@plainconceptsplatform/workflows 1.6.0 → 1.6.11

package/loops/actions/decide-agent-retry/action.yml

@@ -25,6 +25,9 @@ outputs:
   minutes:
     description: How long the agent job ran, or -1 when that could not be read.
     value: ${{ steps.decide.outputs.minutes }}
+  cause:
+    description: 'Why a retry was chosen: short-run, runner-shutdown or cut-off. "none" when there is none.'
+    value: ${{ steps.decide.outputs.cause }}
 runs:
   using: composite
   steps:
@@ -33,6 +36,13 @@ runs:
     # repeating it buys the same wrong answer half an hour later. Duration is what separates them,
     # and it needs no model and no log parsing to read.
     #
+    # Except when the long run was killed rather than wrong. The VM was deleted under a forty
+    # minute implement (Pliny-Bot #699), and an AI gateway that answered nothing ended another
+    # run one turn after it began (#693's first attempt): neither is a verdict on the work, and
+    # both waited six hours for the janitor. classify-failure.sh reads those two from the job's
+    # annotations and from the line above the sandbox teardown, and they are repeated whatever
+    # the run lasted, within the same attempt budget.
+    #
     # Written once here because the rule was in the implement worker alone, and refine, triage and
     # apply-review parked instead -- an Odyssey refine died in three minutes on
     # `Model 'glm-5-2' not found`, a gateway fault that clears in seconds, and waited on the
@@ -44,15 +54,16 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
         REPO: ${{ github.repository }}
         RUN_ID: ${{ github.run_id }}
+        ACTION_PATH: ${{ github.action_path }}
         ATTEMPTS: ${{ inputs.attempts-so-far }}
         PARK_AT: ${{ inputs.park-at }}
         UNDER_MINUTES: ${{ inputs.under-minutes }}
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -60,13 +71,30 @@ runs:
         attempts="${ATTEMPTS:-0}"
         [ -n "$attempts" ] || attempts=0
         retry=false
+        cause=none
         # An unknown duration is treated as a long run: never retry on a guess.
         if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$attempts" -lt "$PARK_AT" ]; then
           retry=true
+          cause=short-run
+        fi
+        # A long run is repeated only when it was killed, not when it was wrong. The reads are best
+        # effort: a log or an annotation list that cannot be fetched leaves the run parked, exactly
+        # as before this check existed.
+        if [ "$retry" != true ] && [ "$attempts" -lt "$PARK_AT" ] && [ -n "${job_id:-}" ]; then
+          work="$(mktemp -d)"
+          gh api "repos/$REPO/check-runs/$job_id/annotations" --paginate --jq '.[].message' >"$work/annotations" 2>/dev/null || true
+          gh api "repos/$REPO/actions/jobs/$job_id/logs" >"$work/log" 2>/dev/null || true
+          kind="$(bash "$ACTION_PATH/classify-failure.sh" "$work/log" "$work/annotations" || echo none)"
+          if [ "$kind" != none ]; then
+            retry=true
+            cause="$kind"
+          fi
+          rm -rf "$work"
         fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"
           echo "minutes=$minutes"
+          echo "cause=$cause"
         } >> "$GITHUB_OUTPUT"
-        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}"
+        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}; cause=${cause}"

