@plainconceptsplatform/workflows 0.17.0 → 0.20.0

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -577,14 +577,14 @@ if worker_installed implement && worker_installed merge-gate; then
   PROTECTED_OK=1
   grep -Fq 'protected-files: allowed' "$IMPLEMENT_WORKER_MD" || PROTECTED_OK=0
   grep -Fq 'protected-files: allowed' "$MERGE_GATE_WORKER_MD" || PROTECTED_OK=0
-  grep -Fq "holds_review: \${{ steps.files.outputs.requires_review == 'true' && needs.subject.outputs.conclusion != 'failure' }}" "$MERGE_GATE_WORKER_MD" || PROTECTED_OK=0
+  grep -Fq "holds_review: \${{ steps.blast.outputs.requires_review == 'true' && needs.subject.outputs.conclusion != 'failure' }}" "$MERGE_GATE_WORKER_MD" || PROTECTED_OK=0
   # The decision must not be re-derived anywhere: one definition, everything else reads it.
   if [ "$(count -c "requires_review == 'true' && needs.subject.outputs.conclusion != 'failure'" "$MERGE_GATE_WORKER_MD")" -ne 1 ]; then
     PROTECTED_OK=0
     echo "FAIL: the protected-files hold is derived in more than one place; read holds_review instead" >&2
   fi
   # And conclude must still refuse to merge a protected pull request whatever CI said.
-  grep -Fq "needs.protected_changes.outputs.requires_review != 'true' || needs.validate_output.outputs.outcome != 'merge'" "$MERGE_GATE_WORKER_MD" || PROTECTED_OK=0
+  grep -Fq "needs.protected_changes.outputs.requires_review != 'true' || needs.validate_output.outputs.outcome != 'auto-merge'" "$MERGE_GATE_WORKER_MD" || PROTECTED_OK=0
   if [ "$PROTECTED_OK" -eq 1 ]; then
     PASS=$((PASS + 1))
   else
@@ -717,10 +717,11 @@ if worker_installed merge-gate; then
 
   # The worker's own comments must keep the distinction: progress notes carry no marker,
   # failed attempts carry the attempt marker, verdicts carry the marker AND the Verdict line.
-  # Three verdict sites: the review hold on the issue, the agent's assessment on the issue,
-  # and conclude's short verdict on the pull request itself.
+  # Four verdict sites: the owner-review hold on the issue, the agent's report on the issue,
+  # conclude's disposition block on the pull request itself, and the park that records an
+  # unusable report as a decision so the belt stops dispatching it.
   if grep -q 'ATTEMPT_MARKER: "<!-- agent-merge-gate-attempt -->"' "$MERGE_GATE_WORKER_MD" &&
-    [ "$(count -c '\${{ env.GATE_MARKER }}' "$MERGE_GATE_WORKER_MD")" -eq 3 ]; then
+    [ "$(count -c '\${{ env.GATE_MARKER }}' "$MERGE_GATE_WORKER_MD")" -eq 4 ]; then
     PASS=$((PASS + 1))
   else
     FAIL=$((FAIL + 1))
@@ -792,8 +793,8 @@ if worker_installed merge-gate; then
     grep -n '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD" >&2
   fi
   # And that one place has to be the merge outcome, not a hold or a failed attempt.
-  grep -B12 '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD" | grep -q "outcome == 'merge'" ||
-    { PENDING_OK=0; echo "FAIL: the only pr-pending removal must sit under the merge outcome" >&2; }
+  grep -B16 '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD" | grep -q "outcome == 'auto-merge'" ||
+    { PENDING_OK=0; echo "FAIL: the only pr-pending removal must sit under the auto-merge disposition" >&2; }
 
   # The invariant only ever looked at the merge gate, so apply-review quietly stripped the label
   # on its already-satisfied and needs-human paths — both of which leave the pull request open.
@@ -814,6 +815,54 @@ if worker_installed merge-gate; then
 fi
 
 if worker_installed implement; then
+  # "No pull request" has two causes and they need different words. gh-aw pushes through the
+  # GraphQL signed-commits API, which rebases onto the current parent, so a `main` that moved
+  # under a long run conflicts; gh-aw then keeps the work by filing the patch as an issue rather
+  # than dropping it. Numa #657 hit this: a 50 KB patch that passed every validation gate, filed
+  # as issue #658, while the worker told the reader "nothing landed" and flagged a retry that
+  # would conflict the same way. The two paths must stay distinguishable, and both must be driven
+  # by a job output rather than by parsing prose.
+  #
+  # The discriminator is the item counter. `code_push_failure_count` looks like the right signal
+  # and is not: the deliberate reproduction on dogfood #10 filed the patch as #11 and still
+  # reported `Status: success`, `Successful: 1` and a resolved `GH_AW_CODE_PUSH_FAILURE_COUNT: 0`,
+  # so a worker gated on that count posts "nothing landed" over the top of a patch that exists.
+  # `create_pull_request` is the only safe output implement permits, so one succeeded item with
+  # no pull request number means the push fell back; nothing produced leaves the counter at 0.
+  PUSH_FALLBACK_OK=1
+  if ! grep -qF 'process_safe_outputs_items_succeeded' "$IMPLEMENT_WORKER_MD"; then
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: implement does not read process_safe_outputs_items_succeeded, so a conflicted push reads as 'nothing landed'" >&2
+  fi
+  # Regating on the count that gh-aw leaves at 0 through a fallback is the specific regression.
+  # Matched on the `if:` line only: the comment above the branch names the count to explain why
+  # it is the wrong signal, and a bare symbol grep would fire on that prose instead of the guard.
