@feigi/fleet-ctl 3.83.1 → 3.83.2

package/commands/run-merge-bot.md

@@ -226,7 +226,7 @@ For each labeled PR clearing the hold rule, lowest first:
      --out <scratch>/pr<N>/merge-bot-<n>/ci.json; rc=$?
    ```
 
-   `--pre` is the head you recorded at **The labelled head**; `--post` is the head step 1's rebase produced — omit it when no rebase ran, which is the same as passing `pre` twice. `pr<N>` is this PR and `merge-bot-<n>` is your own name, so the reading lands under a directory only you write, never in the scratch root by itself: `<scratch>` is the absolute path your dispatch prompt names, and that root is shared with every sibling. The gate is read-only — it runs the instrument re-check, `gh pr view <pr> --json labels,reviewDecision,headRefOid,body`, the main-gain check against that head in the main checkout, the rebase-carry proof when that head is neither `pre` nor `post`, and `ci-state.mjs --pr <pr>`, answers their conjunction, and never merges, labels, rebases or waits. Stdout is exactly one JSON line, `{pr, verdict, reason, head, pre, post, rebaseCarry, behind, instruments, mainGain, ci}`; stderr is its children's diagnostics, so never fold `2>&1` into the line you read. Read `rc` straight off the call, as above — never through a pipe.
+   `--pre` is the head you recorded at **The labelled head**; `--post` is the head step 1's rebase produced — omit it when no rebase ran, which is the same as passing `pre` twice. `pr<N>` is this PR and `merge-bot-<n>` is your own name, so the reading lands under a directory only you write, never in the scratch root by itself: `<scratch>` is the absolute path your dispatch prompt names, and that root is shared with every sibling. The gate is read-only — it runs the instrument re-check, `gh pr view <pr> --json labels,reviewDecision,headRefOid,body`, the main-gain check against that head in the main checkout, the rebase-carry proof when that head is neither `pre` nor `post`, and `ci-state.mjs --pr <pr>`, answers their conjunction, and never merges, labels, rebases or waits. Stdout is exactly one JSON line, `{pr, verdict, reason, head, bodyDigest, pre, post, rebaseCarry, behind, instruments, mainGain, ci}`; stderr is its children's diagnostics, so never fold `2>&1` into the line you read. Read `rc` straight off the call, as above — never through a pipe.
 
    **Run a plain `git fetch origin` in the main checkout before every gate run** — never `git fetch origin <src>:<dst>`, for the reason step 1's fallback gives. The main-gain check and the rebase-carry proof read `origin/main` and the head objects there as they stand and fetch nothing themselves: an unfetched head is `main-gain-unanswerable`, an unheld labelled or carried head is no carry, and a stale `origin/main` is a check against the wrong `main`.
 
@@ -236,7 +236,7 @@ For each labeled PR clearing the hold rule, lowest first:
    Each `reason` is a fact the gate now enforces, not a step you run:
 
