omp-conductor 0.20.0 → 0.20.2

package/src/to-spec.ts

@@ -12,8 +12,9 @@
  * The five contract verdicts map onto it — PROMOTABLE → `promotable`;
  * ALREADY DONE and NEEDS DECOMPOSITION → `considered`; BLOCKED and NEEDS
  * PRODUCT DECISION → `blocked` — and a result that cannot be trusted
- * (malformed JSON, a schema violation, no authoritative source, or a stale
- * source) persists as `blocked` and never as `promotable`/`considered`.
+ * (no answer at all, malformed JSON, a schema violation, no authoritative
+ * source, or a stale source) persists as `blocked` and never as
+ * `promotable`/`considered`.
  * Reprocessing the same candidate is deterministic: the same input at the
  * same observation time produces the same row, and malformed output never
  * erases a prior valid (promotable/considered) result. Stale or source-less
@@ -98,6 +99,44 @@ export const TO_SPEC_MAX_SOURCE_AGE_MS = 24 * 60 * 60 * 1000;
 /** `routing: "MULTI"` requires `routingSplit` naming one repo per slice. */
 const MULTI_ROUTING = "MULTI" as const;
 
+/**
+ * One write-lane entry (#1060): a plausible repository-relative path.
+ *
+ * A lane entry that is prose — veltro#731's
+ * `"docker-compose.dev.yml (only if …)"` parsed as one non-empty string —
+ * used to harden into the durable verdict and brick its issue: the ready
+ * gate then refuses every promotion whose issue-side lane disagrees, a
+ * gate-rejected candidate is deliberately never re-groomed, and the
+ * refusal's own remedy (edit the issue to match) would have written the
+ * parenthetical into the issue. The grammar is therefore enforced here, at
+ * parse time, where a refusal is `malformed`, the retry cooldown can act on
+ * it, and nothing unusable becomes an admission contract. Deliberately
+ * narrow so no valid lane is newly rejected: dots, hyphens, nested
+ * directories, globs and trailing slashes all pass; only a leading `/`
+ * (absolute) or whitespace/parentheses inside the entry (prose) is refused.
+ */
+const LANE_ENTRY_PROSE = /[\s()]/;
+
+/** Every problem with one write lane's entries, each naming the offending
+ *  entry verbatim (`field[index] "…"`), in array order — the detail a repair
+ *  round hands back and a refusal records must be readable against the next
+ *  pass. Empty for a usable lane. */
+function laneEntryProblems(field: string, entries: readonly string[]): string[] {
+  const problems: string[] = [];
+  for (const [index, entry] of entries.entries()) {
+    if (entry.startsWith("/")) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is absolute — a write lane names repository-relative paths`,
+      );
+    } else if (LANE_ENTRY_PROSE.test(entry)) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is not a path — write-lane entries carry no whitespace or parentheses`,
+      );
+    }
+  }
+  return problems;
+}
+
 const ToSpecSourceSchema = z
   .object({
     name: z.string().trim().min(1).describe("The authoritative source that was read: repo or tracker, e.g. `TerrifiedBug/conductor`."),
@@ -145,6 +184,14 @@ const ToSpecDecompositionChildSchema = z
       .describe("The focused commands that prove this child, each with its cwd when it matters."),
   })
   .strict()
+  .superRefine((child, ctx) => {
+    // #1060: a decomposition child carries the identical admission contract,
+    // so its write lane obeys the identical grammar — prose here would
+    // harden into a child slice nothing can file.
+    for (const problem of laneEntryProblems("writeLane", child.writeLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
+  })
   .describe("One ordered child slice a decomposition proposal names (#1041).");
 
 /**
@@ -308,6 +355,12 @@ const ToSpecResultSchema = z
     if (value.routing !== MULTI_ROUTING && value.routingSplit !== undefined) {
       ctx.addIssue({ code: "custom", message: "routingSplit is only valid with routing `MULTI`" });
     }
+    // #1060: the lane is the admission contract, so its entries must be
+    // plausible repository-relative paths — refused here, at parse time,
+    // rather than hardening into a durable verdict no promotion can use.
+    for (const problem of laneEntryProblems("fileLane", value.fileLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
   })
   .describe("A complete, to-spec grooming result; nothing outside this shape is accepted.");
 
@@ -326,9 +379,16 @@ export type ToSpecResult = Omit<z.infer<typeof ToSpecResultSchema>, "source"> &
   source: { name: string; ref: string; freshAt: number };
 };
 
