@muggleai/works 5.14.0-staging.96 → 5.14.0-staging.98

package/dist/plugin/hooks/hooks.json

@@ -190,6 +190,12 @@
             "async": false,
             "timeout": 10
           },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/scripts/guardrail-build-followthrough-gate.sh\"",
+            "async": false,
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "bash \"${CLAUDE_PLUGIN_ROOT}/scripts/guardrail-walkthrough-gate.sh\"",

package/dist/plugin/scripts/guardrail-build-followthrough-gate.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# build-followthrough gate (Stop). When the front-door router took a
+# build/implement/fix prompt this session but no PR was ever opened, block the
+# turn end and point at /muggle-do (or the MUGGLE_BUILD_SKIP escape hatch). The
+# router's offer is advisory and a session that finds the root cause can still
+# end without shipping it — the fix then lives only in a transcript that dies
+# with the session, and no other gate catches it: the watcher gate only fires on
+# a PR that already exists.
+#
+# Mirrors guardrail-watch-gate.sh: synchronous (only a sync Stop hook can block
+# the turn end), fires on EVERY turn end, and pre-filters in shell so Node spawns
+# only when a build request was routed and no PR was handled. On the
+# overwhelming majority of turns no build intent was detected, so the state file
+# is absent or the flag is unset and we return {} in-shell, never paying Node
+# cold-start. Degrades to {}.
+payload="$(cat)"
+
+raw_sid="$(printf '%s' "$payload" | grep -oE '"session_id"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*:[[:space:]]*"([^"]*)".*/\1/')"
+[ -n "$raw_sid" ] || raw_sid="unknown"
+sid="$(printf '%s' "$raw_sid" | sed 's/[^A-Za-z0-9_-]/_/g')"
+
+# Resolve the same home dir Node's os.homedir() uses. HOME is correct on
+# macOS/Linux and on most Git Bash setups; fall back to converting USERPROFILE
+# when HOME doesn't hold the state dir (some Windows shells point HOME elsewhere).
+home="${HOME:-}"
+if [ ! -d "$home/.muggle-ai" ] && command -v cygpath >/dev/null 2>&1 && [ -n "${USERPROFILE:-}" ]; then
+  home="$(cygpath -u "$USERPROFILE" 2>/dev/null || printf '%s' "$home")"
+fi
+
+# A non-empty prsHandled array spans lines, so the empty match reliably says no
+# PR was opened. Skip Node unless a build request was routed and nothing shipped.
+state_file="$home/.muggle-ai/guardrails/$sid.json"
+if [ ! -f "$state_file" ] \
+  || ! grep -q '"buildIntentRouted": true' "$state_file" \
+  || ! grep -q '"prsHandled": \[\]' "$state_file" \
+  || grep -q '"buildSkipped": true' "$state_file"; then
+  printf '{}'
+  exit 0
+fi
+
+root="${CLAUDE_PLUGIN_ROOT:-${CURSOR_PLUGIN_ROOT:-}}"
+printf '%s' "$payload" | node "${root}/scripts/guardrails.mjs" build-followthrough-gate 2>/dev/null || printf '{}'

