mandrel 2.63.0 → 2.65.0

package/.agents/scripts/lib/orchestration/review-providers/code-review.js

@@ -0,0 +1,203 @@
+/**
+ * review-providers/code-review.js — a low-effort model bug review of the
+ * Story diff through `claude --print --effort low`. It asks only for
+ * merge-blocking problems, so every parsed finding is `critical` and halts
+ * close before auto-merge. The reviewer is handed the diff range, the Story
+ * id and the diff text — never `acceptance[]` or the self-eval verdict: this
+ * is a bug review, not a second acceptance scoring.
+ *
+ * A missing CLI throws at construction (the default chain entry is
+ * `optional: true`, so hosts without it skip). A review that cannot run or
+ * whose output does not parse degrades to one non-halting `suggestion`.
+ *
+ * @typedef {import('./types.js').Finding}        Finding
+ * @typedef {import('./types.js').ReviewInput}    ReviewInput
+ * @typedef {import('./types.js').ReviewProvider} ReviewProvider
+ */
+
+import { spawnCapture } from '../../child-exec.js';
+import { gitSpawn } from '../../git-utils.js';
+import { PROJECT_ROOT } from '../../project-root.js';
+import { parseProviderFindings } from './parse-findings.js';
+import { renderDepthDirective } from './review-depth.js';
+import { probeClaudeCli } from './security-review.js';
+
+const CLAUDE_ARGS = Object.freeze(['--print', '--effort', 'low']);
+const INVOKE_TIMEOUT_MS = 10 * 60 * 1000;
+/** Larger diffs are truncated; the reviewer is told so. */
+const MAX_DIFF_CHARS = 200_000;
+
+const PROMPT_HEAD =
+  'You are reviewing the diff `{baseRef}...{headRef}` for Story #{ticketId} ' +
+  'before it merges. {depthDirective}\n\n' +
+  'Report ONLY problems you would block this merge for: a bug that makes ' +
+  'the change behave incorrectly, crash, lose data, or break an existing ' +
+  'caller. Do not report style, naming, refactoring ideas, missing tests or ' +
+  'anything you would merge anyway. For each problem give the file, the ' +
+  'line in the new version, why it is wrong, and how to show it fails (an ' +
+  'input, command or test that exposes it).\n\n' +
+  'The diff below is authoritative — files on disk may not reflect it. ' +
+  'Emit ONLY a JSON array on stdout with this exact shape, no prose around ' +
+  'it:\n\n' +
+  '[{"title":"...","body":"Why it is wrong: ... How to show it fails: ...",' +
+  '"file":"...","line":1,"category":"bug"}]\n\n' +
+  'Emit [] if there is nothing you would block the merge for.\n\n';
+
+/**
+ * @param {ReviewInput} input
+ * @param {string} diff
+ * @returns {string}
+ */
+function buildPrompt(input, diff) {
+  const truncated = diff.length > MAX_DIFF_CHARS;
+  const body = truncated ? diff.slice(0, MAX_DIFF_CHARS) : diff;
+  const note = truncated
+    ? `\n[diff truncated at ${MAX_DIFF_CHARS} characters]\n`
+    : '';
+  const head = PROMPT_HEAD.replace('{baseRef}', input.baseRef)
+    .replace('{headRef}', input.headRef)
+    .replace('{ticketId}', String(input.ticketId))
+    .replace('{depthDirective}', renderDepthDirective(input.depth));
+  return `${head}<diff>\n${body}${note}\n</diff>\n`;
+}
+
+/**
+ * The prompt rides stdin so no shell ever quotes it.
+ *
+ * @param {string} prompt
+ * @param {Function} [run] - `spawnSync`-shaped seam for tests.
+ * @returns {{ status: number, stdout: string, stderr: string }}
+ */
+function invokeClaude(prompt, run) {
+  return spawnCapture('claude', [...CLAUDE_ARGS], {
+    cwd: PROJECT_ROOT,
+    input: prompt,
+    shell: process.platform === 'win32',
+    timeout: INVOKE_TIMEOUT_MS,
+    ...(run ? { run } : {}),
+  });
+}
+
+/** A model often fences its JSON; strip one surrounding fence. */
+function stripFence(text) {
