outerloop-science 0.1.0.dev3__py3-none-any.whl → 0.1.1__py3-none-any.whl

outerloop/__init__.py

@@ -2,7 +2,7 @@
 
 import os
 
-__version__ = "0.1.0.dev3"
+__version__ = "0.1.1"
 
 
 def _bridge_legacy_env() -> None:

outerloop/appauth.py

@@ -17,8 +17,10 @@ network; the production signer lives behind the `app-auth` extra.
 
 from __future__ import annotations
 
+import argparse
 import base64
 import json
+import os
 import time
 import urllib.error
 import urllib.parse
@@ -29,6 +31,7 @@ from pathlib import Path
 from typing import Any
 
 from outerloop.github import AUTH_SAFE_OPENER, FileTokenProvider, TokenProvider
+from outerloop.paths import CONFIG_DIR
 
 # RS256-sign the JWT signing input, returning the raw signature bytes.
 Signer = Callable[[bytes], bytes]
@@ -211,3 +214,17 @@ def resolve_bot_auth(pat_file: str | Path, app_file: str | Path = "") -> TokenPr
     if str(app_file).strip():
         return app_provider_from_file(Path(str(app_file)).expanduser())
     return FileTokenProvider(Path(str(pat_file)).expanduser())
+
+
+def add_credential_args(parser: argparse.ArgumentParser) -> None:
+    """Add the shared bot-auth options to a role parser: `--pat-file`, and
+    `--github-app-file`, which supplies installation tokens instead of the PAT
+    when set. `resolve_bot_auth` reads the pair. One owner so the defaults and
+    help cannot drift between attempt, followup, and steward."""
+    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
+    parser.add_argument(
+        "--github-app-file",
+        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
+        help="GitHub App config (JSON: app_id, installation_id, private_key); "
+        "when set, installation tokens replace the PAT",
+    )

outerloop/attempt.py

@@ -19,6 +19,7 @@ import os
 import re
 import shutil
 import time
+import traceback
 from collections.abc import Callable, Iterable
 from dataclasses import dataclass
 from dataclasses import replace as dc_replace
@@ -26,7 +27,7 @@ from functools import partial
 from pathlib import Path
 from typing import Any, cast
 
-from outerloop.appauth import resolve_bot_auth
+from outerloop.appauth import add_credential_args, resolve_bot_auth
 from outerloop.brief import BudgetState, distill_lessons
 from outerloop.compute import LocalCompute
 from outerloop.contract import Benchmark, Contract, contract_text_in_tree, load_contract
@@ -319,18 +320,35 @@ class AttemptOutcome:
     report_path: str = ""
 
 
+def _attach_run_log(directory: Path) -> None:
+    """Also write the kernel's log lines to `<run dir>/kernel.log`: the scheduler
+    discards a wake job's own stderr, so this is the only trace a swallowed
+    step leaves. Only for a run that exists — never a stray directory."""
+    if not directory.is_dir():
+        return
+    try:
+        handler = logging.FileHandler(directory / "kernel.log", encoding="utf-8")
+    except OSError as exc:
+        log.warning("run log unavailable: %s", exc)
+        return
+    handler.setFormatter(logging.Formatter("%(asctime)s %(message)s"))
+    logging.getLogger().addHandler(handler)
+
+
 def _best_effort(what: str, fn: Callable[[], object], secrets: tuple[str, ...] = ()) -> bool:
-    """One ending step; a failure is logged, never raised.
+    """One ending step; a failure is logged with its traceback, never raised.
 
     The terminal sequence (record, report, issue post) must degrade
     independently: a full disk must not block the GitHub post, and a network
-    failure must not block the record.
+    failure must not block the record. The traceback is the only trace a
+    swallowed step leaves, so it is logged whole (redacted).
     """
     try:
         fn()
         return True
     except Exception as exc:
-        log.warning("%s failed: %s", what, redact(f"{type(exc).__name__}: {exc}", secrets))
+        detail = "".join(traceback.format_exception(exc)).rstrip()
+        log.warning("%s failed: %s", what, redact(detail, secrets))
         return False
 
