pr-shepherd 0.56.2 → 0.56.4

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pr-shepherd",
   "description": "Autonomous PR CI monitor and review-comment resolver for agentic coding tools",
-  "version": "0.56.2",
+  "version": "0.56.4",
   "author": {
     "name": "Jonathan Ong",
     "email": "jonathanrichardong@gmail.com"

package/README.md

@@ -164,7 +164,7 @@ receipts, and whose bottom open layer GitHub has retargeted onto the stack base,
 with `gh stack merge <that PR number> --yes` and the allowed method flag (`--squash` unless config or the repository selects another). That lands the named layer and every
 unmerged layer below it. When the base uses a merge queue, the same command queues the prefix
 together and GitHub evaluates each layer from the bottom; a failure ejects that layer and those
-above it. If the evidence shows an unrelated failure and no source changes or other blockers remain, the one-PR session emits a head-, queue-commit-, and timestamp-pinned local acknowledgment command. Fresh source checks and a new READY receipt then let the aggregate selector recover the eligible prefix. Manual or stale removals cannot use this path. Layers above the prefix keep their one-PR sessions. After the merge, GitHub retargets
+above it. For a `failed_checks` removal on the layer's first ejection, the one-PR session emits a head-, queue-commit-, and timestamp-pinned local acknowledgment command; run it only when the failure does not reproduce after updating from the latest base, the head did not change, and no source changes or other blockers remain. Fresh source checks and a new READY receipt then let the aggregate selector recover the eligible prefix. Manual or stale removals cannot use this path. Layers above the prefix keep their one-PR sessions. After the merge, GitHub retargets
 the next layer, so the rerun continues until the stack returns `CANCEL`. API and MCP aggregate
 calls perform one summary tick and leave recurrence to the caller.
 

package/bin/checks/classify.d.mts

@@ -7,11 +7,10 @@
  *      to PR readiness.
  *   2. Drop checks with `conclusion == SKIPPED` or `conclusion == NEUTRAL` from the
  *      pass/fail tally. Report them as "skipped" for transparency but don't block on them.
- *   3. Reclassify `CANCELLED` checks as "superseded" (non-blocking) when a newer run of
- *      the same workflow exists on the same commit — this is GitHub's concurrency-group
- *      eviction behavior, not a real failure. GitHub branch protection itself resolves
- *      required status checks by latest-run-per-name and merges past these; mirroring
- *      that here keeps shepherd's verdict aligned with what GitHub will actually allow.
+ *   3. Reclassify `CANCELLED` checks as "superseded" (non-blocking) when a newer
+ *      run of the same workflow exists on the same commit and event, or when an
+ *      exact matching check from a lower-ID run started and succeeded later.
+ *      GitHub can start jobs out of workflow-run creation order.
  */
 import type { CheckRun, ClassifiedCheck } from "../types.mts";
 /**
@@ -36,7 +35,7 @@ export interface CiVerdict {
     filteredNames: string[];
     /** Names of checks suppressed by the user's ignoreChecks config. */
     ignoredNames: string[];
-    /** Names of CANCELLED checks superseded by a newer run of the same workflow (concurrency-group eviction). */
+    /** Names of CANCELLED checks covered by another run of the same workflow and event. */
     supersededNames: string[];
 }
 /** Compute a high-level CI verdict from a list of classified checks. */

package/bin/checks/classify.mjs

@@ -7,11 +7,10 @@
  *      to PR readiness.
  *   2. Drop checks with `conclusion == SKIPPED` or `conclusion == NEUTRAL` from the
  *      pass/fail tally. Report them as "skipped" for transparency but don't block on them.
- *   3. Reclassify `CANCELLED` checks as "superseded" (non-blocking) when a newer run of
- *      the same workflow exists on the same commit — this is GitHub's concurrency-group
- *      eviction behavior, not a real failure. GitHub branch protection itself resolves
- *      required status checks by latest-run-per-name and merges past these; mirroring
- *      that here keeps shepherd's verdict aligned with what GitHub will actually allow.
+ *   3. Reclassify `CANCELLED` checks as "superseded" (non-blocking) when a newer
+ *      run of the same workflow exists on the same commit and event, or when an
+ *      exact matching check from a lower-ID run started and succeeded later.
+ *      GitHub can start jobs out of workflow-run creation order.
  */
 import { loadConfig } from "../config/load.mjs";
 import { buildSupersededIndices } from "./superseded.mjs";
@@ -37,8 +36,7 @@ export function classifyChecks(checks, opts = {}) {
             return { ...c, category: "ignored" };
         }
         const classified = classify(c, relevantEvents);
-        // Only ever override a "failing" verdict (i.e. conclusion === CANCELLED, guaranteed by
-        // buildSupersededIndices below) — never touch filtered/skipped/passed classifications.
+        // Only override a failing CANCELLED check, never filtered/skipped/passed classifications.
         if (classified.category === "failing" && supersededIndices.has(index)) {
             return { ...classified, category: "superseded" };
         }

package/bin/checks/superseded.d.mts

@@ -1,21 +1,8 @@
-/**
- * Detects check runs that are `CANCELLED` because a newer run of the *same workflow*
- * superseded them on the same commit (concurrency-group eviction), rather than a genuine
- * cancellation. Split out of classify.mts to stay under the file-length cap.
- */
+/** Identify cancelled checks covered by another run on the same commit and event. */
 import type { CheckRun } from "../types.mts";
 /**
- * Grouping key is `workflowId ?? workflowName` — the numeric GitHub Actions workflow database
- * ID when available, falling back to the display name. Checks with neither a workflow identity
- * nor a numeric `runId` (status contexts, startup-failure synthetics) never participate: they
- * can neither be marked superseded nor count as evidence of a newer run.
- *
- * A check is superseded iff its own conclusion is `CANCELLED` and some other check sharing its
- * workflow key has a strictly greater `runId`. The newest run for a workflow is therefore never
- * superseded, even if it is itself cancelled — that case stays "failing" so the agent can decide
- * whether to rerun it.
- *
- * @returns Indices into `checks` (not object identities, since check-run objects are not
- *   deduplicated by reference elsewhere) that should be reclassified as "superseded".
+ * A later-created run supersedes an older cancellation as before. GitHub can start
+ * check jobs out of run-ID order, so a lower-ID run can also cover a cancellation
+ * when its matching successful job actually started and completed later.
  */
 export declare function buildSupersededIndices(checks: CheckRun[]): Set<number>;

