@nanobpm/nano-workforce 0.210.0 → 0.210.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.210.1](https://github.com/nanobpm/nano-workforce/compare/v0.210.0...v0.210.1) (2026-11-12)
+
+### Bug Fixes
+
+* **merge:** same-named check-runs from different events are different gates ([#957](https://github.com/nanobpm/nano-workforce/issues/957)) ([e2c4e96](https://github.com/nanobpm/nano-workforce/commit/e2c4e966b566ce8b4bdc19e84bceb130909a981c)), closes [#348](https://github.com/nanobpm/nano-workforce/issues/348) [camunda/console-api-js#17](https://github.com/camunda/console-api-js/issues/17) [#348](https://github.com/nanobpm/nano-workforce/issues/348) [#955](https://github.com/nanobpm/nano-workforce/issues/955) [#955](https://github.com/nanobpm/nano-workforce/issues/955) [#951](https://github.com/nanobpm/nano-workforce/issues/951) [#955](https://github.com/nanobpm/nano-workforce/issues/955)
+
 ## [0.210.0](https://github.com/nanobpm/nano-workforce/compare/v0.209.1...v0.210.0) (2026-11-12)
 
 ### Features

package/app/behindBaseRemedy.test.ts

@@ -16,7 +16,7 @@ function st(over: Partial<PrState> = {}): PrState {
     failingCheckNames: ["build"],
     presentCheckNames: ["build"],
     pendingCheckNames: [],
-    checkConclusions: { build: "FAILURE" },
+    checkGateConclusions: { build: ["FAILURE"] },
     totalChecks: 1,
     isDraft: false,
     headRefOid: "head1",

package/app/failingChecksSupersede.test.ts

@@ -12,7 +12,7 @@
 
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
-import { allCheckNames, failingCheckNames, latestRunPerCheck } from "./github.ts";
+import { allCheckNames, applyRollupEvents, checkConclusions, checkGateConclusions, failingCheckNames, latestRunPerCheck } from "./github.ts";
 
 test("a CANCELLED run superseded by a newer green run on the same head does not count as failing", () => {
   const rollup = [
@@ -91,3 +91,290 @@ test("legacy StatusContext (state + context) supersession is handled by createdA
   ];
   assertEquals(failingCheckNames(rollup), [], "a superseded legacy status context is not a failing gate");
 });
+
+// ── Issue #955: same display name, DIFFERENT triggering events — not the same gate ──────────────
+//
+// One workflow file with both `pull_request` and `push` jobs named `build` puts TWO runs named
+// `build` on the same head SHA. They are different gates: the ruleset / branch-protection required
+// context gates the `pull_request` run, so a red PR `build` must never be collapsed away by a newer
+// green push `build` (camunda/console-api-js#17: the collapse hid the red required check, the merge
+// loop classified `waiting`, and `senior:fix-ci` never ran).
+
+test("#955: a red pull_request `build` is not collapsed away by a newer green push `build`", () => {
+  const rollup = [
+    // The required gate: PR-event run, failed (biome check on CHANGELOG.md), completed 00:41:34Z.
+    { name: "build", event: "pull_request", conclusion: "FAILURE", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+    // A different gate sharing the display name: push-event run, green, completed 4s later.
