@norskvideo/ctl-dev-kit 0.2.60 → 0.2.62

package/conventions/sync-dev-kit.yml

@@ -8,14 +8,20 @@
 #
 # It bumps the @norskvideo/ctl-dev-kit pin to the newest published version,
 # reinstalls, re-syncs this product's forced copies from the new canonical
-# (sync-drift), then runs the gate (check:drift + lint + typecheck + unit tests):
+# (sync-drift), runs the gate (check:drift + lint + typecheck + unit tests), and
+# ALWAYS opens (or updates) a PR on sync-dev-kit/<version> -- never a push to
+# main. bot-prs merges it once checks, smoke, integration and the guides gate
+# are green on its head. The gate's verdict heads the PR body: red means the new
+# dev-kit genuinely does not fit this product (a convention that fails
+# lint/typecheck/tests, or a copy sync-drift could not converge), and adopting
+# it is real engineering on the branch, not a copy-paste.
 #
-#   - gate green -> the bump plus any mechanical re-sync is correct; commit it all
-#     straight to main, hands-free. This is the common case.
-#   - gate red   -> the new dev-kit genuinely does not fit this product: a
-#     convention that fails lint/typecheck/tests, or a copy sync-drift could not
-#     mechanically converge. Push a branch and open a PR for a human -- real
-#     engineering to adopt the convention, not a copy-paste.
+# Why a PR even when the gate is green: a new dev-kit changes the copied
+# workflows themselves, and those are exactly what the gate does not run. On
+# 2026-10-09 a newer copied build-image.yml, never run against oracle-reasoning's
+# set-up, broke it on main after a green gate landed it (ci-workflows
+# docs/dashboard/ci-fragility.md, proposal B). On the PR, build-image's build
+# and guides run against the new copy before main has it.
 #
 # sync-drift re-derives each copy from the canonical (never a second opinion that
 # can disagree), preserving the per-repo bits the gate masks -- the product: keys,
@@ -185,100 +191,94 @@ jobs:
             bun run test:unit
           '
 
-      - name: Land the freshness bump on main (gate green)
-        if: steps.sync.outputs.changed == '1' && steps.gate.outcome == 'success'
+      # The bump's only way to main is this PR. bot-prs merges it once every tier
+      # that runs on a bot PR -- checks, smoke, integration and build-image's
+      # guides gate, wherever this repo has them -- is green on its head
+      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
+      # green gate kept lint, typecheck and unit failures off main, but the tiers
+      # that break on an upstream change ran only after landing, so a bad
+      # upstream release still turned main red in every repo that took it. The
+      # gate above still runs: its verdict heads the PR body, and a red one
+      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
+      # the tiers, and a draft could never become ready again by PATCH.
+      - name: Open (or update) the bump PR
+        if: steps.sync.outputs.changed == '1'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          GATE: ${{ steps.gate.outcome }}
         run: |
           set -euo pipefail
-          # This bump is about to land, which makes any sync-dev-kit/* PR an earlier
-          # red run opened obsolete. Left open they piled up -- nine were closed
-          # by hand on 2026-10-03 -- so close them once the push has landed.
-          # Best-effort: a failure here must not fail the landing.
+          branch="sync-dev-kit/${{ steps.sync.outputs.new }}"
+          prefix="sync-dev-kit/"
+          title="Sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }}"
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          # An older PR of this bot's family is obsolete once this one is open:
+          # left open they piled up (nine were closed by hand on 2026-10-03).
+          # Best-effort: a failure here must not fail the bump.
           close_superseded() {
-            api="https://api.github.com/repos/$GITHUB_REPOSITORY"
+            local keep="$1" n
             auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api/pulls?state=open&per_page=100" \
-                | jq -r --arg repo "$GITHUB_REPOSITORY" '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith("sync-dev-kit/"))) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "$api/issues/$n/comments" \
-                -d '{"body":"Superseded: a later sync-dev-kit run landed its bump on main."}'
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/pulls/$n" -d '{"state":"closed"}'
+            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
+                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
+                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
+              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
+                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
+              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
               echo "closed superseded PR #$n"
             done
           }
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$branch"
           git add -A
           git commit -m "chore: sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }}
 