 
@@ -928,6 +946,22 @@ def _wake_author_sleep(
     if extra_update:
         # a submitted park's gate/panel feedback leads; launch results follow
         wake_text = f"{extra_update}\n\n{wake_text}"
+    # A research line whose base moved while it slept RE-PINS to the fresh base
+    # and is told to merge it: the agent does the merge (mirroring the in-review
+    # conflict wake, followup.py), the kernel only fetches and re-pins. Re-pinning
+    # base_sha to the fresh head is what makes the gate baseline and the scope
+    # base the CURRENT base (like followup's base_sha_at_fetch), so a sibling's
+    # merged work is never credited to this line and a forbidden conflict
+    # resolution (differing from the fresh base) is still scope-checked. Non-line
+    # runs and an unmoved base are untouched.
+    if _line_ref_for(bench, config.agent_id):
+        fresh_base = _line_base_advanced(ws, base_branch, base_sha)
+        if fresh_base:
+            digest = _reintegration_digest(ws, base_sha, fresh_base)
+            base_sha = fresh_base
+            wake_text = (
+                REINTEGRATE_PROMPT.format(base_branch=base_branch, digest=digest) + wake_text
+            )
     _best_effort(
         "budget refresh",
         lambda: write_budget(
@@ -1009,8 +1043,6 @@ def _wake_author_sleep(
         # existing wake path decides). Keep the NEW park's snapshot ref; the OLD
         # sleep ref is superseded once the new park persists.
         kept_ref = next((s.ref for s in snapshots if s.commit == p.candidate_sha), "")
-        import time
-
         try:
             _park_run(
                 run_root,
@@ -1296,6 +1328,54 @@ def _line_ref_for(bench: Benchmark | None, agent_id: str) -> str:
     return f"agents/{agent_id}"
 
 
+# The base moved under a line while it slept: rather than the kernel doing a
+# git merge (which mishandles the agent's in-flight tree, its conflicts, and
+# the scope gate), the wake mirrors the in-review conflict wake — fetch the
+# fresh base into the workspace and TELL THE AGENT to merge it. The agent has
+# git and already resolves the run-start merge as its first task; only the
+# credential-bearing fetch/push are the kernel's. No commit text goes in the
+# prompt (no cross-agent prompt-injection surface); the agent reads what
+# landed from git itself.
+REINTEGRATE_PROMPT = (
+    "# The base moved while you were asleep\n"
+    "`origin/{base_branch}` advanced since your last run and is fetched into "
+    "your workspace. What landed:\n{digest}\n"
+    "Merge it into your line and resolve any conflicts honestly, then decide "
+    "what to re-run given what landed — if a sibling took your direction "
+    "further, pivot or say so plainly rather than pushing on. Your change is "
+    "measured against the current base.\n\n"
+)
+
+
+def _reintegration_digest(ws: Workspace, base_sha: str, fresh_head: str) -> str:
+    """A short 'what landed' list: the subjects of the commits merged into the
+    base since this line's base, newest first, capped. These are MERGED commits
+    — vetted by the human-merge gate — so they are context, not untrusted input;
+    the agent also has them in git to read in full."""
+    try:
+        out = ws.git("log", "--no-merges", "--format=%s", f"{base_sha}..{fresh_head}")
+    except Exception:
+        return "  (recent changes on the base; see `git log`)"
+    subjects = [ln.strip() for ln in out.splitlines() if ln.strip()][:12]
+    return "\n".join(f"  - {s}" for s in subjects) or "  (a merge on the base; see `git log`)"
+
+
+def _line_base_advanced(ws: Workspace, base_branch: str, base_sha: str) -> str:
+    """Fetch `origin/<base_branch>` and return its head when it has advanced
+    past the line's pinned base, else "". The fetch doubles as making the
+    fresh base available for the agent to merge and refreshes the origin refs
+    the scope/measure path pairs against. Best-effort: any git failure returns
+    "" and the wake proceeds exactly as today."""
+    try:
+        ws.fetch_origin()
+        new = ws.git("rev-parse", f"refs/remotes/origin/{base_branch}").strip()
+        merge_base = ws.git("merge-base", new, base_sha).strip()
+        return new if new and merge_base != new else ""
+    except Exception as exc:
+        log.warning("base-moved check failed (%s); wake proceeds unchanged", type(exc).__name__)
+        return ""
+
+
 def _push_line_snapshot(
     ws: Workspace,
     line_ref: str,
@@ -2953,8 +3033,6 @@ def live_attempt(
                 # commit); record and keep that same ref, drop the rest. An
                 # author-sleep's snapshot is the tree the wake re-delivers.
                 kept_ref = next((s.ref for s in snapshots if s.commit == p.candidate_sha), "")
-            import time
-
             # anchor the deadline to the PARK (when the evals were submitted),
             # not the run's start `now` — a session lasting hours would otherwise
             # eat the queue budget and let the sweep cancel a still-queued eval.
@@ -3355,11 +3433,22 @@ def main() -> int:
             )
         return value
 