+    { name: "build", event: "push", conclusion: "SUCCESS", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  assertEquals(
+    failingCheckNames(rollup),
+    ["build"],
+    "the red required pull_request run must survive the collapse — a green push job must not satisfy it",
+  );
+  assertEquals(
+    checkConclusions(rollup).build,
+    "FAILURE",
+    "the gate's conclusion is the red pull_request run's, so requiredChecksVerdict sees the failure",
+  );
+});
+
+test("#955: the #348 collapse still holds WITHIN one event — a cancelled rerun of the same job collapses", () => {
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "CANCELLED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:31:00Z" },
+    { name: "build", event: "pull_request", conclusion: "SUCCESS", startedAt: "2026-11-12T00:32:00Z", completedAt: "2026-11-12T00:35:00Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), [], "a CANCELLED rerun of the SAME workflow/event still collapses to the newest run");
+  assertEquals(checkConclusions(rollup).build, "SUCCESS");
+});
+
+test("#955: a green pull_request run does not mask a red push run of the same name (symmetric)", () => {
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "SUCCESS", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+    { name: "build", event: "push", conclusion: "FAILURE", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), ["build"], "any non-superseded failed run of the name fails the gate");
+});
+
+test("#955: distinct events keep both runs in latestRunPerCheck (one per gate, not one per name)", () => {
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "FAILURE", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", event: "push", conclusion: "SUCCESS", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const latest = latestRunPerCheck(rollup);
+  assertEquals(latest.length, 2, "two different gates sharing a name must both survive");
+});
+
+test("#955: runs without event identity keep the pre-#955 name-only collapse (legacy shapes unchanged)", () => {
+  // A rollup whose entries carry no `event` (older gh, a StatusContext-only head) collapses exactly
+  // as before: same name → newest run wins.
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", conclusion: "SUCCESS", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  assertEquals(failingCheckNames(rollup), [], "no event identity → the name-only #348 collapse is unchanged");
+  assertEquals(latestRunPerCheck(rollup).length, 1);
+});
+
+test("#955: allCheckNames still reports the display name once when events differ", () => {
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "FAILURE", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", event: "push", conclusion: "SUCCESS", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  assertEquals(allCheckNames(rollup), ["build"], "presence is by required-context name, not per (name, event) pair");
+});
+
+// ── PR #957 review: the gate key must be an unambiguous tuple ────────────────────────────────────
+//
+// A bare `name + event` concatenation lets two DIFFERENT identities collide: `name:"build",
+// event:"push"` and an event-less `context:"buildpush"` both produce `"buildpush"`, so a newer green
+// entry could discard an unrelated red check (and the known-event bucket could merge with the
+// unknown-event one). The key is length-prefixed (`${name.length}:${name}${event}`) so no
+// `(name, event)` pair aliases a different pair or a name-only key.
+
+test("#957: an eventful `build`+`push` never collides with an event-less `buildpush` context", () => {
+  const rollup = [
+    // The event-less legacy StatusContext whose context string happens to equal the concatenation.
+    { context: "buildpush", state: "FAILURE", createdAt: "2026-11-12T00:41:34Z" },
+    // A different gate: a CheckRun named `build` triggered by `push`, green, newer.
+    { name: "build", event: "push", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const latest = latestRunPerCheck(rollup);
+  assertEquals(latest.length, 2, "distinct identities must not collapse into one gate");
+  assertEquals(
+    failingCheckNames(rollup),
+    ["buildpush"],
+    "the event-less red `buildpush` survives — the green `build`+`push` run must not discard it",
+  );
+});
+
+test("#957: a known-event gate never merges with the unknown-event bucket of the same name", () => {
+  // Same display name, one run event-ful, one event-less: these are different gates, so both survive.
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", completedAt: "2026-11-12T00:41:34Z" }, // event-less (legacy)
+    { name: "build", event: "push", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  assertEquals(latestRunPerCheck(rollup).length, 2, "known-event and unknown-event runs of one name stay separate");
+  assertEquals(failingCheckNames(rollup), ["build"], "the event-less red run is not shadowed by the eventful green one");
+});
+
+// ── PR #957 review: the real transport must populate `event` ─────────────────────────────────────
+//
+// The `gh pr view --json statusCheckRollup` exporter omits `event` (cli/cli `api/export_pr.go`), so
+// `fetchPrState` enriches the rollup from GraphQL `CheckRun.checkSuite.workflowRun.event` before
+// grouping. `applyRollupEvents` is the pure mapping; these cover the transport normalisation path.
+
+test("#957: applyRollupEvents stamps each CheckRun's triggering event so the collapse separates events", () => {
+  // What `gh pr view --json statusCheckRollup` actually returns: NO `event` field on either run.
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  // Without enrichment the name-only fallback collapses the red run away (the #955 hole).
+  assertEquals(failingCheckNames(rollup), [], "pre-enrichment: the newer green run hides the red one");
+  // The GraphQL `statusCheckRollup.contexts` nodes for the same head, joined by (name, startedAt).