           @norskvideo/ctl-dev-kit pin bumped to the newest published version and the
-          forced copies re-synced from the new canonical (sync-drift); check:drift +
-          lint + typecheck + unit tests green against the new bytes. Lockfile
+          forced copies re-synced from the new canonical (sync-drift). Lockfile
           regenerated."
-          # This pushes with CI_DISPATCH_TOKEN (a PAT), so unlike a GITHUB_TOKEN
-          # push it DOES retrigger downstream checks -- intended: the landed sync
-          # should exercise the product's build workflows once (sync-dev-kit itself
-          # is schedule/dispatch-only, so no loop). Rebase-and-retry so a commit
-          # landing mid-run does not red the sync; a real conflict aborts.
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:main; then close_superseded || true; exit 0; fi
-            echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
-            # --unshallow, not a plain fetch: these runners keep their .git
-            # between jobs, and a commit an earlier job fetched at depth 1 stays
-            # recorded as parentless. A plain fetch does not re-fetch an object it
-            # already holds, so main's tip can look like an unrelated root and the
-            # rebase replays our base commit over it -- add/add conflicts on every
-            # file it touches (playout + studio, 2026-10-03). The fallback covers
-            # a repo that is already complete, where --unshallow is refused.
-            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
-            git rebase origin/main || { git rebase --abort; echo "rebase hit a real conflict; aborting"; exit 1; }
-          done
-          echo "push still failing after 5 rebase attempts"; exit 1
-
-      - name: Open a reconciliation PR (gate red)
-        if: steps.sync.outputs.changed == '1' && steps.gate.outcome == 'failure'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-        run: |
-          set -euo pipefail
-          branch="sync-dev-kit/${{ steps.sync.outputs.new }}"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$branch"
-          git add -A
-          git commit -m "chore: sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }} (needs reconciliation)"
-          git push -f origin "$branch"
-          title="Sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }}"
+          # One branch per bump, force-pushed from today's main -- but only when
+          # its tree changed. A red bump PR left standing is rebuilt by every run
+          # of this bot, and pushing the same tree again would re-run every slow
+          # tier on it for nothing.
+          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
+            echo "$branch already holds this bump; not re-pushing it"
+          else
+            git push -f origin "$branch"
+          fi
+          if [ "$GATE" = "success" ]; then
+            verdict="Gate green: check:drift, lint, typecheck and unit tests pass against the new dev-kit."
+          else
+            verdict="**Gate red**: the new dev-kit does not fit this product yet. Run the gate to see which part: \`bun install\`, then \`bun run check:drift\` (a copy sync-drift could not converge) and \`bun run lint && bun run typecheck && bun run test:unit\` (a convention that breaks real code). Fix it on this branch until green."
+          fi
           body="$(printf '%s\n' \
-            "Automated dev-kit sync: the @norskvideo/ctl-dev-kit pin moved to the newest" \
-            "published version and sync-drift re-synced the forced copies from the new" \
-            "canonical -- but the gate is **red**, so this bump needs a human." \
-            "" \
-            "The mechanical re-sync is already on this branch. A red gate here means the" \
-            "new dev-kit genuinely does not fit the product yet -- run the gate to see which:" \
+            "Automated dev-kit sync: the @norskvideo/ctl-dev-kit pin moved to the newest published version and sync-drift re-synced the forced copies from the new canonical." \
             "" \
-            "    bun install" \
-            "    bun run check:drift   # a copy sync-drift could not mechanically converge" \
-            "    bun run lint && bun run typecheck && bun run test:unit   # a convention that breaks real code" \
+            "$verdict" \
             "" \
-            "Resolve whichever is failing, pushing to this branch until green -- then merge.")"
+            "bot-prs merges this once checks, smoke, integration and the guides gate" \
+            "(build-image) have all passed on its head, wherever this repo runs them." \
+            "Until then main does not move; a red tier keeps it open and reports it on" \
+            "the product dashboard.")"
           # gh is not on the self-hosted runner PATH (it lives only inside
           # `nix develop`, and this step runs outside it), so create/update the PR
           # straight against the REST API with the same PAT that pushed the branch.
-          # Using the PAT (not GITHUB_TOKEN) lets the PR's own checks run so a human
-          # sees the red/green. curl+jq are on the host PATH (the pin-resolve step
-          # above already uses them).
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
+          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
+          # which is the whole point: the bump is judged before it lands.
           curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
           existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
           if [ -n "$existing" ]; then
             curl "${curl_api[@]}" -X PATCH "$api/$existing" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" >/dev/null
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
+            number="$existing"
+            echo "updated PR #$number"
           else
-            curl "${curl_api[@]}" -X POST "$api" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" '{title:$t, body:$b, head:$h, base:"main"}')" >/dev/null
+            number="$(curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
+                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
+            echo "opened PR #$number"
           fi
+          close_superseded "$number" || true
 