+  const match = /^\s*```[a-z]*\s*\n([\s\S]*?)\n\s*```\s*$/i.exec(text ?? '');
+  return match ? match[1] : (text ?? '');
+}
+
+/**
+ * @param {string} title
+ * @param {string} detail
+ * @returns {Finding}
+ */
+function advisory(title, detail) {
+  return {
+    severity: 'suggestion',
+    title,
+    body:
+      `${detail} The model bug review did not produce a verdict — inspect ` +
+      'the diff manually before merging. Advisory only; the chain did not halt.',
+    category: 'bug',
+  };
+}
+
+/**
+ * @param {string} stdout
+ * @returns {Finding[]}
+ */
+function parseFindings(stdout) {
+  try {
+    return parseProviderFindings(stripFence(stdout), {
+      errorPrefix: '[code-review] Failed to parse reviewer stdout as JSON',
+      mapSeverity: () => 'critical',
+      defaultCategory: 'bug',
+    });
+  } catch (err) {
+    return [
+      advisory(
+        'Code review output not parseable as JSON',
+        `The reviewer returned text that did not parse as a JSON findings array (${err.message}).`,
+      ),
+    ];
+  }
+}
+
+/**
+ * @param {ReviewInput} input
+ */
+function assertInput(input) {
+  const { baseRef, headRef, ticketId } = input ?? {};
+  if (!baseRef || !headRef) {
+    throw new TypeError(
+      '[code-review] runReview requires baseRef and headRef.',
+    );
+  }
+  if (!Number.isInteger(ticketId) || ticketId <= 0) {
+    throw new TypeError(
+      '[code-review] runReview requires a positive integer ticketId.',
+    );
+  }
+}
+
+/**
+ * @param {{
+ *   probeFn?: () => boolean,
+ *   gitSpawnFn?: typeof gitSpawn,
+ *   spawnFn?: Function,
+ *   logger?: { info?: Function, warn?: Function },
+ * }} [deps] - `spawnFn` replaces `spawnSync` for the `claude` call.
+ * @returns {ReviewProvider}
+ */
+export function createCodeReviewProviderForRegistry(deps = {}) {
+  const probeFn = deps.probeFn ?? probeClaudeCli;
+  if (!probeFn()) {
+    throw new Error(
+      '[ReviewProviderFactory] codeReview provider "code-review" requires ' +
+        'the `claude` CLI on PATH but it was not detected. Install the ' +
+        'Claude Code CLI, or keep the entry `optional: true` so hosts ' +
+        'without it skip the model bug review.',
+    );
+  }
+  const gitSpawnFn = deps.gitSpawnFn ?? gitSpawn;
+  const { spawnFn, logger } = deps;
+
+  return {
+    async runReview(input) {
+      assertInput(input);
+      const { baseRef, headRef, ticketId } = input;
+      const diff = gitSpawnFn(
+        PROJECT_ROOT,
+        'diff',
+        '--no-color',
+        `${baseRef}...${headRef}`,
+      );
+      if (diff.status !== 0) {
+        return [
+          advisory(
+            'Code review could not read the diff',
+            `\`git diff ${baseRef}...${headRef}\` failed: ${diff.stderr || '<no output>'}.`,
+          ),
+        ];
+      }
+      if (diff.stdout.trim().length === 0) return [];
+
+      logger?.info?.(
+        `[code-review] Invoking claude --print --effort low for Story #${ticketId} (${baseRef}...${headRef})...`,
+      );
+      const result = invokeClaude(buildPrompt(input, diff.stdout), spawnFn);
+      if (result.status !== 0) {
+        logger?.warn?.(
+          `[code-review] claude exited ${result.status}; emitting advisory.`,
+        );
+        return [
+          advisory(
+            'Code review did not complete',
+            `\`claude --print\` exited with status ${result.status}: ${
+              result.stderr || result.stdout || '<no output>'
+            }.`,
+          ),
+        ];
+      }
+      return parseFindings(result.stdout);
+    },
+  };
+}

package/.agents/scripts/lib/orchestration/review-providers/review-provider-factory.js