    - **`head-moved-after-label`** — the PR head is neither `pre` nor `post`, nor a head whose net change the gate proved identical to `pre`'s (`rebaseCarry`, which names both). **Any third SHA is a push that landed while you waited on CI, and no CI check can see it**: `ci-state.mjs` selects the run whose `headSha` equals the *current* PR head (`scripts/ci-state.mjs`, the `r.headSha === prHead` filter), so a member's push plus its own green run satisfies every CI check while the audit behind the label belongs to a tree that is gone. A carry is proven only for the head `gh pr view` read; a different head at `ci-state`'s own read is still this row. The remedy is a fresh finisher against the new head, label untouched.
-   - **`main-gain-removed:<path>`** — merging this head would remove lines `main` gained after the PR's work began: lines a later merge landed, deleted by a branch commit that every rebase since has replayed without a conflict, so no conflict preview and no `origin/main...HEAD` read is sure to show them. `mainGain.hits[]` names each file, the landing key (`#<n>` for a merged PR, else the landing commit's 12-character SHA), the removed lines, and the `ack` line to copy. Skip the PR, leave the label alone, and report `main-gain-removed:<path>-#<pr>` with the hit list and the keys. Never restore the lines yourself — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for every hit; the gate reads the body each run, so editing it is enough. An acknowledged removal is listed in `mainGain.acknowledged[]` and the gate passes it — name each one, with its reason, in your report.
+   - **`main-gain-removed:<path>`** — merging this head would remove lines `main` gained after the PR's work began: lines a later merge landed, deleted by a branch commit that every rebase since has replayed without a conflict, so no conflict preview and no `origin/main...HEAD` read is sure to show them. `mainGain.hits[]` names each file, the landing key (`#<n>` for a merged PR, else the landing commit's 12-character SHA), the removed lines, and the `ack` line to copy. Skip the PR, leave the label alone, and report `main-gain-removed:<path>-#<pr>` with the hit list and the keys. Never restore the lines yourself — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for every hit; the gate reads the body each run, so editing it is enough. An acknowledged removal is listed in `mainGain.acknowledged[]` and the gate passes it — name each one, with its reason, in your report. Your report's `refused[]` entry for the PR carries the gate's `reason` as it printed it, `main-gain-removed:<path>`, and the gate's `--out` file above stays where the gate wrote it: the controller parks the PR off that entry, at the `head` and `bodyDigest` that file records the gate refused, and no merge bot is dispatched on the PR's account until its head or its body changes — though a bot dispatched for another queued PR may still evaluate it again.
    - **`main-gain-unanswerable`** — the main-gain check could not answer: a head object the main checkout does not hold after `git fetch origin`, a merge that does not resolve cleanly, a blame that failed. `mainGain.reason` says which. Stop and report `main-gain-unanswerable-#<pr>` with it, label untouched.
    - **`behind:<n>`** — you are the only place currency is proven, and a sibling merge since your rebase expires it (the staleness below).
    - **`instrument-set-changed` / `instruments-unanswerable`** — the instrument re-check the controller runs before its own gates (`run-team/SKILL.md`, **You read your instruments out of a tree every member can write to**), taken at this seat because nothing dispatches a merge bot to read that rule. Report `<reason>-#<pr>` with what the gate printed, leave the label alone, and do **not** re-run the gate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.83.1",
+  "version": "3.83.2",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/fleet-event.mjs

@@ -72,9 +72,15 @@
 //       A settle that refuses on `ready-to-merge` — missing from the PR or from the read-back — is the case the tick's `DISPATCH finisher PR#<M>` catches next: settle it `ledger.mjs settle finisher-pr-<M>=labelled` as reported, and `ledger.mjs filed <N> "<subject>"` for each `unrecorded` entry.
 //   merge-bot-report <merge-bot-n>
 //       `ledger.mjs token <pr> held-behind:#<behind>` for each `held[]` entry
-//       of the report the PR's rows do not already carry, then `settle
-//       --from-report`. The reap and the reclaim run under the tick's
-//       `--apply`.
+//       of the report the PR's rows do not already carry, then `ledger.mjs
+//       token <pr> parked=<head>:<body digest>:<reason>` for each `refused[]`
+//       entry whose reason is `main-gain-removed:<path>`, bound to the head
+//       and body digest the bot's gate reading `<scratch>/pr<pr>/<merge-bot-n>/ci.json`
+//       records it refused, unless the rows already carry it (a reading that
+//       is missing or is not that refusal is a NEED, nothing written), then
+//       `settle --from-report`.
+//       Every other refusal reason writes nothing. The reap and the reclaim
+//       run under the tick's `--apply`.
 //       The verdict moves no label and leaves nothing in the repo, so the row is the only place the tick can read a `held-behind` from.
 //       The reap and the reclaim run once for every merge bot settled `done`, always, even when the pass merged nothing, and again on the next tick after an `APPLY FAILED` line, and on every tick while this run has no controller record to remember the pass by.
 //       The bot may also have written `conflict-hold:#<pr>` onto a held PR's own row earlier in the same pass, before reporting: a token the bot wrote in that pass, never one `reap.sh` writes.
@@ -188,7 +194,7 @@ import { FleetDirUnresolvable, fleetFile } from "./fleet-dir.mjs";
 import { gitEnv } from "./git-env.mjs";
 import { isCLI } from "./is-cli.mjs";
 import { BRIEFS, REVIEW, REVIEWED, REVIEWER, memberTokens, nextReviewerName, parseDispatchedEntry, parseMember, parseToken, readRetired, rowNums } from "./ledger-grammar.mjs";
-import { NO_TRANSCRIPT_AFTER_DEFAULT, controllerState, dispositionsToken, foldLedger } from "./fleet-tick.mjs";
+import { NO_TRANSCRIPT_AFTER_DEFAULT, PARKS, controllerState, dispositionsToken, foldLedger, parkedToken } from "./fleet-tick.mjs";
 import { phase0Gate, readRunReceipt, tickCaps } from "./phase0-receipt.mjs";
 import { defaultScratch, readReportIn, reportsDir } from "./report-files.mjs";
 import { readState, statePath } from "./fleet-state.mjs";
@@ -636,9 +642,46 @@ function mergeBotReport(ev, member) {
     if (r.status === 0) ev.note(`#${pr} ${tok}`);
     else ev.refuse(`token #${pr} ${tok}`, r);
   }
+  for (const { pr, reason } of read.state === "ok" ? read.report.refused : []) {
+    if (PARKS.test(reason)) park(ev, member, pr, reason);
+  }
   ev.settle(member);
 }
 
