automata-cli 0.1.0-feature-030-do-work.214 → 0.1.0-feature-030-do-work.218

package/dist/{ConfigWizard-5MOWNA7O.js → ConfigWizard-5B5AOGUU.js}

@@ -9,7 +9,7 @@ import {
   readConfig,
   readRawConfig,
   writeConfig
-} from "./chunk-5ZRROOCC.js";
+} from "./chunk-LTCVLM4I.js";
 
 // src/config/ConfigWizard.tsx
 import { useState } from "react";
@@ -147,6 +147,9 @@ function ConfigWizard() {
   );
   const initialExecutorIndex = EXECUTOR_OPTIONS.findIndex((o) => o.value === existing.doWork?.executor);
   const [doWorkExecutorIndex, setDoWorkExecutorIndex] = useState(Math.max(initialExecutorIndex, 0));
+  const [doWorkProtectedBranches, setDoWorkProtectedBranches] = useState(
+    (existing.doWork?.protectedBranches ?? DEFAULT_DO_WORK.protectedBranches).join(", ")
+  );
   const [doWorkClaudeModel, setDoWorkClaudeModel] = useState(existing.doWork?.models?.claude ?? "");
   const [doWorkCodexModel, setDoWorkCodexModel] = useState(existing.doWork?.models?.codex ?? "");
   const [doWorkLockStale, setDoWorkLockStale] = useState(
@@ -246,9 +249,24 @@ function ConfigWizard() {
     },
     "do-work-base-branch": {
       setValue: setDoWorkBaseBranch,
-      onSubmit: () => setScreen("do-work-executor"),
+      onSubmit: () => setScreen("do-work-protected-branches"),
       onBack: () => setScreen("main")
     },
+    "do-work-protected-branches": {
+      setValue: (update) => {
+        setValidationError("");
+        setDoWorkProtectedBranches(update);
+      },
+      onSubmit: () => {
+        if (parseAllowedUsers(doWorkProtectedBranches).length === 0) {
+          setValidationError("Enter at least one branch name.");
+          return;
+        }
+        setValidationError("");
+        setScreen("do-work-executor");
+      },
+      onBack: () => setScreen("do-work-base-branch")
+    },
     "do-work-claude-model": {
       setValue: setDoWorkClaudeModel,
       onSubmit: () => setScreen("do-work-codex-model"),
@@ -293,6 +311,7 @@ function ConfigWizard() {
           doWork: {
             ...current.doWork,
             baseBranch: doWorkBaseBranch.trim() || void 0,
+            protectedBranches: parseAllowedUsers(doWorkProtectedBranches),
             executor: EXECUTOR_OPTIONS[doWorkExecutorIndex].value,
             models: {
               claude: doWorkClaudeModel.trim() || void 0,
@@ -375,7 +394,7 @@ function ConfigWizard() {
       length: EXECUTOR_OPTIONS.length,
       setIndex: setDoWorkExecutorIndex,
       onSelect: () => setScreen("do-work-claude-model"),
-      onBack: () => setScreen("do-work-base-branch")
+      onBack: () => setScreen("do-work-protected-branches")
     }
   };
   useInput((input, key) => {
@@ -439,6 +458,12 @@ function ConfigWizard() {
       value: doWorkBaseBranch,
       hint: `Type branch \xB7 Enter to continue \xB7 ${BACK}`
     },
+    "do-work-protected-branches": {
+      title: "Do Work \u2014 Protected Branches",
+      label: "Branches a build turn must never push to (comma separated):",
+      value: doWorkProtectedBranches,
+      hint: `Type branches \xB7 Enter to continue \xB7 ${BACK}`
+    },
     "do-work-claude-model": {
       title: "Do Work \u2014 Claude Model",
       label: "Default model when the executor is Claude (blank = the executor's own default):",

package/dist/{chunk-5ZRROOCC.js → chunk-LTCVLM4I.js}

@@ -9,6 +9,7 @@ var DEFAULT_SONAR_PROMPT = "You are an expert software engineer. You have been g
 var DEFAULT_CHECK_ISSUE_PROMPT = "You are an expert software engineer working on a GitHub issue. Below is the conversation on that issue, restricted to the people allowed to instruct you and your own previous replies. Messages marked as new arrived after your last run: treat them as the current instruction and read the earlier messages only as context. Do what the new messages ask, following the project's existing conventions and style, and make minimal, targeted changes. Run tests and linting before finishing, then reply on the issue with a short summary of what you did.";