package/dist/plugin/scripts/guardrails.mjs

@@ -13,6 +13,7 @@ var GH_PR_REOPENED_LINE = /\bReopened pull request [\w./-]*#(\d+)/;
 var PR_MONITOR_TERMINAL_LINE = /\bTERMINAL pr=(\d+): (MERGED|CLOSED)\b/;
 var MAX_PR_TERMINAL_BLOCKS = 3;
 var MAX_WATCH_BLOCKS = 3;
+var MAX_BUILD_BLOCKS = 3;
 var MAX_WALKTHROUGH_BLOCKS = 3;
 var GH_LOOKUP_TIMEOUT_MS = 1e4;
 var MUGGLE_SKILL_EMIT_TOOL = /muggle-local-telemetry-skill-emit/i;
@@ -583,6 +584,25 @@ function watchGateDecision(state, untrackedPrUrls, maxBlocks = MAX_WATCH_BLOCKS)
     untracked: untrackedPrUrls
   };
 }
+
+// src/guardrails/buildFollowthrough.ts
+var BUILD_SKIP_MARKER = /^\s*echo\s+["']?MUGGLE_BUILD_SKIP\b/;
+function isBuildSkipMarker(cmd) {
+  return BUILD_SKIP_MARKER.test(cmd);
+}
+function applyBuildSkip(state, skipped) {
+  if (!skipped || state.buildSkipped === true) return state;
+  return { ...state, buildSkipped: true };
+}
+function buildFollowthroughDecision(state, maxBlocks = MAX_BUILD_BLOCKS) {
+  const blockCount = state.buildBlockCount ?? 0;
+  const owed = state.buildIntentRouted === true && state.buildSkipped !== true && state.prsHandled.length === 0;
+  if (!owed) return { action: "none" /* None */, blockCount };
+  if (blockCount >= maxBlocks) {
+    return { action: "release" /* Release */, blockCount };
+  }
+  return { action: "block" /* Block */, blockCount: blockCount + 1 };
+}
 var REPORT_SENTINEL = "muggle-pr-section";
 var PR_PROSE_CMD = /\bgh\s+pr\s+(comment|create|edit)\b/;
 var GH_API_CMD = /\bgh\s+api\b/;
@@ -1080,7 +1100,8 @@ function recordTests() {
     e2eSkipped: isE2ESkipMarker(cmd)
   });
   const withWatchSkip = applyWatchSkip(recorded, isWatchSkipMarker(cmd));
-  const withWalkthroughPost = applyWalkthroughPosted(withWatchSkip, detectWalkthroughPost(input));
+  const withBuildSkip = applyBuildSkip(withWatchSkip, isBuildSkipMarker(cmd));
+  const withWalkthroughPost = applyWalkthroughPosted(withBuildSkip, detectWalkthroughPost(input));
   const withWalkthroughSkip = applyWalkthroughSkip(withWalkthroughPost, isWalkthroughSkipMarker(cmd));
   const failedRunId = detectFailedRunId(input);
   const next = failedRunId ? applyFailedRun(withWalkthroughSkip, failedRunId) : withWalkthroughSkip;
@@ -1179,6 +1200,16 @@ function watchGate() {
   const reason = decision.blockCount === 1 ? `Do not end the turn yet. A PR was opened this session but no muggle-do session slot tracks it: ${prList}. Seed the slot and hand off per muggle-do Stage 8 \u2014 /muggle:muggle-pr-followup ${decision.untracked[0]} does both. Seeding is what matters: once a slot exists, reconcile arms it at the next session start and finalizes it when the PR goes terminal, so an unarmed slot is fine but no slot means nothing ever picks this PR up. If it genuinely should not be tracked (autoWatchPR=never, handed off elsewhere), tell the user why and run \`echo "MUGGLE_WATCH_SKIP: <reason>"\` \u2014 that records the skip and keeps this gate quiet for the rest of the session.` : `PR hand-off still owed for ${prList} (reminder ${decision.blockCount}/${MAX_WATCH_BLOCKS}): seed a slot via /muggle:muggle-pr-followup, or record a legitimate skip via \`echo "MUGGLE_WATCH_SKIP: <reason>"\`.`;
   return blockStop(reason, host);
 }
+function buildFollowthroughGate() {
+  const state = readState(sessionId);
+  const decision = buildFollowthroughDecision(state);
+  if (decision.action === "release" /* Release */) return releaseGate("buildSkipped");
+  if (decision.action === "none" /* None */) return "{}";
+  state.buildBlockCount = decision.blockCount;
+  writeState(state);
+  const reason = decision.blockCount === 1 ? `Do not end the turn yet. This session took a build/implement/fix request but no PR was opened. A root cause written into the transcript ships nothing \u2014 once the session ends it is gone, and the watcher gate never fires because it only looks at PRs that exist. Carry the work to a PR via /muggle-do, which runs requirements \u2192 build \u2192 impact \u2192 unit tests \u2192 E2E \u2192 PR \u2192 watcher. If no PR is owed here (the user changed their mind, the fix landed in another repo, the answer was advice rather than a change), tell the user why and run \`echo "MUGGLE_BUILD_SKIP: <reason>"\` \u2014 that records the skip and keeps this gate quiet for the rest of the session.` : `Build request still unanswered \u2014 no PR opened (reminder ${decision.blockCount}/${MAX_BUILD_BLOCKS}): carry it to a PR via /muggle-do, or record a legitimate skip via \`echo "MUGGLE_BUILD_SKIP: <reason>"\`.`;
+  return blockStop(reason, host);
+}
 function walkthroughGate() {
   const state = readState(sessionId);
   if (state.e2eRun !== true || state.walkthroughPosted === true || state.walkthroughSkipped === true) {
@@ -1302,6 +1333,7 @@ var handlers = {
   "e2e-gate": e2eGate,
   "terminal-gate": terminalGate,
   "watch-gate": watchGate,
+  "build-followthrough-gate": buildFollowthroughGate,
   "walkthrough-gate": walkthroughGate,
   "record-comment-replies": recordCommentReplies,
   "comment-reply-gate": commentReplyGate,