package/loops/actions/decide-agent-retry/classify-failure.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/decide-agent-retry/classify-failure.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Say why an agent job died, when the reason is one that repeating the run fixes.
+#
+# Duration alone could not tell the difference. A run that dies in three minutes produced nothing;
+# a run that works for forty minutes and is then killed by its machine produced nothing either, and
+# was parked for the janitor's six-hourly sweep as if the agent had been wrong. Two causes are
+# infrastructure, not judgement:
+#
+#   runner-shutdown  the VM was taken away mid-job: the process is killed with SIGTERM and GitHub
+#                    annotates the job "Process completed with exit code 143" (the log has the
+#                    longer "The runner has received a shutdown signal"), whatever the model was
+#                    doing. 137, a SIGKILL, is left out: an out-of-memory kill repeats itself
+#   cut-off          the engine was stopped one turn after it started: the last thing the log shows
+#                    before the sandbox stops is the header opencode prints when it sends a request
+#                    to the model, with no reply under it. The AI gateway answered nothing, or an
+#                    error opencode did not surface, and the run ended with the work unsaid
+#
+# A tool's output in the log can quote either phrase, so neither is searched for in the body: the
+# shutdown is read from the annotations, which only GitHub writes, and the cut-off from the one line
+# immediately above the sandbox teardown.
+#
+# Usage: classify-failure.sh LOG_FILE ANNOTATIONS_FILE
+# Prints one word: runner-shutdown, cut-off or none.
+
+set -euo pipefail
+
+log="${1:-}"
+annotations="${2:-}"
+
+if [ -n "$annotations" ] && [ -f "$annotations" ] && grep -qiE 'exit code 143|runner has received a shutdown signal|lost communication with the server|runner.*(was|has been) (deleted|terminated)' "$annotations"; then
+  echo runner-shutdown
+  exit 0
+fi
+
+if [ -n "$log" ] && [ -f "$log" ]; then
+  # The line the sandbox teardown starts on. grep exits 1 for none, which is an answer here.
+  stop=$(grep -n '\[INFO\] Stopping containers' "$log" | head -1 | cut -d: -f1 || true)
+  if [ -n "$stop" ] && [ "$stop" -gt 1 ]; then
+    # The last line with any text above it, ignoring the ANSI colour codes opencode wraps its
+    # output in and the timestamp every runner line carries.
+    last=$(sed -n "1,$((stop - 1))p" "$log" | sed -E 's/\x1b\[[0-9;]*m//g' | grep -vE '^(\S+Z )?[[:space:]]*$' | tail -1 || true)
+    if printf '%s' "$last" | grep -qE '^(\S+Z )?> [A-Za-z0-9_.-]+ · [A-Za-z0-9_./:-]+[[:space:]]*$'; then
+      echo cut-off
+      exit 0
+    fi
+  fi
+fi
+
+echo none

package/loops/actions/housekeeping/action.yml

@@ -71,13 +71,33 @@ runs:
           // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
           // logic below can never free because the run never reaches a terminal state. This
           // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
+          //
+          // Only a run with nothing live ahead of it. The router queues implement runs FIFO
+          // (`queue: max`) so that labelling six issues at once implements all six, one after the
+          // other, and each of those takes an hour: the sixth waits five hours legitimately. A
+          // flat one-hour cutoff cancelled every run behind the first, which left its issue
+          // carrying bot-working with no run until the sweep cleared it (Pliny-Bot #706 and #644,
+          // both cancelled while #693 ran). A pending run is stuck when no run of its own kind
+          // ("Agent: Implement", "Agent: Merge Gate") is running or queued to hold the group.
           const stuckCutoff = Date.now() - 3600 * 1000; // 1 hour ago
+          const runKind = (run) => String(run.display_title || '').split(' - ')[0];
+          const liveKinds = new Set();
+          for (const status of ['in_progress', 'queued']) {
+            for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
+              owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
+              status, per_page: 50,
+            })) liveKinds.add(runKind(run));
+          }
           let cancelledRuns = 0;
           for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
             owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
             status: 'pending', per_page: 50,
           })) {
             if (new Date(run.created_at).getTime() > stuckCutoff) continue;
+            if (liveKinds.has(runKind(run))) {
+              core.info(`run #${run.id} (${run.display_title}) waits behind a live ${runKind(run)} run; not stuck`);
+              continue;
+            }
             await act(`cancelling stuck pending run #${run.id} (queued ${new Date(run.created_at).toISOString()})`, async () => {
               await github.rest.actions.cancelWorkflowRun({
                 owner: context.repo.owner, repo: context.repo.repo, run_id: run.id,