 var DEFAULT_DO_WORK = {
   baseBranch: "develop",
+  protectedBranches: ["main", "master"],
   executor: "claude",
   maxRunsPerTick: 0,
   lockStaleMinutes: 120

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   readConfig,
   readRawConfig,
   writeConfig
-} from "./chunk-5ZRROOCC.js";
+} from "./chunk-LTCVLM4I.js";
 
 // src/index.ts
 import { Command as Command7 } from "commander";
@@ -109,6 +109,16 @@ var configSetDoWorkBaseBranch = new Command("do-work-base-branch").description("
   process.stdout.write(`do-work base branch set to: ${branch}
 `);
 });
+var configSetDoWorkProtectedBranches = new Command("do-work-protected-branches").description("Set the branches a `do-work` build turn must never check out and push to").argument("<value>", `Comma-separated branch names (default: ${DEFAULT_DO_WORK.protectedBranches.join(",")})`).action((value) => {
+  const branches = value.split(",").map((branch) => branch.trim()).filter((branch) => branch.length > 0);
+  if (branches.length === 0) {
+    process.stderr.write("Error: do-work-protected-branches requires at least one branch name.\n");
+    process.exit(1);
+  }
+  writeDoWork({ protectedBranches: branches });
+  process.stdout.write(`do-work protected branches set to: ${branches.join(", ")}
+`);
+});
 var configSetDoWorkExecutor = new Command("do-work-executor").description("Set the default executor `do-work` invokes").argument("<value>", `Executor: ${VALID_EXECUTORS.join(", ")}`).action((value) => {
   if (!VALID_EXECUTORS.includes(value)) {
     process.stderr.write(`Error: invalid executor "${value}". Must be one of: ${VALID_EXECUTORS.join(", ")}
@@ -179,12 +189,12 @@ var configSetDoWorkPrompt = new Command("do-work-prompt").description("Set the t
   process.stdout.write(`do-work ${turnKind} prompt set.
 `);
 });
-var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkPrompt);
+var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkPrompt);
 var configCommand = new Command("config").description("Configure automata settings").addCommand(configSet).action(async () => {
   const [{ render }, React, { ConfigWizard }] = await Promise.all([
     import("ink"),
     import("react"),
-    import("./ConfigWizard-5MOWNA7O.js")
+    import("./ConfigWizard-5B5AOGUU.js")
   ]);
   const { waitUntilExit } = render(React.createElement(ConfigWizard));
   await waitUntilExit();
@@ -2350,6 +2360,10 @@ function login(author) {
 function byCreatedAt2(a, b) {
   return a.createdAt.localeCompare(b.createdAt);
 }
+function visibleAt(createdAt, submittedAt) {
+  if (submittedAt === null || submittedAt === void 0) return createdAt;
+  return submittedAt > createdAt ? submittedAt : createdAt;
+}
 function getRepoSlug() {
   const { stdout, status } = run4("git", ["remote", "get-url", "origin"]);
   if (status !== 0) {
@@ -2502,7 +2516,7 @@ query($owner:String!,$repo:String!,$prNumber:Int!,$cursor:String){
           isResolved isOutdated path line
           comments(last:100){
             pageInfo{ hasPreviousPage }
-            nodes{ author{login} body createdAt url }
+            nodes{ author{login} body createdAt url pullRequestReview{ submittedAt } }
           }
         }
       }
@@ -2553,7 +2567,14 @@ function getReviewThreads(prNumber) {
           kind: "thread-comment",
           author: login(comment.author),
           body: comment.body,
-          createdAt: comment.createdAt
+          // When the comment became *visible*, not when it was drafted.
+          // GitHub stamps `createdAt` the moment a comment is added to a
+          // pending review, and it only becomes visible when the review is
+          // submitted — minutes later for a human working through a diff.
+          // Using `createdAt` let an agent answer posted in between look newer
+          // than the review, which marked every one of its threads answered
+          // and discarded the whole review silently.
