F2d: already-fixed check and opening the task's PR

[mchwang]

Lane F, step F2d (design: "Checking whether the issue is already fixed" and "Needs human"). See docs/implementation/pull-request-opening.md.

What changes

• github/already-fixed.ts: the pre-PR check. It matches when something other than the task closed the issue, when another open or merged PR links to it, or when a new base commit mentions it (#N, GH-N, owner/repo#N, the issue URL). Own PRs are excluded by repository and number, and own commits by SHA (AGENTS.md: repository identity, stable identity). Every read is bounded (100 timeline events, 250 base commits). A bound, a non-ancestor base, or a malformed or unreadable answer returns unknown, which is handled like a match.
• github/pull-requests.ts: opens a PR or draft with literal gh argv. It finds a lost PR by its description marker and refreshes (and marks ready) the task's existing PR. It checks the head and base repository and branch in every answer.
• runner/publish.ts: recover → check → push → re-read → open or reuse. A match opens nothing: a running task moves to possibly already fixed, and a needs-human task stays as it is, with no draft. The GitHub call comes right after a Store transaction that confirms a clear check with no task change since (AGENTS.md: re-read before an irreversible action).
• runner/store.ts: schema v7 adds already_fixed_checks and task_pull_requests. An opening is recorded before the call, so a lost outcome is adopted, not opened twice. A PR that opens after a cancel is still recorded, so it can be closed.
• core/pull-request-body.ts: plan text and open problems go inside a fence longer than any backtick run in them, so closing keywords and @-mentions do nothing. The description stays under 60,000 characters.

Not in this PR

• The real push (BranchPusher) needs D: inspect task changes and make runner commits (needed by F2) #66's commit export and a runner-owned host repository.
• The Continue and Cancel actions from possibly already fixed, and closing the draft on cancel.
• Moving the pre-merge check in GhMergeGateway onto this module (F6).

Evidence

• test/already-fixed.test.ts and test/publish.test.ts: 97 tests (on 6c15c41); with the Store and recovery suites, 190 pass. After merging main (fa037c9), the F2d, runner, store and merge suites pass together: 367 tests in 8 files.
• Mutation checks: 104 guards were broken one at a time, and each broken guard failed a test; the SIGKILL escalation was also checked by removing it (its test then times out). One guard made redundant by a reordering (the extra pre-push re-read) was removed rather than kept untestable.
• Full local suite: 956 passed. The 18 failures were Docker daemon contention with other sessions (pool overlap, a name conflict, "cannot connect") and two load timeouts. None are in touched code. The non-Docker suites (history, review, store, runner, merge) pass when re-run: 341/341.

