alissa-tools-github-orcloop 0.3.8__tar.gz → 0.3.10__tar.gz

{alissa_tools_github_orcloop-0.3.8/src/main/alissa_tools_github_orcloop.egg-info → alissa_tools_github_orcloop-0.3.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.3.8
+Version: 0.3.10
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_orcloop-0.3.8 → alissa_tools_github_orcloop-0.3.10}/src/main/alissa/tools/github/orcloop/__main__.py

@@ -145,6 +145,18 @@ def build_parser() -> argparse.ArgumentParser:
         "disables it). The sweep reports, it never releases.",
     )
 
+    over.add_argument(
+        "--autoclose-grace-seconds",
+        type=int,
+        metavar="SECONDS",
+        help="close edge only: how long to let GitHub close a released issue "
+        "itself, measured from the closing PR's mergedAt, before the daemon "
+        "closes it mechanically (default 300; 0 = no grace). GitHub's "
+        "`Closes #n` auto-close is best-effort and can silently never fire, "
+        "which would otherwise leave the issue open and its origin task stuck "
+        "forever.",
+    )
+
     close = over.add_mutually_exclusive_group()
     close.add_argument(
         "--close-loop",
@@ -191,6 +203,7 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "alissa_endpoint": args.alissa_endpoint,
         "ledger_path": args.ledger_path,
         "close_loop_enabled": args.close_loop_enabled,
+        "autoclose_grace_seconds": args.autoclose_grace_seconds,
         "dry_run": args.dry_run,
         "release_feed": args.release_feed,
         "bow_prefix": args.bow_prefix,

{alissa_tools_github_orcloop-0.3.8 → alissa_tools_github_orcloop-0.3.10}/src/main/alissa/tools/github/orcloop/config.py

@@ -121,6 +121,7 @@ CONFIG_KEYS = (
     "dry_run",
     "ledger_path",
     "close_loop_enabled",
+    "autoclose_grace_seconds",
     "release_feed",
     "bow_prefix",
     "bow_owners",
@@ -499,6 +500,25 @@ class Config:
     # half; every side effect still honors dry_run. Off reverts to release-only.
     close_loop_enabled: bool = True
 
+    # How long to let GitHub close a released issue itself, measured from the
+    # closing PR's `mergedAt`, before the close edge closes it mechanically.
+    #
+    # GitHub's `Closes #n` auto-close is best-effort, not a contract: it has been
+    # observed to silently never fire on a properly-linked PR while a sibling
+    # merge seconds earlier auto-closed normally. Past this window an issue whose
+    # closing PR has MERGED is treated as a flaked platform step and completed by
+    # the daemon (issue #40). Within it, nothing happens -- the daemon never
+    # races the platform for a step the platform usually performs.
+    #
+    # Minutes, not seconds or hours: auto-close normally lands within seconds, so
+    # a few minutes is far outside the healthy distribution, while an hour would
+    # leave the released work's lane occupied for an hour on every flake. `0`
+    # means "no grace" (close on the first pass that sees the merge) and is legal
+    # -- it is a race with the platform, not a correctness problem, since the
+    # close is idempotent -- but it makes a normal auto-close look like an
+    # anomaly, so it is not the default.
+    autoclose_grace_seconds: int = 300
+
     dry_run: bool = False
 
     # Where release candidates come from: `scan` (all committed tasks, filtered
@@ -651,6 +671,20 @@ class Config:
                 f"release_blocked_floor_days must be >= 1, got {floor_days}"
             )
 
+        grace = int(raw.get("autoclose_grace_seconds", cls.autoclose_grace_seconds))
+        if grace < 0:
+            # No upper bound and no MIN_POLL_INTERVAL floor, unlike the sweep:
+            # this is a wait, not a cadence, so a small value only makes the
+            # daemon act sooner (`0` = act on the first pass that sees the
+            # merge), and a large one only makes it wait longer. Neither can
+            # produce the runaway a sub-poll INTERVAL can. Negative is the one
+            # value with no reading at all -- it would say "close it before the
+            # PR merged" -- so it is rejected rather than clamped.
+            raise ValueError(
+                f"autoclose_grace_seconds must be >= 0 (0 = no grace, close as "
+                f"soon as the merge is seen), got {grace}"
+            )
+
         marker_key = str(raw.get("marker_key", cls.marker_key))
         scope_key = str(raw.get("scope_key", cls.scope_key))
         for name, value in (("marker_key", marker_key), ("scope_key", scope_key)):
@@ -721,6 +755,7 @@ class Config:
             close_loop_enabled=bool(
                 raw.get("close_loop_enabled", cls.close_loop_enabled)
             ),
+            autoclose_grace_seconds=grace,
             dry_run=bool(raw.get("dry_run", cls.dry_run)),
             release_feed=release_feed,
             bow_prefix=bow_prefix,

{alissa_tools_github_orcloop-0.3.8 → alissa_tools_github_orcloop-0.3.10}/src/main/alissa/tools/github/orcloop/ghclient.py

@@ -1,8 +1,9 @@
 """GitHub access via `gh api`.
 
 orcloop's GitHub side: create the `alissa:develop` issue for a released task,
-manage its label, read issues back, search the watched repos, comment, and --
-for the close-loop -- find the MERGED pull request that closed a released issue.
+manage its label, read issues back, search the watched repos, comment, close an
+issue the platform should have closed itself, and -- for the close-loop -- find
+the MERGED pull request that closed a released issue.
 
 Targets gh 2.4.0, which predates `gh search` and `gh issue`-level JSON we can
 rely on: every call goes through `gh api` against REST v3. The gh-2.4.0-safe
@@ -24,6 +25,7 @@ import os
 import re
 import tempfile
 import urllib.parse
+from datetime import datetime, timezone
 from dataclasses import dataclass
 
 from . import proc
@@ -97,6 +99,33 @@ def parse_task_ref(body: str) -> int | None:
     return int(match.group(1)) if match else None
 
 
+def parse_timestamp(value: str | None) -> float | None:
+    """A GitHub RFC 3339 timestamp (`2026-07-28T04:42:55Z`) as unix seconds, or
+    None when it is missing or unparseable.
+
+    `fromisoformat` handles the `Z` suffix from 3.11 on, which `setup.py`
+    already requires. A timestamp carrying no zone is read as UTC rather than as
+    the daemon's local time: every timestamp GitHub sends is UTC, and a
+    container running in a non-UTC zone would otherwise shift an age by hours --
+    silently, and in whichever direction the deployment happens to sit.
+
+    None rather than an exception, for the same reason `pull_request` degrades a
+    malformed payload to None: the callers here are decisions, not parsers, and
+    a field GitHub omitted must not be able to crash a poll. What "unknown"
+    MEANS is the caller's to decide, which is why it is a distinct answer and
+    not, say, 0.
+    """
+    if not value:
+        return None
+    try:
+        parsed = datetime.fromisoformat(str(value).strip())
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed.timestamp()
+
+
 @dataclass(frozen=True)
 class Issue:
     owner: str
@@ -107,6 +136,17 @@ class Issue:
     body: str
     url: str
     labels: tuple[str, ...]
+    # `state_reason`, verbatim: `completed` / `not_planned` / `reopened`, or ""
+    # when GitHub did not state one. Defaulted like the PullRequest fields below
+    # -- it is a late addition to the API and an issue reopened long ago (or
+    # through an unusual path) can carry nothing here.
+    #
+    # `reopened` is the one value the close edge acts on, and it is the cheapest
+    # answer to "has this issue ever been closed?" -- a question `state` cannot
+    # answer and, verified against a real reopened issue (golang/go#79623),
+    # `closed_at` cannot either: GitHub CLEARS `closed_at` on reopen, so it is
+    # null on exactly the issues that matter. See `_evaluate_open_released`.
+    state_reason: str = ""
 