-/** Why a result could not be trusted; each persists as a blocked record. */
+/** Why a result could not be trusted; each persists as a blocked record.
+ *
+ * `no-answer` is the session-level refusal (#1064): the pass produced no
+ * payload at all — the scout was killed at its turn ceiling, or the session
+ * ended without ever yielding. It is a property of the session, never of
+ * output, so it is decided by the pass before anything is parsed and is never
+ * `malformed`. */
 export type ToSpecFailure =
   | { kind: "malformed"; detail: string }
+  | { kind: "no-answer"; detail: string }
   | { kind: "missing-source"; detail: string }
   | { kind: "stale-source"; detail: string };
 
@@ -338,6 +398,20 @@ export type ParseToSpecOutcome = { ok: true; result: ToSpecResult } | { ok: fals
 export interface ToSpecEvidence {
   kind: "to-spec";
   result: ToSpecResult;
+  /**
+   * How the answer arrived (#1064): through the `yield` tool, or recovered
+   * from the session's text because it never yielded. `"text"` is the record's
+   * admission that the verdict did not come through the yield contract — the
+   * answer was complete and valid, so it stands, but a later reader can tell
+   * the two apart. Absent (or `"yield"`) means it came through the contract.
+   */
+  via?: "yield" | "text";
+  /**
+   * Whether the one bounded repair round produced the answer (#1064): the
+   * first answer parsed but violated the contract, the validation error was
+   * handed back, and the re-answer is what this record carries.
+   */
+  repaired?: boolean;
   /**
    * What the ready gate found missing when a valid PROMOTABLE verdict was
    * refused mechanical promotion (#1041). A sibling of `result`, never a
@@ -356,12 +430,21 @@ export interface ToSpecFailureEvidence {
   input: string;
 }
 
-/** How much raw agent output a failure record may carry. */
-export const TO_SPEC_INPUT_SAMPLE_MAX = 2_000;
+/**
+ * How much raw agent output a failure record may carry (#1064).
+ *
+ * Sized for the whole refused payload, not a sample of it: a complete verdict
+ * with a proposed brief and sizing analysis routinely exceeds 2 KB, and a
+ * discarded verdict should be recoverable from the row rather than
+ * re-derived at full session cost. 8 KB holds a full payload with headroom
+ * while still keeping a single refused row bounded.
+ */
+export const TO_SPEC_INPUT_SAMPLE_MAX = 8_000;
 
 /** Refused results always land on the same store surface, named by failure. */
 const FAILURE_REASON: Record<ToSpecFailure["kind"], string> = {
   malformed: "malformed",
+  "no-answer": "no-answer",
   "missing-source": "missing-source",
   "stale-source": "stale-source",
 };
@@ -411,6 +494,59 @@ function extractJson(input: string): string {
   return (fenced?.[1] ?? input).trim();
 }
 
