[melodic-automation-lanes]

Closes #10887

Summary

Opened by the work-resolve-issue lane. The run's own summary:

enable-auto-merge's pythonVerify kept only the reader's babysit-GH -calls stderr line, so the babysit-listing-miss lines that explain a fallback to the full artifact listing never reached the job log. A new exported listingMissLines helper picks those lines out of the reader's stderr in order, and pythonVerify logs each one unchanged right after the GH -calls line, whatever the reader's exit status. A non-zero exit's error message also skips miss lines when it quotes what the reader said.

Not verified

• node --test .github/scripts/pr-merge/enable-auto-merge.test.mjs was not run: this lane runs no interpreter or test runner, so the suite is left to the PR's CI
• tidy skipped: the change is under .github/, a listed tidy shared path
• build/lint of the touched .mjs files beyond check-affected not run here (no node runner allowed); left to the PR's CI
• PR ＃10743 also edits enable-auto-merge.test.mjs; a rebase conflict is possible if it lands first

Fix

• .github/scripts/pr-merge/enable-auto-merge.mjs: add LISTING_MISS_PREFIX and listingMissLines(stderr); pythonVerify logs each miss line after the babysit-GH -calls line, before the cache line and both throws; the non-zero-exit message filters out miss lines as it already did the GH -calls line
• .github/scripts/pr-merge/enable-auto-merge.test.mjs: a MISSES fixture in the reader's real json.dumps(sort_keys=True) shape; a listingMissLines case (order, CRLF trimmed, GH -calls and unrelated lines dropped, empty and undefined stderr give []); a pythonVerify case where the stub exits 0 with a v

Verification

The runner ran each check from the base copy against 908b44f:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• check-changelog-fragments (run before and after the review fixes): all 2 fragments under .changes/ valid; no plugin changed, so no fragment is owed
• check-affected (run before and after the review fixes): 8 passed, 7 skipped over 2 changed files
• fresh-context subagent review of the full diff: no correctness bugs; it confirmed the JS prefix matches babysit_verify_evidence.py's printed line (LISTING_MISS_PREFIX at :323, print at :1184) and that the new tests should pass against the existing fixtures; its two minor notes (a fixture whose shape
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40844980666

Left out: the items under Not verified.

Related

#10887

[github-actions]

claude-security-review reviewed 908b44fc6cdfb41ec9e1d2fb5cea4e3cb926f4b3: 0 finding(s), 0 as inline comments.

No security issues found.

enable-auto-merge.mjs is a trusted path, so I read the whole change and what it gates. The change adds listingMissLines(). It makes pythonVerify log the reader's babysit-listing-miss {json} stderr lines to stdout. It also drops those lines from the error message built when the reader exits non-zero.

• Merge gate: The change doesn't touch the verifier's parsed result, the refusal handling, the cache logic, the timeouts or the decision to enable auto-merge. It only reads stderr. Nothing in the diff weakens, narrows or removes a merge hold.
• Log injection: The helper splits on \n, strips \r, and keeps only lines that start with babysit-listing-miss . A kept line therefore can't begin with ::, so the runner won't read it as a workflow command (::add-mask::, ::set-output:: and the like). It also can't contain an embedded newline.
• Data exposure: The reader prints json.dumps(miss, sort_keys=True) (babysit_verify_evidence.py:1184). The fields are stage, counts, pages and base_age_seconds. They carry no tokens or secrets. Logging them adds no exposure.
• Error message filter: Excluding miss lines from the "said" line only affects the text of a thrown error. It doesn't change whether the verifier fails closed.
• Plugin manifests: No manifest was touched.

The PR description contains no embedded instructions.

critical-findings: 0

Spend: none beyond ordinary CI. The change adds a few log lines and no extra runs.

[github-actions]

claude-review reviewed 908b44fc6cdfb41ec9e1d2fb5cea4e3cb926f4b3: 0 finding(s), 0 as inline comments.

No findings. I read the whole diff (2 files) and the surrounding pythonVerify code in enable-auto-merge.mjs. I ran no tests, because this lane has no test runner.

Closing issue #10887. The issue asks for each babysit-listing-miss line from done.stderr to be printed beside the babysit-gh-calls line, including when the reader exits 0 with a refusal such as verify:unreadable.

• pythonVerify now logs the lines through listingMissLines at .github/scripts/pr-merge/enable-auto-merge.mjs:1038-1040. That is before the rate-limit and non-zero-exit throws and independent of exit status.
• The issue's open question was why a candidate fell back to the full listing. Logging the lines answers it.
• The new test pythonVerify logs the reader's listing misses beside its calls line on a refusal that exits 0 covers the exit-0 case. The failure-path test also covers the non-zero case.

Prefix. LISTING_MISS_PREFIX = "babysit-listing-miss " has a trailing space. The reader prints f"{LISTING_MISS_PREFIX} {json.dumps(...)}" (babysit_verify_evidence.py:1184) with the prefix constant "babysit-listing-miss" (:323). The two together give babysit-listing-miss {...}, which the JS prefix matches.

Error message. The non-zero-exit message now skips miss lines as well as the calls line (:1052), so it still names the real error line.

Log safety. Only lines starting with babysit-listing-miss are echoed. A line that starts with a workflow command such as :: is not echoed, so the new logging adds no log-injection path. The lines come from the repo's own reader script.

Tests. I traced both new and changed tests against the code and found no mismatch.

• The failure-path test expects MISSES[0] after the calls line, and said resolves to RuntimeError: listing 502.
• The listingMissLines test covers CRLF stripping, ordering, dropping of unrelated lines, and undefined input.

Cost. None. This is only extra log output.

The PR body says #10743 also edits enable-auto-merge.test.mjs, so a rebase conflict is possible. That is a merge-ordering note, not a defect.

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head 908b44fc6cdfb41ec9e1d2fb5cea4e3cb926f4b3. A person must clear this reason, so the pr-merge lane added the needs-human label: fix the reason, then remove the label, and the next scheduled run judges it again.

it changes .github/scripts/pr-merge/enable-auto-merge.mjs, a hold path
pr-merge's gate holds it on its risk score (high-path:.github/scripts/pr-merge/enable-auto-merge.mjs: .github/scripts/pr-merge/enable-auto-merge.mjs)

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head 908b44fc6cdfb41ec9e1d2fb5cea4e3cb926f4b3.

[github-actions]

Post-merge mutation testing

• Range: 46ed9f1..a1f6513
• Merged pull request: #10917
• Outcome: refused

Killed 0, survived 0, timeout 0, no coverage 0, invalid 0, not run 7.
Covered-code score n/a; mutation score n/a.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
.github/scripts/pr-merge/enable-auto-merge.mjs	0	0	0	0	0	7

The run's summary has the full report.