@opengsd/gsd-core 1.20.0 → 1.21.0

package/scripts/changeset/lint.cjs

@@ -20,6 +20,9 @@ const LINT_REASON = Object.freeze({
   OK_FRAGMENT_PRESENT: 'ok_fragment_present',
   OK_OPT_OUT_LABEL: 'ok_opt_out_label',
   OK_NO_USER_FACING_CHANGES: 'ok_no_user_facing_changes',
+  // #5903: the release pipeline's own PRs consume every fragment into
+  // CHANGELOG.md, so they carry none by design.
+  OK_RELEASE_PIPELINE: 'ok_release_pipeline',
   FAIL_MISSING_FRAGMENT: 'fail_missing_fragment',
   FAIL_INVALID_FRAGMENT: 'fail_invalid_fragment',
   FAIL_PR_FIELD_DRIFT: 'fail_pr_field_drift',
@@ -86,13 +89,18 @@ function findPrFieldDrift(prEntries, realPrNumber) {
   return drift;
 }
 
-function evaluateLint({ changedFiles, labels, fragmentFailures = [], prFieldDrift = [] }) {
+function evaluateLint({
+  changedFiles, labels, fragmentFailures = [], prFieldDrift = [], releasePipelineKind = null,
+}) {
   if (fragmentFailures.length > 0) {
     return { ok: false, reason: LINT_REASON.FAIL_INVALID_FRAGMENT, failures: fragmentFailures };
   }
   if (prFieldDrift.length > 0) {
     return { ok: false, reason: LINT_REASON.FAIL_PR_FIELD_DRIFT, drift: prFieldDrift };
   }
+  if (releasePipelineKind) {
+    return { ok: true, reason: LINT_REASON.OK_RELEASE_PIPELINE, releasePipelineKind };
+  }
   if (changedFiles.some(isFragment)) {
     return { ok: true, reason: LINT_REASON.OK_FRAGMENT_PRESENT };
   }
@@ -107,6 +115,7 @@ function evaluateLint({ changedFiles, labels, fragmentFailures = [], prFieldDrif
 
 const { ExitError, runMain } = require('../lib/cli-exit.cjs');
 const { parseFragment } = require('./parse.cjs');
+const { releasePipelinePrKind } = require('../release-pipeline-pr.cjs');
 
 function main() {
   const fs = require('node:fs');
@@ -119,6 +128,12 @@ function main() {
   // `pull_request` in the payload, or no payload at all) — the drift check
   // below is a no-op in that case, it never fails a push run.
   let realPrNumber = null;
+  // #5903: head/base refs and whether the head lives in this repository, for
+  // the release-pipeline exemption. sameRepo is false when anything is missing
+  // (a deleted fork has head.repo === null).
+  let headRef;
+  let baseRef;
+  let sameRepo = false;
   if (eventPath && fs.existsSync(eventPath)) {
     try {
       const event = JSON.parse(fs.readFileSync(eventPath, 'utf8'));
@@ -126,6 +141,12 @@ function main() {
       if (event.pull_request && Number.isInteger(event.pull_request.number)) {
         realPrNumber = event.pull_request.number;
       }
+      headRef = event.pull_request?.head?.ref;
+      baseRef = event.pull_request?.base?.ref;
+      const headRepo = event.pull_request?.head?.repo?.full_name;
+      const thisRepo = process.env.GITHUB_REPOSITORY;
+      sameRepo = typeof headRepo === 'string' && typeof thisRepo === 'string'
+        && headRepo !== '' && headRepo.toLowerCase() === thisRepo.toLowerCase();
     } catch { /* fall through */ }
   }
   // #2988: local fallback must match the repo's integration branch (`next`),
@@ -176,11 +197,15 @@ function main() {
   }
 