+/**
+ * The three-way gate the scout runner decides a payload against (#1064):
+ * whether a string is a payload at all, and whether that payload already
+ * conforms to the contract or is a single re-answer away from it.
+ *
+ *  - `conforming` — a JSON object that satisfies the strict contract. For
+ *    text-recovered blocks this is the criterion that separates "a complete
+ *    verdict written outside the yield tool" from mere narration.
+ *  - `repairable` — a JSON object that violates the contract (the #1062
+ *    shape: every required field present, one key misnamed). The failure
+ *    carries the first validation issue, which is what the repair round hands
+ *    back to the scout.
+ *  - `not-a-payload` — prose, truncated JSON, a non-object: nothing a
+ *    re-answer can repair, so the pass records no answer rather than grading
+ *    it.
+ *
+ * Same parser as {@link parseToSpecResult}, deliberately: the runner probes
+ * with the one contract so its repair decision can never drift from what the
+ * persistence layer will accept — this is the one validator used twice, not a
+ * second, weaker one.
+ */
+export type ToSpecPayloadGate =
+  | { state: "conforming"; body: string }
+  | { state: "repairable"; body: string; failure: ToSpecFailure }
+  | { state: "not-a-payload" };
+
+export function gateToSpecPayload(payload: string): ToSpecPayloadGate {
+  const body = extractJson(payload);
+  if (body.length === 0) return { state: "not-a-payload" };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(body);
+  } catch {
+    return { state: "not-a-payload" };
+  }
+  if (!isObject(raw)) return { state: "not-a-payload" };
+  const parsed = ToSpecResultSchema.safeParse(raw);
+  if (!parsed.success) {
+    // The field path rides in front of the message: zod says "Required" for a
+    // missing field and "Unrecognized key(s)…" for an extra one, and the
+    // repair round's whole value is that the scout sees WHICH field failed.
+    const first = parsed.error.issues[0];
+    const detail =
+      first === undefined
+        ? "schema violation"
+        : first.path.length === 0
+          ? first.message
+          : `${first.path.join(".")}: ${first.message}`;
+    return { state: "repairable", body, failure: { kind: "malformed", detail } };
+  }
+  return { state: "conforming", body };
+}
+
 /**
  * Parse and validate a groomer's raw output against the to-spec contract.
  * `now` is the settle time, explicit so staleness and determinism are
@@ -487,8 +623,31 @@ export type ToSpecGroomingOutcome =
 export interface ToSpecGroomingRequest {
   project: string;
   issue: number;
-  /** The agent's raw output, exactly as returned. */
+  /** The agent's structured answer, exactly as returned: the yield payload,
+   *  or a conforming block recovered from its text. Empty when the pass
+   *  produced no answer at all — which is its own refusal class, decided here
+   *  before anything is parsed (#1064). */
   input: string;
+  /** How the answer arrived: through the yield tool, or recovered from the
+   *  session's text because it never yielded. `"text"` marks the record so it
+   *  stays visible that the verdict did not come through the yield contract;
+   *  omitted reads as a yield, and an empty `input` with no `via` reads as no
+   *  answer. */
+  via?: "yield" | "text";
+  /** The session's last narration, recorded as the refusal's context when no
+   *  answer arrived — never parsed as a verdict (#1064). */
+  report?: string;
+  /** Whether the one bounded repair round produced the carried answer
+   *  (#1064); recorded on the row so a repaired verdict is distinguishable. */
+  repaired?: boolean;
+  /** Whether the session was killed at its turn ceiling before it answered
+   *  (#1064) — half of the no-answer shape naming. */
+  killedAtCeiling?: boolean;
+  /** The turn ceiling the pass ran under, and the turns it took: the other