+          createdAt: visibleAt(comment.createdAt, comment.pullRequestReview?.submittedAt)
         })).sort(byCreatedAt2)
       });
     }
@@ -2696,7 +2717,32 @@ function newestPr(prs) {
 function plural(count, noun) {
   return `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
 }
-function decideWork(state, p, baseBranch, defaultBranch = null) {
+function protectedHeads(policy) {
+  return [policy.baseBranch, policy.defaultBranch ?? "", ...policy.protectedBranches ?? []].filter(
+    (branch) => branch.length > 0
+  );
+}
+function unsafeBranchSkip(pr, issue, policy) {
+  if (pr.isCrossRepository) {
+    return {
+      kind: "skip",
+      issue,
+      reason: "unsafe-pr-branch",
+      detail: `pull request #${String(pr.number)} comes from a fork; its head branch is not in this repository`
+    };
+  }
+  if (protectedHeads(policy).includes(pr.headRefName)) {
+    return {
+      kind: "skip",
+      issue,
+      reason: "unsafe-pr-branch",
+      detail: `pull request #${String(pr.number)} has a protected branch (${pr.headRefName}) as its head, so a turn would have to push to it`
+    };
+  }
+  return null;
+}
+function decideWork(state, p, policy) {
+  const baseBranch = policy.baseBranch;
   const { issueSurface, prSurface } = state;
   const issue = issueSurface.issue;
   if (issueSurface.state === "CLOSED") {
@@ -2732,25 +2778,8 @@ function decideWork(state, p, baseBranch, defaultBranch = null) {
     };
   }
   const surface = prSurface;
-  if (surface.pr.isCrossRepository) {
-    return {
-      kind: "skip",
-      issue,
-      reason: "unsafe-pr-branch",
-      detail: `pull request #${String(surface.pr.number)} comes from a fork; its head branch is not in this repository`
-    };
-  }
-  const protectedHead = [baseBranch, defaultBranch].filter(
-    (branch) => branch !== null && branch.length > 0
-  );
-  if (protectedHead.includes(surface.pr.headRefName)) {
-    return {
-      kind: "skip",
-      issue,
-      reason: "unsafe-pr-branch",
-      detail: `pull request #${String(surface.pr.number)} has a protected branch (${surface.pr.headRefName}) as its head, so a turn would have to push to it`
-    };
-  }
+  const unsafe = unsafeBranchSkip(surface.pr, issue, policy);
+  if (unsafe !== null) return unsafe;
   const agentThreadMessages = surface.threads.flatMap((thread) => thread.comments).filter((comment) => comment.author.toLowerCase() === p.agentUser.toLowerCase());
   const prAnalysis = analyzeSurface([...surface.messages, ...agentThreadMessages], p);
   const actionableThreads = findActionableThreads(surface.threads, p, prAnalysis.lastAgentAt);
@@ -2873,15 +2902,21 @@ function isAuthorized(author, p) {
   const login2 = author.toLowerCase();
   return login2 !== p.agentUser.toLowerCase() && p.allowedUsers.some((user) => user.toLowerCase() === login2);
 }
-function promptWatermark(analysed) {
+function promptWatermark(messageSets) {
   let watermark = null;
-  for (const surface of analysed) {
-    for (const message of surface.messages) {
+  for (const messages of messageSets) {
+    for (const message of messages) {
       if (watermark === null || message.createdAt > watermark) watermark = message.createdAt;
     }
   }
   return watermark;
 }
+function messagesBetween(messages, p, watermark, until) {
+  const since = watermark ?? "";
+  return messages.filter(
+    (message) => isAuthorized(message.author, p) && message.createdAt > since && message.createdAt <= until
+  );
+}
 function analyseAnswer(messages, p, marker, watermark) {
   let answeredAt = null;
   for (const message of messages) {
@@ -2894,12 +2929,12 @@ function analyseAnswer(messages, p, marker, watermark) {
   const toReport = messages.filter(
     (message) => isAuthorized(message.author, p) && message.createdAt > since
   );
-  const missed = answeredAt === null ? [] : toReport.filter((message) => message.createdAt < answeredAt);
+  const missed = answeredAt === null ? [] : toReport.filter((message) => message.createdAt <= answeredAt);
   return { answeredAt, missed, toReport };
 }
 
 // src/run/runLock.ts