@@ -14,6 +14,8 @@
  * @typedef {import('./types.js').ProviderChain}         ProviderChain
  */
 
+import { DEFAULT_REVIEW_PROVIDERS } from '../../config/review-chain-default.js';
+import { createCodeReviewProviderForRegistry } from './code-review.js';
 import { createCodexProviderForRegistry } from './codex.js';
 import { mergeChainDegradations } from './degraded-gates.js';
 import { createNativeProviderForRegistry } from './native.js';
@@ -22,6 +24,7 @@ import { createUltrareviewProviderForRegistry } from './ultrareview.js';
 
 /** @type {Readonly<Record<string, () => ReviewProvider>>} */
 const INLINE_PROVIDERS = Object.freeze({
+  'code-review': createCodeReviewProviderForRegistry,
   codex: createCodexProviderForRegistry,
   native: createNativeProviderForRegistry,
   'security-review': createSecurityReviewProviderForRegistry,
@@ -36,8 +39,6 @@ const PROMPT_PROVIDERS = Object.freeze({
   ultrareview: createUltrareviewProviderForRegistry,
 });
 
-export const DEFAULT_PROVIDER_NAME = 'native';
-
 /**
  * Gate predicate from a `when` clause (`label` / `labelAny`); absent → always true.
  *
@@ -79,7 +80,8 @@ export function isScopeApplicable(declaredScopes, currentScope) {
 }
 
 /**
- * Takes the `codeReview` sub-object; unset/empty `providers` defaults to native.
+ * Takes the `codeReview` sub-object; unset/empty `providers` falls back to
+ * `DEFAULT_REVIEW_PROVIDERS`.
  *
  * @param {{
  *   providers?: Array<object>,
@@ -105,7 +107,7 @@ export function createReviewProvider(codeReviewConfig, opts = {}) {
     Array.isArray(codeReviewConfig.providers) &&
     codeReviewConfig.providers.length > 0
       ? codeReviewConfig.providers
-      : [{ name: DEFAULT_PROVIDER_NAME }];
+      : DEFAULT_REVIEW_PROVIDERS;
 
   const chain = buildProviderChain(entries, {
     inlineRegistry,

package/.agents/scripts/lib/orchestration/review-providers/security-review.js

@@ -24,11 +24,12 @@ export const SECURITY_REVIEW_REMEDIATIONS = Object.freeze({
 
 /**
  * Synchronous so a missing CLI surfaces at construction, not mid-review.
+ * Shared by every `claude --print` provider.
  *
  * @param {{ spawnFn?: typeof spawnSync }} [opts]
  * @returns {boolean}
  */
-function defaultProbeClaudeCli(opts = {}) {
+export function probeClaudeCli(opts = {}) {
   const spawnFn = opts.spawnFn ?? spawnSync;
   try {
     const result = spawnFn('claude', ['--version'], {
@@ -173,7 +174,7 @@ export function buildUnparseableFallbackFinding() {
  * @returns {ReviewProvider}
  */
 export function createSecurityReviewProvider(deps = {}) {
-  const probeFn = deps.probeFn ?? defaultProbeClaudeCli;
+  const probeFn = deps.probeFn ?? probeClaudeCli;
   if (!probeFn()) {
     throw buildSecurityReviewUnavailableError();
   }

package/.agents/scripts/lib/orchestration/single-story-close/failed-terminal.js

@@ -107,6 +107,7 @@ export function failedTerminalFor(err, args = {}) {
       failure: { reason: String(err?.message ?? err) },
       nextCommand: NEXT_COMMANDS.recover(storyId),
       elapsedSeconds: 0,
+      phaseDurations: err?.closePhaseDurations ?? undefined,
     });
   } catch (buildErr) {
     Logger.error(

package/.agents/scripts/lib/orchestration/single-story-close/phases/code-review.js