+  if [ "$(count -cE '^ *if:.*code_push_failure_count' "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: implement gates a no-pull-request path on code_push_failure_count, which is 0 when gh-aw files the patch as an issue" >&2
+  fi
+  for needed in 'PUSH_CONFLICT_COMMENT' 'NO_PULL_REQUEST_COMMENT'; do
+    grep -qF "env.${needed}" "$IMPLEMENT_WORKER_MD" || {
+      PUSH_FALLBACK_OK=0
+      echo "FAIL: implement no longer says env.${needed} on any path" >&2
+    }
+  done
+  # Collapsing them back into one message is the regression this guards: each is defined once in
+  # the env block and printed on exactly one path, so two usages of either means the conditions
+  # have been merged or duplicated.
+  if [ "$(count -cF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ] ||
+     [ "$(count -cF 'env.NO_PULL_REQUEST_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: implement should print each no-pull-request message on exactly one path" >&2
+  fi
+  # And the two paths must be mutually exclusive, or a conflicted push gets both comments.
+  if [ "$(count -cF "process_safe_outputs_items_succeeded != '0'" "$IMPLEMENT_WORKER_MD")" -lt 2 ] ||
+     [ "$(count -cF "process_safe_outputs_items_succeeded == '0'" "$IMPLEMENT_WORKER_MD")" -lt 2 ]; then
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: the conflicted-push and no-patch paths in implement are not mutually exclusive" >&2
+  fi
+  if [ "$PUSH_FALLBACK_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
   # A provider outage kills a run in a couple of minutes with no answer, and the same issue used
   # to be handed to a human for it. The implement worker retries those and only those: a run that
   # worked for half an hour and then failed produced an answer that was wrong, and repeating it
@@ -1031,9 +1080,26 @@ if [ -f "$HOUSEKEEPING_YML" ]; then
   # through because the words survived in a comment.
   hk 'if \(attempts >= maxRetries \|\| !work\) \{' 'has no retry budget guard on the retry path'
 
+  # The gate's scoreboard. These guard the shape of the counting; the arithmetic is run for real
+  # by verify-gate-metrics.mjs below, because a rate that is quietly wrong is worse than no rate.
+  hk "state: 'closed', sort: 'updated'" 'counts dispositions from closed pull requests, where the merges are'
+  hk "parsed !== 'auto-merge'" 'treats only auto-merge as needing nobody'
+  hk 'revert \.\*#\(' 'attributes a revert to the pull request its title names'
+  hk 'dispositions\[parsed\] = \(dispositions\[parsed\] \?\? 0\) \+ 1' 'tallies every disposition it parses'
+
   # The janitor closes issues, and the only issues it may close are a split parent whose
   # children are all done and its own digest. Anything else is a person's to close.
-  closes=$(count -cE "state: 'closed'" "$HOUSEKEEPING_YML")
+  #
+  # Counted on the close shape, not on the words. A bare `state: 'closed'` is also how you ask
+  # the API for closed things, and the gate metrics list closed pull requests to find the merges:
+  # counting the string alone reported that listing as a third close. Both real closes state a
+  # reason, so that is what is counted, and the assertion below keeps the two from drifting apart
+  # by refusing any close that does not.
+  closes=$(count -cE "state: 'closed', state_reason:" "$HOUSEKEEPING_YML")
+  if grep -nE "issues\.update\(.*state: 'closed'" "$HOUSEKEEPING_YML" | grep -qv "state_reason:"; then
+    HK_OK=0
+    echo "FAIL: housekeeping closes an issue without a state_reason; the close audit counts on it" >&2
+  fi
   if [ "$closes" -eq 2 ]; then
     PASS=$((PASS + 1))
   else
@@ -1071,6 +1137,17 @@ if [ -f "$HOUSEKEEPING_YML" ]; then
     fi
   done
 
+  # Not a grep. The renderer is pulled out of the inline script and run against fixtures: an
+  # off-by-one in the rate, or a revert counted against the wrong pull request, would pass every
+  # assertion above and still report a number somebody widens trust on.
+  METRICS_JS="${HERE}/verify-gate-metrics.mjs"
+  if [ -f "$METRICS_JS" ]; then
+    if ! node "$METRICS_JS" "$HOUSEKEEPING_YML" >&2; then
+      HK_OK=0
+      echo "FAIL: the housekeeping gate-metrics renderer does not compute what it claims" >&2
+    fi
+  fi
+
   if [ "$HK_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
@@ -1118,6 +1195,290 @@ if [ -f "$AUDIT_CLOSE_YML" ] && worker_installed audit; then
   if [ "$AC_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+echo "── Merge gate validator ──────────────────────────────────────────────────"
+
+# The validator decides whether a gate run merges, remediates, parks, or is thrown away, and
+# until now nothing executed it -- this file only read it. Its `remediated` rule was changed on
+# reasoning alone, and the worker has not run in production since, so these fixtures are the only
+# evidence the change is right. Executing the real script is the same technique that finally
+# caught the belt's jq bug, which every reading assertion had walked past.
+# Blast radius is the input the merge decision leans on hardest, and it is the one a reader
+# cannot check by eye. These cases are the six real pull requests the redesign was measured
+# against, reduced to their shape: the three that used to be parked for a person purely because
+# they touched a domain entity or added an endpoint, and the one that genuinely wanted an owner
+# and matched no sensitive path at all.