+  const nodes = [
+    { __typename: "CheckRun", databaseId: 1001, name: "build", startedAt: "2026-11-12T00:30:00Z", checkSuite: { workflowRun: { event: "pull_request" } } },
+    { __typename: "CheckRun", databaseId: 1002, name: "build", startedAt: "2026-11-12T00:41:30Z", checkSuite: { workflowRun: { event: "push" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, "pull_request");
+  assertEquals(rollup[0].databaseId, 1001);
+  assertEquals(rollup[1].event, "push");
+  assertEquals(rollup[1].databaseId, 1002);
+  assertEquals(
+    failingCheckNames(rollup),
+    ["build"],
+    "post-enrichment: the red pull_request run survives — #955 is actually fixed on the real transport",
+  );
+});
+
+test("#957: applyRollupEvents leaves a StatusContext / misaligned / unreadable node event-less", () => {
+  const rollup = [
+    { context: "ci/legacy", state: "SUCCESS", createdAt: "2026-11-12T00:41:34Z" }, // a StatusContext
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+    { name: "test", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:31Z", completedAt: "2026-11-12T00:41:39Z" },
+  ];
+  const nodes = [
+    { __typename: "StatusContext", context: "ci/legacy" }, // no event on this type
+    { __typename: "CheckRun", name: "DIFFERENT", startedAt: "2026-11-12T00:41:30Z", checkSuite: { workflowRun: { event: "push" } } }, // misaligned name
+    { __typename: "CheckRun", name: "test", startedAt: "2026-11-12T00:41:31Z", checkSuite: { workflowRun: { event: null } } }, // unreadable run
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, undefined, "a StatusContext never gains an event");
+  assertEquals(rollup[1].event, undefined, "a misaligned node is not stamped blindly");
+  assertEquals(rollup[2].event, undefined, "a null/absent event leaves the entry event-less");
+});
+
+// ── PR #957 review round 3: the join is by run identity, never array position ────────────────────
+//
+// The `gh pr view` read and the GraphQL contexts read are two SEPARATE GitHub calls that can observe
+// different runs or heads, so index `i` in one is not reliably run `i` in the other. A positional
+// join can stamp one run's event onto another (the name guard cannot catch it for duplicate `build`
+// names), re-creating the cross-event collapse #955 fixed. The join keys on `(name, startedAt)` and
+// stamps only an exact 1:1 bucket match.
+
+test("#957: applyRollupEvents joins by run identity, not position — a reordered read stamps the right runs", () => {
+  // The GraphQL read returns the two same-named runs in the OPPOSITE order from the CLI rollup.
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const nodes = [
+    // Reversed order vs the rollup: a positional join would stamp push onto the red run.
+    { __typename: "CheckRun", databaseId: 1002, name: "build", startedAt: "2026-11-12T00:41:30Z", checkSuite: { workflowRun: { event: "push" } } },
+    { __typename: "CheckRun", databaseId: 1001, name: "build", startedAt: "2026-11-12T00:30:00Z", checkSuite: { workflowRun: { event: "pull_request" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, "pull_request", "the red run keeps ITS event despite the reorder");
+  assertEquals(rollup[1].event, "push", "the green run keeps ITS event despite the reorder");
+  assertEquals(failingCheckNames(rollup), ["build"], "no cross-run stamp → the red pull_request run survives");
+});
+
+test("#957: applyRollupEvents stamps nothing when the two reads observed different run sets", () => {
+  // A rerun landed between the `gh pr view` read and the GraphQL read: the GraphQL side has an
+  // EXTRA `build` run at the SAME start instant (a cancelled/re-run pair re-queued together), so the
+  // node bucket (2) out-sizes the rollup bucket (1) and stamping anything would risk a cross-run stamp.
