISPATCHED, FILED, RULED, DRAIN, RETIRED, RECEIPT, archiveStamp, receiptArchiveName, CLOSEOUT_RECEIPT, closeoutArchiveName, BRIEFS, briefsArchiveName, memberRole, parseDispatchedEntry, dispatchedEntry, headerRe, escapeText, unescapeText, nextReviewerName } from "./ledger-grammar.mjs";
-import { deriveRun, LedgerError, labelOffMember, HELD, CONFLICT_HOLD } from "./fleet-tick.mjs";
+import { deriveRun, LedgerError, labelOffMember, HELD, CONFLICT_HOLD, PARKED } from "./fleet-tick.mjs";
 import { stateFileIn, readState, writeState, assessBeat, stallsAt } from "./fleet-state.mjs";
 import { processSource, ancestry, controllerOf, judgeController, ProcUnreadable } from "./proc.mjs";
 import { attemptLock, releaseLockFile, reapPathOf } from "./pid-lock.mjs";
@@ -2674,9 +2674,9 @@ function badLabelOff(words) {
 // ` · ` separator are no token. A member token is `dispatch`'s or `settle`'s,
 // a review token `review`'s. A word shaped like a member that the grammar
 // cannot parse, a `tier=` that is not a cell, a `tier=` naming a second tier
-// on a row that already has one, a `held-behind` or `conflict-hold` token the
-// tick cannot read, and a lone `→` — an arrow with no PR beside it points at
-// nothing — are refused. Every other word is a freeform token.
+// on a row that already has one, a `held-behind`, `conflict-hold` or `parked`
+// token the tick cannot read, and a lone `→` — an arrow with no PR beside it
+// points at nothing — are refused. Every other word is a freeform token.
 function tokenRefusal(tok, rowText) {
   if (tok === "" || /\s/.test(tok)) {
     return "is not one token — pass each token as its own argument, with no space in it";
@@ -2697,6 +2697,9 @@ function tokenRefusal(tok, rowText) {
       return `is not ${prefix}:#<M> — the tick reads only ${prefix}:#<number> and would ignore this one`;
     }
   }
+  if (tok.startsWith("parked=") && !PARKED.test(tok)) {
+    return "is not parked=<head>:<body digest>:main-gain-removed:<path> — the tick reads only a 40-hex head, a 12-hex body digest and a main-gain-removed reason, and would ignore this one";
+  }
   const [tier] = tierValues(tok);
   if (tier !== undefined) {
     if (!CELL.test(tier)) return "is not tier=<cell> — a cell is <slow|task|smol>-<level>";

package/scripts/merge-gate.mjs

@@ -23,14 +23,18 @@
 // member number only the bot knows, so the bot passes it and this script never
 // guesses it.
 //
-// Stdout: exactly one JSON line, `{pr, verdict, reason, head, pre, post,
-// rebaseCarry, behind, instruments, mainGain, ci}`, `rebaseCarry` naming the
-// labelled head and the head accepted as carrying it (`{labelled, accepted}`),
-// or null when no carry was proven, `mainGain` echoing main-gain.mjs's own
-// payload — hits, acknowledged removals and unchecked files — or null when
-// it did not run or printed no JSON object; an unusable payload is still
-// echoed. Stderr: the children's own diagnostics, passed straight through
-// and never folded into stdout.
+// Stdout: exactly one JSON line, `{pr, verdict, reason, head, bodyDigest, pre,
+// post, rebaseCarry, behind, instruments, mainGain, ci}`, `bodyDigest` the
+// first 12 hex of the sha256 of the body gh read (fleet-tick.mjs's
+// `bodyDigest`, the digest a `parked=` token binds — `fleet-event.mjs
+// merge-bot-report` parks a `main-gain-removed` refusal at this `head` and
+// `bodyDigest`), or null with `head` when gh could not be read, `rebaseCarry`
+// naming the labelled head and the head accepted as carrying it (`{labelled,
+// accepted}`), or null when no carry was proven, `mainGain` echoing
+// main-gain.mjs's own payload — hits, acknowledged removals and unchecked
+// files — or null when it did not run or printed no JSON object; an unusable
+// payload is still echoed. Stderr: the children's own diagnostics, passed
+// straight through and never folded into stdout.
 //
 // Exit vocabulary — the same three-way contract as inflight.sh, prove-merge.sh
 // and staleness.mjs:
@@ -77,6 +81,7 @@
 // no carry, and the head row blocks exactly as it does for any other moved head.
 
