@plot-pm/board 0.14.3 → 0.15.0

package/plot-host.sh

@@ -19,7 +19,18 @@
 #                                 than a transient to retry. Adding a host is
 #                                 an edit to `HOST_DRIVES` and the arms below,
 #                                 and to nothing in `packages/domain`.
-#   default-branch                print the repo's default branch name
+#   default-branch                print the repo's default branch name. THE HOST
+#                                 IS ASKED, on both backends, and the local
+#                                 `origin/HEAD` is the fallback where it cannot
+#                                 answer — that ref is a clone-time cache and a
+#                                 default branch moved since then never updates
+#                                 it. Prints "" where neither can answer.
+#   account                       print the signed-in host user, read from the
+#                                 CLI's config file (no API request).
+#                                 `PLOT_BUDGET_ACCOUNT` overrides it. Exit 3
+#                                 where GitHub's `hosts.yml` names no user;
+#                                 exit 4 on Bitbucket, which stores no username
+#                                 for free. Never prints `unknown`.
 #   pr-state <number|branch> [--repo <owner/repo>]   one JSON object:
 #                                   {"number":N,"state":"OPEN|MERGED|CLOSED|NONE",
 #                                    "draft":true|false,"url":"..."}
@@ -61,6 +72,30 @@
 #   pr-ready <number>              take a PR out of draft
 #                                 merge the PR
 #   pr-list [--state open|merged|closed|all] [--limit N] [--rich]
+#                                 [--since <iso>] narrows the listing to pull
+#                                 requests the host has seen change since that
+#                                 stamp. Measured 2026-09-21 on this repository:
+#                                 one `--state all` over 933 pull requests takes
+#                                 29 811 ms with the fields the board needs, and
+#                                 the same call over one day takes 943 ms for 3
+#                                 rows — factor 32, with every expensive field
+#                                 still included.
+#                                 THE STAMP IS THE HOST'S OWN, passed through
+#                                 byte-for-byte: a caller that re-renders it
+#                                 sends its own clock's spelling, and a client
+#                                 two seconds fast excludes the PRs updated in
+#                                 that gap from every later window — forever,
+#                                 because the window never reopens.
+#                                 GITHUB NARROWS AND BITBUCKET'S BULK LISTING
+#                                 CANNOT. `gh pr list` takes `--search`; `bb pr
+#                                 list` has no query flag at all (verified
+#                                 against bb 1.9.0: `unknown flag: --query`), so
+#                                 only the per-branch sweep's REST `q=` can
+#                                 carry it. The bulk Bitbucket listing SAYS it
+#                                 could not narrow and answers in full, because
+#                                 a full answer reported as a delta is what
+#                                 would let a caller advance a watermark over a
+#                                 window it never applied.
 #                                 [--repo <owner/repo>] pins the list to ONE
 #                                 repository, exactly as pr-state and pr-merged
 #                                 do. A checkout with remotes on two hosts lets
@@ -70,7 +105,24 @@
 #                                 JSON lines: {"number":N,"title":"...",
 #                                 "state":"...","head":"..."}
 #                                 --rich adds: draft, checks, mergeable, review,
-#                                 url, failing_checks — `failing_checks` names
+#                                 url, updatedAt, failing_checks —
+#                                 `updatedAt` is WHEN THE HOST LAST SAW THE PR
+#                                 CHANGE, in the host's own words and on the
+#                                 host's own clock (`updatedAt` on GitHub,
+#                                 `updated_on` on Bitbucket), "" where the CLI
+#                                 omits it. It is the field a durable store
+#                                 advances its watermark by, and it is the
+#                                 host's rather than this machine's because a
+#                                 client clock two seconds fast would exclude
+#                                 every PR updated in that gap from every later
+#                                 window — permanently, and silently.
+#                                 Measured 2026-09-21: over 937 PRs,
+#                                 `number,updatedAt` is 4715 ms against 5417 ms
+#                                 for the base fields and 18842 ms for
+#                                 `statusCheckRollup`. Asked on --rich ONLY —
+#                                 the plain arm is the cheap one and no shell
+#                                 caller reads a watermark.