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+  ];
+  const nodes = [
+    { __typename: "CheckRun", databaseId: 1001, name: "build", startedAt: "2026-11-12T00:30:00Z", checkSuite: { workflowRun: { event: "pull_request" } } },
+    { __typename: "CheckRun", databaseId: 1003, name: "build", startedAt: "2026-11-12T00:30:00Z", checkSuite: { workflowRun: { event: "push" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, undefined, "a bucket-size mismatch (the reads disagree) stamps nothing");
+});
+
+// ── PR #957 review round 3: the gate key is encoded for EVERY entry, event-less included ─────────
+//
+// Encoding only the known-event bucket leaves the two key spaces overlapping: `name:"build",
+// event:"push"` produces `5:buildpush`, and an event-less `context:"5:buildpush"` ALSO produces
+// `5:buildpush`, so a newer green entry could still discard an unrelated red check. Every entry —
+// event-less ones included — is encoded as the same length-prefixed tuple.
+
+test("#957: an eventful `build`+`push` never collides with an event-less `5:buildpush` context", () => {
+  const rollup = [
+    // An event-less legacy StatusContext whose context string equals the ENCODED tuple of the other gate.
+    { context: "5:buildpush", state: "FAILURE", createdAt: "2026-11-12T00:41:34Z" },
+    // A different gate: a CheckRun named `build` triggered by `push`, green, newer.
+    { name: "build", event: "push", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const latest = latestRunPerCheck(rollup);
+  assertEquals(latest.length, 2, "the encoded event-less key never aliases an eventful gate");
+  assertEquals(
+    failingCheckNames(rollup),
+    ["5:buildpush"],
+    "the red event-less `5:buildpush` survives — encoding every entry closes the cross-bucket hole",
+  );
+});
+
+// ── PR #957 review round 3: a prototype-free dictionary for arbitrary check names ────────────────
+//
+// A check can legitimately be named `constructor`, `toString`, or `__proto__`; on a plain `{}` those
+// resolve to an INHERITED property, so `out[name] ?? []` returns a function/object and `.push`
+// throws — aborting `fetchPrState` / readiness parsing for that PR. The dictionary is
+// prototype-free (`Object.create(null)`), so every check name is a safe own-key.
+
+test("#957: checkGateConclusions survives a check named `constructor` / `toString` / `__proto__`", () => {
+  const rollup = [
+    { name: "constructor", conclusion: "FAILURE", status: "COMPLETED", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "toString", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:35Z" },
+    { name: "__proto__", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:36Z" },
+  ];
+  const gates = checkGateConclusions(rollup);
+  assertEquals(gates.constructor, ["FAILURE"], "an inherited-property name is a safe own-key");
+  assertEquals(gates.toString, ["SUCCESS"]);
+  assertEquals(gates.__proto__, ["SUCCESS"]);
+  assertEquals(failingCheckNames(rollup), ["constructor"], "and the failure is still reported, not crashed");
+});
+
+// ── PR #957 review round 4: never assign events by position inside a multi-run bucket ────────────
+
+test("#957: same (name, startedAt) runs reordered between reads are joined by detailsUrl, not position", () => {
+  const t = "2026-11-12T00:30:00Z";
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: t, completedAt: "2026-11-12T00:41:34Z", detailsUrl: "https://github.com/o/r/actions/runs/1/job/11" },
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: t, completedAt: "2026-11-12T00:41:38Z", detailsUrl: "https://github.com/o/r/actions/runs/2/job/22" },
+  ];
+  const nodes = [
+    { __typename: "CheckRun", databaseId: 22, name: "build", startedAt: t, detailsUrl: "https://github.com/o/r/actions/runs/2/job/22", checkSuite: { workflowRun: { event: "push" } } },
+    { __typename: "CheckRun", databaseId: 11, name: "build", startedAt: t, detailsUrl: "https://github.com/o/r/actions/runs/1/job/11", checkSuite: { workflowRun: { event: "pull_request" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, "pull_request");
+  assertEquals(rollup[0].databaseId, 11);
