@plainconceptsplatform/workflows 1.6.0 → 1.6.10

package/loops/actions/decide-agent-retry/action.yml

@@ -25,6 +25,9 @@ outputs:
   minutes:
     description: How long the agent job ran, or -1 when that could not be read.
     value: ${{ steps.decide.outputs.minutes }}
+  cause:
+    description: 'Why a retry was chosen: short-run, runner-shutdown or cut-off. "none" when there is none.'
+    value: ${{ steps.decide.outputs.cause }}
 runs:
   using: composite
   steps:
@@ -33,6 +36,13 @@ runs:
     # repeating it buys the same wrong answer half an hour later. Duration is what separates them,
     # and it needs no model and no log parsing to read.
     #
+    # Except when the long run was killed rather than wrong. The VM was deleted under a forty
+    # minute implement (Pliny-Bot #699), and an AI gateway that answered nothing ended another
+    # run one turn after it began (#693's first attempt): neither is a verdict on the work, and
+    # both waited six hours for the janitor. classify-failure.sh reads those two from the job's
+    # annotations and from the line above the sandbox teardown, and they are repeated whatever
+    # the run lasted, within the same attempt budget.
+    #
     # Written once here because the rule was in the implement worker alone, and refine, triage and
     # apply-review parked instead -- an Odyssey refine died in three minutes on
     # `Model 'glm-5-2' not found`, a gateway fault that clears in seconds, and waited on the
@@ -44,15 +54,16 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
         REPO: ${{ github.repository }}
         RUN_ID: ${{ github.run_id }}
+        ACTION_PATH: ${{ github.action_path }}
         ATTEMPTS: ${{ inputs.attempts-so-far }}
         PARK_AT: ${{ inputs.park-at }}
         UNDER_MINUTES: ${{ inputs.under-minutes }}
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -60,13 +71,30 @@ runs:
         attempts="${ATTEMPTS:-0}"
         [ -n "$attempts" ] || attempts=0
         retry=false
+        cause=none
         # An unknown duration is treated as a long run: never retry on a guess.
         if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$attempts" -lt "$PARK_AT" ]; then
           retry=true
+          cause=short-run
+        fi
+        # A long run is repeated only when it was killed, not when it was wrong. The reads are best
+        # effort: a log or an annotation list that cannot be fetched leaves the run parked, exactly
+        # as before this check existed.
+        if [ "$retry" != true ] && [ "$attempts" -lt "$PARK_AT" ] && [ -n "${job_id:-}" ]; then
+          work="$(mktemp -d)"
+          gh api "repos/$REPO/check-runs/$job_id/annotations" --paginate --jq '.[].message' >"$work/annotations" 2>/dev/null || true
+          gh api "repos/$REPO/actions/jobs/$job_id/logs" >"$work/log" 2>/dev/null || true
+          kind="$(bash "$ACTION_PATH/classify-failure.sh" "$work/log" "$work/annotations" || echo none)"
+          if [ "$kind" != none ]; then
+            retry=true
+            cause="$kind"
+          fi
+          rm -rf "$work"
         fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"
           echo "minutes=$minutes"
+          echo "cause=$cause"
         } >> "$GITHUB_OUTPUT"
-        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}"
+        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}; cause=${cause}"

package/loops/actions/decide-agent-retry/classify-failure.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/decide-agent-retry/classify-failure.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Say why an agent job died, when the reason is one that repeating the run fixes.
+#
+# Duration alone could not tell the difference. A run that dies in three minutes produced nothing;
+# a run that works for forty minutes and is then killed by its machine produced nothing either, and
+# was parked for the janitor's six-hourly sweep as if the agent had been wrong. Two causes are
+# infrastructure, not judgement:
+#
+#   runner-shutdown  the VM was taken away mid-job: the process is killed with SIGTERM and GitHub
+#                    annotates the job "Process completed with exit code 143" (the log has the
+#                    longer "The runner has received a shutdown signal"), whatever the model was
+#                    doing. 137, a SIGKILL, is left out: an out-of-memory kill repeats itself
+#   cut-off          the engine was stopped one turn after it started: the last thing the log shows
+#                    before the sandbox stops is the header opencode prints when it sends a request
+#                    to the model, with no reply under it. The AI gateway answered nothing, or an
+#                    error opencode did not surface, and the run ended with the work unsaid
+#
+# A tool's output in the log can quote either phrase, so neither is searched for in the body: the
+# shutdown is read from the annotations, which only GitHub writes, and the cut-off from the one line
+# immediately above the sandbox teardown.
+#
+# Usage: classify-failure.sh LOG_FILE ANNOTATIONS_FILE
+# Prints one word: runner-shutdown, cut-off or none.
+
+set -euo pipefail
+
+log="${1:-}"
+annotations="${2:-}"
+
+if [ -n "$annotations" ] && [ -f "$annotations" ] && grep -qiE 'exit code 143|runner has received a shutdown signal|lost communication with the server|runner.*(was|has been) (deleted|terminated)' "$annotations"; then
+  echo runner-shutdown
+  exit 0
+fi
+
+if [ -n "$log" ] && [ -f "$log" ]; then
+  # The line the sandbox teardown starts on. grep exits 1 for none, which is an answer here.
+  stop=$(grep -n '\[INFO\] Stopping containers' "$log" | head -1 | cut -d: -f1 || true)
+  if [ -n "$stop" ] && [ "$stop" -gt 1 ]; then
+    # The last line with any text above it, ignoring the ANSI colour codes opencode wraps its
+    # output in and the timestamp every runner line carries.
+    last=$(sed -n "1,$((stop - 1))p" "$log" | sed -E 's/\x1b\[[0-9;]*m//g' | grep -vE '^(\S+Z )?[[:space:]]*$' | tail -1 || true)
+    if printf '%s' "$last" | grep -qE '^(\S+Z )?> [A-Za-z0-9_.-]+ · [A-Za-z0-9_./:-]+[[:space:]]*$'; then
+      echo cut-off
+      exit 0
+    fi
+  fi
+fi
+
+echo none

package/loops/actions/housekeeping/action.yml

@@ -71,13 +71,33 @@ runs:
           // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
           // logic below can never free because the run never reaches a terminal state. This
           // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
+          //
+          // Only a run with nothing live ahead of it. The router queues implement runs FIFO
+          // (`queue: max`) so that labelling six issues at once implements all six, one after the
+          // other, and each of those takes an hour: the sixth waits five hours legitimately. A
+          // flat one-hour cutoff cancelled every run behind the first, which left its issue
+          // carrying bot-working with no run until the sweep cleared it (Pliny-Bot #706 and #644,
+          // both cancelled while #693 ran). A pending run is stuck when no run of its own kind
+          // ("Agent: Implement", "Agent: Merge Gate") is running or queued to hold the group.
           const stuckCutoff = Date.now() - 3600 * 1000; // 1 hour ago
+          const runKind = (run) => String(run.display_title || '').split(' - ')[0];
+          const liveKinds = new Set();
+          for (const status of ['in_progress', 'queued']) {
+            for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
+              owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
+              status, per_page: 50,
+            })) liveKinds.add(runKind(run));
+          }
           let cancelledRuns = 0;
           for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
             owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
             status: 'pending', per_page: 50,
           })) {
             if (new Date(run.created_at).getTime() > stuckCutoff) continue;
+            if (liveKinds.has(runKind(run))) {
+              core.info(`run #${run.id} (${run.display_title}) waits behind a live ${runKind(run)} run; not stuck`);
+              continue;
+            }
             await act(`cancelling stuck pending run #${run.id} (queued ${new Date(run.created_at).toISOString()})`, async () => {
               await github.rest.actions.cancelWorkflowRun({
                 owner: context.repo.owner, repo: context.repo.repo, run_id: run.id,