   const prFieldDrift = findPrFieldDrift(prEntries, realPrNumber);
-  const verdict = evaluateLint({ changedFiles, labels, fragmentFailures, prFieldDrift });
+  const releasePipelineKind = releasePipelinePrKind({ headRef, baseRef, sameRepo });
+  const verdict = evaluateLint({
+    changedFiles, labels, fragmentFailures, prFieldDrift, releasePipelineKind,
+  });
   if (process.argv.includes('--json')) {
     process.stdout.write(JSON.stringify({ ...verdict, changedFiles, labels }, null, 2) + '\n');
   } else if (verdict.ok) {
-    process.stdout.write(`ok changeset-lint: ${verdict.reason}\n`);
+    const kind = verdict.releasePipelineKind ? ` (${verdict.releasePipelineKind})` : '';
+    process.stdout.write(`ok changeset-lint: ${verdict.reason}${kind}\n`);
   } else if (verdict.reason === LINT_REASON.FAIL_INVALID_FRAGMENT) {
     process.stderr.write(`\nERROR changeset-lint: ${verdict.reason}\n`);
     process.stderr.write(`The following .changeset fragment(s) failed content validation:\n`);

package/scripts/changeset/serialize.cjs

@@ -1,5 +1,15 @@
 'use strict';
 
+// Body of a dated release rendered by `render --allow-empty` when no fragment
+// exists (cli.cjs injectEmptyPlaceholder). Shared so consumers recognise it.
+const EMPTY_RELEASE_PLACEHOLDER = '_No notable changes._';
+
+// F3: matches linked headers: ## [1.42.1](url) - 2026-05-15. The
+// (?:\([^)]*\))? group skips an optional (url) after the closing ] before the
+// optional date suffix. Exported so line-slicing consumers (release-notes
+// builder, #5922) locate headings with the exact regex parseChangelog uses.
+const RELEASE_HEADING_RE = /^##\s+\[([^\]]+)\](?:\([^)]*\))?\s*(?:-\s*(\S+))?/;
+
 /**
  * Markdown serializer + parser for the changelog IR. The two are inverses
  * over the well-formed subset; tests assert via round-trip (parse(serialize(ir)))
@@ -87,7 +97,7 @@ function parseChangelog(text) {
     //     before looking for the optional date suffix.
     // F6: strip a leading `v` from the captured version so `## [v1.0.0]`
     //     parses as version "1.0.0" instead of "v1.0.0".
-    const releaseMatch = line.match(/^##\s+\[([^\]]+)\](?:\([^)]*\))?\s*(?:-\s*(\S+))?/);
+    const releaseMatch = line.match(RELEASE_HEADING_RE);
     if (releaseMatch) {
       flushBullet();
       const rawVersion = releaseMatch[1];
@@ -131,4 +141,4 @@ function parseChangelog(text) {
   return { releases };
 }
 
-module.exports = { serializeChangelog, parseChangelog };
+module.exports = { serializeChangelog, parseChangelog, RELEASE_HEADING_RE, EMPTY_RELEASE_PLACEHOLDER };