+  assertEquals(rollup[1].event, "push");
+  assertEquals(rollup[1].databaseId, 22);
+  assertEquals(failingCheckNames(rollup), ["build"]);
+});
+
+test("#957: a mixed-event multi-run bucket without a joinable URL stamps nothing (no positional swap)", () => {
+  const t = "2026-11-12T00:30:00Z";
+  const rollup = [
+    { name: "build", conclusion: "FAILURE", status: "COMPLETED", startedAt: t },
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: t },
+  ];
+  const nodes = [
+    { __typename: "CheckRun", name: "build", startedAt: t, checkSuite: { workflowRun: { event: "push" } } },
+    { __typename: "CheckRun", name: "build", startedAt: t, checkSuite: { workflowRun: { event: "pull_request" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, undefined);
+  assertEquals(rollup[1].event, undefined);
+});
+
+test("#957: a same-event multi-run bucket is stamped order-independently", () => {
+  const t = "2026-11-12T00:30:00Z";
+  const rollup = [
+    { name: "build", conclusion: "CANCELLED", status: "COMPLETED", startedAt: t },
+    { name: "build", conclusion: "SUCCESS", status: "COMPLETED", startedAt: t },
+  ];
+  const nodes = [
+    { __typename: "CheckRun", name: "build", startedAt: t, checkSuite: { workflowRun: { event: "pull_request" } } },
+    { __typename: "CheckRun", name: "build", startedAt: t, checkSuite: { workflowRun: { event: "pull_request" } } },
+  ];
+  applyRollupEvents(rollup, nodes);
+  assertEquals(rollup[0].event, "pull_request");
+  assertEquals(rollup[1].event, "pull_request");
+});

package/app/github.test.ts

@@ -3,7 +3,7 @@
 // the merge-exclusion graph. Force the token transport and stub `globalThis.fetch`.
 import { test } from "node:test";
 import { assert, assertEquals, assertRejects } from "#test-assert";
-import { BaseBranchMustExistError, checkConclusions, hasCopilotWorkStarted, classifyBlockedCause, copilotWorkStartedSince, classifyMergeability, classifyPrLiveness, coalesceTitle, compareCommits, createPullRequest, ensureBaseBranch, ensurePromotionPr, fetchBranchHead, fetchIssueTitle, fetchPrFiles, fetchPrHead, fetchPrReviews, isNotAPullRequestError, listPrsForHead, THREAD_PROBE_FAILED, updateBranchRef, type GhReview, type Mergeability, type PrState } from "./github.ts";
+import { BaseBranchMustExistError, checkConclusions, checkGateConclusions, hasCopilotWorkStarted, classifyBlockedCause, copilotWorkStartedSince, classifyMergeability, classifyPrLiveness, coalesceTitle, compareCommits, createPullRequest, ensureBaseBranch, ensurePromotionPr, failingCheckNames, fetchBranchHead, fetchIssueTitle, fetchPrFiles, fetchPrHead, fetchPrReviews, isNotAPullRequestError, listPrsForHead, THREAD_PROBE_FAILED, updateBranchRef, type GhReview, type Mergeability, type PrState } from "./github.ts";
 import { DEFAULT_MERGE_PROTOCOL, type MergeProtocol, type RequiredCheck } from "./mergeProtocol.ts";
 
 // A fake `fetch` that serves `pages` of file batches; each page N (1-based) returns `pages[N-1]`
@@ -551,7 +551,7 @@ function prState(over: Partial<PrState>): PrState {
     failingCheckNames: [],
     presentCheckNames: [],
     pendingCheckNames: [],
-    checkConclusions: {},
+    checkGateConclusions: {},
     totalChecks: 0,
     isDraft: false,
     headRefOid: null,
@@ -601,7 +601,7 @@ function mergePrState(over: Partial<PrState> & { rollup?: { name: string; conclu
     totalChecks: 0,
     presentCheckNames: [],
     pendingCheckNames: [],
-    checkConclusions: {},
+    checkGateConclusions: {},
     isDraft: false,
     headRefOid: "abc123",
     mergeQueueEntry: null,
@@ -613,17 +613,20 @@ function mergePrState(over: Partial<PrState> & { rollup?: { name: string; conclu
     const present: string[] = [];
     const pending: string[] = [];
     const failing: string[] = [];
-    const conclusions: Record<string, string> = {};
+    const conclusions: Record<string, string[]> = {};
     for (const c of rollup) {
       const v = c.conclusion.toUpperCase();
       present.push(c.name);
-      conclusions[c.name] = pendingStates.has(v) ? "" : v;
+      // One entry per rollup run of the name — mirrors `checkGateConclusions` (a per-gate list).