+#                                 `failing_checks` names
 #                                 WHICH checks failed, the detail `checks`
 #                                 collapses to one word, from the same response
 #                                 at no extra call; [] on bitbucket and wherever
@@ -718,6 +770,24 @@ bb_branch_query() { # $1=branch $2=adapter state; rest=global bb args → values
   local _br="$1" _st="$2"; shift 2
   local _q _path _out _rc
   _q="state=$(url_encode "\"$(bb_query_state "$_st")\"") AND source.branch.name=$(url_encode "\"$_br\"")"
+  # THE WINDOW COMPOSES WITH THE STATE FILTER AND NEVER REPLACES IT. Bitbucket
+  # takes ONE `q=` parameter, so a second one would silently win or lose
+  # depending on the host's parsing — and either way the state clause this query
+  # is built around would be the term at risk. `AND` is the same conjunction the
+  # two terms above already use.
+  #
+  # ENCODED LIKE EVERY OTHER TERM ON THIS PATH, and an ISO stamp needs it: `:`
+  # and `-` are not in `url_encode`'s safe set, and the block header records
+  # what an unencoded value costs — `/` ends the filter early, so the query asks
+  # about one thing and answers about another.
+  #
+  # `>=` RATHER THAN `>`, and the asymmetry with the GitHub arm is deliberate.
+  # Bitbucket's `updated_on` carries microseconds and GitHub's stamp does not,
+  # so an exclusive comparison against a truncated stamp would drop a PR updated
+  # inside the same second. Re-reading one row the caller already holds costs a
+  # row; missing one costs a change nobody ever sees again.
+  [ -n "$PR_LIST_SINCE" ] \
+    && _q="$_q AND updated_on>=$(url_encode "\"$PR_LIST_SINCE\"")"
   # The space between the two terms is encoded too; `bb api` passes the path to
   # curl verbatim and an unencoded space would truncate the request line.
   _q="${_q// /%20}"
@@ -824,6 +894,19 @@ bb_branch_sweep() { # global bb args… --state <s> --json → one JSON array
 # separator is git's guarantee rather than a hopeful convention.
 PR_LIST_BRANCHES=""
 
+# The window a sweep's query carries, the host's own stamp. Empty means ask
+# about everything, which is what every caller predating `--since` asks.
+#
+# A GLOBAL FOR `PR_LIST_BRANCHES`' REASON, and it travels the same route: the
+# `pr-list` arm sets it immediately before the call, `bb_branch_sweep` passes
+# through without reading it, and `bb_branch_query` composes it into the one
+# `q=` Bitbucket takes. Threading it through the sweep as an argument would mean
+# teaching that function a parameter it only forwards, and its header already
+# refuses the mirror of that — "teaching `pr_list_states` which of its commands
+# is a sweep would put a backend's shape inside the one piece of this file that
+# has none."
+PR_LIST_SINCE=""
+
 # How many branches the last sweep asked about, and how many answered.
 #
 # THE COMPLETENESS SIGNAL, AND WHY THE ARM STATES IT RATHER THAN THE SCAN
@@ -2469,6 +2552,18 @@ backend() {
 # written beside it.
 . "$here/plot-budget.sh"
 
+# THE MEMO IS SWEPT ON THE WAY OUT. `budget_rate` caches its reading under
+# `$PLOT_BUDGET_HOME/memo/$$` because a command substitution is a subshell and a
+# variable set inside one does not survive it — see the block above
+# `budget_rate`. A directory keyed on a pid must be removed by the process that
+# made it, or a long-lived machine accumulates one per `plot-host.sh` call.
+#
+# `EXIT` ALONE, deliberately. It runs on a normal return and on an uncaught
+# signal's default termination path is irrelevant here: the sweep is an
+# optimisation's housekeeping, and a cache that outlives one run costs a stale
+# reading at worst, which is the same staleness the memo grants by design.
+trap 'budget_memo_clear' EXIT
+
 # WHO IS SPENDING — read from the CLI's own config, never from an API call.
 #
 # `gh api user` would answer authoritatively and cost one request against the
@@ -2912,14 +3007,77 @@ case "$op" in
     ;;
 
   default-branch)
+    # THE HOST IS ASKED FIRST, ON BOTH BACKENDS, and `origin/HEAD` is the
+    # fallback rather than the answer. `origin/HEAD` is a LOCAL CACHE WRITTEN AT
+    # CLONE TIME: a default branch changed afterwards never updates it and
+    # nothing in git notices. Reported 2026-09-24 — a clone whose GitHub default
+    # had moved to `develop` kept `origin/HEAD → main`, the board read plans from
+    # `origin/main`, and two of three plans went missing.