+// `ledger.mjs token <pr> parked=<head>:<body digest>:<reason>` for a refusal
+// only a human edit clears, bound to the head and body the gate refused: the
+// bot's own gate reading, `<scratch>/pr<pr>/<member>/ci.json` (run-merge-bot.md
+// step 3's `--out`), never a read taken now, so a push or a body edit landing
+// after the refusal is never what gets parked. Skipped when the PR's rows
+// already carry that token. A reading that cannot be read, is not JSON, is not
+// this refusal, or carries no full head and body digest is a NEED naming
+// which, nothing written: a park bound to no refused head would never lift.
+function park(ev, member, pr, reason) {
+  const file = join(ev.scratch, `pr${pr}`, member, "ci.json");
+  let g;
+  try {
+    g = JSON.parse(readFileSync(file, "utf8"));
+  } catch (e) {
+    ev.need(`park PR #${pr} ${reason} — the gate reading ${file} ${e instanceof SyntaxError ? "is not JSON" : `cannot be read (${e.code ?? e.message})`}; nothing parked`);
+    return;
+  }
+  const off = g === null || typeof g !== "object" ? "is not a JSON object"
+    : g.pr !== pr || g.verdict !== "blocked" || g.reason !== reason ? `is not this refusal (pr ${g.pr}, verdict ${g.verdict}, reason ${g.reason})`
+    : null;
+  const tok = off === null ? parkedToken(g.head, g.bodyDigest, reason) : null;
+  if (tok === null) {
+    ev.need(`park PR #${pr} ${reason} — the gate reading ${file} ${off ?? `carries no full head and body digest (head ${g.head}, bodyDigest ${g.bodyDigest})`}; nothing parked`);
+    return;
+  }
+  if (prWords(ev.ledger, pr).includes(tok)) {
+    ev.note(`#${pr} already ${tok}`);
+    return;
+  }
+  const w = node("ledger.mjs", ["token", String(pr), tok]);
+  if (w.status === 0) ev.note(`#${pr} ${tok}`);
+  else ev.refuse(`token #${pr} ${tok}`, w);
+}
+
 // `p` with its symlinks resolved, or as written when it does not exist yet.
 function real(p) {
   try {