+      const gates = conclusions[c.name] ?? [];
+      gates.push(pendingStates.has(v) ? "" : v);
+      conclusions[c.name] = gates;
       if (pendingStates.has(v)) pending.push(c.name);
       else if (bad.has(v)) failing.push(c.name);
     }
     base.presentCheckNames = present;
     base.pendingCheckNames = pending;
-    base.checkConclusions = conclusions;
+    base.checkGateConclusions = conclusions;
     base.failingCheckNames = failing;
     base.failingChecks = failing.length;
     base.totalChecks = rollup.length;
@@ -812,13 +815,185 @@ for (const c of TOKEN_MODE) {
       totalChecks: -1,
       presentCheckNames: [],
       pendingCheckNames: [],
-      checkConclusions: {},
+      checkGateConclusions: {},
     });
     const protocol = protocolWith({ requiredChecks: reqChecks("build"), waitForChecks: true });
     assertEquals(classifyMergeability(s, protocol), c.want);
   });
 }
 
+// ── Same-named checks from different triggering events are different gates (issue #955) ─────────
+//
+// One workflow file with both `pull_request` and `push` jobs named `build` puts two runs named
+// `build` on the same head SHA. Grouping the rollup by display name alone kept the NEWER run, so a
+// red required `pull_request` `build` was collapsed away by a green `push` `build` 4s later —
+// `failingChecks` read 0, `classifyBlockedCause` could not see the failed required check, the
+// poller classified `waiting`, and `senior:fix-ci` never ran (camunda/console-api-js#17). These
+// tests walk the exact observed rollup through the derivation helpers into the classifier — no
+// merge-protocol file required.
+
+test("#955 classifier walk: red PR `build` + newer green push `build` + pending CLA, BLOCKED -> blocked", () => {
+  // The exact head `641c7ee9` rollup shape from camunda/console-api-js#17.
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "FAILURE", status: "COMPLETED", startedAt: "2026-11-12T00:30:00Z", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", event: "push", conclusion: "SUCCESS", status: "COMPLETED", startedAt: "2026-11-12T00:41:30Z", completedAt: "2026-11-12T00:41:38Z" },
+    { context: "license/cla", state: "PENDING", createdAt: "2026-11-12T00:30:05Z" },
+  ];
+  const names = failingCheckNames(rollup);
+  assertEquals(names, ["build"], "the red required pull_request run survives the collapse and names the gate");
+  const s = prState({
+    mergeStateStatus: "BLOCKED",
+    failingChecks: names.length,
+    failingCheckNames: names,
+    unresolvedThreads: 0,
+  });
+  // No merge-protocol file on the repo — the default protocol declares no requiredChecks.
+  assertEquals(classifyBlockedCause(s), "checks");
+  assertEquals(classifyMergeability(s), "blocked", "the merge loop must route to fix-ci, not park on wait-mergeable");
+  assertEquals(classifyMergeability(s, DEFAULT_MERGE_PROTOCOL), "blocked");
+});
+
+test("#955 classifier walk: the same rollup ALSO blocks a ruleset-declared required `build`", () => {
+  // Even with #901's ruleset-sourced requiredChecks, the collapsed-away red run made
+  // `requiredChecksVerdict` return "pass". With the fix the required `build` reads FAILURE.
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "FAILURE", status: "COMPLETED", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", event: "push", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const conclusions = checkGateConclusions(rollup);
+  assertEquals(conclusions.build, ["FAILURE", "SUCCESS"], "each retained gate keeps its own conclusion");
+  const s = prState({
+    mergeStateStatus: "BLOCKED",
+    failingChecks: 1,
+    failingCheckNames: ["build"],
+    presentCheckNames: ["build"],
+    checkGateConclusions: conclusions,
+    unresolvedThreads: 0,
+  });
+  assertEquals(classifyMergeability(s, protocolWith({ requiredChecks: reqChecks("build") })), "blocked");
+});
+
+test("#955: a genuinely non-required red check of a colliding name does not newly block a CLEAN PR", () => {
+  // UNSTABLE + only an OPTIONAL red check stays "ready" — the fix must not turn every cross-event
+  // red run into a merge block when GitHub itself says only non-required checks failed.