-import { writeFileSync, readFileSync as readFileSync3, unlinkSync, mkdirSync, renameSync, linkSync } from "fs";
+import { writeFileSync, readFileSync as readFileSync3, unlinkSync, mkdirSync, renameSync, linkSync, statSync } from "fs";
 import { randomUUID } from "crypto";
 import { hostname } from "os";
 import { join as join2 } from "path";
@@ -2999,7 +3034,7 @@ function makeHandle(path, token) {
     }
   };
 }
-function write(path, command, token, flag = "wx") {
+function publishLock(path, command, token) {
   const owner = {
     pid: process.pid,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -3008,17 +3043,31 @@ function write(path, command, token, flag = "wx") {
     token,
     pidStartedAt: processStartedAt(process.pid) ?? void 0
   };
-  writeFileSync(path, JSON.stringify(owner, null, 2) + "\n", { encoding: "utf8", flag });
+  const staging = `${path}.staging.${token}`;
+  try {
+    writeFileSync(staging, JSON.stringify(owner, null, 2) + "\n", { encoding: "utf8", flag: "wx" });
+  } catch {
+    return false;
+  }
+  try {
+    linkSync(staging, path);
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    return false;
+  } finally {
+    try {
+      unlinkSync(staging);
+    } catch {
+    }
+  }
 }
 function acquireRunLock(command, staleMinutes) {
   const path = lockPath();
   const token = randomUUID();
   mkdirSync(join2(process.cwd(), LOCK_DIR), { recursive: true });
-  try {
-    write(path, command, token);
+  if (publishLock(path, command, token)) {
     return { ok: true, handle: makeHandle(path, token) };
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
   }
   const owner = readOwner(path);
   if (!isStale(owner, staleMinutes)) {
@@ -3071,11 +3120,14 @@ function acquireClaim(path) {
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
   }
+  if (!claimIsAbandoned(claimPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync3(claimPath, "utf8"));
-    const at = raw.at === void 0 ? Number.NaN : Date.parse(raw.at);
-    if (!Number.isNaN(at) && Date.now() - at < CLAIM_STALE_MS) return null;
-    unlinkSync(claimPath);
+    renameSync(claimPath, `${claimPath}.abandoned.${String(process.pid)}`);
+  } catch {
+    return null;
+  }
+  try {
+    unlinkSync(`${claimPath}.abandoned.${String(process.pid)}`);
   } catch {
   }
   try {
@@ -3088,10 +3140,28 @@ function acquireClaim(path) {
     return null;
   }
 }
+function claimIsAbandoned(claimPath) {
+  let at = Number.NaN;
+  try {
+    const raw = JSON.parse(readFileSync3(claimPath, "utf8"));
+    if (raw.at !== void 0) at = Date.parse(raw.at);
+  } catch {
+  }
+  if (Number.isNaN(at)) {
+    try {
+      at = statSync(claimPath).mtimeMs;
+    } catch {
+      return true;
+    }
+  }
+  return Date.now() - at >= CLAIM_STALE_MS;
+}
 function reclaim(path, command, token, expected) {
   const claimPath = acquireClaim(path);
   if (claimPath === null) {
-    return { ok: false, heldBy: readOwner(path) ?? UNKNOWN_OWNER, suspect: false };
+    const owner = readOwner(path);
+    const ownerDead = owner !== null && owner.host === hostname() && !isAlive(owner.pid);
+    return { ok: false, heldBy: owner ?? UNKNOWN_OWNER, suspect: ownerDead };
   }
   try {
     if (!claimStaleLock(path, token, expected)) {
@@ -3099,10 +3169,9 @@ function reclaim(path, command, token, expected) {
     }
     const claimed = `${path}.stale.${token}`;
     try {
-      write(path, command, token, "wx");
-      return { ok: true, handle: makeHandle(path, token) };
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
+      if (publishLock(path, command, token)) {
+        return { ok: true, handle: makeHandle(path, token) };
+      }
       return { ok: false, heldBy: readOwner(path) ?? UNKNOWN_OWNER, suspect: false };
     } finally {
       try {
@@ -3224,6 +3293,7 @@ function resolveSettings(options) {
   }
   return {
     baseBranch: doWork.baseBranch ?? DEFAULT_DO_WORK.baseBranch,
+    protectedBranches: doWork.protectedBranches ?? DEFAULT_DO_WORK.protectedBranches,
     executor,
     // --model wins; otherwise take the default for the executor in use.