package/loops/actions/identify-gate-subject/action.yml

@@ -1,6 +1,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
 name: Identify gate subject
-description: Confirm the pull request is one the gate may act on, resolve the issue it closes, and check a bot pull request's issue carries the required label.
+description: Confirm the pull request is one the gate may act on (same repository, opened by a trusted bot or someone with write access) and resolve the open issue it closes, if any.
 inputs:
   token:
     description: GitHub token with issues and pull-requests read access.
@@ -24,10 +24,6 @@ inputs:
     description: Issue the pull request closes, when the router already resolved it.
     required: false
     default: ''
-  require-label:
-    description: Label a bot pull request's closing issue must carry. Empty disables the check. A person's pull request needs neither an issue nor the label.
-    required: false
-    default: ''
 outputs:
   found:
     description: Whether a valid gate subject was found.
@@ -66,7 +62,6 @@ runs:
         CONCLUSION: ${{ inputs.ci-conclusion }}
         CI_RUN_ID: ${{ inputs.ci-run-id }}
         LINKED_ISSUE: ${{ inputs.linked-issue }}
-        REQUIRE_LABEL: ${{ inputs.require-label }}
         TRUSTED_BOTS: ${{ inputs.trusted-bots }}
       run: |
         set -euo pipefail
@@ -115,19 +110,16 @@ runs:
             grep -oE '[0-9]+' | head -n 1 || true)"
         fi
 
-        # The bot only opens a pull request for an issue it was given, so one that closes none, or
-        # whose issue lost the label, is not work the gate was handed. A person's pull request is
-        # gated on its own description when it closes nothing.
-        if [ "$bot" = true ]; then
-          [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
-        fi
-
-        if [ "$bot" = true ] && [ -n "$REQUIRE_LABEL" ]; then
-          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
-            --jq '[.labels[].name]')"
-
-          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
-            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
+        # An issue that is already closed is not the work this pull request is for: the feature
+        # landed some other way, and the label on a closed issue says nothing. Comments, labels
+        # and the acceptance criteria then come from the pull request itself. A pull request is
+        # never refused for lacking an issue: the merge train hands the gate every pull request
+        # that can move, and a gate that declines one without a trace is handed it again.
+        if [ -n "$issue" ]; then
+          issue_state="$(gh issue view "$issue" --repo "$REPO" --json state --jq '.state' 2>/dev/null || echo UNKNOWN)"
+          if [ "$issue_state" != OPEN ]; then
+            echo "Issue #$issue is $issue_state; gating the pull request on its own description."
+            issue=""
           fi
         fi
 

package/loops/actions/merge-train/action.yml

@@ -28,6 +28,10 @@ inputs:
     description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
     required: false
     default: '3'
+  max-repairs:
+    description: How many pull requests may be in repair at once. Merges stay one at a time.
+    required: false
+    default: '1'
   stuck-hours:
     description: How long the train waits behind a CI run that never finishes before it passes that pull request by.
     required: false
@@ -60,6 +64,7 @@ runs:
         MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
         MAX_RETRIES: ${{ inputs.max-retries }}
         STUCK_HOURS: ${{ inputs.stuck-hours }}
+        MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}

package/loops/actions/merge-train/merge-train.sh

@@ -1,19 +1,20 @@
 #!/usr/bin/env bash
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-train/merge-train.sh. Update with `workflows update --force`; consumer edits may be overwritten.
-# Move the merge train one step: the oldest open pull request that can move, and only that one.
+# Move the merge train: look at every open pull request, oldest first, and do for each the one
+# thing it needs, with merges one at a time and repairs in parallel.
 #
 # The belt this replaces dispatched the gate for every eligible pull request at once. Each gate
 # then resolved its branch against a default branch the gate ahead of it was about to move, so a
 # night of ten pull requests became ten repairs, ten CI runs and ten more gates after every merge,
-# and a verdict that parked a pull request held it however stale it went. The train keeps one
-# pull request in flight, lowest number first. Everything else waits, untouched, until the one in
-# front of it has merged or been parked for a person.
+# and a verdict that parked a pull request held it however stale it went.
 #
-# One tick does at most one thing:
-#   wait     the front pull request's CI is still running, or a gate is already on the belt
-#   update   it is green but behind the default branch: merge the default branch in, CI reruns
-#   gate     it is green and current, red, or conflicting: the merge gate repairs or merges it
+# What races is a merge, because it moves the default branch under everyone else. A repair (a gate
+# handed red CI) pushes to its own branch and can never merge, so it races nothing. So:
+#   merge    one at a time, the oldest ready pull request first; nothing behind a pull request that
+#            is waiting on its CI, or behind a gate that may merge, merges or is brought up to date
+#   repair   a red or conflicting pull request goes to the gate at once, up to MAX_REPAIRS together
 #   approve  its CI is waiting for approval and a trusted bot opened it
+#   update   it is green but behind the default branch: merge the default branch in, CI reruns
 # A pull request a person has to decide on, or that carries the hold label, is skipped, so it never
 # blocks the line. Ticks come from every merge, every CI completion, every finished gate, and the
 # hourly schedule as the fallback.
@@ -27,7 +28,12 @@ set -euo pipefail
 #   HOLD               true when the pull request carries the hold label
 #   REVIEW_DECISION    GitHub's review decision (CHANGES_REQUESTED holds it for its author)
 #   PARK               none, or held when a standing gate verdict covers this head
-#   ATTEMPTS           failed gate attempts on this head; MAX_ATTEMPTS is the budget
+#   ATTEMPTS           failed gate attempts on this head; MAX_ATTEMPTS is the budget. Counts the
+#                      larger of the attempt comments and the gate runs, so a gate that fails
+#                      without a comment still spends it
+#   SILENT_GATE        true when a gate already ran on this head and left no verdict and no attempt
+#                      comment: it declined, or died before it could say so. Handing it the same
+#                      pull request again reproduces that, a hot loop with every tick
 #   MERGEABLE          MERGEABLE, CONFLICTING or UNKNOWN
 #   CI_STATUS          none, or the latest CI run's status (queued, in_progress, completed, ...)
 #   CI_CONCLUSION      that run's conclusion when it completed
@@ -45,6 +51,8 @@ train_move() {
     move=skip; reason="a gate verdict on this head is waiting for a person"
   elif [ "${ATTEMPTS:-0}" -ge "${MAX_ATTEMPTS:-6}" ]; then
     move=skip; reason="its gate attempt budget on this head is spent"
+  elif [ "${SILENT_GATE:-false}" = true ]; then
+    move=skip; reason="its gate already ran on this head and left no verdict or attempt"
   elif [ "${MERGEABLE:-UNKNOWN}" = CONFLICTING ]; then
     # A conflicting pull request has no merge ref, so CI can never run on it: waiting for a
     # verdict would wait forever. Resolving the conflict is the gate's job.
@@ -126,6 +134,8 @@ TRUSTED_BOTS="${TRUSTED_BOTS:-}"
 HOLD_LABEL="${HOLD_LABEL:-hold}"
 MAX_ATTEMPTS="${MAX_ATTEMPTS:-6}"
 MAX_RETRIES="${MAX_RETRIES:-3}"
+MAX_REPAIRS="${MAX_REPAIRS:-1}"
+case "$MAX_REPAIRS" in ''|*[!0-9]*|0) MAX_REPAIRS=1 ;; esac
 STUCK_HOURS="${STUCK_HOURS:-3}"
 DRY_RUN="${DRY_RUN:-false}"
 SELF_RUN_ID="${GITHUB_RUN_ID:-0}"
@@ -168,18 +178,18 @@ can_ride() {
   [ "${WRITE_ACCESS[$login]}" = true ]
 }
 