package/scripts/fleet-tick.mjs

@@ -30,7 +30,9 @@
 //             unsettled `fix-pr-`), the merge bot (`## Dispatched`), merge
 //             holds (`held-behind:#M`, and `conflict-hold:#<pr>`, written by
 //             the merge bot or by the controller off a `CONFLICT` line),
-//             tier mismatches and the drain marker
+//             merge parks (`parked=<head>:<body digest>:<reason>`, written by
+//             `fleet-event.mjs merge-bot-report`), tier mismatches and the
+//             drain marker
 //             all come off it, and so does the ledger half of the In-flight
 //             count: every claimed ticket whose newest `impl-` member is live,
 //             or settled `killed`/`tier-mismatch` and so owed a replacement,
@@ -47,9 +49,11 @@
 //             nothing. Missing or unparsable is depth 0 and a
 //             refresh, never a refusal: the depth only ever bounds PULLs
 //             downward. A file with no `dropped` names no drops.
-//   gh        The open PRs, by label, by whether they close an issue and by
-//             GitHub's `mergeable` — the merge queue, which PRs are owed a
-//             review, which conflict, and the PR half of the In-flight count:
+//   gh        The open PRs, by label, by whether they close an issue, by
+//             GitHub's `mergeable`, and by head and body — the merge queue,
+//             which PRs are owed a review, which conflict, which queued PR
+//             still matches the head and body it was parked at, and the PR
+//             half of the In-flight count:
 //             every open PR that closes an issue, whoever opened it and
 //             whatever its state. Also, for each in-flight `review=` token
 //             whose PR the open list does not carry, and for each ticket's
@@ -445,14 +449,23 @@ function reviewers(s) {
 
