@humanbased/crosscheck 1.3.1-beta.7 → 1.6.0-beta.11

package/dist/commands/run.d.ts

@@ -2,6 +2,7 @@ import { type Vendor } from '../lib/vendor.js';
 import { type WorkflowStep } from '../lib/workflow.js';
 import { type PRRef } from '../lib/pr-spec.js';
 import { type ConcurrencyOpts } from '../lib/multi-run.js';
+import { type JudgedRecordShape } from '../lib/no-verdict.js';
 export interface RunOpts {
     config?: string;
     reviewer?: string;
@@ -14,6 +15,12 @@ export interface RunOpts {
         id?: number;
         body: string;
     };
+    /**
+     * A specific review comment to act on, from the `#issuecomment-<id>` anchor on
+     * the PR URL. Without it a fix step falls back to "whatever the latest review
+     * is", which can be a different comment from the one the user pasted.
+     */
+    reviewCommentId?: number;
     expectedHeadSha?: string;
     timeout?: string;
     noTimeout?: boolean;
@@ -26,6 +33,52 @@ export interface StepVendorOverrides {
 }
 export declare function resolveWorkflowSteps(allSteps: WorkflowStep[], stepFilter: string[] | undefined, assignedReviewer: 'claude' | 'codex', overrides?: StepVendorOverrides): WorkflowStep[];
 export declare function buildFixRecheckSteps(steps: WorkflowStep[], allSteps: WorkflowStep[], assignedReviewer: 'claude' | 'codex', overrides?: StepVendorOverrides): WorkflowStep[];
+/**
+ * The verdict standing on the PR when the report is printed — which this run is
+ * one of the things that can have changed.
+ *
+ * A run can post a `BLOCK` review and then have its recheck emit no parseable
+ * verdict: the workflow ends with `verdict === null` because the recheck is the
+ * last step to record one, while the `BLOCK` it just posted is what actually
+ * governs the PR. Pre-run history has never heard of that comment, so reporting
+ * from it either says nothing stands or names the verdict the run superseded —
+ * pointing the reader at an older commit while a fresh judgment sits on HEAD.
+ *
+ * A successful read supersedes the pre-run selection outright rather than being
+ * merged with it: it is a read of the same comments, one workflow later, so
+ * where the two disagree the later one is the PR's current state. The pre-run
+ * selection is the fallback for a failed read, not a floor.
+ *
+ * That only holds if the later read can see at least as far back as the earlier
+ * one, which is why it is not `fetchStepHistory` — see
+ * `fetchStandingVerdictRecords`, whose backward scan is complete where step
+ * detection's fast path truncates at the newest annotated review.
+ */
+export declare function standingVerdictForReport(preRun: {
+    verdict: string;
+    sha?: string;
+} | undefined, fetchHistory: () => Promise<readonly JudgedRecordShape[]>): Promise<{
+    verdict: string;
+    sha?: string;
+} | undefined>;
+/**
+ * The commit the no-verdict report measures the standing verdict against.
+ *
+ * The head captured at dispatch stops describing the PR the moment a step
+ * pushes: a resumed run can land a fix commit and then have its recheck gated
+ * out, which is the exact shape this report exists to explain. Comparing the
+ * standing verdict against the pre-run head there would claim it covers HEAD
+ * while an unjudged fix commit sits on top of it — the inverse of the truth.
+ *
+ * A failed read yields nothing rather than the pre-run head. Reporting the
+ * verdict without a staleness claim is what this report already does for a
+ * verdict whose own SHA is unknown; asserting coverage from a commit the run
+ * itself moved past is the defect. Nothing else consumes the head, so a run
+ * with no standing verdict never pays for the round-trip.