     model: options.model ?? doWork.models?.[executor],
@@ -3331,6 +3401,12 @@ function validateDoWorkConfig(section) {
   validateOptionalString(section, "baseBranch", "doWork.baseBranch");
   validateOptionalInt(section, "maxRunsPerTick", "doWork.maxRunsPerTick", 0, "a non-negative integer (0 = unlimited)");
   validateOptionalInt(section, "lockStaleMinutes", "doWork.lockStaleMinutes", 1, "a positive integer");
+  const protectedBranches = section["protectedBranches"];
+  if (protectedBranches !== void 0 && protectedBranches !== null) {
+    if (!Array.isArray(protectedBranches) || protectedBranches.some((b) => typeof b !== "string" || b.trim().length === 0)) {
+      fail("doWork.protectedBranches must be an array of non-empty strings.");
+    }
+  }
   for (const container of ["models", "prompts"]) {
     const value = section[container];
     if (value === void 0 || value === null) continue;
@@ -3414,16 +3490,13 @@ function claimIssue(item, settings) {
   }
 }
 function notePickupOnIssue(item, marker) {
-  if (item.turn !== "pr-work" || item.pr === null || !item.issueAnalysis.hasNewMessage) return true;
+  if (item.turn !== "pr-work" || item.pr === null || !item.issueAnalysis.hasNewMessage) return null;
   try {
-    postMarker(
+    return postMarker(
       "issue",
       item.issue.number,
       `automata do-work: picked this up on pull request #${String(item.pr.number)} \u2014 ${item.pr.url}`
     );
-    progress(`  noted on issue #${String(item.issue.number)} that the work is on pull request #${String(item.pr.number)}.
-`);
-    return true;
   } catch (err) {
     progress(`  skipped: could not note the pickup on issue #${String(item.issue.number)} \u2014 ${err.message}
 `);
@@ -3436,14 +3509,38 @@ function notePickupOnIssue(item, marker) {
     return false;
   }
 }
+function reportIssueMessagesBuriedByNote(item, note, participants) {
+  const watermark = promptWatermark([item.issueAnalysis.messages]);
+  let buried;
+  try {
+    const messages = getIssueSurface(item.issue.number).messages;
+    buried = messagesBetween(messages, participants, watermark, note.createdAt);
+  } catch (err) {
+    progress(`  warning: could not re-read issue #${String(item.issue.number)}: ${err.message}
+`);
+    return 0;
+  }
+  if (buried.length === 0) return 0;
+  const authors = [...new Set(buried.map((message) => message.author))].join(", ");
+  try {
+    postMarker(
+      "issue",
+      item.issue.number,
+      `automata do-work: ${authors} posted here while this issue was being picked up, so ${buried.length === 1 ? "that message was" : "those messages were"} not included in the run. Please post again to have them acted on.`
+    );
+  } catch (err) {
+    progress(`  warning: could not report the buried issue message(s): ${err.message}
+`);
+  }
+  return buried.length;
+}
 function refreshItem(item, settings) {
   const linkMap = getOpenPrLinkMap();
-  return decideWork(
-    buildIssueState(item.issue, linkMap),
-    settings.participants,
-    settings.baseBranch,
-    linkMap.defaultBranch
-  );
+  return decideWork(buildIssueState(item.issue, linkMap), settings.participants, {
+    baseBranch: settings.baseBranch,
+    defaultBranch: linkMap.defaultBranch,
+    protectedBranches: settings.protectedBranches
+  });
 }
 function readAnsweringSurface(item) {
   if (item.turn === "issue-discuss" || item.pr === null) {
@@ -3496,10 +3593,11 @@ function reconcileMarker(item, marker, participants, watermark, runError) {
     if (analysis.missed.length > 0) {
       return {
         outcome: "answered-no-reply",
-        detail: `answered (${String(analysis.toReport.length)} message(s) arrived mid-run and were flagged)`
+        detail: `answered (${String(analysis.toReport.length)} message(s) arrived mid-run and were flagged)`,
+        reason: "flagged"
       };
     }
-    return runError === null ? { outcome: "answered", detail: "answered" } : { outcome: "answered", detail: `answered, but the run reported: ${runError.message}` };
+    return runError === null ? { outcome: "answered", detail: "answered", reason: "answered" } : { outcome: "answered", detail: `answered, but the run reported: ${runError.message}`, reason: "answered" };