-# One gate at a time across the repository. A gate dispatched by a tick, by a person or by a
-# consumer CI is a router run titled by run-name; the run this tick belongs to is excluded,
-# because the tick after a gate runs inside the gate's own router run.
-live_gate() {
+# The gates on the belt, one title per line. A gate handed red CI repairs and pushes and cannot
+# merge, so run-name gives it a " (repair)" suffix and the router queues it per pull request;
+# every other gate may merge, and there is one of those at a time across the repository. The run
+# this tick belongs to is excluded: the tick after a gate runs inside the gate's own router run.
+live_gates() {
   local status
   for status in queued in_progress waiting pending requested; do
-    gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
-      --jq ".workflow_runs[]
+    gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100"       --jq ".workflow_runs[]
         | select(.id != $SELF_RUN_ID)
         | select(.display_title | startswith(\"$GATE_TITLE_PREFIX\"))
-        | .display_title" 2>/dev/null | head -1
-  done | head -1
+        | .display_title" 2>/dev/null
+  done | sort -u
 }
 
 # GitHub works mergeability out on demand: the first read of a pull request nobody has opened
@@ -220,6 +230,14 @@ update_branch() {
   gh api "repos/$REPO/pulls/$pr/update-branch" --method PUT -f expected_head_sha="$head_sha" >/dev/null
 }
 
+# How many gate runs were started for a pull request since a moment, whatever became of them. A
+# run is titled by the router's run-name; this is the one count that does not depend on the gate
+# having written anything.
+gate_run_count() {
+  local pr="$1" since="$2"
+  gh api --paginate "repos/$REPO/actions/workflows/work-router.yml/runs?event=workflow_dispatch&per_page=100"     --jq "[.workflow_runs[] | select(.display_title == \"$GATE_TITLE_PREFIX$pr\") | select(.created_at > \"$since\")] | length"     2>/dev/null | awk '{ n += $1 } END { print n + 0 }'
+}
+
 attempt_count() {
   local number="$1" since="$2"
   gh api --paginate "repos/$REPO/issues/$number/comments?per_page=100" \
@@ -241,7 +259,7 @@ dispatch_gate() {
   # The next tick waits behind this one and must see the gate it started, or it starts a second.
   for _ in $(seq 1 12); do
     if gh api "repos/$REPO/actions/workflows/work-router.yml/runs?event=workflow_dispatch&created=>=$since&per_page=20" \
-      --jq ".workflow_runs[] | select(.display_title == \"$GATE_TITLE_PREFIX$pr\") | .id" 2>/dev/null | grep -q .; then
+      --jq ".workflow_runs[] | select(.display_title | startswith(\"$GATE_TITLE_PREFIX$pr\")) | .id" 2>/dev/null | grep -q .; then
       return 0
     fi
     sleep 5
@@ -252,11 +270,21 @@ dispatch_gate() {
 summary "### Merge train"
 summary ""
 
-if gate=$(live_gate) && [ -n "$gate" ]; then
-  echo "A gate is already on the belt (${gate}); the train waits for it."
-  summary "Waiting: \`${gate}\` is on the belt."
-  exit 0
-fi
+live_titles="$(live_gates)"
+live_repairs=$(printf '%s
+' "$live_titles" | grep -c ' (repair)$' || true)
+live_merge=$(printf '%s
+' "$live_titles" | grep -v ' (repair)$' | grep -c . || true)
+live_for_pr() { printf '%s
+' "$live_titles" | grep -qE "PR #$1( \(repair\))?$"; }
+echo "On the belt: ${live_merge} merging gate(s), ${live_repairs} repair(s). Up to ${MAX_REPAIRS} repair(s) at once."
+summary "On the belt: ${live_merge} merging gate(s), ${live_repairs} repair(s); up to ${MAX_REPAIRS} repair(s) at once."
+summary ""
+
+# Once a pull request ahead is waiting on its CI, or a gate that may merge is on the belt, nothing
+# behind it may merge or be brought up to date: the oldest merges first, and one at a time.
+merge_blocked=false
+[ "$live_merge" -eq 0 ] || merge_blocked=true
 
 base_head_date=""
 base_head_date_for() {
@@ -332,6 +360,7 @@ for line in "${candidates[@]}"; do
     RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" train_park)
 
   attempts=0
+  silent_gate=false
   if [ "$park" = none ]; then
     horizon="${head_committed:-1970-01-01T00:00:00Z}"
     # A retried verdict starts a fresh budget from the verdict it retries, not from the head.
@@ -340,6 +369,12 @@ for line in "${candidates[@]}"; do
     if [ -n "$linked_issue" ]; then
       attempts=$((attempts + $(attempt_count "$linked_issue" "$horizon")))
     fi
+    gate_runs=$(gate_run_count "$pr" "$horizon")
+    # Comments say what the gate decided. Runs say it was asked. A run on this head that left no
+    # attempt comment and no verdict is a gate that did nothing, and the next tick must not ask
+    # again: that is the loop.
+    if [ "$gate_runs" -gt 0 ] && [ "$attempts" -eq 0 ]; then silent_gate=true; fi
+    [ "$gate_runs" -le "$attempts" ] || attempts="$gate_runs"
   fi
 
   ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
@@ -372,32 +407,51 @@ for line in "${candidates[@]}"; do
   is_trusted_bot "$author" && trusted_author=true
 
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
-    ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" MERGEABLE="$mergeable" \
+    ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
     CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" \
     BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")
 
+  # A gate is already on this pull request, whatever kind: offering it another would run the same
+  # work twice. It does not hold the line up for the repair kind; a merging gate already does.
+  if [ "$move" != skip ] && live_for_pr "$pr"; then
+    move=skip
+    reason="a gate is already on it"
+  fi
+
   echo "#$pr ($author): $move, $reason."
   summary "| #$pr | $author | $move | $reason |"
 
   case "$move" in
     skip) continue ;;
-    wait) exit 0 ;;
+    wait)
+      # Its CI is running: nothing behind it may merge or be brought up to date first, but the
+      # pull requests behind it that need repair do not wait for anyone.
+      merge_blocked=true
+      continue
+      ;;
     approve)
       act "Approving the CI runs waiting on #$pr." approve_runs "$head_ref"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
     update)
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr waits for the pull request ahead of it before it is brought up to date."
+        continue
+      fi
       # Merge, never rebase: the gate's pushes are fast-forward only, and so are a person's.
       if act "Merging $base_ref into #$pr so CI judges it against what it will land on." \
         update_branch "$pr" "$head_sha"; then
-        exit 0
+        merge_blocked=true
+        continue
       fi
       echo "::warning::GitHub could not update #$pr from $base_ref; handing it to the gate."
       act "Dispatching the merge gate for #$pr to bring it up to date." \
         dispatch_gate "$pr" success "${ci_run_id:-}" "$attempts"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
     gate)
       conclusion="${ci_conclusion:-}"
@@ -412,13 +466,30 @@ for line in "${candidates[@]}"; do
         conclusion=$(cut -f2 <<<"$last")
         [ -n "$conclusion" ] || conclusion=failure
       fi
+      if [ "$conclusion" = failure ]; then
+        # A repair: it pushes and can never merge, so it races nothing. Up to MAX_REPAIRS at once.
+        if [ "$live_repairs" -ge "$MAX_REPAIRS" ]; then
+          echo "  #$pr needs a repair; ${live_repairs} already in progress, the limit is ${MAX_REPAIRS}."
+          continue
+        fi
+        act "Dispatching a repair gate for #$pr (CI failed, attempt $((attempts + 1)) of $MAX_ATTEMPTS)." \
+          dispatch_gate "$pr" failure "${ci_run_id:-}" "$attempts"
+        live_repairs=$((live_repairs + 1))
+        continue
+      fi
+      # CI is green on the verdict: this gate may merge, so it goes only when nothing is ahead of it.
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr is ready for the gate; it waits for the pull request ahead of it."
+        continue
+      fi
       act "Dispatching the merge gate for #$pr (CI $conclusion, attempt $((attempts + 1)) of $MAX_ATTEMPTS)." \
         dispatch_gate "$pr" "$conclusion" "${ci_run_id:-}" "$attempts"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
   esac
 done
 