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -390,6 +395,7 @@ try {
     verdict,
     reason,
     head: prView?.headRefOid ?? null,
+    bodyDigest: prView === null ? null : createHash("sha256").update(prView.body).digest("hex").slice(0, 12),
     pre,
     post,
     rebaseCarry,

package/scripts/reclaim-scratch.mjs

@@ -109,6 +109,7 @@ import { fileURLToPath } from "node:url";
 import { defineFlags, isDigits, makeDie, writeAll } from "./arg.mjs";
 import { fleetFile, FleetDirUnresolvable, SCRATCH_KEY_SHAPE, scratchRoot } from "./fleet-dir.mjs";
 import { gitEnv } from "./git-env.mjs";
+import { ghAliasedRead, how } from "./gh-aliased-read.mjs";
 import { isCLI } from "./is-cli.mjs";
 import { liveOnLedger, parseMember, REVIEWER } from "./ledger-grammar.mjs";
 
@@ -116,7 +117,6 @@ const NAME = "reclaim-scratch";
 const die = makeDie(NAME);
 const DAY_MS = 24 * 60 * 60 * 1000;
 export const RETENTION_MS = 7 * DAY_MS;
-const BATCH = 100;
 const GH_TIMEOUT_MS = 30_000;
 const MAX_BUFFER = 64 * 1024 * 1024;
 
@@ -151,13 +151,6 @@ const REPORT_PR_ENTRY = /^(?:fix-pr|finisher-pr|review-pr)-([1-9][0-9]*)(?:-[a-z
 const REPORT_IMPL_ENTRY = /^impl-([1-9][0-9]*)(?:-[a-z])?(?:\.check)?\.json$/;
 const RUN_ROOT = /^run-/;
 
-function how(r) {
-  if (r.error) return r.error.code ?? r.error.message;
-  if (r.signal) return `killed by ${r.signal}`;
-  const said = String(r.stderr ?? "").trim().split("\n").at(-1);
-  return said ? `exit ${r.status}: ${said}` : `exit ${r.status}`;
-}
-
 /** The path of something under `path` (itself included) modified at or after
  * `cutoff`, or null when everything is older. Symlinks are not followed. A
  * directory that cannot be listed counts its own mtime only, and so does one
@@ -302,59 +295,18 @@ function claimWorktree(listing, n) {
 
 // `{type, state}` per number GitHub answered (type "Issue" or "PullRequest",
 // or null for a number that names nothing), or `{unreachable}` for a number
-// that has no usable answer. GitHub resolves every alias it can and nulls the
-// rest, and gh exits 1 with the whole body, so a body carrying an object
-// `data.repository` is read alias by alias at any exit status. An alias is
-// answered by a node, or by null with a NOT_FOUND error naming it — GitHub's
-// own "this number names nothing". Any other error naming an alias, a null
-// no NOT_FOUND explains, and an error naming no alias (it may belong to any
-// of the batch) leave the number unreachable: a failed lookup is not an
-// answer.
+// that has no usable answer. What counts as an answer is gh-aliased-read.mjs's:
+// a number GitHub nulls with NOT_FOUND names nothing, and a failed lookup is
+// not an answer.
 function githubStates(numbers) {
   const out = new Map();
-  for (let i = 0; i < numbers.length; i += BATCH) {
-    const batch = numbers.slice(i, i + BATCH);
-    const fields = batch.map((n) => `n${n}:issueOrPullRequest(number:${n}){__typename ... on Issue{state} ... on PullRequest{state}}`).join(" ");
-    const r = spawnSync("gh", ["api", "graphql", "-F", "owner={owner}", "-F", "name={repo}",
-      "-f", `query=query($owner:String!,$name:String!){repository(owner:$owner,name:$name){${fields}}}`], {
-      encoding: "utf8", maxBuffer: MAX_BUFFER, timeout: GH_TIMEOUT_MS, env: gitEnv({ GH_REPO: "" }),
-    });
-    let body;
-    let unparseable;
-    try {
-      body = JSON.parse(r.stdout);
-    } catch (e) {
-      body = undefined;
-      if (r.status === 0) unparseable = e.message;
-    }
-    const repo = body?.data?.repository;
-    const errors = body?.errors ?? [];
-    const answered = repo !== null && typeof repo === "object" && !Array.isArray(repo) && Array.isArray(errors);
-    const nothing = new Set();
-    const refused = new Map();
-    let batchWide;
-    if (answered) {
-      for (const e of errors) {
-        const path = e?.path;
-        const alias = Array.isArray(path) && path[0] === "repository" && typeof path[1] === "string" ? path[1] : null;
-        const said = `${e?.type ?? "error"}${e?.message ? `: ${e.message}` : ""}`;
-        if (alias === null) batchWide ??= said;
-        else if (e.type === "NOT_FOUND" && path.length === 2) nothing.add(alias);
-        else refused.set(alias, said);
-      }
-    }
-    for (const n of batch) {
-      const alias = `n${n}`;
-      const gone = (why) => out.set(n, { unreachable: `gh api graphql gave no answer for #${n} (${why})` });
-      if (!answered) gone(unparseable === undefined ? how(r) : `${how(r)}: unparseable body: ${unparseable}`);
-      else if (refused.has(alias)) gone(refused.get(alias));
-      else if (batchWide !== undefined) gone(batchWide);
-      else if (!Object.hasOwn(repo, alias)) gone(how(r));
-      else if (repo[alias] === null) {
-        if (nothing.has(alias)) out.set(n, { type: null });
-        else gone("null with no NOT_FOUND error");
-      } else out.set(n, { type: repo[alias].__typename, state: String(repo[alias].state).toUpperCase() });
-    }
+  const read = ghAliasedRead(numbers, {
+    field: "issueOrPullRequest", selection: "{__typename ... on Issue{state} ... on PullRequest{state}}", timeoutMs: GH_TIMEOUT_MS,
+  });
+  for (const [n, r] of read) {
+    if (r.unreachable !== undefined) out.set(n, { unreachable: `gh api graphql gave no answer for #${n} (${r.unreachable})` });
+    else if (r.notFound) out.set(n, { type: null });
+    else out.set(n, { type: r.node.__typename, state: String(r.node.state).toUpperCase() });
   }
   return out;
 }