 function mergeBot(s) {
   // Cap is 1 by invariant, not by configuration.
-  const row = mkRow("merge-bot", s.mergeBotLive, 1, `merge-queue=${s.mergeQueue} held=${s.mergeHeld}`);
+  const parked = s.mergeParked;
+  const row = mkRow("merge-bot", s.mergeBotLive, 1,
+    `merge-queue=${s.mergeQueue} held=${s.mergeHeld}${parked.length > 0 ? ` parked=${parked.length}` : ""}`);
   if (s.mergeBotLive >= 1) return row("AT CAP");
   if (s.mergeQueue === 0) return row("IDLE OK");
   // `ready-to-merge` is the author's sign-off and nothing more. A bot
   // dispatched against a queue whose candidates are all held — behind a lower
-  // open PR, or on a conflict merge-bot already refused to force —
-  // spends a whole member re-deriving a verdict already recorded.
-  if (s.mergeQueue - s.mergeHeld <= 0) {
+  // open PR, or on a conflict merge-bot already refused to force — or parked
+  // on a refusal only a human edit clears spends a whole member re-deriving a
+  // verdict already recorded.
+  if (s.mergeQueue - s.mergeHeld - parked.length <= 0) {
+    if (parked.length > 0) {
+      return row(`HOLD (parked ${parked.map((p) => `#${p.pr} ${p.reason}`).join(", ")})`, {
+        extra: "a park clears on a PR-body acknowledgement `main-gain-removal: <path> <key> - <why>` or a new head"
+          + (s.mergeHeld > 0 ? `; ${s.mergeHeld} more held` : ""),
+      });
+    }
     const why = s.mergeConflictHeld ? "behind a lower PR or on a merge conflict no fix-pr has cleared" : "behind a lower PR";
     return row("HOLD", { extra: `every queued candidate is held ${why}` });
   }
@@ -565,6 +578,39 @@ export const HELD = /^held-behind[:-]#?(\d+)$/;
 // spelled like `held-behind` so the two read alike. Distinct from an
 // Exclusion, which gates a ticket's claim; this gates a PR's merge.
 export const CONFLICT_HOLD = /^conflict-hold[:-]#?(\d+)$/;
+// The durable record that a merge bot refused a PR on a main-gain hit — a
+// refusal only a human edit clears — written onto the PR's own row by
+// `fleet-event.mjs merge-bot-report`: `parked=<head>:<body digest>:<reason>`,
+// the head and the body digest those the merge gate read when it refused, and
+// the reason the gate's `main-gain-removed:<path>` percent-encoded with
+// encodeURI, and `#` as `%23`, so the token stays one word and carries no
+// `#<n>` a row would read as a PR mention. It parks the PR only while its head
+// and body still match: a new head or an edited body lifts it, with no write.
+export const PARKED = /^parked=([0-9a-f]{40}):([0-9a-f]{12}):(main-gain-removed:\S+)$/;
+// The only gate reason that parks: every other refusal clears without a
+// human edit to the PR. A path is any non-empty text, a newline included.
+export const PARKS = /^main-gain-removed:./s;
+// The digest a park binds a PR body by: gh's `body` string, as gh prints it.
+// merge-gate.mjs computes the same digest of the body it read into its
+// payload's `bodyDigest`, which is where a park's digest comes from.
+export const bodyDigest = (body) => createHash("sha256").update(body).digest("hex").slice(0, 12);
+// The park token for a refusal `reason` at `head` with body digest `digest`,
+// or null when the reason does not park, the head is not a full commit SHA or
+// the digest is not a body digest.
+export function parkedToken(head, digest, reason) {
+  if (!PARKS.test(reason)) return null;
+  const tok = `parked=${String(head).toLowerCase()}:${digest}:${encodeURI(reason).replaceAll("#", "%23")}`;
+  return PARKED.test(tok) ? tok : null;
+}
+// A park token's reason as the gate printed it; a hand-written one that does
+// not decode is shown as written.
+function parkedReason(encoded) {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    return encoded;
+  }
+}
 // tier-check.mjs's verdict on an implementer, `tier-ok=<member>:<def>`
 // or `tier-mismatch=<member>:<def>` — or `tier-unverifiable=<member>:no-transcript`
 // for a settled member whose transcript was never written.
@@ -803,7 +849,7 @@ export function foldLedger({ rows, dispatched }, open, { lenient = false } = {})
       inFlight: false, reviewedAny: false, survived: 0, unverified: 0, reviewFixed: false,
       fixMembers: new Set(), fixLanded: new Set(), conflictLanded: new Set(), held: [],
       conflictOpen: false, reviewedHead: null, reviewedRun: null, pastPinHalt: false, dispositions: [], workers: new Set(),
-      finishers: new Set(),
+      finishers: new Set(), parked: [],
     };
     // The finisher-pr token currently deciding `pastPinHalt`, picked by
     // retry suffix ("" < "b" < "c" …) — never by row-text position. A
@@ -906,6 +952,10 @@ export function foldLedger({ rows, dispatched }, open, { lenient = false } = {})