-echo "Nothing on the train can move: every open pull request is parked, held or has no CI verdict."
+echo "That is every open pull request this tick could move."
 summary ""
-summary "Nothing can move: every open pull request is parked, held or has no CI verdict."
+summary "Every open pull request was looked at; those that could move have."

package/loops/actions/push-agent-branch/action.yml

@@ -24,7 +24,20 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.token }}
       run: |
-        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
+        set -euo pipefail
+        # The runners here outlive their jobs, and `git config --global` outlives the job with
+        # them. This step used to add one `url.<token>.insteadOf` rule per run and never remove it,
+        # so a runner that had pushed before held several rules for the same prefix, each carrying
+        # a token revoked since, and git picks among equal-length matches arbitrarily. The same
+        # gate pushed for one pull request and was refused for the next: "Invalid username or
+        # token", then "Target branch does not exist" because ls-remote exited 128 (Pliny-Bot #716
+        # failed twice that way while #717 pushed in between). Drop every such rule wherever it
+        # lives, and set this run's rule in the checkout only.
+        for scope in --global --local; do
+          git config "$scope" --get-regexp '^url\..*x-access-token.*\.insteadof$' 2>/dev/null |
+            while read -r key _; do git config "$scope" --unset-all "$key" || true; done || true
+        done
+        git config --local url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
     - name: Read pull request branch
       id: request
       shell: bash

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -493,6 +493,14 @@ if [ "$BELT_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # trailing space, so a number at the end of a body is still followed by a non-digit, and the
 # pattern matches `[^0-9]`. Four quoting layers cannot eat a character class.
 SWEEP_OK=1
+# The live runs come from status-filtered queries. Reading the repository's latest hundred runs of
+# any kind let a long-queued implement fall out of the window, and the sweep cleared bot-working
+# from issues whose runs were alive (Pliny-Bot #693 and #707).
+if grep -q 'gh api "repos/\$REPO/actions/runs?per_page=100"' "$ROUTER_YML" ||
+  ! grep -qF 'actions/runs?status=$status&per_page=100' "$ROUTER_YML"; then
+  SWEEP_OK=0
+  echo "FAIL: the stale-reservation sweep must read live runs by status, not the latest hundred runs" >&2
+fi
 if ! grep -qF 'test(\"#${issue}[^0-9]\")' "$ROUTER_YML"; then
   SWEEP_OK=0
   echo "FAIL: the stale-reservation sweep does not match a run title with a character class; a word boundary there is eaten by bash and jq" >&2
@@ -688,12 +696,15 @@ if worker_installed merge-gate; then
   # The merge belt is serial for the whole repository: several overnight pull requests
   # mean every merge moves the default branch under the rest, and gates running at once
   # rebase onto bases other gates are about to invalidate. A per-issue group here would
-  # reintroduce that race, so assert the repo-wide lock is the one in use.
-  if grep -A7 'call-merge-gate:' "$ROUTER_YML" | grep -q 'group: merge-belt'; then
+  # reintroduce that race, so assert the repo-wide lock is the one in use. The exception is a gate
+  # handed red CI: it repairs and pushes and can never merge, so it queues per pull request.
+  gate_group="$(sed -n '/^  call-merge-gate:/,/^    permissions:/p' "$ROUTER_YML" | grep 'group:')"
+  if grep -q "'merge-belt'" <<<"$gate_group" &&
+    grep -q "ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number)" <<<"$gate_group"; then
     PASS=$((PASS + 1))
   else
     FAIL=$((FAIL + 1))
-    echo "FAIL: call-merge-gate must hold the repo-wide merge-belt lock" >&2
+    echo "FAIL: call-merge-gate must queue on merge-belt, and only a gate handed red CI may queue per pull request instead" >&2
   fi
 fi
 