Review rounds

Round	Source	Head	Findings	Fixed in
1	Copilot	cba0a9b	7: branch-name collision; gh inherited the full environment (2); a closed PR could be recorded; the no-changes shortcut skipped the status guard; a lost opening was abandoned after one empty lookup; a stale response could move a newer task.	7e3830b
2	Local /code-review	7e3830b	2: a needs-human task reusing its ready PR moved to in review, and the PR stayed ready; fenced() spread every backtick run into Math.max.	1dcd29e
3	Local /code-review	1dcd29e	1: the gh allowlist left out the D-Bus session bus that Linux keyring sign-in needs.	7f3e5fe
4	Local /code-review	7f3e5fe	None.	—
5	Copilot	ea96836	4: the push ran before the re-read that follows the earlier-PR lookup; a manually connected, then disconnected PR still counted as linked; no overall deadline across the check's gh calls; an update of the open PR had no durable record if its read-back failed.	0f750f1
6	Copilot	0f750f1	4: the 45 s check deadline exceeded the 15 s request budget; an already-aborted signal was ignored on paths with no await; overlapping publishes could clear or overtake an in-flight update; the pre-write guard ignored review_version.	89621e9
7	Local /code-review	89621e9	1: the one-publish-per-task guard was per publisher instance.	6b26e65
8	Local /code-review	6b26e65	None.	—
9	Handed-off /code-review (high effort, from the #86 session)	0f750f1	8: closing keywords in the title and in squash/merge commit messages; publishing stuck when an abandoned opening's PR appears later; overlapping publishes (already fixed in 89621e9/6b26e65); a ProjectV2 closer made the check unknown; the PR-number check ran after the push; the deadline comment (already fixed in 89621e9); sequential timeline and commit reads; title cutting split surrogate pairs.	9980445
10	Independent review agent	uncommitted fixes for round 9	2: adoption was unreachable because the check ran before the lookup that identifies the task's own PR (the test's fake check hid this); cutting problems by code point broke the description size bound.	9980445
11	Copilot	9980445	3: the PR description was one OS argument (a 60,000-character multibyte body or a NUL fails to spawn); shown problems were 2,001 characters, not 2,000; Promise.all returned while the sibling gh was still settling.	fc5887b
12	Local /code-review	fc5887b	1: the new stdin runner sent only SIGTERM, so a gh that ignores it never settles.	b32a330
13	Local /code-review	b32a330	None.	—
14	Local /code-review, high effort	b32a330	5: the check's default gh runner never escalated past SIGTERM, so the deadline could not hold; runWithInput waited on pipes a grandchild could hold open; the refresh read-back raced GitHub's asynchronous head update; a matching check left the earlier ready PR ready for review; #recover read the PR records three times.	07c6630
15	Local /code-review, high effort	07c6630	3: a failed draft change stranded the ready PR after the status moved; the draft record could throw after GitHub changed (number mismatch refused too late); head polls leaked abort listeners.	dcc2b0c
16	Local /code-review, high effort	dcc2b0c	None.	—
17	Copilot	dcc2b0c	4: markDraft and refresh accepted a read-back that did not show the requested draft state; the draft change ran without re-reading the task after the check; @-mentions in the unfenced title could notify; the 12 s deadline plus the runner's SIGTERM and pipe grace periods could exceed the 15 s budget.	0be7147
18	Local /code-review, extra-high effort	0be7147	9: the task's own merged PR (or its own close of the issue) was excluded, so a fixed issue looked clear; repositories without draft PRs looped forever on needs-human publishing; the push moved the open PR before the refresh was recorded; the gh allowlist lacked Windows variables; commit subjects could split a surrogate pair; validation regexes were duplicated across adapters; markDraft re-read a PR its caller had just read; one Store method served two contracts; test Stores were never closed.	f5859f4
19	Copilot	f5859f4	4: the first publish pushed without checking for an open PR on the branch that codeboost did not open; a needs-human refresh pushed and patched the ready PR before trying the draft change; the already-fixed module summary described the old exclusion policy; no v6→v7 upgrade test.	a0b5206
20	Copilot	fa037c9	3: the marker was matched anywhere in the description, so agent-controlled text could block or impersonate a PR; a draft change whose record was lost was never repaired; recovery confirmed a lost draft opening whose PR had been made ready.	46bbeba
21	Copilot	46bbeba	3 (2 inline, 1 in the summary): a comparison that repeats a SHA could hide a commit and read as clear; recovery ended a newer publish with an older opening's PR (wrong task version or draft mode); a draft opening that GitHub created as ready was accepted.	f094853
22	Copilot (summary only, no inline threads)	f094853	2: each PR command got a fresh 30 s, so one refresh or draft change could run for minutes; an abandoned opening's PR seen during a non-clear publish was never adopted, leaving it unrecorded for cleanup.	8a4e5ea
23	Local /engineering:code-review	8a4e5ea	1 applied: beginRefresh kept an unused adopt path after adoption moved to adoptOpening; removed, and beginRefresh now requires an opened row. Other suggestions deferred (see below).	af56100
24	Copilot	af56100	3: recordAlreadyFixed accepted a result after the review changed during the draft change; openings and refreshes owned only the task state version, so a review change during open()/refresh() still moved the task; the design doc still placed adoption in the refresh.	6c15c41

Each fix has a regression test. All 34 Copilot threads are answered and resolved; the summary-only finding of round 21 is answered in the recovery thread.