       } else {
         const h = HELD.exec(tok);
         if (h) st.held.push(Number(h[1]));
+        // Every park the PR's rows carry: the tick matches each against the
+        // PR's current head and body, so a stale one is never cleared here.
+        const k = PARKED.exec(tok);
+        if (k) st.parked.push({ head: k[1], digest: k[2], reason: parkedReason(k[3]) });
         const c = CONFLICT_HOLD.exec(tok);
         if (c) {
           // Bound to the row's own PR: a hold naming another PR is a
@@ -1052,6 +1102,15 @@ export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed
   const state = (n) => byPr.get(n);
   const heldBehind = (st) => (st?.held ?? []).some((n) => open.has(n));
   const conflictHeld = (st) => st !== undefined && st.conflictOpen;
+  const mergeHeldOn = (p) => heldBehind(state(p.number)) || conflictHeld(state(p.number));
+  // The latest park on a queued PR whose head and body still match it, or
+  // undefined: a new head or an edited body lifts every earlier park.
+  const parkOn = (p) => {
+    const parks = state(p.number)?.parked ?? [];
+    if (parks.length === 0) return undefined;
+    const digest = bodyDigest(p.body);
+    return parks.findLast((k) => k.head === p.headRefOid.toLowerCase() && k.digest === digest);
+  };
   const anyLive = (names) => [...names].some((n) => members.get(n).outcome === null);
   const fixRunning = (st) => anyLive(st.fixMembers);
   // An open PR the ledger tracks that GitHub reads CONFLICTING — no other
@@ -1144,9 +1203,15 @@ export function deriveRun({ rows, dispatched, drain, retired = [] }, prs, closed
     // MERGED or CLOSED, the same lift rule as a `behind-pr` Exclusion. A
     // conflict hold lifts only once a fix-applier after it has SETTLED
     // `applied:`/`no-op` — never on dispatch alone.
-    mergeHeld: queued.filter((p) => heldBehind(state(p.number)) || conflictHeld(state(p.number))).length,
+    mergeHeld: queued.filter(mergeHeldOn).length,
     // How many of those are conflict holds — the HOLD row's wording, no field.
     mergeConflictHeld: queued.filter((p) => conflictHeld(state(p.number))).length,
+    // Each queued PR no hold counts that a park still matches, `{pr, reason}`
+    // ascending: the merge bot would only refuse it again.
+    mergeParked: queued.flatMap((p) => {
+      const k = mergeHeldOn(p) ? undefined : parkOn(p);
+      return k === undefined ? [] : [{ pr: p.number, reason: k.reason }];
+    }).sort((a, b) => a.pr - b.pr),
     // Finishers settled `labelled` on an open PR without the label.
     unlabelled: unlabelledFinishers({ rows, dispatched },
       new Set(prs.filter((p) => !isQueued(p)).map((p) => p.number))),
@@ -1622,7 +1687,7 @@ function openPrs() {
   let out;
   try {
     out = execFileSync("gh", ["pr", "list", "--state", "open", "--limit", String(PR_LIMIT),
-      "--json", "number,labels,closingIssuesReferences,headRefOid,mergeable"], { encoding: "utf8", timeout: GH_TIMEOUT_MS });
+      "--json", "number,labels,closingIssuesReferences,headRefOid,mergeable,body"], { encoding: "utf8", maxBuffer: MAX_BUFFER, timeout: GH_TIMEOUT_MS });
   } catch (e) {
     // Never interpolates e.stderr or e.message: execFileSync already forwarded
     // the child's stderr to ours, and Node builds e.message out of it, so
@@ -1642,12 +1707,12 @@ function openPrs() {
   // would leave that ticket's implementer counted twice. headRefOid likewise
   // — absent, a `halted:past-pin` PR would read as moved forever — and
   // mergeable: absent or outside GitHub's MergeableState enum, no PR would ever
-  // read CONFLICTING.
+  // read CONFLICTING. body too: absent, no park could ever be matched or lifted.
   if (!Array.isArray(prs) || prs.some((p) => !p || typeof p.number !== "number"
     || !Array.isArray(p.labels) || !Array.isArray(p.closingIssuesReferences)
     || !p.closingIssuesReferences.every((r) => r && Number.isInteger(r.number))
-    || typeof p.headRefOid !== "string" || !MERGEABLE_STATES.includes(p.mergeable))) {
-    die("gh pr list did not return {number,labels,closingIssuesReferences[{number}],headRefOid,mergeable} rows, mergeable one of MERGEABLE, CONFLICTING, UNKNOWN");
+    || typeof p.headRefOid !== "string" || !MERGEABLE_STATES.includes(p.mergeable) || typeof p.body !== "string")) {
+    die("gh pr list did not return {number,labels,closingIssuesReferences[{number}],headRefOid,mergeable,body} rows, mergeable one of MERGEABLE, CONFLICTING, UNKNOWN");
   }
   if (prs.length === PR_LIMIT) {
     die(`exactly ${PR_LIMIT} open PRs — the list is capped and may be truncated. Raise PR_LIMIT; a backlog that silently drops PRs is not a reconcile.`);