@@ -719,7 +730,9 @@ if worker_installed merge-gate; then
     # One gate at a time, found by the title run-name gives it. The belt looked for a title that
     # run-name had stopped producing, saw no live gate ever, and dispatched #680 five times in
     # an hour onto a belt that runs one gate at a time.
-    gate_title="$(sed -n "s/.*format('\(Agent: Merge Gate - PR #\){0}'.*/\1/p" "$ROUTER_YML" | head -1)"
+    gate_title="$(sed -n "s/.*format('\(Agent: Merge Gate - PR #\){0}{1}'.*/\1/p" "$ROUTER_YML" | head -1)"
+    grep -q "' (repair)'" "$ROUTER_YML" ||
+      { BELT_OK=0; echo "FAIL: run-name must mark a gate handed red CI as a (repair), the train counts them by it" >&2; }
     if [ -z "$gate_title" ] || ! grep -qF "GATE_TITLE_PREFIX=\"${gate_title}\"" "$TRAIN_SH"; then
       BELT_OK=0
       echo "FAIL: the train looks for live gates titled differently from what run-name names them ('${gate_title:-unread}')" >&2
@@ -1771,6 +1784,151 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
   if [ "$VALIDATOR_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+# The gate takes any pull request the train hands it. A subject check that refuses one without
+# leaving a verdict or an attempt is a loop: the train cannot tell a gate that declined from a gate
+# that has not run. Refusals are for what the train never hands over (a fork, a stranger, a pull
+# request that is not open), and the train filters those itself.
+if worker_installed merge-gate; then
+  # check-diff exiting 1 is the `fail` the code_rules job reports. Under GitHub's `bash -e` a bare
+  # assignment from it ends the step, so the report is never recorded and the gate burns its
+  # budget on a failure it could have repaired.
+  if grep -qF 'check-diff.mjs --base "$BASE" 2>&1) || code=$?' "$MERGE_GATE_WORKER_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: code_rules must capture check-diff's exit code with || code=\$?; a bare assignment dies under bash -e" >&2
+  fi
+  # A run killed by its infrastructure is repeated whatever its duration; one the agent got wrong is
+  # not. The two signatures are read from places a tool's output cannot write: GitHub's annotations
+  # for the runner shutdown, and the line above the sandbox teardown for an engine cut off one turn
+  # after it asked the model something (Pliny-Bot #699 and #693's first attempt).
+  CLASSIFY="${HERE}/../decide-agent-retry/classify-failure.sh"
+  if [ -f "$CLASSIFY" ]; then
+    ctmp="$(mktemp -d)"
+    printf '%s
+' '2026-10-16T22:13:03Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:05Z the grep printed a line' '2026-10-16T22:13:36Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/cutoff.log"
+    printf '%s
+' '2026-10-16T22:13:03Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:36Z Done. The pull request is ready.' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/done.log"
+    printf '%s
+' '2026-10-16T22:13:03Z the log quotes: Process completed with exit code 143 and The runner has received a shutdown signal' '2026-10-16T22:13:04Z Done.' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/quoted.log"
+    printf '%s
+' 'Process completed with exit code 143.' 'Property x does not exist' >"$ctmp/sigterm.ann"
+    printf '%s
+' 'Process completed with exit code 137.' >"$ctmp/sigkill.ann"
+    printf '%s
+' 'Process completed with exit code 1.' >"$ctmp/plain.ann"
+    assert "an engine stopped one turn after its request is a cut-off" cut-off "$(bash "$CLASSIFY" "$ctmp/cutoff.log" "")"
+    assert "a run that said its piece is not a cut-off" none "$(bash "$CLASSIFY" "$ctmp/done.log" "")"
+    assert "a tool quoting the shutdown text does not count" none "$(bash "$CLASSIFY" "$ctmp/quoted.log" "")"
+    assert "exit 143 in the annotations is a runner shutdown" runner-shutdown "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/sigterm.ann")"
+    assert "exit 137 (an out-of-memory kill) is repeated by nobody" none "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/sigkill.ann")"
+    assert "an ordinary failure is not infrastructure" none "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/plain.ann")"
+    assert "nothing to read classifies as nothing" none "$(bash "$CLASSIFY" "" "")"
+    rm -rf "$ctmp"
+  fi
+  # The implement worker carried its own copy of the retry rule while four other workers used the
+  # shared action, so a rule fixed in one place stayed broken in the other.
+  IMPLEMENT_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if [ -f "$IMPLEMENT_MD" ]; then
+    uses=$(count -c "uses: ./.github/actions/decide-agent-retry" "$IMPLEMENT_MD")
+    if [ "$uses" -ge 2 ] && ! grep -q 'minutes=$(( ( $(date -u -d "$finished"' "$IMPLEMENT_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-implement.md must decide a retry through the shared decide-agent-retry action, in both incomplete and conclude" >&2
+    fi
+  fi
+  # Implement runs spread over IMPLEMENT_PARALLELISM queues, but the children of one refine share
+  # a queue keyed on their split parent: they build on each other's code. The queue step's
+  # arithmetic is exercised with the same expression the router runs.
+  if grep -q 'group: implement-queue-${{ needs.check-stack-branch.outputs.implement-queue' "$ROUTER_YML" &&
+    sed -n '/- name: Pick the implement queue/,/- name: Resolve the feature branch/p' "$ROUTER_YML" | grep -q 'key="${parent:-$ISSUE_NUMBER}"'; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: call-implement must queue on check-stack-branch's implement-queue, keyed on the split parent" >&2
+  fi
+  queue_for() { local parent="$1" issue="$2" queues="$3"; case "$queues" in ''|*[!0-9]*|0) queues=1 ;; esac; local key="${parent:-$issue}"; echo $(( key % queues )); }
+  assert "siblings of one refine share a queue" "$(queue_for 690 693 3)" "$(queue_for 690 694 3)"
+  assert "parallelism 1 is one queue for everything" 0 "$(queue_for "" 722 1)"
+  assert "an unset or garbled parallelism is one queue" 0 "$(queue_for "" 725 abc)"
+  assert "independent issues spread across the queues" 1 "$(queue_for "" 724 3)"
+  # The router queues implement runs FIFO, so a run waiting an hour behind the one in progress is
+  # healthy. The janitor cancelling every pending run over an hour old took every issue queued
+  # behind the first out of the queue and left it holding bot-working (Pliny-Bot #706, #644).
+  if [ -f "${HERE}/../housekeeping/action.yml" ] && ! grep -q "liveKinds" "${HERE}/../housekeeping/action.yml"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the janitor cancels pending runs without checking for a live run of their own kind ahead of them" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  # The implement worker names every phase skill it must load. Left as "load each phase skill",
+  # glm-5-2 loaded pc-plan-goal, wrote proposal.md and tasks.md itself and edited the code alone:
+  # a hand-written tasks.md has no <!-- agent --> annotations, so pc-plan-apply had no subagents
+  # to spawn and the whole change ran on one model, in sequence (Pliny-Bot #693, #699).
+  IMPL_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if [ -f "$IMPL_MD" ]; then
+    if grep -q 'You never write' "$IMPL_MD" && grep -q '`pc-plan-propose`, even when the issue is refined' "$IMPL_MD" &&
+      grep -q 'In this phase you do not edit source files' "$IMPL_MD" && grep -q '`pc-repo-verify`, then `pc-plan-archive`' "$IMPL_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-implement.md must name pc-plan-propose, pc-plan-apply, pc-repo-verify and pc-plan-archive and forbid writing tasks.md by hand" >&2
+    fi
+  fi
+  # Refine writes in English and may retitle an issue written in another language; without
+  # allow_title on update-issue the title in the call is dropped and the issue keeps its language.
+  REFINE_MD="${WORKFLOWS_DIR}/agent-refine.md"
+  if [ -f "$REFINE_MD" ]; then
+    if sed -n '/^  update-issue:/,/^  add-comment:/p' "$REFINE_MD" | grep -q '^    title:' &&
+      grep -q 'Everything you write is in English' "$REFINE_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-refine.md must write in English and be allowed to retitle an issue (update-issue title:)" >&2
+    fi
+  fi
+  # A token written to the runner's global git config outlives the job on a runner that is reused:
+  # rules for revoked tokens pile up for the same prefix and git picks one at random, so the same
+  # gate pushed for one pull request and was refused for the next (Pliny-Bot #716 and #717).
+  PUSH_ACTION="${HERE}/../push-agent-branch/action.yml"
+  if [ -f "$PUSH_ACTION" ] && grep -qE 'git config( --global)? url\.' "$PUSH_ACTION" && ! grep -qF 'git config --local url.' "$PUSH_ACTION"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: push-agent-branch writes its token to the global git config, where stale rules from earlier jobs accumulate" >&2
+  elif [ -f "$PUSH_ACTION" ] && grep -qE 'git config --global url\.' "$PUSH_ACTION"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: push-agent-branch adds to the global git config; set the rule with --local" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  # A conclude that dies leaves no verdict and no attempt comment unless `incomplete` records it,
+  # and the train then reads the run as a gate that did nothing and never offers the pull request
+  # again.
+  if sed -n '/^  incomplete:/,/^    runs-on:/p' "$MERGE_GATE_WORKER_MD" | grep -q "needs.conclude.result == 'failure'"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the gate's incomplete job must record a failed conclude as an attempt, or the train strands the pull request" >&2
+  fi
+  # A stack child is dispatched on its feature branch, and a dispatched run reads repository secrets
+  # by their own names, not through the router's FORGE_API_KEY mapping. Without the fallback every
+  # stack child died at activation on "Validate CODEX_API_KEY or OPENAI_API_KEY secret".
+  COMPILE_SCRIPT="${HERE}/../../scripts/compile-agent-workflows.mjs"
+  if [ -f "$COMPILE_SCRIPT" ] && ! grep -qF "secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY" "$COMPILE_SCRIPT"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the compile script no longer gives the engine key a FORGE_API_KEY fallback; dispatched stack children cannot start" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  SUBJECT_YML="${HERE}/../identify-gate-subject/action.yml"
+  if grep -qE 'does not close a numbered issue|does not carry' "$SUBJECT_YML" || grep -q 'require-label' "$SUBJECT_YML" "$MERGE_GATE_WORKER_MD"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the gate's subject job refuses a pull request for lacking an issue or a label; the train hands it back forever" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+fi
+
 echo "── Merge gate park ───────────────────────────────────────────────────────"
 