package/dist/plugin/scripts/pr-watch-guards.sh

@@ -85,3 +85,33 @@ watcher_pid_alive() {
     [ -n "$pid" ] || return 1
     kill -0 "$pid" 2>/dev/null
 }
+
+# True when the slot's lease is held by a live loop that no longer belongs to the
+# session arming now — the deaf-orphan case.
+#
+# A live PID proves the loop is running; it never proves anything is listening.
+# On Windows a detached loop outlives the session that launched it, keeps
+# polling, and keeps touching its heartbeat, while its stdout is the dead
+# session's monitor pipe. Every liveness signal reads healthy and the events
+# reach nobody. Because arming skipped on a live PID alone, that corpse blocked
+# a live session from arming the PR for the whole lifetime cap — seven days
+# since the default moved off six hours.
+#
+# Deliberately narrow. It answers only "is this lease held on behalf of some
+# other session", which is decidable from state already on disk. It says nothing
+# about a loop orphaned by its own session's monitor dying, where the owner still
+# matches; that one needs a signal from the reader, which no file here carries.
+#
+# Conservative on every unknown — no watch.pid, a dead PID, no owner.json, or no
+# current session id all answer false, so a slot is never reclaimed on a guess.
+watcher_lease_is_foreign() {
+    local slot="$1" current_session="$2" owner_pid owner_session
+    [ -n "$current_session" ] || return 1
+    [ -f "${slot}/watch.pid" ] || return 1
+    owner_pid=$(tr -d ' \r\n' < "${slot}/watch.pid" 2>/dev/null)
+    watcher_pid_alive "$owner_pid" || return 1
+    [ -f "${slot}/owner.json" ] || return 1
+    owner_session=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "${slot}/owner.json" | head -1)
+    [ -n "$owner_session" ] || return 1
+    [ "$owner_session" != "$current_session" ]
+}

package/dist/plugin/skills/muggle-pr-followup/arm-watcher.md

@@ -14,7 +14,11 @@ Read the `DRAIN` lines it prints: they are the outstanding work the monitor will
 