package/scripts/ci-compact-v8-coverage.cjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Compacts one CI shard's raw V8 coverage dumps into a single merged file.
+ *
+ * Why: the `coverage-gate` job used to download every shard's raw dumps
+ * (~1.68 GB across 3 shards, mostly node internals, tests/ and
+ * node_modules scripts that c8 discards at report time) and make
+ * `c8 report --merge-async` parse and merge all of it twice (lib report +
+ * scripts floor). Doing the same filter + merge on each shard, in parallel
+ * with the other shards, leaves the gate three small files to merge.
+ *
+ * Exactness: this applies the SAME steps c8's Report applies before it
+ * converts to istanbul — `_normalizeProcessCov` (node: urls, file:// urls,
+ * include/exclude filter), `_normalizeSourceMapCache` (file-url keys; a
+ * non-file key throws, as it does in c8) and then `@bcoe/v8-coverage`
+ * `mergeProcessCovs`. Merging is applied in batches of MERGE_BATCH_SIZE
+ * (`mergeProcessCovs([acc, ...batch])`) so peak memory does not grow with the
+ * number of dumps (#6140). Merge grouping preserves every per-offset execution
+ * count (what line/statement coverage reads), but @bcoe/v8-coverage
+ * normalization is not associative in range structure: a block range can be
+ * wrapped or joined differently than in a one-pass merge, so istanbul branch
+ * totals may differ by merge grouping, the same variance the shard -> gate
+ * merge already has (pinned by test). The merged output is a valid c8
+ * temp-directory dump, so the gate's unchanged
+ * `c8 report` commands read it as if it were one more raw dump. Retained urls
+ * are the UNION of every include glob the gate uses, so both
+ * `test:coverage:report` and `test:coverage:scripts-floor` see all of the
+ * data they would have seen before. The one deliberate deviation from raw c8
+ * is `normalizeBlockFlags`, which makes a never-called function's block flag
+ * independent of dump count (#5985).
+ *
+ * Guard: a shard that produced no V8 coverage dumps at all throws, restoring
+ * the `if-no-files-found: error` guarantee the raw-dump upload step gave.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { createRequire } = require('module');
+const { fileURLToPath, pathToFileURL } = require('url');
+
+// Single source of truth for what the gate may report on. Must stay equal to
+// the union of the --include globs in package.json's test:coverage:report and
+// test:coverage:scripts-floor (tests/ci-compact-v8-coverage.test.cjs pins it).
+const INCLUDE_GLOBS = ['gsd-core/bin/lib/**/*.cjs', 'scripts/**/*.cjs'];
+const EXCLUDE_GLOBS = ['tests/**'];
+// Bounds how many filtered dumps are held before folding them into the accumulator (#6140).
+const MERGE_BATCH_SIZE = 64;
+
+function loadDeps(cwd) {
+  // Resolve through c8 so the versions are exactly the ones c8 itself uses.
+  const c8Require = createRequire(require.resolve('c8/package.json', { paths: [cwd, __dirname] }));
+  return {
+    mergeProcessCovs: c8Require('@bcoe/v8-coverage').mergeProcessCovs,
+    Exclude: c8Require('test-exclude'),
+  };
+}
+
+// Normalized href for a retained script url, or null when c8 would discard it.
+function retainedHref(shouldInstrument, url) {
+  if (typeof url !== 'string' || !/^file:\/\//.test(url)) return null; // node: and non-file urls
+  const filePath = fileURLToPath(url);
+  return shouldInstrument(filePath) ? pathToFileURL(filePath).href : null;
+}
+
+// The same rule @bcoe/v8-coverage mergeFunctionCovs applies on a real merge
+// (merge.js:158). Its single-input fast path skips it, so under c8's pairwise
+// merge a never-called function adds a 0-count branch only when it appears in
+// an odd number of dumps. Applying the rule unconditionally makes the gate's
+// branch count independent of how dumps are split into shards (#5985).
+function normalizeBlockFlags(result) {
+  for (const script of result) {
+    for (const fn of script.functions) {
+      if (fn.ranges.length === 1 && fn.ranges[0].count === 0) fn.isBlockCoverage = false;
+    }
+  }
+}
+
+// `mergeProcessCovs` is an injection point for tests; main() never passes it.
+function compact({ tempDirectory, outFile, cwd = process.cwd(), batchSize = MERGE_BATCH_SIZE, mergeProcessCovs: mergeOverride }) {
+  if (!Number.isInteger(batchSize) || batchSize < 1) {
+    throw new RangeError(`ci-compact-v8-coverage: batchSize must be a positive integer, got ${batchSize}`);
+  }