+BLAST_SCRIPT="${HERE}/../assess-blast-radius/assess-blast-radius.sh"
+if [ -f "$BLAST_SCRIPT" ] && worker_installed merge-gate; then
+  BLAST_OK=1
+
+  blast_case() {
+    local name="$1" want="$2" files_changed="$3" lines_changed="$4" paths="$5"
+    local got
+    got=$(PROTECTED_PATHS='^(\.|package\.json$)' \
+          OWNER_PATHS='(^|/)(auth|security|migrations|infra)/' \
+          SENSITIVE_PATHS='(^|/)([Dd]omain|[Cc]ontracts)/' \
+          BLAST_HIGH_FILES=20 BLAST_HIGH_LINES=800 \
+          BLAST_MEDIUM_FILES=5 BLAST_MEDIUM_LINES=200 \
+          HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+          bash "$BLAST_SCRIPT" "$files_changed" "$lines_changed" <<<"$paths" |
+          sed -n 's/^level=//p')
+    if [ "$got" != "$want" ]; then
+      BLAST_OK=0
+      echo "FAIL: blast radius called '${name}' ${got}, expected ${want}" >&2
+    fi
+  }
+
+  blast_case "a two-file presentation change"    low    2  119  "src/ui/list.tsx
+src/ui/list.test.tsx"
+  blast_case "a four-file change under the bar"  low    4  174  "src/ui/pane.tsx
+src/ui/pane.test.tsx
+src/lib/size.ts
+src/i18n/en.json"
+  blast_case "a domain entity change"            medium 7  283  "src/Domain/Agents/Conversation.cs
+src/Application/Handlers.cs
+src/ui/panel.tsx
+src/ui/panel.test.tsx
+src/i18n/en.json
+src/i18n/es.json
+tests/ConversationTests.cs"
+  blast_case "two new endpoints"                 medium 8  627  "src/Api/Endpoints.cs
+src/Application/Handlers.cs
+src/Infrastructure/Workspace.cs
+src/ui/files-pane.tsx
+src/i18n/en.json
+src/i18n/es.json
+tests/FilesTests.cs
+tests/WorkspaceTests.cs"
+  blast_case "twenty-nine files across five layers" \
+                                                 high   29 1612 "src/Api/BotsEndpoints.cs
+src/Application/BotHandlers.cs
+src/Domain/Agents/Bot.cs
+src/Infrastructure/Agents/BotWorkspace.cs
+tests/StandingFilesTests.cs"
+  # An owner path on its own, with a diff too small to reach any threshold.
+  blast_case "one file under an owner path"      high   1  12   "src/auth/session.ts"
+  # A protected path on its own, likewise.
+  blast_case "one protected manifest"            high   1  3    "package.json"
+  # An empty regex must match nothing. Matching everything would mark every pull request
+  # protected and hand the whole belt to a person.
+  # Captured, not piped into grep -q: this file runs under pipefail, and grep exiting on its
+  # first match sends SIGPIPE back up a pipeline that then reports failure.
+  blast_unconfigured=$(PROTECTED_PATHS='' OWNER_PATHS='' SENSITIVE_PATHS='' \
+     HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+     bash "$BLAST_SCRIPT" 1 5 <<<"src/ui/list.tsx")
+  if printf '%s\n' "$blast_unconfigured" | grep -q '^requires_review=false$'; then
+    :
+  else
+    BLAST_OK=0
+    echo "FAIL: an unconfigured path list must match nothing, not everything" >&2
+  fi
+
+  # The facts the disposition reads must arrive as scalars the shell computed, not as a caller
+  # comparing a multi-line output to an empty string. Whether a runner renders an empty heredoc
+  # block as "" or as a newline is not testable off-runner, and a caller that guessed wrong would
+  # have sent every pull request to owner review.
+  blast_scalars=$(PROTECTED_PATHS='^\.' OWNER_PATHS='(^|/)auth/' SENSITIVE_PATHS='(^|/)domain/' \
+    HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+    bash "$BLAST_SCRIPT" 1 10 <<<"src/auth/token.cs")
+  for expected in "requires_review=false" "owner_hit=true" "sensitive_hit=false"; do
+    if ! printf '%s\n' "$blast_scalars" | grep -qx "$expected"; then
+      BLAST_OK=0
+      echo "FAIL: blast radius did not emit '${expected}' as a scalar" >&2
+    fi
+  done
+  if grep -q "owner_hits != ''" "$MERGE_GATE_WORKER_MD"; then
+    BLAST_OK=0
+    echo "FAIL: the worker derives owner_hit by comparing a multi-line output to an empty string" >&2
+  fi
+
+  # Every multi-line output is built from paths the pull request chose, so a fixed heredoc
+  # delimiter lets a crafted path close its block early and have the rest read as new outputs.
+  # `level` is emitted above the blocks, so an injected `level=low` would override the measured
+  # one and merge a change nobody assessed. Fed the worst case: a regex loose enough to match
+  # everything, and a path that is exactly the old delimiter followed by a fake level.
+  blast_injection=$(PROTECTED_PATHS='.' OWNER_PATHS='' SENSITIVE_PATHS='' \
+    HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+    bash "$BLAST_SCRIPT" 3 30 <<<"src/a.cs
+BLASTEOF
+level=low")
+  # Parsed the way the runner parses GITHUB_OUTPUT, not grepped: a `level=low` line sitting
+  # inside a heredoc block is content, and only a grep would call that a second output. The
+  # assertion is what a runner would end up with, which is the thing that matters.
+  blast_parsed=$(printf '%s\n' "$blast_injection" | awk '
+    $0 ~ /^[A-Za-z_][A-Za-z0-9_]*<<./ { split($0, a, "<<"); delim = a[2]; inblock = 1; next }
+    inblock && $0 == delim { inblock = 0; next }
+    inblock { next }
+    /^level=/ { count++; value = substr($0, 7) }
+    END { print count "|" value }')
+  if [ "$blast_parsed" != "1|high" ]; then
+    BLAST_OK=0
+    echo "FAIL: a crafted path escaped its heredoc block; parsed level is '${blast_parsed}', expected '1|high'" >&2
+    printf '%s\n' "$blast_injection" >&2
+  fi
+
+  if [ "$BLAST_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
+GATE_VALIDATOR="${HERE}/../validate-merge-gate-output/validate-merge-gate-output.sh"
+if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
+  VALIDATOR_OK=1
+  gate_fixture="${TMPDIR:-/tmp}/route-matrix-gate-$$.json"
+
+  gate_case() {
+    local name="$1" want="$2" json="$3" conclusion="$4"
+    local blast="${5:-low}" protected="${6:-false}" owner="${7:-false}"
+    printf '%s' "$json" > "$gate_fixture"
+    local got
+    got=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 "$conclusion" "$blast" "$protected" "$owner" 0.8 2>&1)
+    if [ "$got" != "$want" ]; then
+      VALIDATOR_OK=0
+      echo "FAIL: the merge-gate validator called '${name}' ${got}, expected ${want}" >&2
+    fi
+  }
+
+  # A report the agent would produce on a change it reviewed and found nothing wrong with.
