dorfl 0.7.0 → 0.8.0

package/src/github.ts

@@ -10,6 +10,8 @@ import {
 	type PostPRCommentInput,
 	type PostPRCommentOnBranchInput,
 	type PostPRCommentResult,
+	type CloseRequestOnBranchInput,
+	type CloseRequestOnBranchResult,
 } from './integrator.js';
 
 /**
@@ -185,6 +187,27 @@ export class GitHubProvider implements ReviewProvider {
 	 * record / `status`).
 	 */
 	async openRequest(input: OpenRequestInput): Promise<OpenRequestResult> {
+		// REOPEN a CLOSED PR before trying to CREATE one (task
+		// `tasking-disapprove-closes-existing-pr-keeps-branch`): a spec whose earlier
+		// tasking review DISAPPROVED had its PR CLOSED (branch kept). A later re-task
+		// that now APPROVES must REOPEN that SAME PR (preserving its history +
+		// closing-comment thread) rather than leaving a new duplicate. `gh pr create`
+		// on a branch with a closed PR would open a SECOND PR, so we reopen first.
+		// Best-effort + never-throw; a failed reopen falls through to the normal
+		// create path (the branch is already pushed, so the work is safe).
+		const existingForReopen = this.resolvePrForBranch(
+			input.branch,
+			input.cwd,
+			input.env,
+		);
+		if (existingForReopen?.state === 'CLOSED') {
+			const reopened = this.reopenExistingRequest(input, existingForReopen.url);
+			if (reopened !== undefined) {
+				return reopened;
+			}
+			// Could not reopen (transient `gh` failure) — fall through to create.
+		}
+
 		const args = [
 			'pr',
 			'create',
@@ -307,6 +330,93 @@ export class GitHubProvider implements ReviewProvider {
 		};
 	}
 
+	/**
+	 * REOPEN a previously-CLOSED PR for the branch (task
+	 * `tasking-disapprove-closes-existing-pr-keeps-branch`): `gh pr reopen <url>`,
+	 * then refresh its title/body (reusing {@link updateExistingRequest}'s edit so
+	 * the reopened PR carries this run's content). Returns `{opened: true, url}` on
+	 * a successful reopen, or `undefined` when the reopen itself failed (the caller
+	 * then falls through to `gh pr create`). Best-effort edit — a failed refresh
+	 * still returns the reopened PR. NEVER throws.
+	 */
+	private reopenExistingRequest(
+		input: OpenRequestInput,
+		url: string,
+	): OpenRequestResult | undefined {
+		const reopen = this.runGh(['pr', 'reopen', url], input.cwd, input.env);
+		if (reopen === undefined || reopen.status !== 0) {
+			return undefined;
+		}
+		// Refresh title/body on the reopened PR (best-effort; only when supplied).
+		if (input.title !== undefined || input.body !== undefined) {
+			const editArgs = ['pr', 'edit', url];
+			if (input.title !== undefined) {
+				editArgs.push('--title', input.title);
+			}
+			if (input.body !== undefined) {
+				editArgs.push('--body', input.body);
+			}
+			this.runGh(editArgs, input.cwd, input.env);
+		}
+		return {
+			opened: true,
+			url,
+			instruction: `Reopened the existing GitHub PR for ${input.branch}: ${url}`,
+		};
+	}
+
+	/**
+	 * CLOSE the branch's OPEN PR (keeping the branch) with the disapproving review
+	 * as the closing comment — the disapprove artefact-cleanup path (task
+	 * `tasking-disapprove-closes-existing-pr-keeps-branch`). Resolves the PR from
+	 * the branch; when there is NO OPEN PR (none at all, already closed/merged, or
+	 * `gh` missing) it is a clean no-op (`closed: false`) — we never OPEN a PR just
+	 * to close it. `gh pr close <url> --comment <review>` (NO `--delete-branch`, so
+	 * the branch — the recovery point — survives for a later approving re-task to
+	 * REOPEN). NEVER throws, NEVER `--force`s (ADR §6).
+	 */
+	async closeRequestOnBranch(
+		input: CloseRequestOnBranchInput,
+	): Promise<CloseRequestOnBranchResult> {
+		const existing = this.resolvePrForBranch(
+			input.branch,
+			input.cwd,
+			input.env,
+		);
+		if (existing === undefined || existing.state !== 'OPEN') {
+			// No OPEN PR to close (none, already closed/merged, or gh unavailable):
+			// honest no-op AFTER trying. Surface the review so it is never lost.
+			return {
+				closed: false,
+				instruction:
+					`No open PR to close for ${input.branch} (the branch is kept). ` +
+					`The disapproving review:\n${input.comment}`,
+			};
+		}
+		const closed = this.runGh(
+			['pr', 'close', existing.url, '--comment', input.comment],
+			input.cwd,
+			input.env,
+		);
+		if (closed === undefined || closed.status !== 0) {
+			// The close failed (transient) — the branch + PR are untouched; surface
+			// the review text and report no-close. The item is still surfaced to
+			// needs-attention by the caller regardless.
+			return {
+				closed: false,
+				instruction:
+					`Could not close the PR for ${input.branch} (the branch is kept). ` +
+					`The disapproving review:\n${input.comment}`,
+			};
+		}
+		return {
+			closed: true,
+			instruction:
+				`Closed the stale PR for ${input.branch} with the disapproving ` +
+				`review as its closing comment (branch kept): ${existing.url}`,
+		};
+	}
+
 	/** Map a successful `gh pr create` RunResult to an OpenRequestResult. */
 	private parseOpened(
 		input: OpenRequestInput,
@@ -429,6 +539,45 @@ export class GitHubProvider implements ReviewProvider {
 		return parsePrUrl(result.stdout);
 	}
 