+  const deps = loadDeps(cwd);
+  const mergeProcessCovs = mergeOverride || deps.mergeProcessCovs;
+  const { Exclude } = deps;
+  const exclude = new Exclude({
+    cwd,
+    include: INCLUDE_GLOBS,
+    // Exactly c8's set: an explicit --exclude REPLACES istanbul's default exclude
+    // (c8 lib/parse-args.js `exclude` default), so defaultExclude must not apply.
+    exclude: [...EXCLUDE_GLOBS],
+    relativePath: true,
+    excludeNodeModules: true,
+  });
+
+  // Memoized per path, as c8 does (report.js shouldInstrumentCache): the same
+  // node_modules scripts repeat across every dump.
+  const instrumentCache = new Map();
+  const shouldInstrument = (filePath) => {
+    let decision = instrumentCache.get(filePath);
+    if (decision === undefined) {
+      decision = exclude.shouldInstrument(filePath);
+      instrumentCache.set(filePath, decision);
+    }
+    return decision;
+  };
+  const hrefCache = new Map();
+  const hrefFor = (url) => {
+    if (typeof url !== 'string') return null;
+    let href = hrefCache.get(url);
+    if (href === undefined) {
+      href = retainedHref(shouldInstrument, url);
+      hrefCache.set(url, href);
+    }
+    return href;
+  };
+
+  let merged = null;
+  let pending = [];
+  // Count equality across merge groupings relies on a V8 invariant: detailed
+  // (NODE_V8_COVERAGE) coverage reports isBlockCoverage:false only for a
+  // never-compiled function (one range, count 0). @bcoe/v8-coverage drops
+  // function-level entries when block-level ones exist, so a function-level
+  // entry with count > 0 would merge differently by grouping.
+  const flush = () => {
+    if (pending.length === 0) return;
+    merged = mergeProcessCovs(merged ? [merged, ...pending] : pending);
+    pending = [];
+  };
+  const sourceMapCache = {};
+  let inputFiles = 0;
+  for (const name of fs.readdirSync(tempDirectory).sort()) {
+    let dump;
+    try {
+      dump = JSON.parse(fs.readFileSync(path.join(tempDirectory, name), 'utf8'));
+    } catch {
+      continue; // c8 skips unparsable dumps too
+    }
+    if (!dump || !Array.isArray(dump.result)) continue;
+    inputFiles++;
+    const result = [];
+    for (const script of dump.result) {
+      const href = hrefFor(script.url);
+      if (href === null) continue;
+      script.url = href;
+      result.push(script);
+    }
+    const cache = dump['source-map-cache'];
+    if (cache) {
+      for (const key of Object.keys(cache)) {
+        // c8's _normalizeSourceMapCache calls fileURLToPath(key) unguarded: a
+        // non-file key throws there, so it throws here too.
+        const keyPath = fileURLToPath(key);
+        if (shouldInstrument(keyPath)) sourceMapCache[pathToFileURL(keyPath).href] = cache[key];
+      }
+    }
+    pending.push({ result });
+    if (pending.length >= batchSize) flush();
+  }
+
+  if (inputFiles === 0) {
+    throw new Error(`ci-compact-v8-coverage: no V8 coverage dumps in ${tempDirectory}`);
+  }
+
+  flush();
+  const out = { result: merged ? merged.result : [], 'source-map-cache': sourceMapCache };
+  normalizeBlockFlags(out.result);
+  fs.mkdirSync(path.dirname(outFile), { recursive: true });
+  fs.writeFileSync(outFile, JSON.stringify(out));
+  return { inputFiles, scripts: out.result.length };
+}
+
+const USAGE = 'usage: ci-compact-v8-coverage.cjs --out <file> [--temp-directory <dir>]';
+
+function parseArgs(argv) {
+  // undefined: flag absent; null: flag present without a usable value.
+  const value = (flag) => {
+    const i = argv.indexOf(flag);
+    if (i === -1) return undefined;
+    const v = argv[i + 1];
+    return v === undefined || v.startsWith('--') ? null : v;
+  };
+  const outFile = value('--out');
+  const tempDirectory = value('--temp-directory');
+  if (!outFile || tempDirectory === null) return { error: USAGE };
+  return { tempDirectory: tempDirectory === undefined ? path.join('coverage', 'tmp') : tempDirectory, outFile };
+}
+
+function main(argv) {
+  const parsed = parseArgs(argv);
+  if (parsed.error) {
+    console.error(parsed.error);
+    process.exitCode = 2;
+    return;
+  }
+  const stats = compact({ tempDirectory: parsed.tempDirectory, outFile: parsed.outFile });
+  console.log(`compacted ${stats.inputFiles} dumps -> ${stats.scripts} scripts in ${parsed.outFile}`);
+}
+
+if (require.main === module) main(process.argv.slice(2));
+
+module.exports = { compact, parseArgs, main, INCLUDE_GLOBS, EXCLUDE_GLOBS, MERGE_BATCH_SIZE };