package/loops/actions/identify-gate-subject/action.yml

@@ -1,6 +1,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
 name: Identify gate subject
-description: Confirm the pull request is one the gate may act on, resolve the issue it closes, and check a bot pull request's issue carries the required label.
+description: Confirm the pull request is one the gate may act on (same repository, opened by a trusted bot or someone with write access) and resolve the open issue it closes, if any.
 inputs:
   token:
     description: GitHub token with issues and pull-requests read access.
@@ -24,10 +24,6 @@ inputs:
     description: Issue the pull request closes, when the router already resolved it.
     required: false
     default: ''
-  require-label:
-    description: Label a bot pull request's closing issue must carry. Empty disables the check. A person's pull request needs neither an issue nor the label.
-    required: false
-    default: ''
 outputs:
   found:
     description: Whether a valid gate subject was found.
@@ -66,7 +62,6 @@ runs:
         CONCLUSION: ${{ inputs.ci-conclusion }}
         CI_RUN_ID: ${{ inputs.ci-run-id }}
         LINKED_ISSUE: ${{ inputs.linked-issue }}
-        REQUIRE_LABEL: ${{ inputs.require-label }}
         TRUSTED_BOTS: ${{ inputs.trusted-bots }}
       run: |
         set -euo pipefail
@@ -115,19 +110,16 @@ runs:
             grep -oE '[0-9]+' | head -n 1 || true)"
         fi
 
-        # The bot only opens a pull request for an issue it was given, so one that closes none, or
-        # whose issue lost the label, is not work the gate was handed. A person's pull request is
-        # gated on its own description when it closes nothing.
-        if [ "$bot" = true ]; then
-          [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
-        fi
-
-        if [ "$bot" = true ] && [ -n "$REQUIRE_LABEL" ]; then
-          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
-            --jq '[.labels[].name]')"
-
-          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
-            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
+        # An issue that is already closed is not the work this pull request is for: the feature
+        # landed some other way, and the label on a closed issue says nothing. Comments, labels
+        # and the acceptance criteria then come from the pull request itself. A pull request is
+        # never refused for lacking an issue: the merge train hands the gate every pull request
+        # that can move, and a gate that declines one without a trace is handed it again.
+        if [ -n "$issue" ]; then
+          issue_state="$(gh issue view "$issue" --repo "$REPO" --json state --jq '.state' 2>/dev/null || echo UNKNOWN)"
+          if [ "$issue_state" != OPEN ]; then
+            echo "Issue #$issue is $issue_state; gating the pull request on its own description."
+            issue=""
           fi
         fi
 
@@ -140,6 +132,31 @@ runs:
         # both stalled on a human that way while CI was legitimately red and remediable.
         ci_conclusion="$CONCLUSION"
         ci_run_id="$CI_RUN_ID"
+
+        # A verdict from a CI run that judged an older head is not a verdict on this one. The
+        # router carries the run it saw, and the head can move before the gate starts: a repair
+        # pushed, a branch updated from main. Pliny-Bot #729 was blocked and sent to review on a
+        # red run of a commit that two later pushes had already fixed, and the gate's own report
+        # said so. When the run's commit is not the head, the carried verdict is dropped and read
+        # again from the head's own latest run; when that head has no finished run yet, there is
+        # nothing to judge, and the gate steps aside until CI finishes and the train hands the
+        # pull request back.
+        if [ -n "$ci_run_id" ]; then
+          run_sha="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.head_sha' 2>/dev/null || true)"
+          current_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ]; then
+            echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
+            ci_conclusion=""
+            ci_run_id=""
+            fresh="$(gh api "repos/$REPO/actions/runs?head_sha=$current_sha&per_page=100"               --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci") | select(.status == "completed")] | sort_by(.created_at) | last')"
+            if [ -z "$fresh" ] || [ "$fresh" = "null" ]; then
+              none "CI has not finished on the current head of PR #$PR_NUMBER; the train hands it back when it has"
+            fi
+            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$fresh")"
+            ci_run_id="$(jq -r '.id' <<<"$fresh")"
+          fi
+        fi
+
         if [ -z "$ci_conclusion" ] || [ -z "$ci_run_id" ]; then
           head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
           # A run keeps the name it had when it ran, so a repository whose CI was renamed still

package/loops/actions/merge-train/action.yml

@@ -28,6 +28,10 @@ inputs:
     description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
     required: false
     default: '3'
+  max-repairs:
+    description: How many pull requests may be in repair at once. Merges stay one at a time.
+    required: false
+    default: '1'
   stuck-hours:
     description: How long the train waits behind a CI run that never finishes before it passes that pull request by.
     required: false
@@ -60,6 +64,7 @@ runs:
         MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
         MAX_RETRIES: ${{ inputs.max-retries }}
         STUCK_HOURS: ${{ inputs.stuck-hours }}
+        MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}