+    def _run_id(value: str) -> str:
+        # the id names the run directory under runs/: one path segment, so a
+        # value cannot reach outside the run root before the record is read
+        # ("" is the default: a fresh climb, not a resume)
+        if value and not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}", value):
+            raise argparse.ArgumentTypeError(
+                f"run id {value!r} is not a run directory name (want [A-Za-z0-9][A-Za-z0-9_.@-]*)"
+            )
+        return value
+
     parser.add_argument("--agent-id", default="agent-01", type=_agent_id)
     parser.add_argument("--run-root", required=True, type=Path)
     parser.add_argument(
         "--resume",
         default="",
+        type=_run_id,
         metavar="RUN_ID",
         help="wake a parked dispatched run instead of starting a fresh climb",
     )
@@ -3447,13 +3536,7 @@ def main() -> int:
         default=120.0,
         help="how long before the walltime the self-deadline fires (floor 60)",
     )
-    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
-    parser.add_argument(
-        "--github-app-file",
-        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
-        help="GitHub App config (JSON: app_id, installation_id, private_key); "
-        "when set, installation tokens replace the PAT",
-    )
+    add_credential_args(parser)
     parser.add_argument(
         "--key-file",
         default="",
@@ -3472,6 +3555,8 @@ def main() -> int:
     )
     args = parser.parse_args()
     logging.basicConfig(level=logging.INFO, format="%(asctime)s %(message)s")
+    if args.resume:
+        _attach_run_log(run_dir_of(args.run_root, args.resume))
     if not args.image and not args.uncontained:
         parser.error("--image is required (or pass --uncontained explicitly, dev only)")
     # NOTE: the codex author is validated on the EFFECTIVE author per path — the

outerloop/cli.py

@@ -499,6 +499,55 @@ def start(args: argparse.Namespace) -> int:
     return 0
 
 
+DIST = "outerloop-science"  # the PyPI distribution; imported as `outerloop`
+
+
+def _installed_version(python: str) -> str:
+    """The installed version of the distribution, read from a fresh interpreter
+    so it reflects what pip just wrote rather than this process's imported copy."""
+    proc = subprocess.run(
+        [python, "-c", f"import importlib.metadata as m; print(m.version({DIST!r}))"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return proc.stdout.strip() or "unknown"
+
+
+def upgrade(args: argparse.Namespace) -> int:
+    """Upgrade the installed package in place, the local adopter's one verb.
+
+    On Slurm the resident tick self-updates through OUTERLOOP_AUTO_UPDATE; a local
+    install has no such loop, so this is the equivalent: `pip install --upgrade`,
+    then you restart the loop to pick the new code up. Pip already picks the newest
+    release and only falls back to a pre-release when that is all that is published;
+    --pre forces pre-releases even once a stable exists."""
+    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", DIST]
+    if args.pre:
+        cmd.append("--pre")
+    if args.dry_run:
+        print(shlex.join(cmd))
+        return 0
+    before = _installed_version(sys.executable)
+    proc = subprocess.run(cmd, check=False)
+    if proc.returncode != 0:
+        print(
+            f"upgrade failed (pip exited {proc.returncode}). If this environment has no "
+            f"pip, upgrade through its installer instead, e.g. `uv pip install --upgrade {DIST}`.",
+            file=sys.stderr,
+        )
+        return proc.returncode
+    after = _installed_version(sys.executable)
+    if before == after:
+        print(f"already up to date: outerloop {after}.")
+    else:
+        print(
+            f"upgraded outerloop {before} -> {after}. Restart the loop to pick it up: "
+            f"stop the running tick, then `outerloop start`."
+        )
+    return 0
+
+
 def main(argv: list[str] | None = None) -> int:
     from outerloop import __version__
 