package/bin/checks/superseded.mjs

@@ -1,59 +1,83 @@
-/**
- * Detects check runs that are `CANCELLED` because a newer run of the *same workflow*
- * superseded them on the same commit (concurrency-group eviction), rather than a genuine
- * cancellation. Split out of classify.mts to stay under the file-length cap.
- */
-/** Grouping key for a check's workflow: numeric `workflowId`, falling back to `workflowName`. */
+/** Identify cancelled checks covered by another run on the same commit and event. */
+/** Prefer the stable workflow ID; retain the name fallback for the older-run rule. */
 function workflowKeyOf(check) {
-    return check.workflowId ?? check.workflowName;
+    if (check.workflowId)
+        return `id:${check.workflowId}`;
+    return check.workflowName ? `name:${check.workflowName}` : undefined;
+}
+function groupKeyOf(check) {
+    const workflow = workflowKeyOf(check);
+    if (workflow === undefined)
+        return undefined;
+    return JSON.stringify([workflow, check.event, check.scope ?? null, check.commitOid ?? null]);
+}
+function numericRunId(check) {
+    if (check.runId === null || !/^[1-9]\d*$/.test(check.runId))
+        return undefined;
+    const id = Number(check.runId);
+    return Number.isSafeInteger(id) ? id : undefined;
+}
+function validTimes(check) {
+    const { startedAtUnix: start, completedAtUnix: completion } = check;
+    return (typeof start === "number" &&
+        Number.isFinite(start) &&
+        start > 0 &&
+        typeof completion === "number" &&
+        Number.isFinite(completion) &&
+        completion > 0 &&
+        completion >= start);
 }
 /**
- * Grouping key is `workflowId ?? workflowName` — the numeric GitHub Actions workflow database
- * ID when available, falling back to the display name. Checks with neither a workflow identity
- * nor a numeric `runId` (status contexts, startup-failure synthetics) never participate: they
- * can neither be marked superseded nor count as evidence of a newer run.
- *
- * A check is superseded iff its own conclusion is `CANCELLED` and some other check sharing its
- * workflow key has a strictly greater `runId`. The newest run for a workflow is therefore never
- * superseded, even if it is itself cancelled — that case stays "failing" so the agent can decide
- * whether to rerun it.
- *
- * @returns Indices into `checks` (not object identities, since check-run objects are not
- *   deduplicated by reference elsewhere) that should be reclassified as "superseded".
+ * A later-created run supersedes an older cancellation as before. GitHub can start
+ * check jobs out of run-ID order, so a lower-ID run can also cover a cancellation
+ * when its matching successful job actually started and completed later.
  */
 export function buildSupersededIndices(checks) {
-    const runIdByIndex = new Map();
-    const maxRunIdByWorkflow = new Map();
+    const maxRunIdByGroup = new Map();
+    const runIds = checks.map(numericRunId);
     checks.forEach((check, index) => {
-        const workflowKey = workflowKeyOf(check);
-        if (workflowKey === undefined || check.runId === null)
-            return;
-        const runIdNum = Number(check.runId);
-        if (!Number.isFinite(runIdNum))
+        const group = groupKeyOf(check);
+        const runId = runIds[index];
+        if (group === undefined || runId === undefined)
             return;
-        runIdByIndex.set(index, runIdNum);
-        const currentMax = maxRunIdByWorkflow.get(workflowKey);
-        if (currentMax === undefined || runIdNum > currentMax) {
-            maxRunIdByWorkflow.set(workflowKey, runIdNum);
-        }
+        const previous = maxRunIdByGroup.get(group);
+        if (previous === undefined || runId > previous)
+            maxRunIdByGroup.set(group, runId);
     });
     const superseded = new Set();
-    checks.forEach((check, index) => {
-        if (check.conclusion !== "CANCELLED")
+    checks.forEach((cancelled, index) => {
+        if (cancelled.conclusion !== "CANCELLED")
             return;
-        const runIdNum = runIdByIndex.get(index);
-        if (runIdNum === undefined)
+        const group = groupKeyOf(cancelled);
+        const runId = runIds[index];
+        if (group === undefined || runId === undefined)
             return;
-        // workflowKeyOf(check) is guaranteed defined here, with a corresponding entry in
-        // maxRunIdByWorkflow: runIdByIndex is only ever populated in the loop above alongside a
-        // maxRunIdByWorkflow entry for that same workflow key (at minimum, this check's own
-        // runIdNum) — the two maps are always updated together for a given index. A defensive
-        // undefined-check here would therefore guard a branch no input can ever exercise, which
-        // would silently fail this repo's 100%-coverage requirement instead of catching a real bug.
-        const maxRunId = maxRunIdByWorkflow.get(workflowKeyOf(check));
-        if (maxRunId > runIdNum) {
+        if (maxRunIdByGroup.get(group) > runId) {
             superseded.add(index);
+            return;
         }
+        if (cancelled.status !== "COMPLETED" ||
+            !cancelled.workflowId ||
+            cancelled.event === null ||
+            !validTimes(cancelled))
+            return;
+        const covered = checks.some((success, candidateIndex) => {
+            const candidateRunId = runIds[candidateIndex];
+            return (candidateRunId !== undefined &&
+                candidateRunId < runId &&
+                success.status === "COMPLETED" &&
+                success.conclusion === "SUCCESS" &&
+                success.workflowId === cancelled.workflowId &&
+                success.event === cancelled.event &&
+                success.scope === cancelled.scope &&
+                success.commitOid === cancelled.commitOid &&
+                success.name === cancelled.name &&
+                validTimes(success) &&
+                success.startedAtUnix > cancelled.startedAtUnix &&
+                success.completedAtUnix > cancelled.completedAtUnix);
+        });
+        if (covered)
+            superseded.add(index);
     });
     return superseded;
 }

package/bin/cli/iterate-merge-formatter.mjs

@@ -40,6 +40,8 @@ export function appendMergeQueueHeader(lines, result) {
         parts.push("checks incomplete (first 100 shown)");
     if (queue.headUpdatedAfterRemoval)
         parts.push("head updated after removal");
+    if (queue.removalsOnHead)
+        parts.push(`removals on this head \`${queue.removalsOnHead}\``);
     if (queue.removalAcknowledged)
         parts.push("removal acknowledged");
     lines.push(`**merge queue** ${parts.join(" · ")}`);

package/bin/commands/apply-queue-removal.mjs

@@ -24,10 +24,9 @@ export async function applyQueueRemovalAck(input) {
         !queueRemovalAppliesToHead({
             parentOids: removal.beforeCommitParentOids,
             headOid: data.headRefOid,
-            ...(data.activity?.latestCommitCommittedAtUnix != null && {
-                headCommittedAtUnix: data.activity.latestCommitCommittedAtUnix,
-            }),
-            ...(data.headPushedAtUnix !== undefined && { headPushedAtUnix: data.headPushedAtUnix }),
+            headCommittedAtUnix: data.activity?.latestCommitCommittedAtUnix,
+            headPushedAtUnix: data.headPushedAtUnix,
+            headForcePushedAtUnix: data.headForcePushedAtUnix,
             removedAtUnix: removal.createdAtUnix,
         })) {
         throw new ShepherdError("The supplied queue-removal evidence is stale or is not a current CI-driven removal for this native-stack PR.", EXIT.UNAVAILABLE);