package/loops/actions/merge-train/merge-train.sh

@@ -1,19 +1,20 @@
 #!/usr/bin/env bash
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-train/merge-train.sh. Update with `workflows update --force`; consumer edits may be overwritten.
-# Move the merge train one step: the oldest open pull request that can move, and only that one.
+# Move the merge train: look at every open pull request, oldest first, and do for each the one
+# thing it needs, with merges one at a time and repairs in parallel.
 #
 # The belt this replaces dispatched the gate for every eligible pull request at once. Each gate
 # then resolved its branch against a default branch the gate ahead of it was about to move, so a
 # night of ten pull requests became ten repairs, ten CI runs and ten more gates after every merge,
-# and a verdict that parked a pull request held it however stale it went. The train keeps one
-# pull request in flight, lowest number first. Everything else waits, untouched, until the one in
-# front of it has merged or been parked for a person.
+# and a verdict that parked a pull request held it however stale it went.
 #
-# One tick does at most one thing:
-#   wait     the front pull request's CI is still running, or a gate is already on the belt
-#   update   it is green but behind the default branch: merge the default branch in, CI reruns
-#   gate     it is green and current, red, or conflicting: the merge gate repairs or merges it
+# What races is a merge, because it moves the default branch under everyone else. A repair (a gate
+# handed red CI) pushes to its own branch and can never merge, so it races nothing. So:
+#   merge    one at a time, the oldest ready pull request first; nothing behind a pull request that
+#            is waiting on its CI, or behind a gate that may merge, merges or is brought up to date
+#   repair   a red or conflicting pull request goes to the gate at once, up to MAX_REPAIRS together
 #   approve  its CI is waiting for approval and a trusted bot opened it
+#   update   it is green but behind the default branch: merge the default branch in, CI reruns
 # A pull request a person has to decide on, or that carries the hold label, is skipped, so it never
 # blocks the line. Ticks come from every merge, every CI completion, every finished gate, and the
 # hourly schedule as the fallback.
@@ -27,11 +28,20 @@ set -euo pipefail
 #   HOLD               true when the pull request carries the hold label
 #   REVIEW_DECISION    GitHub's review decision (CHANGES_REQUESTED holds it for its author)
 #   PARK               none, or held when a standing gate verdict covers this head
-#   ATTEMPTS           failed gate attempts on this head; MAX_ATTEMPTS is the budget
+#   ATTEMPTS           failed gate attempts on this head; MAX_ATTEMPTS is the budget. Counts the
+#                      larger of the attempt comments and the gate runs, so a gate that fails
+#                      without a comment still spends it
+#   SILENT_GATE        true when a gate already ran on this head and left no verdict and no attempt
+#                      comment: it declined, or died before it could say so. Handing it the same
+#                      pull request again reproduces that, a hot loop with every tick
 #   MERGEABLE          MERGEABLE, CONFLICTING or UNKNOWN
 #   CI_STATUS          none, or the latest CI run's status (queued, in_progress, completed, ...)
 #   CI_CONCLUSION      that run's conclusion when it completed
 #   CI_STUCK           true when that run has been pending longer than the train waits
+#   SAME_AS_MAIN       true when every check that failed on the head also fails on the base branch
+#                      tip: the failure is the base's, and repairing the pull request spends its
+#                      attempts on code that is not at fault (Pliny-Bot, 2026-10-17: a red main
+#                      cost every open pull request its repairs for seven hours)
 #   BEHIND_BY          commits on the base branch the head does not have
 #   TRUSTED_AUTHOR     true when a trusted bot opened it (only those runs are approved)
 train_move() {
@@ -45,6 +55,8 @@ train_move() {
     move=skip; reason="a gate verdict on this head is waiting for a person"
   elif [ "${ATTEMPTS:-0}" -ge "${MAX_ATTEMPTS:-6}" ]; then
     move=skip; reason="its gate attempt budget on this head is spent"
+  elif [ "${SILENT_GATE:-false}" = true ]; then
+    move=skip; reason="its gate already ran on this head and left no verdict or attempt"
   elif [ "${MERGEABLE:-UNKNOWN}" = CONFLICTING ]; then
     # A conflicting pull request has no merge ref, so CI can never run on it: waiting for a
     # verdict would wait forever. Resolving the conflict is the gate's job.
@@ -62,7 +74,13 @@ train_move() {
               move=gate; reason="green and up to date"
             fi
             ;;
-          failure) move=gate; reason="CI failed" ;;
+          failure)
+            if [ "${SAME_AS_MAIN:-false}" = true ]; then
+              move="wait"; reason="CI failed, but only on checks that fail on the base branch too; waiting for the base to be fixed"
+            else
+              move=gate; reason="CI failed"
+            fi
+            ;;
           action_required)
             if [ "${TRUSTED_AUTHOR:-false}" = true ]; then
               move=approve; reason="CI is waiting for approval"
@@ -126,6 +144,8 @@ TRUSTED_BOTS="${TRUSTED_BOTS:-}"
 HOLD_LABEL="${HOLD_LABEL:-hold}"
 MAX_ATTEMPTS="${MAX_ATTEMPTS:-6}"
 MAX_RETRIES="${MAX_RETRIES:-3}"
+MAX_REPAIRS="${MAX_REPAIRS:-1}"
+case "$MAX_REPAIRS" in ''|*[!0-9]*|0) MAX_REPAIRS=1 ;; esac
 STUCK_HOURS="${STUCK_HOURS:-3}"
 DRY_RUN="${DRY_RUN:-false}"
 SELF_RUN_ID="${GITHUB_RUN_ID:-0}"
@@ -168,18 +188,18 @@ can_ride() {
   [ "${WRITE_ACCESS[$login]}" = true ]
 }
 