+    #
+    # THE BITBUCKET ARM ASKED THE CACHE FIRST UNTIL 2026-09-25, so on Bitbucket
+    # this op answered from the very cache it exists to bypass, the two readings
+    # could never disagree, and the defect was invisible there. Every caller —
+    # `plot-open-pr.sh:73`, `plot-approve.sh:205`, `plot-deliver.sh:218`,
+    # `plot-reap.sh:176`, `plot-release-refs.sh:162`, `/plot-idea:252` — wants
+    # the branch the host calls default, which is what this now answers.
+    #
+    # AND THE FALLBACK WAS DEAD CODE. `git symbolic-ref … | sed … || bb …` takes
+    # the PIPELINE's exit status, which is `sed`'s, and `sed` exits 0 on empty
+    # input — measured 2026-09-25 against a ref that does not exist. So `bb repo
+    # view` had never once been reached, and a Bitbucket clone with no
+    # `origin/HEAD` printed an empty line and exited 0. Each reading is now
+    # tested for a NON-EMPTY value of its own, never for a pipeline's status.
+    _db=""
     if [ "$be" = "github" ]; then
-      gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'
+      _db=$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null || true)
     else
-      # Symbolic ref of origin/HEAD is host-neutral and offline; fall back to
-      # the bb API only when the local clone has no origin/HEAD.
-      git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||' \
-        || bb repo view --json 2>/dev/null | jq -r '.mainbranch.name'
+      # `--json` IS A CAPABILITY, NOT A GIVEN. Two products share the name `bb`
+      # and craftamap's rejects the flag (see `bb_require_json`) — against it
+      # this call emits `unknown flag: --json`, `jq` reads non-JSON, and the arm
+      # would answer nothing while exiting 0. This call was unguarded while it
+      # was unreachable; asking the host makes it live.
+      bb_require_json
+      _db=$(bb repo view --json 2>/dev/null | jq -r '.mainbranch.name // empty' 2>/dev/null || true)
     fi
+    # `null` is what `jq` prints for an absent field and it is not a branch name.
+    [ "$_db" = "null" ] && _db=""
+    # THE CACHE IS THE FALLBACK: a host that cannot be asked is not a reason to
+    # answer nothing, since every caller above needs a usable branch name and
+    # worked from this reading alone before today.
+    [ -n "$_db" ] || _db=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')
+    printf '%s\n' "$_db"
+    ;;
+
+  account)
+    # WHO IS READING, from the same free reading `budget_account` makes. It
+    # costs a file read and no request, which matters because the board asks on
+    # its timer. `PLOT_BUDGET_ACCOUNT` overrides it on every backend.
+    #
+    # THE BITBUCKET ARM IS NOT EXPOSED. `budget_account bitbucket` answers the
+    # remote's owner segment, which is the WORKSPACE: on a team workspace every
+    # contributor gets the same word, and it matches no PR author. Measured
+    # 2026-09-25, neither `bb` stores a username for free. Quatico's keeps only
+    # the Atlassian email, in the Keychain. craftamap's keeps an email in
+    # `configuration.toml`. A Bitbucket PR author carries a nickname, an
+    # account id and a uuid, and never an email. So this backend has no answer,
+    # and exit 4 says so.
+    #
+    # `unknown` IS NEVER PRINTED. It groups budget lines correctly and names
+    # nobody, so an unreadable `hosts.yml` exits 3 with the reason on stderr.
+    _acct=''
+    if [ -n "${PLOT_BUDGET_ACCOUNT:-}" ]; then
+      _acct="$PLOT_BUDGET_ACCOUNT"
+    elif [ "$be" = "github" ]; then
+      _acct="$(budget_account github)"
+    else
+      echo "plot-host.sh: account: $be names no signed-in user without an API request" >&2
+      exit 4
+    fi
+    if [ -z "$_acct" ] || [ "$_acct" = "unknown" ]; then
+      echo "plot-host.sh: account: no user in ${GH_CONFIG_DIR:-$HOME/.config/gh}/hosts.yml" >&2
+      exit 3
+    fi
+    printf '%s\n' "$_acct"
     ;;
 
   pr-state)
@@ -3302,12 +3460,22 @@ case "$op" in
     # existing caller's result changes.
     limit=""
     branches=""
+    # THE WINDOW, AND IT IS THE HOST'S OWN STAMP. Empty means ask about
+    # everything, which is what every caller predating this asks and what a
+    # caller with no stored watermark must ask. A caller that has one sends it
+    # verbatim — see the header: re-rendering it is how a window closes forever.