package/scripts/ledger.mjs

@@ -54,7 +54,7 @@ import { spawnSync, execFileSync } from "node:child_process";
 import { makeDie, isFlagLike, hasEqualsForm, isDigits, writeAll } from "./arg.mjs";
 import { fleetFile, FleetDirUnresolvable } from "./fleet-dir.mjs";
 import { parseMember, parseToken, memberTokens, nextMergeBot, nextRetry, liveOnLedger, retiredOnLedger, retiredName, readRetired, agentDefinition, CELL, tierValues, rowPr, rowWriteRefusal, isReviewToken, addedReviewToken, newSplitRow, splitRowClause, added, premisesOf, MEMBER_FAMILIES, HALT_CAUSES, ROWS, DISPATCHED, FILED, RULED, DRAIN, RETIRED, RECEIPT, archiveStamp, receiptArchiveName, CLOSEOUT_RECEIPT, closeoutArchiveName, BRIEFS, briefsArchiveName, memberRole, parseDispatchedEntry, dispatchedEntry, headerRe, escapeText, unescapeText, nextReviewerName } from "./ledger-grammar.mjs";
-import { deriveRun, LedgerError, labelOffMember, HELD, CONFLICT_HOLD } from "./fleet-tick.mjs";
+import { deriveRun, LedgerError, labelOffMember, HELD, CONFLICT_HOLD, PARKED } from "./fleet-tick.mjs";
 import { stateFileIn, readState, writeState, assessBeat, stallsAt } from "./fleet-state.mjs";
 import { processSource, ancestry, controllerOf, judgeController, ProcUnreadable } from "./proc.mjs";
 import { attemptLock, releaseLockFile, reapPathOf } from "./pid-lock.mjs";
@@ -2674,9 +2674,9 @@ function badLabelOff(words) {
 // ` · ` separator are no token. A member token is `dispatch`'s or `settle`'s,
 // a review token `review`'s. A word shaped like a member that the grammar
 // cannot parse, a `tier=` that is not a cell, a `tier=` naming a second tier
-// on a row that already has one, a `held-behind` or `conflict-hold` token the
-// tick cannot read, and a lone `→` — an arrow with no PR beside it points at
-// nothing — are refused. Every other word is a freeform token.
+// on a row that already has one, a `held-behind`, `conflict-hold` or `parked`
+// token the tick cannot read, and a lone `→` — an arrow with no PR beside it
+// points at nothing — are refused. Every other word is a freeform token.
 function tokenRefusal(tok, rowText) {
   if (tok === "" || /\s/.test(tok)) {
     return "is not one token — pass each token as its own argument, with no space in it";
@@ -2697,6 +2697,9 @@ function tokenRefusal(tok, rowText) {
       return `is not ${prefix}:#<M> — the tick reads only ${prefix}:#<number> and would ignore this one`;
     }
   }
+  if (tok.startsWith("parked=") && !PARKED.test(tok)) {
+    return "is not parked=<head>:<body digest>:main-gain-removed:<path> — the tick reads only a 40-hex head, a 12-hex body digest and a main-gain-removed reason, and would ignore this one";
+  }
   const [tier] = tierValues(tok);
   if (tier !== undefined) {
     if (!CELL.test(tier)) return "is not tier=<cell> — a cell is <slow|task|smol>-<level>";