@@ -56,8 +56,6 @@ async function invokeStoryReviewCore({
   prNumber,
   provider,
   runCodeReviewFn,
-  runLocalLensReviewFn,
-  appendFindingsYieldFn,
   gitSpawnFn,
   progress,
 }) {
@@ -71,8 +69,6 @@ async function invokeStoryReviewCore({
     progressTag: 'REVIEW',
     runCodeReviewFn,
     gitSpawnFn,
-    ...(runLocalLensReviewFn ? { runLocalLensReviewFn } : {}),
-    ...(appendFindingsYieldFn ? { appendFindingsYieldFn } : {}),
   });
 }
 
@@ -131,8 +127,6 @@ async function postStoryReviewCrossRef({
  *   prNumber: number|null,
  *   provider: object,
  *   runCodeReviewFn: Function,
- *   runLocalLensReviewFn?: Function,
- *   appendFindingsYieldFn?: Function,
  *   gitSpawnFn?: Function,
  *   progress: (tag: string, msg: string) => void,
  * }} args
@@ -145,7 +139,6 @@ async function postStoryReviewCrossRef({
  *   degraded?: boolean,
  *   degradations?: Array<object>,
  *   crossRefPosted?: boolean,
- *   localLensReview?: object,
  * }>}
  */
 export async function runStoryScopeReview({
@@ -157,8 +150,6 @@ export async function runStoryScopeReview({
   prNumber,
   provider,
   runCodeReviewFn,
-  runLocalLensReviewFn,
-  appendFindingsYieldFn,
   gitSpawnFn,
   progress,
 }) {
@@ -192,8 +183,6 @@ export async function runStoryScopeReview({
     prNumber,
     provider,
     runCodeReviewFn,
-    runLocalLensReviewFn,
-    appendFindingsYieldFn,
     gitSpawnFn,
     progress,
   });
@@ -229,6 +218,5 @@ export async function runStoryScopeReview({
     postedCommentId: result.postedCommentId ?? null,
     ...degradationEnvelope(result.degradations),
     crossRefPosted,
-    localLensReview: result.localLensReview,
   };
 }

package/.agents/scripts/lib/orchestration/single-story-close/phases/confirm-merge.js

