From cb7d76f89c631aa23dd7d70818957476528ec335 Mon Sep 17 00:00:00 2001
From: topcoder1 <topcoder1@gmail.com>
Date: Fri, 14 Aug 2026 14:46:46 -0700
Subject: [PATCH 1/4] fix(automerge): anchor the quiet period on the review
 TRIGGER, not only on elapsed silence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

wxa_vpn#1392, incident PR wxa_vpn#1512 (2026-08-14).

The quiet gate held the arm until the conversation had been silent for
findings_quiet_minutes, measured against three anchors — newest authored
commit, newest inline comment, newest non-self [bot] comment. All three
measure silence that has ALREADY ELAPSED, which is the right question
only when the event that woke the workflow did not itself start a review.

`ready_for_review` does exactly that. pr-review.yml, pr-codex-review.yml
and this workflow share the same `types:` list, so readying a draft fires
the review lanes and arms the gate in the same instant, while every
anchor the gate can read still dates from before the PR was drafted. The
longer a PR sits in draft, the more thoroughly the gate is satisfied that
nobody is talking — at the exact moment three review lanes start talking.

Measured on #1512, which was drafted at 03:21 and readied at 05:38:04Z:

  Quiet: newest commit/review activity is 7757s old (>= 1200s).
  whois-api-llc/wxa_vpn#1512 — no unaddressed findings (last commit 03:20:37Z)
  Enabling auto-merge (squash)                                  [05:38:26Z]

It never slept. The detector's "clean" was accurate and useless: it read
a conversation the reviews had not joined yet. Codex posted VERDICT:
REGRESSION at 05:39:01Z — 35s after the arm — and the PR merged at
05:42:51Z carrying it. The regression shipped and needed follow-up PR
#1518 to fix. #1518 then cleared the same way at 3074s; its review came
back clean, so that one was a near miss rather than a hit.

A longer window is not the fix: no window helps when the clock starts
pre-expired, and 7757s already exceeded the 20-minute default by 6.5x.
The anchor has to include the moment the CURRENT round of review was
triggered — so c4 is the newest `ready_for_review`/`reopened` event.

This is not new policy. The push path already waits: wxa_vpn#1513, the
same day, slept 1162s then 441s and merged clean. This only stops the
ready path from skipping a wait the push path has always taken.

Three properties the tests pin, because over-gating is how these controls
get switched off:

  * the anchor is the event's TIMESTAMP, not a boolean "was readied", so
    a later `labeled` re-run sees it age out normally and the gate cannot
    be held shut by its own re-runs;
  * only the two review triggers anchor — `labeled` above all must not,
    since pr-classify labels every PR within seconds of opening and this
    workflow re-runs on `labeled`;
  * a PR with no such event keeps exactly the pre-fix anchor set.

The read fails CLOSED like its three siblings: "could not read the
timeline" and "the PR was never readied" are the same empty value
downstream, and only the second justifies arming.

Tests: selftest/test_automerge_quiet_anchor.sh (14 checks). Proven to
bite by mutation — removing the anchor fails 5 checks with A1 reporting
`sleeps=[] clear=1 reason=quiet+clean`, the #1512 log line exactly;
making the read fail-open fails A5 alone; dropping the event filter fails
S2 and all six A4 cases. test_automerge_findings_gate.sh's S4 loop grew
the fourth endpoint (its claim is "every anchor read paginates", and a
list enumerating three of four silently stops being that) and its gh stub
grew a timeline arm.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/claude-author-automerge.yml |  59 +++-
 selftest/test_automerge_findings_gate.sh      |  16 +-
 selftest/test_automerge_quiet_anchor.sh       | 320 ++++++++++++++++++
 3 files changed, 388 insertions(+), 7 deletions(-)
 create mode 100755 selftest/test_automerge_quiet_anchor.sh

diff --git a/.github/workflows/claude-author-automerge.yml b/.github/workflows/claude-author-automerge.yml
index 82b69d2..5a361ae 100644
--- a/.github/workflows/claude-author-automerge.yml
+++ b/.github/workflows/claude-author-automerge.yml
@@ -152,7 +152,7 @@ on:
         type: boolean
         default: true
       findings_quiet_minutes:
-        description: "Quiet period (minutes) the PR must be free of new commits and review-bot comments before auto-merge is armed, after which the unaddressed-findings check runs (wxa_vpn#1392: findings posted 3-16 min after the last push merged unanswered). Applies to EVERY arm path, bypass labels included — the escape for a wrong finding is the manual merge click, which this gate never blocks. Set 0 to disable the whole gate (no wait, no findings check)."
+        description: "Quiet period (minutes) the PR must be free of new commits, review-bot comments and review triggers (ready_for_review / reopened) before auto-merge is armed, after which the unaddressed-findings check runs (wxa_vpn#1392: findings posted 3-16 min after the last push merged unanswered; #1512: a draft readied after 2h09m idle cleared the window without waiting at all and armed 35s before a REGRESSION verdict). Applies to EVERY arm path, bypass labels included — the escape for a wrong finding is the manual merge click, which this gate never blocks. Set 0 to disable the whole gate (no wait, no findings check)."
         required: false
         type: number
         default: 20
@@ -1032,10 +1032,14 @@ jobs:
       #   1. QUIET — wait until >= findings_quiet_minutes have passed since
       #      the newest of: the newest AUTHORED (non-merge) commit, the
       #      newest inline review comment (any author — an inline comment
-      #      is a deliberate code-level finding), and the newest top-level
+      #      is a deliberate code-level finding), the newest top-level
       #      [bot] comment that is not this workflow's own marker comment
       #      or pr-classify chatter (a gate that counts its own sticky
-      #      comment as review activity never opens). Sleeping here is
+      #      comment as review activity never opens), and the newest
+      #      `ready_for_review`/`reopened` event — the trigger that STARTS
+      #      a round of review, without which the clock is pre-expired on
+      #      exactly the event that begins one (wxa_vpn#1512; see c4 in
+      #      read_anchor for the measurement). Sleeping here is
       #      safe: callers run concurrency cancel-in-progress per PR, so a
       #      new push replaces this run and restarts the clock, and the
       #      arm below binds --match-head-commit so a moved head can never
@@ -1098,8 +1102,49 @@ jobs:
           # a --paginate stream (one top-level array per page) aggregates
           # ACROSS pages, not per page — the multi-page defect pinned in
           # test_automerge_hold_gate.sh.
+          #
+          # c4 — THE REVIEW-TRIGGER ANCHOR, and the reason this gate armed
+          # over a live finding on wxa_vpn#1512 (2026-08-14). The other
+          # three anchors all measure silence that has ALREADY ELAPSED,
+          # which is the right question only when the event that woke this
+          # workflow did not itself start a review. `ready_for_review` and
+          # `reopened` do exactly that: pr-review.yml, pr-codex-review.yml
+          # and this workflow share the same `types:` list, so readying a
+          # draft fires the review lanes and arms the gate IN THE SAME
+          # INSTANT — while every anchor the gate could read still dates
+          # from before the PR was drafted.
+          #
+          # Measured on #1512: the PR sat as a draft for 2h09m, so at
+          # ready_for_review the step logged
+          #   Quiet: newest commit/review activity is 7757s old (>= 1200s)
+          # cleared the 20-minute window without sleeping once, ran the
+          # detector against a conversation the reviews had not joined yet,
+          # got a legitimate "no unaddressed findings", and armed at
+          # 05:38:26Z. Codex posted VERDICT: REGRESSION at 05:39:01Z — 35
+          # seconds later — and the PR merged at 05:42:51Z carrying it.
+          # #1518 cleared the same way at 3074s (its review happened to
+          # come back clean, so it was a near miss rather than a hit).
+          #
+          # The fix is not a longer window — no window helps when the clock
+          # starts pre-expired. It is to anchor on the moment the CURRENT
+          # round of review was triggered, so `ready_for_review` waits
+          # exactly as long as a push does. That is not new policy: the
+          # push path already waits (wxa_vpn#1513 slept 1162s + 441s and
+          # merged clean), and this only stops the ready path from skipping
+          # a wait the push path has always taken.
+          #
+          # These are POINT-IN-TIME event timestamps, not "now", so a later
+          # `labeled` run re-reads the same fixed value and sees it age out
+          # normally — the gate cannot be held shut by its own re-runs. A
+          # PR opened non-draft and never reopened has no such event, `max`
+          # yields empty, and the anchor set is exactly what it is today.
+          #
+          # Fail-closed like every sibling read: `issues/{n}/timeline` is
+          # already load-bearing in this job (the detector fetched below
+          # reads issues/{n}/comments fatally), so an unreadable timeline
+          # is an unreadable anchor, not an absent one.
           read_anchor() {
-            local commits inline issue c1 c2 c3
+            local commits inline issue timeline c1 c2 c3 c4
             commits=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}/commits?per_page=100" --paginate) || return 1
             c1=$(printf '%s' "$commits" | jq -rs '[(add // [])[] | select((.parents | length) < 2) | .commit.committer.date] | max // empty') || return 1
             inline=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}/comments?per_page=100" --paginate) || return 1
@@ -1109,7 +1154,11 @@ jobs:
                   | select(((.user.login // "") | endswith("[bot]")))
                   | select(((.body // "") | test("<!-- (claude-author-automerge|pr-classify)")) | not)
                   | .created_at] | max // empty') || return 1
-            printf '%s\n%s\n%s\n' "$c1" "$c2" "$c3" | grep -v '^$' | sort | tail -1
+            timeline=$(retry gh api "repos/${GITHUB_REPOSITORY}/issues/${PR}/timeline?per_page=100" --paginate) || return 1
+            c4=$(printf '%s' "$timeline" | jq -rs '[(add // [])[]
+                  | select(.event == "ready_for_review" or .event == "reopened")
+                  | .created_at] | max // empty') || return 1
+            printf '%s\n%s\n%s\n%s\n' "$c1" "$c2" "$c3" "$c4" | grep -v '^$' | sort | tail -1
           }
 