package/bin/commands/check.mjs

@@ -1,5 +1,5 @@
 import { fetchPrBatch } from "../github/batch.mjs";
-import { queueRemovalAppliesToHead } from "../github/queue-removal-freshness.mjs";
+import { headArrivalUnix, queueRemovalAppliesToHead } from "../github/queue-removal-freshness.mjs";
 import { readQueueRemovalAcknowledgment, matchesQueueRemovalAcknowledgment, isCiQueueRemovalReason, } from "../state/queue-removal-ack.mjs";
 import { storePrFingerprint } from "../state/pr-fingerprint.mjs";
 import { tryReuseFingerprintReport } from "./check-fingerprint.mjs";
@@ -76,22 +76,25 @@ export async function runCheck(opts, context) {
     // it as stale/updated rather than as still current, so Shepherd doesn't escalate
     // `merge-queue-removed` permanently on data it can no longer check. A squash or rebase
     // queue commit has one parent and does not list the PR head; that removal stays current
-    // until this head reached the PR after it. The push time is the earliest pull_request
-    // check on the head, with committer time as the fallback when no check time is
-    // available. The raw removal fields still render in the merge-queue header regardless
-    // of this flag.
-    const headCommittedAtUnix = batchData.activity?.latestCommitCommittedAtUnix;
+    // until this head reached the PR after it (`headArrivalUnix`). The raw removal fields
+    // still render in the merge-queue header regardless of this flag.
+    const headTimes = {
+        headCommittedAtUnix: batchData.activity?.latestCommitCommittedAtUnix,
+        headPushedAtUnix: batchData.headPushedAtUnix,
+        headForcePushedAtUnix: batchData.headForcePushedAtUnix,
+    };
     const headUpdatedAfterRemoval = Boolean(latestRemoval &&
         !queueRemovalAppliesToHead({
+            ...headTimes,
             parentOids: latestRemoval.beforeCommitParentOids,
             headOid: batchData.headRefOid,
-            ...(headCommittedAtUnix !== undefined &&
-                headCommittedAtUnix !== null && { headCommittedAtUnix }),
-            ...(batchData.headPushedAtUnix !== undefined && {
-                headPushedAtUnix: batchData.headPushedAtUnix,
-            }),
             removedAtUnix: latestRemoval.createdAtUnix,
         }));
+    // Repeat ejections of this head: removals after it reached the PR.
+    const headSinceUnix = headArrivalUnix(headTimes);
+    const removalsOnHead = latestRemoval && !headUpdatedAfterRemoval && headSinceUnix !== undefined
+        ? (batchData.mergeQueueRemovalTimesUnix ?? []).filter((t) => t >= headSinceUnix).length
+        : 0;
     const removalAcknowledged = Boolean(batchData.stack &&
         latestRemoval?.beforeCommitOid &&
         isCiQueueRemovalReason(latestRemoval.reason) &&
@@ -367,6 +370,7 @@ export async function runCheck(opts, context) {
                     checksIncomplete: true,
                 }),
                 ...(headUpdatedAfterRemoval && { headUpdatedAfterRemoval: true }),
+                ...(removalsOnHead > 1 && { removalsOnHead }),
                 ...(removalAcknowledged && { removalAcknowledged: true }),
             },
         }),

package/bin/commands/iterate/fix-code.mjs

@@ -8,6 +8,7 @@ import { buildThreadMutationRouting, threadHasAuthorizedMutation, } from "./thre
 import { buildFixInstructions } from "./render.mjs";
 import { buildRemovedQueueRecovery, buildStackQueueRemovalAcknowledgment } from "./merge.mjs";
 import { hasLogEvidence } from "./check-evidence.mjs";
+import { currentEjectionCommit, } from "./queue-recovery-instructions.mjs";
 import { buildReleasedBlockerInstruction } from "./check-instructions.mjs";
 import { buildNativeStackLayerRebase } from "./native-stack-rebase.mjs";
 import { lookupUpperLayerTrunkConflict } from "./stack-trunk-conflict.mjs";
@@ -301,25 +302,21 @@ export async function handleFixCode(ctx) {
             trunk: stack.baseRefName,
         })
         : undefined;
-    // Conflicts, and a behind branch whose rerun already failed, both ask for a branch update.
-    const stackRebase = hasConflicts || (isBehind && exhaustedAttempts.length > 0)
-        ? buildNativeStackLayerRebase(report.repo, { number: prNumber, baseBranch: baseLookup.branch }, stack, trunkConflict)
-        : undefined;
-    const instructions = buildFixInstructions(threads, actionableComments, checks, changesRequestedReviews, baseLookup.branch, resolveCommand, hasConflicts, prReference, cancelled.length, firstLookThreads, firstLookComments, firstLookSummaries, editedSummaries, inProgressRunIds, resolutionOnlyThreads, resolveOnlyCommand, behindBaseHint, isBehind, report.viewerAuthorization?.viewerCanUpdate === true, exhaustedAttempts.length > 0, stackRebase);
     const requeue = buildRemovedQueueRecovery(report, failingAgentChecks, opts.merge);
     const queueRemovalAcknowledgment = buildStackQueueRemovalAcknowledgment(report, failingAgentChecks);
-    if (queueRemovalAcknowledgment) {
-        const completion = instructions.pop();
-        instructions.push("If the merge-group failure belongs to this PR, fix and push its head, then iterate. Otherwise, if no code changed and no other blocker remains, run `acknowledge queue removal:` exactly as printed. This records only the disposition of that removed queue commit; finish this one-PR session to validate current source CI and record its READY receipt, then return to the aggregate `--stack` selector with its original options. In merge mode it verifies lower-layer readiness before merging. Do not enqueue or merge this layer directly.");
-        if (completion !== undefined)
-            instructions.push(completion);
-    }
-    if (requeue) {
-        const completion = instructions.pop();
-        instructions.push("If the merge-group failure belongs to this PR, fix and push the PR head, then iterate. Otherwise, if no code changed and no other blocker remains, run the `requeue:` command exactly as printed. If gh reports auto-merge is disabled instead of adding the PR to the queue, run the `requeue API fallback:` command. Both commands require the observed PR head SHA; if the head changed, iterate for a fresh command.");
-        if (completion !== undefined)
-            instructions.push(completion);
-    }
+    const queueEjection = !currentEjectionCommit(report, failingAgentChecks)
+        ? undefined
+        : requeue
+            ? "requeue"
+            : queueRemovalAcknowledgment
+                ? "acknowledge"
+                : "none";
+    // Conflicts, a behind branch whose rerun already failed, and a queue ejection that may be
+    // reproduced on the latest base all print the branch update route.
+    const stackRebase = hasConflicts || (isBehind && exhaustedAttempts.length > 0) || queueEjection
+        ? buildNativeStackLayerRebase(report.repo, { number: prNumber, baseBranch: baseLookup.branch }, stack, trunkConflict)
+        : undefined;
+    const instructions = buildFixInstructions(threads, actionableComments, checks, changesRequestedReviews, baseLookup.branch, resolveCommand, hasConflicts, prReference, cancelled.length, firstLookThreads, firstLookComments, firstLookSummaries, editedSummaries, inProgressRunIds, resolutionOnlyThreads, resolveOnlyCommand, behindBaseHint, isBehind, report.viewerAuthorization?.viewerCanUpdate === true, exhaustedAttempts.length > 0, stackRebase, queueEjection);
     if (failingAgentChecks.some((check) => releasedCheckNames.has(check.name))) {
         const completion = instructions.pop();
         instructions.push(buildReleasedBlockerInstruction(prNumber));

package/bin/commands/iterate/merge.mjs

@@ -99,6 +99,9 @@ function removedQueueRecoveryAvailable(report, checks, merge) {
         !queue?.enabled ||
         queue.inQueue ||
         queue.headUpdatedAfterRemoval ||
+        // A repeat ejection of the same head is not retried blindly; a conflict forces a new head.
+        (queue.removalsOnHead ?? 1) > 1 ||
+        report.mergeStatus.status === "CONFLICTS" ||
         // GitHub exposes a raw string, not a capability to reverse a human's queue removal.
         // Only known CI-driven reasons authorize offering automated recovery.
         !isCiQueueRemovalReason(queue.latestRemoval?.reason) ||