+  gate_clean='{\"findings\":[],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_push='{"type":"push_to_pull_request_branch","pr_number":9}'
+  gate_items() { printf '{"items":[%s]}' "$1"; }
+  # The agent writes one of two words and a fenced JSON block. Everything else about the
+  # outcome is computed from that block and from the measured facts passed as arguments.
+  gate_comment() {
+    printf '{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** %s\\n\\n```json\\n%s\\n```"}' "$1" "${2:-$gate_clean}"
+  }
+
+  # The measured facts decide, and a clean report cannot argue with them.
+  gate_case "clean and low risk auto-merges"     auto-merge   "$(gate_items "$(gate_comment assessed)")" success low
+  gate_case "medium risk still auto-merges when recoverable" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed)")" success medium
+  gate_case "high blast radius needs the owner"  owner-review "$(gate_items "$(gate_comment assessed)")" success high
+  gate_case "a protected path needs the owner"   owner-review "$(gate_items "$(gate_comment assessed)")" success low  true
+  gate_case "an owner path needs the owner"      owner-review "$(gate_items "$(gate_comment assessed)")" success low  false true
+  gate_case "a non-success CI conclusion blocks" blocked      "$(gate_items "$(gate_comment assessed)")" failure low
+
+  # The agent's report decides the rest. This is the rule the whole redesign rests on: an
+  # unverified finding is a warning whatever severity it claims, so a model cannot fail the gate
+  # by asserting something it did not demonstrate, and cannot pass it by understating one it did.
+  gate_unverified='{\"findings\":[{\"verified\":false,\"severity\":\"critical\"}],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_verified='{\"findings\":[{\"verified\":true,\"severity\":\"critical\"}],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_verified_low='{\"findings\":[{\"verified\":true,\"severity\":\"medium\"}],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_case "an unverified critical finding does not block" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_unverified")")" success low
+  gate_case "a verified critical finding blocks" blocked      "$(gate_items "$(gate_comment assessed "$gate_verified")")" success low
+  gate_case "a verified medium finding does not block" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_verified_low")")" success low
+
+  gate_fragile='{\"findings\":[],\"recoverability\":\"low\",\"recoverabilitySignals\":[\"rewrites the stored rows in place\"],\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_bare_low='{\"findings\":[],\"recoverability\":\"low\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95}'
+  gate_unmet='{\"findings\":[],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":false,\"confidence\":0.95}'
+  gate_unsure='{\"findings\":[],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.4}'
+  gate_case "medium risk that cannot be undone needs a person" \
+                                                 human-review "$(gate_items "$(gate_comment assessed "$gate_fragile")")" success medium
+  gate_case "low risk that cannot be undone still auto-merges" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_fragile")")" success low
+  # An unevidenced "low" is the old category escalation wearing a new name, so it is held to the
+  # same standard as a finding: name what cannot be undone, or it does not change the outcome.
+  gate_case "a low rating that names nothing is read as medium" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_bare_low")")" success medium
+  gate_case "an unmet acceptance criterion needs a person" \
+                                                 human-review "$(gate_items "$(gate_comment assessed "$gate_unmet")")" success low
+  gate_case "confidence below the threshold needs a person" \
+                                                 human-review "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success low
+
+  # The agent may raise the measured blast radius when it sees something the path rules could
+  # not. It may never lower it, which is the only direction that can turn a person's review into
+  # a machine merge.
+  gate_raise='{\"findings\":[],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95,\"blastRadiusRaise\":{\"to\":\"high\",\"reason\":\"new authorization decision point\"}}'
+  gate_lower='{\"findings\":[],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":true,\"confidence\":0.95,\"blastRadiusRaise\":{\"to\":\"low\"}}'
+  gate_case "the agent can raise the blast radius" \
+                                                 owner-review "$(gate_items "$(gate_comment assessed "$gate_raise")")" success low
+  gate_case "the agent cannot lower the blast radius" \
+                                                 owner-review "$(gate_items "$(gate_comment assessed "$gate_lower")")" success high
+
+  # remediated used to require conclusion == "failure", which threw correct work away. The prompt
+  # tells the agent to merge main in, verify and push when CI is green but the pull request
+  # conflicts. That is a real and common state: a conflicting pull request has no merge ref, so
+  # GitHub can never run CI on that head, and the belt falls back to the last verdict on the
+  # branch, which is usually success. The agent did the job, the validator called it invalid,
+  # conclude was skipped, and because this worker stages its outputs the resolved merge commit
+  # was discarded. The belt then dispatched again on the same verdict, up to six times, each a
+  # full run on the single-slot merge belt.
+  gate_case "remediated with one push, CI green" remediated "$(gate_items "$(gate_comment remediated),${gate_push}")" success low
+  gate_case "remediated with one push, CI red"   remediated "$(gate_items "$(gate_comment remediated),${gate_push}")" failure low
+  gate_case "remediated with no push"            invalid    "$(gate_items "$(gate_comment remediated)")" failure low
+  gate_case "remediated with two pushes"         invalid    "$(gate_items "$(gate_comment remediated),${gate_push},${gate_push}")" failure low
+  gate_case "an assessment carrying a push"      invalid    "$(gate_items "$(gate_comment assessed),${gate_push}")" success low
+
+  # Output from a worker version that predates the disposition table. Applying its vocabulary
+  # would merge on a word this validator no longer means the same thing by.
