[melodic-automation-lanes]

Closes #9102

Summary

Opened by the work-resolve-issue lane. The run's own summary:

didNoWork in label-unblocked.mjs only matched the write runner's Request the lane token step for a failed mint, but resolve-issue calls the read runner, whose broker step is Ask the broker whether the lane may run. A broker-check failure for any reason but the kill switch, or with no reason in its log, therefore matched no no-work class. It is now classed mint-failed and re-fired under the existing failed-mint bound and clamp. A kill-switch refusal stays a breaker trip, and the MINT_STEP match is unchanged, as the recorded decision on the issue asked.

Not verified

• label-unblocked.test.mjs was not executed: this lane runs no node interpreter, and check-affected names .test.mjs suites as delegated to CI. The new and changed assertions were checked only by reading the test helpers. CI's node test job on the PR must run it.
• .github/workflows/work-unblock.yml lines 31-39, a header comment only, still list 'a rerun the token broker refused as workflow-modified' among the once-per-version failed-run re-fires. That path is patch-protected (/.github/workflows/**), and the issue's change does not need it, so it was left. A p
• No web source was read: the change cites no external fact.
• Changes are left uncommitted in the working tree per the runner's instructions (the runner turns them into a patch), not committed with a commit tool.

Fix

• .github/scripts/work-unblock/label-unblocked.mjs: didNoWork classes a resolve-issue job that failed at BROKER_STEP with no kill-switch refusal as mint-failed (minting || checked). The header comments on the failed-run and failed-mint re-fires, the breaker log paragraph and the didNoWork comment no
• .github/scripts/work-unblock/label-unblocked.test.mjs: new test 'a broker-check failure not for the kill switch is re-fired as a failed mint, under its bound', using BROKER_REFUSED with a workflow-modified log and with no readable log. It asserts a re-fire past the once-per-version mark (earlierPump
• .changes/pr-pipeline/fix-9102-broker-check-refire-4c7a2e91.md: new patch changelog fragment for the pr-pipeline convention.

Verification

The runner ran each check from the base copy against 4390df4:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• /home/runner/work/claude-code-plugins/claude-code-plugins/.lane/checks/bin/check-changelog-fragments: all 10 fragments under .changes/ valid
• /home/runner/work/claude-code-plugins/claude-code-plugins/.lane/checks/bin/check-affected: 9 passed, 5 skipped, 0 failed over 3 changed files. Its affected-tests step selects .test.mjs suites but does not run them (delegated to CI).
• fresh-context review subagent over the whole diff: no correctness bugs. It traced every existing BROKER_REFUSED test and the new test through restartRefusal (NOW 10-16 12:00, reset-clamp-min 1, limit-stops-per-issue 3) and found they hold. It reported stale comments in label-unblocked.test.mjs (fixe
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40441486669

Left out: the items under Not verified.

Related

#9102

[github-actions]

claude-security-review reviewed 4390df4fa96773f55e9c7e45e94c2c52a6c09894: 0 finding(s), 0 as inline comments.

No security issues found in this change.

critical-findings: 0

I read the whole diff (a changelog fragment, label-unblocked.mjs and its test) and didNoWork in full. No changed file matches a trusted path or a manifest, and none of them is a trust control.

• Change: didNoWork (.github/scripts/work-unblock/label-unblocked.mjs:823) now classes a resolve-issue run that failed at BROKER_STEP as mint-failed. That covers a refusal for a reason other than the kill switch, and a run whose log is unreadable. Such a run is re-fired under the existing failed-mint bound (limits.limit-stops-per-issue per workflow version, then the backoff) and the limits.reset-clamp-min wait.
• Kill switch: it is still enforced. A kill-switch refusal, whether the broker-check step was skipped (killed) or the log names the kill switch (refusalOf(...) === BREAKER), is still checked first and still classed breaker. A re-fire is a fresh label event that makes a new run, and that run asks the broker again. Re-firing cannot get past a refusal the broker would repeat.
• Unreadable logs: a kill-switch refusal whose log cannot be read now counts as a failed mint instead of falling through. The re-fire is bounded and the broker still refuses it, so nothing gets through that was blocked before.
• Workflow-modified refusals: the broker's workflow-modified refusal now leads to a re-fire. The re-fire runs on main's workflow files, and the broker still decides whether the new run may mint a token.
• Log handling: log reading, the LOG_CAP_BYTES cap and the RUN_ID validation are unchanged. The new MINT_CAUSE text is a constant with no interpolated untrusted data.
• PR context: it contains no embedded instructions.
• Cost: the extra re-fires spend only prepaid API credits and Actions runs of the existing lane, so there is no hold.

[github-actions]

claude-review reviewed 4390df4fa96773f55e9c7e45e94c2c52a6c09894: 1 finding(s), 0 as inline comments.

Code review: PR #10422 (closes #9102)

I read the full diff, the PR context, didNoWork in label-unblocked.mjs, the BROKER_REFUSED and CHECK_KILLED fixtures, and the existing kill-switch tests. I did not run the tests: this lane has no shell. The PR's own claim that the tests pass is author-claimed and unverified.

Correctness. The change is sound.

• At label-unblocked.mjs L820-824, a kill-switch refusal still takes the breaker branch first, because killed and refused === BREAKER are checked before minting || checked.
• Any other failure at BROKER_STEP now falls into mint-failed. That covers an unreadable log and a log naming another reason such as workflow-modified.
• mint-failed keeps the existing bounds (limits.limit-stops-per-issue re-fires per workflow version, the reset-clamp-min wait, then the stranded backoff), so the new class adds no unbounded loop.
• The MINT_STEP match is unchanged, as the decision comment on fix(pr-pipeline): the mint-failed re-fire for resolve-issue matches a step the read runner does not have #9102 asked.

Closing-issue criteria (#9102). All three are met.

1. didNoWork classification. A resolve-issue job that failed at BROKER_STEP for a non-kill-switch reason, or with no reason in its log, is now mint-failed.
2. Test. The new test uses BROKER_REFUSED with a workflow-modified log and with no readable log. It asserts the re-fire under the bound, the clamp wait and the backoff record. The existing kill-switch test is unchanged, and the new test asserts the kill-switch case stays a breaker trip past the failed-mint bound.
3. Comments. The header and didNoWork comments now say a non-kill-switch broker-check failure is re-fired as mint-failed.

Each criterion has a test that would fail if it broke.

Manifests. The diff changes no plugin manifest.

Spend. The change adds more issue-lane re-fire runs, bounded by the existing limits. That draws only on prepaid or subscription usage, so it is not a hold.

Finding (advisory, not on a changed line). .github/workflows/work-unblock.yml lines 31-39 (header comment) still list "a rerun the token broker refused as workflow-modified" among the failed runs re-fired once per workflow version. After this change that case is re-fired as a failed mint, up to limits.limit-stops-per-issue times and then on the backoff. The comment now contradicts the code and the updated comments in label-unblocked.mjs. The PR author flagged it and left it because /.github/workflows/** is patch-protected. A person should update that comment in a follow-up.

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head 4390df4fa96773f55e9c7e45e94c2c52a6c09894.