           waited=0
diff --git a/selftest/test_automerge_findings_gate.sh b/selftest/test_automerge_findings_gate.sh
index 07e3a52..7bbca43 100644
--- a/selftest/test_automerge_findings_gate.sh
+++ b/selftest/test_automerge_findings_gate.sh
@@ -117,8 +117,12 @@ else
   echo "✓ S3 run block is interpolation-free (env vars only)"
 fi
 
-# S4. All three anchor reads paginate.
-for ep in 'pulls/${PR}/commits?per_page=100' 'pulls/${PR}/comments?per_page=100' 'issues/${PR}/comments?per_page=100'; do
+# S4. All FOUR anchor reads paginate. The timeline read is the review-trigger
+# anchor (wxa_vpn#1512); its behaviour is pinned in test_automerge_quiet_anchor.sh,
+# but it belongs in this loop because the loop's claim is "every anchor read
+# paginates" — a list that enumerates three of four silently stops being that.
+for ep in 'pulls/${PR}/commits?per_page=100' 'pulls/${PR}/comments?per_page=100' \
+          'issues/${PR}/comments?per_page=100' 'issues/${PR}/timeline?per_page=100'; do
   if grep -F "$ep" "$T/qf.sh" | grep -q -- '--paginate'; then
     echo "✓ S4 anchor read paginates: $ep"
   else
@@ -173,6 +177,14 @@ case "$*" in
     cat "$T_DIR/commits.json"; exit 0 ;;
   *pulls/*/comments*)
     cat "$T_DIR/inline.json"; exit 0 ;;
+  *issues/*/timeline*)
+    # The review-trigger anchor (wxa_vpn#1512). Empty here on purpose: the
+    # cases in THIS file are about the quiet/findings decision, and an empty
+    # timeline is the pre-fix anchor set exactly. Its own behaviour — a recent
+    # ready_for_review must anchor, an old one must not, unrelated events must
+    # not, an unreadable read must fail closed — is pinned in
+    # selftest/test_automerge_quiet_anchor.sh.
+    echo '[]'; exit 0 ;;
   *contents/.github/scripts/unaddressed-findings.sh*)
     base64 < "$T_DIR/checker_stub.sh"; exit 0 ;;
   *issues/*/comments*--jq*)
diff --git a/selftest/test_automerge_quiet_anchor.sh b/selftest/test_automerge_quiet_anchor.sh
new file mode 100755
index 0000000..23228b1
--- /dev/null
+++ b/selftest/test_automerge_quiet_anchor.sh
@@ -0,0 +1,320 @@
+#!/usr/bin/env bash
+# Behavioral test for the REVIEW-TRIGGER anchor in claude-author-automerge.yml's
+# quiet-period gate (wxa_vpn#1392, incident PR wxa_vpn#1512).
+#
+# THE DEFECT. The quiet gate holds the arm until the review conversation has
+# been silent for findings_quiet_minutes, then runs the unaddressed-findings
+# detector. Its three original anchors — newest authored commit, newest inline
+# comment, newest non-self [bot] comment — all measure silence that has ALREADY
+# ELAPSED. That is the right question only when the event that woke the workflow
+# did not itself start a review.
+#
+# `ready_for_review` does exactly that. pr-review.yml, pr-codex-review.yml and
+# claude-author-automerge.yml share the same `types:` list, so readying a draft
+# fires the review lanes and arms the gate in the same instant — while every
+# anchor the gate can read still dates from before the PR was drafted. The
+# longer a PR sits in draft, the more thoroughly the gate is satisfied that
+# nobody is talking, at the exact moment three review lanes start talking.
+#
+# MEASURED, wxa_vpn#1512 (2026-08-14). The PR was drafted at 03:21 and readied
+# at 05:38:04Z — 2h09m later. The step logged:
+#
+#   Quiet: newest commit/review activity is 7757s old (>= 1200s).
+#   whois-api-llc/wxa_vpn#1512 — no unaddressed findings (last commit 03:20:37Z)
+#   Enabling auto-merge (squash)                                  [05:38:26Z]
+#
+# It never slept. The detector's "clean" was accurate and useless: it read a
+# conversation the reviews had not joined yet. Codex posted VERDICT: REGRESSION
+# at 05:39:01Z — 35 seconds after the arm — and the PR merged at 05:42:51Z
+# carrying it. The regression shipped and needed follow-up PR #1518 to fix.
+# #1518 then cleared the same way at 3074s; its review came back clean, so that
+# one was a near miss rather than a hit.
+#
+# WHY A LONGER WINDOW IS NOT THE FIX: no window helps when the clock starts
+# pre-expired. 7757s already exceeded a 20-minute window by 6.5x, and would
+# exceed any window an operator would accept. The anchor has to include the
+# moment the current round of review was TRIGGERED.
+#
+# WHY THIS IS NOT NEW POLICY: the push path already waits. wxa_vpn#1513, the
+# same day, slept 1162s then 441s and merged clean. This only stops the ready
+# path from skipping a wait the push path has always taken — which is why A2
+# and A4 below matter as much as A1: over-gating is how these controls get
+# switched off, and a gate that could be held shut by its own re-runs would be.
+#
+# Cases:
+#   S1. structural: the timeline anchor read paginates
+#   S2. structural: the anchor filters to ready_for_review/reopened by EVENT,
+#       not by a substring of the whole timeline
+#   A1. THE INCIDENT: old commit + old comments + RECENT ready_for_review ⇒
+#       the gate SLEEPS the remainder instead of clearing instantly
+#   A2. over-correction guard: an OLD ready_for_review does not hold the gate
+#       shut — it ages out like every other anchor (a point-in-time event, not
+#       "now"), so a later `labeled` re-run still arms without sleeping
+#   A3. `reopened` anchors too (draft→ready is not the only review trigger)
+#   A4. over-correction guard: unrelated timeline events (labeled, commented,
+#       assigned, merged) anchor NOTHING — pr-classify labels every PR seconds
+#       after it opens, and anchoring on that would hold every arm for a full
+#       window on every run
+#   A5. an unreadable timeline fails CLOSED (an unreadable anchor is not an