     @property
     def full_name(self) -> str:
@@ -116,6 +156,11 @@ class Issue:
     def issue_slug(self) -> str:
         return f"{self.owner}/{self.repo}#{self.number}"
 
+    @property
+    def reopened(self) -> bool:
+        """Whether GitHub says this issue was re-opened after being closed."""
+        return self.state_reason == "reopened"
+
 
 @dataclass(frozen=True)
 class PullRequest:
@@ -127,11 +172,59 @@ class PullRequest:
     body: str
     merged: bool
     url: str
+    # The merge commit's SHA (`merge_commit_sha`), for anchoring the close
+    # evidence to a point in history. Defaulted rather than required: it is
+    # meaningful only on a merged PR, and a payload that omits it must degrade
+    # to "unknown" in the evidence rather than fail the close walk.
+    merge_sha: str = ""
+    # The branch this PR merged INTO (`base.ref`), verbatim. GitHub only
+    # auto-closes a linked issue when the PR merges into the repository's
+    # DEFAULT branch, so this is what separates "the auto-close flaked" from
+    # "the platform correctly declined to auto-close a merge into `develop`".
+    # Defaulted like the fields below: a payload that omits it says nothing, and
+    # the close edge refuses to repair on a base it cannot read.
+    base_ref: str = ""
+    # `merged_at`, verbatim as GitHub sent it (RFC 3339, `2026-07-28T04:42:55Z`).
+    # Kept as the RAW string rather than a parsed timestamp for the same reason
+    # `merge_sha` is defaulted: this dataclass mirrors a payload, and a field the
+    # payload omitted must read as "not stated" rather than as an epoch the
+    # daemon invented. `merged_epoch` below is the parsed view, and it answers
+    # None on exactly the payloads that omit or malform it.
+    merged_at: str = ""
 
     @property
     def full_name(self) -> str:
         return f"{self.owner}/{self.repo}"
 
+    @property
+    def pr_slug(self) -> str:
+        return f"{self.owner}/{self.repo}#{self.number}"
+
+    @property
+    def merged_epoch(self) -> float | None:
+        """`merged_at` as unix seconds, or None when it is absent/unparseable.
+
+        The close edge measures GitHub's auto-close grace window from this, so
+        "unknown" must be distinguishable from "long ago" -- see
+        `Orchestrator._evaluate_open_released`, which is what decides how an
+        unknown merge time behaves."""
+        return parse_timestamp(self.merged_at)
+
+
+@dataclass(frozen=True)
+class CloseWalk:
+    """What ONE walk of an issue's timeline establishes about how it closed --
+    or failed to.
+
+    Two facts, deliberately together: the merged PR that declares it closes the
+    issue (None if there is none), and whether the issue has ever been closed at
+    all. The close edge's repair needs both and must not pay for two walks to
+    get them; keeping them in one record is also what stops a caller from
+    answering "was it closed?" with the cheaper, wrong `state == "closed"`."""
+
+    pr: "PullRequest | None"
+    ever_closed: bool
+
 
 class RateLimited(RuntimeError):
     """A `gh` rate-limit signal -- a retry-later condition, distinct from a
@@ -146,6 +239,11 @@ def _is_rate_limited(exc: proc.CommandError) -> bool:
 class GitHub:
     SEARCH_PER_PAGE = 100
 
+    def __init__(self) -> None:
+        # Per-repo default branch, resolved lazily and kept for the process.
+        # See `default_branch`; only successful reads land here.
+        self._default_branches: dict[str, str] = {}
+
     def _api(self, *args: str, timeout: int = 60):
         try:
             return proc.run_json(["gh", "api", *args], timeout=timeout)
@@ -339,6 +437,38 @@ class GitHub:
             f"repos/{owner}/{repo}/issues/{number}/comments", "-f", f"body={body}"
         )
 
+    def close_issue(
+        self, owner: str, repo: str, number: int, reason: str = "completed"
+    ) -> Issue:
+        """Close an issue, stating WHY, and return it as GitHub now reports it.
+
+        The only issue-state mutation orcloop performs, and it exists for one
+        anomaly: GitHub's `Closes #n` auto-close is best-effort, so a merged
+        closing PR can leave its issue open forever (see the close edge's
+        `_evaluate_open_released`). `reason` maps to `state_reason`, which is
+        what distinguishes a completed issue from an abandoned one in GitHub's
+        own UI -- the daemon only ever completes work the platform confirmed
+        merged, so the default is `completed` and no caller passes anything else
+        today.
+
+        PATCH, through the same `--input <tempfile>` path `_post_json` uses:
+        gh 2.4.0's `-f` sends everything as a string, and `state_reason` is a
+        closed enum whose values would still be strings but whose siblings on
+        this endpoint (`labels`, `assignees`) are arrays -- one JSON body is
+        both simpler and the pattern the rest of this file already follows.
+
+        Idempotent on GitHub's side: closing an already-closed issue is a 200
+        that leaves it closed, so a retry after a lost response is harmless.
+        """
+        data = self._send_json(
+            "PATCH",
+            f"repos/{owner}/{repo}/issues/{number}",
+            {"state": "closed", "state_reason": reason},
+        )
+        return self._issue_from_payload(
+            owner, repo, data if isinstance(data, dict) else {}
+        )
+
     # --- the close-loop: the merged-PR walk --------------------------------
 
     def closing_merged_pr(self, owner: str, repo: str, number: int) -> PullRequest | None:
@@ -363,21 +493,68 @@ class GitHub:
         wedge the close decision. Newest-referenced PR wins ties -- the last
         cross-reference is the one most likely to be the real closer.
         """
-        candidates = self._referenced_pr_numbers(owner, repo, number)
+        return self.close_walk(owner, repo, number).pr
+
+    def close_walk(self, owner: str, repo: str, number: int) -> "CloseWalk":
+        """`closing_merged_pr`'s answer PLUS whether the issue was ever closed,
+        both from the SAME timeline walk.
+
+        The close edge's flaked-auto-close repair (O16) needs both facts, and
+        needs them not to cost two walks: "is there a merged closer?" decides
+        whether there is anything to repair, and "was this issue ever closed?"
+        decides whether there is anything WRONG -- an issue that was closed once
+        and is open again was re-opened by a human, which is indistinguishable
+        from a flake on every other signal (same open state, same merged PR,
+        same elapsed time since `mergedAt`).
+
+        Split out from `closing_merged_pr` rather than folded into it so the
+        closed-issue path keeps its exact signature and semantics: that caller
+        wants a PR, has no use for the history, and must not have to learn a new
+        return shape for a question it never asks."""
+        candidates, ever_closed = self._timeline_facts(owner, repo, number)
         pattern = _closes_re(number)
         for pr_number in candidates[:MAX_PR_CHECKS]:
             pr = self.pull_request(owner, repo, pr_number)
             if pr is None or not pr.merged:
                 continue
             if pattern.search(pr.body):
-                return pr
-        return None
+                return CloseWalk(pr=pr, ever_closed=ever_closed)
+        return CloseWalk(pr=None, ever_closed=ever_closed)
+
+    def default_branch(self, owner: str, repo: str) -> str:
+        """The repository's default branch, memoised for this process.
+
+        GitHub auto-closes a linked issue only on a merge into this branch, so
+        the close edge needs it to tell a flaked auto-close from a merge the
+        platform correctly declined to act on. Memoised because a default branch
+        does not move within a poll (or most weeks) and the daemon watches a
+        handful of repos: one read per repo per process, never per poll. A
+        failure is NOT cached -- it must be retried, not turned into a permanent
+        empty answer that would look like an unreadable base forever."""
+        key = f"{owner}/{repo}"
+        cached = self._default_branches.get(key)
+        if cached is not None:
+            return cached
+        data = self._api(f"repos/{owner}/{repo}")
+        branch = str((data or {}).get("default_branch") or "") if isinstance(
+            data, dict
+        ) else ""
+        if branch:
+            self._default_branches[key] = branch
+        return branch
 