   }
   return reportNoAnswer(item, marker, runError);
 }
@@ -3514,7 +3612,11 @@ function reportUnverified(item, marker) {
     progress(`  warning: could not update the marker comment: ${err.message}
 `);
   }
-  return { outcome: "answered-no-reply", detail: "could not verify whether an answer was posted" };
+  return {
+    outcome: "answered-no-reply",
+    detail: "could not verify whether an answer was posted",
+    reason: "unverified"
+  };
 }
 function reportNoAnswer(item, marker, runError) {
   const surface = markerSurfaceLabel(item);
@@ -3529,7 +3631,7 @@ function reportNoAnswer(item, marker, runError) {
 `
     );
   }
-  return runError === null ? { outcome: "answered-no-reply", detail: "run finished but posted no answer" } : { outcome: "failed", detail: `run failed: ${runError.message}` };
+  return runError === null ? { outcome: "answered-no-reply", detail: "run finished but posted no answer", reason: "no-answer" } : { outcome: "failed", detail: `run failed: ${runError.message}`, reason: "no-answer" };
 }
 async function invokeExecutor(prompt, settings, silent) {
   if (settings.executor === "codex") {
@@ -3611,13 +3713,21 @@ async function processItem(planned, settings, silent) {
     return { ...base, outcome: "skipped", detail: `marker failed: ${err.message}` };
   }
   inFlightMarker = { marker, item };
-  if (!notePickupOnIssue(item, marker)) {
+  const note = notePickupOnIssue(item, marker);
+  if (note === false) {
     inFlightMarker = null;
     return { ...base, outcome: "skipped", detail: "issue pickup note failed" };
   }
+  let buriedByNote = 0;
+  if (note !== null) {
+    progress(`  noted on issue #${String(item.issue.number)} that the work is on pull request #${String(item.pr?.number ?? 0)}.
+`);
+    buriedByNote = reportIssueMessagesBuriedByNote(item, note, settings.participants);
+  }
   const watermark = promptWatermark([
-    item.issueAnalysis,
-    ...item.prAnalysis === null ? [] : [item.prAnalysis]
+    item.issueAnalysis.messages,
+    item.prAnalysis?.messages ?? [],
+    item.actionableThreads.flatMap((thread) => thread.comments)
   ]);
   const prompt = composePrompt({
     item,
@@ -3656,10 +3766,21 @@ async function processItem(planned, settings, silent) {
   progress(`  ${reconciled.detail}
 `);
   let outcome = reconciled;
+  if (buriedByNote > 0 && outcome.outcome === "answered") {
+    outcome = {
+      outcome: "answered-no-reply",
+      detail: `${outcome.detail} (${String(buriedByNote)} issue message(s) were buried by the pickup note and flagged)`,
+      reason: "flagged"
+    };
+  }
   if (item.turn === "issue-discuss") {
     const linked = repairIssueLink(item, settings.baseBranch);
-    if (linked && outcome.outcome === "answered-no-reply") {
-      outcome = { outcome: "answered", detail: "opened a pull request (no issue comment)" };
+    if (linked && outcome.reason === "no-answer") {
+      outcome = {
+        outcome: "answered",
+        detail: "opened a pull request (no issue comment)",
+        reason: "answered"
+      };
       progress("  a pull request was opened, so the turn is counted as answered.\n");
     }
   }
@@ -3761,12 +3882,11 @@ async function runTick(settings, options) {
   const issues = discoverIssues(settings);
   const linkMap = getOpenPrLinkMap();
   const decisions = issues.map(
-    (issue) => decideWork(
-      buildIssueState(issue, linkMap),
-      settings.participants,
-      settings.baseBranch,
-      linkMap.defaultBranch
-    )
+    (issue) => decideWork(buildIssueState(issue, linkMap), settings.participants, {
+      baseBranch: settings.baseBranch,
+      defaultBranch: linkMap.defaultBranch,
+      protectedBranches: settings.protectedBranches
+    })
   );
   const items = decisions.flatMap((decision) => decision.kind === "work" ? [decision.item] : []);
   const planText = `Work plan (${String(items.length)} of ${String(issues.length)} issues need an answer):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "automata-cli",
-  "version": "0.1.0-feature-030-do-work.214",
+  "version": "0.1.0-feature-030-do-work.218",
   "description": "Automata CLI tool",
   "type": "module",
   "bin": {