Review-lesson audit

Finding	Classification
Branch-name collision	Covered: AGENTS.md, Guarded external actions, "Exclude the subject … by stable identity only."
gh inherited the full environment (2 threads)	Covered: AGENTS.md, Owned host and Docker resources, "Give every subprocess an explicit allowlisted environment."
A closed PR could be recorded	Covered: AGENTS.md, Guarded external actions, "Validate every field used to classify an external record as clear."
No-changes shortcut skipped the status guard	New rule (ea96836): "Check an operation's source-state preconditions before any shortcut or early return …"
Lost opening abandoned after one empty lookup	Covered: AGENTS.md, Async jobs and polling, "When an irreversible command has an ambiguous … outcome, retain durable in-flight ownership …"
Stale response could move a newer task	Covered: AGENTS.md, Async jobs and polling, "Never apply a background response without proving it is still current."
Needs-human task moved to in review by a refresh	New rule (ea96836): "A current response may still move a record only along a transition allowed from the state the action was guarded for …"
fenced() spread unbounded runs	New rule (ea96836): "Never spread a collection whose size follows unbounded input into function arguments …"
Push before the re-read after the earlier-PR lookup	Covered: AGENTS.md, Guarded external actions, "After the final asynchronous external validation, re-read the local generation immediately before an irreversible action."
Disconnected PR still counted as linked	New rule (0f750f1): "When a relation can be added and removed …, replay its add and remove events in order and count only its latest state."
No overall deadline for the check	Covered: AGENTS.md, Guarded external actions, "… give the combined operation an overall deadline below the serving request timeout."
Refresh left no durable record	Covered: AGENTS.md, Async jobs and polling, "When an irreversible command has an ambiguous … outcome, retain durable in-flight ownership and reconcile external state before enabling retry."
Check deadline above the request budget	Covered: AGENTS.md, Guarded external actions, "… an overall deadline below the serving request timeout."
Already-aborted signal ignored	New rule (89621e9): "Honour a cancellation signal that is already aborted before the first durable write …"
Overlapping publishes (Copilot and handed-off review)	Covered: AGENTS.md, Async jobs and polling, "… retain durable in-flight ownership and reconcile external state before enabling retry."
Guard ignored review_version	Covered: AGENTS.md, "After the final asynchronous external validation, re-read the local generation …", and the F1 contract (runner-lifecycle.md, Irreversible actions).
Publish guard was per instance	Covered: the same in-flight ownership rule; the guard is now shared per Store.
Closing keywords in commit messages	New rule (9980445): "Neutralise issue references … in any text codeboost writes that can become a commit message …"
Stuck after an abandoned opening's PR appears (and the unreachable first fix)	New rule (9980445): "When recovery looks for the result of an earlier attempt, recognise the identities of all earlier attempts, abandoned ones included …"
ProjectV2 closer	New rule (9980445): "Select every member the API documents for a union or enum you classify …"
PR-number check after the push	Covered: AGENTS.md, "Check an operation's source-state preconditions before any shortcut or early return …" and the re-read rule.
Deadline comment	Covered: AGENTS.md, Review readiness, "Treat every behavioural claim … as something to verify."
Sequential reads	One-off: a latency choice under one deadline, not a correctness rule; fixed in place.
Surrogate-splitting cuts and the size bound	One-off: text-cutting detail with a regression test for both the split and the size bound; too narrow for a repository rule.
PR description passed as an OS argument	New rule (fc5887b): "Pass text whose size follows user or agent input to a subprocess on stdin, never as an argument …"
Problems cut to 2,001 characters	Covered: AGENTS.md, Review readiness, "Treat every behavioural claim … as something to verify."
Check returned before the sibling gh settled	Covered: AGENTS.md, Async jobs and polling, "Keep the job tracked until its underlying invocation or subprocess has terminated."
Runner sent only SIGTERM	Covered: the same rule; a process that ignores SIGTERM has not terminated, so the runner escalates to SIGKILL.
Check runner never escalated past SIGTERM	Covered: AGENTS.md, Async jobs and polling, "Keep the job tracked until its underlying invocation or subprocess has terminated." Fixed by reusing runWithInput.
Runner waited on pipes a grandchild held	Covered: the same rule; the process has terminated, so the runner settles after a pipe grace period.
Refresh read-back raced the head update	One-off: GitHub-specific eventual consistency after a push, handled with a bounded poll and a test.
Matching check left the ready PR ready	Covered: AGENTS.md, "A current response may still move a record only along a transition allowed from the state the action was guarded for …" (a task not published as ready must not offer a ready PR).