+ */
+export declare function headShaForStalenessClaim(standingVerdict: {
+    verdict?: string;
+} | undefined, fetchHead: () => Promise<string>): Promise<string | undefined>;
 export declare function runRun(prUrl: string, opts?: RunOpts): Promise<void>;
 export type RunSpecOpts = RunOpts & ConcurrencyOpts;
 export declare function buildRunChildArgs(ref: PRRef, opts: RunOpts): string[];

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAKlF,OAAO,EAA0G,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE9J,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAG3D,OAAO,EAAmG,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAO3J,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IACjC,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,eAAe,CAAA;CACrD;AAiBD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAkDD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EAAE,EACxB,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,gBAAgB,EAAE,QAAQ,GAAG,OAAO,EACpC,SAAS,GAAE,mBAAwB,GAClC,YAAY,EAAE,CAgBhB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EAAE,EACrB,QAAQ,EAAE,YAAY,EAAE,EACxB,gBAAgB,EAAE,QAAQ,GAAG,OAAO,EACpC,SAAS,GAAE,mBAAwB,GAClC,YAAY,EAAE,CAehB;AAgBD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,OAAY,iBAmpB7D;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,eAAe,CAAA;AAKnD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAerE;AAKD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDpF;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAKlF,OAAO,EAA0G,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE9J,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAG3D,OAAO,EAAmG,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE3J,OAAO,EAAsE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAMjI,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IACjC,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,eAAe,CAAA;CACrD;AAiBD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAkDD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,YAAY,EAAE,EACxB,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,gBAAgB,EAAE,QAAQ,GAAG,OAAO,EACpC,SAAS,GAAE,mBAAwB,GAClC,YAAY,EAAE,CAgBhB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EAAE,EACrB,QAAQ,EAAE,YAAY,EAAE,EACxB,gBAAgB,EAAE,QAAQ,GAAG,OAAO,EACpC,SAAS,GAAE,mBAAwB,GAClC,YAAY,EAAE,CAehB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrD,YAAY,EAAE,MAAM,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAOxD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC5C,eAAe,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACjD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAgBD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,OAAY,iBAwwB7D;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,eAAe,CAAA;AAKnD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAerE;AAKD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DpF;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}

package/dist/commands/run.js

@@ -1,4 +1,3 @@
-import { execFileSync } from 'child_process';
 import { mkdtempSync, rmSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
@@ -6,8 +5,9 @@ import chalk from 'chalk';
 import { execa } from 'execa';
 import { parseDuration } from '../lib/durations.js';
 import ora from 'ora';
-import { createGithubClient } from '../github/client.js';
-import { fetchStepHistory, identifyNextWorkflowStep } from '../lib/pr-workflow-state.js';
+import { createGithubClient, fetchIssueComment } from '../github/client.js';
+import { parseAnnotation } from '../lib/annotation.js';
+import { fetchStandingVerdictRecords, fetchStepHistoryWithRetry, identifyNextWorkflowStep } from '../lib/pr-workflow-state.js';
 import { detectOriginFull, assignReviewer } from '../github/detector.js';
 import { loadConfig, getGithubToken, getLinearApiKey, getLinearCredentials } from '../config/loader.js';
 import { enrichIssueContext } from '../issues/enrich.js';
@@ -23,9 +23,10 @@ import { closedPRSkip } from '../lib/pr-state.js';
 import { resolveCliInvocation } from '../lib/cli-invocation.js';
 import { executeMultiPR, resolveRunConcurrency, printMultiPRSummary, concurrencyError, aggregateExitCode } from '../lib/multi-run.js';
 import { formatVerdict } from '../lib/verdict.js';
-import { clonePRForReview } from '../lib/clone.js';
+import { buildNoVerdictReport, renderNoVerdictReport, selectStandingVerdict } from '../lib/no-verdict.js';
+import { clonePRForReview, runGitWithoutHooks, BaseRefUnavailableError } from '../lib/clone.js';
 import { acquirePRLock, releasePRLock } from '../lib/pr-lock.js';
-import { checkRemoteLock, acquireRemoteLock, releaseRemoteLock, startRemoteLockHeartbeat } from '../github/review-status.js';
+import { checkRemoteLock, acquireRemoteLock, claimRemoteLock, releaseRemoteLock, startRemoteLockHeartbeat } from '../github/review-status.js';
 function meetsCrazyStopCondition(verdict, mode) {
     if (verdict === null)
         return false;
@@ -118,6 +119,62 @@ export function buildFixRecheckSteps(steps, allSteps, assignedReviewer, override
     }
     return fixRecheckSteps;
 }
+/**
+ * The verdict standing on the PR when the report is printed — which this run is
+ * one of the things that can have changed.
+ *
+ * A run can post a `BLOCK` review and then have its recheck emit no parseable
+ * verdict: the workflow ends with `verdict === null` because the recheck is the
+ * last step to record one, while the `BLOCK` it just posted is what actually
+ * governs the PR. Pre-run history has never heard of that comment, so reporting
+ * from it either says nothing stands or names the verdict the run superseded —
+ * pointing the reader at an older commit while a fresh judgment sits on HEAD.