     def pull_request(self, owner: str, repo: str, number: int) -> PullRequest | None:
         """One PR's close-loop-relevant fields, or None if it cannot be read.
         A malformed/empty payload degrades to None rather than a fabricated PR
         -- the close-loop treats "unreadable" as "not the closer, keep
-        looking", never as a merge."""
+        looking", never as a merge.
+
+        `body`, `merge_sha` and `merged_at` all come from this ONE payload,
+        which is why the close edge's delivery-record evidence (O15) and its
+        auto-close grace window (O16) cost no extra round-trip: the PR the close
+        walk already resolved carries everything both need. A field the payload
+        omits degrades to the empty string here and is reported as missing at
+        the use site -- never fabricated, never fetched a second time."""
         data = self._api(f"repos/{owner}/{repo}/pulls/{number}")
         if not isinstance(data, dict) or not data:
             return None
@@ -390,13 +567,30 @@ class GitHub:
             body=data.get("body") or "",
             merged=bool(data.get("merged") or data.get("merged_at")),
             url=data.get("html_url") or "",
+            merge_sha=str(data.get("merge_commit_sha") or ""),
+            merged_at=str(data.get("merged_at") or ""),
+            base_ref=str(((data.get("base") or {}) if isinstance(
+                data.get("base"), dict) else {}).get("ref") or ""),
         )
 
-    def _referenced_pr_numbers(self, owner: str, repo: str, number: int) -> list[int]:
-        """Same-repo PR numbers cross-referenced by the issue timeline, newest
-        last, deduped -- the candidate set for `closing_merged_pr`."""
+    def _timeline_facts(
+        self, owner: str, repo: str, number: int
+    ) -> tuple[list[int], bool]:
+        """One timeline walk, two answers: the same-repo PR numbers it
+        cross-references (newest first, deduped -- the candidate set for
+        `close_walk`) and whether it carries a `closed` event.
+
+        The `closed` event is what makes "has this issue EVER been closed?"
+        answerable. It is durable in a way the issue's own fields are not: a
+        reopen clears `closed_at` and leaves `state` at `open`, so the timeline
+        is the only place the history survives (`golang/go#79623`, a real
+        reopened issue, reports `closed_at: null` while its timeline still
+        carries `closed`). Bounded by the same TIMELINE_MAX_PAGES page cap as
+        the cross-reference scan, which is why the caller does not rely on it
+        alone -- see `Issue.reopened`."""
         same_repo_pull = f"https://github.com/{owner}/{repo}/pull/"
         numbers: list[int] = []
+        ever_closed = False
         for page in range(1, TIMELINE_MAX_PAGES + 1):
             events = self._api(
                 "-X", "GET", f"repos/{owner}/{repo}/issues/{number}/timeline",
@@ -405,7 +599,11 @@ class GitHub:
             if not isinstance(events, list):
                 break
             for event in events:
-                if not isinstance(event, dict) or event.get("event") != "cross-referenced":
+                if not isinstance(event, dict):
+                    continue
+                if event.get("event") == "closed":
+                    ever_closed = True
+                if event.get("event") != "cross-referenced":
                     continue
                 source = event.get("source")
                 src = source.get("issue") if isinstance(source, dict) else None
@@ -421,19 +619,24 @@ class GitHub:
             if len(events) < TIMELINE_PAGE_SIZE:
                 break  # short page: the timeline is exhausted
         # Dedupe keeping LAST occurrence: the most recent cross-reference is the
-        # likeliest closer, and closing_merged_pr checks candidates in order.
-        return list(dict.fromkeys(reversed(numbers)))
+        # likeliest closer, and close_walk checks candidates in order.
+        return list(dict.fromkeys(reversed(numbers))), ever_closed
 
     # --- helpers -----------------------------------------------------------
 
     def _post_json(self, path: str, payload: dict):
-        """POST a JSON body via `--input <tempfile>`, cleaning the file up on
-        every path (success or raise)."""
+        """POST a JSON body via `--input <tempfile>`."""
+        return self._send_json("POST", path, payload)
+
+    def _send_json(self, method: str, path: str, payload: dict):
+        """Send a JSON body via `--input <tempfile>`, cleaning the file up on
+        every path (success or raise). One implementation for every verb: the
+        tempfile lifetime is the part worth having exactly once."""
         fd, body_path = tempfile.mkstemp(prefix="orcloop-", suffix=".json")
         try:
             with os.fdopen(fd, "w") as handle:
                 handle.write(json.dumps(payload))
-            return self._api("-X", "POST", path, "--input", body_path)
+            return self._api("-X", method, path, "--input", body_path)
         finally:
             os.unlink(body_path)
 
@@ -452,6 +655,7 @@ class GitHub:
                 (lb.get("name") or "") if isinstance(lb, dict) else str(lb)
                 for lb in (data.get("labels") or [])
             ),
+            state_reason=str(data.get("state_reason") or ""),
         )
 
 

{alissa_tools_github_orcloop-0.3.8 → alissa_tools_github_orcloop-0.3.10}/src/main/alissa/tools/github/orcloop/loop.py

@@ -213,12 +213,31 @@ so it behaves identically under `scan` and `bow` (and keeps driving issues
 released before a feed switch):
 
 * Poll each released issue (the ledger is the set to re-check; GitHub is the
-  truth for its state). Still open -> in flight, nothing to do.
+  truth for its state). Still open with no merged closing PR -> in flight,
+  nothing to do.
+* Still OPEN but a merged pull request already declares `Closes #n` (O16, issue
+  #40) -> GitHub's auto-close is best-effort and has been observed to silently
+  never fire, leaving a phantom "in-flight" issue that holds its lane and an
+  origin task stuck at `in_progress` with nothing escalated. Inside
+  `autoclose_grace_seconds` of the merge, nothing happens -- the daemon does not
+  race the platform. Past it, the daemon closes the issue itself (`completed`,
+  commented, WARNING-logged) and falls into the close walk below in the SAME
+  pass. A close that FAILS holds the row untouched; an open issue with no merged
+  closer is never touched; and the repair runs EXACTLY once, so an issue an
+  operator re-opens afterwards is left alone for good. See
+  `_evaluate_open_released`.
 * Closed with a MERGED pull request that declares `Closes #n` -> close the
   loop on the ORIGIN task: satisfy every validation criterion, attach the
   merged-PR evidence, and move the task `committed -> in_progress ->
   pending_validation` (the two-step transition the status matrix requires;
   orcloop hands off at pending_validation, never validates for the operator).
+  That evidence carries the merged PR's DELIVERY RECORD -- its `## Delivery
+  notes` section, or the whole body when there is none, anchored by PR title
+  and merge SHA (O15, `render_close_evidence`). A task arriving at
+  `pending_validation` has to be validatable from what is attached to it; a
+  bare "closed by <url>" makes the reader re-derive every criterion from
+  GitHub. An unreadable write-up degrades loudly and never blocks the walk --
+  the merge already happened, so holding the close would only strand the task.
 * Closed with NO merged closing PR -> the `closed-unmerged` escalation only;
   the task is NOT mutated (a human closed it, or the work was abandoned).
 * The origin task already moved on (validated/cancelled/blocked/... -- the
@@ -278,7 +297,7 @@ import logging
 import re
 import time
 from collections import Counter
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from enum import Enum
 from functools import lru_cache
 from typing import Callable, Sequence
@@ -461,6 +480,15 @@ CLOSELOOP_DONE = "closeloop-done"
 # only after `add_evidence` succeeds, so a failed write retries next poll.
 CLOSELOOP_EVIDENCE_DONE = "closeloop-evidence-done"
 