 # A gate verdict parks the code it was given on. The belt used to compare the standing verdict
@@ -1813,6 +1971,10 @@ if worker_installed merge-gate; then
     assert "requested changes keep it off the train" skip "$(move REVIEW_DECISION=CHANGES_REQUESTED CI_STATUS=completed CI_CONCLUSION=success)"
     assert "a parked pull request is passed by, not waited on" skip "$(move PARK=held CI_STATUS=completed CI_CONCLUSION=success)"
     assert "a spent attempt budget is passed by" skip "$(move ATTEMPTS=6 MAX_ATTEMPTS=6 CI_STATUS=completed CI_CONCLUSION=failure)"
+    # The loop that ran Pliny-Bot's gate twenty times on one pull request: the gate declined it
+    # (its issue was closed), left no verdict and no attempt, and every tick handed it back.
+    assert "a gate that ran and left no trace is not asked again" skip "$(move SILENT_GATE=true MERGEABLE=CONFLICTING CI_STATUS=none)"
+    assert "a gate that ran and left no trace is not asked again, green or red" skip "$(move SILENT_GATE=true MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure)"
     assert "a conflict goes to the gate even with no CI" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=none)"
     assert "running CI is waited on" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=in_progress)"
     assert "CI stuck past the limit is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=queued CI_STUCK=true)"
@@ -2568,7 +2730,7 @@ if [ "$INPUT_WIRING_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)
 BELT_QUEUE_OK=1
 belt_caller=$(awk '/^  call-merge-gate:/ { found = 1; print; next } found && /^  [a-z]/ { exit } found { print }' "$ROUTER_YML")
 printf '%s
-' "$belt_caller" | grep -qE '^ *group: merge-belt *$' ||
+' "$belt_caller" | grep -qE "^ *group: .*'merge-belt'" ||
   { BELT_QUEUE_OK=0; echo "FAIL: the merge gate is no longer serialised on the merge-belt concurrency group" >&2; }
 printf '%s
 ' "$belt_caller" | grep -qE '^ *queue: max *$' ||

package/loops/docs/diagrams.md

@@ -94,7 +94,7 @@ flowchart LR
     gate -->|merge| merged(("Merged"))
     merged -->|"next PR"| train
     gate -.->|"CI failed or conflict"| fix("Fix, push, CI again") --> ci
-    gate -.->|".github, secrets<br/>or 1000+ lines"| human(("Human review"))
+    gate -.->|".github, secrets<br/>or 10000+ lines"| human(("Human review"))
     review("Someone reviews the PR") --> applyReview("apply-review") --> ci
     audit("audit, weekly") -->|"files one issue"| refine
 
@@ -381,7 +381,7 @@ flowchart TD
     gateDisposition -->|"no verified blocker,<br/>radius low or recoverable medium"| gateRootCheck
     gateRootCheck{"PR base is a<br/>stack feature branch<br/>and this PR is the root?"}
     gateRootCheck -->|"child PR: no"| gateMerge
-    gateDisposition -.->|"1000+ lines, .github/<br/>or a secret"| gateOwner
+    gateDisposition -.->|"10000+ lines, .github/<br/>or a secret"| gateOwner
     gateDisposition -.->|"fragile, unmet criteria<br/>or low confidence"| gateHuman
     gateDisposition -.->|"CI red or a verified<br/>high finding"| gateBlocked
     gateMerge(("AUTO-MERGE<br/>squash into the PR's base<br/>(main, or the feature branch:<br/>then the child issue closes,<br/>pr-pending removed)"))

package/loops/scripts/compile-agent-workflows.mjs

@@ -331,7 +331,19 @@ for (const file of readdirSync(workflowDirectory)) {
     // runner rather than the run so a runner keeps its server warm between its own jobs.
     // No double quotes here: the enclosing run: is a double-quoted YAML scalar, so a quote
     // would have to be escaped. The default has no spaces, so bare is safe shell.
-    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}');
+    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}')
+    // The engine key falls back to FORGE_API_KEY, the one secret every repository here has. The
+    // router maps it to OPENAI_API_KEY when it CALLS a worker, but a stack child is DISPATCHED on
+    // its feature branch, and a dispatched run reads repository secrets by their own names: with
+    // no OPENAI_API_KEY or CODEX_API_KEY set, activation died on "Validate CODEX_API_KEY or
+    // OPENAI_API_KEY secret" and every stack child in Pliny-Bot failed that way for hours. gh-aw
+    // reads the key in four places, the validation step, the engine env and the redaction list
+    // included, and all of them must see the fallback or the key would run unredacted. The
+    // longest form goes first so the shorter ones do not match inside it.
+    .replaceAll('${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}',
+      '${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.CODEX_API_KEY }}', '${{ secrets.CODEX_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.OPENAI_API_KEY }}', '${{ secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}');
 
   let rewritten = patched;
   // A queued implement executes hours after its run was created, but actions/checkout
@@ -340,8 +352,8 @@ for (const file of readdirSync(workflowDirectory)) {
   // every later push became a rebase onto a moved parent, which gh-aw's signed-commit
   // push cannot do (it dies with "cannot rebase: You have unstaged changes" and files the
   // pull request as an issue instead of a pull request). Checking out the branch tip at
-  // execution time makes the commit parent current main; the implement-global queue
-  // already keeps sibling merges out of the window while the agent runs.
+  // execution time makes the commit parent current main; the implement queue, shared by the
+  // children of one refine, keeps sibling merges out of the window while the agent runs.
   //
   // A stack child dispatches this workflow directly (`gh workflow run
   // agent-implement.lock.yml --ref feat/N`), and there the pin must select the feature
@@ -415,6 +427,11 @@ for (const file of readdirSync(workflowDirectory)) {
   for (const check of [
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    // Every read of the engine key carries the FORGE_API_KEY fallback; see the rewrite above.
+    {
+      name: "engine key falls back to FORGE_API_KEY",
+      ok: lock => !lock.includes("${{ secrets.OPENAI_API_KEY }}") && !lock.includes("${{ secrets.CODEX_API_KEY }}"),
+    },
     { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
     // Only agent-refine declares update_issue; the other workers never carry the tool.
     {

package/loops/workflows/agent-implement.md

@@ -185,7 +185,7 @@ jobs:
           fi
 
           # A queued implement run can start long after it was dispatched. If triage concluded
-          # needs-maintainer while this run waited in the implement-global queue, the issue now
+          # needs-maintainer while this run waited in its implement queue, the issue now
           # carries review and the verdict must stand: the reserve step clears review blindly,
           # so eligibility has to catch it first (Pliny-Bot #372).
           if jq -e 'index("review")' >/dev/null <<<"$labels"; then
@@ -245,6 +245,8 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
+      # reads the agent job's log and annotations, and re-enters through the router on a retry
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -433,8 +435,48 @@ jobs:
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.PATCH_WITHOUT_REQUEST_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-      - name: Flag a run that produced nothing
+      # A run that ends with nothing is not always the agent's verdict. The AI gateway can answer
+      # nothing and end the engine one turn after it began, and the runner's VM can be taken away
+      # mid-job; neither says the work was wrong, and parking them for the janitor cost up to six
+      # hours each (Pliny-Bot #693's first attempt). The shared rule repeats those, and a run that
+      # died young, within the attempt budget.
+      - name: Decide whether an empty run is worth repeating
+        id: empty_retry
         if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      - name: Report the retried empty run
+        if: steps.empty_retry.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.ATTEMPT_MARKER }}
+            Attempt ${{ steps.empty_retry.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended with nothing after ${{ steps.empty_retry.outputs.minutes }} minutes (${{ steps.empty_retry.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
+            The issue keeps `implement`.
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Send the issue back through the router
+        if: steps.empty_retry.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          ISSUE_NUMBER: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.empty_retry.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=implement -f issue-number="$ISSUE_NUMBER" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched implement for #$ISSUE_NUMBER as attempt $NEXT."
+      - name: Flag a run that produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -443,7 +485,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say the run produced nothing
-        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -478,36 +520,17 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      # The shared rule, which this worker used to carry its own copy of. It repeats a run that died
+      # young, and now also one that was killed after a long time: the runner's VM taken away
+      # mid-job, or the AI gateway answering nothing and ending the engine one turn after it began.
       - name: Decide whether this failure is worth repeating
         id: decide
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          ATTEMPTS: ${{ inputs.attempts_so_far || '0' }}
-          PARK_AT: ${{ env.PARK_AT_ATTEMPT }}
-          UNDER_MINUTES: ${{ env.RETRY_UNDER_MINUTES }}
-        run: |
-          set -euo pipefail
-          # The agent job belongs to this same run: a called workflow shares the caller's run id.
-          read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
-            --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                  | "\(.started_at // "") \(.completed_at // "")"')"
-          minutes=-1
-          if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
-            minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
-          fi
-          retry=false
-          # An unknown duration is treated as a long run: never retry on a guess.
-          if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$ATTEMPTS" -lt "$PARK_AT" ]; then
-            retry=true
-          fi
-          {
-            echo "retry=$retry"
-            echo "next=$((ATTEMPTS + 1))"
-            echo "minutes=$minutes"
-          } >> "$GITHUB_OUTPUT"
-          echo "agent job ran for ${minutes}m; attempts so far ${ATTEMPTS}; retry=${retry}"
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
       # The attempt is recorded before any label moves, so a failure in the steps below leaves a
       # run that can be counted rather than an issue released with nothing to show for it.
       - name: Report the failed attempt
@@ -518,7 +541,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           body: |
             ${{ env.ATTEMPT_MARKER }}
-            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer. That is what a provider outage looks like, so this is being retried.
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes without an answer (${{ steps.decide.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
             The issue keeps `implement`.
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
       - name: Release the reservation for the retry
@@ -703,6 +726,28 @@ timeout-minutes: 180
    phase skill it names, in order, and do not explore the code yourself where it says a phase
    is skipped.
 