+#       absent one — same posture as the three sibling reads)
+#   A6. a PR with no ready/reopen event behaves exactly as before the fix
+#       (empty c4 must not poison the anchor set)
+#
+# Run from the repo root:
+#   bash selftest/test_automerge_quiet_anchor.sh
+set -euo pipefail
+
+WF=.github/workflows/claude-author-automerge.yml
+failed=0
+T=$(mktemp -d)
+trap 'rm -rf "$T"' EXIT
+
+# ---------------------------------------------------------------------------
+# Extract the gate's run block — the shipped bash, not a mirrored copy.
+# ---------------------------------------------------------------------------
+awk '
+  /^      - name: Quiet period \+ unaddressed findings$/ { in_step=1 }
+  in_step && /^        run: \|/ { in_run=1; next }
+  in_run {
+    if ($0 ~ /^          / || $0 == "") { sub(/^          /, ""); print }
+    else { exit }
+  }
+' "$WF" > "$T/qf.sh"
+
+if ! grep -q 'QUIET_MINUTES' "$T/qf.sh" || ! grep -q 'read_anchor' "$T/qf.sh"; then
+  echo "✗ could not extract the quiet/findings run block from $WF"
+  exit 1
+fi
+echo "✓ extracted quiet/findings step ($(wc -l < "$T/qf.sh" | tr -d ' ') lines)"
+
+# ---------------------------------------------------------------------------
+# S1. The timeline read paginates.
+#
+# A PR that has been readied, converted back to draft and readied again — or
+# simply one with a long timeline — pushes the ready event past page 1. An
+# unpaginated read would silently restore the exact defect this file exists to
+# pin, and would do it only on the busiest PRs.
+# ---------------------------------------------------------------------------
+# shellcheck disable=SC2016  # `${PR}` is the literal text being searched for in
+# the EXTRACTED workflow shell, not an expansion this test wants performed.
+if grep -F 'issues/${PR}/timeline?per_page=100' "$T/qf.sh" | grep -q -- '--paginate'; then
+  echo "✓ S1 timeline anchor read paginates"
+else
+  echo "✗ S1 timeline anchor read does not paginate — a ready event past page 1 anchors nothing"
+  failed=1
+fi
+
+# S2. Filtered by EVENT equality, not by a substring of the payload. A
+# `test("ready_for_review")` over the whole timeline would match any comment
+# quoting the phrase, and the anchor would then be steered by prose.
+if grep -q '\.event == "ready_for_review"' "$T/qf.sh" && grep -q '\.event == "reopened"' "$T/qf.sh"; then
+  echo "✓ S2 anchor selects on .event equality for both review triggers"
+else
+  echo "✗ S2 anchor does not select .event == ready_for_review / reopened"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# Stub environment — same shape as test_automerge_findings_gate.sh.
+#
+# Fake clock: NOW lives in $T_NOW; `date -u +%s` reads it, `sleep N` advances it
+# by N and logs the call. Fixture timestamps:
+#   OLD    2026-01-01T00:00:00Z -> 1000000   (age 7000s at NOW=1007000: quiet)
+#   YOUNG  2026-01-01T02:00:00Z -> 1006800   (age  200s at NOW=1007000: not)
+# ---------------------------------------------------------------------------
+mkdir -p "$T/bin"
+
+cat > "$T/bin/date" <<'EOF'
+#!/usr/bin/env bash
+if [ "$1" = "-u" ] && [ "$2" = "+%s" ]; then cat "$T_NOW"; exit 0; fi
+if [ "$1" = "-u" ] && [ "$2" = "-d" ]; then
+  case "$3" in
+    2026-01-01T00:00:00Z) echo 1000000 ;;
+    2026-01-01T02:00:00Z) echo 1006800 ;;
+    *) echo "date-stub: unmapped timestamp '$3'" >&2; exit 1 ;;
+  esac
+  exit 0
+fi
+echo "date-stub: unexpected args: $*" >&2; exit 1
+EOF
+
+cat > "$T/bin/sleep" <<'EOF'
+#!/usr/bin/env bash
+echo "$1" >> "$T_DIR/sleep.log"
+n=$(cat "$T_NOW"); echo $(( n + ${1%.*} )) > "$T_NOW"
+exit 0
+EOF
+
+# gh stub: dispatches on call shape, logs every call. `timeline` is matched
+# BEFORE the generic issues-comments arm; neither string contains the other, so
+# the order is belt-and-braces rather than load-bearing.
+cat > "$T/bin/gh" <<'EOF'
+#!/usr/bin/env bash
+echo "$*" >> "$T_DIR/gh.log"
+case "$*" in
+  *pulls/*/commits*)
+    cat "$T_DIR/commits.json"; exit 0 ;;
+  *pulls/*/comments*)
+    cat "$T_DIR/inline.json"; exit 0 ;;
+  *issues/*/timeline*)
+    [ -f "$T_DIR/fail_timeline" ] && exit 1
+    cat "$T_DIR/timeline.json"; exit 0 ;;
+  *contents/.github/scripts/unaddressed-findings.sh*)
+    base64 < "$T_DIR/checker_stub.sh"; exit 0 ;;
+  *issues/*/comments*--jq*)
+    exit 0 ;;
+  *issues/*/comments*)
+    cat "$T_DIR/issue.json"; exit 0 ;;
+  "pr merge --disable-auto"*)
+    echo "disable-auto" >> "$T_DIR/calls.log"; exit 0 ;;
+  "pr view"*)
+    echo "OFF"; exit 0 ;;
+  "pr comment"*)
+    echo "comment-posted" >> "$T_DIR/calls.log"; exit 0 ;;
+  "api -X PATCH"*)
+    echo "comment-patched" >> "$T_DIR/calls.log"; exit 0 ;;
+  *)
+    echo "gh-stub: unmatched: $*" >&2; exit 1 ;;
+esac
+EOF
+chmod +x "$T/bin/date" "$T/bin/sleep" "$T/bin/gh"
+
+OLD_COMMITS='[{"parents":[{"sha":"x"}],"commit":{"committer":{"date":"2026-01-01T00:00:00Z"}}}]'
+
+new_case() {
+  CASE=$(mktemp -d "$T/case.XXXXXX")
+  cat > "$CASE/checker_stub.sh" <<'EOF'
+#!/usr/bin/env bash
+echo "stub findings report line"
+exit "$(cat "$T_DIR/checker_rc")"
+EOF
+  echo 1007000 > "$CASE/now"
+  : > "$CASE/gh.log"; : > "$CASE/sleep.log"; : > "$CASE/calls.log"; : > "$CASE/output"
+  printf '%s' "$OLD_COMMITS" > "$CASE/commits.json"
+  echo '[]' > "$CASE/inline.json"
+  echo '[]' > "$CASE/issue.json"
+  echo '[]' > "$CASE/timeline.json"
+  echo 0 > "$CASE/checker_rc"
+}
+exec_gate() {
+  set +e
+  PATH="$T/bin:$PATH" T_DIR="$CASE" T_NOW="$CASE/now" \
+    GITHUB_OUTPUT="$CASE/output" GITHUB_REPOSITORY="o/r" \
+    PR=1 PR_URL="https://example.invalid/pr/1" QUIET_MINUTES="$1" \
+    bash "$T/qf.sh" > "$CASE/stdout" 2>&1
+  RC=$?
+  set -e
+}