@@ -539,6 +588,17 @@ def main(argv: list[str] | None = None) -> int:
         help="guided setup: write ~/.config/outerloop/.env and the PAT file",
         add_help=False,
     )
+    up = sub.add_parser(
+        "upgrade",
+        help="upgrade the installed package, then restart the loop to pick it up",
+        description="Upgrade outerloop-science in this environment with pip. On Slurm the "
+        "resident tick self-updates through OUTERLOOP_AUTO_UPDATE; this is the equivalent "
+        "for a local install. Restart the loop afterwards to run the new code.",
+    )
+    up.add_argument(
+        "--pre", action="store_true", help="include pre-releases even once a stable exists"
+    )
+    up.add_argument("--dry-run", action="store_true", help="print the command and exit")
     argv = sys.argv[1:] if argv is None else list(argv)
     if argv[:1] == ["tick"]:
         # the tick entry owns its own parser; hand it the rest untouched
@@ -551,7 +611,10 @@ def main(argv: list[str] | None = None) -> int:
         from outerloop import init
 
         return init.main(argv[1:])
-    return start(parser.parse_args(argv))
+    args = parser.parse_args(argv)
+    if args.command == "upgrade":
+        return upgrade(args)
+    return start(args)
 
 
 if __name__ == "__main__":

outerloop/climbboard.py

@@ -29,7 +29,7 @@ from pathlib import Path
 from typing import Any
 
 from outerloop.markers import marker
-from outerloop.runstate import ENDED, list_runs, run_dir
+from outerloop.runstate import ENDED, RunRecord, list_runs, run_dir
 
 log = logging.getLogger("outerloop.climbboard")
 
@@ -169,12 +169,19 @@ def _curve_from_eval(run_directory: Path) -> list[list[float]]:
     return best
 
 
-def collect_rows(root: Path, target: str) -> dict[str, list[ClimbRow]]:
-    """Terminal attempts of `target` with a report, grouped by benchmark."""
+def collect_rows(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, list[ClimbRow]]:
+    """Terminal attempts of `target` with a report, grouped by benchmark.
+
+    `records` is one tick-wide snapshot the board threads to every collector;
+    absent, the rows are read fresh (direct callers, tests)."""
     from datetime import UTC, datetime
 
+    if records is None:
+        records = list_runs(root)
     out: dict[str, list[ClimbRow]] = {}
-    for record in list_runs(root):
+    for record in records:
         # only ENDED runs: an in-review run's outcome is not known yet (its
         # PR may be rejected), and a published row is never rewritten
         if record.target != target or record.state != ENDED:
@@ -872,13 +879,19 @@ def is_fixed_kernel_job(name: str) -> bool:
     return any(p.match(name) for p in FIXED_JOB_PATTERNS)
 
 
-def run_job_names(root: Path, target: str) -> dict[str, tuple[str, str, bool]]:
+def run_job_names(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, tuple[str, str, bool]]:
     """Expected per-run job names for `target`: name -> (run_id, agent,
     is_prefix). Exact for wake and followup; a prefix for launches, whose
     names end in the experiment's own label. Every run of the target counts,
-    ended ones too: a finishing job can outlive its record's state."""
+    ended ones too: a finishing job can outlive its record's state.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    if records is None:
+        records = list_runs(root)
     out: dict[str, tuple[str, str, bool]] = {}
-    for record in list_runs(root):
+    for record in records:
         if record.target != target:
             continue
         rid, agent = record.run_id, record.agent_id
@@ -897,13 +910,19 @@ def run_job_names(root: Path, target: str) -> dict[str, tuple[str, str, bool]]:
     return out
 
 
-def eval_job_owners(root: Path, target: str) -> dict[str, tuple[str, str]]:
+def eval_job_owners(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, tuple[str, str]]:
     """Slurm job id -> (run_id, agent) for every eval a live run of `target`
     has dispatched: the measurer leaves the id in eval-*/submitted. Eval job
     names are liveness hashes with no agent in them, so this is how the queue
-    view knows whose eval is whose."""
+    view knows whose eval is whose.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    if records is None:
+        records = list_runs(root)
     out: dict[str, tuple[str, str]] = {}
-    for record in list_runs(root):
+    for record in records:
         if record.target != target or record.state == ENDED:
             continue
         for submitted in run_dir(root, record.run_id).glob("eval-*/submitted"):
@@ -916,12 +935,20 @@ def eval_job_owners(root: Path, target: str) -> dict[str, tuple[str, str]]:
     return out
 