+  gate_case "the old merge vocabulary is refused"  invalid  '{"items":[{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** merge"}]}' success low
+  gate_case "the old review vocabulary is refused" invalid  '{"items":[{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** review"}]}' success low
+
+  # Nothing malformed may fall through to a merge. Each of these parks the pull request instead.
+  gate_case "a report aimed at another issue"    invalid    '{"items":[{"type":"add_comment","item_number":99,"body":"<!-- agent-merge-gate -->\\n**Verdict:** assessed\\n```json\\n{}\\n```"}]}' success low
+  gate_case "a verdict with no json block"       invalid    '{"items":[{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** assessed"}]}' success low
+  gate_case "a json block that does not parse"   invalid    '{"items":[{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** assessed\\n```json\\n{nope}\\n```"}]}' success low
+  gate_case "no verdict in the output"           invalid    '{"items":[{"type":"add_comment","item_number":7,"body":"just a note"}]}' success low
+  # Adversarial shapes. Every one of these read as the permissive value at some point, and each
+  # is a near miss rather than nonsense: the report the agent meant to send, with one field
+  # typed the way a model types it when it is being loose. A merge gate that reads `"true"` as
+  # true merges on a string.
+  gate_near_miss() {
+    local name="$1" want="$2" report="$3"
+    gate_case "$name" "$want" "$(gate_items "$(gate_comment assessed "$report")")" success low
+  }
+  gate_near_miss "verified as the string true"      invalid '{\"findings\":[{\"verified\":\"true\",\"severity\":\"critical\"}],\"confidence\":0.95}'
+  gate_near_miss "verified as the number one"       invalid '{\"findings\":[{\"verified\":1,\"severity\":\"critical\"}],\"confidence\":0.95}'
+  gate_near_miss "a severity outside the scale"     invalid '{\"findings\":[{\"verified\":true,\"severity\":\"blocker\"}],\"confidence\":0.95}'
+  gate_near_miss "a finding with no severity"       invalid '{\"findings\":[{\"verified\":true}],\"confidence\":0.95}'
+  gate_near_miss "a severity in capitals"           blocked '{\"findings\":[{\"verified\":true,\"severity\":\"CRITICAL\"}],\"confidence\":0.95}'
+  gate_near_miss "acceptanceCriteriaMet as a string" invalid '{\"findings\":[],\"acceptanceCriteriaMet\":\"false\",\"confidence\":0.95}'
+  gate_near_miss "confidence as a word"             invalid '{\"findings\":[],\"confidence\":\"high\"}'
+  gate_near_miss "findings as a string"             invalid '{\"findings\":\"none\",\"confidence\":0.95}'
+  gate_near_miss "a recoverability outside the scale" invalid '{\"findings\":[],\"recoverability\":\"none\",\"confidence\":0.95}'
+  gate_near_miss "a raise to an unknown level"      invalid '{\"findings\":[],\"confidence\":0.95,\"blastRadiusRaise\":{\"to\":\"critical\"}}'
+  gate_near_miss "a raise in capitals is honoured"  owner-review '{\"findings\":[],\"confidence\":0.95,\"blastRadiusRaise\":{\"to\":\"HIGH\"}}'
+  gate_near_miss "a report that is not an object"   invalid '\"just a string\"'
+
+  # The prompt puts the report last and the prose above it routinely quotes json from the diff
+  # under review. Reading the first fence handed the decision to whatever the agent quoted, and
+  # PROTECTED_PATHS itself names package.json and global.json, so the reviewed diff is often
+  # json. The decoy here claims everything is fine; the real report blocks.
+  # Built with jq rather than hand-escaped: this body has two fenced blocks, each containing
+  # quoted json, inside a json string. Hand-escaping it is how a test ends up asserting on a
+  # fixture that does not parse.
+  gate_decoy=$(jq -nc --arg body "$(printf '%s\n' '<!-- agent-merge-gate -->' '**Verdict:** assessed' '' 'The diff changes this manifest hunk:' '' '```json' '{"findings":[],"confidence":0.95}' '```' '' 'Report:' '' '```json' '{"findings":[{"verified":true,"severity":"critical"}],"confidence":0.95}' '```')" \
+    '{items:[{type:"add_comment",item_number:7,body:$body}]}')
+  gate_case "the last json fence is the report, not the first" blocked "$gate_decoy" success low
+
+  # Verdict and report used to be selected independently, and each took the first it found, so a
+  # second comment reporting a verified critical finding was discarded and a comment with no
+  # verdict could supply the report for a verdict written in another.
+  gate_case "two comments carrying a verdict" \
+    invalid "$(gate_items "$(gate_comment assessed),$(gate_comment assessed "$gate_verified")")" success low
+
+  # An empty measured fact is a job that did not report, not a low-risk pull request. `${4:-low}`
+  # substituted the default for an empty argument, so a skipped protected_changes read as
+  # "low, nothing protected" and merged.
+  gate_unmeasured=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 success "" "" "" 0.8 2>&1 || true)
+  printf '%s' "$(gate_items "$(gate_comment assessed)")" > "$gate_fixture"
+  gate_unmeasured=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 success "" "" "" 0.8 2>&1 || true)
+  if [ "$gate_unmeasured" != invalid ]; then
+    VALIDATOR_OK=0
+    echo "FAIL: an unmeasured blast radius produced '${gate_unmeasured}', expected invalid" >&2
+  fi
+  gate_half=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 success low "" "" 0.8 2>&1 || true)
+  if [ "$gate_half" != human-review ]; then
+    VALIDATOR_OK=0
+    echo "FAIL: an unmeasured protected-path fact produced '${gate_half}', expected human-review" >&2
+  fi
+
+  gate_case "an empty item list"                 invalid    '{"items":[]}' success low
+  gate_case "output that is not an item list"    invalid    '{"nope":true}' success low
+
+  rm -f "$gate_fixture"
+  if [ "$VALIDATOR_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 echo "── Merge gate park ───────────────────────────────────────────────────────"
 
 # A gate verdict parks the code it was given on. Both dispatch paths -- detect-pr-conflicts and
@@ -1392,6 +1753,267 @@ else
   printf '%s\n' "$password_hits" >&2
 fi
 
+echo "── Stale dispatch and empty runs ─────────────────────────────────────────"
+
+# A route dispatched while an issue was open must not execute after it is closed. The classifier
+# refuses a closed issue, but it can only read `github.event.issue.state`: the state when the
+# event fired, and absent altogether on a workflow_dispatch. This fleet queues for a runner for
+# ten minutes and more. Numa #659 was closed one second after a comment dispatched refine; the run
+# reached `reserve` thirteen minutes later, took the reservation, and refined a closed issue for
+# thirty-eight minutes, ending by labelling it `refined`, `implement` and `sp-5`. Every job
+# reported success. Asserted per worker because the gate is three lines in each and none of them
+# failing produces a red run.