 1. **Drain.** Run one tick per [`contract.md`](contract.md). It acts on everything already outstanding — actionable threads (`gitlab`: discussions), body-only reviews past the watermark (GitHub-only — GitLab has no review envelope), a stale branch, red CI — and finalizes a terminal PR. If the tick dispatched a cycle, stop here: the cycle's exit path settles the watch when it finishes.
 2. **Seed the watermark.** *(`pr-watch-arm.sh` does this; the reasoning is kept because the floors are subtle and wrong ones are quiet.)* Resolve the provider once per [`../_shared/vcs/detect-vcs.md`](../_shared/vcs/detect-vcs.md) — every fetch in this sequence uses that provider's recipes. Write the slot's watch watermark ([`state-schemas.md`](state-schemas.md#watch-watermarkenv)) to the ids the **drain itself read** — the max review-id and comment-id observed at the drain's own fetch (Step 1), snapshotted at that read. Never let the loop capture its own baseline — the arming session writes it; and **never** from a fresh fetch taken after the drain, which would include a comment that arrived after the drain read the wave and mark it seen unread. Seeded to the drain's floor, anything landing after that read stays above the watermark and the monitor's first iteration surfaces it. Seed the CI floor (`CIRED`) from the same drain read: set it to the head SHA when the checks have **already settled red** at that read (no check pending, one or more in the `fail` bucket per [`../_shared/vcs/common/ci-rollup.md`](../_shared/vcs/common/ci-rollup.md)) — that red is what the drain just handled — and empty otherwise, so an escalated red head the drain already saw does not re-fire on the loop's first iteration. Seed the rebase floor (`REBASED`) the same way, from the drain's branch-standing read per [`../_shared/vcs/common/branch-standing.md`](../_shared/vcs/common/branch-standing.md): set it to the current `rebase_key` (`<head_sha>..<base_tip_sha>`) when the drain found the branch already behind or conflicting — that staleness is what the drain just handled — and empty otherwise, so a branch the drain already rebased or escalated does not re-fire on the loop's first iteration. Seed the blocked-CI floor (`BLOCKED_CIDIGEST`) to the blocked fingerprint's `ci_digest` when arming while `last_seen.blocked` is already set, and empty otherwise — empty is the not-blocked state, in which the loop's blocked-resume probe stays dormant.
-3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds), a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
+3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds) **and `owner.json` records this session**, a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
+
+   **A live lease owned by a different session does not count as owned** — check it with `watcher_lease_is_foreign` from [`../../scripts/pr-watch-guards.sh`](../../scripts/pr-watch-guards.sh). A live PID proves the loop is running, never that anything is listening: an orphan left by a dead session keeps polling and keeps touching its heartbeat while its stdout is that session's closed monitor pipe, so every liveness signal reads healthy and the events reach nobody. Skipping on the PID alone let such a corpse block this session from arming the PR for the whole lifetime cap — seven days, since the default moved off six hours. When the guard reports a foreign lease, kill that PID, delete `watch.pid`, and arm fresh; note it in the slot's `followup.log` so the reclaim is visible.
+
+   This is narrow on purpose. It reclaims only a lease held on behalf of *another* session, which is decidable from `owner.json` alone. A loop orphaned by its **own** session's monitor dying still reads as owned, and nothing on disk distinguishes it — that needs a signal from the reader, which no slot file carries. Treat an armed watcher as evidence a poller exists, never as proof a review will be seen.
 
    Otherwise **claim the slot for this session** before starting anything: write `owner.json` ([`state-schemas.md`](state-schemas.md#ownerjson)) with `session_id` from `$CLAUDE_CODE_SESSION_ID` and `claimed_at` now. Arming is what establishes ownership, so every arming point records it here rather than each caller remembering to. If `$CLAUDE_CODE_SESSION_ID` is unset, write no `owner.json` — an unidentifiable owner is worse than none, since [`reconcile.md`](reconcile.md) would read a bogus id as some other session's claim and could never recover the slot.
 