package/scripts/ci-fix-next-rerun.cjs

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+'use strict';
+
+// ci-fix-next-rerun.cjs — #6076: re-run ONLY the `Base branch health` job of a
+// PR's latest Tests run after the `fix-next` label was added or removed.
+//
+// Runs from .github/workflows/fix-next-rerun.yml (pull_request_target) against
+// the BASE sha's copy of this file, never the PR's. The core is dependency
+// injected (`gh`, `now`, `sleep`) so every branch is tested without a network.
+
+const { execFile } = require('node:child_process');
+const { runMain } = require('./lib/cli-exit.cjs');
+
+const BASE_HEALTH_JOB_NAME = 'Base branch health';
+const TESTS_WORKFLOW_FILE = 'test.yml';
+const GH_TIMEOUT_MS = 30000;
+const DEFAULT_DEADLINE_MS = 85 * 60 * 1000;
+const DEFAULT_POLL_MS = 30 * 1000;
+const PR_NUMBER_PATTERN = /^[1-9]\d*$/;
+const HEAD_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+
+/**
+ * @param {object} opts
+ * @param {(args:string[]) => Promise<string>} opts.gh  stdout of `gh <args>`; throws on failure
+ * @param {string} opts.repo      owner/repo
+ * @param {string} opts.headSha   head sha from the label event payload
+ * @param {string} opts.prNumber  PR number
+ * @param {() => number} opts.now ms clock (read once at start, once per incomplete poll)
+ * @param {(ms:number) => Promise<void>} opts.sleep
+ * @param {number} opts.deadlineMs  how long to wait for the run to complete
+ * @param {number} opts.pollMs
+ * @returns {Promise<{action:'rerun'|'skip'|'error', reason:string, runId?:string, jobId?:string}>}
+ */
+async function rerunBaseHealth({
+  gh, repo, headSha, prNumber, now, sleep, deadlineMs = DEFAULT_DEADLINE_MS, pollMs = DEFAULT_POLL_MS,
+}) {
+  try {
+    const deadline = now() + deadlineMs;
+    let run;
+    for (;;) {
+      const listed = JSON.parse(await gh([
+        'run', 'list', '--workflow', TESTS_WORKFLOW_FILE, '--commit', headSha,
+        '--event', 'pull_request', '--limit', '1', '--json', 'databaseId,status,conclusion',
+      ]));
+      if (!Array.isArray(listed) || listed.length === 0) return { action: 'skip', reason: 'no-run' };
+      [run] = listed;
+      if (run.status === 'completed') break;
+      if (now() >= deadline) return { action: 'error', reason: 'timeout', runId: String(run.databaseId) };
+      await sleep(pollMs);
+    }
+    const runId = String(run.databaseId);
+
+    // A cancelled run was superseded by a newer one, which reads the label from
+    // the API; re-running a job here would rejoin the Tests concurrency group
+    // and could cancel that newer run.
+    if (run.conclusion === 'cancelled') return { action: 'skip', reason: 'run-cancelled', runId };
+
+    // A run waiting for approval has not executed; there is nothing to re-run.
+    if (run.conclusion === 'action_required') return { action: 'skip', reason: 'run-awaiting-approval', runId };
+
+    const readHead = async () => (await gh(['api', `repos/${repo}/pulls/${prNumber}`, '--jq', '.head.sha'])).trim();
+    if ((await readHead()) !== headSha) return { action: 'skip', reason: 'head-moved', runId };
+
+    const view = JSON.parse(await gh(['run', 'view', runId, '--json', 'jobs']));
+    const jobs = view && Array.isArray(view.jobs) ? view.jobs : [];
+    const job = jobs.find((j) => j && j.name === BASE_HEALTH_JOB_NAME);
+    if (!job) return { action: 'error', reason: 'no-job', runId };
+    const jobId = String(job.databaseId);
+
+    // Second read immediately before the re-run, to shrink the stale-run window.
+    if ((await readHead()) !== headSha) return { action: 'skip', reason: 'head-moved', runId };
+
+    await gh(['run', 'rerun', runId, '--job', jobId]);
+    return { action: 'rerun', reason: 'rerun', runId, jobId };
+  } catch (err) {
+    return { action: 'error', reason: `gh-failed: ${err && err.message ? err.message : String(err)}` };
+  }
+}
+
+function realGh(args) {
+  return new Promise((resolve, reject) => {
+    execFile('gh', args, { timeout: GH_TIMEOUT_MS, maxBuffer: 8 * 1024 * 1024, encoding: 'utf8' }, (err, stdout) => {
+      if (err) reject(err);
+      else resolve(stdout);
+    });
+  });
+}
+
+/**
+ * @param {object} [deps]  test seams: env, gh, now, sleep, stdout, stderr, deadlineMs, pollMs
+ * @returns {Promise<number>} exit code
+ */
+async function main(deps = {}) {
+  const env = deps.env || process.env;
+  const out = deps.stdout || ((s) => process.stdout.write(s));
+  const errOut = deps.stderr || ((s) => process.stderr.write(s));
+
+  const prNumber = (env.PR_NUMBER || '').trim();
+  if (!PR_NUMBER_PATTERN.test(prNumber)) {
+    errOut(`::error::PR_NUMBER must be a positive integer, got ${JSON.stringify(prNumber)}\n`);
+    return 1;
+  }
+  const headSha = (env.HEAD_SHA || '').trim();
+  if (!HEAD_SHA_PATTERN.test(headSha)) {
+    errOut('::error::HEAD_SHA must be a 40-character hex sha\n');
+    return 1;
+  }
+  const repo = (env.GH_REPO || '').trim();
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+    errOut('::error::GH_REPO must be owner/repo\n');
+    return 1;
+  }
+
+  const result = await rerunBaseHealth({
+    gh: deps.gh || realGh,
+    repo,
+    headSha,
+    prNumber,
+    now: deps.now || Date.now,
+    sleep: deps.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    deadlineMs: deps.deadlineMs,
+    pollMs: deps.pollMs,
+  });
+
+  if (result.action === 'error') {
+    errOut(`::error::fix-next re-run failed (${result.reason})${result.runId ? ` on Tests run ${result.runId}` : ''}; re-run "${BASE_HEALTH_JOB_NAME}" by hand.\n`);
+    return 1;
+  }
+  if (result.action === 'skip') {
+    out(`::notice::fix-next re-run skipped (${result.reason}); the newer or upcoming run reads the label from the API.\n`);
+    return 0;
+  }
+  out(`Re-ran "${BASE_HEALTH_JOB_NAME}" (job ${result.jobId}) on Tests run ${result.runId}.\n`);
+  return 0;
+}
+
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = {
+  BASE_HEALTH_JOB_NAME,
+  TESTS_WORKFLOW_FILE,
+  DEFAULT_DEADLINE_MS,
+  DEFAULT_POLL_MS,
+  GH_TIMEOUT_MS,
+  rerunBaseHealth,
+  main,
+};