-# One gate at a time across the repository. A gate dispatched by a tick, by a person or by a
-# consumer CI is a router run titled by run-name; the run this tick belongs to is excluded,
-# because the tick after a gate runs inside the gate's own router run.
-live_gate() {
+# The gates on the belt, one title per line. A gate handed red CI repairs and pushes and cannot
+# merge, so run-name gives it a " (repair)" suffix and the router queues it per pull request;
+# every other gate may merge, and there is one of those at a time across the repository. The run
+# this tick belongs to is excluded: the tick after a gate runs inside the gate's own router run.
+live_gates() {
   local status
   for status in queued in_progress waiting pending requested; do
-    gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
-      --jq ".workflow_runs[]
+    gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100"       --jq ".workflow_runs[]
         | select(.id != $SELF_RUN_ID)
         | select(.display_title | startswith(\"$GATE_TITLE_PREFIX\"))
-        | .display_title" 2>/dev/null | head -1
-  done | head -1
+        | .display_title" 2>/dev/null
+  done | sort -u
 }
 
 # GitHub works mergeability out on demand: the first read of a pull request nobody has opened
@@ -220,6 +240,14 @@ update_branch() {
   gh api "repos/$REPO/pulls/$pr/update-branch" --method PUT -f expected_head_sha="$head_sha" >/dev/null
 }
 
+# How many gate runs were started for a pull request since a moment, whatever became of them. A
+# run is titled by the router's run-name; this is the one count that does not depend on the gate
+# having written anything.
+gate_run_count() {
+  local pr="$1" since="$2"
+  gh api --paginate "repos/$REPO/actions/workflows/work-router.yml/runs?event=workflow_dispatch&per_page=100"     --jq "[.workflow_runs[] | select(.display_title == \"$GATE_TITLE_PREFIX$pr\") | select(.created_at > \"$since\")] | length"     2>/dev/null | awk '{ n += $1 } END { print n + 0 }'
+}
+
 attempt_count() {
   local number="$1" since="$2"
   gh api --paginate "repos/$REPO/issues/$number/comments?per_page=100" \
@@ -241,7 +269,7 @@ dispatch_gate() {
   # The next tick waits behind this one and must see the gate it started, or it starts a second.
   for _ in $(seq 1 12); do
     if gh api "repos/$REPO/actions/workflows/work-router.yml/runs?event=workflow_dispatch&created=>=$since&per_page=20" \
-      --jq ".workflow_runs[] | select(.display_title == \"$GATE_TITLE_PREFIX$pr\") | .id" 2>/dev/null | grep -q .; then
+      --jq ".workflow_runs[] | select(.display_title | startswith(\"$GATE_TITLE_PREFIX$pr\")) | .id" 2>/dev/null | grep -q .; then
       return 0
     fi
     sleep 5
@@ -252,11 +280,21 @@ dispatch_gate() {
 summary "### Merge train"
 summary ""
 