+    since=""
     while [ $# -gt 0 ]; do
       case "$1" in
         --state) state="${2:?}"; shift 2 ;;
         --limit) limit="${2:?}"; shift 2 ;;
         --rich) rich=1; shift ;;
         --repo) repo_args=(-R "${2:?}"); shift 2 ;;
+        # `${2:?}` REFUSES AN EMPTY VALUE, and that is the point rather than
+        # boilerplate. `--since ""` would reach GitHub as `--search "updated:>"`,
+        # a syntax error the host may answer with everything or with nothing —
+        # and a caller whose watermark was null would send exactly that.
+        --since) since="${2:?}"; shift 2 ;;
         # THE BRANCHES THE CALLER TRACKS, repeatable, and OPT-IN. Given any,
         # the Bitbucket arm sweeps the REST endpoint once per branch per state
         # instead of listing the repository; given none, every existing caller
@@ -3328,6 +3496,23 @@ case "$op" in
     done
     limit_args=()
     [ -n "$limit" ] && limit_args=(--limit "$limit")
+    # THE WINDOW AS GITHUB TAKES IT, built once and appended at all three call
+    # sites — the same argument `pr_list_call`'s header makes about the six
+    # hand-applied fixes: three sites each composing their own search string is
+    # three places for the next window's shape to drift.
+    #
+    # `updated:>` is EXCLUSIVE, and that is the safe direction here. The
+    # watermark is the stamp of a row the caller has ALREADY stored, so
+    # excluding it re-asks nothing; including it would re-fetch that row every
+    # pass for no new information. A PR updated in the same second as the
+    # watermark is the one this can miss, and the periodic full read the caller
+    # is required to keep making is what corrects it.
+    #
+    # THE STAMP IS NOT QUOTED INSIDE THE QUERY. `gh` sends `--search`'s value as
+    # one API parameter and an ISO-8601 stamp carries no space, so a quote would
+    # travel to GitHub as part of the term and match nothing.
+    search_args=()
+    [ -n "$since" ] && search_args=(--search "updated:>$since")
 
     # --- Jenkins CI integration (orthogonal to Git host) ---
     # When `CI: jenkins` is configured, build status comes from Jenkins rather
@@ -3438,8 +3623,8 @@ case "$op" in
           #   $jstatus != "ok"  → Jenkins could not answer; every row `unknown`.
           #   $jentry == null   → the branch has no Jenkins job; `none`.
           #   otherwise         → the joined colour's `checks`, job named on fail.
-          _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} \
-            --json number,title,state,headRefName,isDraft,mergeable,mergeStateStatus,reviewDecision,url)" || exit $?
+          _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
+            --json number,title,state,headRefName,isDraft,mergeable,mergeStateStatus,reviewDecision,url,updatedAt,author)" || exit $?
           pr_list_report_truncation github "$limit" "$state" \
             "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
           printf '%s' "$_gh_raw" \
@@ -3459,6 +3644,8 @@ case "$op" in
                   else "unknown" end),
                 review:(.reviewDecision // ""),
                 url:.url,
+                updatedAt:(.updatedAt // ""),
+                author:(.author.login // ""),
                 failing_checks:(
                   if $jentry != null and $jentry.checks == "failing"
                   then [$jentry.job]
@@ -3467,8 +3654,8 @@ case "$op" in
               }'
         else
           # GitHub without Jenkins (or Jenkins not configured): use GitHub rollup
-          _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} \
-            --json number,title,state,headRefName,isDraft,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision,url)" || exit $?
+          _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
+            --json number,title,state,headRefName,isDraft,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision,url,updatedAt,author)" || exit $?
           pr_list_report_truncation github "$limit" "$state" \
             "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
           printf '%s' "$_gh_raw" \
@@ -3490,6 +3677,8 @@ case "$op" in
                   else "unknown" end),
                 review:(.reviewDecision // ""),
                 url:.url,
+                updatedAt:(.updatedAt // ""),
+                author:(.author.login // ""),
                 failing_checks:[
                   .statusCheckRollup[]? | select((if (.conclusion // "") != "" then .conclusion else (.status // .state) end) as $c
                     | $c=="FAILURE" or $c=="ERROR" or $c=="CANCELLED"
@@ -3498,14 +3687,20 @@ case "$op" in
               }'
         fi
       else
-        _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} \
-          --json number,title,state,headRefName)" || exit $?