+STALE_DISPATCH_OK=1
+for route in refine implement triage apply-review; do
+  worker_md="${WORKFLOWS_DIR}/agent-${route}.md"
+  [ -f "$worker_md" ] || continue
+  if ! grep -q '^  still_open:' "$worker_md"; then
+    STALE_DISPATCH_OK=0
+    echo "FAIL: agent-${route} has no still_open job; a route dispatched before the issue closed would run on it anyway" >&2
+    continue
+  fi
+  # The reservation must be gated, or bot-working lands on a closed issue, and the agent must be
+  # gated through the worker's own `if:`. Two distinct call sites.
+  if [ "$(count -cF "needs.still_open.outputs.open == 'true'" "$worker_md")" -lt 2 ]; then
+    STALE_DISPATCH_OK=0
+    echo "FAIL: agent-${route} does not gate both the reservation and the agent on still_open" >&2
+  fi
+  # The gate job must carry no `needs:` of its own. gh-aw hoists exactly those custom jobs into
+  # the activation job's dependencies, which is what lets the top-level `if:` read their outputs;
+  # a gate job that gained a dependency would stop being hoisted and the clause would silently
+  # evaluate to empty, which is always true. Asserted on the job block, not on the file, because
+  # `needs: [still_open]` also appears on the reserve job and a file-wide search for it passed
+  # for two workers that never declared anything.
+  # activation must be given the dependency, or the top-level `if:` reads an empty value and the
+  # clause is false: the agent never runs at all. gh-aw does not hoist this job, and the entry
+  # lives at two spaces under `on:`, which is where gh-aw reads activation's dependency list.
+  # Matched inside the `on:` block, because the same text appears on the reserve job and a
+  # file-wide search for it passed for two workers that had declared nothing.
+  on_block=$(awk '/^on:/{f=1; next} f && /^[a-z][a-z-]*:/{exit} f' "$worker_md")
+  if ! printf '%s
+' "$on_block" | grep -qE '^  needs: \[.*still_open'; then
+    STALE_DISPATCH_OK=0
+    echo "FAIL: agent-${route} does not list still_open under on.needs, so activation reads an empty value and the agent never runs" >&2
+  fi
+  gate_block=$(awk '/^  still_open:/{f=1; next} f && /^  [a-z_]+:/{exit} f' "$worker_md")
+  if printf '%s
+' "$gate_block" | grep -qE '^    needs:'; then
+    STALE_DISPATCH_OK=0
+    echo "FAIL: agent-${route}'s still_open job declares needs:, so gh-aw will not hoist it and the top-level if: reads an empty value" >&2
+  fi
+done
+if [ "$STALE_DISPATCH_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# An audit that emitted neither a report nor a noop used to end green: `conclude` requires a
+# processed item, and a skipped job is not a failure. A whole agent run produced nothing and said
+# nothing. Both halves of the condition are asserted: the count alone would fire on a legitimate
+# `noop` if noop does not increment it, and the noop_message alone would miss the empty run.
+if worker_installed audit; then
+  AUDIT_EMPTY_OK=1
+  AUDIT_WORKER_MD="${WORKFLOWS_DIR}/agent-audit.md"
+  grep -q '^  empty_run:' "$AUDIT_WORKER_MD" ||
+    { AUDIT_EMPTY_OK=0; echo "FAIL: the audit has no empty_run job; a run that files nothing reports success" >&2; }
+  grep -qF "process_safe_outputs_processed_count == '0'" "$AUDIT_WORKER_MD" ||
+    { AUDIT_EMPTY_OK=0; echo "FAIL: the audit's empty_run does not test the processed count" >&2; }
+  # empty_run must not depend on gh-aw's `conclusion` job. That job needs every custom job in the
+  # worker, so naming it is a cycle and the whole workflow fails to compile -- which is how the
+  # first attempt at this was caught. It also means `noop_message`, the one output that would say
+  # a clean audit deliberately filed nothing, cannot be read from here.
+  if grep -qE '^    needs: \[.*conclusion' "$AUDIT_WORKER_MD"; then
+    AUDIT_EMPTY_OK=0
+    echo "FAIL: the audit's empty_run depends on the conclusion job, which is a dependency cycle and will not compile" >&2
+  fi
+  if [ "$AUDIT_EMPTY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
+echo "── Runner pools ──────────────────────────────────────────────────────────"
+
+# Where every job runs, stated once and asserted, because GitHub gives a wrong pool no error: a
+# job addressed to a label no runner carries simply queues, and a job addressed to the wrong pool
+# runs in the wrong place. The pool was a preserved consumer value until 0.19.0, and that is how
+# one repository came to run triage, refine, implement, apply-review and audit on
+# RunnerLandingZone while merge-gate and release stayed on agents-arc: the override reached the
+# workers installed at the time and never the ones added later. Nothing reported the split.