+	/**
+	 * Resolve the branch's PR url AND state (`OPEN` / `CLOSED` / `MERGED`) via
+	 * `gh pr view <branch> --json url,state`, or `undefined` when no PR exists /
+	 * `gh` is missing. Needed by {@link openRequest} to REOPEN a CLOSED PR (the
+	 * disapprove-close artefact — a later approving re-task reopens the SAME PR
+	 * instead of leaving a new one) and by {@link closeRequestOnBranch} to no-op
+	 * when there is no OPEN PR to close. `gh pr view <branch>` reports the most
+	 * recent PR for the branch, including a closed one. Read-only.
+	 */
+	private resolvePrForBranch(
+		branch: string,
+		cwd: string,
+		env: NodeJS.ProcessEnv | undefined,
+	): {url: string; state: string} | undefined {
+		const result = this.runGh(
+			[
+				'pr',
+				'view',
+				branch,
+				'--json',
+				'url,state',
+				'--jq',
+				'.url + " " + .state',
+			],
+			cwd,
+			env,
+		);
+		if (result === undefined || result.status !== 0) {
+			return undefined;
+		}
+		const url = parsePrUrl(result.stdout);
+		if (url === undefined) {
+			return undefined;
+		}
+		// The `--jq` prints `<url> <STATE>`; the state is the last whitespace token.
+		const state = result.stdout.trim().split(/\s+/).pop() ?? '';
+		return {url, state};
+	}
+
 	/**
 	 * Is `gh` available AND authenticated (so a PR can actually be opened)?
 	 * `gh auth status` exits 0 when authenticated. A missing `gh` (spawn failure)

package/src/index.ts

@@ -35,6 +35,30 @@ export {
 	resolveRepoConfig,
 } from './repo-config.js';
 
+export type {
+	ForwardDecision,
+	ForwardOutcome,
+	ForwardSpawn,
+	ForwardSpawnResult,
+	RepoCmdReader,
+} from './bootstrap-forward.js';
+export {
+	FORWARDED_ENV_MARKER,
+	NO_FORWARD_ENV,
+	NO_FORWARD_FLAG,
+	decideForward,
+	performForward,
+	maybeForward,
+	defaultRepoCmdReader,
+	defaultForwardSpawn,
+	forwardNotice,
+	forwardFailureMessage,
+	argvHasNoForward,
+	envHasNoForward,
+	envIsForwarded,
+	stripNoForwardFlag,
+} from './bootstrap-forward.js';
+
 export type {ConfigOverrideMap} from './config-override.js';
 export {
 	defaultConfigOverridePath,

package/src/install-ci-core.ts

@@ -828,54 +828,26 @@ ${indent(modelsJsonStr, 8)}
       run: npm install -g dorfl${installHarness}`;
 	}
 