+# NOT an operator page: an idempotency marker recording that the daemon closed a
+# released issue GitHub's `Closes #n` auto-close never closed (O16, issue #40).
+# It is what makes that repair happen EXACTLY once: an issue seen open again
+# with this marker set was re-opened by an operator -- the very escape hatch the
+# posted comment offers -- and is left alone for good, the close-edge twin of
+# park's "never re-labeling". Recorded only after the close succeeds, so a
+# failed close retries next poll.
+AUTOCLOSE_HEALED = "autoclose-healed"
+
 # The origin status the close-loop mutation itself hands off to. Seeing the task
 # already here (before CLOSELOOP_DONE was recorded) means a prior pass completed
 # the mutation but died before the completion marker -- orcloop's OWN transition,
@@ -606,6 +634,30 @@ CLOSELOOP_FAILED_ISSUE_COMMENT = (
     "Retrying; operator help may be needed."
 )
 
+# Posted on the issue the daemon closes on GitHub's behalf (O16, issue #40). It
+# says what was true, what the daemon did, and what it did NOT do -- a reader
+# arriving at a mechanically-closed issue must be able to tell this apart from
+# an operator closing it by hand, which is the whole reason it is commented and
+# not just logged. It names the merged PR because that PR is the entire
+# justification: without one this path is unreachable.
+AUTOCLOSE_HEALED_ISSUE_COMMENT = (
+    "**Orchestrator: completed a flaked auto-close** — this issue was closed by "
+    "the orchestrator, not by GitHub. Pull request {pr_url} merged {merged} and "
+    "declares that it closes this issue, but GitHub's own `Closes #n` "
+    "auto-close never fired (best-effort, not a contract), and the issue was "
+    "still open more than {grace}s later. The work is merged, so the "
+    "orchestrator completed the step the platform skipped and is now driving "
+    "the origin Alissa task forward. Nothing was reverted and no code changed; "
+    "if this issue was genuinely NOT finished by that pull request, reopen it "
+    "and correct the PR's closing keyword."
+)
+
+# The merge time as the comment above states it when the payload did not carry
+# one. Spelled out rather than left blank: "merged " followed by nothing reads
+# as a rendering bug, and this path is exactly the one a reader should treat
+# with suspicion.
+AUTOCLOSE_MERGED_AT_UNKNOWN = "at an unreported time"
+
 DEGRADED_DISCOVERY_REASON = (
     "release discovery was incomplete this pass ({count} feed body(ies) of "
     "work unreadable), so the two-body-of-work ambiguity check could not run "
@@ -637,6 +689,116 @@ CLOSE_EVIDENCE_BODY = (
     "operator validation."
 )
 
+# O15: the confirmation sentence above is the CLAIM; everything below is the
+# delivery record that lets a validator check it without leaving the task. The
+# two anchor lines are always present, on every path -- a bare slug and URL is
+# what the operator's soft validator rejected on studio TASK-1156925553.
+CLOSE_EVIDENCE_PR_LINE = "**Pull request:** {pr_slug} — {title}"
+CLOSE_EVIDENCE_SHA_LINE = "**Merge commit:** `{sha}`"
+CLOSE_EVIDENCE_TITLE_MISSING = "_(the pull request payload carried no title)_"
+CLOSE_EVIDENCE_SHA_MISSING = "unknown"
+
+# The heading over the included record, in its two shapes. Each names WHICH of
+# the two it is, so the reader never has to guess whether they are looking at a
+# curated section or the whole body.
+CLOSE_EVIDENCE_NOTES_HEADING = "## Delivery notes (from the merged pull request)"
+# "no write-up" rather than "no section": a heading with nothing under it is one
+# of the shapes that lands here, and this heading must not deny it exists when
+# the body below plainly shows it.
+CLOSE_EVIDENCE_FULL_HEADING = (
+    "## Pull request body (no `## Delivery notes` write-up — full body included)"
+)
+
+# The heading the delivery record is written under. Matched line-anchored and
+# case-insensitively, but otherwise EXACTLY: see `extract_delivery_notes` for
+# why this one is strict where O14's context anchors are lenient.
+#
+# WHO EMITS IT: nothing in THIS repo. The producer is the develop daemon's
+# worker directive -- a companion task in the develop-daemon lane, fed the same
+# day as issue #36 and explicitly out of scope for it -- which tells an
+# implementing session to write this section into its PR body. So until that
+# lands, every close legitimately takes the full-body branch; the fallback is
+# the norm today and the section is the arriving case, not the other way round.
+# Both branches are load-bearing and neither is dead code: a PR authored by a
+# human, or by any daemon that never adopts the directive, will always want the
+# fallback.
+DELIVERY_NOTES_HEADING = "## Delivery notes"
+
+# The cap on the included record. Generous on purpose -- a delivery write-up is
+# thousands of chars, and evidence is markdown on a task rather than a GitHub
+# body, so there is no 65,536-char cliff to fit under. It exists so one
+# pathological PR body cannot turn every close into a megabyte write, not to
+# shape the common case. A constant, not a config key, for the reason O14's
+# context caps are: documented caps are a promise, tunable ones are a
+# compatibility commitment.
+#
+# THE HEADROOM IS MEASURED, not assumed, because the size of this write is the
+# one way this feature could newly BLOCK a close: `add_evidence` is not wrapped
+# in `_mutate_close`, `_close_loop` routes its `AlissaError` to
+# `_closeloop_failed`, and `set_status(pending_validation)` comes after it -- so
+# a rejection that is deterministic rather than transient would strand the
+# origin task at `in_progress` on every future poll. `AddEvidenceRequest`
+# declares `markdownContent` with a `minLength` and NO `maxLength`, so the
+# ceiling was probed directly against the live endpoint (2026-07-28, disposable
+# task, since cancelled):
+#
+#     32,300 -> 201     131,072 -> 201     524,288 -> 201
+#     65,536 -> 201     262,144 -> 201   1,048,576 -> 500
+#
+# Worst case here is this cap plus the confirmation line and the two anchors,
+# ~32.3k -- sixteen times under the largest write the endpoint accepted. Raising
+# this constant is therefore NOT a free edit: past ~512k the write starts
+# failing, and it fails in the one direction this feature promises never to
+# fail. Re-probe before widening it.
+CLOSE_EVIDENCE_RECORD_MAX_CHARS = 32000
+# Appended verbatim (issue #36's own wording). No silent caps.
+#
+# The marker ALONE is not the "was anything cut" signal, and the counterexample
+# is this repo's own PR #37: the record is the PR body verbatim, that body
+# mentions the marker inside the very section that gets extracted, and so the
+# first evidence item this feature ever produced would answer a bare-literal
+# grep wrong. `CLOSE_EVIDENCE_TRUNCATED_RE` below is the signal -- deliberately
+# the only place the pattern is written down, because a comment restating it is
+# a second copy to drift from (and, found the hard way, a second copy for a
+# counterfactual to patch instead of the code).
+CLOSE_EVIDENCE_TRUNCATED_MARKER = "[PR body truncated — read the PR]"
+# The signal as a PATTERN rather than as prose: whoever greps an evidence item
+# matches the same thing `_truncate_record` emits, and tests pin both directions
+# so the two cannot drift apart. A promise about a diagnostic is worth exactly as
+# much as the mechanism that keeps it true.
+#
+# ANCHORED at the end, which is what makes the ceiling below exactly true rather
+# than merely nearly so. A real truncation is always LAST in the evidence:
+# `_truncate_record` appends the marker after the record it cut, and
+# `render_close_evidence` appends that record after everything else. Unanchored,
+# a forged line ANYWHERE in a body would read as truncated; anchored, only a body
+# whose own end forges it can. `\s*` before `\Z` so a consumer that normalises
+# trailing whitespace still matches -- trailing blanks cannot forge anything.
+# The end-position invariant this depends on is pinned by a test, so a future
+# change that appends anything after the record fails loudly instead of silently
+# turning a real truncation undetectable. A false NEGATIVE is the worse failure
+# here, exactly as it is for O13's warning.
+#
+# THE CEILING, stated so nobody over-trusts it: a body whose end is a forged
+# marker-and-counts line is indistinguishable from a real truncation. That needs
+# merge access to the target repo, which is the same trust boundary
+# `render_close_evidence` scopes for the included text as a whole -- so it bounds
+# the diagnostic rather than opening a hole to escape.
+CLOSE_EVIDENCE_TRUNCATED_RE = re.compile(
+    re.escape(CLOSE_EVIDENCE_TRUNCATED_MARKER) + r" \(\d+ of \d+ chars included\)\s*\Z"
+)
+
+# The loud degradation. The close walk NEVER stops for this: the merge already
+# happened, and holding the close would strand the origin task in `in_progress`
+# for a missing write-up. (The opposite trade from O14's context hold, where
+# nothing has happened yet and the release can safely wait.)
+CLOSE_EVIDENCE_UNRETRIEVABLE = (
+    "**The pull request body could not be retrieved**, so this evidence carries "
+    "the merge confirmation only — open the pull request for the delivery "
+    "record. The close-loop hand-off proceeded regardless: the merge is a fact "
+    "whether or not its write-up can be read."
+)
+
 