+timeline_with() {  # $1 = event name, $2 = created_at
+  jq -n --arg e "$1" --arg t "$2" '[{event:$e, created_at:$t}]' > "$CASE/timeline.json"
+}
+
+# ---------------------------------------------------------------------------
+# A1. THE INCIDENT. Everything the old anchor set could see is 7000s old; the
+# PR was readied 200s ago. Pre-fix this cleared the 1200s window without a
+# single sleep and armed over a review that had not started. Post-fix the ready
+# event IS the anchor, so the gate sleeps the 1000s remainder — which is what
+# gives the review lanes room to post before the detector reads the thread.
+# ---------------------------------------------------------------------------
+new_case
+timeline_with ready_for_review 2026-01-01T02:00:00Z
+exec_gate 20
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && grep -q '^1000$' "$CASE/sleep.log"; then
+  echo "✓ A1 a recent ready_for_review anchors the clock: slept the 1000s remainder before consulting the detector"
+else
+  echo "✗ A1 ready_for_review did not anchor the quiet clock — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")] output=[$(tr '\n' ' ' < "$CASE/output")]"
+  echo "     this is wxa_vpn#1512: the gate arms in the same instant the review lanes are triggered"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# A2. OVER-CORRECTION GUARD, and the one that keeps this fix shippable. The
+# anchor is a point-in-time event timestamp, not "now". A `labeled` re-run an
+# hour after the ready must therefore see it age out like any other anchor and
+# arm without sleeping. Anchoring on "this PR was ever readied" instead would
+# hold every subsequent run for a full window, and a gate that never opens gets
+# set to findings_quiet_minutes=0 — at which point it protects nothing.
+# ---------------------------------------------------------------------------
+new_case
+timeline_with ready_for_review 2026-01-01T00:00:00Z
+exec_gate 20
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && [ ! -s "$CASE/sleep.log" ]; then
+  echo "✓ A2 an aged-out ready_for_review does not hold the gate shut (armed without sleeping)"
+else
+  echo "✗ A2 an OLD ready_for_review still delayed the arm — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")] output=[$(tr '\n' ' ' < "$CASE/output")]"
+  echo "     the anchor must be the event's timestamp, never a boolean 'was readied'"
+  failed=1
+fi
+
+# A3. `reopened` re-fires the review lanes on the same `types:` list, so it is a
+# review trigger too and must anchor identically.
+new_case
+timeline_with reopened 2026-01-01T02:00:00Z
+exec_gate 20
+if [ "$RC" -eq 0 ] && grep -q '^1000$' "$CASE/sleep.log"; then
+  echo "✓ A3 a recent reopened anchors the clock the same way"
+else
+  echo "✗ A3 reopened did not anchor — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# A4. OVER-CORRECTION GUARD. Only the two review triggers anchor. `labeled` is
+# the sharpest of these: pr-classify labels every PR within seconds of opening
+# and this workflow re-runs on `labeled`, so anchoring on it would make every
+# arm wait a full window behind a label the gate itself provoked. The others are
+# ordinary timeline noise that must stay invisible to the clock.
+# ---------------------------------------------------------------------------
+for ev in labeled commented assigned merged review_requested head_ref_force_pushed; do
+  new_case
+  timeline_with "$ev" 2026-01-01T02:00:00Z
+  exec_gate 20
+  if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && [ ! -s "$CASE/sleep.log" ]; then
+    echo "✓ A4 '$ev' does not anchor the quiet clock"
+  else
+    echo "✗ A4 '$ev' anchored the quiet clock — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+    echo "     only ready_for_review/reopened trigger a review round; anything else stalls every arm"
+    failed=1
+  fi
+done
+
+# ---------------------------------------------------------------------------
+# A5. Fail CLOSED. "Could not read the timeline" and "the PR was never readied"
+# are the same empty value to every caller downstream, and only the second
+# justifies arming. The three sibling anchor reads already return 1 on failure;
+# this one must too, or the fix quietly reverts to the pre-fix anchor set on any
+# API blip — the failure mode being least visible exactly when the API is worst.
+# ---------------------------------------------------------------------------
+new_case
+touch "$CASE/fail_timeline"
+exec_gate 20
+if [ "$RC" -ne 0 ]; then
+  echo "✓ A5 an unreadable timeline fails closed (no anchor, no arm)"
+else
+  echo "✗ A5 timeline read failing 3x produced rc=0 — an unreadable anchor read as an absent one"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# A6. A PR opened non-draft and never reopened has no such event. `max // empty`
+# yields nothing, the empty line is stripped, and the anchor set is exactly what
+# it was before the fix. Pins that the added read cannot poison the common case.
+# ---------------------------------------------------------------------------
+new_case
+echo '[]' > "$CASE/timeline.json"
+exec_gate 20
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && grep -q '^reason=quiet+clean$' "$CASE/output" \
+   && [ ! -s "$CASE/sleep.log" ]; then
+  echo "✓ A6 no ready/reopen event leaves the pre-fix anchor set intact"
+else
+  echo "✗ A6 an empty timeline changed the outcome — rc=$RC output=[$(tr '\n' ' ' < "$CASE/output")] sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+  failed=1
+fi
+
+echo
+if [ "$failed" -eq 0 ]; then
+  echo "PASS — quiet-period review-trigger anchor"
+else
+  echo "FAIL — quiet-period review-trigger anchor"
+fi
+exit "$failed"