-if gate=$(live_gate) && [ -n "$gate" ]; then
-  echo "A gate is already on the belt (${gate}); the train waits for it."
-  summary "Waiting: \`${gate}\` is on the belt."
-  exit 0
-fi
+live_titles="$(live_gates)"
+live_repairs=$(printf '%s
+' "$live_titles" | grep -c ' (repair)$' || true)
+live_merge=$(printf '%s
+' "$live_titles" | grep -v ' (repair)$' | grep -c . || true)
+live_for_pr() { printf '%s
+' "$live_titles" | grep -qE "PR #$1( \(repair\))?$"; }
+echo "On the belt: ${live_merge} merging gate(s), ${live_repairs} repair(s). Up to ${MAX_REPAIRS} repair(s) at once."
+summary "On the belt: ${live_merge} merging gate(s), ${live_repairs} repair(s); up to ${MAX_REPAIRS} repair(s) at once."
+summary ""
+
+# Once a pull request ahead is waiting on its CI, or a gate that may merge is on the belt, nothing
+# behind it may merge or be brought up to date: the oldest merges first, and one at a time.
+merge_blocked=false
+[ "$live_merge" -eq 0 ] || merge_blocked=true
 
 base_head_date=""
 base_head_date_for() {
@@ -332,6 +370,7 @@ for line in "${candidates[@]}"; do
     RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" train_park)
 
   attempts=0
+  silent_gate=false
   if [ "$park" = none ]; then
     horizon="${head_committed:-1970-01-01T00:00:00Z}"
     # A retried verdict starts a fresh budget from the verdict it retries, not from the head.
@@ -340,6 +379,12 @@ for line in "${candidates[@]}"; do
     if [ -n "$linked_issue" ]; then
       attempts=$((attempts + $(attempt_count "$linked_issue" "$horizon")))
     fi
+    gate_runs=$(gate_run_count "$pr" "$horizon")
+    # Comments say what the gate decided. Runs say it was asked. A run on this head that left no
+    # attempt comment and no verdict is a gate that did nothing, and the next tick must not ask
+    # again: that is the loop.
+    if [ "$gate_runs" -gt 0 ] && [ "$attempts" -eq 0 ]; then silent_gate=true; fi
+    [ "$gate_runs" -le "$attempts" ] || attempts="$gate_runs"
   fi
 
   ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
@@ -368,36 +413,71 @@ for line in "${candidates[@]}"; do
     fi
   fi
 
+  # What failed on the head, compared with what is failing on the base branch tip. Names are
+  # compared after the last " / ": a check that a reusable workflow runs is "CI / backend" on the
+  # base branch and "backend" on a pull request. Only when every failed check is also failing on
+  # the base is the pull request left alone.
+  same_as_main=false
+  if [ "$ci_status" = completed ] && [ "$ci_conclusion" = failure ] && [ "$park" = none ]; then
+    failed_here=$(gh api "repos/$REPO/commits/$head_sha/check-runs?per_page=100" \
+      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
+    failed_base=$(gh api "repos/$REPO/commits/$base_ref/check-runs?per_page=100" \
+      --jq '[.check_runs[] | select(.conclusion == "failure") | (.name | sub("^.* / "; ""))] | unique | .[]' 2>/dev/null || true)
+    if [ -n "$failed_here" ] && [ -n "$failed_base" ] &&
+      [ -z "$(comm -23 <(sort <<<"$failed_here") <(sort <<<"$failed_base"))" ]; then
+      same_as_main=true
+    fi
+  fi
+
   trusted_author=false
   is_trusted_bot "$author" && trusted_author=true
 
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
-    ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" MERGEABLE="$mergeable" \
-    CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" \
+    ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
+    CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" SAME_AS_MAIN="$same_as_main" \
     BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")
 