 class Action(str, Enum):
     RELEASED = "released"
@@ -2479,9 +2641,7 @@ class Orchestrator:
                     f"{slug}: label removed by operator — parked, never re-labeling",
                     task_number,
                 ))
-            return self._logged(ref, Decision(
-                Action.SKIPPED, f"{slug}: released issue still open — in flight", task_number,
-            ))
+            return self._evaluate_open_released(task_number, ref, slug, issue)
 
         try:
             pr = self.github.closing_merged_pr(owner, repo, number)
@@ -2507,6 +2667,290 @@ class Orchestrator:
 
         return self._close_loop(task_number, ref, slug, issue, pr)
 
+    def _evaluate_open_released(
+        self, task_number: int, ref: str, slug: str, issue: Issue
+    ) -> tuple[str, Decision]:
+        """A released issue that is still OPEN: genuinely in flight, or a
+        platform step that flaked and must be completed on GitHub's behalf.
+
+        Through 0.3.9 `open` was terminal for the pass -- "still open" meant
+        "still being worked on", and the closing PR was resolved only AFTER the
+        issue closed. That reading is wrong, and it cost a live incident
+        (studio#262 / PR #265, 2026-07-28): the PR merged with a properly-linked
+        `Closes #262` and GitHub's auto-close silently never fired, while the
+        sibling merge 21 seconds earlier auto-closed normally. **GitHub's
+        `Closes #n` auto-close is best-effort, not a contract.** Nothing
+        distinguished that issue from real work: the origin task sat
+        `in_progress` with no evidence, the phantom in-flight issue held its
+        scope in the repo lane against a queued task, and nothing escalated.
+
+        So the merged-closer read moves ahead of the open/closed split, and this
+        branch answers one of three ways:
+
+        * no merged closing PR -> in flight, exactly as before. This is the
+          common case and it is untouched: the daemon never closes an issue it
+          cannot point at a merged PR for.
+        * merged, inside the grace window -> SKIPPED, with a reason that says
+          which condition it is. The window exists so the daemon never RACES
+          GitHub for a step GitHub usually performs; the healthy case lands in
+          seconds, so a few minutes is well outside it.
+        * merged, past the window -> complete the step: close the issue
+          (`completed`, commented, WARNING-logged) and fall straight through
+          into the same close walk a natural auto-close would have produced --
+          in THIS pass, because an extra poll of latency is the thing the origin
+          task was already waiting on.
+
+        THE COST, stated as measured rather than as hoped. `repo_parallelism`
+        bounds how MANY issues reach here at once (1 in-flight released issue
+        per repo at the default), but it says nothing about how OFTEN, and this
+        walk now runs on every poll for as long as the issue stays open. Note
+        the shape: the healthy, common case -- genuinely in flight, no merged
+        closer -- is the EXPENSIVE one, because it never short-circuits and
+        fetches every cross-referenced candidate, so the per-poll cost grows
+        with an issue's discussion rather than with its work. Measured: 2 `gh`
+        calls per poll with one cross-referenced PR, 11 at the MAX_PR_CHECKS
+        cap, ~+120 calls/hour/repo at `poll_interval=60` and the default
+        parallelism -- small against a 5000/hour REST budget, but not zero, and
+        it was zero before.
+
+        There is deliberately no damper here yet. The obvious one (probe every
+        Nth poll) needs a design this change should not smuggle in: N interacts
+        with `poll_interval` to stretch the effective grace window, it needs
+        somewhere to survive a restart, and a throttled poll needs its own
+        decision reason so it cannot be mistaken for a healthy in-flight one.
+        The nearby `ESCALATION_CLOSED_UNMERGED` short-circuit exists for exactly
+        this reason on a TERMINAL row, whose cost is unbounded in time; this
+        one ends when the issue closes.
+
+        This is the devloop self-heal doctrine transposed to the close edge --
+        complete the dead protocol step on the platform's behalf, exactly once,
+        loudly -- the same family as the pushed-but-never-re-requested fix.
+
+        Park detection runs BEFORE this, in `_evaluate_close`, and stays there:
+        an operator who removed the label has said "stop acting on this", which
+        outranks any repair the daemon might otherwise perform.
+
+        "Exactly once" is enforced by the AUTOCLOSE_HEALED marker, recorded
+        after a successful close. Seeing an issue OPEN again with that marker
+        already set means the close landed and someone re-opened it -- which is
+        precisely what the comment the daemon posted invites a reader to do if
+        the PR did not really finish the work. Re-closing there would fight the
+        operator and make that invitation a lie, so the repair is refused for
+        good, exactly like park's "never re-labeling". It also covers the
+        cheaper case of a read-after-write that still reports the issue open:
+        one close, one comment, whatever the API's timing.
+        """
+        if self.state.escalated(task_number, AUTOCLOSE_HEALED):
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: auto-close already completed once and the issue is "
+                f"open again — operator reopened it, never re-closing",
+                task_number,
+            ))
+
+        try:
+            walk = self.github.close_walk(issue.owner, issue.repo, issue.number)
+        except (CommandError, RateLimited) as exc:
+            return self._logged(ref, Decision(
+                Action.HELD,
+                f"{slug}: could not resolve closing PR: {exc}",
+                task_number,
+            ))
+
+        pr = walk.pr
+        if pr is None:
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: released issue still open — in flight",
+                task_number,
+            ))
+
+        # HAS THIS ISSUE EVER BEEN CLOSED? -- the question the open/closed state
+        # cannot answer and the one this branch actually turns on. A flaked
+        # auto-close and a human's deliberate re-open are identical on every
+        # other signal: same open state, same merged PR declaring `Closes #n`,
+        # same elapsed time since the merge. Repairing the second is not a
+        # missed opportunity, it is REVERTING AN OPERATOR -- and posting a
+        # comment claiming the auto-close never fired when it did.
+        #
+        # Two independent signals, because each covers the other's blind spot:
+        # `state_reason` is free (it rides the issue payload already fetched)
+        # and exact, but it is a late API addition that can be empty on an issue
+        # re-opened long ago; the timeline's `closed` event is durable history
+        # but can fall past TIMELINE_MAX_PAGES on a very chatty issue. Either
+        # one refuses the repair, for good.
+        #
+        # `closed_at` is deliberately NOT among them: GitHub CLEARS it on
+        # reopen, so it is null on precisely the issues this must catch
+        # (verified against golang/go#79623, a real reopened issue).
+        #
+        # The accepted cost is a false NEGATIVE: an issue an operator closed and
+        # re-opened earlier in its life is never repaired, even by a genuinely
+        # flaked later merge. That fails toward leaving an operator's issue
+        # alone, which is the trade park already makes.
+        if issue.reopened or walk.ever_closed:
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: closed once already and open again — reopened, not a "
+                f"flaked auto-close; never re-closing",
+                task_number,
+            ))
+
+        # DID GITHUB EVEN OWE US AN AUTO-CLOSE? It fires only for a merge into
+        # the repository's DEFAULT branch: a PR carrying `Closes #n` that merges
+        # into `develop`, a release branch, or a stacked base leaves the issue
+        # open ON PURPOSE, and that is the platform working correctly.
+        #
+        # Through 0.3.9 the merged-closer predicate (merged + a closing keyword)
+        # only supplied ATTRIBUTION for a decision GitHub had already made, so
+        # being loose was harmless. Promoting it to the TRIGGER for a state