From 4463bce274a54af2fd3d637e55e56df9e3dc077a Mon Sep 17 00:00:00 2001
From: topcoder1 <topcoder1@gmail.com>
Date: Fri, 14 Aug 2026 16:54:53 -0700
Subject: [PATCH 2/4] fix(selftest): CI-wire test_automerge_quiet_anchor.sh +
 guard the wrapper list's completeness
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_workflow_guards.py runs the .sh selftests under pytest via an explicit
parametrize list — "what makes them CI-enforced rather than run-manually-only
documentation", per its own docstring. This PR's test_automerge_quiet_anchor.sh
was not in that list: it passed 14/14 on the workstation and ran in CI never,
which is the exact silently-unenforced shape the gate it tests exists to close.

Listing it fixes the instance. The new test_every_shell_selftest_is_listed
fixes the class: every selftest/test_*.sh on disk must be in the list or in
_UNLISTED_OK (named exemptions with reasons; currently only
test_bb_automerge_risk_patterns.sh, which needs a workstation checkout). Stale
exemptions fail too.

The guard bit on its first execution: test_claude_review_max_turns_type.sh
(#152) and test_ruff_format_gate.sh (#160) both shipped unlisted and have never
run in CI. Both pass today; both are now listed. Mutation-proven the other way
with a stray selftest/test_stray_zz.sh (fails naming it), then removed.

45 tests pass (was 42 — the three newly-wired selftests now run).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 selftest/test_workflow_guards.py | 89 +++++++++++++++++++++++---------
 1 file changed, 65 insertions(+), 24 deletions(-)

diff --git a/selftest/test_workflow_guards.py b/selftest/test_workflow_guards.py
index 0f4f826..80f0af3 100644
--- a/selftest/test_workflow_guards.py
+++ b/selftest/test_workflow_guards.py
@@ -18,30 +18,36 @@
 # test_bb_automerge_risk_patterns.sh is deliberately absent: it resolves
 # bb-automerge.py from the local ~/.claude/templates checkout and imports
 # `requests`, neither of which exists on this repo's CI runner. Run it
-# manually on a workstation.
-@pytest.mark.parametrize(
-    "script",
-    [
-        "selftest/test_automerge_base_gate.sh",
-        "selftest/test_automerge_findings_gate.sh",
-        "selftest/test_automerge_hold_gate.sh",
-        "selftest/test_automerge_risk_patterns.sh",
-        "selftest/test_automerge_riskfile_gate.sh",
-        "selftest/test_bot_skip_commit_authorship.sh",
-        "selftest/test_classify_bracket_guard.sh",
-        "selftest/test_classify_env_globs.sh",
-        "selftest/test_classify_exclude.sh",
-        "selftest/test_classify_list_shape.sh",
-        "selftest/test_classify_nocase.sh",
-        "selftest/test_codex_verdict_gate.sh",
-        "selftest/test_pr_files_listing.sh",
-        "selftest/test_prettier_scope_failsafe.sh",
-        "selftest/test_prettier_symlink_filter.sh",
-        "selftest/test_ruff_ruleset_warning.sh",
-        "selftest/test_safe_paths_risk_tier_hold.sh",
-        "selftest/test_safe_paths_unsafe_overrides.sh",
-    ],
-)
+# manually on a workstation. (Its absence is a named exemption in
+# _UNLISTED_OK below, which is what keeps this list honest.)
+_SHELL_SELFTESTS = [
+    "selftest/test_automerge_base_gate.sh",
+    "selftest/test_automerge_findings_gate.sh",
+    "selftest/test_automerge_hold_gate.sh",
+    "selftest/test_automerge_quiet_anchor.sh",
+    "selftest/test_automerge_risk_patterns.sh",
+    "selftest/test_automerge_riskfile_gate.sh",
+    "selftest/test_bot_skip_commit_authorship.sh",
+    "selftest/test_classify_bracket_guard.sh",
+    "selftest/test_classify_env_globs.sh",
+    "selftest/test_classify_exclude.sh",
+    "selftest/test_classify_list_shape.sh",
+    "selftest/test_classify_nocase.sh",
+    # These two shipped unlisted (#152 and #160) and ran in CI never —
+    # the completeness guard below found both on its first execution.
+    "selftest/test_claude_review_max_turns_type.sh",
+    "selftest/test_codex_verdict_gate.sh",
+    "selftest/test_pr_files_listing.sh",
+    "selftest/test_prettier_scope_failsafe.sh",
+    "selftest/test_prettier_symlink_filter.sh",
+    "selftest/test_ruff_format_gate.sh",
+    "selftest/test_ruff_ruleset_warning.sh",
+    "selftest/test_safe_paths_risk_tier_hold.sh",
+    "selftest/test_safe_paths_unsafe_overrides.sh",
+]
+
+
+@pytest.mark.parametrize("script", _SHELL_SELFTESTS)
 def test_shell_selftest(script):
     proc = subprocess.run(
         ["bash", script], cwd=REPO_ROOT, capture_output=True, text=True
@@ -49,6 +55,41 @@ def test_shell_selftest(script):
     assert proc.returncode == 0, f"{script} failed:\n{proc.stdout}\n{proc.stderr}"
 
 
+# A selftest that exists on disk but is missing from the parametrize list
+# above passes locally forever and runs in CI never — the "CI-enforced
+# rather than run-manually-only documentation" claim in this module's
+# docstring quietly stops being true, one file at a time. That is not
+# hypothetical: test_automerge_quiet_anchor.sh shipped in this very PR,
+# passed 14/14 on the workstation, and was invisible to the Tests (Python)
+# job until this guard's companion list entry was added.
+#
+# Exemptions are named, with the reason a reader needs: an entry here is a
+# decision, never a leftover.
+_UNLISTED_OK = {
+    # Resolves bb-automerge.py from the local ~/.claude/templates checkout
+    # and imports `requests`; neither exists on this repo's CI runner.
+    "selftest/test_bb_automerge_risk_patterns.sh",
+}
+
+
+def test_every_shell_selftest_is_listed():
+    on_disk = {
+        f"selftest/{p.name}"
+        for p in (REPO_ROOT / "selftest").glob("test_*.sh")
+    }
+    listed = set(_SHELL_SELFTESTS) | _UNLISTED_OK
+    unlisted = sorted(on_disk - listed)
+    assert not unlisted, (
+        "selftest .sh file(s) exist but are not run by CI — add them to the "
+        f"parametrize list (or _UNLISTED_OK, with a reason): {unlisted}"
+    )
+    # The inverse direction: a listed file that no longer exists fails the
+    # parametrized run itself with a bash error, so only the stale-exemption
+    # half needs pinning here.
+    stale_exempt = sorted(e for e in _UNLISTED_OK if not (REPO_ROOT / e).exists())
+    assert not stale_exempt, f"_UNLISTED_OK entries no longer on disk: {stale_exempt}"
+
+
 def test_codex_verdict_gate_is_wired_and_opt_in():
     """codex-review.yml must enforce Codex's verdict only when asked to.
 