+  const rollup = [
+    { name: "build", event: "pull_request", conclusion: "SUCCESS", status: "COMPLETED", completedAt: "2026-11-12T00:41:34Z" },
+    { name: "build", event: "push", conclusion: "FAILURE", status: "COMPLETED", completedAt: "2026-11-12T00:41:38Z" },
+  ];
+  const names = failingCheckNames(rollup);
+  assertEquals(names, ["build"], "the optional red push run is still reported as failing");
+  const s = prState({
+    mergeStateStatus: "UNSTABLE",
+    failingChecks: names.length,
+    failingCheckNames: names,
+    unresolvedThreads: -1,
+  });
+  assertEquals(classifyMergeability(s), "ready", "UNSTABLE means only non-required checks failing — still mergeable");
+});
+
+test("#955: token mode (failingChecks === -1) is unchanged", () => {
+  const s = prState({
+    mergeStateStatus: "BLOCKED",
+    failingChecks: -1,
+    totalChecks: -1,
+    presentCheckNames: [],
+    pendingCheckNames: [],
+    checkGateConclusions: {},
+    unresolvedThreads: 0,
+  });
+  assertEquals(classifyMergeability(s), "waiting", "unenumerable checks stay conservative — never newly blocked");
+});
+
+// ── PR #957 review: per-gate conclusions drive the required-check verdict ───────────────────────
+//
+// Same-named runs from different events are different gates, so a required name can carry SEVERAL
+// terminal conclusions. The verdict must (a) route a settled rejection to fix-ci even while a
+// same-named sibling gate is still pending, and (b) require EVERY retained gate to satisfy
+// `acceptedConclusions` — a single accepted gate must not whitewash a rejected sibling.
+
+test("#957: a settled FAILURE required gate routes to fix-ci even while a same-named sibling is pending", () => {
+  // A red PR `build` plus an in-progress push `build`: pending must not mask the settled failure.
+  const s = prState({
+    mergeStateStatus: "BLOCKED",
+    failingChecks: 1,
+    failingCheckNames: ["build"],
+    presentCheckNames: ["build"],
+    pendingCheckNames: ["build"], // the push gate is still running
+    checkGateConclusions: { build: ["FAILURE", ""] }, // PR gate failed, push gate in-flight
+    unresolvedThreads: 0,
+  });
+  assertEquals(
+    classifyMergeability(s, protocolWith({ requiredChecks: reqChecks("build") })),
+    "blocked",
+    "a settled rejected gate owns remediation now — a pending sibling must not delay fix-ci",
+  );
+});
+
+test("#957: a SUCCESS gate does not satisfy a success-only required check while a NEUTRAL sibling gate exists", () => {
+  // Every retained gate must be accepted: a green PR `build` + a NEUTRAL push `build` is rejected.