+        _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
+          --json number,title,state,headRefName,author)" || exit $?
         pr_list_report_truncation github "$limit" "$state" \
           "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
         printf '%s' "$_gh_raw" \
-          | jq -c '.[] | {number:.number,title:.title,state:.state,head:.headRefName}'
+          | jq -c '.[] | {number:.number,title:.title,state:.state,head:.headRefName,author:(.author.login // "")}'
       fi
     else
+      # `author` IS THE `nickname`, the one handle field a Bitbucket user
+      # object carries. Measured 2026-09-25 against bb 1.9.0: `author` holds
+      # `display_name`, `nickname`, `account_id` and `uuid` and no username,
+      # and on a Quatico workspace `nickname` equals the display name. GitHub's
+      # arm reads `.author.login`. Both answer `""` where the host omits it.
+      #
       # Bitbucket carries no check rollup through `bb pr list`, and no
       # mergeability verdict either. Rather than guess, --rich reports
       # checks:"unknown" and mergeable:"unknown" — a consumer must render those
@@ -3543,6 +3738,23 @@ case "$op" in
       # ways, which is how the six hand-applied fixes `pr_list_call` warns about
       # began. One assignment here; the sites are untouched but for this word.
       PR_LIST_BRANCHES="$branches"
+      # THE WINDOW REACHES THE SWEEP AND NOT THE LISTING, and the asymmetry is
+      # the CLI's rather than a choice. `bb pr list` takes `--state`, `--author`,
+      # `--json` and `--jq` and no query flag at all — verified against bb 1.9.0,
+      # which answers `unknown flag: --query` — so the only Bitbucket path that
+      # can carry `updated_on` is `bb_branch_query`'s own REST `q=`.
+      #
+      # SAID RATHER THAN SWALLOWED, for the reason `--limit` two blocks up is
+      # said: a caller that asked for a window and got a full listing must not
+      # read the answer as a delta. It would advance its watermark over a window
+      # it never applied — harmless this pass, since a full listing holds every
+      # row a narrow one would, and wrong the moment the caller uses the flag to
+      # decide whether its answer was complete.
+      PR_LIST_SINCE="$since"
+      if [ -n "$since" ] && [ -z "$branches" ]; then
+        echo "plot-host: bitbucket ignores --since $since on a listing; bb pr list has no query flag (bb 1.9.0) — answering in full" >&2
+        PR_LIST_SINCE=""
+      fi
       PR_SWEEP_ASKED=0
       bb_cmd=(bb ${repo_args[@]+"${repo_args[@]}"} pr list)
       if [ -n "$branches" ]; then
@@ -3574,6 +3786,8 @@ case "$op" in
                   mergeable:"unknown",
                   review:"",
                   url:(.links.html.href // ""),
+                  updatedAt:(.updated_on // ""),
+                  author:(.author.nickname // ""),
                   failing_checks:(
                     if $jentry != null and $jentry.checks == "failing"
                     then [$jentry.job]
@@ -3584,13 +3798,13 @@ case "$op" in
           # Bitbucket without Jenkins: checks remain unknown
           PR_LIST_JQ_ARGS=()
           pr_list_states bitbucket "$limit" "$bb_states" \
-            '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,draft:(.draft // false),checks:"unknown",mergeable:"unknown",review:"",url:(.links.html.href // ""),failing_checks:[]}' \
+            '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,draft:(.draft // false),checks:"unknown",mergeable:"unknown",review:"",url:(.links.html.href // ""),updatedAt:(.updated_on // ""),author:(.author.nickname // ""),failing_checks:[]}' \
             "${bb_cmd[@]}" || exit $?
         fi
       else
         PR_LIST_JQ_ARGS=()
         pr_list_states bitbucket "$limit" "$bb_states" \
-          '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name}' \
+          '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,author:(.author.nickname // "")}' \
           "${bb_cmd[@]}" || exit $?