+   **The pipeline is these skill loads, in this order, each a call to the Skill tool.** A run
+   that edits source files without having made them has skipped the pipeline, whatever it
+   wrote instead:
+
+   1. `pc-plan-goal`, then Phase 0 as it describes.
+   2. `pc-plan-propose`, even when the issue is refined. It is what turns the issue into
+      `openspec/changes/<id>/tasks.md` with every task annotated
+      `<!-- agent: <engineer>.<tier>, depends_on: [...], touches: [...] -->`. **You never write
+      `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
+      and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
+      you alone, in sequence, on one model. That is the failure this step exists to prevent.
+   3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
+      the model tier its annotation names. **In this phase you do not edit source files
+      yourself.** If it stops because a worker cannot be resolved, report that with
+      `report_incomplete`, naming the task and the missing worker; do not do the task yourself
+      to get past it.
+   4. `pc-repo-verify`, then `pc-plan-archive`, as `pc-plan-goal` directs.
+
+   Before the first edit to a source file, check that
+   `openspec/changes/<id>/tasks.md` exists and that its tasks carry the annotation above. If it
+   does not, you have not run `pc-plan-propose`: load it now.
+
    a. `branch` is the output mode this sandbox needs: the branch is kept, nothing is merged and
       nothing is pushed. Without it the skill merges into the local default branch and deletes
       the feature branch, and step 6 below then opens a pull request from a branch that is

package/loops/workflows/agent-merge-gate.md

@@ -37,11 +37,12 @@ env:
   # infrastructure used to stop a merge from here; they are the review pass's to look at now, and
   # a migration that rewrites data still parks through a `low` recoverability the agent evidences.
   SENSITIVE_PATHS: '(^|/)([Dd]omain|entities|[Cc]ontracts)/|(^|/)([Aa]uth|[Aa]uthn|[Aa]uthz|[Aa]uthentication|[Aa]uthorization|[Ii]dentity|[Ss]ecurity|[Mm]igrations|[Ii]nfra|terraform|helm|k8s|deploy)(/|[A-Z][A-Za-z]*\.[a-z]+$)'
-  # Diff shape. Lines decide high: a change over a thousand counted lines (tests, docs,
-  # translations and generated code excluded) is too big to merge unseen. A file count alone
-  # never does, so the high file threshold is set out of reach; spread still raises medium.
+  # Diff shape. Lines decide high: a change over ten thousand counted lines (tests, docs,
+  # translations and generated code excluded) is too big to merge unseen. It was a thousand, which
+  # is a normal feature once the tests are left out. A file count alone never decides, so the high
+  # file threshold is set out of reach; spread still raises medium.
   BLAST_HIGH_FILES: "100000"
-  BLAST_HIGH_LINES: "1000"
+  BLAST_HIGH_LINES: "10000"
   BLAST_MEDIUM_FILES: "5"
   BLAST_MEDIUM_LINES: "200"
   # Paths that change no runtime behaviour: tests, docs, specs, translations and generated
@@ -182,7 +183,6 @@ jobs:
           ci-conclusion: ${{ inputs.ci-conclusion }}
           ci-run-id: ${{ inputs.ci-run-id }}
           linked-issue: ${{ inputs.linked-issue }}
-          require-label: ${{ env.IMPLEMENT_LABEL }}
           trusted-bots: ${{ env.TRUSTED_BOTS }}
       - name: Block a pull request with requested changes
         id: review
@@ -320,8 +320,13 @@ jobs:
             echo "check-diff is not installed (agent-harness 3.2.0 or later ships it), so comments and tests were not checked." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
-          report=$(node .opencode/scripts/check-diff.mjs --base "$BASE" 2>&1)
-          code=$?
+          # `|| code=$?`, not a bare `code=$?` on the next line. GitHub runs this under `bash -e`,
+          # and `set -uo pipefail` above does not undo it, so a check-diff that exited 1 (the
+          # `fail` this step exists to report) ended the step there: the job failed, the agent
+          # was skipped, and the pull request burned its whole attempt budget on a verdict that
+          # was never recorded (Pliny-Bot #686, six attempts in twenty minutes).
+          code=0
+          report=$(node .opencode/scripts/check-diff.mjs --base "$BASE" 2>&1) || code=$?
           case "$code" in 0) result=pass ;; 1) result=fail ;; *) result=error ;; esac
           delimiter="EOF_$(openssl rand -hex 8)"
           {
@@ -691,8 +696,12 @@ jobs:
             ${{ env.OWNER_REVIEW_LABEL }}
             ${{ env.BLOCKED_LABEL }}
             ${{ env.PR_PENDING_LABEL }}
+  # A conclude that dies (a push refused, a token rejected) is a failed attempt too. Without it
+  # here the run left no verdict and no attempt comment, which the merge train reads as a gate that
+  # did nothing and never offers the pull request again: Pliny-Bot #716 sat stranded that way after
+  # its repair was computed and then lost to a rejected git fetch in conclude.
   incomplete:
-    needs: [subject, protected_changes, agent, safe_outputs, validate_output]
+    needs: [subject, protected_changes, agent, safe_outputs, validate_output, conclude]
     if: >
        always() &&
        needs.subject.outputs.found == 'true' &&
@@ -700,7 +709,8 @@ jobs:
        (
          needs.agent.result != 'success' ||
          needs.safe_outputs.result != 'success' ||
-         needs.validate_output.outputs.valid != 'true'
+         needs.validate_output.outputs.valid != 'true' ||
+         needs.conclude.result == 'failure'
        )
     runs-on: agents-arc
     permissions:

package/loops/workflows/agent-refine.md

@@ -837,9 +837,11 @@ safe-outputs:
   # was sent with an incorrect parameter shape (20 bytes, missing body) and was accepted
   # with success by the bridge, consuming the 1-per-run quota". The prompt still says to
   # send the body once.
+  # `title:` lets refine set an English title when the issue was written in another language.
   update-issue:
     target: "*"
     max: 3
+    title:
   add-comment:
   # Split children. An oversized story becomes several implementable ones rather than
   # one issue nobody can land; the cap stops a runaway decomposition.
@@ -976,6 +978,13 @@ timeout-minutes: 90
    The visible line is for people and the marker is read by the workflow, which turns it into the
    `sp-N` label. A body without the marker gets no estimate label at all.
 