-	// PREFER-LOCAL RESOLVER (task install-ci-prefer-project-local-dorfl,
-	// SPEC install-ci-project-provisioning axis C1+C3): emit a `dorfl` SHIM
-	// that resolves a project-local `node_modules/.bin/dorfl` FIRST (the repo's
-	// devDep pin, populated by the project-setup hook's `pnpm install` — C3),
-	// and falls back to the global bootstrap dorfl this composite action just
-	// installed (C1). Prepended to `$GITHUB_PATH` so EVERY downstream
-	// `dorfl <verb>` step in EVERY capability workflow inherits the resolver
-	// without each template editing its literal `dorfl` invocation (single
-	// shared prefix, no per-capability drift). The captured global path is
-	// written to a sibling file so the shim's `command -v` never recurses into
-	// itself once the shim dir is on PATH. Applied uniformly in both registry
-	// and workspace modes; the workspace-mode install path itself is untouched
-	// (the shim runs AFTER the install).
-	const resolverStep = `\
-
-    # Generated by install-ci (task install-ci-prefer-project-local-dorfl):
-    # a single shared shim that prefers a project-local node_modules/.bin/dorfl
-    # (the repo's devDep pin, C3) over the global bootstrap dorfl just installed
-    # (C1), so CI runs the dorfl the repo DECLARES, not a skewed global.
-    - name: Install dorfl resolver (prefer project-local over global)
-      shell: bash
-      run: |
-        global_dorfl="$(command -v dorfl || true)"
-        if [ -z "$global_dorfl" ]; then
-          echo "ERROR: dorfl bootstrap not found on PATH after install" >&2
-          exit 1
-        fi
-        shim_dir="\${RUNNER_TEMP:-/tmp}/dorfl-resolver"
-        mkdir -p "$shim_dir"
-        printf '%s\\n' "$global_dorfl" > "$shim_dir/global-path"
-        # Write the shim via printf (not a heredoc) so the shebang lands at
-        # column 0 — a YAML \`run: |\` block's common-indent would otherwise
-        # prefix every heredoc line and break the shebang.
-        printf '%s\\n' \\
-          '#!/usr/bin/env bash' \\
-          '# Prefer the project-pinned dorfl (devDep, populated by the' \\
-          "# project's dependency install) over the global bootstrap." \\
-          '# Generated by install-ci.' \\
-          'local_bin="\${GITHUB_WORKSPACE:-$PWD}/node_modules/.bin/dorfl"' \\
-          'if [ -x "$local_bin" ]; then' \\
-          '  exec "$local_bin" "$@"' \\
-          'fi' \\
-          'global_path_file="$(dirname "$0")/global-path"' \\
-          'exec "$(cat "$global_path_file")" "$@"' \\
-          > "$shim_dir/dorfl"
-        chmod +x "$shim_dir/dorfl"
-        echo "$shim_dir" >> "$GITHUB_PATH"`;
-	installSteps = installSteps + resolverStep;
+	// NO bespoke CI resolver shim (task install-ci-shim-converges-on-dorfl-cmd,
+	// spec `dorfl-self-version-pinning-and-bootstrap-forward` §6 / story 4).
+	// Historically this action emitted a `$PATH` shim that preferred a
+	// project-local `node_modules/.bin/dorfl` over the global bootstrap (task
+	// install-ci-prefer-project-local-dorfl). That shim was CI-only AND
+	// JS-specific (it hardcoded `node_modules/.bin`). Now that the global
+	// bootstrap dorfl SELF-FORWARDS to the repo-declared `dorflCmd` on its own
+	// (task `dorfl-bootstrap-self-forward`), the shim is redundant: CI's global
+	// `dorfl` forwards to the repo's declared `dorflCmd` by the SAME generic
+	// mechanism the laptop uses — ONE code path, JS and non-JS alike. A JS repo
+	// that pinned via a devDep declares `dorflCmd: "node_modules/.bin/dorfl"`
+	// (one line; `setup` nudges it) and gets the pin in CI via the forward. A
+	// repo with NO `dorflCmd` runs the global bootstrap — identically on CI and
+	// the laptop (onboarding-safe). Keeping a JS-only no-`dorflCmd` fallback was
+	// deliberately REJECTED (see the ## Decisions note in the done record): it
+	// would re-introduce the JS-specific CI-only special case the convergence
+	// removes, AND when a repo declares BOTH the devDep AND `dorflCmd` the shim
+	// would exec the local bin which then forwards AGAIN — a confusing
+	// double-resolution. The install step below leaves `dorfl` on `$PATH` as the
+	// bootstrap; the forward does the pinning.
 