       fi
     fi

package/plot-plan-meta.sh

@@ -107,8 +107,9 @@
 #                  placeholder
 #   story          story slug the plan belongs to (`## Status` `Story:` or
 #                  front matter `story:`); "" if absent or a placeholder
-#   assignee       github handle from the `## Approval` `Assignee:` line or
-#                  front matter `assignee:`; "" if absent
+#   assignee       github handle from front matter `assignee:`, else the
+#                  `## Approval` `Assignee:` line, else the `## Status`
+#                  `Assignee:` line; "" if absent or a placeholder
 #   branches       branch names, sorted and unique, read from EITHER spelling:
 #                  the old `## Branches` section (a LIST ITEM whose first token
 #                  is the backtick-quoted name, matching the known prefixes) OR
@@ -415,7 +416,7 @@ function reset_state() {
   fm_delivered = ""; fm_design = ""
   fm_rounds = ""
   canon_state = ""; canon_phase = ""; canon_type = ""
-  canon_sprint = ""; canon_story = ""; canon_assignee = ""
+  canon_sprint = ""; canon_story = ""; canon_assignee = ""; status_assignee = ""
   canon_review = ""; canon_impl = ""; canon_approved = ""; canon_released = ""
   canon_delivered = ""; canon_design = ""
   canon_rounds = ""
@@ -478,6 +479,9 @@ function emit_record(   fmt, praw, palt_raw, traw, title, sprint, story, assigne
   sprint   = strip_placeholder((fm_sprint   != "") ? fm_sprint   : canon_sprint)
   story    = strip_placeholder((fm_story    != "") ? fm_story    : canon_story)
   assignee = strip_placeholder((fm_assignee != "") ? fm_assignee : canon_assignee)
+  # `## Status` is the section both templates offer; `## Approval` is older and
+  # outranks it, so a plan writing both keeps the answer it parsed to before.
+  if (fm_assignee == "" && assignee == "") assignee = status_assignee
   review   = strip_placeholder((fm_review   != "") ? fm_review   : canon_review)
   impl     = strip_placeholder((fm_impl     != "") ? fm_impl     : canon_impl)
   design   = strip_placeholder((fm_design   != "") ? fm_design   : canon_design)
@@ -823,6 +827,9 @@ section == "status" {
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**issue[:*]/ && canon_issue == "") canon_issue = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**review[:*]/ && canon_review == "") canon_review = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**impl[:*]/ && canon_impl == "") canon_impl = val_after_colon($0)
+  # Its own slot, not `canon_assignee`: the `## Approval` line outranks this one
+  # in `emit_record`, whichever section comes first.
+  else if (lower ~ /^[ \t]*[-*]?[ \t]*\**assignee[:*]/ && status_assignee == "") status_assignee = strip_placeholder(val_after_colon($0))
   # EACH TAKES THE FIRST LINE THAT CARRIES A VALUE, NOT THE FIRST LINE.
   #
   # A plan may hold both a record and an unfilled placeholder for the same

package/plot-pr-merged.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Plot helper: the ONE answer to "did the host merge ANY PR for this branch?"
 #
-# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged` and
-# `pr_open`; the file does nothing else on load. That is what makes sourcing it
+# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged`,
+# `pr_open` and `pr_merged_heads`; the file does nothing else on load. That is what makes sourcing it
 # safe, and it is the same shape — and the same reason — as
 # `plot-worker-state.sh`: the logic could not simply stay in `plot-reap.sh`,
 # because that file parses `$@` and `exit 2`s on an unknown argument at load
@@ -178,3 +178,30 @@ pr_open() {
   answer=$(_plot_landed none "$(_plot_open_lookup "$1")") || return 1
   case "$answer" in *"	open-pr") return 0 ;; *) return 1 ;; esac
 }
+
+# Which commits did the host merge for this branch? One `headRefOid` per merged
+# PR, one per line.
+#
+# A THIRD QUESTION, asked by `plot-reap.sh` only. After a squash merge the
+# host deletes the branch (`delete_branch_on_merge`), `git fetch --prune`
+# drops the remote-tracking ref, and the branch's own commits are then on no
+# remote ref at all. So "which commits did no remote ever hold?" needs the
+# head the host merged: a commit reachable from it was pushed; a commit beyond
+# it exists only on the desk.
+#
+# Returns 1 when the host cannot be asked. The caller reads that as
+# `unknown`, which keeps the desk: here a failure to observe is the case that
+# loses work. It prints nothing and returns 0 when the host answered and no PR
+# merged.
+pr_merged_heads() {
+  local br="$1" out
+  command -v gh >/dev/null 2>&1 || return 1
+  out=$(gh pr list --head "$br" --state all --limit 100 --json mergedAt,headRefOid 2>/dev/null) \
+    || return 1
+  printf '%s' "$out" | node -e '
+let s = "";
+process.stdin.on("data", (d) => { s += d; }).on("end", () => {
+  const rows = JSON.parse(s);
+  for (const r of rows) if (r.mergedAt && r.headRefOid) console.log(r.headRefOid);
+});' 2>/dev/null || return 1
+}