       - name: Report "already fresh"
         if: steps.sync.outputs.changed != '1'

package/conventions/upgrade-latest.sdk-app.yml

@@ -15,11 +15,14 @@
 # template launches, which an sdk-app pins in its own source.
 #
 # Nightly cron + on demand. The bump runs the product's own gate (lint,
-# typecheck, unit tests) BEFORE it lands, exactly as upgrade-latest.yml and
-# sync-dev-kit do: green lands on main, red opens a reconciliation PR and main
-# stays green. The push is made with CI_DISPATCH_TOKEN (a PAT), so the push to
-# main fires the product's own workflows -- a GITHUB_TOKEN push would fire
-# nothing. No norsk-ctl pin to refresh: the sdk-app flake carries none.
+# typecheck, unit tests), then ALWAYS opens (or updates) a PR on
+# upgrade-latest/nightly, exactly as upgrade-latest.yml does, for bot-prs to
+# merge once the PR's tiers are green; it never pushes to main (see that file
+# for why). The branch is pushed with CI_DISPATCH_TOKEN (a PAT), so the PR's
+# workflows fire -- a GITHUB_TOKEN push would fire nothing. It also moves
+# flake.nix's ctlVersion, the norsk-ctl the product's CI tiers run, to the
+# `latest` channel: an sdk-app's flake fetches no daemon, so it carries the
+# version alone (ctl-pinned-in-repo.test.ts).
 #
 # Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.sdk-app.yml)
 # and copied verbatim into each sdk-app product repo as
@@ -113,7 +116,19 @@ jobs:
           hub="https://hub.docker.com/v2/repositories/norskvideo/norsk/tags"
           tag_re='^[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+$'
           changed=0
-          summary=""
+          parts=()
+
+          # NORSK-CTL: the version flake.nix's ctlVersion names is the daemon every
+          # CI tier runs (ctl-pinned-in-repo.test.ts) as well as the one the dev
+          # shell launches, so it moves here like the engine does and the bump
+          # PR's tiers are what test it (ci-workflows docs/dashboard/
+          # ci-fragility.md, proposal A). Resolved up front, with everything
+          # else, so a refusal rewrites nothing.
+          ctl_base="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
+          old_ctl="$( { grep -oE 'ctlVersion = "[^"]+"' flake.nix 2>/dev/null || true; } | head -1 | sed -E 's/.*"(.*)"/\1/')"
+          [ -n "$old_ctl" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl it names, so add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+          new_ctl="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/latest")"
+          [ -n "$new_ctl" ] || { echo "::error::could not resolve norsk-ctl's latest channel"; exit 1; }
 