@@ -27,6 +27,7 @@ import {
 import { pollUntil } from '../../../util/poll-loop.js';
 import { applyBehindUpdate } from '../../behind-recovery.js';
 import { isRerunPermitted } from '../../check-state.js';
+import { recordRequiredRed as defaultRecordRequiredRed } from '../../ci-red-handling.js';
 import {
   emitMergeFlipFailed as defaultEmitMergeFlipFailed,
   MERGED_FLIP_FAILED_BLOCK_CLASS,
@@ -36,20 +37,22 @@ import { classifyMergeBlock as defaultClassifyMergeBlock } from '../../merge-blo
 import {
   ADVISORY_GATE_INCONCLUSIVE_CLASS,
   ADVISORY_GATE_RED_CLASS,
+  CHECKS_FAILED_CLASS,
   DEFAULT_INTERVAL_SECONDS,
   DEFAULT_MAX_BUDGET_SECONDS,
   decideAdvisoryGateBlock,
   decideMergeWaitFailFast,
   deriveChecksStatus,
   deriveRedHeadRuns,
-  deriveRequiredRunEvidence,
   isPrMerged,
   MERGE_WAIT_GH_TIMEOUT_MS,
   parseWorkflowRunId,
+  pollIntervalMs,
   readRunSummary,
   resolveAdvisoryGateVerdict,
 } from '../../merge-poll.js';
 import { readMergeQueueState } from '../../merge-queue.js';
+import { readProbeRunEvidence } from '../../required-checks.js';
 import { NEXT_COMMANDS } from '../../story-deliver-terminal.js';
 import {
   postStructuredComment,
@@ -153,6 +156,7 @@ export async function readPrWaitProbe({
   gh = defaultGh,
   ghTimeoutMs = MERGE_WAIT_GH_TIMEOUT_MS,
   readMergeQueueStateFn = readMergeQueueState,
+  readRequiredCheckNamesFn,
 }) {
   try {
     const view = await withGhTimeout(
@@ -186,7 +190,14 @@ export async function readPrWaitProbe({
       }),
       // Head-anchored, so superseded/pending runs don't read as red; `null`
       // when the rollup is empty (the consecutive-probe fallback owns that).
-      requiredRunEvidence: deriveRequiredRunEvidence(view?.statusCheckRollup),
+      requiredRunEvidence: await readProbeRunEvidence({
+        view,
+        checksStatus,
+        prNumber,
+        gh,
+        ghTimeoutMs,
+        readFn: readRequiredCheckNamesFn,
+      }),
       redHeadRuns: deriveRedHeadRuns(view?.statusCheckRollup),
       headSha: readString(view?.headRefOid),
     };
@@ -297,14 +308,9 @@ function advisoryGateRemedy({ storyId, blockClass }) {
  * @param {{ storyId: number, prNumber: number|null, blockClass: string }} args
  * @returns {string}
  */
-function unlandedRemedy({ storyId, prNumber, blockClass }) {
-  if (blockClass === 'checks-failed') {
-    return (
-      `A required check is **red**. Fix the failure and push a new commit on \`story-${storyId}\`; ` +
-      `the red disarms auto-merge, and only a green on a new head SHA re-arms it — ` +
-      `re-running the failed job is forbidden. Watch the checks with:\n\n` +
-      `\`\`\`bash\n${NEXT_COMMANDS.watchCi(storyId, prNumber)}\n\`\`\``
-    );
+function unlandedRemedy({ storyId, prNumber, blockClass, redRecord }) {
+  if (blockClass === CHECKS_FAILED_CLASS) {
+    return checksFailedRemedy({ storyId, prNumber, redRecord });
   }
   if (
     blockClass === ADVISORY_GATE_INCONCLUSIVE_CLASS ||
@@ -319,6 +325,35 @@ function unlandedRemedy({ storyId, prNumber, blockClass }) {
   );
 }
 
+/**
+ * States what the red handling actually did — never claims a disarm or a
+ * digest that did not happen — then names both ci-remediation routes.
+ *
+ * @param {{ storyId: number, prNumber: number|null, redRecord?: object }} args
+ * @returns {string}
+ */
+function checksFailedRemedy({ storyId, prNumber, redRecord }) {
+  const disarm = redRecord?.disarm;
+  const armLine = disarm?.disarmed
+    ? disarm.alreadyUnarmed
+      ? 'Auto-merge was already un-armed.'
+      : 'Auto-merge was **disarmed**; only a green on a new head SHA, or the one rerun a filed `capacity` / `unreproducible-tier` verdict admits, re-arms it.'
+    : `⚠️ Auto-merge could **not** be disarmed (${disarm?.detail ?? 'the red handling did not run'}) — GitHub may still land the PR when the checks read green. Disarm it by hand.`;
+  const watch = NEXT_COMMANDS.watchCi(storyId, prNumber);
+  const digestLine = redRecord?.digestPaths
+    ? `CI digest (run link + failure signature): \`${redRecord.digestPaths.jsonPath}\`.`
+    : `⚠️ No CI digest was written (${redRecord?.digestError ?? 'no Story scope'}); \`${watch}\` rewrites it.`;
+  return (
+    `A required check is **red**. ${armLine}\n\n${digestLine}\n\n` +
+    `Per \`.agents/rules/ci-remediation.md\`, either fix the failure and push a new commit on ` +
+    `\`story-${storyId}\` (re-running the failed job is forbidden), or — when the root cause is ` +
+    `outside this delivery — file it:\n\n` +
+    `\`\`\`bash\nnode .agents/scripts/file-ci-gap.js --story ${storyId} --pr ${prNumber} ` +
+    `--verdict <verdict> --owner <consumer|framework|platform> --evidence "<proof reading>"\n\`\`\`\n\n` +
+    `Then watch the checks with:\n\n\`\`\`bash\n${watch}\n\`\`\``
+  );
+}
+
 function formatUnlandedFriction({
   storyId,
   prNumber,
@@ -326,12 +361,13 @@ function formatUnlandedFriction({
   blockClass,
   reason,
   elapsedSeconds,
+  redRecord,
 }) {
   const prLabel =
     Number.isInteger(prNumber) && prNumber > 0
       ? `PR #${prNumber}${prUrl ? ` (${prUrl})` : ''}`
       : (prUrl ?? 'the PR');
-  const remedy = unlandedRemedy({ storyId, prNumber, blockClass });
+  const remedy = unlandedRemedy({ storyId, prNumber, blockClass, redRecord });
   return (
     `### close-and-land: merge did not land\n\n` +
     `Story #${storyId}: the close polled ${prLabel} for merge confirmation and ` +
@@ -691,6 +727,61 @@ function queuedExhaustionVerdict(probe, cumulativeMs) {
   };
 }
 