+   *  half of the no-answer shape naming (`turns >= maxTurns` reads as a cap
+   *  kill even when the runner did not flag it). */
+  maxTurns?: number;
+  turns?: number;
   /** Observation time for staleness and the recorded row; `Date.now()` when
    *  omitted (tests pass it to keep reprocessing deterministic). */
   now?: number;
@@ -520,24 +679,51 @@ function failureEvidence(failure: ToSpecFailure, input: string): string {
  * it, not anything the agent wrote, becomes the recorded source observation
  * time.
  */
-export function recordToSpecGrooming(store: Store, request: ToSpecGroomingRequest): ToSpecGroomingOutcome {
-  const now = request.now ?? Date.now();
-  const parsed = parseToSpecResult(request.input, now, { launchedAt: request.launchedAt });
-  if (parsed.ok) {
-    const evidence: ToSpecEvidence = { kind: "to-spec", result: parsed.result };
-    store.upsertGrooming({
-      project: request.project,
-      issue: request.issue,
-      verdict: mapStoreVerdict(parsed.result.verdict),
-      reason: mapStoreReason(parsed.result.verdict),
-      evidence: JSON.stringify(evidence),
-      at: now,
-    });
-    return { kind: "persisted", record: store.grooming(request.project, request.issue)! };
+/**
+ * The reason a via-text verdict carries: the groomer's own label with a
+ * visible marker that the answer arrived outside the yield contract (#1064),
+ * so `status` reads `#13 promotable via text` instead of hiding the
+ * distinction in an evidence string. Yielded verdicts keep the bare label.
+ */
+function mapStoreReasonWithVia(verdict: ToSpecVerdict, via: "yield" | "text" | undefined): string {
+  const label = mapStoreReason(verdict);
+  return via === "text" ? `${label} via text` : label;
+}
+
+/**
+ * The no-answer detail names which of the two session shapes produced it
+ * (#1064): a turn-ceiling kill (`killedAtCeiling`, or `turns >= maxTurns`
+ * when the runner did not flag it) or a session that ended without ever
+ * yielding.
+ */
+function noAnswerDetail(request: ToSpecGroomingRequest): string {
+  const killed =
+    request.killedAtCeiling === true ||
+    (request.maxTurns !== undefined && request.turns !== undefined && request.turns >= request.maxTurns);
+  const turns = request.turns === undefined ? "" : ` after ${request.turns} turn(s)`;
+  if (killed) {
+    const ceiling = request.maxTurns === undefined ? "its turn ceiling" : `its ${request.maxTurns}-turn ceiling`;
+    return `the scout was killed at ${ceiling}${turns} and never yielded an answer`;
   }
+  return `the scout session ended${turns} without yielding an answer`;
+}
+
+/**
+ * Persist one refusal, or keep a prior valid verdict when the new pass
+ * produced something no-answer-like or malformed. `input` is what the failure
+ * record carries: the raw payload of the refused pass — or, for a no-answer
+ * pass, the session's narration as context (#1064).
+ */
+function persistGroomingRefusal(
+  store: Store,
+  request: ToSpecGroomingRequest,
+  failure: ToSpecFailure,
+  input: string,
+  now: number,
+): ToSpecGroomingOutcome {
   const prior = store.grooming(request.project, request.issue);
   if (
-    parsed.failure.kind === "malformed" &&
+    (failure.kind === "malformed" || failure.kind === "no-answer") &&
     prior !== undefined &&
     (prior.verdict === "promotable" || prior.verdict === "considered")
   ) {
@@ -547,13 +733,83 @@ export function recordToSpecGrooming(store: Store, request: ToSpecGroomingReques
     project: request.project,
     issue: request.issue,
     verdict: "blocked",
-    reason: FAILURE_REASON[parsed.failure.kind],
-    evidence: failureEvidence(parsed.failure, request.input),
+    reason: FAILURE_REASON[failure.kind],
+    evidence: failureEvidence(failure, input),
     at: now,
   });
   return { kind: "persisted", record: store.grooming(request.project, request.issue)! };
 }
 