package/dist/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "release": "5.13.0",
-  "buildId": "run-96-1",
-  "commitSha": "3a0a6a70d012faf3cc36cf1ac486fd5650c21da7",
-  "buildTime": "2026-09-05T00:42:20Z",
+  "buildId": "run-98-1",
+  "commitSha": "e54fb7c620d882db7a9333d6f2e252fbd6c6c543",
+  "buildTime": "2026-09-05T01:07:04Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muggleai/works",
   "mcpName": "io.github.multiplex-ai/muggle",
-  "version": "5.14.0-staging.96",
+  "version": "5.14.0-staging.98",
   "description": "Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
   "type": "module",
   "main": "dist/index.js",

package/plugin/hooks/hooks.json

@@ -190,6 +190,12 @@
             "async": false,
             "timeout": 10
           },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/scripts/guardrail-build-followthrough-gate.sh\"",
+            "async": false,
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "bash \"${CLAUDE_PLUGIN_ROOT}/scripts/guardrail-walkthrough-gate.sh\"",

package/plugin/scripts/guardrail-build-followthrough-gate.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# build-followthrough gate (Stop). When the front-door router took a
+# build/implement/fix prompt this session but no PR was ever opened, block the
+# turn end and point at /muggle-do (or the MUGGLE_BUILD_SKIP escape hatch). The
+# router's offer is advisory and a session that finds the root cause can still
+# end without shipping it — the fix then lives only in a transcript that dies
+# with the session, and no other gate catches it: the watcher gate only fires on
+# a PR that already exists.
+#
+# Mirrors guardrail-watch-gate.sh: synchronous (only a sync Stop hook can block
+# the turn end), fires on EVERY turn end, and pre-filters in shell so Node spawns
+# only when a build request was routed and no PR was handled. On the
+# overwhelming majority of turns no build intent was detected, so the state file
+# is absent or the flag is unset and we return {} in-shell, never paying Node
+# cold-start. Degrades to {}.
+payload="$(cat)"
+
+raw_sid="$(printf '%s' "$payload" | grep -oE '"session_id"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*:[[:space:]]*"([^"]*)".*/\1/')"
+[ -n "$raw_sid" ] || raw_sid="unknown"
+sid="$(printf '%s' "$raw_sid" | sed 's/[^A-Za-z0-9_-]/_/g')"
+
+# Resolve the same home dir Node's os.homedir() uses. HOME is correct on
+# macOS/Linux and on most Git Bash setups; fall back to converting USERPROFILE
+# when HOME doesn't hold the state dir (some Windows shells point HOME elsewhere).
+home="${HOME:-}"
+if [ ! -d "$home/.muggle-ai" ] && command -v cygpath >/dev/null 2>&1 && [ -n "${USERPROFILE:-}" ]; then
+  home="$(cygpath -u "$USERPROFILE" 2>/dev/null || printf '%s' "$home")"
+fi
+
+# A non-empty prsHandled array spans lines, so the empty match reliably says no
+# PR was opened. Skip Node unless a build request was routed and nothing shipped.
+state_file="$home/.muggle-ai/guardrails/$sid.json"
+if [ ! -f "$state_file" ] \
+  || ! grep -q '"buildIntentRouted": true' "$state_file" \
+  || ! grep -q '"prsHandled": \[\]' "$state_file" \
+  || grep -q '"buildSkipped": true' "$state_file"; then
+  printf '{}'
+  exit 0
+fi
+
+root="${CLAUDE_PLUGIN_ROOT:-${CURSOR_PLUGIN_ROOT:-}}"
+printf '%s' "$payload" | node "${root}/scripts/guardrails.mjs" build-followthrough-gate 2>/dev/null || printf '{}'