+ *
+ * A successful read supersedes the pre-run selection outright rather than being
+ * merged with it: it is a read of the same comments, one workflow later, so
+ * where the two disagree the later one is the PR's current state. The pre-run
+ * selection is the fallback for a failed read, not a floor.
+ *
+ * That only holds if the later read can see at least as far back as the earlier
+ * one, which is why it is not `fetchStepHistory` — see
+ * `fetchStandingVerdictRecords`, whose backward scan is complete where step
+ * detection's fast path truncates at the newest annotated review.
+ */
+export async function standingVerdictForReport(preRun, fetchHistory) {
+    try {
+        return selectStandingVerdict(await fetchHistory());
+    }
+    catch {
+        // Best-effort: fall back to what step detection already read this run.
+        return preRun;
+    }
+}
+/**
+ * The commit the no-verdict report measures the standing verdict against.
+ *
+ * The head captured at dispatch stops describing the PR the moment a step
+ * pushes: a resumed run can land a fix commit and then have its recheck gated
+ * out, which is the exact shape this report exists to explain. Comparing the
+ * standing verdict against the pre-run head there would claim it covers HEAD
+ * while an unjudged fix commit sits on top of it — the inverse of the truth.
+ *
+ * A failed read yields nothing rather than the pre-run head. Reporting the
+ * verdict without a staleness claim is what this report already does for a
+ * verdict whose own SHA is unknown; asserting coverage from a commit the run
+ * itself moved past is the defect. Nothing else consumes the head, so a run
+ * with no standing verdict never pays for the round-trip.
+ */
+export async function headShaForStalenessClaim(standingVerdict, fetchHead) {
+    if (!standingVerdict?.verdict)
+        return undefined;
+    try {
+        return await fetchHead();
+    }
+    catch {
+        // Best-effort: the report drops the staleness line rather than guessing.
+        return undefined;
+    }
+}
 function printRoundModeBanner(mode) {
     const BLINK = '\x1b[5m';
     const RESET = '\x1b[0m';
@@ -258,17 +315,70 @@ export async function runRun(prUrl, opts = {}) {
     }
     let stepFilter = opts.steps?.split(',').map(s => s.trim().toLowerCase());
     let initialReviewComment = opts.initialReviewComment;
+    // An explicit `#issuecomment-<id>` anchor names the review to act on. Resolve it
+    // here rather than letting the step fall back to the latest review: the two are
+    // often the same comment, and when they are not, the silent substitution means
+    // the command did something other than what the URL said.
+    if (initialReviewComment === undefined && opts.reviewCommentId !== undefined) {
+        const anchored = await fetchIssueComment(owner, repo, opts.reviewCommentId, token);
+        if (!anchored) {
+            console.error(chalk.red(`✗ Comment ${opts.reviewCommentId} not found on ${owner}/${repo}`));
+            process.exit(1);
+        }
+        // Compared case-insensitively: GitHub echoes the repository's canonical casing,
+        // so a URL typed with different case (github.com/HumanBased-AI/...) would fail an
+        // exact compare while naming the very same PR. The check still pins the comment
+        // to this owner/repo/number, which is the property that matters.
+        const expectedIssueUrl = `https://api.github.com/repos/${owner}/${repo}/issues/${number}`;
+        if (anchored.issue_url?.toLowerCase() !== expectedIssueUrl.toLowerCase()) {
+            console.error(chalk.red(`✗ Comment ${opts.reviewCommentId} does not belong to ${owner}/${repo}#${number} — nothing to act on`));
+            process.exit(1);
+        }
+        // The annotation tag is plain HTML in a comment body — any PR commenter can post
+        // one. It only proves provenance when the comment also comes from the token's own
+        // account, the same check watch.ts's onComment handler makes against
+        // authenticatedLogin. Fail closed if the authenticated user can't be determined.
+        let authenticatedLogin = null;
+        try {
+            const { data: me } = await createGithubClient(token).rest.users.getAuthenticated();
+            authenticatedLogin = me.login;
+        }
+        catch {
+            authenticatedLogin = null;
+        }
+        if (authenticatedLogin === null || anchored.user.login !== authenticatedLogin) {
+            console.error(chalk.red(`✗ Comment ${opts.reviewCommentId} was not posted by crosscheck — nothing to act on`));
+            process.exit(1);
+        }
+        // A comment ID is user-supplied and untrusted, so this mutation path requires the
+        // stricter annotation-based check rather than isFreshReviewComment's legacy header
+        // fallback — the header alone is too permissive to gate a fix dispatch on.