+/**
+ * The only way a groomer's output becomes a durable grooming verdict: parse
+ * and validate, then upsert through the existing store — no second store, no
+ * `GroomingRecord` extension. Valid results map to the store's verdict
+ * surface with the full structured result serialized into `evidence`
+ * (`{"kind":"to-spec","result":…}`), which is what survives a restart. A
+ * refused result persists as `blocked` with the failure named in
+ * `evidence` (`to-spec-failure`) — never as promotable/considered — except
+ * when a prior valid result exists: malformed and no-answer reprocessing then
+ * keep that prior row instead of erasing it. Nothing here touches labels or
+ * issues.
+ *
+ * The refusal classes come from the whole pass, not just its output (#1064):
+ *
+ *  - `no-answer` — the session produced no payload at all (no yield, no
+ *    conforming text block): a turn-ceiling kill or a session end without a
+ *    yield, recorded by shape, never as `malformed`. The narration is kept as
+ *    context only. A text-carried block that fails validation is also
+ *    `no-answer` — such a session never yielded, and the block is not an
+ *    answer — except a batch-window staleness, which is a property of the
+ *    pass rather than the answer.
+ *  - `malformed` / `missing-source` — a *yielded* payload (or an unjudged
+ *    one) that violates the contract, with the raw payload persisted so the
+ *    discarded verdict stays recoverable.
+ *  - `stale-source` — the batch window outlived the freshness ceiling.
+ *
+ * `request.launchedAt` is the dispatcher's launch stamp for the batch (#1000);
+ * it, not anything the agent wrote, becomes the recorded source observation
+ * time.
+ */
+export function recordToSpecGrooming(store: Store, request: ToSpecGroomingRequest): ToSpecGroomingOutcome {
+  const now = request.now ?? Date.now();
+  if (request.input === "") {
+    return persistGroomingRefusal(
+      store,
+      request,
+      { kind: "no-answer", detail: noAnswerDetail(request) },
+      request.report ?? "",
+      now,
+    );
+  }
+  const parsed = parseToSpecResult(request.input, now, { launchedAt: request.launchedAt });
+  if (parsed.ok) {
+    const evidence: ToSpecEvidence = {
+      kind: "to-spec",
+      result: parsed.result,
+      ...(request.via === undefined ? {} : { via: request.via }),
+      ...(request.repaired === true ? { repaired: true } : {}),
+    };
+    store.upsertGrooming({
+      project: request.project,
+      issue: request.issue,
+      verdict: mapStoreVerdict(parsed.result.verdict),
+      reason: mapStoreReasonWithVia(parsed.result.verdict, request.via),
+      evidence: JSON.stringify(evidence),
+      at: now,
+    });
+    return { kind: "persisted", record: store.grooming(request.project, request.issue)! };
+  }
+  // A text-carried answer that fails validation was never yielded and does
+  // not conform: that is a no-answer pass, with the block kept as the
+  // failure's context — never malformed (#1064). The one exception is a
+  // batch-window staleness, whose class is about the pass, not the answer.
+  const failure =
+    request.via === "text" && parsed.failure.kind !== "stale-source"
+      ? { kind: "no-answer" as const, detail: noAnswerDetail(request) }
+      : parsed.failure;
+  return persistGroomingRefusal(store, request, failure, request.input, now);
+}
+
 /**
  * Recover the validated result from a record's evidence (the restart
  * round-trip). Returns undefined for anything that is not a `to-spec`
@@ -601,7 +857,12 @@ export function parseToSpecFailureEvidence(evidence: string): ToSpecFailure | un
   if (!isObject(raw) || raw.kind !== "to-spec-failure") return undefined;
   const failure = raw.failure;
   if (!isObject(failure) || typeof failure.detail !== "string") return undefined;
-  if (failure.kind !== "malformed" && failure.kind !== "missing-source" && failure.kind !== "stale-source") {
+  if (
+    failure.kind !== "malformed" &&
+    failure.kind !== "no-answer" &&
+    failure.kind !== "missing-source" &&
+    failure.kind !== "stale-source"
+  ) {
     return undefined;
   }
   return { kind: failure.kind, detail: failure.detail };