+        # mutation is what makes the missing check matter.
+        try:
+            default_branch = self.github.default_branch(issue.owner, issue.repo)
+        except (CommandError, RateLimited) as exc:
+            # Same posture as the closing-PR failure above: an unreadable input
+            # is not permission to close someone's issue.
+            return self._logged(ref, Decision(
+                Action.HELD,
+                f"{slug}: could not resolve the default branch of "
+                f"{issue.full_name}: {exc}",
+                task_number,
+            ))
+
+        if not default_branch:
+            # A read that SUCCEEDED but answered nothing is the same species of
+            # unknown as one that raised, and it must not fall through to the
+            # comparison below: with a non-empty `base_ref` that mismatch would
+            # be reported as "GitHub declined to auto-close a non-default
+            # merge", asserting a fact not in evidence -- the base may well have
+            # BEEN the default branch; the daemon just could not read it. Held,
+            # not skipped, so the row retries instead of silently never
+            # repairing. Recoverable because `default_branch` deliberately does
+            # not cache an empty answer.
+            return self._logged(ref, Decision(
+                Action.HELD,
+                f"{slug}: the default branch of {issue.full_name} could not be "
+                f"read (empty answer) — holding rather than guessing whether "
+                f"merged {pr.pr_slug} targeted it",
+                task_number,
+            ))
+
+        if not pr.base_ref or pr.base_ref != default_branch:
+            if not pr.base_ref:
+                # Unknown provenance cannot authorise a state mutation. Unlike
+                # an unmeasurable grace window -- which could only be granted
+                # FOREVER, the very hang this path exists to end -- refusing
+                # here hangs nothing: the issue stays exactly as GitHub left it.
+                log.warning(
+                    "%s: %s reports no base branch, so it cannot be confirmed "
+                    "to have merged into %s — refusing to close the issue on a "
+                    "merge whose target is unknown",
+                    slug, pr.pr_slug, default_branch,
+                )
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: merged {pr.pr_slug} targeted "
+                f"{pr.base_ref or '(unreported)'}, not the default branch "
+                f"{default_branch!r} — GitHub does not auto-close on a "
+                f"non-default merge, so there is nothing to repair",
+                task_number,
+            ))
+
+        grace = self.config.autoclose_grace_seconds
+        merged_epoch = pr.merged_epoch
+        if merged_epoch is not None and self._now() - merged_epoch < grace:
+            # Deliberately NOT a WARNING and not an escalation: for the first
+            # few minutes after a merge this state is what a perfectly healthy
+            # repo looks like. Only outliving the window makes it an anomaly.
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: closed by merged {pr.pr_slug} but still open — "
+                f"GitHub auto-close pending, within the {grace}s grace window",
+                task_number,
+            ))
+
+        # An unreadable/absent `mergedAt` lands HERE rather than in the branch
+        # above, i.e. it heals. The window is a courtesy extended to a platform
+        # step whose age we can measure; when the payload does not say when the
+        # merge happened, the courtesy cannot be granted without granting it
+        # FOREVER -- which is precisely the indefinite hang this whole change
+        # exists to end. The downside is bounded and self-announcing: at worst
+        # the daemon completes a close GitHub was about to perform anyway (the
+        # close is idempotent) and says so in a comment that names the merge
+        # time as unreported, so a spurious anomaly report is visible as one.
+        merged = (
+            f"at {pr.merged_at}" if merged_epoch is not None
+            else AUTOCLOSE_MERGED_AT_UNKNOWN
+        )
+        if self.config.dry_run:
+            # Sequenced here rather than with the real one below because there
+            # is no close to sequence it against, and its prefix already cannot
+            # be misread as a completed repair.
+            log.warning(
+                "[dry-run] would complete a flaked GitHub auto-close: %s is "
+                "still open but %s merged %s declaring it closed "
+                "(grace %ds elapsed)",
+                slug, pr.pr_slug, merged, grace,
+            )
+        else:
+            try:
+                self.github.close_issue(issue.owner, issue.repo, issue.number)
+            except (CommandError, RateLimited) as exc:
+                # HOLD, never walk: `_close_loop` and everything downstream of
+                # it assume the issue is closed -- that is what makes moving the
+                # origin task to `pending_validation` an honest report. An
+                # unclosed issue with a validated task is a worse state than one
+                # more poll of waiting, and the next poll re-enters here with
+                # the same inputs (no marker was recorded, nothing was mutated).
+                log.error("could not close %s on GitHub's behalf: %s", slug, exc)
+                return self._logged(ref, Decision(
+                    Action.HELD,
+                    f"{slug}: merged {pr.pr_slug} never auto-closed the issue "
+                    f"and closing it failed: {exc} — holding, no task mutation",
+                    task_number,
+                ))
+            # AFTER the close, never before it: this line is the anomaly report,
+            # and "completing" is the one word a log-scraper or a half-read
+            # alert picks up. Emitted ahead of the attempt it would announce a
+            # repair that a following ERROR then has to retract -- the anomaly
+            # stays just as visible logged here, and is never claimed falsely.
+            log.warning(
+                "completed a flaked GitHub auto-close: %s was still open but "
+                "%s merged %s declaring it closed (grace %ds elapsed)",
+                slug, pr.pr_slug, merged, grace,
+            )
+            # Recorded the moment the close lands, BEFORE the best-effort
+            # comment and before the walk: from here on the repair is done and
+            # must never be performed twice, whatever any later step does. A
+            # marker written after the walk would be lost on a walk that raises,
+            # which is the one path that re-enters this branch.
+            self.state.record_escalation(task_number, AUTOCLOSE_HEALED)
+            # Best-effort, and AFTER the close for idempotency: a comment that
+            # posted before a close which then failed would post again on the
+            # retry, so the audit trail would grow one copy per failure. Losing
+            # the comment costs an explanation the WARNING above still carries;
+            # losing the close would cost the fix.
+            try:
+                self.github.comment(
+                    issue.owner, issue.repo, issue.number,
+                    AUTOCLOSE_HEALED_ISSUE_COMMENT.format(
+                        pr_url=pr.url or pr.pr_slug, merged=merged, grace=grace,
+                    ),
+                )
+            except (CommandError, RateLimited) as exc:
+                log.warning(
+                    "best-effort auto-close explanation comment failed on %s: %s",
+                    slug, exc,
+                )
+
+        # Walk in the SAME pass, with the issue's state corrected to what the
+        # daemon just made true. `_close_loop` only reads the issue to address
+        # its escalation comments, but handing a stale `state="open"` to
+        # anything downstream is a trap for whatever reads it next.
+        return self._close_loop(
+            task_number, ref, slug, replace(issue, state="closed"), pr
+        )
+
     def _close_loop(
         self, task_number: int, ref: str, slug: str, issue: Issue, pr: PullRequest
     ) -> tuple[str, Decision]:
@@ -2589,6 +3033,12 @@ class Orchestrator:
           record). A retry after the write succeeded finds the marker and skips,
           so evidence is never duplicated.
 