package/bin/commands/iterate/native-stack-rebase.d.mts

@@ -36,5 +36,8 @@ export declare function buildNativeStackLayerRebase(repo: string, pr: {
 }): string | undefined;
 /** Point at the conflicts, and at the stack rebase when the PR is a native stack layer. */
 export declare function buildConflictInstruction(stackRebase: string | undefined): string;
-/** Push a conflict resolution or branch refresh: one branch, or the whole rewritten native stack. */
-export declare function buildBranchPushInstruction(stackRebase: string | undefined, hasConflicts: boolean, mutationSuffix: string): string;
+/**
+ * Push a conflict resolution or branch refresh: one branch, or the whole rewritten native stack.
+ * After a merge-queue ejection update, push only when the update or a fix changed the head.
+ */
+export declare function buildBranchPushInstruction(stackRebase: string | undefined, hasConflicts: boolean, mutationSuffix: string, ejectionUpdate?: boolean): string;

package/bin/commands/iterate/native-stack-rebase.mjs

@@ -44,8 +44,17 @@ export function buildConflictInstruction(stackRebase) {
     const pointer = "The branch has merge conflicts (see `**branch**` above).";
     return stackRebase ? `${pointer} ${stackRebase}` : `${pointer} Resolve them before committing.`;
 }
-/** Push a conflict resolution or branch refresh: one branch, or the whole rewritten native stack. */
-export function buildBranchPushInstruction(stackRebase, hasConflicts, mutationSuffix) {
+/**
+ * Push a conflict resolution or branch refresh: one branch, or the whole rewritten native stack.
+ * After a merge-queue ejection update, push only when the update or a fix changed the head.
+ */
+export function buildBranchPushInstruction(stackRebase, hasConflicts, mutationSuffix, ejectionUpdate = false) {
+    if (ejectionUpdate) {
+        const push = stackRebase
+            ? "commit any remaining changes on the PR head branch and push the rewritten stack with `gh stack push`"
+            : "commit any remaining changes and push to the PR head branch";
+        return `If the base update or a fix changed the head, ${push}${mutationSuffix}. If neither did, do not push.`;
+    }
     if (stackRebase)
         return `Commit any remaining changes on the PR head branch and push the rewritten stack with \`gh stack push\`${mutationSuffix}.`;
     return hasConflicts

package/bin/commands/iterate/queue-recovery-instructions.d.mts

@@ -0,0 +1,8 @@
+/** Instruction text for a PR that GitHub removed from the merge queue after failed checks. */
+import type { AgentCheck, ShepherdReport } from "../../types.mts";
+/** Which recovery command, if any, Shepherd printed for a failure that does not reproduce. */
+export type QueueEjectionRecovery = "requeue" | "acknowledge" | "none";
+/** The removed queue commit whose failed checks this tick surfaces, if the removal is current. */
+export declare function currentEjectionCommit(report: ShepherdReport, checks: AgentCheck[]): string | undefined;
+/** The ejection step after failing-check triage; points at a stack route already printed. */
+export declare function queueEjectionSteps(recovery: QueueEjectionRecovery | undefined, stackRebase: string | undefined, routePrinted: boolean): string[];

package/bin/commands/iterate/queue-recovery-instructions.mjs

@@ -0,0 +1,38 @@
+/** Instruction text for a PR that GitHub removed from the merge queue after failed checks. */
+import { playbookPointer } from "../playbook-pointer.mjs";
+/** The removed queue commit whose failed checks this tick surfaces, if the removal is current. */
+export function currentEjectionCommit(report, checks) {
+    const queue = report.mergeQueue;
+    const commit = queue?.latestRemoval?.beforeCommitOid;
+    if (!commit || queue.inQueue || queue.headUpdatedAfterRemoval)
+        return undefined;
+    return checks.some((check) => check.scope === "merge_group" && check.commitOid === commit)
+        ? commit
+        : undefined;
+}
+/** The ejection step after failing-check triage; points at a stack route already printed. */
+export function queueEjectionSteps(recovery, stackRebase, routePrinted) {
+    if (!recovery)
+        return [];
+    const route = stackRebase && routePrinted ? "use the stack route printed above." : stackRebase;
+    return [buildQueueEjectionInstruction(recovery, route)];
+}
+/**
+ * The trigger, update route, and command guard; the fixed procedure lives in the playbook.
+ * A printed command implies a `failed_checks` removal. Without one, the agent reads the raw
+ * removal reason, since a person's dequeue must not be undone by a branch update.
+ */
+function buildQueueEjectionInstruction(recovery, stackRoute) {
+    const target = stackRoute ? "the stack" : "the PR head";
+    const route = stackRoute ? `: ${stackRoute}` : ".";
+    const update = recovery === "none"
+        ? `If the \`**queue removal**\` reason shows GitHub removed the entry itself, update ${target} from the latest base first${route} If a person may have dequeued the PR, skip that update unless a conflict step above requires it.`
+        : `Update ${target} from the latest base first${route}`;
+    const reproduce = "only if the failure does not reproduce on the updated head, neither the update nor a code change altered the head, and no other blocker remains.";
+    const guard = recovery === "requeue"
+        ? `Run \`requeue:\` ${reproduce} If gh reports auto-merge is disabled, run \`requeue API fallback:\` instead.`
+        : recovery === "acknowledge"
+            ? `Run \`acknowledge queue removal:\` ${reproduce}`
+            : "Shepherd printed no queue command for this session, so do not enqueue the PR.";
+    return `Triage the merge-queue ejection before any requeue. ${update} ${guard} ${playbookPointer("Merge queue ejection")}`;
+}

package/bin/commands/iterate/render.d.mts

@@ -1,5 +1,7 @@
 import type { AgentThread, AgentComment, AgentCheck, Review, ResolveCommand, FirstLookThread, FirstLookComment, ReviewThread } from "../../types.mts";
+import { type QueueEjectionRecovery } from "./queue-recovery-instructions.mts";
 /** Render a resolve command as a shell snippet. Appends `--require-sha "$HEAD_SHA"` when set. */
 export declare function renderResolveCommand(rc: ResolveCommand): string;
 export declare function buildFixInstructions(threads: AgentThread[], actionableComments: AgentComment[], checks: AgentCheck[], changesRequestedReviews: Review[], baseBranch: string, resolveCommand: ResolveCommand, hasConflicts: boolean, prReference: string | number, _cancelledCount: number, firstLookThreads?: FirstLookThread[], firstLookComments?: FirstLookComment[], firstLookSummaries?: Review[], editedSummaries?: Review[], _inProgressRunIds?: string[], resolutionOnlyThreads?: ReviewThread[], resolveOnlyCommand?: ResolveCommand, behindBaseHint?: string, // iterate.behindBaseHint — see buildBehindBaseHintInstruction
-isBehind?: boolean, viewerCanUpdate?: boolean, hasExhaustedWorkflowRerun?: boolean, stackRebase?: string): string[];
+isBehind?: boolean, viewerCanUpdate?: boolean, hasExhaustedWorkflowRerun?: boolean, stackRebase?: string, // native stack layers rebase with gh-stack, not branch by branch
+queueEjection?: QueueEjectionRecovery): string[];