+        const parsedAnnotation = parseAnnotation(anchored.body);
+        if (!parsedAnnotation || parsedAnnotation.type !== 'review') {
+            console.error(chalk.red(`✗ Comment ${opts.reviewCommentId} is not a crosscheck review comment — nothing to act on`));
+            process.exit(1);
+        }
+        initialReviewComment = { id: opts.reviewCommentId, body: anchored.body };
+        console.log(chalk.dim(`  targeting review comment ${opts.reviewCommentId}`));
+    }
     // When running without an explicit --steps flag, detect the next step from live
     // PR comment history. When triggered by kickass the dispatch is intentionally
     // one-step-at-a-time (watch owns continuation via webhooks). For all other
     // triggers (direct user invocation, backtrace, etc.) run all remaining steps
     // from the detected starting point so a standalone `ck run` still works end-to-end.
+    // The verdict already on the PR when this run started, if any — taken from the
+    // history step detection has to fetch anyway, so it costs nothing here. The
+    // no-verdict report re-reads at reporting time and prefers that; this is what
+    // it falls back to when the re-read fails, and all an explicit --steps run
+    // (which never fetches here) has to fall back to is nothing.
+    let standingVerdict;
     if (!opts.steps) {
         try {
-            const history = await fetchStepHistory(owner, repo, number, token);
+            const history = await fetchStepHistoryWithRetry(owner, repo, number, token);
             // prData comes from pulls.get, which carries `mergeable` — so routing a conflicted
             // PR to conflict-resolve costs no extra call here.
             const nextResult = identifyNextWorkflowStep(history, allSteps, prData.head.sha, { mergeable: prData.mergeable });
+            standingVerdict = selectStandingVerdict(history);
             if (nextResult.step === null) {
                 if (nextResult.stopReason === 'approved') {
                     // This commit is approved; a push moves HEAD and re-opens the workflow.
@@ -304,7 +414,16 @@ export async function runRun(prUrl, opts = {}) {
                 // so the subprocess exits non-zero and kickass records a retryable failure.
                 throw err;
             }
-            /* best-effort for other triggers — fall through to normal review flow */
+            // Fail closed here too. This history is what carries the approval stop and the
+            // per-SHA dedup, so falling through without it re-reviews commits that are
+            // already approved — measured on 2026-09-19, when a batch of `ck run`
+            // invocations rate-limited this fetch and re-reviewed four already-APPROVEd
+            // SHAs. `--steps` remains the deliberate way to force a pass without history.
+            const message = err instanceof Error ? err.message : String(err);
+            fileLog({ level: 'warn', event: 'pr_skipped', repo: `${owner}/${repo}`, pr: number, reason: 'history_unavailable', sha: prData.head.sha, error: message });
+            console.log(chalk.yellow(`⚠  could not read PR history (${message}) — skipping rather than risk re-reviewing an approved commit`));
+            console.log(chalk.dim('   use --steps review to force a pass without history detection'));
+            return;
         }
     }
     const stepVendorOverrides = {
@@ -441,7 +560,15 @@ export async function runRun(prUrl, opts = {}) {
                 // request still triggers releaseRemoteLock (GitHub may have already
                 // created the pending status server-side).
                 lockAttemptStarted = true;
-                await acquireRemoteLock(octokit, owner, repo, sha);
+                if (!await claimRemoteLock(octokit, owner, repo, sha)) {
+                    // Another instance claimed this commit inside the check-then-act window.
+                    // Its claim is the live one, so leave it alone and drop ours.