package/plugin/scripts/guardrails.mjs

@@ -13,6 +13,7 @@ var GH_PR_REOPENED_LINE = /\bReopened pull request [\w./-]*#(\d+)/;
 var PR_MONITOR_TERMINAL_LINE = /\bTERMINAL pr=(\d+): (MERGED|CLOSED)\b/;
 var MAX_PR_TERMINAL_BLOCKS = 3;
 var MAX_WATCH_BLOCKS = 3;
+var MAX_BUILD_BLOCKS = 3;
 var MAX_WALKTHROUGH_BLOCKS = 3;
 var GH_LOOKUP_TIMEOUT_MS = 1e4;
 var MUGGLE_SKILL_EMIT_TOOL = /muggle-local-telemetry-skill-emit/i;
@@ -583,6 +584,25 @@ function watchGateDecision(state, untrackedPrUrls, maxBlocks = MAX_WATCH_BLOCKS)
     untracked: untrackedPrUrls
   };
 }
+
+// src/guardrails/buildFollowthrough.ts
+var BUILD_SKIP_MARKER = /^\s*echo\s+["']?MUGGLE_BUILD_SKIP\b/;
+function isBuildSkipMarker(cmd) {
+  return BUILD_SKIP_MARKER.test(cmd);
+}
+function applyBuildSkip(state, skipped) {
+  if (!skipped || state.buildSkipped === true) return state;
+  return { ...state, buildSkipped: true };
+}
+function buildFollowthroughDecision(state, maxBlocks = MAX_BUILD_BLOCKS) {
+  const blockCount = state.buildBlockCount ?? 0;
+  const owed = state.buildIntentRouted === true && state.buildSkipped !== true && state.prsHandled.length === 0;
+  if (!owed) return { action: "none" /* None */, blockCount };
+  if (blockCount >= maxBlocks) {
+    return { action: "release" /* Release */, blockCount };
+  }
+  return { action: "block" /* Block */, blockCount: blockCount + 1 };
+}
 var REPORT_SENTINEL = "muggle-pr-section";
 var PR_PROSE_CMD = /\bgh\s+pr\s+(comment|create|edit)\b/;
 var GH_API_CMD = /\bgh\s+api\b/;
@@ -1080,7 +1100,8 @@ function recordTests() {
     e2eSkipped: isE2ESkipMarker(cmd)
   });
   const withWatchSkip = applyWatchSkip(recorded, isWatchSkipMarker(cmd));
-  const withWalkthroughPost = applyWalkthroughPosted(withWatchSkip, detectWalkthroughPost(input));
+  const withBuildSkip = applyBuildSkip(withWatchSkip, isBuildSkipMarker(cmd));
+  const withWalkthroughPost = applyWalkthroughPosted(withBuildSkip, detectWalkthroughPost(input));
   const withWalkthroughSkip = applyWalkthroughSkip(withWalkthroughPost, isWalkthroughSkipMarker(cmd));
   const failedRunId = detectFailedRunId(input);
   const next = failedRunId ? applyFailedRun(withWalkthroughSkip, failedRunId) : withWalkthroughSkip;
@@ -1179,6 +1200,16 @@ function watchGate() {
   const reason = decision.blockCount === 1 ? `Do not end the turn yet. A PR was opened this session but no muggle-do session slot tracks it: ${prList}. Seed the slot and hand off per muggle-do Stage 8 \u2014 /muggle:muggle-pr-followup ${decision.untracked[0]} does both. Seeding is what matters: once a slot exists, reconcile arms it at the next session start and finalizes it when the PR goes terminal, so an unarmed slot is fine but no slot means nothing ever picks this PR up. If it genuinely should not be tracked (autoWatchPR=never, handed off elsewhere), tell the user why and run \`echo "MUGGLE_WATCH_SKIP: <reason>"\` \u2014 that records the skip and keeps this gate quiet for the rest of the session.` : `PR hand-off still owed for ${prList} (reminder ${decision.blockCount}/${MAX_WATCH_BLOCKS}): seed a slot via /muggle:muggle-pr-followup, or record a legitimate skip via \`echo "MUGGLE_WATCH_SKIP: <reason>"\`.`;
   return blockStop(reason, host);
 }
+function buildFollowthroughGate() {
+  const state = readState(sessionId);
+  const decision = buildFollowthroughDecision(state);
+  if (decision.action === "release" /* Release */) return releaseGate("buildSkipped");
+  if (decision.action === "none" /* None */) return "{}";
+  state.buildBlockCount = decision.blockCount;
+  writeState(state);
+  const reason = decision.blockCount === 1 ? `Do not end the turn yet. This session took a build/implement/fix request but no PR was opened. A root cause written into the transcript ships nothing \u2014 once the session ends it is gone, and the watcher gate never fires because it only looks at PRs that exist. Carry the work to a PR via /muggle-do, which runs requirements \u2192 build \u2192 impact \u2192 unit tests \u2192 E2E \u2192 PR \u2192 watcher. If no PR is owed here (the user changed their mind, the fix landed in another repo, the answer was advice rather than a change), tell the user why and run \`echo "MUGGLE_BUILD_SKIP: <reason>"\` \u2014 that records the skip and keeps this gate quiet for the rest of the session.` : `Build request still unanswered \u2014 no PR opened (reminder ${decision.blockCount}/${MAX_BUILD_BLOCKS}): carry it to a PR via /muggle-do, or record a legitimate skip via \`echo "MUGGLE_BUILD_SKIP: <reason>"\`.`;
+  return blockStop(reason, host);
+}
 function walkthroughGate() {
   const state = readState(sessionId);
   if (state.e2eRun !== true || state.walkthroughPosted === true || state.walkthroughSkipped === true) {
@@ -1302,6 +1333,7 @@ var handlers = {
   "e2e-gate": e2eGate,
   "terminal-gate": terminalGate,
   "watch-gate": watchGate,
+  "build-followthrough-gate": buildFollowthroughGate,
   "walkthrough-gate": walkthroughGate,
   "record-comment-replies": recordCommentReplies,
   "comment-reply-gate": commentReplyGate,