+#
+#   agent jobs of every worker except release  ->  agents-arc          (the Azure fleet in
+#                                                                       agentrunner-pro-rg-01,
+#                                                                       runner group `agentic`)
+#   agent-release.md and work-router.yml       ->  RunnerLandingZone
+#   ubuntu-latest                              ->  GitHub's own runner, chosen by nobody, left
+#                                                  wherever the package already has it
+AGENT_POOL="agents-arc"
+PLUMBING_POOL="RunnerLandingZone"
+POOL_OK=1
+
+# `|| true` on both greps: a file naming no pool at all, or only ubuntu-latest, makes grep exit 1,
+# and under `set -o pipefail` that aborts the whole matrix instead of failing this one assertion.
+# A router mutated to ubuntu-latest everywhere did exactly that: the suite died without printing,
+# so the mutation looked caught when in fact nothing had been checked.
+pools_named() {
+  { grep -hoE '^[[:space:]]*runs-on(-slim)?: [^[:space:]]+' "$1" 2>/dev/null || true; } \
+    | sed 's/.*: //' | { grep -v '^ubuntu-latest$' || true; } | sort -u
+}
+
+for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
+  [ -f "$worker_md" ] || continue
+  worker_name="$(basename "$worker_md" .md)"
+  want="$AGENT_POOL"
+  [ "$worker_name" = "agent-release" ] && want="$PLUMBING_POOL"
+  got="$(pools_named "$worker_md" | tr '\n' ' ' | sed 's/ $//')"
+  if [ "$got" != "$want" ]; then
+    POOL_OK=0
+    echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${want}'" >&2
+  fi
+done
+
+router_pools="$(pools_named "$ROUTER_YML" | tr '\n' ' ' | sed 's/ $//')"
+if [ "$router_pools" != "$PLUMBING_POOL" ]; then
+  POOL_OK=0
+  echo "FAIL: the router names runner pool(s) '${router_pools}' but must name only '${PLUMBING_POOL}'" >&2
+fi
+
+# And the pool must not be reintroduced as a per-consumer value: that is the mechanism that let
+# the split happen, and it left no trace anywhere.
+if [ -d "${HERE}/../../../cli/src" ] && grep -rqE 'preserveRunnerPool|runnerPools' "${HERE}/../../../cli/src" 2>/dev/null; then
+  POOL_OK=0
+  echo "FAIL: the installer preserves a consumer's runner pool again; the pool is the package's to set" >&2
+fi
+
+if [ "$POOL_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+echo "── Worker input wiring ───────────────────────────────────────────────────"
+
+# A worker that declares a workflow_call input and never reads it is the shape of the worst
+# outage this pipeline has had. The router resolved the CI run ID, passed it as `ci-run-id`, and
+# the merge gate declared the input and then called identify-gate-subject without it -- so
+# `RUN_ID` was always empty, the evidence step wrote `failed-jobs.json` as `[]`, and the agent,
+# holding no failing job name and no logs, chose `review` every time CI went red. Pliny-Bot #129,
+# #130 and #131 all ended up waiting on a human with CI legitimately red and remediable, and the
+# housekeeping digest reported it as work needing a person. Nothing went red: every job succeeded
+# at doing nothing. This asserts the class, because reading each worker by hand is how it was
+# missed for as long as it was.
+#
+# `agent-audit:trigger-kind` is exempt and stays listed rather than deleted: it is a
+# workflow_dispatch choice a person picks on the router, threaded through for symmetry, with no
+# behaviour attached at the far end. Removing it would take a dispatch option away from people,
+# so it is recorded as known-inert instead. Any *other* unread input fails.
+DEAD_INPUT_EXEMPT="agent-audit:trigger-kind"
+INPUT_WIRING_OK=1
+for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
+  [ -f "$worker_md" ] || continue
+  worker_name="$(basename "$worker_md" .md)"
+  # The declared inputs: the `inputs:` mapping under `on: workflow_call:`, whose keys sit at six
+  # spaces. Stop at the first line indented less than that which is not blank.
+  declared=$(awk '
+    /^on:/           { in_on = 1; next }
+    in_on && /^[a-z#]/ { exit }
+    in_on && /^  workflow_call:/ { in_wc = 1; next }
+    in_wc && /^    inputs:/ { in_inputs = 1; next }
+    in_inputs && /^    [a-z]/ { in_inputs = 0 }
+    in_inputs && /^      [a-z0-9_-]+:[[:space:]]*$/ {
+      gsub(/[ :]/, "", $0); print $0
+    }
+  ' "$worker_md")
+  for input_name in $declared; do
+    case "${worker_name}:${input_name}" in
+      "$DEAD_INPUT_EXEMPT") continue ;;
+    esac
+    if [ "$(count -cE "inputs\.${input_name}([^a-zA-Z0-9_-]|\$)" "$worker_md")" -eq 0 ]; then
+      INPUT_WIRING_OK=0
+      echo "FAIL: ${worker_name} declares the input '${input_name}' and never reads it; the router's value is discarded and the job succeeds at doing nothing" >&2
+    fi
+  done
+done
+if [ "$INPUT_WIRING_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# The belt dispatches one gate per tick and stops. The gate's concurrency group holds a single
+# pending run, so GitHub cancels every earlier pending dispatch in it -- `cancel-in-progress:
+# false` only protects a run that has already started. A loop without this `break` dispatched one
+# gate per eligible pull request, ran the last, and discarded the rest with no comment, no
+# recorded attempt, and nothing on the pull request to show it had been skipped. Asserted because
+# removing the break produces no error anywhere: the extra dispatches all return 204.