package/src/tracker/github.ts

@@ -94,6 +94,12 @@ interface GhCheck {
   status?: string;
   conclusion?: string;
   state?: string;
+  /** When the run started (`startedAt` on a GraphQL CheckRun, `started_at`
+   *  over REST); a StatusContext stamps `createdAt` instead. Undefined when
+   *  the payload spelled none — unordered entries resolve pessimistically
+   *  (#1066), never invented. */
+  startedAt?: string;
+  createdAt?: string;
   detailsUrl?: string;
 }
 
@@ -419,6 +425,75 @@ function checkVerdict(check: GhCheck): CheckVerdict {
   return "failed";
 }
 
+/** One check normalized onto the verdict vocabulary, carrying whatever run
+ *  timestamp its payload spelled: undefined means unordered, which
+ *  {@link resolveNewestPerName} treats pessimistically. */
+interface NamedVerdict {
+  readonly name: string;
+  readonly verdict: CheckVerdict;
+  readonly state: string;
+  readonly startedAt: string | undefined;
+}
+
+/** Epoch ms of an ISO stamp, or undefined when absent or unreadable — both
+ *  leave the entry unordered rather than inventing an age for it. */
+function startedAtMs(startedAt: string | undefined): number | undefined {
+  if (startedAt === undefined) return undefined;
+  const ms = Date.parse(startedAt);
+  return Number.isFinite(ms) ? ms : undefined;
+}
+
+/** Worse beats better when a name's deciding entries disagree. */
+const VERDICT_RANK: Readonly<Record<CheckVerdict, number>> = { failed: 0, pending: 1, green: 2 };
+
+/**
+ * Decide every check name by its newest run, never by payload order (#1066).
+ *
+ * One head can carry several check-runs of one name — a re-run creates a new
+ * run record without retiring the old one — and folding them first-match lets
+ * a stale `skipped` mask a newer `failure`: exactly how veltro#717 nearly
+ * merged green over its only upgrade-path check, whose failing run started
+ * five minutes behind the skipped row of the same name. Entries are grouped
+ * by name and each group is decided by its newest tier, GitHub's own checks-UI
+ * rule:
+ *
+ * - timed entries at the maximum `started_at` decide; older runs of the name
+ *   cannot mask them, so a re-run that went green supersedes its red
+ *   predecessor;
+ * - ties at one instant resolve pessimistically — a failure anywhere in the
+ *   deciding tier fails the name;
+ * - an entry without a readable timestamp cannot be proven older than
+ *   anything, so it belongs to every deciding tier (pessimistic again).
+ *
+ * The representative kept per name is the deciding entry itself, so the
+ * folds' refusal lines render the decided verdict's own spelling.
+ */
+function resolveNewestPerName(entries: readonly NamedVerdict[]): NamedVerdict[] {
+  const groups = new Map<string, { entry: NamedVerdict; startedMs: number | undefined }[]>();
+  for (const entry of entries) {
+    const stamped = { entry, startedMs: startedAtMs(entry.startedAt) };
+    const group = groups.get(entry.name);
+    if (group === undefined) groups.set(entry.name, [stamped]);
+    else group.push(stamped);
+  }
+  const resolved: NamedVerdict[] = [];
+  for (const group of groups.values()) {
+    let newest = -Infinity;
+    for (const { startedMs } of group) {
+      if (startedMs !== undefined && startedMs > newest) newest = startedMs;
+    }
+    let decided: NamedVerdict | undefined;
+    for (const { entry, startedMs } of group) {
+      if (startedMs !== undefined && startedMs !== newest) continue;
+      if (decided === undefined || VERDICT_RANK[entry.verdict] < VERDICT_RANK[decided.verdict]) {
+        decided = entry;
+      }
+    }
+    if (decided !== undefined) resolved.push(decided);
+  }
+  return resolved;
+}
+
 /**
  * Verify one `gh pr view --json state,isDraft,headRefOid,statusCheckRollup`
  * payload, optionally against a caller-observed head. A missing rollup is
@@ -430,6 +505,10 @@ function checkVerdict(check: GhCheck): CheckVerdict {
  * a different question: *what is this PR's state*, and a merged or closed PR
  * is reported as a fact rather than a failure — the merge gate paths never
  * pass `read`, so the `expected OPEN` refusal stays exactly where it gates.
+ *
+ * Same-name entries are decided by recency, not payload order (#1066): only
+ * the newest run of a name answers for it, ties and unreadable stamps resolve
+ * pessimistically, and the green count names de-duplicated checks.
  */
 export function prVerificationFrom(
   raw: string,
@@ -467,23 +546,34 @@ export function prVerificationFrom(
   if (checks.length === 0) {
     return { status: "pending", reason: "GitHub has not reported any checks yet", headSha };
   }
-  const failed = checks.filter((check) => checkVerdict(check) === "failed");
+  // Same-name runs decide by recency, not payload order (#1066): the rollup
+  // can carry an older run of a name beside a newer one, and first-match
+  // folding would let the older verdict answer for the name.
+  const resolved = resolveNewestPerName(
+    checks.map((check): NamedVerdict => ({
+      name: checkName(check),
+      verdict: checkVerdict(check),
+      state: check.conclusion ?? check.state ?? "unknown",
+      startedAt: check.startedAt ?? check.createdAt,
+    })),
+  );
+  const failed = resolved.filter((check) => check.verdict === "failed");
   if (failed.length > 0) {
     return {
       status: "failed",
-      reason: `Checks failed: ${failed.map((check) => `${checkName(check)} (${check.conclusion ?? check.state ?? "unknown"})`).join(", ")}`,
+      reason: `Checks failed: ${failed.map((check) => `${check.name} (${check.state})`).join(", ")}`,
       headSha,
     };
   }
-  const pending = checks.filter((check) => checkVerdict(check) === "pending");
+  const pending = resolved.filter((check) => check.verdict === "pending");
   if (pending.length > 0) {
     return {
       status: "pending",
-      reason: `Checks pending: ${pending.map(checkName).join(", ")}`,
+      reason: `Checks pending: ${pending.map((check) => check.name).join(", ")}`,
       headSha,
     };
   }
-  return { status: "green", reason: `${checks.length} checks succeeded or were skipped`, headSha };
+  return { status: "green", reason: `${resolved.length} checks succeeded or were skipped`, headSha };
 }
 
 /**
@@ -538,6 +628,9 @@ interface RestCheckConclusion {
    *  GitHub spelled it — surfaced in refusals exactly like the GraphQL one. */
   state: string;
   verdict: CheckVerdict;
+  /** The run's `started_at` (or a commit status's `updated_at`), undefined
+   *  when the page spelled none — unordered, never invented (#1066). */
+  startedAt: string | undefined;
 }
 