package/plugin/scripts/pr-watch-guards.sh

@@ -85,3 +85,33 @@ watcher_pid_alive() {
     [ -n "$pid" ] || return 1
     kill -0 "$pid" 2>/dev/null
 }
+
+# True when the slot's lease is held by a live loop that no longer belongs to the
+# session arming now — the deaf-orphan case.
+#
+# A live PID proves the loop is running; it never proves anything is listening.
+# On Windows a detached loop outlives the session that launched it, keeps
+# polling, and keeps touching its heartbeat, while its stdout is the dead
+# session's monitor pipe. Every liveness signal reads healthy and the events
+# reach nobody. Because arming skipped on a live PID alone, that corpse blocked
+# a live session from arming the PR for the whole lifetime cap — seven days
+# since the default moved off six hours.
+#
+# Deliberately narrow. It answers only "is this lease held on behalf of some
+# other session", which is decidable from state already on disk. It says nothing
+# about a loop orphaned by its own session's monitor dying, where the owner still
+# matches; that one needs a signal from the reader, which no file here carries.
+#
+# Conservative on every unknown — no watch.pid, a dead PID, no owner.json, or no
+# current session id all answer false, so a slot is never reclaimed on a guess.
+watcher_lease_is_foreign() {
+    local slot="$1" current_session="$2" owner_pid owner_session
+    [ -n "$current_session" ] || return 1
+    [ -f "${slot}/watch.pid" ] || return 1
+    owner_pid=$(tr -d ' \r\n' < "${slot}/watch.pid" 2>/dev/null)
+    watcher_pid_alive "$owner_pid" || return 1
+    [ -f "${slot}/owner.json" ] || return 1
+    owner_session=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "${slot}/owner.json" | head -1)
+    [ -n "$owner_session" ] || return 1
+    [ "$owner_session" != "$current_session" ]
+}

package/plugin/skills/muggle-pr-followup/arm-watcher.md

@@ -14,7 +14,11 @@ Read the `DRAIN` lines it prints: they are the outstanding work the monitor will
 