+  # A gate is already on this pull request, whatever kind: offering it another would run the same
+  # work twice. It does not hold the line up for the repair kind; a merging gate already does.
+  if [ "$move" != skip ] && live_for_pr "$pr"; then
+    move=skip
+    reason="a gate is already on it"
+  fi
+
   echo "#$pr ($author): $move, $reason."
   summary "| #$pr | $author | $move | $reason |"
 
   case "$move" in
     skip) continue ;;
-    wait) exit 0 ;;
+    wait)
+      # Its CI is running: nothing behind it may merge or be brought up to date first, but the
+      # pull requests behind it that need repair do not wait for anyone.
+      merge_blocked=true
+      continue
+      ;;
     approve)
       act "Approving the CI runs waiting on #$pr." approve_runs "$head_ref"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
     update)
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr waits for the pull request ahead of it before it is brought up to date."
+        continue
+      fi
       # Merge, never rebase: the gate's pushes are fast-forward only, and so are a person's.
       if act "Merging $base_ref into #$pr so CI judges it against what it will land on." \
         update_branch "$pr" "$head_sha"; then
-        exit 0
+        merge_blocked=true
+        continue
       fi
       echo "::warning::GitHub could not update #$pr from $base_ref; handing it to the gate."
       act "Dispatching the merge gate for #$pr to bring it up to date." \
         dispatch_gate "$pr" success "${ci_run_id:-}" "$attempts"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
     gate)
       conclusion="${ci_conclusion:-}"
@@ -412,13 +492,30 @@ for line in "${candidates[@]}"; do
         conclusion=$(cut -f2 <<<"$last")
         [ -n "$conclusion" ] || conclusion=failure
       fi
+      if [ "$conclusion" = failure ]; then
+        # A repair: it pushes and can never merge, so it races nothing. Up to MAX_REPAIRS at once.
+        if [ "$live_repairs" -ge "$MAX_REPAIRS" ]; then
+          echo "  #$pr needs a repair; ${live_repairs} already in progress, the limit is ${MAX_REPAIRS}."
+          continue
+        fi
+        act "Dispatching a repair gate for #$pr (CI failed, attempt $((attempts + 1)) of $MAX_ATTEMPTS)." \
+          dispatch_gate "$pr" failure "${ci_run_id:-}" "$attempts"
+        live_repairs=$((live_repairs + 1))
+        continue
+      fi
+      # CI is green on the verdict: this gate may merge, so it goes only when nothing is ahead of it.
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr is ready for the gate; it waits for the pull request ahead of it."
+        continue
+      fi
       act "Dispatching the merge gate for #$pr (CI $conclusion, attempt $((attempts + 1)) of $MAX_ATTEMPTS)." \
         dispatch_gate "$pr" "$conclusion" "${ci_run_id:-}" "$attempts"
-      exit 0
+      merge_blocked=true
+      continue
       ;;
   esac
 done
 
-echo "Nothing on the train can move: every open pull request is parked, held or has no CI verdict."
+echo "That is every open pull request this tick could move."
 summary ""
-summary "Nothing can move: every open pull request is parked, held or has no CI verdict."
+summary "Every open pull request was looked at; those that could move have."

package/loops/actions/push-agent-branch/action.yml

@@ -24,7 +24,20 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.token }}
       run: |
-        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
+        set -euo pipefail
+        # The runners here outlive their jobs, and `git config --global` outlives the job with
+        # them. This step used to add one `url.<token>.insteadOf` rule per run and never remove it,
+        # so a runner that had pushed before held several rules for the same prefix, each carrying
+        # a token revoked since, and git picks among equal-length matches arbitrarily. The same
+        # gate pushed for one pull request and was refused for the next: "Invalid username or
+        # token", then "Target branch does not exist" because ls-remote exited 128 (Pliny-Bot #716
+        # failed twice that way while #717 pushed in between). Drop every such rule wherever it
+        # lives, and set this run's rule in the checkout only.
+        for scope in --global --local; do
+          git config "$scope" --get-regexp '^url\..*x-access-token.*\.insteadof$' 2>/dev/null |
+            while read -r key _; do git config "$scope" --unset-all "$key" || true; done || true
+        done
+        git config --local url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
     - name: Read pull request branch
       id: request
       shell: bash