#recover read records three times	One-off: redundant reads, simplified in place.
Failed draft change stranded the PR	Covered: AGENTS.md, "Check an operation's source-state preconditions before any shortcut …" and the in-flight ownership rule; the draft change now runs before the status is recorded.
Draft record threw after GitHub changed	Covered: the same preconditions rule; the number check now runs before any GitHub change.
Head polls leaked abort listeners	One-off: listener cleanup, with a test that counts listeners.
Draft or ready change not verified	New rule (0be7147): "After an external state change (ready, draft, close), read the record back and require the new state before recording success …"
No re-read before drafting	Covered: AGENTS.md, "After the final asynchronous external validation, re-read the local generation immediately before an irreversible action."
@-mentions in the title	Rule extended (0be7147): "Neutralise issue references … and neutralise @-mentions in any of that text that is not fenced (a title)."
Deadline ignored shutdown grace periods	New rule (0be7147): "Count the subprocess shutdown grace periods … inside that overall deadline …"
Own merged PR excluded	New rule (f5859f4): "Exclude the subject's own records only in the states the exclusion is for …"
Drafts unsupported looped forever	Covered: AGENTS.md, Async jobs and polling, "… Only a confirmed refusal may become retryable failure." GitHub's "drafts not supported" is a confirmed refusal, so the opening or update is dropped instead of being held as unknown.
Push before the refresh was recorded	New rule (f5859f4): "Record in-flight ownership before the first external write of an operation …"
Windows variables missing	Covered: AGENTS.md, "Build that allowlist from each tool's documented credential and configuration channels on every supported platform …"
Commit subject split a surrogate pair	One-off: the shared core/text.ts cut now serves every bounded text; a test pins the straddling case.
Duplicated validation regexes	One-off: consolidated into github/validate.ts (merge.ts is left to #86's owner).
markDraft extra read	One-off: redundant I/O removed in place.
Store method with two contracts	One-off: split into recordPullRequestOpened and recordRefreshConfirmed.
Test Stores never closed	One-off: afterEach closes them, matching the other runner test files.
Push without checking for a foreign branch PR	Covered: AGENTS.md, "Check an operation's source-state preconditions before any shortcut or early return …"; the lookup now runs even with no known markers.
Refresh changed the PR before the draft step	New rule (a0b5206): "Order an operation's external writes so that any step the remote can definitely refuse comes before the writes that cannot be taken back …"
Stale module summary	Covered: AGENTS.md, Review readiness, "Treat every behavioural claim … as something to verify."
No v6→v7 upgrade test	One-off: added the upgrade test the earlier migrations already have.
Marker matched anywhere in the body	New rule (46bbeba): "Read an identity marker only from its reserved position …"
Lost draft change never repaired	New rule (46bbeba): "When the external record is observed, correct the local copy of any field the operation owns …"
Recovery confirmed a ready PR for a draft opening	Covered: AGENTS.md, "A current response may still move a record only along a transition allowed from the state the action was guarded for …"; the lost opening owned a draft.
Repeated SHA in the comparison	Covered: AGENTS.md, "A bounded safety scan must fail closed when its limit is exceeded. Never truncate evidence and report the result as clear."
Recovery ended a newer publish	Covered: AGENTS.md, "Never apply a background response without proving it is still current …"
Draft opening created as ready	Covered: AGENTS.md, "After an external state change … read the record back and require the new state before recording success …"
Per-command timeouts instead of one operation deadline	Covered: AGENTS.md, "… give the combined operation an overall deadline …" and "Count the subprocess shutdown grace periods … inside that overall deadline …"
Abandoned opening's PR not adopted on a non-clear check	Covered: AGENTS.md, "When the external record is observed, correct the local copy of any field the operation owns …" and "… recognise the identities of all earlier attempts, abandoned ones included …"
Dead adopt path in beginRefresh	One-off: removing code left behind by an earlier move; a test pins the stricter rule.
Review version not owned by checks, openings and refreshes	New rule (6c15c41): "When the local state has more than one version counter … an in-flight action owns all of them …" (the F1 contract, runner-lifecycle.md, Irreversible actions, already required it).
Stale adoption wording in the doc	Covered: AGENTS.md, Review readiness, "Treat every behavioural claim … as something to verify."
D-Bus variables missing from the allowlist	New rule (ea96836): "Build that allowlist from each tool's documented credential and configuration channels on every supported platform …"