 	// One optional ACTION INPUT per provider key (models-json mode), named
 	// identically to the secret/env var. Optional + default '' so a workflow that

package/src/integration-core.ts

@@ -2256,6 +2256,16 @@ function bridgeProvider(
 					req.body,
 			};
 		},
+		// The legacy bridge has no PR-close capability — a clean no-op (keep the
+		// branch), surfacing the disapproving review text.
+		async closeRequestOnBranch(req) {
+			return {
+				closed: false,
+				instruction:
+					'The legacy review bridge cannot close a PR (branch kept); the ' +
+					`disapproving review:\n${req.comment}`,
+			};
+		},
 	};
 }
 

package/src/integrator.ts

@@ -81,6 +81,52 @@ export interface ReviewProvider {
 	 * review — ADR §6).
 	 */
 	postPRCommentOnBranch(input: PostPRCommentOnBranchInput): PostPRCommentResult;
+	/**
+	 * CLOSE the PR opened for an already-pushed `work/<slug>` BRANCH — WITHOUT
+	 * deleting the branch — posting {@link CloseRequestOnBranchInput.comment} (the
+	 * review that disapproved) as the closing comment. RESOLVES the PR from the
+	 * branch (the disapprove path holds the branch, not the PR url).
+	 *
+	 * Used when a tasking review DISAPPROVES a spec whose PR is already open (the
+	 * multi-run artefact): the stale PR is closed with the review as its closing
+	 * comment (so the reason is visible ON the PR), while the branch is KEPT — the
+	 * safety-bearing recovery point — so a later re-task that APPROVES can REOPEN
+	 * the same PR (via {@link openRequest}, which reopens an existing-closed PR).
+	 *
+	 * ONLY-IF-EXISTS: a real provider first resolves the branch's PR and, when
+	 * there is NO open PR to close, cleanly no-ops (`closed: false`) — the disapprove
+	 * path never OPENS a PR just to close it.
+	 *
+	 * ADVISORY — it gates nothing; like the other PR-text methods it must NEVER
+	 * throw (a missing/unauthenticated `gh`, the `none` provider, or no resolvable
+	 * open PR all DEGRADE: surface the text in the result, close nothing, keep the
+	 * branch — ADR §6).
+	 */
+	closeRequestOnBranch(
+		input: CloseRequestOnBranchInput,
+	): Promise<CloseRequestOnBranchResult>;
+}
+
+export interface CloseRequestOnBranchInput {
+	cwd: string;
+	/**
+	 * The pushed `work/<slug>` branch whose OPEN PR to close (keeping the branch).
+	 * The GitHub provider resolves the PR via `gh pr view <branch>` and closes it
+	 * with `gh pr close <branch>` (NO `--delete-branch`).
+	 */
+	branch: string;
+	/** The arbiter remote the branch was pushed to. */
+	arbiter: string;
+	/** The closing comment — the disapproving review prose (JSON block stripped). */
+	comment: string;
+	env?: NodeJS.ProcessEnv;
+}
+
+export interface CloseRequestOnBranchResult {
+	/** True iff an open PR was actually resolved from the branch AND closed. */
+	closed: boolean;
+	/** Human-readable confirmation / fallback (the review text on degrade/no-op). */
+	instruction: string;
 }
 
 export interface PostPRCommentInput {
@@ -216,6 +262,22 @@ export class NoneProvider implements ReviewProvider {
 				`comment. The review:\n${input.body}`,
 		};
 	}
+
+	/**
+	 * No API to resolve/close a PR (a local `--bare` arbiter has no review
+	 * concept), so DEGRADE: close nothing, keep the branch, surface the review
+	 * text, never throw. A clean no-op for the PR.
+	 */
+	async closeRequestOnBranch(
+		input: CloseRequestOnBranchInput,
+	): Promise<CloseRequestOnBranchResult> {
+		return {
+			closed: false,
+			instruction:
+				'No review provider configured — no PR was closed (the branch is ' +
+				`kept). The disapproving review:\n${input.comment}`,
+		};
+	}
 }
 