+  const s = prState({
+    mergeStateStatus: "CLEAN",
+    failingChecks: 0,
+    presentCheckNames: ["build"],
+    pendingCheckNames: [],
+    checkGateConclusions: { build: ["SUCCESS", "NEUTRAL"] },
+    unresolvedThreads: 0,
+  });
+  assertEquals(
+    classifyMergeability(s, protocolWith({ requiredChecks: reqChecks("build") })),
+    "blocked",
+    "a same-named NEUTRAL gate rejects a success-only required check even alongside a SUCCESS gate",
+  );
+});
+
+test("#957: a SUCCESS gate does not satisfy a success-only required check while a SKIPPED sibling gate exists", () => {
+  const s = prState({
+    mergeStateStatus: "CLEAN",
+    failingChecks: 0,
+    presentCheckNames: ["build"],
+    pendingCheckNames: [],
+    checkGateConclusions: { build: ["SUCCESS", "SKIPPED"] },
+    unresolvedThreads: 0,
+  });
+  assertEquals(
+    classifyMergeability(s, protocolWith({ requiredChecks: reqChecks("build") })),
+    "blocked",
+    "a same-named SKIPPED gate rejects a success-only required check even alongside a SUCCESS gate",
+  );
+});
+
+test("#957: every gate accepted passes; a NEUTRAL sibling is fine when the protocol accepts neutral", () => {
+  const s = prState({
+    mergeStateStatus: "CLEAN",
+    failingChecks: 0,
+    presentCheckNames: ["build"],
+    pendingCheckNames: [],
+    checkGateConclusions: { build: ["SUCCESS", "NEUTRAL"] },
+    unresolvedThreads: 0,
+  });
+  assertEquals(
+    classifyMergeability(s, protocolWith({ requiredChecks: [{ name: "build", acceptedConclusions: ["success", "neutral"] }] })),
+    "ready",
+    "when every retained gate's conclusion is accepted the required check is satisfied",
+  );
+});
+
+test("#957: a still-pending only gate (no settled conclusion) waits, never passes", () => {
+  const s = prState({
+    mergeStateStatus: "CLEAN",
+    failingChecks: 0,
+    presentCheckNames: ["build"],
+    pendingCheckNames: ["build"],
+    checkGateConclusions: { build: [""] },
+    unresolvedThreads: 0,
+  });
+  assertEquals(
+    classifyMergeability(s, protocolWith({ requiredChecks: reqChecks("build") })),
+    "waiting",
+    "a required check with no settled gate is not-yet-concluded → waiting, not pass",
+  );
+});
+
 // ── Draft PRs are never landable (issue #454) ────────────────────────────────────────────────────
 //
 // A draft PR with green checks reports `mergeStateStatus: CLEAN`, so the old `mergeStateStatus`
@@ -1076,7 +1251,7 @@ test("classifyMergeability: a known merge conflict is never suppressed by the th
         mergeStateStatus: "DIRTY",
         failingChecks: 1,
         presentCheckNames: ["build"],
-        checkConclusions: { build: "FAILURE" },
+        checkGateConclusions: { build: ["FAILURE"] },
         unresolvedThreads: 2,
       }),
       { requiredChecks: [{ name: "build", acceptedConclusions: ["SUCCESS"] }] },
@@ -1100,7 +1275,7 @@ test("classifyMergeability: the declared required-check verdict outranks the set
         mergeStateStatus: "CLEAN",
         failingChecks: 0,
         presentCheckNames: ["build"],
-        checkConclusions: { build: "NEUTRAL" },
+        checkGateConclusions: { build: ["NEUTRAL"] },
         unresolvedThreads: 2,
       }),
       successOnly,
@@ -1125,7 +1300,7 @@ test("classifyMergeability: the declared required-check verdict outranks the set
         mergeStateStatus: "CLEAN",
         failingChecks: 0,
         presentCheckNames: ["build"],
-        checkConclusions: { build: "SUCCESS" },
+        checkGateConclusions: { build: ["SUCCESS"] },
         unresolvedThreads: 2,
       }),
       successOnly,
@@ -1640,3 +1815,18 @@ test("hasCopilotWorkStarted (token): an aborted (timed-out) read is UNKNOWN (nul
   );
   assertEquals(got, null);
 });
+
+test("CHECK_EVENTS_QUERY is brace-balanced (a malformed query leaves the rollup event-less, PR #957)", async () => {
+  const { CHECK_EVENTS_QUERY } = await import("./github.ts");
+  let depth = 0;
+  for (const ch of CHECK_EVENTS_QUERY) {
+    if (ch === "{") depth++;
+    if (ch === "}") depth--;
+    if (depth < 0) throw new Error("closing brace without a matching opening brace");
+  }
+  assertEquals(depth, 0);
+  for (const p of ["(", "["]) {
+    const close = p === "(" ? ")" : "]";
+    assertEquals(CHECK_EVENTS_QUERY.split(p).length, CHECK_EVENTS_QUERY.split(close).length);
+  }
+});