package/scripts/ci-next-health.cjs

@@ -17,7 +17,8 @@
 // with a non-success conclusion for the base branch's last push-triggered Tests
 // run, that is treated as authoritative and blocks — with one explicit, visible,
 // human-operated escape hatch (the `fix-next` label) for the PR that is itself
-// the fix-forward.
+// the fix-forward. On a pull request the label is read from the API (#6076), so
+// after it is added the fix-next-rerun workflow re-runs this check and sees it.
 //
 // Every non-success conclusion (`failure`, `cancelled`, `timed_out`,
 // `action_required`, ...) is treated as RED, not just `failure` — a cancelled or
@@ -205,11 +206,14 @@ async function evaluateQueueBypass({ headRef, baseRef, baseSha, headSha, repo, g
  * (or throwing) — injected so tests never touch the network.
  * `evaluateQueueBypass` (merge_group only) is an async function returning
  * `{authorized, reason, actor}`; it is how a queued fix-forward is recognised.
+ * `fetchPrLabels` (pull_request only, RED base only) is an async function
+ * returning the PR's current label names (or throwing, which keeps the gate
+ * RED with reason `label-read-failed`); when absent, `labels` decides (#6076).
  *
  * @returns {Promise<{verdict:string, payload:*, reason:string}>}
  */
 async function resolveNextHealth({
-  fetchLatestRun, eventName, baseRef, labels, evaluateQueueBypass: queueBypass,
+  fetchLatestRun, eventName, baseRef, labels, fetchPrLabels, evaluateQueueBypass: queueBypass,
 } = {}) {
   if (!APPLICABLE_EVENTS.has(eventName)) {
     return { verdict: VERDICT.SKIPPED_NOT_APPLICABLE, payload: null, reason: 'not-applicable-event' };
@@ -235,10 +239,25 @@ async function resolveNextHealth({
     return { verdict: assessed.verdict, payload: evidence, reason };
   }
 