+   **Everything you write is in English, whatever language the issue was written in.** Bodies,
+   child issues, comments and questions are English. When the title of the issue you are refining
+   is not English, put an English title in the same `update_issue` call as the body, as
+   `{"issue_number":N,"title":"...","body":"..."}`: it carries the same meaning, short, with no
+   language tag. People write issues in their own language, and everything the workflow produces
+   from them (pull requests, commits, the run history) is read by everyone else in English.
+
 7. **One safe-output call per turn.** Never batch multiple safe-output calls into a single
    message: `update_issue`, `create_issue` and `add_comment` each go in their own turn, with
    nothing else in the message. The provider caps one response at a fixed size, and a batch of

package/loops/workflows/work-router.yml

@@ -69,7 +69,7 @@ run-name: >-
   && format('Agentics: Merge Train - CI on PR #{0}', inputs.pr-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'merge-gate'
-  && format('Agent: Merge Gate - PR #{0}', inputs.pr-number)
+  && format('Agent: Merge Gate - PR #{0}{1}', inputs.pr-number, inputs.ci-conclusion == 'failure' && ' (repair)' || '')
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'merge-train'
   && format('Agentics: Merge Train{0}', '')
@@ -160,6 +160,15 @@ env:
   # "true" logs the move the train would make and makes none. For trying the train on a
   # repository before letting it act.
   MERGE_TRAIN_DRY_RUN: "false"
+  # How many pull requests the merge train may have in repair at once. A repair moves nothing on
+  # the default branch, so repairs of different pull requests do not race; only merges are serial.
+  # 1 repairs one pull request at a time.
+  MERGE_TRAIN_REPAIRS: "1"
+  # How many implement runs may work at once. Each queue is FIFO and serial. An issue joins the
+  # queue of its split parent when it has one, so the children of one refine never run side by
+  # side on the code they share; independent issues spread across the queues. 1 is one queue
+  # for everything, as before this existed. Raise it only with a fleet that has the VMs.
+  IMPLEMENT_PARALLELISM: "1"
   # Whether a merged pull request's verification plan is replayed and its screenshots archived on
   # the pull request (evidence.yml). It needs nothing configured: the app starts with the root
   # `pnpm run dev`, and a pull request with no plan costs one API call. Set it to "false" for a
@@ -522,7 +531,29 @@ jobs:
       stack-branch: ${{ steps.stack.outputs.stack-branch }}
       stack-in-flight: ${{ steps.inflight.outputs.stack-in-flight }}
       stack-blocked: ${{ steps.blocked.outputs.stack-blocked }}
+      implement-queue: ${{ steps.queue.outputs.queue }}
     steps:
+      # Which implement queue this issue waits in. The children of one refine share a queue,
+      # keyed on their split parent, because they build on each other's code and two of them at
+      # once would each cut from a main the other is about to change. Anything else is keyed on
+      # its own number. A body that cannot be read keys on the issue: a wrong queue only costs
+      # parallelism, never order within a feature.
+      - name: Pick the implement queue
+        id: queue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
+        run: |
+          set -euo pipefail
+          queues="${IMPLEMENT_PARALLELISM:-1}"
+          case "$queues" in ''|*[!0-9]*|0) queues=1 ;; esac
+          body=$(gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo '')
+          parent=$(printf '%s' "$body" | grep -oE '<!-- split-parent: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
+          key="${parent:-$ISSUE_NUMBER}"
+          queue=$(( key % queues ))
+          echo "queue=$queue" >> "$GITHUB_OUTPUT"
+          echo "#$ISSUE_NUMBER waits in implement queue $queue of $queues (keyed on #$key)."
       - name: Resolve the feature branch from the stack markers
         id: stack
         env:
@@ -645,8 +676,10 @@ jobs:
     needs: [classify, authorize, check-implement-pr, check-stack-branch]
     if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true' && needs.check-stack-branch.outputs.is-stack != 'true'
     uses: ./.github/workflows/agent-implement.lock.yml
+    # One FIFO queue per IMPLEMENT_PARALLELISM slot, chosen by check-stack-branch: the children of
+    # one refine always share a queue, independent issues spread across them.
     concurrency:
-      group: implement-global
+      group: implement-queue-${{ needs.check-stack-branch.outputs.implement-queue || '0' }}
       cancel-in-progress: false
       # FIFO, up to 100 waiting. Without this the default `queue: single` cancels whatever
       # was pending, so labelling six issues at once implements one and drops the rest.
@@ -793,8 +826,12 @@ jobs:
     needs: classify
     if: needs.classify.outputs.route == 'merge-gate'
     uses: ./.github/workflows/agent-merge-gate.lock.yml
+    # A gate that was handed red CI repairs and pushes: it can never merge (the validator blocks a
+    # non-success conclusion), so it moves nothing on the default branch and cannot race another
+    # gate. Those run in a group of their own per pull request, in parallel, while everything that
+    # may merge still waits its turn on the one belt.
     concurrency:
-      group: merge-belt
+      group: ${{ needs.classify.outputs.ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number) || 'merge-belt' }}
       cancel-in-progress: false
       queue: max
     permissions: write-all
@@ -865,6 +902,7 @@ jobs:
           hold-label: ${{ env.MERGE_TRAIN_HOLD_LABEL }}
           max-gate-attempts: ${{ env.MAX_GATE_ATTEMPTS }}
           max-retries: ${{ env.MERGE_TRAIN_MAX_RETRIES }}
+          max-repairs: ${{ env.MERGE_TRAIN_REPAIRS }}
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
           ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
@@ -1254,19 +1292,28 @@ jobs:
           set -euo pipefail
 
           # Stale reservation sweep. Labelling ten issues at once labels all ten immediately,
-          # because authorize-bot-work is keyed per issue, while implement-global lets exactly
+          # because authorize-bot-work is keyed per issue, while each implement queue lets exactly
           # one run at a time. A queued run that is cancelled therefore leaves its issue
           # carrying bot-working with no run and no pull request: parked, invisible, and not
           # re-triggerable, because classify refuses an issue that is already reserved.
+          #
+          # The live runs are read by status, not as the repository's latest hundred runs. Every
+          # comment and label is a router run, so a busy repository pushes an implement that has
+          # waited two hours in the queue out of the latest hundred, and the sweep then cleared
+          # bot-working from issues whose runs were alive and about to start (Pliny-Bot #693 and
+          # #707, both still queued from 07:32). Runs that are not finished are few, whatever
+          # their age.
+          active_runs=$(for status in queued in_progress pending waiting requested; do
+              gh api "repos/$REPO/actions/runs?status=$status&per_page=100" --jq '.workflow_runs[]' 2>/dev/null || true
+            done | jq -s '{workflow_runs: .}')
           gh issue list --repo "$REPO" --label bot-working --state open --limit 100 \
             --json number --jq '.[].number' |
             while IFS= read -r issue; do
               [ -n "$issue" ] || continue
 
-              live=$(gh api "repos/$REPO/actions/runs?per_page=100" \
-                --jq "[.workflow_runs[]
+              live=$(jq "[.workflow_runs[]
                   | select(.status == \"queued\" or .status == \"in_progress\" or .status == \"pending\" or .status == \"waiting\")
-                  | select((.display_title + \" \") | test(\"#${issue}[^0-9]\"))] | length")
+                  | select((.display_title + \" \") | test(\"#${issue}[^0-9]\"))] | length" <<<"$active_runs")
               [ "${live:-0}" -eq 0 ] || continue
 
               has_pr=$(gh pr list --repo "$REPO" --state open --json body \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.0",
+  "version": "1.6.10",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -25,6 +25,13 @@
     "loops",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public",
+    "prepack": "node ./scripts/copy-loops.mjs"
+  },
   "engines": {
     "node": ">=20.19"
   },
@@ -35,11 +42,5 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
-  },
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit --project tsconfig.json",
-    "release": "pnpm build && pnpm test && npm publish --access public"
   }
-}
+}