package/scripts/merge-gate.mjs

@@ -23,14 +23,18 @@
 // member number only the bot knows, so the bot passes it and this script never
 // guesses it.
 //
-// Stdout: exactly one JSON line, `{pr, verdict, reason, head, pre, post,
-// rebaseCarry, behind, instruments, mainGain, ci}`, `rebaseCarry` naming the
-// labelled head and the head accepted as carrying it (`{labelled, accepted}`),
-// or null when no carry was proven, `mainGain` echoing main-gain.mjs's own
-// payload — hits, acknowledged removals and unchecked files — or null when
-// it did not run or printed no JSON object; an unusable payload is still
-// echoed. Stderr: the children's own diagnostics, passed straight through
-// and never folded into stdout.
+// Stdout: exactly one JSON line, `{pr, verdict, reason, head, bodyDigest, pre,
+// post, rebaseCarry, behind, instruments, mainGain, ci}`, `bodyDigest` the
+// first 12 hex of the sha256 of the body gh read (fleet-tick.mjs's
+// `bodyDigest`, the digest a `parked=` token binds — `fleet-event.mjs
+// merge-bot-report` parks a `main-gain-removed` refusal at this `head` and
+// `bodyDigest`), or null with `head` when gh could not be read, `rebaseCarry`
+// naming the labelled head and the head accepted as carrying it (`{labelled,
+// accepted}`), or null when no carry was proven, `mainGain` echoing
+// main-gain.mjs's own payload — hits, acknowledged removals and unchecked
+// files — or null when it did not run or printed no JSON object; an unusable
+// payload is still echoed. Stderr: the children's own diagnostics, passed
+// straight through and never folded into stdout.
 //
 // Exit vocabulary — the same three-way contract as inflight.sh, prove-merge.sh
 // and staleness.mjs:
@@ -77,6 +81,7 @@
 // no carry, and the head row blocks exactly as it does for any other moved head.
 
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -390,6 +395,7 @@ try {
     verdict,
     reason,
     head: prView?.headRefOid ?? null,
+    bodyDigest: prView === null ? null : createHash("sha256").update(prView.body).digest("hex").slice(0, 12),
     pre,
     post,
     rebaseCarry,

package/skills/run-team/SKILL.md

@@ -831,7 +831,7 @@ and flag the PR for a human. A new review of the PR counts again from none.
 
 | Failure | Response |
 |---|---|
-| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, nothing written to the ledger, and no member is dispatched to restore the lines — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
+| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, and no member is dispatched to restore the lines — the removal may be deliberate. `fleet-event.mjs merge-bot-report` parks it: a `parked=<head>:<body digest>:<reason>` token on its row, at the head and body digest the bot's gate reading `<scratch>/pr<pr>/merge-bot-<n>/ci.json` records it refused, and no bot is dispatched on its account — when nothing else queued is dispatchable the tick prints `HOLD (parked #<pr> <reason>)`, though a bot dispatched for another queued PR may still evaluate it again; a new head or an edited body lifts the park with no write. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
 | Merge bot's gate cannot answer the main-gain check (`main-gain-unanswerable`, exit 2) | Report `main-gain-unanswerable-#<pr>` with what it printed, PR stays queued, label untouched |
 
 ## Failure handling

package/skills/run-team/references/ledger.md

@@ -88,6 +88,8 @@ A member that dies between spawn and write is invisible — and members die in b
 
 `ci=<run-id>:<attempt>:<conclusion>` and `held-behind:#<lower>` are row tokens the same way, and so is `conflict-hold:#<pr>` — written by the merge bot itself (`run-merge-bot.md` step 1), or by you off the tick's `CONFLICT` line, naming the row's own PR. It is not an Exclusion: that gates a ticket's claim, this a PR's merge.
 
+`parked=<head>:<body digest>:main-gain-removed:<path>` is a row token too, written by `fleet-event.mjs merge-bot-report` off a merge bot's `main-gain-removed` refusal, binding the head and a digest of the body the bot's gate refused, read from its gate reading `<scratch>/pr<N>/merge-bot-<n>/ci.json`: while both still match, the tick counts the PR parked beside the held ones, so it alone never prints `DISPATCH merge-bot`, and a new head or an edited body lifts it with no write. No other refusal reason parks.
+
 ## The review pair on a PR's row
 
 A PR's review is not a member, so it carries its own pair of row tokens, written with `review` onto the PR's row (**The reviewer**): `review=wf:<runId>` | `review=member:<name>` at launch, `<name>` being `review-pr-<n>` for the PR's first runner and the next letter its rows do not carry yet (`review-pr-<n>-b`, `-c`, …) for every later one, settled dead as `…=failed`, then `reviewed=<head>:<survived>/<refuted>/<unverified>:<run>` when the result lands, `<run>` the review's `run-XXXXXXXX` run root under `<scratch>/pr<n>/`, which holds its `review.json`.