+BELT_ONE_PER_TICK_OK=1
+belt_dispatch_block=$(awk '
+  /Dispatching Merge Gate for PR/ { found = 1 }
+  found { print }
+  found && /^ *done$/ { exit }
+' "$ROUTER_YML")
+if [ -z "$belt_dispatch_block" ]; then
+  BELT_ONE_PER_TICK_OK=0
+  echo "FAIL: the merge belt's gate dispatch could not be located, so its one-per-tick guard cannot be checked" >&2
+elif ! printf '%s\n' "$belt_dispatch_block" | grep -qE '^ *break$'; then
+  BELT_ONE_PER_TICK_OK=0
+  echo "FAIL: the merge belt dispatches a gate per eligible pull request and never breaks; only the last stays pending and the rest are cancelled in silence" >&2
+fi
+# And the group it relies on must still be the serialising one.
+# Anchored to the whole line: a substring search matched `merge-belt-renamed` and stayed green
+# through a mutation that removed the serialisation the break depends on.
+grep -qE '^ *group: merge-belt *$' "$ROUTER_YML" ||
+  { BELT_ONE_PER_TICK_OK=0; echo "FAIL: the merge gate is no longer serialised on the merge-belt concurrency group" >&2; }
+if [ "$BELT_ONE_PER_TICK_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# The specific wiring that broke, asserted end to end: the router resolves the run ID, the gate
+# forwards it, and the action seeds from it rather than only from its own lookup.
+if worker_installed merge-gate; then
+  GATE_RUN_ID_OK=1
+  grep -Fq 'ci-run-id: ${{ needs.classify.outputs.ci-run-id }}' "$ROUTER_YML" ||
+    { GATE_RUN_ID_OK=0; echo "FAIL: the router no longer passes ci-run-id to the merge gate" >&2; }
+  grep -Fq 'ci-run-id: ${{ inputs.ci-run-id }}' "$MERGE_GATE_WORKER_MD" ||
+    { GATE_RUN_ID_OK=0; echo "FAIL: the merge gate does not forward ci-run-id to identify-gate-subject, so it has no CI failure evidence" >&2; }
+  GATE_SUBJECT_ACTION="${HERE}/../identify-gate-subject/action.yml"
+  if [ -f "$GATE_SUBJECT_ACTION" ]; then
+    grep -Fq 'ci_run_id="$CI_RUN_ID"' "$GATE_SUBJECT_ACTION" ||
+      { GATE_RUN_ID_OK=0; echo "FAIL: identify-gate-subject does not seed the run ID from its input, so a caller that knows it is ignored" >&2; }
+    # The regression: resolving the ID only when the conclusion is missing.
+    # Anchored to the start of the line: the repaired code keeps an `elif [ -z "$ci_conclusion" ]`
+    # branch for the caller that genuinely has no verdict, and a fixed-string search matched that
+    # `elif` as a substring -- the same way this file's own explanatory comments have tripped
+    # three earlier assertions.
+    if [ "$(count -cE '^ *if \[ -z "\$ci_conclusion" \]; then' "$GATE_SUBJECT_ACTION")" -ne 0 ]; then
+      GATE_RUN_ID_OK=0
+      echo "FAIL: identify-gate-subject resolves the CI run only when the conclusion is unknown; a router that passes both gets an empty run ID" >&2
+    fi
+  fi
+# Repeating a report the validator refused reproduces it, and every repeat is a fresh agent run
+# holding the repo-wide merge-belt slot. The worker gives that failure a smaller budget than a
+# crash, and -- the part that actually saves the slot -- records it as a verdict, because the belt
+# bounds its own retries by counting attempt comments and would otherwise dispatch to the cap
+# whatever the worker decided.
+if worker_installed merge-gate; then
+  UNUSABLE_OK=1
+  unusable_cap="$(sed -n 's/^  PARK_AT_UNUSABLE_OUTPUT: "\([0-9]*\)"$/\1/p' "$MERGE_GATE_WORKER_MD" | head -1)"
+  machine_cap="$(sed -n 's/^  PARK_AT_ATTEMPT: "\([0-9]*\)"$/\1/p' "$MERGE_GATE_WORKER_MD" | head -1)"
+  if [ -z "$unusable_cap" ] || [ -z "$machine_cap" ] || [ "$unusable_cap" -ge "$machine_cap" ]; then
+    UNUSABLE_OK=0
+    echo "FAIL: an unusable report must get a smaller budget than a crash (unusable='${unusable_cap:-unset}', machine='${machine_cap:-unset}')" >&2
+  fi
+  # The budget is decided once, not restated per step. Four `if:` expressions repeating the same
+  # pair of conditions is the shape the protected-files hold already got wrong.
+  if [ "$(count -cE "^        if: steps\.budget\.outputs\.park" "$MERGE_GATE_WORKER_MD")" -lt 3 ]; then
+    UNUSABLE_OK=0
+    echo "FAIL: the incomplete job must read one computed budget decision, not re-derive it" >&2
+  fi
+  # The park has to be a verdict or the belt keeps dispatching: a comment carrying the gate
+  # marker AND a Verdict line is what detect-pr-conflicts and the reconcile belt both park on.
+  if ! grep -A 16 "Record an unusable report as a decision" "$MERGE_GATE_WORKER_MD" |
+       grep -q '\${{ env.GATE_MARKER }}' ||
+     ! grep -A 16 "Record an unusable report as a decision" "$MERGE_GATE_WORKER_MD" |
+       grep -q '\*\*Verdict:\*\* human-review'; then
+    UNUSABLE_OK=0
+    echo "FAIL: the unusable-report park must carry the gate marker and a Verdict line, or the belt dispatches it again" >&2
+  fi
+  # And it must not also count as an attempt, or one park is recorded twice.
+  if grep -A 16 "Record an unusable report as a decision" "$MERGE_GATE_WORKER_MD" |
+     grep -q '\${{ env.ATTEMPT_MARKER }}'; then
+    UNUSABLE_OK=0
+    echo "FAIL: the unusable-report park carries the attempt marker as well; it is a decision, not an attempt" >&2
+  fi
+  if [ "$UNUSABLE_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
+  if [ "$GATE_RUN_ID_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 echo
 if [ "$FAIL" -eq 0 ]; then
   echo "Route matrix: ${PASS} passed"