From 440d61edb7c0f929a8f39cbc4210d6df98f4c8f3 Mon Sep 17 00:00:00 2001
From: topcoder1 <topcoder1@gmail.com>
Date: Fri, 14 Aug 2026 19:27:55 -0700
Subject: [PATCH 3/4] =?UTF-8?q?fix(automerge):=20round-2=20review=20fixes?=
 =?UTF-8?q?=20=E2=80=94=20anchor=20the=20`opened`=20trigger=20(c5);=20hois?=
 =?UTF-8?q?t=20immutable=20reads;=20test=20tightening?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Five findings from #161's Claude Review, all addressed:

1. THE REAL ONE: `opened` is in the same review-lane `types:` list, so a
   branch whose commits idled before the PR was opened NON-draft arrives
   with c1 pre-aged and armed at the instant the reviews started —
   wxa_vpn#1512's hole through a different door, which c4 (ready/reopen
   events) cannot see because a never-drafted PR has neither event. c5 is
   the PR's own creation time, taken from the event payload (zero API
   reads; immutable, so a later labeled re-run sees it aged out). A7 pins
   the door (mutation: dropping c5 from the anchor set fails A7 with
   `sleeps=[] clear=1` — the incident shape); A8 pins that an aged-out
   creation cannot hold the gate shut; S3 pins the env binding, because the
   run block is ${{ }}-free and an unbound var is an empty c5 forever.

2. Immutable anchors hoisted out of the wait loop: c4/c5 cannot change
   while the run sleeps (a fresh ready_for_review event's own run replaces
   this one via the callers' cancel-in-progress groups), so the timeline is
   read once instead of per wake — on a long timeline --paginate cost
   multiplied per iteration. Each pre-loop read fails closed with its own
   named error.

3. The in-loop anchor error no longer says "commits/comments" while the
   timeline read lives elsewhere — each failure names exactly the reads it
   covers.

4. A3 now asserts clear=1 like A1 — it previously passed a gate that slept
   correctly and then failed to arm.

5. The date stub's unmapped-timestamp error now tells a future contributor
   where to add the mapping instead of failing cryptically inside an
   arithmetic expansion.

All 17 checks pass; actionlint + shellcheck clean; sibling selftests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/claude-author-automerge.yml | 61 ++++++++++---
 selftest/test_automerge_quiet_anchor.sh       | 91 ++++++++++++++++---
 2 files changed, 124 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/claude-author-automerge.yml b/.github/workflows/claude-author-automerge.yml
index 5a361ae..160200a 100644
--- a/.github/workflows/claude-author-automerge.yml
+++ b/.github/workflows/claude-author-automerge.yml
@@ -1035,11 +1035,14 @@ jobs:
       #      is a deliberate code-level finding), the newest top-level
       #      [bot] comment that is not this workflow's own marker comment
       #      or pr-classify chatter (a gate that counts its own sticky
-      #      comment as review activity never opens), and the newest
-      #      `ready_for_review`/`reopened` event — the trigger that STARTS
-      #      a round of review, without which the clock is pre-expired on
-      #      exactly the event that begins one (wxa_vpn#1512; see c4 in
-      #      read_anchor for the measurement). Sleeping here is
+      #      comment as review activity never opens), the newest
+      #      `ready_for_review`/`reopened` event, and the PR's own creation
+      #      time — the triggers that START a round of review, without
+      #      which the clock is pre-expired on exactly the events that
+      #      begin one (wxa_vpn#1512; see c4/c5 above read_anchor for the
+      #      measurement — `opened` is in the same `types:` list, so a
+      #      branch whose commits idled before the PR was opened non-draft
+      #      is the same hole through a different door). Sleeping here is
       #      safe: callers run concurrency cancel-in-progress per PR, so a
       #      new push replaces this run and restarts the clock, and the
       #      arm below binds --match-head-commit so a moved head can never
@@ -1084,6 +1087,10 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
           PR_URL: ${{ github.event.pull_request.html_url }}
           QUIET_MINUTES: ${{ inputs.findings_quiet_minutes }}
+          # The c5 anchor (see read_anchor). From the event payload rather
+          # than an API read; immutable, so a later labeled/synchronize
+          # re-run sees the same fixed value aged out.
+          PR_CREATED_AT: ${{ github.event.pull_request.created_at }}
         run: |
           set -euo pipefail
           retry() { local i out; for i in 1 2 3; do if out=$("$@"); then printf '%s' "$out"; return 0; fi; [ "$i" -lt 3 ] && sleep $((i * 5)); done; return 1; }
@@ -1136,15 +1143,45 @@ jobs:
           # These are POINT-IN-TIME event timestamps, not "now", so a later
           # `labeled` run re-reads the same fixed value and sees it age out
           # normally — the gate cannot be held shut by its own re-runs. A
-          # PR opened non-draft and never reopened has no such event, `max`
-          # yields empty, and the anchor set is exactly what it is today.
+          # PR opened non-draft and never reopened contributes no c4; its
+          # `opened` trigger is anchored by c5 (creation time) below.
           #
           # Fail-closed like every sibling read: `issues/{n}/timeline` is
           # already load-bearing in this job (the detector fetched below
           # reads issues/{n}/comments fatally), so an unreadable timeline
           # is an unreadable anchor, not an absent one.
+          #
+          # c4 and c5 are IMMUTABLE, so they are resolved ONCE, outside the
+          # wait loop — historical timeline events and the PR's creation
+          # time cannot change while this run sleeps, and a long timeline
+          # costs --paginate round-trips on every wake if read in-loop. The
+          # one way a NEW review trigger can appear mid-sleep is a fresh
+          # ready_for_review event, and that event's own run replaces this
+          # one via the callers' cancel-in-progress concurrency groups, so
+          # nothing is missed by not re-reading.
+          #
+          # c5 — the PR's creation time — anchors the `opened` trigger:
+          # it is in the same review-lane `types:` list as ready_for_review,
+          # so a branch whose commits idled before the PR was opened
+          # NON-draft arrives with c1 pre-aged and would otherwise arm at
+          # the instant the reviews start — wxa_vpn#1512's hole through a
+          # different door. It comes from the event payload (no API read);
+          # an empty value (defensive — every pull_request payload carries
+          # created_at) simply contributes no anchor.
+          timeline=$(retry gh api "repos/${GITHUB_REPOSITORY}/issues/${PR}/timeline?per_page=100" --paginate) || {
+            echo "::error::could not read the PR timeline (the ready/reopen anchor) after retries — refusing to arm auto-merge (fail closed)."
+            exit 1
+          }
+          c4=$(printf '%s' "$timeline" | jq -rs '[(add // [])[]
+                | select(.event == "ready_for_review" or .event == "reopened")
+                | .created_at] | max // empty') || {
+            echo "::error::could not parse the PR timeline — refusing to arm auto-merge (fail closed)."
+            exit 1
+          }
+          c5="${PR_CREATED_AT:-}"
+
           read_anchor() {
-            local commits inline issue timeline c1 c2 c3 c4
+            local commits inline issue c1 c2 c3
             commits=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}/commits?per_page=100" --paginate) || return 1
             c1=$(printf '%s' "$commits" | jq -rs '[(add // [])[] | select((.parents | length) < 2) | .commit.committer.date] | max // empty') || return 1
             inline=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}/comments?per_page=100" --paginate) || return 1
@@ -1154,18 +1191,14 @@ jobs:
                   | select(((.user.login // "") | endswith("[bot]")))
                   | select(((.body // "") | test("<!-- (claude-author-automerge|pr-classify)")) | not)
                   | .created_at] | max // empty') || return 1
-            timeline=$(retry gh api "repos/${GITHUB_REPOSITORY}/issues/${PR}/timeline?per_page=100" --paginate) || return 1
-            c4=$(printf '%s' "$timeline" | jq -rs '[(add // [])[]
-                  | select(.event == "ready_for_review" or .event == "reopened")
-                  | .created_at] | max // empty') || return 1
-            printf '%s\n%s\n%s\n%s\n' "$c1" "$c2" "$c3" "$c4" | grep -v '^$' | sort | tail -1
+            printf '%s\n%s\n%s\n%s\n%s\n' "$c1" "$c2" "$c3" "$c4" "$c5" | grep -v '^$' | sort | tail -1
           }
 