 
-def queue_rows(root: Path, target: str, snapshot: list[dict[str, str]]) -> list[dict[str, str]]:
+def queue_rows(
+    root: Path,
+    target: str,
+    snapshot: list[dict[str, str]],
+    records: list[RunRecord] | None = None,
+) -> list[dict[str, str]]:
     """The published queue: kernel jobs from a `Compute.queue_snapshot()`,
     each attributed to an agent (by eval marker, else by the agent id every
-    other kernel job carries in its name)."""
-    owners = eval_job_owners(root, target)
-    expected = run_job_names(root, target)
+    other kernel job carries in its name).
+
+    `records` shares the board's one snapshot across both owner maps; absent,
+    each reads fresh (watcher, tests)."""
+    owners = eval_job_owners(root, target, records)
+    expected = run_job_names(root, target, records)
     rows: list[dict[str, str]] = []
     for job in snapshot:
         name = str(job.get("name", ""))
@@ -1001,19 +1028,25 @@ def collect_status(
     now: float,
     contract: Any = None,
     queue: list[dict[str, str]] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> dict[str, Any]:
     """The fleet's live picture for `target`: one entry per non-terminal run.
     Timestamps, not durations — the page computes elapsed time client-side,
-    so the strip feels live between pushes."""
+    so the strip feels live between pushes.
+
+    `records` shares the board's one snapshot (the runs list and the queue's
+    owner maps read the same records); absent, it reads fresh."""
     from outerloop.dispatch import effective_eval_minutes
 
+    if records is None:
+        records = list_runs(root)
     budgets = {
         b.name: (b.depth_k, b.sleep_k, getattr(b, "eval_minutes", 0) or 0)
         for b in getattr(contract, "benchmarks", ())
     }
     gpu_budget = getattr(getattr(contract, "budgets", None), "gpu_hours_per_run", None)
     runs = []
-    for record in list_runs(root):
+    for record in records:
         if record.target != target or record.state not in _LIVE_STATES:
             continue
         stage = record.stage or {}
@@ -1058,7 +1091,7 @@ def collect_status(
     runs.sort(key=lambda r: str(r.get("run_id")))
     status: dict[str, Any] = {"target": target, "published": now, "runs": runs}
     if queue is not None:  # a snapshot was taken (Slurm); the local loop has no queue
-        status["queue"] = queue_rows(root, target, queue)
+        status["queue"] = queue_rows(root, target, queue, records)
     return status
 
 
@@ -1069,12 +1102,15 @@ def service_status(
     now: float,
     contract: Any = None,
     queue: list[dict[str, str]] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> bool:
     """Publish the strip when the fleet's SHAPE changed — a run appearing,
     leaving, or changing state/phase — never on every tick: the page shows
     elapsed time client-side, so timestamp-only drift is not worth a commit.
-    Advisory like the board; True when a write happened."""
-    status = collect_status(root, target, now, contract, queue)
+    Advisory like the board; True when a write happened.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    status = collect_status(root, target, now, contract, queue, records)
     try:
         existing_raw: str | None = github.get_file(target, STATUS_PATH, BOARD_BRANCH)
     except Exception as exc:
@@ -1247,7 +1283,11 @@ def _read_index(github: Any, target: str) -> dict[str, str] | None:
 
 
 def service_climb_board(
-    root: Path, github: Any, target: str, directions: dict[str, str] | None = None
+    root: Path,
+    github: Any,
+    target: str,
+    directions: dict[str, str] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> int:
     """Publish the board for `target`. Returns how many files changed.
 
@@ -1255,8 +1295,10 @@ def service_climb_board(
     as ONE commit (`put_files`) — data, curves, and the views are atomic,
     so the page can never point at data that is not on the branch, and a
     board pass costs at most one commit of research-log history. A failed
-    batch changes nothing; the whole pass retries next tick."""
-    local = collect_rows(root, target)
+    batch changes nothing; the whole pass retries next tick.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    local = collect_rows(root, target, records)
     # snapshot BEFORE any branch read: put_files refuses if the head moves
     # mid-pass, so a concurrent write is never buried under stale content.
     # "" = branch missing (nothing to protect); None = outage — writing

outerloop/followup.py

@@ -49,7 +49,6 @@ from outerloop.orchestrator import (
     steward_out_of_scope,
 )
 from outerloop.orchestrator import improved as orch_improved
-from outerloop.paths import CONFIG_DIR
 from outerloop.progress import (
     PROGRESS_PATHS,
     fmt_metric,
@@ -1970,7 +1969,7 @@ def main() -> int:
     import os
     import time
 