package/bin/commands/iterate/render.mjs

@@ -5,6 +5,7 @@ import { isFailingAgentCheck } from "../../checks/conclusions.mjs";
 import { buildCommitSuggestionInstruction } from "../commit-suggestion-instruction.mjs";
 import { partitionFixThreads, reviewSectionRefs } from "./fix-instruction-threads.mjs";
 import { buildBranchPushInstruction, buildConflictInstruction } from "./native-stack-rebase.mjs";
+import { queueEjectionSteps } from "./queue-recovery-instructions.mjs";
 /** Render a resolve command as a shell snippet. Appends `--require-sha "$HEAD_SHA"` when set. */
 export function renderResolveCommand(rc) {
     const parts = [...rc.argv];
@@ -13,7 +14,8 @@ export function renderResolveCommand(rc) {
     return renderShellCommand(parts);
 }
 export function buildFixInstructions(threads, actionableComments, checks, changesRequestedReviews, baseBranch, resolveCommand, hasConflicts, prReference, _cancelledCount, firstLookThreads = [], firstLookComments = [], firstLookSummaries = [], editedSummaries = [], _inProgressRunIds = [], resolutionOnlyThreads = [], resolveOnlyCommand, behindBaseHint = "", // iterate.behindBaseHint — see buildBehindBaseHintInstruction
-isBehind = false, viewerCanUpdate = false, hasExhaustedWorkflowRerun = false, stackRebase) {
+isBehind = false, viewerCanUpdate = false, hasExhaustedWorkflowRerun = false, stackRebase, // native stack layers rebase with gh-stack, not branch by branch
+queueEjection) {
     const instructions = [];
     const { locatedThreads, unlocatedMutatedThreads, unlocatedThreads } = partitionFixThreads(threads, resolveCommand, resolveOnlyCommand);
     const failingChecks = checks.filter((c) => isFailingAgentCheck(c));
@@ -45,25 +47,22 @@ isBehind = false, viewerCanUpdate = false, hasExhaustedWorkflowRerun = false, st
     });
     // The conflict hint belongs with the conflict step; otherwise it precedes the push step.
     const hintWithConflictStep = hasConflicts && !hasRepeatedWorkflowBranchRecovery;
-    if (hintWithConflictStep) {
+    const branchRecovery = hasConflicts || hasRepeatedWorkflowBranchRecovery;
+    if (hintWithConflictStep)
         instructions.push(buildConflictInstruction(stackRebase), ...branchUpdateHint);
-    }
     const firstLookTotal = firstLookThreads.length + firstLookComments.length;
-    if (firstLookTotal > 0) {
+    if (firstLookTotal > 0)
         instructions.push("Review every item under `## First-look items` before acting.");
-    }
     if (firstLookSummaries.length > 0 && viewerCanUpdate)
         instructions.push(SHEPHERD_JOURNAL_FIRST_LOOK_GUIDANCE);
     const editedTotal = editedSummaries.length +
         actionableComments.filter((c) => c.edited).length +
         firstLookThreads.filter((t) => t.edited).length +
         firstLookComments.filter((c) => c.edited).length;
-    if (editedTotal > 0) {
+    if (editedTotal > 0)
         instructions.push("Read every item marked `[edited since first look]`, including edited summaries and edited first-look bullets, before deciding whether to resolve a matching thread.");
-    }
-    if (unlocatedThreads.length > 0) {
+    if (unlocatedThreads.length > 0)
         instructions.push("Acknowledge each item under `## Unlocated review threads (logged once — no mutation)`. Shepherd cannot route a code fix or review mutation without a path and line; the unchanged item will be skipped on later ticks.");
-    }
     const hasSuggestions = locatedThreads.some((t) => t.suggestion);
     if (hasSuggestions)
         instructions.push(buildCommitSuggestionInstruction(prReference, "## Review threads"));
@@ -73,13 +72,11 @@ isBehind = false, viewerCanUpdate = false, hasExhaustedWorkflowRerun = false, st
         const filesRef = locatedThreads.length > 0 ? "each file referenced above" : "the relevant files";
         instructions.push(`Apply every warranted review fix in ${filesRef}.`);
     }
-    if (resolutionOnlyThreads.length > 0) {
+    if (resolutionOnlyThreads.length > 0)
         instructions.push("Review the threads under `## Review threads to resolve` before running the generated mutations.");
-    }
-    instructions.push(...buildFailingCheckInstructions(failingChecks), ...repeatedWorkflowBranchRecoveryInstructions);
-    if (hasAnnotations) {
+    instructions.push(...buildFailingCheckInstructions(failingChecks), ...repeatedWorkflowBranchRecoveryInstructions, ...queueEjectionSteps(queueEjection, stackRebase, branchRecovery));
+    if (hasAnnotations)
         instructions.push("Inspect every referenced range under `## Check annotations` and apply any warranted change.");
-    }
     if (changesRequestedReviews.length > 0) {
         const staleClause = buildCrStaleClause(changesRequestedReviews);
         instructions.push(`Read every body under \`## Changes-requested reviews\` and apply any warranted change.${staleClause}`);
@@ -88,8 +85,8 @@ isBehind = false, viewerCanUpdate = false, hasExhaustedWorkflowRerun = false, st
         instructions.push(...branchUpdateHint);
     const hasReviewMutations = resolveCommand.hasMutations || resolveOnlyCommand?.hasMutations === true;
     const mutationSuffix = hasReviewMutations ? " before review mutations" : "";
-    if (hasConflicts || hasRepeatedWorkflowBranchRecovery) {
-        instructions.push(buildBranchPushInstruction(stackRebase, hasConflicts, mutationSuffix));
+    if (branchRecovery || queueEjection) {
+        instructions.push(buildBranchPushInstruction(stackRebase, hasConflicts, mutationSuffix, !branchRecovery));
     }
     else if (hasNonConflictHints) {
         instructions.push("If you changed code, commit any remaining changes and push to the PR head branch. If you did not, do not commit.");

package/bin/commands/iterate/stall.mjs

@@ -50,6 +50,8 @@ function computeStallFingerprint(action, headSha, base, report, reviewSummaryIds
         state: base.state,
         isDraft: base.isDraft,
         checks,
+        // A requeued head ejected again gets its own triage window.
+        queueRemovalCommit: report.mergeQueue?.latestRemoval?.beforeCommitOid,
         threads,
         resolutionOnlyThreads,
         ruleAutoResolveThreads,

package/bin/github/batch-parsers.mjs

@@ -118,6 +118,12 @@ export function parseRawPr(raw, rawThreadPages, rawCommentNodes, rawReviewNodes,
         reviewDecision: (raw.reviewDecision ?? null),
         headRefOid: raw.headRefOid,
         ...(headPushedAtUnix !== undefined && { headPushedAtUnix }),
+        ...(raw.headRefForcePushes?.nodes[0] && {
+            headForcePushedAtUnix: Math.floor(Date.parse(raw.headRefForcePushes.nodes[0].createdAt) / 1000),
+        }),
+        ...(raw.mergeQueueRemovalTimes && {
+            mergeQueueRemovalTimesUnix: raw.mergeQueueRemovalTimes.nodes.map((node) => Math.floor(Date.parse(node.createdAt) / 1000)),
+        }),
         headRefName: raw.headRefName,
         headRepoWithOwner: raw.headRepository?.nameWithOwner ?? null,
         viewerAuthorization: {

package/bin/github/batch-raw-rules.d.mts

@@ -101,6 +101,18 @@ export interface RawPrMergeFields {
             createdAt: string;
         }>;
     } | null;
+    /** Timestamps of the last 10 queue removals; counts repeat ejections of one head. */
+    mergeQueueRemovalTimes?: {
+        nodes: Array<{
+            createdAt: string;
+        }>;
+    } | null;
+    /** The latest force-push, which dates a head whose commit time predates its push. */
+    headRefForcePushes?: {
+        nodes: Array<{
+            createdAt: string;
+        }>;
+    } | null;
     stack?: RawStack | null;
     stackEntry?: {
         position: number;