           waited=0
           cap=$(( QUIET_S * 3 ))
           while :; do
             anchor=$(read_anchor) || {
-              echo "::error::could not read the quiet-period anchors (commits/comments) after retries — refusing to arm auto-merge (fail closed)."
+              echo "::error::could not read the quiet-period anchors (commits/inline/issue comments) after retries — refusing to arm auto-merge (fail closed)."
               exit 1
             }
             # SHAPE, not just emptiness — an error body that leaks through
diff --git a/selftest/test_automerge_quiet_anchor.sh b/selftest/test_automerge_quiet_anchor.sh
index 23228b1..24e10ca 100755
--- a/selftest/test_automerge_quiet_anchor.sh
+++ b/selftest/test_automerge_quiet_anchor.sh
@@ -57,8 +57,18 @@
 #       window on every run
 #   A5. an unreadable timeline fails CLOSED (an unreadable anchor is not an
 #       absent one — same posture as the three sibling reads)
-#   A6. a PR with no ready/reopen event behaves exactly as before the fix
-#       (empty c4 must not poison the anchor set)
+#   A6. a PR with no ready/reopen event and an aged-out creation behaves
+#       exactly as before the fix (empty c4 must not poison the anchor set)
+#   A7. THE `opened` DOOR (review round 2): a recently-CREATED PR with old
+#       commits and no ready event sleeps the remainder — `opened` is in
+#       the same review-lane `types:` list, so a branch whose commits idled
+#       before the PR was opened non-draft is #1512 through a different
+#       door; c5 (creation time, from the event payload) anchors it
+#   A8. over-correction guard for c5: an aged-out creation time does not
+#       hold the gate shut (same point-in-time rule as A2)
+#   S3. structural: PR_CREATED_AT is bound from the event payload in the
+#       step's env block — c5 reads an env var, and an unbound var is an
+#       empty c5 forever, silently reverting A7 to the pre-fix behavior
 #
 # Run from the repo root:
 #   bash selftest/test_automerge_quiet_anchor.sh
@@ -114,6 +124,20 @@ else
   failed=1
 fi
 
+# S3. The c5 anchor reads $PR_CREATED_AT, and the run block is deliberately
+# ${{ }}-free — so the binding lives in the step's env block, and dropping
+# it there leaves c5 empty on every run: A7 silently reverts to pre-fix
+# behavior with nothing red. Pin the binding in the WORKFLOW, not the
+# extracted shell.
+# shellcheck disable=SC2016  # the ${{ }} is the literal workflow-expression
+# text being searched for, not a shell expansion this test wants performed.
+if grep -q 'PR_CREATED_AT: ${{ github.event.pull_request.created_at }}' "$WF"; then
+  echo "✓ S3 PR_CREATED_AT is bound from the event payload in the step env"
+else
+  echo "✗ S3 PR_CREATED_AT env binding missing — c5 is empty forever and the opened trigger is unanchored"
+  failed=1
+fi
+
 # ---------------------------------------------------------------------------
 # Stub environment — same shape as test_automerge_findings_gate.sh.
 #
@@ -131,7 +155,7 @@ if [ "$1" = "-u" ] && [ "$2" = "-d" ]; then
   case "$3" in
     2026-01-01T00:00:00Z) echo 1000000 ;;
     2026-01-01T02:00:00Z) echo 1006800 ;;
-    *) echo "date-stub: unmapped timestamp '$3'" >&2; exit 1 ;;
+    *) echo "date-stub: unmapped timestamp '$3' — new fixture timestamps must be added to the case map in this stub (see the fake-clock note above the stub in this file)" >&2; exit 1 ;;
   esac
   exit 0
 fi
@@ -196,11 +220,12 @@ EOF
   echo '[]' > "$CASE/timeline.json"
   echo 0 > "$CASE/checker_rc"
 }
-exec_gate() {
+exec_gate() {  # $1 = quiet minutes, $2 = PR_CREATED_AT (optional; empty = unset-like)
   set +e
   PATH="$T/bin:$PATH" T_DIR="$CASE" T_NOW="$CASE/now" \
     GITHUB_OUTPUT="$CASE/output" GITHUB_REPOSITORY="o/r" \
     PR=1 PR_URL="https://example.invalid/pr/1" QUIET_MINUTES="$1" \
+    PR_CREATED_AT="${2:-}" \
     bash "$T/qf.sh" > "$CASE/stdout" 2>&1
   RC=$?
   set -e
@@ -247,14 +272,16 @@ else
 fi
 
 # A3. `reopened` re-fires the review lanes on the same `types:` list, so it is a
-# review trigger too and must anchor identically.
+# review trigger too and must anchor identically — including the arm at the
+# end: asserting only the sleep would pass a gate that waited correctly and
+# then failed to write clear=1 (review round 2's catch on this very case).
 new_case
 timeline_with reopened 2026-01-01T02:00:00Z
 exec_gate 20
-if [ "$RC" -eq 0 ] && grep -q '^1000$' "$CASE/sleep.log"; then
-  echo "✓ A3 a recent reopened anchors the clock the same way"
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && grep -q '^1000$' "$CASE/sleep.log"; then
+  echo "✓ A3 a recent reopened anchors the clock the same way (and still arms)"
 else
-  echo "✗ A3 reopened did not anchor — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+  echo "✗ A3 reopened did not anchor+arm — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")] output=[$(tr '\n' ' ' < "$CASE/output")]"
   failed=1
 fi
 
