merge-fix

merge-fix — bounded mechanical correction on an existing PR

input.json is one SHA-pinned mechanical finding. ./repo is the repo-owned isolated worktree for the ticket. This is not a general implementation run.

1. Read the ticket and all comments. Re-read the PR head/base and required checks. Refuse if the ticket, PR identity, branch, finding hash, or base identity moved. A changed PR head is not by itself a refusal for an operational rebase: handle it with the concurrent-head protocol below so a fixer cannot be erased. Other stale evidence requires a fresh independent scan.
2. Confirm the finding is mechanical, round is 1 or 2, and no security/product/policy judgment is involved. Otherwise move the ticket to Blocked, notify when policy requires, and output BLOCKED without editing. Owned Paths bound the correction, not the rebase (WM-679):

   • format_and_lint: compute the PR file set once with git diff --name-only --diff-filter=ACMR -z origin/<base>...HEAD. Pass that NUL-delimited set, and no repository-wide path, to both fixers:

     changed=$(mktemp)
     git diff --name-only --diff-filter=ACMR -z origin/<base>...HEAD >"$changed"
     xargs -0 -r bunx prettier --write --ignore-unknown <"$changed"
     xargs -0 -r bunx eslint --fix --no-warn-ignored <"$changed"
     rm -f "$changed"
     

     Do not make judgment-based source edits under this finding. Re-run the ticket's exact Verification Command, push, and let the next independent scan establish green. This deterministic correction does not consume a max_fix_rounds round.

   • rebase_onto_base / rerun_ci_at_head: first fetch both the PR branch and base, record the fetched PR tip as expectedRemoteSha, and keep that exact value for the push lease:

     git fetch --no-tags origin \
       "+refs/heads/<headRef>:refs/remotes/origin/<headRef>" \
       "+refs/heads/<base>:refs/remotes/origin/<base>"
     expectedRemoteSha=$(git rev-parse "origin/<headRef>")
     

     Before either rebase, query check runs on that exact expectedRemoteSha (not a branch-name lookup). If Full verification is QUEUED or IN_PROGRESS, return outcome: "BLOCKED" with a summary beginning ci_in_flight: and do not edit or push. Also leave the branch alone when that check concluded SUCCESS within FACTORY_MERGE_REBASE_SKIP_FRESH_CI_MINUTES (default 60) minutes, returning a summary beginning ci_fresh:. For example, inspect the exact head with:

     gh api "repos/<github>/commits/${expectedRemoteSha}/check-runs?per_page=100"
     

     Refused merge-fix findings are retried after FACTORY_MERGE_FIX_REFUSAL_COOLDOWN_MINUTES (default 15 minutes). Refusals with reason merge_fix_ticket_escalated or merge_fix_ticket_security use the longer FACTORY_MERGE_FIX_DURABLE_REFUSAL_COOLDOWN_MINUTES (default 360 minutes) because they need a human to clear a blocker. The refusal lookup is bounded by the larger of these two cooldowns, so raising either one widens the scan window for both kinds of refusal.

     A CONFLICTING PR still needs a rebase even when CI is running or fresh. Query the live PR labels too (gh pr view <pr> --repo <github> --json labels); an ai:landing label always blocks this mechanical rebase with a summary beginning ai_landing:. Treat an unreadable check response conservatively as ci_in_flight: rather than risking an external lander's branch.

     Compare expectedRemoteSha with the pinned input.json headSha. Only when they differ, query the live PR with gh pr view <pr> --repo <github> --json headRefOid,updatedAt. Refuse with branch_moved: before editing if that live head no longer equals expectedRemoteSha. A differing fetched head proves another actor moved the branch because this run has not pushed yet; do not substitute commit author/committer metadata, which does not identify who pushed or when. Treat the PR's updatedAt as a conservative upper bound on the head-change time. If it is within MERGE_FIX_IN_FLIGHT_MINUTES (default 10), do not touch or push the branch. Return outcome: "BLOCKED" and a summary beginning branch_in_flight: instead of racing the active fixer. Treat an unknown live head or timestamp as in flight; validate the optional minute value as a positive integer before using it. Never classify the unchanged pinned head as branch_in_flight. PR activity other than a push can only make this conservative check wait longer; it cannot allow a clobber.