package/bin/github/gql/batch-pr.gql

@@ -88,6 +88,20 @@ query BatchPr($owner: String!, $repo: String!, $pr: Int!) {
           }
         }
       }
+      mergeQueueRemovalTimes: timelineItems(last: 10, itemTypes: [REMOVED_FROM_MERGE_QUEUE_EVENT]) {
+        nodes {
+          ... on RemovedFromMergeQueueEvent {
+            createdAt
+          }
+        }
+      }
+      headRefForcePushes: timelineItems(last: 1, itemTypes: [HEAD_REF_FORCE_PUSHED_EVENT]) {
+        nodes {
+          ... on HeadRefForcePushedEvent {
+            createdAt
+          }
+        }
+      }
       stack {
         number
         size

package/bin/github/gql/poll-summary-check-contexts.gql

@@ -12,6 +12,8 @@ fragment PollSummaryCheckContexts on StatusCheckRollupContextConnection {
       status
       conclusion
       detailsUrl
+      startedAt
+      completedAt
       checkSuite {
         createdAt
         workflowRun {

package/bin/github/gql/poll-summary-fragment.gql

@@ -93,6 +93,13 @@ fragment PollSummaryPr on PullRequest {
       }
     }
   }
+  headRefForcePushes: timelineItems(last: 1, itemTypes: [HEAD_REF_FORCE_PUSHED_EVENT]) {
+    nodes {
+      ... on HeadRefForcePushedEvent {
+        createdAt
+      }
+    }
+  }
   mergeQueueEntry {
     headCommit {
       oid

package/bin/github/merge-queue-checks.mjs

@@ -1,7 +1,7 @@
 import { parseCreatedAt } from "./batch-parser-helpers.mjs";
 import { graphqlWithRateLimit } from "./client.mjs";
 import { GitHubRequestError } from "./errors.mjs";
-import { headPushUnixFromCheckNodes, queueRemovalAppliesToHead, } from "./queue-removal-freshness.mjs";
+import { forcePushUnix, headPushUnixFromCheckNodes, queueRemovalAppliesToHead, } from "./queue-removal-freshness.mjs";
 import { requireContextNodes } from "./batch-response.mjs";
 import { COMMIT_CHECK_CONTEXTS_QUERY } from "./queries.mjs";
 function omittedCursorError(oid) {
@@ -79,6 +79,7 @@ function currentRemovalCommit(raw) {
             headCommittedAtUnix: parseCreatedAt(headCommit.committedDate),
         }),
         ...(headPushedAtUnix !== undefined && { headPushedAtUnix }),
+        headForcePushedAtUnix: forcePushUnix(raw.headRefForcePushes),
         removedAtUnix: Math.floor(Date.parse(removal.createdAt) / 1000),
     })) {
         return undefined;

package/bin/github/poll-summary-checks.mjs

@@ -1,10 +1,9 @@
 import { classifyChecks } from "../checks/classify.mjs";
+import { parseCreatedAt } from "./batch-parser-helpers.mjs";
 export function summarizePollSummaryChecks(raw) {
     const rollups = summaryRollups(raw);
     const counts = {};
-    for (const check of classifyChecks(checkRuns(rollups), {
-        additionalRelevantEvents: ["merge_group"],
-    })) {
+    for (const check of classifiedSummaryChecks(raw)) {
         const key = {
             passed: "passing",
             failing: "failing",
@@ -17,33 +16,36 @@ export function summarizePollSummaryChecks(raw) {
         counts[key] = (counts[key] ?? 0) + 1;
     }
     const summary = counts;
-    if (rollups.some((rollup) => rollup.contexts.pageInfo.hasPreviousPage)) {
+    if (rollups.some(({ rollup }) => rollup.contexts.pageInfo.hasPreviousPage)) {
         summary.incomplete = true;
     }
     return summary;
 }
 /** Names of failing checks in the loaded summary rollup. */
 export function failingSummaryCheckNames(raw) {
-    return classifyChecks(checkRuns(summaryRollups(raw)), {
-        additionalRelevantEvents: ["merge_group"],
-    })
+    return classifiedSummaryChecks(raw)
         .filter((check) => check.category === "failing")
         .map((check) => check.name);
 }
 function summaryRollups(raw) {
     return [
-        raw.commits.nodes[0]?.commit.statusCheckRollup,
-        raw.mergeQueueEntry?.headCommit?.statusCheckRollup,
-    ].filter((rollup) => rollup !== null && rollup !== undefined);
+        { rollup: raw.commits.nodes[0]?.commit.statusCheckRollup, scope: undefined },
+        {
+            rollup: raw.mergeQueueEntry?.headCommit?.statusCheckRollup,
+            scope: "merge_group",
+        },
+    ].flatMap(({ rollup, scope }) => (rollup ? [{ rollup, scope }] : []));
 }
-function checkRuns(rollups) {
-    return rollups.flatMap((rollup, rollupIndex) => rollup.contexts.nodes.map((context) => {
+function classifiedSummaryChecks(raw) {
+    // A successful check on the queue commit cannot cover a PR-head cancellation, or vice versa.
+    return summaryRollups(raw).flatMap(({ rollup, scope }) => classifyChecks(checkRuns(rollup, scope), scope === "merge_group" ? { additionalRelevantEvents: ["merge_group"] } : {}));
+}
+function checkRuns(rollup, scope) {
+    return rollup.contexts.nodes.map((context) => {
         if (context.__typename === "StatusContext") {
             return {
                 name: context.context,
-                status: context.state === "PENDING" || context.state === "EXPECTED"
-                    ? "IN_PROGRESS"
-                    : "COMPLETED",
+                status: context.state === "PENDING" || context.state === "EXPECTED" ? "IN_PROGRESS" : "COMPLETED",
                 conclusion: context.state === "SUCCESS"
                     ? "SUCCESS"
                     : context.state === "FAILURE" || context.state === "ERROR"
@@ -53,7 +55,7 @@ function checkRuns(rollups) {
                 detailsUrl: "",
                 event: null,
                 runId: null,
-                ...(rollupIndex === 1 && { scope: "merge_group" }),
+                ...(scope && { scope }),
             };
         }
         const run = context.checkSuite?.workflowRun;
@@ -70,7 +72,9 @@ function checkRuns(rollups) {
             ...(run?.workflow?.databaseId != null && {
                 workflowId: String(run.workflow.databaseId),
             }),
-            ...(rollupIndex === 1 && { scope: "merge_group" }),
+            ...(context.startedAt && { startedAtUnix: parseCreatedAt(context.startedAt) }),
+            ...(context.completedAt && { completedAtUnix: parseCreatedAt(context.completedAt) }),
+            ...(scope && { scope }),
         };
-    }));
+    });
 }

package/bin/github/poll-summary-queue-removal.mjs

@@ -1,4 +1,4 @@
-import { headPushUnixFromCheckNodes, queueRemovalAppliesToHead, } from "./queue-removal-freshness.mjs";
+import { forcePushUnix, headPushUnixFromCheckNodes, queueRemovalAppliesToHead, } from "./queue-removal-freshness.mjs";
 import { parseCreatedAt } from "./batch-parser-helpers.mjs";
 /** Latest queue removal that still applies to this PR head, not an older attempt. */
 export function currentQueueRemovalEvent(raw) {
@@ -21,6 +21,7 @@ export function currentQueueRemovalEvent(raw) {
             headCommittedAtUnix: parseCreatedAt(headCommit.committedDate),
         }),
         ...(headPushedAtUnix !== undefined && { headPushedAtUnix }),
+        headForcePushedAtUnix: forcePushUnix(raw.headRefForcePushes),
         removedAtUnix: Math.floor(removalTime / 1000),
     })) {
         return null;