Readiness report

• Head: 6c15c41. It fixes Copilot's tenth review (round 24) and adds one AGENTS.md rule. Main was merged in at fa037c9.
• CI: test passed on 6c15c41.
• Mergeability: mergeable, no conflicts (CLEAN).
• Unresolved review threads: 0 (all 34 resolved).
• Latest Copilot review: on af56100, with 3 findings, all fixed in 6c15c41. Copilot has not reviewed 6c15c41.
• Stacked work: Give the merge and issue gh runners the allowlisted environment #86 (gh environment allowlist for the merge and issue adapters) is rebased onto 6c15c41 (head 1aebc6d); it will be moved onto main and marked ready after this PR merges.
• Files: github/already-fixed.ts, github/pull-requests.ts, github/run-with-input.ts, github/gh-env.ts, github/validate.ts, github/merge.ts (exports RunGh), runner/publish.ts, runner/store.ts (schema v7), core/pull-request-body.ts, core/text.ts, two test files, docs/implementation/pull-request-opening.md, AGENTS.md.
• Deferred follow-ups:
  • The real branch push (BranchPusher) needs D: inspect task changes and make runner commits (needed by F2) #66's commit export.
  • Continue and Cancel from possibly already fixed, and closing the draft on cancel.
  • F6: move GhMergeGateway's pre-merge check onto github/already-fixed.ts.
  • Optional cleanups from round 23: split #publish into refresh and open paths; also treat HTTP 422 on a draft request as "drafts unsupported", not only GitHub's English message; state in the doc that each PR operation's 60 s limit excludes the runner's shutdown grace.
  • When the publisher is wired into the runner: pass it the coordinator's shutdown signal and await it before closeWrites(), so a publish in flight settles before the Store's write gate closes.
  • Give the merge and issue gh adapters the same environment allowlist: Give the merge and issue gh runners the allowlisted environment #86, stacked on this PR.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Ambiguous recovery, stale-response races, PR-state handling, and subprocess environment exposure can produce unsafe publishing outcomes.

Review effort: Balanced
Findings: 1 · 6

Open (7)

• Use collision-resistant suffix for task branch identity · New
• Restrict subprocess environment to required GitHub variables · New
• Restrict subprocess environment to required GitHub variables · New
• Require returned pull requests to be open · New
• Validate source status before no-changes early return · New
• Reconcile ambiguous PR openings before retrying POST · New
• Prevent stale responses from updating newer task generations · New

What changed in this PR

Adds the F2d workflow for detecting already-fixed issues and opening or reusing task pull requests.

Changes:

• Adds bounded, fail-closed GitHub issue/commit checks.
• Persists and coordinates PR opening, recovery, and reuse.
• Generates bounded PR content with expanded tests and documentation.

File	Description
core/​pull-request-body.ts	Builds safe, bounded PR titles and bodies.
docs/​implementation/​pull-request-opening.md	Documents the F2d workflow.
github/​already-fixed.ts	Implements already-fixed detection.
github/​merge.ts	Exports the shared GitHub runner type.
github/​pull-requests.ts	Implements GitHub PR operations.
runner/​publish.ts	Coordinates checking, pushing, recovery, and opening.
runner/​store.ts	Persists checks and PR-opening lifecycle state.
test/​already-fixed.test.ts	Tests already-fixed detection and bounds.
test/​publish.test.ts	Tests publishing, recovery, bodies, and adapters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unhandled stale-push and partial-refresh races can mutate GitHub without current or durable ownership.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Recheck generation before pushing stale snapshot · New
• Replay disconnect events before reporting linked pull requests · New
• Enforce one overall deadline across all check stages · New
• Preserve mutation outcome when final read fails · New

Resolved since last review (7)

• Use collision-resistant suffix for task branch identity
• Prevent stale responses from updating newer task generations
• Reconcile ambiguous PR openings before retrying POST
• Validate source status before no-changes early return
• Require returned pull requests to be open
• Restrict subprocess environment to required GitHub variables
• Restrict subprocess environment to required GitHub variables

[Copilot]

Copilot review overview

🟡 Changes recommended

Stale-review and overlapping-refresh races can still produce incorrect external PR state.

Review effort: Balanced
Findings: 4

Open (4)

• Set the external probe deadline below the server timeout · New
• Reject already-aborted signals before recovery or mutations · New
• Prevent overlapping refreshes from applying stale GitHub state · New
• Bind review freshness checks to the current review version · New

Resolved since last review (4)

• Recheck generation before pushing stale snapshot
• Preserve mutation outcome when final read fails
• Enforce one overall deadline across all check stages
• Replay disconnect events before reporting linked pull requests

Previously missed (1)

In code that hasn't changed since last review

Exclude path separators from issue URL pattern matches

github/​already-fixed.ts:86

These boundaries do not exclude /, so both patterns match suffixes inside unrelated paths. For example, https://example.com/owner/repo#12 and https://example.com/github.com/owner/repo/issues/12 are reported as mentions of this issue, incorrectly moving the task to “possibly already fixed.” Include / in both leading negative lookbehinds.