+        The evidence body itself is the merged PR's DELIVERY RECORD, not a bare
+        merge confirmation -- see `render_close_evidence`. It is rendered from
+        the `pr` object this method was handed, so it adds no call and no
+        failure mode to the walk: a PR whose write-up cannot be read still
+        reaches `pending_validation`, carrying an explicit line saying so.
+
         Criteria satisfaction is naturally idempotent (already-satisfied ones are
         skipped), so it needs no gate."""
         if task.status == TASK_TODO_STATE:
@@ -2600,7 +3050,7 @@ class Orchestrator:
             self.alissa.add_evidence(
                 ref,
                 CLOSE_EVIDENCE_TITLE,
-                CLOSE_EVIDENCE_BODY.format(slug=slug, pr_url=pr.url),
+                render_close_evidence(slug, pr),
             )
             self.state.record_escalation(task_number, CLOSELOOP_EVIDENCE_DONE)
         self.alissa.set_status(ref, "pending_validation")
@@ -3117,3 +3567,263 @@ def render_issue_body(
     """`render_issue(...).body` -- the body alone, for callers with nothing to
     report about how it was rendered."""
     return render_issue(task, target, scope, config, context).body
+
+
+# --- the close edge's delivery-record evidence (O15) -----------------------
+
+# POSSESSIVE quantifiers (`*+`, python >= 3.11, which setup.py already requires)
+# on all three whitespace runs. Greedy `*` makes the tail CUBIC on a line that
+# starts with the heading and then fails: the engine tries every way to split
+# the trailing whitespace across `[ \t]* … [ \t]* … [ \t]*`. Measured on
+# `"## Delivery notes" + " "*n + "X"`: 20ms at n=200, 2.7s at n=800, 24.7s at
+# n=1600 -- and this regex runs inside `_mutate_close`, on a single-threaded
+# poll loop with no timeout, so a crafted body would stall the WHOLE daemon,
+# release edge included, on every poll forever. Possessive quantifiers cannot
+# backtrack, which takes the same n=65,000 input from days to 0.045ms. They are
+# safe here precisely because the three runs are DISJOINT character classes
+# (whitespace / `:` / `#`), so refusing to give text back can never starve a
+# later token: every tolerance case below still matches and every rejection
+# still fails.
+_DELIVERY_NOTES_RE = re.compile(
+    rf"^[ ]{{0,3}}{re.escape(DELIVERY_NOTES_HEADING)}[ \t]*+:?[ \t]*+#*+[ \t]*+\r?$",
+    re.IGNORECASE,
+)
+# A sibling-or-parent heading: `# ` or `## `. A `### ` subsection belongs to the
+# delivery notes and must NOT end them.
+_SECTION_END_RE = re.compile(r"^[ ]{0,3}#{1,2}[ \t]")
+# The delimiter and whatever follows it on the line (the "info string"), which
+# decides whether a fence line can CLOSE a block.
+_FENCE_RE = re.compile(r"^[ ]{0,3}(`{3,}|~{3,})(.*)$")
+
+
+def _fence_scan(lines: Sequence[str]) -> tuple[list[bool], str]:
+    """`(mask, open_fence)` for a markdown document: which lines sit in (or
+    delimit) a fenced code block, and the delimiter still open at the end.
+
+    Both halves come from ONE pass on purpose. A caller that needs to close a
+    block must close it with the delimiter that opened it, and re-deriving that
+    by scanning backwards for "a fence line" is a guess -- the nearest fence
+    line may be an inner one of the other character, or a shorter one, neither
+    of which opened anything. The scan already knows; it hands the answer back
+    rather than making the caller reconstruct it.
+
+    CommonMark's three closing rules, all of which matter here:
+
+    * **Same character.** A `~~~` inside a ``` block is content. Conflating the
+      two ends the block early and hands the code after it back to the heading
+      scan -- the failure the fence tracking exists to prevent.
+    * **At least as long.** ``` cannot close a ```` block, so an inner shorter
+      fence is content too.
+    * **No info string.** ```` ```python ```` opens a block; it can never close
+      one. Without this rule a `## Delivery notes` heading sitting inside an
+      unclosed block reads as a real heading, and because the scan takes the
+      FIRST candidate with content, a fake section early in a body would outrank
+      the real one later -- the one direction this module promises not to err.
+
+    An unclosed fence runs to the end of the document, which errs toward
+    treating more text as code and so toward including more of the body: the
+    same direction as every other tie-break here.
+    """
+    fenced = [False] * len(lines)
+    open_fence = ""
+    for index, line in enumerate(lines):
+        match = _FENCE_RE.match(line)
+        if match:
+            delimiter, info = match.group(1), match.group(2).strip()
+            closes = (
+                open_fence
+                and delimiter[0] == open_fence[0]
+                and len(delimiter) >= len(open_fence)
+                and not info
+            )
+            if closes or not open_fence:
+                # A delimiter line is not content either way; marking it keeps
+                # the line that OPENS a block from reading as a heading.
+                fenced[index] = True
+                open_fence = "" if closes else delimiter
+                continue
+            # A fence line that cannot close the open block IS content.
+        fenced[index] = bool(open_fence)
+    return fenced, open_fence
+
+
+def extract_delivery_notes(body: str) -> str | None:
+    """The `## Delivery notes` section of a pull-request body, or None when the
+    body has no such section with anything under it.
+
+    THE TIE-BREAK, and why it is the opposite of O14's. Both this and
+    `strip_context_section` locate a section by an ambiguous heading, but the
+    costs are mirrored. There, a wrong START anchor SUPPRESSED a diagnostic, so
+    every tie broke toward doing nothing. Here, "do nothing" means falling back
+    to the FULL body -- a strict superset of any section this could have found.
+    Guessing wrong and matching a section costs the reader the rest of the
+    write-up; guessing wrong and matching nothing costs them some scrolling. So
+    the heading match is STRICT: the line, stripped of up to three leading
+    spaces and an optional trailing colon, must be exactly the heading, differing
+    at most in case. `## Delivery notes are still missing` is prose about the
+    notes, not the notes, and reads as absent.
+
+    Strict about the PROSE, tolerant about the TYPOGRAPHY, and the CRLF case is
+    why the distinction matters. This is the only end-of-line-anchored regex in
+    the package -- every other line-anchored parser (`TASK_TRAILER_RE`, the
+    `markers.py` templates, `_SECTION_END_RE`, `_FENCE_RE`) is a prefix match and
+    so already tolerates a trailing `\r`. A PR body edited in GitHub's web UI
+    comes back CRLF-normalised, which would have made every heading read as
+    absent and sent a PR that plainly HAS delivery notes down the full-body
+    branch, under a heading asserting it has none. So `\r` is admitted, as is a
+    closed ATX heading (`## Delivery notes ##`) -- both are the same class of
+    concession as the leading spaces and the case-fold, and neither can turn
+    prose into a match. The scan still splits on `"\n"` and nothing else, for the
+    reason `escape_control_lines` documents: `str.splitlines()` breaks on
+    characters `^` does not recognise and this function JOINS its result back
+    together, so it must not be able to invent a line boundary.
+
+    THE TERMINATOR is the next `# ` or `## ` -- a sibling or parent section.
+    `### ` subsections are kept: a write-up structured as `### What shipped` /
+    `### Verification` under the notes heading is the shape the devloop
+    directive asks for, and ending on the first `###` would take the first