package/bin/github/poll-summary-raw.d.mts

@@ -26,6 +26,8 @@ type RawCheckContext = {
     status: string;
     conclusion: string | null;
     detailsUrl?: string;
+    startedAt?: string | null;
+    completedAt?: string | null;
     annotations?: {
         totalCount: number;
     };
@@ -136,6 +138,12 @@ export interface RawSummaryPr {
     mergeQueueEntry: {
         headCommit: RawSummaryCommit | null;
     } | null;
+    /** The latest force-push, which dates a head whose commit and check times predate its push. */
+    headRefForcePushes?: {
+        nodes: Array<{
+            createdAt: string;
+        }>;
+    } | null;
     stack: {
         number: number;
         size: number;

package/bin/github/queue-removal-freshness.d.mts

@@ -15,17 +15,35 @@ type PushCheckNode = {
  * build a one-parent commit on the base, so parent identity cannot show a
  * later push. Missing parents are unverifiable: GitHub keeps returning the
  * latest removal after the synthetic commit is gone. A one-parent removal is
- * stale once this head reached the PR after the removal. That time is the
- * earliest pull_request check on the head, with the head's committer time as
- * the fallback when no check time is available.
+ * stale once this head reached the PR after the removal (see `headArrivalUnix`).
+ * A force-push after the removal makes any removal stale, even one whose
+ * parents list the head: that SHA was pushed back for a new attempt.
  */
-export declare function queueRemovalAppliesToHead(input: {
+export declare function queueRemovalAppliesToHead(input: HeadTimes & {
     parentOids: readonly string[] | null | undefined;
     headOid: string;
-    headCommittedAtUnix?: number;
-    headPushedAtUnix?: number;
     removedAtUnix?: number;
 }): boolean;
+type HeadTimes = {
+    headCommittedAtUnix?: number | null;
+    headPushedAtUnix?: number;
+    headForcePushedAtUnix?: number;
+};
+/**
+ * When the current head reached the PR. The earliest pull_request check on the
+ * head is its push time, but it can come from an earlier tenure of a commit
+ * that was later force-pushed back, so the latest force-push wins when it is
+ * later. Without a check time, the committer time is the fallback, again
+ * superseded by a later force-push. A committer clock that runs ahead only
+ * matters in that fallback.
+ */
+export declare function headArrivalUnix(input: HeadTimes): number | undefined;
+/** Latest head-ref force-push time from a `headRefForcePushes` timeline field. */
+export declare function forcePushUnix(field: {
+    nodes: Array<{
+        createdAt: string;
+    }>;
+} | null | undefined): number | undefined;
 /** Earliest pull_request check-suite time on the head commit, when one exists. */
 export declare function headPushUnixFromCheckNodes(nodes: readonly (PushCheckNode | null)[] | null | undefined): number | undefined;
 export {};

package/bin/github/queue-removal-freshness.mjs

@@ -7,28 +7,50 @@ const PULL_REQUEST_EVENTS = new Set(["pull_request", "pull_request_target"]);
  * build a one-parent commit on the base, so parent identity cannot show a
  * later push. Missing parents are unverifiable: GitHub keeps returning the
  * latest removal after the synthetic commit is gone. A one-parent removal is
- * stale once this head reached the PR after the removal. That time is the
- * earliest pull_request check on the head, with the head's committer time as
- * the fallback when no check time is available.
+ * stale once this head reached the PR after the removal (see `headArrivalUnix`).
+ * A force-push after the removal makes any removal stale, even one whose
+ * parents list the head: that SHA was pushed back for a new attempt.
  */
 export function queueRemovalAppliesToHead(input) {
     const parents = input.parentOids ?? [];
     if (parents.length === 0)
         return false;
+    const removedAt = positive(input.removedAtUnix);
+    const forcePushedAt = positive(input.headForcePushedAtUnix);
+    // The same SHA force-pushed back after the removal starts a new tenure.
+    if (removedAt !== undefined && forcePushedAt !== undefined && forcePushedAt > removedAt)
+        return false;
     if (parents.includes(input.headOid))
         return true;
     if (parents.length > 1)
         return false;
-    const removedAt = input.removedAtUnix;
-    if (removedAt === undefined || removedAt <= 0)
+    if (removedAt === undefined)
         return true;
-    const pushedAt = input.headPushedAtUnix;
-    if (pushedAt !== undefined && pushedAt > 0)
-        return pushedAt <= removedAt;
-    const committedAt = input.headCommittedAtUnix;
-    if (committedAt !== undefined && committedAt > removedAt)
-        return false;
-    return true;
+    const arrivedAt = headArrivalUnix(input);
+    return arrivedAt === undefined || arrivedAt <= removedAt;
+}
+/**
+ * When the current head reached the PR. The earliest pull_request check on the
+ * head is its push time, but it can come from an earlier tenure of a commit
+ * that was later force-pushed back, so the latest force-push wins when it is
+ * later. Without a check time, the committer time is the fallback, again
+ * superseded by a later force-push. A committer clock that runs ahead only
+ * matters in that fallback.
+ */
+export function headArrivalUnix(input) {
+    const pushedAt = positive(input.headPushedAtUnix) ?? positive(input.headCommittedAtUnix);
+    const forcePushedAt = positive(input.headForcePushedAtUnix);
+    if (pushedAt === undefined)
+        return forcePushedAt;
+    return forcePushedAt === undefined ? pushedAt : Math.max(pushedAt, forcePushedAt);
+}
+function positive(value) {
+    return value !== undefined && value !== null && value > 0 ? value : undefined;
+}
+/** Latest head-ref force-push time from a `headRefForcePushes` timeline field. */
+export function forcePushUnix(field) {
+    const raw = field?.nodes[0]?.createdAt;
+    return raw ? positive(parseCreatedAt(raw)) : undefined;
 }
 /** Earliest pull_request check-suite time on the head commit, when one exists. */
 export function headPushUnixFromCheckNodes(nodes) {

package/bin/state/queue-removal-ack.d.mts

@@ -9,7 +9,11 @@ type StateKey = {
     repo: string;
     pr: number;
 };
-/** The only removal reasons that indicate a CI-driven queue ejection. */
+/**
+ * The only removal reason that indicates a CI-driven queue ejection. GitHub sends lowercase raw
+ * strings; observed values also include `merged`, `merge_conflict`, `invalid_merge_commit`, and
+ * `stack_invalidated`, none of which a requeue can recover.
+ */
 export declare function isCiQueueRemovalReason(reason: string | null | undefined): boolean;
 /** Missing, unreadable, or malformed acknowledgment state is treated as absent. */
 export declare function readQueueRemovalAcknowledgment(key: StateKey): Promise<QueueRemovalAcknowledgment | null>;

package/bin/state/queue-removal-ack.mjs

@@ -4,9 +4,13 @@ import { randomUUID } from "node:crypto";
 import { dirname } from "node:path";
 import { resolvePrStatePath } from "./base.mjs";
 const FILE = "queue-removal-ack.json";
-/** The only removal reasons that indicate a CI-driven queue ejection. */
+/**
+ * The only removal reason that indicates a CI-driven queue ejection. GitHub sends lowercase raw
+ * strings; observed values also include `merged`, `merge_conflict`, `invalid_merge_commit`, and
+ * `stack_invalidated`, none of which a requeue can recover.
+ */
 export function isCiQueueRemovalReason(reason) {
-    return reason === "CI_FAILURE" || reason === "MERGE_QUEUE_POLICY_CHECK_FAILURE";
+    return reason === "failed_checks";
 }
 /** Missing, unreadable, or malformed acknowledgment state is treated as absent. */
 export async function readQueueRemovalAcknowledgment(key) {