 /** One REST check plane, parsed strictly. */
@@ -579,6 +672,7 @@ function restRunConclusionFrom(row: { readonly [key: string]: unknown }): RestCh
   const name = row["name"];
   const status = row["status"];
   const conclusion = row["conclusion"];
+  const startedAt = row["started_at"];
   if (typeof name !== "string" || name === "") return undefined;
   if (typeof status !== "string") return undefined;
   if (conclusion !== undefined && conclusion !== null && typeof conclusion !== "string") return undefined;
@@ -591,7 +685,12 @@ function restRunConclusionFrom(row: { readonly [key: string]: unknown }): RestCh
       : conclusion === "success" || conclusion === "skipped" || conclusion === "neutral"
         ? "green"
         : "failed";
-  return { name, state: typeof conclusion === "string" ? conclusion : status, verdict };
+  return {
+    name,
+    state: typeof conclusion === "string" ? conclusion : status,
+    verdict,
+    startedAt: typeof startedAt === "string" ? startedAt : undefined,
+  };
 }
 
 /** One REST commit-status member onto the rollup vocabulary, or undefined when
@@ -599,12 +698,14 @@ function restRunConclusionFrom(row: { readonly [key: string]: unknown }): RestCh
 function restStatusConclusionFrom(row: { readonly [key: string]: unknown }): RestCheckConclusion | undefined {
   const context = row["context"];
   const state = row["state"];
+  const updatedAt = typeof row["updated_at"] === "string" ? row["updated_at"] : undefined;
+  const createdAt = typeof row["created_at"] === "string" ? row["created_at"] : undefined;
   if (typeof context !== "string" || context === "") return undefined;
   if (typeof state !== "string") return undefined;
   // StatusContext semantics: `success` is green, `pending` pending, anything
   // else (`failure`/`error`) is failed.
   const verdict: CheckVerdict = state === "success" ? "green" : state === "pending" ? "pending" : "failed";
-  return { name: context, state, verdict };
+  return { name: context, state, verdict, startedAt: updatedAt ?? createdAt };
 }
 
 /**
@@ -706,6 +807,10 @@ function restProjectionVerdict(
  * Throws on a payload that cannot prove the head or either check plane, so the
  * caller maps it to `head-unresolvable` exactly as it does for the GraphQL
  * parser.
+ *
+ * Same-name runs are decided by recency, not page order (#1066): the newest
+ * attempt of a name answers for it, so a stale `skipped` beside a newer
+ * `failure` fails the verdict whatever order the pages arrive in.
  */
 export function restVerificationFrom(
   prRaw: string,
@@ -732,7 +837,11 @@ export function restVerificationFrom(
   if (checks.length === 0) {
     return { status: "pending", reason: "GitHub has not reported any checks yet", headSha };
   }
-  const failed = checks.filter((c) => c.verdict === "failed");
+  // Same-name runs decide by recency, not page order (#1066): the flattened
+  // planes carry every attempt of a name, and first-match folding would let
+  // the oldest attempt answer for it.
+  const resolved = resolveNewestPerName(checks);
+  const failed = resolved.filter((c) => c.verdict === "failed");
   if (failed.length > 0) {
     return {
       status: "failed",
@@ -740,7 +849,7 @@ export function restVerificationFrom(
       headSha,
     };
   }
-  const pending = checks.filter((c) => c.verdict === "pending");
+  const pending = resolved.filter((c) => c.verdict === "pending");
   if (pending.length > 0) {
     return {
       status: "pending",
@@ -748,7 +857,7 @@ export function restVerificationFrom(
       headSha,
     };
   }
-  return { status: "green", reason: `${checks.length} checks succeeded or were skipped`, headSha };
+  return { status: "green", reason: `${resolved.length} checks succeeded or were skipped`, headSha };
 }
 
 /**
@@ -2074,6 +2183,19 @@ export function makeTracker(
           const rest = await verifyPrRest(runGh, cache, url, expectedHead, opts, hooks.onNotModified);
           return rest ?? verification;
         }
+        if (verification.status === "green") {
+          // A rollup context is one NAME, not one RUN (#1066): veltro#717
+          // read eighteen green contexts while the same SHA carried a newer
+          // `failure` run of a name whose rollup row still said `skipped`.
+          // Recency ordering helps only when both rows arrive together; a
+          // rollup that omits the newer run entirely cannot be ordered back
+          // to correctness, so green is re-proven from the flattened REST
+          // planes — the same evidence the empty-rollup path above trusts.
+          // REST that cannot answer leaves this verdict standing, exactly as
+          // a degraded plane leaves the #999 pending standing.
+          const rest = await verifyPrRest(runGh, cache, url, expectedHead, opts, hooks.onNotModified);
+          return rest ?? verification;
+        }
         if (verification.status !== "failed") return verification;
 
         const detailsUrl = failedCheck(raw)?.detailsUrl;