@@ -296,18 +323,54 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# A6. A PR opened non-draft and never reopened has no such event. `max // empty`
-# yields nothing, the empty line is stripped, and the anchor set is exactly what
-# it was before the fix. Pins that the added read cannot poison the common case.
+# A6. A PR with no ready/reopen event and an AGED-OUT creation time. `max //
+# empty` yields no c4, c5 has aged out, the empty line is stripped, and the
+# anchor set decides exactly as before the fix. Pins that the added reads
+# cannot poison the common case (a mature PR's labeled/synchronize re-runs).
 # ---------------------------------------------------------------------------
 new_case
 echo '[]' > "$CASE/timeline.json"
-exec_gate 20
+exec_gate 20 2026-01-01T00:00:00Z
 if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && grep -q '^reason=quiet+clean$' "$CASE/output" \
    && [ ! -s "$CASE/sleep.log" ]; then
-  echo "✓ A6 no ready/reopen event leaves the pre-fix anchor set intact"
+  echo "✓ A6 no ready/reopen event + aged-out creation leaves the pre-fix decision intact"
+else
+  echo "✗ A6 the added anchors changed the outcome — rc=$RC output=[$(tr '\n' ' ' < "$CASE/output")] sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# A7. THE `opened` DOOR (review round 2, the incomplete-fix finding). Commits
+# idle since T0; the PR is CREATED non-draft at T1 = now-200s; no ready or
+# reopen event exists because the PR was never a draft. `opened` fires the
+# review lanes and this gate in the same instant — without c5 the gate reads
+# only pre-aged anchors and arms immediately, #1512 through a different door.
+# With c5 the creation time IS the anchor: sleep the 1000s remainder.
+# ---------------------------------------------------------------------------
+new_case
+echo '[]' > "$CASE/timeline.json"
+exec_gate 20 2026-01-01T02:00:00Z
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && grep -q '^1000$' "$CASE/sleep.log"; then
+  echo "✓ A7 a recently-created PR (opened trigger) anchors on creation: slept the 1000s remainder"
+else
+  echo "✗ A7 the opened door is unanchored — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")] output=[$(tr '\n' ' ' < "$CASE/output")]"
+  echo "     commits idled before a non-draft open ⇒ the gate arms as the review lanes start"
+  failed=1
+fi
+
+# ---------------------------------------------------------------------------
+# A8. Over-correction guard for c5, same rule as A2: creation time is a
+# point-in-time value, so once it ages out it must not delay any later run.
+# (A6 already covers this composed with an empty timeline; this pins it with
+# a ready event present, so the two immutable anchors age out independently.)
+# ---------------------------------------------------------------------------
+new_case
+timeline_with ready_for_review 2026-01-01T00:00:00Z
+exec_gate 20 2026-01-01T00:00:00Z
+if [ "$RC" -eq 0 ] && grep -q '^clear=1$' "$CASE/output" && [ ! -s "$CASE/sleep.log" ]; then
+  echo "✓ A8 aged-out creation + aged-out ready event do not hold the gate shut"
 else
-  echo "✗ A6 an empty timeline changed the outcome — rc=$RC output=[$(tr '\n' ' ' < "$CASE/output")] sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
+  echo "✗ A8 an old creation time still delayed the arm — rc=$RC sleeps=[$(tr '\n' ' ' < "$CASE/sleep.log")]"
   failed=1
 fi
 

From c232c68ebb1b8d7c01e81586e86235faf08720fd Mon Sep 17 00:00:00 2001
From: topcoder1 <topcoder1@gmail.com>
Date: Fri, 14 Aug 2026 20:21:23 -0700
Subject: [PATCH 4/4] =?UTF-8?q?test+docs:=20pin=20ambient=20PR=5FCREATED?=
 =?UTF-8?q?=5FAT=20out=20of=20findings=5Fgate's=20harness;=20name=20the=20?=
 =?UTF-8?q?undatable-event=20boundary=20=E2=80=94=20round-2=20advisories?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sibling harness inherits ambient env: a developer shell exporting
PR_CREATED_AT would activate c5 in tests that assert zero sleeps. Pinned
empty (proven by running the suite WITH a hostile ambient value exported).
And the fail-closed comment now says what it covers — readability
(fetch+parse) — and that a readable event with created_at:null is
UNDATABLE and contributes no anchor: c4 carries a timestamp, not an
existence claim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/claude-author-automerge.yml | 8 +++++++-
 selftest/test_automerge_findings_gate.sh      | 5 +++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/claude-author-automerge.yml b/.github/workflows/claude-author-automerge.yml
index 160200a..3899f93 100644
--- a/.github/workflows/claude-author-automerge.yml
+++ b/.github/workflows/claude-author-automerge.yml
@@ -1149,7 +1149,13 @@ jobs:
           # Fail-closed like every sibling read: `issues/{n}/timeline` is
           # already load-bearing in this job (the detector fetched below
           # reads issues/{n}/comments fatally), so an unreadable timeline
-          # is an unreadable anchor, not an absent one.
+          # is an unreadable anchor, not an absent one. What fail-closed
+          # covers is READABILITY — the fetch and the parse. A matching
+          # event that carries `created_at: null` (never observed from the
+          # API) is readable but UNDATABLE, and an undatable event simply
+          # contributes no anchor: c4 carries a timestamp, not an
+          # existence claim, and a clock cannot be anchored to an event
+          # with no time.
           #
           # c4 and c5 are IMMUTABLE, so they are resolved ONCE, outside the
           # wait loop — historical timeline events and the PR's creation
diff --git a/selftest/test_automerge_findings_gate.sh b/selftest/test_automerge_findings_gate.sh
index 7bbca43..7a0530d 100644
--- a/selftest/test_automerge_findings_gate.sh
+++ b/selftest/test_automerge_findings_gate.sh
@@ -227,9 +227,14 @@ EOF
 }
 exec_gate() {
   set +e
+  # PR_CREATED_AT pinned empty: the c5 anchor belongs to
+  # test_automerge_quiet_anchor.sh; an ambient value exported in a
+  # developer's shell would otherwise activate it here and fail the
+  # zero-sleep cases nondeterministically.
   PATH="$T/bin:$PATH" T_DIR="$CASE" T_NOW="$CASE/now" \
     GITHUB_OUTPUT="$CASE/output" GITHUB_REPOSITORY="o/r" \
     PR=1 PR_URL="https://example.invalid/pr/1" QUIET_MINUTES="$1" \
+    PR_CREATED_AT="" \
     bash "$T/qf.sh" > "$CASE/stdout" 2>&1
   RC=$?
   set -e