package/skills/run-team/SKILL.md

@@ -831,7 +831,7 @@ and flag the PR for a human. A new review of the PR counts again from none.
 
 | Failure | Response |
 |---|---|
-| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, nothing written to the ledger, and no member is dispatched to restore the lines — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
+| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, and no member is dispatched to restore the lines — the removal may be deliberate. `fleet-event.mjs merge-bot-report` parks it: a `parked=<head>:<body digest>:<reason>` token on its row, at the head and body digest the bot's gate reading `<scratch>/pr<pr>/merge-bot-<n>/ci.json` records it refused, and no bot is dispatched on its account — when nothing else queued is dispatchable the tick prints `HOLD (parked #<pr> <reason>)`, though a bot dispatched for another queued PR may still evaluate it again; a new head or an edited body lifts the park with no write. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
 | Merge bot's gate cannot answer the main-gain check (`main-gain-unanswerable`, exit 2) | Report `main-gain-unanswerable-#<pr>` with what it printed, PR stays queued, label untouched |
 
 ## Failure handling

package/skills/run-team/references/ledger.md

@@ -88,6 +88,8 @@ A member that dies between spawn and write is invisible — and members die in b
 
 `ci=<run-id>:<attempt>:<conclusion>` and `held-behind:#<lower>` are row tokens the same way, and so is `conflict-hold:#<pr>` — written by the merge bot itself (`run-merge-bot.md` step 1), or by you off the tick's `CONFLICT` line, naming the row's own PR. It is not an Exclusion: that gates a ticket's claim, this a PR's merge.
 
+`parked=<head>:<body digest>:main-gain-removed:<path>` is a row token too, written by `fleet-event.mjs merge-bot-report` off a merge bot's `main-gain-removed` refusal, binding the head and a digest of the body the bot's gate refused, read from its gate reading `<scratch>/pr<N>/merge-bot-<n>/ci.json`: while both still match, the tick counts the PR parked beside the held ones, so it alone never prints `DISPATCH merge-bot`, and a new head or an edited body lifts it with no write. No other refusal reason parks.
+
 ## The review pair on a PR's row
 
 A PR's review is not a member, so it carries its own pair of row tokens, written with `review` onto the PR's row (**The reviewer**): `review=wf:<runId>` | `review=member:<name>` at launch, `<name>` being `review-pr-<n>` for the PR's first runner and the next letter its rows do not carry yet (`review-pr-<n>-b`, `-c`, …) for every later one, settled dead as `…=failed`, then `reviewed=<head>:<survived>/<refuted>/<unverified>:<run>` when the result lands, `<run>` the review's `run-XXXXXXXX` run root under `<scratch>/pr<n>/`, which holds its `review.json`.

package/skills/run-team/references/tick-rows.md

@@ -95,8 +95,8 @@ The full text of each row `fleet-tick.mjs` prints and what it asks of the contro
   carried on at the right tier — and once that one settles, the line reads it
   the same way. A tier mismatch on the member that settled `PR#<M>` itself
   replaces nothing, so the line stands beside that hold.
-- `ESCALATE pr-unchecked #<N> PR#<M>` — the same ticket, but `gh pr view
-  <M>` could not answer, so whether M closed is unknown. The maintainer's on
+- `ESCALATE pr-unchecked #<N> PR#<M>` — the same ticket, but gh could not
+  answer for PR M, so whether M closed is unknown. The maintainer's on
   the same terms as `pr-closed`; the next tick probes again.
 - `HOLD (…)` — the row is held and says why: draining, a tier mismatch, an
   unchecked tier, the In-flight bound reached (`HOLD (in-flight <n>/<B>)` —