 export interface IntegrateInput {

package/src/item-lock.ts

@@ -1940,6 +1940,56 @@ export async function heldTaskSlugsStrict(
 	);
 }
 
+/**
+ * List the SPEC slugs currently lock-held on the arbiter — the held-SPEC set the
+ * TASKABLE-spec pool readers SUBTRACT (fix
+ * `propose-tasking-releases-lock-so-spec-is-retasked-and-pr-force-pushed-every-tick`).
+ * The SPEC analogue of {@link heldTaskSlugsStrict}: enumerates {@link listItemLocks}
+ * and keeps only the `spec-<slug>` entries (a task/observation lock does not gate
+ * the SPEC pool), mapping each to its bare `<slug>`.
+ *
+ * LOAD-BEARING for the propose-mode tasking loop: an `advance spec:<slug> --propose`
+ * that opens a PR now KEEPS the `spec:<slug>` lock HELD across the open PR (the
+ * durable `specs/ready → specs/tasked` move lives only on the branch, so `main`
+ * residence does NOT yet signal tasked-ness). This held-spec set is the ONLY thing
+ * that keeps such an in-flight spec out of the taskable pool — WITHOUT it the spec
+ * is re-tasked every tick and its PR force-pushed. Symmetric to the task-pool
+ * subtraction; the same fail-open/fail-closed split applies (see
+ * {@link heldSpecSlugs} vs this strict twin).
+ */
+export async function heldSpecSlugsStrict(
+	cwd: string,
+	arbiter = 'origin',
+	env?: NodeJS.ProcessEnv,
+): Promise<Set<string>> {
+	const entries = await listItemLocks(cwd, arbiter, env);
+	const prefix = 'spec-';
+	return new Set(
+		entries
+			.filter((e) => e.startsWith(prefix))
+			.map((e) => e.slice(prefix.length)),
+	);
+}
+
+/**
+ * GRACEFUL (fail-OPEN) twin of {@link heldSpecSlugsStrict} for read-only SURFACE
+ * paths and the local autopick driver: a fetch fault yields an EMPTY set rather
+ * than throwing (the follow-on tasking-lock CAS is the load-bearing safety net
+ * locally, exactly as {@link heldTaskSlugs} relies on the claim CAS). The SELECTION
+ * path that must refuse an untrusted pool uses the strict twin.
+ */
+export async function heldSpecSlugs(
+	cwd: string,
+	arbiter = 'origin',
+	env?: NodeJS.ProcessEnv,
+): Promise<Set<string>> {
+	try {
+		return await heldSpecSlugsStrict(cwd, arbiter, env);
+	} catch {
+		return new Set();
+	}
+}
+
 /**
  * Parse a serialised lock entry body back into a {@link LockEntry} — the exact
  * inverse of {@link serialiseLockEntry}. Post-`retire-stuck-lock-state` a lock

package/src/repo-config.ts

@@ -3,6 +3,7 @@ import {join} from 'node:path';
 import {
 	mergeConfig,
 	validateDeadlineConfig,
+	validateDorflCmdConfig,
 	warnDeprecatedConfigKeys,
 	type Config,
 	type PartialConfig,
@@ -110,6 +111,20 @@ export const REPO_ALLOWED_KEYS = [
 	// through the SAME chain as `verify`. Install belongs HERE, never baked into
 	// `verify`.
 	'prepare',
+	// `dorflCmd` (the repo-declared dorfl COMMAND bare `dorfl` self-forwards to —
+	// spec `dorfl-self-version-pinning-and-bootstrap-forward` §1/§3) is a genuine
+	// repo property exactly like `verify`/`prepare`: WHICH dorfl this repo builds/
+	// advances/intakes with is agreed by all collaborators + travels with the repo,
+	// for reproducibility. It is the DELIBERATE, ADR-recorded EXCEPTION to ADR §13's
+	// host-only rule: a machine-command key (same class as the REJECTED
+	// `agentCmd`/`piBin`/`sessionsDir` below) that IS repo-settable, because its
+	// purpose is repo-declared reproducibility, it carries no more trust than the
+	// committed `verify` command the repo already runs, and the forward is ANNOUNCED
+	// on stderr (unlike a silent `piBin`). There is NO trust gate. See ADR
+	// `dorfl-cmd-repo-settable-exception-to-host-only` for the full why + the
+	// reversal of §13 for this one key. Resolved per-repo through the SAME chain as
+	// `verify` (flag > env `DORFL_DORFL_CMD` > per-repo > global > default unset).
+	'dorflCmd',
 	'defaultArbiter',
 	// `autoBuild` (may an agent auto-BUILD undeclared, not-`humanOnly` tasks in
 	// this repo?) is a genuine repo property — the build member of the symmetric
@@ -591,6 +606,11 @@ export function resolveRepoConfigFromLoaded(
 	// (flag / env / per-repo / global) throws with a clear message naming the
 	// field + range — NEVER silently clamped.
 	validateDeadlineConfig(config);
+	// Validate + normalise the repo-declared dorfl command (trim; empty ⇒ unset;
+	// non-string ⇒ fail-loud) after layering, so a malformed value from ANY layer
+	// (flag / env / per-repo / global) surfaces the same clear error (ADR
+	// `dorfl-cmd-repo-settable-exception-to-host-only`).
+	validateDorflCmdConfig(config);
 	return {
 		config,
 		rejected: repo.rejected,