           # CURRENT: the product's exact norsk-sdk pin, wherever a tracked
           # package.json carries it (deps, devDeps or overrides). It is the one
@@ -157,7 +172,34 @@ jobs:
           if [ "$old" != "$new" ]; then
             git grep -lF "$old" -- . ':!bun.lock' | xargs -r sed -i "s|$old|$new|g"
             changed=1
-            summary="media \`$new\`"
+            parts+=("media \`$new\`")
+          fi
+
+          # --- norsk-ctl pin (flake.nix) ------------------------------------
+          # ctlVersion, plus the per-platform hash of each platform the flake
+          # fetches the daemon for. A Studio product's flake fetches all four; an
+          # sdk-app's fetches none and carries the version alone. Mirrors
+          # packages/dev-kit/build/refresh-ctl-pin.sh in the ctl monorepo.
+          if [ "$old_ctl" != "$new_ctl" ]; then
+            declare -A ctlplat=([x86_64-linux]=linux-x64 [aarch64-linux]=linux-arm64 [aarch64-darwin]=darwin-arm64 [x86_64-darwin]=darwin-x64)
+            for sys in "${!ctlplat[@]}"; do
+              p="${ctlplat[$sys]}"
+              grep -qF "plat = \"$p\";" flake.nix || continue
+              hex="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/$new_ctl/norsk-ctl-$new_ctl-$p.sha256" | awk '{print $1}')"
+              [ -n "$hex" ] || { echo "no sha256 sidecar for $p"; exit 1; }
+              sri="$(nix hash convert --hash-algo sha256 --to sri "$hex")"
+              perl -0pi -e "s{(plat = \"$p\";\\s*hash = \")[^\"]*(\")}{\${1}$sri\${2}}" flake.nix
+            done
+            perl -0pi -e "s{(ctlVersion = \")[^\"]*(\")}{\${1}$new_ctl\${2}}" flake.nix
+            echo "ctl: $old_ctl -> $new_ctl"
+            changed=1
+            parts+=("norsk-ctl \`$new_ctl\`")
+          fi
+
+          summary=""
+          if [ ${#parts[@]} -gt 0 ]; then
+            summary="$(printf '%s, ' "${parts[@]}")"
+            summary="${summary%, }"
           fi
           {
             echo "changed=$changed"
@@ -192,111 +234,103 @@ jobs:
             bun run test:unit
           '
 
-      - name: Land the bump on main (gate green)
-        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
+      # The bump's only way to main is this PR. bot-prs merges it once every tier
+      # that runs on a bot PR -- checks, smoke, integration and build-image's
+      # guides gate, wherever this repo has them -- is green on its head
+      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
+      # green gate kept lint, typecheck and unit failures off main, but the tiers
+      # that break on an upstream change ran only after landing, so a bad
+      # upstream release still turned main red in every repo that took it. The
+      # gate above still runs: its verdict heads the PR body, and a red one
+      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
+      # the tiers, and a draft could never become ready again by PATCH.
+      - name: Open (or update) the bump PR
+        if: steps.bump.outputs.changed == '1'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          # Through env, never pasted into the script (see the PR step below).
+          GATE: ${{ steps.gate.outcome }}
+          # Through env, never pasted into the script: the summary wraps each
+          # version in backticks, and inside a double-quoted shell string those
+          # ran as commands ("1.3.1-...: command not found"), dropping every
+          # version from the commit message and PR body.
           SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
-          # This bump is about to land, which makes any upgrade-latest/* PR an earlier
-          # red run opened obsolete. Left open they piled up -- nine were closed
-          # by hand on 2026-10-03 -- so close them once the push has landed.
-          # Best-effort: a failure here must not fail the landing.
+          branch="upgrade-latest/nightly"
+          prefix="upgrade-latest/"
+          title="Bump the Norsk family to the SDK nightly"
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          # An older PR of this bot's family is obsolete once this one is open:
+          # left open they piled up (nine were closed by hand on 2026-10-03).
+          # Best-effort: a failure here must not fail the bump.
           close_superseded() {
-            api="https://api.github.com/repos/$GITHUB_REPOSITORY"
+            local keep="$1" n
             auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api/pulls?state=open&per_page=100" \
-                | jq -r --arg repo "$GITHUB_REPOSITORY" '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith("upgrade-latest/"))) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "$api/issues/$n/comments" \
-                -d '{"body":"Superseded: a later upgrade-latest run landed its bump on main."}'
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/pulls/$n" -d '{"state":"closed"}'
+            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
+                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
+                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
+              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
+                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
+              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
               echo "closed superseded PR #$n"
             done
           }
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$branch"
           git add -A
           git commit -m "chore: bump the Norsk family to the SDK nightly
 