+/**
+ * A `checks-failed` fail-fast is a required-check red, so it gets the same
+ * first-red handling as the watcher: disarm, then write the CI digest
+ * `file-ci-gap.js` reads. Never throws — the block stands regardless.
+ *
+ * @returns {Promise<object>} the `recordRequiredRed` outcome.
+ */
+async function recordChecksFailedRed({
+  storyId,
+  prNumber,
+  probe,
+  cwd,
+  config,
+  gh,
+  progress,
+  disarmAutoMergeFn,
+  recordRequiredRedFn,
+}) {
+  const failures = (probe?.redHeadRuns ?? []).map((run) => ({
+    name: run.name ?? 'unknown',
+    outcome: String(run.conclusion ?? 'failure').toLowerCase(),
+  }));
+  try {
+    const record = await recordRequiredRedFn({
+      storyId,
+      prNumber,
+      prRef: String(prNumber),
+      failures,
+      tempRoot: config?.project?.paths?.tempRoot ?? 'temp',
+      cwd,
+      headSha: probe?.headSha ?? null,
+      disarmFn: () => disarmAutoMergeFn({ prNumber, gh, progress }),
+    });
+    if (record.digestPaths) {
+      progress?.(
+        'CONFIRM',
+        `🧾 CI failure digest → ${record.digestPaths.jsonPath}`,
+      );
+    }
+    return record;
+  } catch (err) {
+    const detail = String(err?.message ?? err);
+    progress?.(
+      'CONFIRM',
+      `⚠️ Red-check handling failed (continuing to block): ${detail}`,
+    );
+    return {
+      headSha: probe?.headSha ?? null,
+      disarm: { disarmed: false, alreadyUnarmed: false, detail },
+      digestPaths: null,
+      digestError: detail,
+    };
+  }
+}
+
 /** Classify, emit `merge.unlanded`, post friction, block — all best-effort. */
 async function blockOnUnlanded({
   storyId,
@@ -705,6 +796,7 @@ async function blockOnUnlanded({
   emitMergeUnlandedFn,
   blockClassOverride,
   reasonOverride,
+  redRecord,
 }) {
   // A verdict decided at detection is emitted as-is, never re-derived (the
   // classifier reads an advisory-gate PR as healthy); the classifier runs
@@ -757,6 +849,7 @@ async function blockOnUnlanded({
       blockClass,
       reason,
       elapsedSeconds,
+      redRecord,
     }),
     progress,
   });
@@ -781,6 +874,7 @@ async function blockOnUnlanded({
     reason,
     frictionCommentId,
     elapsedSeconds,
+    ...(redRecord ? { redRecord } : {}),
     // The envelope's `pr.state` / `pr.checksStatus` come from here.
     prProbe,
   };
@@ -933,6 +1027,8 @@ async function onMergeObserved({
  * @param {Function} [args.classifyMergeBlockFn]
  * @param {Function} [args.emitMergeUnlandedFn]
  * @param {Function} [args.runPostLandTailFn]
+ * @param {Function} [args.disarmAutoMergeFn]
+ * @param {Function} [args.recordRequiredRedFn] The shared first-red handling (disarm + CI digest).
  * @param {(ms: number) => Promise<void>} [args.sleepFn]
  * @param {() => number} [args.nowMsFn]
  * @param {number} [args.ghTimeoutMs] Test seam only, not config.
@@ -964,6 +1060,7 @@ export async function runConfirmMergePhase({
   emitMergeFlipFailedFn = defaultEmitMergeFlipFailed,
   runPostLandTailFn = defaultRunPostLandTail,
   disarmAutoMergeFn = disarmAutoMerge,
+  recordRequiredRedFn = defaultRecordRequiredRed,
   sleepFn = defaultSleep,
   nowMsFn = Date.now,
   ghTimeoutMs = MERGE_WAIT_GH_TIMEOUT_MS,
@@ -1017,7 +1114,7 @@ export async function runConfirmMergePhase({
     remaining: rerunAllowance,
     issued: new Set(),
   };
-  const intervalMs = intervalSeconds * 1000;
+  let intervalMs = intervalSeconds * 1000;
   const startedAtMs = nowMsFn();
   let anchorMs = startedAtMs;
   let updatesUsed = 0;
@@ -1041,6 +1138,7 @@ export async function runConfirmMergePhase({
       ghTimeoutMs,
     });
     polls += 1;
+    intervalMs = pollIntervalMs(probe.checksStatus, intervalSeconds);
 