[Copilot]

Copilot review overview

🟡 Changes recommended

Subprocess settlement and large Unicode PR-body transport remain incorrect.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Pass PR body via stdin to avoid argv size limits · New
• Use MAX_PROBLEM to enforce the documented length limit · New
• Await sibling subprocess after Promise.all failure · New

Resolved since last review (4)

• Bind review freshness checks to the current review version
• Prevent overlapping refreshes from applying stale GitHub state
• Reject already-aborted signals before recovery or mutations
• Set the external probe deadline below the server timeout

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved deadline, stale-generation, cancellation, reference-matching, PR-state, and mention-safety issues remain.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Verify PR becomes draft after undoing readiness · New
• Revalidate task generation before publishing draft state · New
• Neutralize @​ mentions in PR titles · New
• Deadline does not bound full subprocess shutdown · New

Resolved since last review (3)

• Pass PR body via stdin to avoid argv size limits
• Await sibling subprocess after Promise.all failure
• Use MAX_PROBLEM to enforce the documented length limit

[Copilot]

Copilot review overview

🟡 Changes recommended

Branch lookup can miss or misclassify PRs, and several draft operations can act on stale task generations.

Review effort: Balanced
Findings: 3

Open (3)

• Fail closed when PR listing is truncated · New
• Validate required fields before filtering PR entries · New
• Guard direct draft mutation against stale generation · New

Resolved since last review (3)

• Review version is not validated for stale opening or refresh responses
• markDraft result can use a stale review version
• Documentation incorrectly says adoption occurs in the update transaction

[Copilot]

Copilot review overview

🔵 Needs a closer look

Recovery can arbitrarily adopt or settle a PR when multiple open PRs carry the same editable marker.

Review effort: Balanced
Findings: None

Resolved since last review (3)

• Guard direct draft mutation against stale generation
• Validate required fields before filtering PR entries
• Fail closed when PR listing is truncated

Previously missed (1)

In code that hasn't changed since last review

Fail closed when multiple matching PRs make ownership ambiguous

runner/​publish.ts:355

findOwned may return multiple PRs carrying this editable marker (for example, one per base), but destructuring the first result makes recovery depend on GitHub's list order. This can clear the durable refresh ownership even though another matching PR makes the update ambiguous; a mismatched first number is also silently cleared by settleUnconfirmedRefresh. Fail closed unless there is at most one result and its number matches the recorded PR.

This issue also appears on line 364 of the same file.

[mchwang]

Addressed Copilot's overview finding ("Fail closed when multiple matching PRs make ownership ambiguous", runner/publish.ts:355 and 364) in 683f538: recovery now refuses with PullRequestMisplaced and keeps the update or opening in flight when more than one open PR carries the update's or the lost opening's marker, or when the only PR carrying an update's marker has another number than the recorded PR. It no longer depends on GitHub's list order or silently clears the update. Tests cover the copy beside the PR, the copy alone, and a lost opening with two matches.

🤖 Addressed by Claude Code

[mchwang]

Correction to my earlier comment on the ambiguous-marker finding: after a code review, 4cc74ca changes how lost updates are handled. Refusing a lost update whenever a copy carried its marker ran before the draft step, so a stopped task's ready PR could stay ready while a copy stayed open. An update's PR has a recorded number, which cannot be edited, so recovery now settles the update from the PR with that number, whatever order GitHub lists them in, and leaves copies to the main path (two own PRs: drafted, then refused) and the draft step. A lost opening has no recorded number, so two PRs carrying its marker still make recovery refuse, and the message says which to close and that the task's PR may still be ready.

🤖 Addressed by Claude Code

[Copilot]

Copilot review overview

🔵 Needs a closer look

Embedded path-like issue tokens can produce false already-fixed matches.

Review effort: Balanced
Findings: None

Previously missed (1)

In code that hasn't changed since last review

Prevent issue tokens from matching inside URL paths

github/​already-fixed.ts:97

These start boundaries allow an issue token to be embedded in a URL path or larger path-like token. For example, both https://example.com/GH-12 and https://example.com/github.com/Owner/Repo/issues/12 currently match and can incorrectly move the task to possibly already fixed. Apply the same path-character exclusion already used by the #N alternative.

[mchwang]

Addressed Copilot's overview finding ("Prevent issue tokens from matching inside URL paths", github/already-fixed.ts:97) in 2aaa4fd: the GH-N, owner/repo#N and issue-URL forms now exclude a preceding / (and ., -, word characters), as #N already did. Tests show https://example.com/GH-12, https://example.com/github.com/Owner/Repo/issues/12, mirror/owner/repo#12 and x.github.com/owner/repo/issues/12 are not mentions, while a bracketed URL and (GH-12) still are.

🤖 Addressed by Claude Code