-  // Escape hatch for the PR that is itself the fix-forward. pull_request runs
-  // read the label from the event (`labels`). merge_group events carry no
-  // labels, so the queue run asks the API instead (evaluateQueueBypass).
-  const labelList = Array.isArray(labels) ? labels : [];
+  // Escape hatch for the PR that is itself the fix-forward. A pull_request run
+  // with `fetchPrLabels` reads the PR's CURRENT labels from the API (#6076), so
+  // a re-run sees a label added or removed after the run started; a failed read
+  // keeps the gate RED. Without it, the event's `labels` decide (bootstrap).
+  // merge_group events carry no labels, so the queue run asks the API instead
+  // (evaluateQueueBypass).
+  let labelList = Array.isArray(labels) ? labels : [];
+  if (eventName === 'pull_request' && typeof fetchPrLabels === 'function') {
+    try {
+      const current = await fetchPrLabels();
+      labelList = Array.isArray(current) ? current : [];
+    } catch (err) {
+      return {
+        verdict: VERDICT.RED,
+        payload: evidence,
+        reason: `${assessed.reason === 'resolved' ? 'red' : assessed.reason}; label-read-failed: ${err.message}`,
+      };
+    }
+  }
   if (labelList.includes(BYPASS_LABEL)) {
     return { verdict: VERDICT.BYPASSED, payload: evidence, reason: 'bypass-label' };
   }
@@ -281,6 +300,9 @@ function usage() {
     'newest settled run decides. Every other case (wrong event, no',
     'resolvable base ref, an unreadable API read) fails open (exit 0).',
     '',
+    'On pull_request with PR_NUMBER set, the label is read from the API, so a',
+    're-run sees the PR\'s current labels (#6076); a failed read keeps the gate RED.',
+    '',
     'On merge_group the label is read back from the API: the queue ref must',
     'name a PR, the group must hold exactly one commit, the PR must carry the',
     'label, and whoever applied it must have write or admin permission.',
@@ -300,7 +322,15 @@ function usage() {
     '  PR_LABELS             comma-separated PR label names (pull_request events;',
     '                        the caller workflow must populate this from',
     '                        github.event.pull_request.labels.*.name); checked',
-    '                        for the literal "fix-next" bypass label',
+    '                        for the literal "fix-next" bypass label; the fallback',
+    '                        when PR_NUMBER is unset or malformed',
+    '  PR_NUMBER             PR number (pull_request events; from',
+    '                        github.event.pull_request.number); trimmed, then it',
+    '                        must match /^[1-9]\\d*$/. When valid, the label is',
+    '                        read from the API so a re-run sees the current',
+    '                        label; a failed read keeps the gate RED. A',
+    '                        malformed value (0, 07, -1, abc, empty) falls back',
+    '                        to PR_LABELS',
     '  MERGE_GROUP_HEAD_REF  merge-group queue branch',
     '                        (github.event.merge_group.head_ref; falls back to',
     '                        GITHUB_REF)',
@@ -437,8 +467,19 @@ async function main(argv = process.argv.slice(2)) {
     ghGet,
   });
 
+  // #6076: with a valid PR number, read the PR's current labels from the API.
+  const prNumber = (process.env.PR_NUMBER || '').trim();
+  const fetchPrLabels = /^[1-9]\d*$/.test(prNumber)
+    ? async () => {
+      const body = await ghGet(`/repos/${repo}/issues/${prNumber}/labels?per_page=100`);
+      return Array.isArray(body)
+        ? body.map((l) => l && l.name).filter((name) => typeof name === 'string')
+        : [];
+    }
+    : undefined;
+
   const result = await resolveNextHealth({
-    fetchLatestRun, eventName, baseRef, labels, evaluateQueueBypass: evaluateQueue,
+    fetchLatestRun, eventName, baseRef, labels, fetchPrLabels, evaluateQueueBypass: evaluateQueue,
   });
 
   writeOutput([`verdict=${result.verdict}`]);
@@ -450,7 +491,9 @@ async function main(argv = process.argv.slice(2)) {
       `::error::the base branch "${baseRef}"'s own last Tests run is red or still re-running after a failure: ${runUrl} (${result.reason}) — `
       + 'wait for a fix-forward merge, or if THIS pull request is the fix, ask a '
       + `maintainer with write access to apply the "${BYPASS_LABEL}" label and re-queue it `
-      + '(the queue run reads the label from the API; it must be the only PR in its merge group).\n',
+      + '(the queue run reads the label from the API; it must be the only PR in its merge group). '
+      + 'On a pull request the label is read from the API too, so after it is added the '
+      + 'fix-next-rerun workflow re-runs this check.\n',
     );
     return 1;
   }