package/bin/types/github.d.mts

@@ -146,6 +146,10 @@ export interface BatchPrData extends BatchPrMergeFields {
      * that signal is unavailable; queue-removal freshness then uses committer time.
      */
     headPushedAtUnix?: number;
+    /** Unix times of the last 10 merge-queue removals, oldest first. */
+    mergeQueueRemovalTimesUnix?: number[];
+    /** Unix time of the latest head-ref force-push, when GitHub reports one. */
+    headForcePushedAtUnix?: number;
     headRefName: string;
     /** `"owner/name"` of the head repository; null when the fork has been deleted. */
     headRepoWithOwner: string | null;

package/bin/types/merge-queue.d.mts

@@ -10,6 +10,8 @@ export interface MergeQueueReport {
     checksIncomplete?: true;
     /** The current PR head is not a parent of the removed synthetic queue commit. */
     headUpdatedAfterRemoval?: true;
+    /** Queue removals since the current head reached the PR; emitted only when above 1. */
+    removalsOnHead?: number;
     /** The caller acknowledged this exact native-stack removal on the current head. */
     removalAcknowledged?: true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pr-shepherd",
-  "version": "0.56.2",
+  "version": "0.56.4",
   "description": "Autonomous PR CI monitor and review-comment resolver for agentic coding tools",
   "keywords": [
     "automation",
@@ -89,7 +89,7 @@
     "husky": "^9.1.7",
     "knip": "^6.14.1",
     "marked": "^18.0.11",
-    "oxfmt": "^0.68.0",
+    "oxfmt": "^0.70.0",
     "oxlint": "^1.60.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0"

package/plugins/pr-shepherd/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pr-shepherd",
-  "version": "0.56.2",
+  "version": "0.56.4",
   "description": "Autonomous PR CI monitor and review-comment resolver for Codex.",
   "author": {
     "name": "Jonathan Ong",

package/plugins/pr-shepherd/.codex.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "pr-shepherd": {
       "command": "npx",
-      "args": ["--yes", "--package", "pr-shepherd@0.56.2", "pr-shepherd-mcp"]
+      "args": ["--yes", "--package", "pr-shepherd@0.56.4", "pr-shepherd-mcp"]
     }
   }
 }

package/plugins/pr-shepherd/.mcp.json

@@ -1,6 +1,6 @@
 {
   "pr-shepherd": {
     "command": "npx",
-    "args": ["--yes", "--package", "pr-shepherd@0.56.2", "pr-shepherd-mcp"]
+    "args": ["--yes", "--package", "pr-shepherd@0.56.4", "pr-shepherd-mcp"]
   }
 }

package/plugins/pr-shepherd/skills/pr-shepherd/SKILL.md

@@ -73,3 +73,4 @@ When a step says `Playbook: "<name>"`, read that file once and apply it before t
 - [Shepherd Journal](references/journal.md)
 - [Branch update](references/branch-update.md)
 - [Stack merge](references/stack-merge.md)
+- [Merge queue ejection](references/merge-queue-ejection.md)

package/plugins/pr-shepherd/skills/pr-shepherd/references/ci-failure-triage.md

@@ -6,7 +6,7 @@ Apply when a step says `Playbook: "CI failure triage"`. For a GitHub Actions row
 - `[rerun authorized]` plus a `rerun:` command means the viewer can rerun Actions (WRITE+) and this is the original attempt. Shepherd checked `repositoryPermission` and `run_attempt`.
 - Run that printed command at most once. An `[attempt: N]` check never gets another rerun. A log excerpt on a later attempt is still investigation work. A later attempt with no usable evidence escalates when nothing else remains.
 - A run in progress, `[conclusion: ACTION_REQUIRED]`, a check whose run id is not a GitHub Actions workflow, or a run with no attempt metadata never gets `[rerun authorized]`.
-- A check with `scope: merge_group` never gets a rerun command. Rerunning cannot restore a removed queue entry and overwrites the failure evidence. If the failure belongs to this PR, fix the PR head. If it does not, follow the printed requeue instruction when a plan is present. Without `--merge`, report the failure without enqueueing. For native stacks, child sessions omit `--merge` and may still record the printed local acknowledgment after inspecting logs or an external provider URL. Complete fresh one-PR READY validation before returning to the aggregate selector with its original options; never enqueue a stack layer directly.
+- A check with `scope: merge_group` never gets a rerun command. Rerunning cannot restore a removed queue entry and overwrites the failure evidence. If the failure belongs to this PR, fix the PR head. If it does not and an ejection step is printed, apply the Merge queue ejection playbook it names. Without an ejection step the entry is still queued: make no queue mutation and iterate until GitHub reports the removal.
 - Do not invent a handoff from `[FIX_CODE]`. Shepherd returns `[ESCALATE]` when no autonomous follow-up remains.
 - Several bullets can share one run id (matrix jobs). The `rerun:` command is printed once, on the first bullet. Run it once.
 

package/plugins/pr-shepherd/skills/pr-shepherd/references/merge-queue-ejection.md

@@ -0,0 +1,17 @@
+# Merge queue ejection
+
+Apply when a step says `Playbook: "Merge queue ejection"`. The `**queue removal**` header names the queue commit. That commit combined the PR head with the base and any entries queued ahead of it, so a failure there may come from this PR, the base, another entry, or a flake. Do not requeue without triage. After triage, continue with the remaining numbered steps; iterate only at the final step.
+
+1. Update the PR head from the latest base following the repository's branch-update convention. On a native stack, use the printed stack update route instead. Reproduce the failing step on the updated head.
+2. If the failure belongs to this PR, fix it. The printed push step commits and pushes the fix.
+3. If the failure does not reproduce and the update changed the head, the printed push step pushes it (`gh stack push` on a native stack). Never run a printed `requeue:` or `acknowledge queue removal:` command after a push. Shepherd prints a fresh queue command once the new head is READY.
+4. If the failure comes from the base itself, do not requeue or acknowledge it. If a Shepherd Journal step is printed, record the finding with it. Make no change. The unchanged failure escalates through the stall timeout.
+5. If the removal reason suggests a person dequeued the PR, skip the step 1 update unless a conflict step requires it. Fix a failure that belongs to this PR; otherwise make no change. Never enqueue.
+6. If the step says no queue command was printed, never enqueue. A failure that does not reproduce follows step 4. Shepherd prints no queue command once the same head was already removed before (`removals on this head` in the header), so a flaky failure is not retried indefinitely.
+7. Otherwise, run the printed `requeue:` or `acknowledge queue removal:` command exactly as printed, and only if all of these hold:
+   - the head did not change;
+   - no code changed;
+   - no other blocker remains;
+   - the logs or the check's details page show a transient failure, or a failure caused by another entry in the same queue group.
+8. If gh reports auto-merge is disabled instead of adding the PR to the queue, run the `requeue API fallback:` command. Both requeue commands require the observed PR head SHA. If the head changed, iterate for a fresh command.
+9. After `acknowledge queue removal:`, finish this one-PR session so it validates current source CI and records its READY receipt. Then return to the aggregate `--stack` selector with its original options. In merge mode it verifies lower-layer readiness before merging. Never enqueue or merge a stack layer directly.