 1. **Drain.** Run one tick per [`contract.md`](contract.md). It acts on everything already outstanding — actionable threads (`gitlab`: discussions), body-only reviews past the watermark (GitHub-only — GitLab has no review envelope), a stale branch, red CI — and finalizes a terminal PR. If the tick dispatched a cycle, stop here: the cycle's exit path settles the watch when it finishes.
 2. **Seed the watermark.** *(`pr-watch-arm.sh` does this; the reasoning is kept because the floors are subtle and wrong ones are quiet.)* Resolve the provider once per [`../_shared/vcs/detect-vcs.md`](../_shared/vcs/detect-vcs.md) — every fetch in this sequence uses that provider's recipes. Write the slot's watch watermark ([`state-schemas.md`](state-schemas.md#watch-watermarkenv)) to the ids the **drain itself read** — the max review-id and comment-id observed at the drain's own fetch (Step 1), snapshotted at that read. Never let the loop capture its own baseline — the arming session writes it; and **never** from a fresh fetch taken after the drain, which would include a comment that arrived after the drain read the wave and mark it seen unread. Seeded to the drain's floor, anything landing after that read stays above the watermark and the monitor's first iteration surfaces it. Seed the CI floor (`CIRED`) from the same drain read: set it to the head SHA when the checks have **already settled red** at that read (no check pending, one or more in the `fail` bucket per [`../_shared/vcs/common/ci-rollup.md`](../_shared/vcs/common/ci-rollup.md)) — that red is what the drain just handled — and empty otherwise, so an escalated red head the drain already saw does not re-fire on the loop's first iteration. Seed the rebase floor (`REBASED`) the same way, from the drain's branch-standing read per [`../_shared/vcs/common/branch-standing.md`](../_shared/vcs/common/branch-standing.md): set it to the current `rebase_key` (`<head_sha>..<base_tip_sha>`) when the drain found the branch already behind or conflicting — that staleness is what the drain just handled — and empty otherwise, so a branch the drain already rebased or escalated does not re-fire on the loop's first iteration. Seed the blocked-CI floor (`BLOCKED_CIDIGEST`) to the blocked fingerprint's `ci_digest` when arming while `last_seen.blocked` is already set, and empty otherwise — empty is the not-blocked state, in which the loop's blocked-resume probe stays dormant.
-3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds), a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
+3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds) **and `owner.json` records this session**, a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
+
+   **A live lease owned by a different session does not count as owned** — check it with `watcher_lease_is_foreign` from [`../../scripts/pr-watch-guards.sh`](../../scripts/pr-watch-guards.sh). A live PID proves the loop is running, never that anything is listening: an orphan left by a dead session keeps polling and keeps touching its heartbeat while its stdout is that session's closed monitor pipe, so every liveness signal reads healthy and the events reach nobody. Skipping on the PID alone let such a corpse block this session from arming the PR for the whole lifetime cap — seven days, since the default moved off six hours. When the guard reports a foreign lease, kill that PID, delete `watch.pid`, and arm fresh; note it in the slot's `followup.log` so the reclaim is visible.
+
+   This is narrow on purpose. It reclaims only a lease held on behalf of *another* session, which is decidable from `owner.json` alone. A loop orphaned by its **own** session's monitor dying still reads as owned, and nothing on disk distinguishes it — that needs a signal from the reader, which no slot file carries. Treat an armed watcher as evidence a poller exists, never as proof a review will be seen.
 
    Otherwise **claim the slot for this session** before starting anything: write `owner.json` ([`state-schemas.md`](state-schemas.md#ownerjson)) with `session_id` from `$CLAUDE_CODE_SESSION_ID` and `claimed_at` now. Arming is what establishes ownership, so every arming point records it here rather than each caller remembering to. If `$CLAUDE_CODE_SESSION_ID` is unset, write no `owner.json` — an unidentifiable owner is worse than none, since [`reconcile.md`](reconcile.md) would read a bogus id as some other session's claim and could never recover the slot.