package/src/scan.ts

@@ -252,16 +252,30 @@ export function scoreSpecs(
 	repoPath: string,
 	pool: LedgerSpecPool,
 	autoTask: boolean,
+	/**
+	 * The held-SPEC set to SUBTRACT from the taskable pool (fix
+	 * `propose-tasking-releases-lock-so-spec-is-retasked-and-pr-force-pushed-every-tick`):
+	 * a spec whose `refs/dorfl/lock/spec-<slug>` is HELD is IN-FLIGHT (a propose-mode
+	 * tasking PR is open, or a merge tasking is mid-flight) and must NOT be enumerated
+	 * as taskable — otherwise CI re-tasks it every tick, force-pushing the open PR.
+	 * Symmetric to {@link scoreItems}'s task held-slug subtraction (specs took NONE
+	 * before this fix). Defaults empty (offline read — the caller supplies the set,
+	 * fail-CLOSED for selection via {@link heldSpecSlugsStrict}, graceful for the
+	 * surface).
+	 */
+	heldSpecSlugs: Set<string> = new Set(),
 ): ScannedSpec[] {
 	const taskable = new Set(
 		taskableSpecs({
-			candidates: pool.specs.map((p) => ({
-				repoPath,
-				slug: p.slug,
-				humanOnly: p.humanOnly,
-				needsAnswers: p.needsAnswers,
-				taskedAfter: p.taskedAfter,
-			})),
+			candidates: pool.specs
+				.filter((p) => !heldSpecSlugs.has(p.slug))
+				.map((p) => ({
+					repoPath,
+					slug: p.slug,
+					humanOnly: p.humanOnly,
+					needsAnswers: p.needsAnswers,
+					taskedAfter: p.taskedAfter,
+				})),
 			taskedSlugs: pool.taskedSlugs,
 			autoTask,
 		}).map((p) => p.slug),
@@ -567,6 +581,16 @@ export function scanRepoPaths(
 	 * empty (no override).
 	 */
 	override?: ConfigOverrideMap,
+	/**
+	 * The held-SPEC set to SUBTRACT from each repo's TASKABLE-spec pool (fix
+	 * `propose-tasking-releases-lock-so-spec-is-retasked-and-pr-force-pushed-every-tick`):
+	 * passed into {@link scoreSpecs} so a spec whose per-item lock is HELD (a
+	 * propose-mode tasking PR is open, or a merge tasking is mid-flight) never leaks
+	 * into the propose matrix's `spec:` legs — the SPEC counterpart of the `heldSlugs`
+	 * task subtraction. Supplied by the in-place caller (offline scan has no arbiter
+	 * handle); DEFAULTS empty.
+	 */
+	heldSpecSlugs: Set<string> = new Set(),
 ): ScanReport {
 	const repos: RepoReport[] = [];
 	const counts = {totalItems: 0, totalEligible: 0};
@@ -585,7 +609,7 @@ export function scanRepoPaths(
 		// predicate. This is what makes the propose-mode CI matrix enumerate `spec:`
 		// legs (see `ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`).
 		const specPool = ledgerRead.resolveSpecPool({repoPath: path});
-		const specs = scoreSpecs(path, specPool, resolved.autoTask);
+		const specs = scoreSpecs(path, specPool, resolved.autoTask, heldSpecSlugs);
 		// The per-repo LIFECYCLE pool (`ci-propose-matrix-enumerates-lifecycle-items`),
 		// gated by this working tree's `observationTriage` / `surfaceBlockers` (resolved
 		// the same way as `autoBuild`/`autoTask`) and computed by REUSING