+                    releasePRLock(owner, repo, number, sha);
+                    lockAttemptStarted = false;
+                    fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repo}`, pr: number, reason: 'lost_remote_claim', sha });
+                    console.log(chalk.yellow(`⚠  PR #${number} was claimed by another crosscheck instance — skipping`));
+                    return;
+                }
             }
             catch (err) {
                 releasePRLock(owner, repo, number, sha);
@@ -470,12 +597,20 @@ export async function runRun(prUrl, opts = {}) {
                 && linearWritePossible(config.linear, roundModeCanWrite ? undefined : filteredSteps)
                 ? await resolveLinearAuth(config.linear, getLinearCredentials(config.linear.auth))
                 : null;
-            await clonePRForReview({
-                owner, repo, prNumber: number, baseRef: prData.base.ref,
+            const { baseRefStatus } = await clonePRForReview({
+                owner, repo, prNumber: number, baseRef: prData.base.ref, baseSha: prData.base.sha,
                 tmpDir, token, protocol: config.clone_protocol,
                 onBaseFetchFailed: () => fileLog({ level: 'warn', event: 'base_branch_fetch_skipped', repo: `${owner}/${repo}`, pr: number, base: prData.base.ref }),
+                onBaseRefRecovered: status => fileLog({ level: 'info', event: 'base_ref_recovered', repo: `${owner}/${repo}`, pr: number, base: prData.base.ref, via: status }),
             });
             cloneSpinner.succeed('Repo ready');
+            if (baseRefStatus === 'unavailable') {
+                fileLog({ level: 'error', event: 'base_ref_unavailable', repo: `${owner}/${repo}`, pr: number, base: prData.base.ref, base_sha: prData.base.sha });
+                throw new BaseRefUnavailableError(prData.base.ref);
+            }
+            if (baseRefStatus !== 'fetched') {
+                console.log(chalk.yellow(`  base ref origin/${prData.base.ref} was missing — recovered ${baseRefStatus === 'recovered_by_sha' ? 'from the PR base commit' : "from the PR's merge ref"}`));
+            }
             // Recover the linked tracker issue (if enabled) so the review is anchored
             // to the stated goal, not just the diff. Done here — after the PR and
             // remote locks are secured — so a PR that gets skipped (already under
@@ -501,6 +636,10 @@ export async function runRun(prUrl, opts = {}) {
                 overrideTimeoutMs: reviewerTimeoutMs,
                 trigger: opts.trigger ?? 'run',
                 issueContext,
+                // Only the CLI flag counts. Resume also narrows `filteredSteps`, but it
+                // starts mid-workflow and still runs to the end, so it is not the operator
+                // scoping this run to a subset.
+                stepsExplicitlyScoped: opts.steps !== undefined,
             };
             let workflowResult = await runWorkflow({
                 ...sharedCtx,
@@ -617,8 +756,8 @@ export async function runRun(prUrl, opts = {}) {
                         // next attempt starts from a clean state. vendor_limit never touches files.
                         if (workflowResult.fixSkipReason === 'fix_error') {
                             try {
-                                execFileSync('git', ['reset', '--hard', 'HEAD'], { cwd: tmpDir, stdio: 'pipe' });
-                                execFileSync('git', ['clean', '-fd'], { cwd: tmpDir, stdio: 'pipe' });
+                                runGitWithoutHooks(tmpDir, ['reset', '--hard', 'HEAD']);
+                                runGitWithoutHooks(tmpDir, ['clean', '-fd']);
                             }
                             catch {
                                 fileLog({ level: 'warn', event: 'step_skipped', repo: `${owner}/${repo}`, pr: number, reason: 'worktree_reset_failed', mode, round: loopRound });
@@ -712,33 +851,66 @@ export async function runRun(prUrl, opts = {}) {
                 }
             }
             activeSpinner.stop();
-            // A run is "no step ran" only when every step across every round skipped.
-            // If the first round skips everything but a later crazy/halfcrazy round
-            // runs a fix, the overall run did work and should not report "no step ran".
-            const ranNothing = accumulatedStepOutcomes !== undefined
-                && accumulatedStepOutcomes.ran.length === 0
-                && accumulatedStepOutcomes.skipped.length > 0;
-            if (strategySkipped) {
-                console.log(chalk.dim(`\n  skipped — ${strategySkipped} class, nothing to review`));
-            }
-            else if (accumulatedStepOutcomes && ranNothing) {
-                // Every dispatched step skipped. `verdict —` on its own reads as "ran and
-                // found nothing", and the green line below then certified a no-op as a
-                // success — which is how conflict-resolve skipping for want of a vendor
-                // went unnoticed across a whole batch of PRs. The reasons are the report.
-                console.log(chalk.yellow(`\n  no step ran`));
-                for (const { step, reason } of accumulatedStepOutcomes.skipped) {
-                    console.log(chalk.dim(`    ${step} — ${reason}`));
-                }
+            // Every run that ends without a verdict gets the same report, whatever the
+            // steps did. Keying on the steps instead — "nothing ran", as this did
+            // before — only moves the blind spot: PR #2548 ran its fix step, applied
+            // nothing, had recheck gated out by `fix.applied_count > 0`, and printed a
+            // bare `verdict —` under a green checkmark. So did a review that ran at
+            // full price and emitted no parseable VERDICT: line. What makes a verdict
+            // missing is what became of the steps that produce one.