+    paragraph and drop the substance.
+
+    FENCED CODE IS SKIPPED, for both the heading scan and the terminator scan
+    (see `_fence_scan`). A delivery write-up quotes shell and diffs, where a
+    line can legitimately begin with `## `, and a code fence is the one context
+    in markdown where a hash is not a heading.
+
+    EMPTY SECTIONS DO NOT COUNT. A heading with nothing under it is not a
+    delivery record, and returning it would suppress the full-body fallback --
+    the one failure here that actually loses information. The scan therefore
+    continues past an empty candidate to a later one, and answers None only if
+    no candidate has content.
+    """
+    lines = (body or "").split("\n")
+    fenced, _ = _fence_scan(lines)
+
+    for start, line in enumerate(lines):
+        if fenced[start] or not _DELIVERY_NOTES_RE.match(line):
+            continue
+        end = len(lines)
+        for index in range(start + 1, len(lines)):
+            if not fenced[index] and _SECTION_END_RE.match(lines[index]):
+                end = index
+                break
+        section = "\n".join(lines[start + 1:end]).strip()
+        if section:
+            return section
+    return None
+
+
+def _open_fence(text: str) -> str:
+    """The code fence `text` leaves open, or `""` -- the delimiter itself, so
+    the caller can close it with the characters that opened it. Taken from
+    `_fence_scan`'s own tracking rather than re-derived: see there."""
+    return _fence_scan(text.split("\n"))[1]
+
+
+def _truncate_record(record: str) -> str:
+    """`record` capped at `CLOSE_EVIDENCE_RECORD_MAX_CHARS`, with the cut marked
+    where it happened. The counts are appended after the marker rather than
+    inside it so the marker stays greppable as the literal string issue #36
+    named -- and `CLOSE_EVIDENCE_TRUNCATED_RE` is the actual "something was cut"
+    signal, since a PR body may quote the bare literal (see the constant).
+
+    The marker is appended LAST, after the record and after any fence this
+    function had to close. `CLOSE_EVIDENCE_TRUNCATED_RE` is anchored to the end
+    of the evidence on the strength of that, so anything appended after the
+    record -- here or in `render_close_evidence` -- would make a real truncation
+    undetectable. `test_a_real_cut_ends_the_evidence_item` pins it.
+
+    The counts describe what is REALLY there. The slice is `.rstrip()`ed, so
+    reporting the cap would overstate by the whitespace dropped -- a record cut
+    mid-whitespace-run could claim 32,000 chars included and carry seven. Only
+    whitespace is ever lost that way, so this is about the number being exactly
+    true rather than about content. The re-added fence below is NOT counted: it
+    is this function's own text, not the record's.
+
+    A cut that lands INSIDE a fenced code block closes the fence first. The cut
+    is a character slice, so a record whose fence opens before the cap and
+    closes after it would otherwise leave the block open -- and the marker,
+    appended after the cut, would render as program output inside that block.
+    The text is present and greppable either way, so this is about the reader
+    NOTICING, which is the whole claim "no silent caps" makes.
+    """
+    original = len(record)
+    if original <= CLOSE_EVIDENCE_RECORD_MAX_CHARS:
+        return record
+    kept = record[:CLOSE_EVIDENCE_RECORD_MAX_CHARS].rstrip()
+    cut = kept
+    fence = _open_fence(kept)
+    if fence:
+        cut += f"\n{fence}"
+    return (
+        cut
+        + f"\n\n{CLOSE_EVIDENCE_TRUNCATED_MARKER} "
+        + f"({len(kept)} of {original} chars included)"
+    )
+
+
+def render_close_evidence(slug: str, pr: PullRequest) -> str:
+    """The close edge's evidence markdown: the merge confirmation, the two
+    anchor lines, and the merged PR's delivery record.
+
+    Costs no round-trip. `GitHub.closing_merged_pr` already re-fetched the PR to
+    decide it was the closer, and that payload carries the body and the merge
+    SHA -- so the record is assembled from the object the close walk is holding,
+    not fetched again. A second fetch would add a failure mode to a path whose
+    whole point is that it must not acquire one.
+
+    DEGRADE, NEVER BLOCK. Every field is rendered from what the PR object
+    actually has: a missing title and a missing merge SHA each say so in place,
+    and a missing BODY drops the record for
+    `CLOSE_EVIDENCE_UNRETRIEVABLE` -- today's evidence plus an explicit line.
+    None of the three raises, because the caller is mid-`_mutate_close`: the
+    merge has happened, the criteria are satisfied, and an exception here would
+    strand the origin task short of `pending_validation` over a write-up.
+
+    THE INCLUDED BODY IS NOT ESCAPED, and the reason is narrower than "nothing
+    parses evidence". O14 blockquotes control lines because an ISSUE body is
+    read back by orcloop's own line-anchored trailer parsers; task evidence is
+    not -- `add_evidence` is write-only and nothing in this package reads
+    evidence back, so no text arriving here can reach a parser that decides
+    anything. That is the claim, and it is about ORCLOOP. The evidence IS read
+    by the operator's soft validator, which is an LLM, so this text is parsed --
+    just not by anything whose answer moves a task. Anyone adding a machine
+    consumer of evidence inherits no guarantee from this function. Note also
+    what reaching this text costs an attacker: the close edge only fires on
+    issues orcloop itself released, and the body must belong to a PR MERGED into
+    that repo.
+
+    On the empty-body branch being defensive: through today's resolution path a
+    resolved closer cannot have an empty body, because `closing_merged_pr`
+    matched a closing keyword IN that body. That is a guarantee held by another
+    function, and this one's contract -- evidence that never lies about what it
+    contains -- must not depend on it. `GitHub.pull_request` degrades an absent
+    `body` field to `""`, so a payload that omits it, or any future resolution
+    rule that does not read the body, lands here and says so rather than
+    emitting a heading with nothing under it.
+    """
+    parts = [
+        CLOSE_EVIDENCE_BODY.format(slug=slug, pr_url=pr.url),
+        CLOSE_EVIDENCE_PR_LINE.format(
+            pr_slug=pr.pr_slug, title=pr.title.strip() or CLOSE_EVIDENCE_TITLE_MISSING
+        ),
+        CLOSE_EVIDENCE_SHA_LINE.format(
+            sha=pr.merge_sha.strip() or CLOSE_EVIDENCE_SHA_MISSING
+        ),
+    ]
+    body = (pr.body or "").strip()
+    if not body:
+        log.warning(
+            "%s: the merged pull request %s carries no readable body — close "
+            "evidence attached WITHOUT a delivery record (the close-loop "
+            "hand-off is unaffected)",
+            slug, pr.url or pr.pr_slug,
+        )
+        parts.append(CLOSE_EVIDENCE_UNRETRIEVABLE)
+        return "\n\n".join(parts)
+
+    notes = extract_delivery_notes(body)
+    heading = (
+        CLOSE_EVIDENCE_NOTES_HEADING if notes is not None else CLOSE_EVIDENCE_FULL_HEADING
+    )
+    parts.append(f"{heading}\n\n{_truncate_record(notes if notes is not None else body)}")
+    return "\n\n".join(parts)

alissa_tools_github_orcloop-0.3.10/src/main/alissa/tools/github/orcloop/version

@@ -0,0 +1 @@
+0.3.10

{alissa_tools_github_orcloop-0.3.8 → alissa_tools_github_orcloop-0.3.10/src/main/alissa_tools_github_orcloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.3.8
+Version: 0.3.10
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_orcloop-0.3.8/src/main/alissa/tools/github/orcloop/version

@@ -1 +0,0 @@
-0.3.8