     anchorMs = resolveBudgetAnchorMs({
       createdAt: probe.createdAt,
@@ -1059,12 +1157,7 @@ export async function runConfirmMergePhase({
     // Heartbeat: a backgrounded close's output-file growth is its liveness signal.
     progress?.(
       'CONFIRM',
-      `⏱  poll ${polls}: PR #${prNumber} state=${probe.state ?? 'unknown'} ` +
-        `checks=${probe.checksStatus ?? 'unknown'} ` +
-        `mergeState=${probe.mergeStateStatus ?? 'unknown'} ` +
-        `(${waitBudget.waitedSeconds}s of ${maxWaitSeconds}s this invocation; ` +
-        `${waitBudget.cumulativeSeconds}s of ${maxBudgetSeconds}s cumulative)` +
-        (probe.error ? ` — probe error: ${probe.error}` : ''),
+      pollHeartbeat({ polls, prNumber, probe, waitBudget }),
     );
 
     if (isPrMerged(probe)) {
@@ -1127,6 +1220,17 @@ export async function runConfirmMergePhase({
           },
           blockClassOverride: decision.blockClass,
           reasonOverride: decision.reason,
+          redRecord: await recordChecksFailedRed({
+            storyId,
+            prNumber,
+            probe,
+            cwd,
+            config,
+            gh: injectedGh,
+            progress,
+            disarmAutoMergeFn,
+            recordRequiredRedFn,
+          }),
         };
       }
 
@@ -1225,13 +1329,24 @@ export async function runConfirmMergePhase({
     },
     predicate: (result) => result?.done === true,
     intervalMs,
-    // No pollUntil timeout: the tick owns both bounds and their classification.
-    sleepFn: (ms) => sleepFn(ms),
+    // No pollUntil timeout: the tick owns both bounds and the cadence.
+    sleepFn: () => sleepFn(intervalMs),
   });
   if (tick.thrown) throw tick.thrown;
   return tick.outcome;
 }
 
+function pollHeartbeat({ polls, prNumber, probe, waitBudget }) {
+  return (
+    `⏱  poll ${polls}: PR #${prNumber} state=${probe.state ?? 'unknown'} ` +
+    `checks=${probe.checksStatus ?? 'unknown'} ` +
+    `mergeState=${probe.mergeStateStatus ?? 'unknown'} ` +
+    `(${waitBudget.waitedSeconds}s of ${waitBudget.maxWaitSeconds}s this invocation; ` +
+    `${waitBudget.cumulativeSeconds}s of ${waitBudget.maxBudgetSeconds}s cumulative)` +
+    (probe.error ? ` — probe error: ${probe.error}` : '')
+  );
+}
+
 function doneWith(outcome) {
   return { done: true, outcome };
 }