           ${SUMMARY}
 
           The norsk-sdk / norsk-api pins and the engine image ref moved together
-          via a global version-string replace; lockfile regenerated."
-          # main can advance under a long bump (lockfile regen + registry
-          # lookups run for minutes); a bare push then loses a non-fast-forward
-          # race and reds the nightly. Rebase-and-retry so an unrelated commit
-          # landing mid-run does not fail the bump; a genuine content conflict
-          # still aborts loudly rather than force-pushing over other work.
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:main; then close_superseded || true; exit 0; fi
-            echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
-            # --unshallow, not a plain fetch: these runners keep their .git
-            # between jobs, and a commit an earlier job fetched at depth 1 stays
-            # recorded as parentless. A plain fetch does not re-fetch an object it
-            # already holds, so main's tip can look like an unrelated root and the
-            # rebase replays our base commit over it -- add/add conflicts on every
-            # file it touches (playout + studio, 2026-10-03). The fallback covers
-            # a repo that is already complete, where --unshallow is refused.
-            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
-            git rebase origin/main || { git rebase --abort; echo "rebase hit a real conflict; aborting"; exit 1; }
-          done
-          echo "push still failing after 5 rebase attempts"; exit 1
-
-      - name: Open a reconciliation PR (gate red)
-        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          # Through env, never pasted into the script: the summary wraps each
-          # version in backticks, and inside a double-quoted shell string those
-          # ran as commands ("1.3.1-...: command not found"), dropping every
-          # version from the commit message and PR body.
-          SUMMARY: ${{ steps.bump.outputs.summary }}
-        run: |
-          set -euo pipefail
-          branch="upgrade-latest/nightly"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$branch"
-          git add -A
-          git commit -m "chore: bump the Norsk family to the SDK nightly (needs reconciliation)
-
-          ${SUMMARY}"
-          git push -f origin "$branch"
-          title="Bump the Norsk family to the SDK nightly"
+          via a global version-string replace; lockfile regenerated. flake.nix
+          ctlVersion, the norsk-ctl CI runs, moved to the latest channel."
+          # One branch per bump, force-pushed from today's main -- but only when
+          # its tree changed. A red bump PR left standing is rebuilt by every run
+          # of this bot, and pushing the same tree again would re-run every slow
+          # tier on it for nothing.
+          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
+            echo "$branch already holds this bump; not re-pushing it"
+          else
+            git push -f origin "$branch"
+          fi
+          if [ "$GATE" = "success" ]; then
+            verdict="Gate green: lint, typecheck and unit tests pass on the bumped pins."
+          else
+            verdict="**Gate red**: lint, typecheck or unit tests fail on the bumped pins. That usually means the new SDK nightly is bad, or genuinely changed something the product depends on. Fix it on this branch, or close this PR to skip the bump -- the next nightly run reopens it against whatever the channel holds then."
+          fi
           body="$(printf '%s\n' \
-            "Automated nightly pin bump: the Norsk nightly channel moved and the coupled" \
-            "pins came with it -- but the product gate is **red**, so this bump needs a" \
-            "human before it reaches main." \
+            "Automated nightly pin bump: the Norsk SDK nightly and norsk-ctl latest moved, and the pins came with them." \
             "" \
             "    ${SUMMARY}" \
             "" \
-            "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
-            "changed something the product depends on. Run it to see which:" \
-            "" \
-            "    bun run lint && bun run typecheck && bun run test:unit" \
+            "$verdict" \
             "" \
-            "Fix it on this branch and merge, or close this PR to skip the bump -- the" \
-            "next nightly run reopens it against whatever the channel holds then.")"
+            "bot-prs merges this once checks, smoke, integration and the guides gate" \
+            "(build-image) have all passed on its head, wherever this repo runs them." \
+            "Until then main does not move; a red tier keeps it open and reports it on" \
+            "the product dashboard.")"
           # gh is not on the self-hosted runner PATH (it lives only inside
           # `nix develop`, and this step runs outside it), so create/update the PR
           # straight against the REST API with the same PAT that pushed the branch.
-          # The PAT (not GITHUB_TOKEN) is what lets the PR's own checks run, which
-          # is the whole point: the bump is judged before it lands, not after.
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
+          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
+          # which is the whole point: the bump is judged before it lands.
           curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
           existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
           if [ -n "$existing" ]; then
             curl "${curl_api[@]}" -X PATCH "$api/$existing" \
               --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
-            echo "updated PR #$existing"
+            number="$existing"
+            echo "updated PR #$number"
           else
-            curl "${curl_api[@]}" -X POST "$api" \
+            number="$(curl "${curl_api[@]}" -X POST "$api" \
               --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
-                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r '"opened PR #\(.number)"'
+                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
+            echo "opened PR #$number"
           fi
+          close_superseded "$number" || true
 
       - name: Report "already fresh"
         if: steps.bump.outputs.changed != '1'