+            if (verdict === null) {
+                // Both claims the report makes about the PR — what verdict stands, and
+                // whether it covers HEAD — are claims about now, so both are read now.
+                const standingNow = await standingVerdictForReport(standingVerdict, () => fetchStandingVerdictRecords(owner, repo, number, token));
+                const reportHeadSha = await headShaForStalenessClaim(standingNow, async () => {
+                    const { data: currentPR } = await octokit.rest.pulls.get({ owner, repo, pull_number: number });
+                    return currentPR.head.sha;
+                });
+                const report = buildNoVerdictReport({
+                    workflowSteps: allSteps,
+                    outcomes: accumulatedStepOutcomes,
+                    strategySkipped,
+                    // Resume narrows the step list too, but it still runs to the end of
+                    // the workflow — only an explicit ask counts as deliberate scoping.
+                    stepsExplicitlyScoped: opts.steps !== undefined || opts.trigger === 'kickass',
+                    prUrl,
+                    ...(standingNow && { standingVerdict: standingNow }),
+                    ...(reportHeadSha !== undefined && { headSha: reportHeadSha }),
+                });
+                console.log('');
+                renderNoVerdictReport(report).forEach((line, i) => {
+                    if (line === '')
+                        return console.log('');
+                    // The headline carries the alarm and the recommended command is what
+                    // the reader is meant to copy, so neither is dimmed into the body.
+                    if (i === 0)
+                        return console.log(report.expected ? chalk.dim(`  ${line}`) : chalk.yellow(`  ${line}`));
+                    console.log(line.startsWith('→ ') ? `  ${line}` : chalk.dim(`  ${line}`));
+                });
+                fileLog({
+                    level: report.expected ? 'info' : 'warn',
+                    event: 'workflow_no_verdict',
+                    repo: `${owner}/${repo}`,
+                    pr: number,
+                    cause: report.cause,
+                    expected: report.expected,
+                    verdict_steps: report.verdictSteps,
+                    ...(accumulatedStepOutcomes && {
+                        ran: accumulatedStepOutcomes.ran,
+                        skipped: accumulatedStepOutcomes.skipped,
+                    }),
+                });
+                // Exit code is unchanged: a run with no verdict is a legitimate outcome,
+                // not a failure, and the exit codes are part of the CLI contract. The
+                // marker is the signal — ⚠ only when a verdict was actually in reach.
+                console.log(report.expected
+                    ? chalk.green(`\n✓ Workflow complete — ${prUrl}\n`)
+                    : chalk.yellow(`\n⚠  Workflow complete, no verdict — ${prUrl}\n`));
             }
             else {
                 console.log(`\n  ${formatVerdict(verdict)}`);
+                console.log(chalk.green(`\n✓ Workflow complete — ${prUrl}\n`));
             }
-            // Exit code is unchanged: a skipped step is a legitimate outcome, not a
-            // failure, and the exit codes are part of the CLI contract.
-            console.log(ranNothing && !strategySkipped
-                ? chalk.yellow(`\n⚠  Workflow complete, no step ran — ${prUrl}\n`)
-                : chalk.green(`\n✓ Workflow complete — ${prUrl}\n`));
         }
         catch (err) {
             workflowError = err;
@@ -820,9 +992,19 @@ export async function runRunSpec(spec, opts = {}) {
         process.exit(1);
     }
     if (refs.length === 1) {
-        await runRun(refs[0].url, opts);
+        await runRun(refs[0].url, {
+            ...opts,
+            ...(refs[0].commentId !== undefined && { reviewCommentId: refs[0].commentId }),
+        });
         return;
     }
+    // Past this point the spec fans out across PRs; a comment anchor names exactly
+    // one review and cannot be applied to all of them.
+    const anchored = refs.filter(r => r.commentId !== undefined);
+    if (anchored.length > 0) {
+        console.error(chalk.red('✗ an #issuecomment- anchor targets a single review comment and cannot be combined with multiple PRs'));
+        process.exit(1);
+    }
     // expected-head-sha is a single-PR guard (set by kickass dispatch); it can't
     // apply to a fan-out across many heads.
     if (opts.expectedHeadSha !== undefined) {