-    from outerloop.appauth import resolve_bot_auth
+    from outerloop.appauth import add_credential_args, resolve_bot_auth
     from outerloop.harness import DEFAULT_MAX_TURNS
     from outerloop.orchestrator import SubprocessEvaluator
 
@@ -2013,13 +2012,7 @@ def main() -> int:
         default=0,
         help="this job's Slurm walltime; arms the self-deadline (0 = off)",
     )
-    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
-    parser.add_argument(
-        "--github-app-file",
-        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
-        help="GitHub App config (JSON: app_id, installation_id, private_key); "
-        "when set, installation tokens replace the PAT",
-    )
+    add_credential_args(parser)
     parser.add_argument(
         "--key-file",
         default="",

outerloop/github.py

@@ -503,10 +503,20 @@ class GitHubClient:
         return True
 
     def disable_auto_merge(self, repo: str, number: int) -> bool:
-        """Disarm GitHub auto-merge (GraphQL). The follow-up lane calls this
-        before pushing new commits to an auto-mode PR: an armed PR would
-        merge the NEW head on green CI without a fresh gate/suite/panel
-        (terra #171). Returns False when nothing was armed or on error."""
+        """Ensure GitHub auto-merge will not fire on this PR, and report whether
+        that is confirmed. The follow-up lane calls this before pushing new
+        commits to an auto-mode PR: an armed PR would merge the NEW head on green
+        CI without a fresh gate/suite/panel (terra #171).
+
+        The property to confirm is "auto-merge is not armed". We always run the
+        disarm mutation — never skipping it on a prior read, which would let
+        another actor arm auto-merge between the read and the push. When nothing
+        is armed the mutation errors, and its text varies by the repo's "Allow
+        auto-merge" setting and the token type (App vs PAT), so we confirm by
+        RE-READING the PR's `auto_merge` state rather than matching a string: if
+        auto-merge is off afterward, the safety property holds and pushing is
+        safe. Returns False only when auto-merge is still armed and could not be
+        disarmed."""
         if self.dry_run:
             log.info("[dry-run] disarm auto-merge on %s#%d", repo, number)
             return True
@@ -519,12 +529,18 @@ class GitHubClient:
                 " disablePullRequestAutoMerge(input: {pullRequestId: $pr})"
                 " { pullRequest { number } } }"
             )
-            self._graphql(mutation, {"pr": str(node_id)})
-            return True
-        except GitHubError as exc:
-            if "not enabled" in str(exc).casefold():
-                # nothing was armed — the state we wanted; pushing is safe
+            try:
+                self._graphql(mutation, {"pr": str(node_id)})
                 return True
+            except GitHubError as exc:
+                # Disarming a PR with nothing armed errors; the message is not a
+                # reliable signal (merge:manual repo, "Allow auto-merge" off, or
+                # App-token phrasing), so confirm by state: off now = safe.
+                if not self.get_pull_request(repo, number).get("auto_merge"):
+                    return True
+                log.warning("auto-merge disarm on %s#%s failed: %s", repo, number, exc)
+                return False
+        except GitHubError as exc:
             log.warning("auto-merge disarm on %s#%s failed: %s", repo, number, exc)
             return False
 
@@ -768,15 +784,19 @@ class GitHubClient:
         )
         return int(data.get("number", 0)) if isinstance(data, dict) else 0
 
-    def update_issue(self, repo: str, number: int, body: str) -> None:
-        """Replace an issue's body (the rolling maintenance digest)."""
+    def update_issue(self, repo: str, number: int, body: str, *, title: str | None = None) -> None:
+        """Replace an issue's body (the rolling maintenance digest), and its
+        title when one is given (the digest carries the scan date there)."""
         if self.dry_run:
             log.info("[dry-run] update issue %s#%s (%d chars)", repo, number, len(body))
             return
+        payload: dict[str, str] = {"body": body}
+        if title is not None:
+            payload["title"] = title
         self._request(
             "PATCH",
             f"/repos/{urllib.parse.quote(repo)}/issues/{number}",
-            {"body": body},
+            payload,
         )
 
     def close_issue(self, repo: str, number: int) -> None: