eaffbed · b127ae9 · 85b5f98 · a7c9a86
@@ -87,6 +87,8 @@
An issue's title and body are edited on its page, with MCP `edit`, or with `e` o
Reports from outside (sent with no account) are decided in the terminal too: open the repository as a person who writes it, press `:` and pick "Reports (N)"; beside each title is when it was sent, the page it came from and its words. `a` accepts the one under the cursor as an issue and says its number, `d` dismisses it after a confirm, and one someone else already decided says "this report was already decided". The row shows only while reports wait, and only to a person — not an agent — who can write the repository (`src/tui/screens/reports.ts`).
**Landing past a stopped gate** (#7790): when the last three merge-queue gates of the forge's own repository went red for one cause and nothing has landed since, home, `/boards` and the terminal's Flow dialog (owners only) say `Landing has stopped: …`. Only then can an owner (repository admin, a person, never an agent) land one named pull without its checks, with a reason of 8 to 500 characters that goes on the pull's trail and the outbox (`pull.bypassed`): the **Land past the gate** form on the pull's Files step, `L` on the terminal's pull screen (reason, then a confirm), or MCP `land_past_gate` (planned unless `dryRun: false`). Review and conflicts still hold. `docs/features/gate-bypass.md`.
**Taking a shipped pull back**: `POST /api/v1/repos/:owner/:name/pulls/:number/take-back` (a person who can write here, `rw` token scope; a session needs a same-origin request) opens a new pull, `Revert "<title>"` from the branch `revert-<n>` into the default branch, that undoes exactly what the shipped pull merged. Nothing lands until a person merges it. It takes no body and answers 201 with the new pull, as `POST …/pulls` answers one. Refusals: an agent or a reader gets 403 `forbidden`; a read-only token gets 403; a pull that is unknown or that you may not see gets 404 `not_found`; 409 `not_shipped` (it never merged), 409 `already_reverted`, 409 `mirrored` (the origin owns the history); 409 `conflict` when the undo no longer applies cleanly, with the conflicting files in `message`, and nothing is left behind. A failure of the forge's own git is 500 `git_failed` with a fixed message; git's words go to the server log. The pull page's **Take back** is the same verb (`revertPull` in `src/actions/revert.ts`). The terminal's pull screen does not offer it yet.
The terminal's history says each commit's check, as MCP `commits` with `oid` does: a ✓ or ✗ mark on a log row where the commit's own check on the default branch passed or failed (blank where it has no verdict yet), and a `check:` line under one commit's title: `green`, `red · <first line of the failing step>`, `running`, `superseded` or `not run`, with `· via <sha>` when a later main commit's check answers for it. Nothing shows to a viewer who may not read the repository's runs (`src/checks/commit_check.ts`, `src/tui/screens/commits.ts`).
@@ -101,6 +101,7 @@
for a tunnel and a forge that sleeps.
| `issue` | `{ repo, number }`: one issue's title, state, closeReason, body, labels, assignee, the newest 50 comments (author, authorIsAgent, body, at), `commentsTotal` and `commentsNext` (older ones: `GET …/comments?cursor=`), and blockedBy/blocks, as `GET …/issues/:number`; a sealed one you cannot see is not found; draws the `ui://forge/issue` card: title, state, assignee, labels and what it waits for, never the body or comments |  |
| `issue_teams` | `{ repo, number, teams? }`: the crew teams an issue names; with `teams` (at most two slugs, `[]` clears) names them, and each reviews the closing pull | yes |
| `labels` | `{ repo, number, labels }`: set an issue's or a pull's labels to exactly these (`[]` clears); only labels the repository has, by a writer | yes |
| `land_past_gate` | `{ repo, number, reason, dryRun? }` (an owner, never an agent): land one named pull past the checks when landing has stopped (the forge's own repository, three red gates of one cause); `reason` (8 to 500 characters) is recorded on the pull's trail and the outbox as `pull.bypassed`; planned unless `dryRun` is false; takes an rw token | yes |
| `limb` | `{ app, issue, action, reason?, pillar?, operation?, dryRun? }`: defer, resume or close a whole limb as not doing, or undo an operation; plans unless `dryRun` is false, and applying takes an admin token | yes |
| `limits` | `{ key?, value?, dryRun? }` (forge admin): every limit the forge's owner can hit, with its value, default and bounds; with `key` and `value` (`""` restores the default), planned first (`dryRun` is true unless `false`); a value out of bounds is refused, applying needs an admin-scope token | yes |
| `make_it_yours` | `{ repo, name?, visibility?, dryRun? }`: a fork of an app you can see, as your own app, following the original; code and history copied, data and secrets not; private unless `visibility` is public (a public original only); at most 5 copies an account a day; plans unless `dryRun` is false | yes |
@@ -4,3 +4,5 @@
A form's fields and its buttons sit in two rows, one for what you fill in and on
- `.field-row` — a row of `.field`s side by side that wraps on a narrow screen, each at least 160px wide and aligned to the bottom so a labelled input and the button beside it share a baseline. Styled in `style/components.ts`; written by `createForm` in `pages/branches.ts` (the new-branch form), the graph filter in `pages/fleet-graph.ts`, the freeze form in `pages/frozen.ts` and the new-pull form in `pages/pulls.ts`.
- `.form-actions` — the row of a form's buttons under its fields: 16px above, 8px apart, wrapping. Styled in `style/components.ts`, and in `style/content.ts` for a thread's close reason and "close into" input and for `.comment-form` on a narrow screen; written by nearly every form in `src/web/pages/` (`account.ts`, `settings.ts`, `crew.ts`, `edit.ts`, `issues.ts`, `pulls.ts`, `oauth.ts`, `teams.ts`, `chain.ts`, `everyday.ts`) and by the review comment form in `diff-view.ts`; `client.ts` finds its `.muted` note to report a save.
- The gate break-glass (#7790) on the pull's Files step is a plain `field()` with a hint and a `.form-actions` row holding one `btn` in the `danger` variant; no new class. It sits under the disabled primary Merge button, so the page keeps one accent.
@@ -0,0 +1,13 @@
# The gate cannot lock itself out (#7790)
On 2026-11-01 a bug in the live gate could not be fixed through the gate, and landing stopped for about 4.7 days.
- **It says so.** When the last 3 merge-queue gates of the forge's own repository were all red for one cause (they share a failing test; or none names a test and they share a reason) and nothing has landed since the first of them, the flow alarms carry one sentence, `Landing has stopped: …`, on home, on `/boards` and in the terminal's Flow dialog. Owner-only, like every flow alarm (an agent reader and `publicOnly` never see it). "One cause" stands in for "one base", which a gate result does not keep: three unrelated broken pulls fail different tests and do not raise it. `checks/gate_stopped.ts`.
- **An owner lands one named pull past it, only while it holds.** The break-glass is offered, and accepted, only while landing has stopped and only on the forge's own repository; otherwise it is refused (`not_stopped`). An owner (repo admin, a person, never an agent) has three doors, all through `landPastGate` in `checks/bypass.ts`:
  - the pull's Files step: a "Land past the gate" form (a labelled reason field and a danger button, plain post, no script needed);
  - MCP: `land_past_gate { repo, number, reason, dryRun: false }` (planned unless `dryRun` is false; the plan checks who, the stop and the reason, as the apply does);
  - the terminal: `L` on the pull screen asks the reason, shows it back in a confirm, then lands.
  The reason (8–500 characters) is written to the pull's trail first, then the pull lands, then `pull.bypassed` goes to the outbox; a refused merge leaves a second comment saying so. Only the checks requirement is skipped; review, conflicts and the agent rule still hold.
- Test: `test/gate-bypass.test.ts`.
Not done: running the gate from a pinned earlier release rather than the tree being judged.
@@ -363,6 +363,8 @@
export async function mergePull(
  strategy: MergeStrategy,
  /** The merge queue's guard: land only onto this base, as this tree (#2036). */
  expect?: LandingExpect,
  /** `pastGate`: the owner's break-glass (`checks/bypass.ts`) skips the checks requirement. */
  opts: { readonly pastGate?: boolean } = {},
): Promise<
  Result<{ mergeOid: string; carried: boolean }, AccessError | MergePullError>
> {
@@ -409,7 +411,7 @@
export async function mergePull(
      gate: {
        db: app.db,
        requireReview: repo.requireReview,
        requireChecks: repo.requireChecks,
        requireChecks: repo.requireChecks && opts.pastGate !== true,
      },
      strategy,
      ...(expect === undefined ? {} : { expect }),
@@ -0,0 +1,86 @@
/**
 * The break-glass (#7790): a gate with a bug cannot judge the pull that fixes
 * it. While landing has stopped (`gate_stopped.ts`, the forge's own repository
 * only), an owner lands one named pull past the checks with one recorded
 * action: a reason, on the pull's trail as a comment and on the outbox as
 * `pull.bypassed`. Review and conflicts still count, and an agent never does
 * it (rule 10). The intent is written to the trail before the merge, so a
 * landing always has its record.
 */
import type { App } from "../app.ts";
import { mergePull } from "../actions/pulls.ts";
import { addComment } from "../actions/issues.ts";
import { canAdmin, type Repo } from "../core/repos.ts";
import type { Pull } from "../core/pulls.ts";
import type { User } from "../core/users.ts";
import { getIssueById } from "../core/issues.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { ownLandingStopped } from "./gate_stopped.ts";
export const MIN_REASON = 8;
export const MAX_REASON = 500;
/** What `mergePull` refuses with. */
type MergeError = Extract<Awaited<ReturnType<typeof mergePull>>, { ok: false }>["error"];
export type BypassError =
  | { readonly kind: "forbidden" | "not_found" | "reason" | "not_stopped" }
  | { readonly kind: "merge"; readonly error: MergeError };
/** The reason as the trail will say it, or undefined when it is too short or too long. */
export function cleanReason(text: string): string | undefined {
  const reason = text.replace(/\s+/g, " ").trim();
  return reason.length < MIN_REASON || reason.length > MAX_REASON ? undefined : reason;
}
/** Whether this person may be offered the break-glass on this repository right now. */
export function bypassOffered(app: App, actor: User | undefined, repo: Repo): boolean {
  return (
    actor !== undefined &&
    actor.kind !== "agent" &&
    canAdmin(app.db, repo, actor) &&
    ownLandingStopped(app.db, repo) !== undefined
  );
}
/** What stops the break-glass before any reason is read, or undefined. */
export function bypassRefusal(app: App, actor: User | undefined, repo: Repo, pull: Pull): BypassError | undefined {
  if (actor === undefined || actor.kind === "agent" || !canAdmin(app.db, repo, actor)) return { kind: "forbidden" };
  if (pull.repoId !== repo.id) return { kind: "not_found" };
  if (ownLandingStopped(app.db, repo) === undefined) return { kind: "not_stopped" };
  return undefined;
}
/** The refusal a plan (a dry run) would meet, in order: who, whether stopped, the reason. */
export function planBypass(app: App, actor: User | undefined, repo: Repo, pull: Pull, reasonText: string): BypassError | undefined {
  return bypassRefusal(app, actor, repo, pull) ?? (cleanReason(reasonText) === undefined ? { kind: "reason" } : undefined);
}
/** Land `pull` past the gate. `reasonText` is what the trail will say. */
export async function landPastGate(
  app: App,
  actor: User | undefined,
  repo: Repo,
  pull: Pull,
  reasonText: string,
): Promise<Result<{ mergeOid: string }, BypassError>> {
  const refused = planBypass(app, actor, repo, pull, reasonText);
  if (refused !== undefined || actor === undefined) return err(refused ?? { kind: "forbidden" });
  const reason = cleanReason(reasonText)!;
  const issue = getIssueById(app.db, pull.id);
  if (issue !== undefined)
    addComment(app, actor, repo, issue, `Landing past the gate, by @${actor.username}: ${reason}`);
  const merged = await mergePull(app, actor, repo, pull, "squash", undefined, { pastGate: true });
  if (!merged.ok) {
      
        sentinelcrew
        12d ago
        
      
      Non-blocking: check that the pull is open (not merged, not closed) in bypassRefusal. As written, a call on an already-merged pull leaves a misleading intent comment before the merge is refused.
    
    if (issue !== undefined) addComment(app, actor, repo, issue, "That did not land: the merge was refused, and nothing changed.");
    return err({ kind: "merge", error: merged.error });
  }
  app.bus.append({
    kind: "pull.bypassed",
    repoId: repo.id,
    actorId: actor.id,
    payload: { number: pull.number, reason, mergeOid: merged.value.mergeOid },
  });
  return ok({ mergeOid: merged.value.mergeOid });
}
@@ -0,0 +1,74 @@
/**
 * Landing has stopped (#7790): the last {@link STOPPED_GATES} merge-queue
 * gates of a repository all went red for one cause and nothing has landed
 * since the first of them. "One cause" stands in for "one base" (a gate keeps
 * its candidate's tip, not its base): the three share a failing test, or all
 * failed with no test named and the same reason. Three unrelated broken pulls
 * fail different tests and do not make a stop. A bug in the gate itself looks
 * exactly so, and the gate cannot judge the pull that fixes it; the owner's way
 * past is `checks/bypass.ts`, offered only while this holds, and only for the
 * forge's own repository. Plain data: rows in, one record out.
 */
import type { Database } from "bun:sqlite";
import { getRepo } from "../core/repos.ts";
import { ownRepoPath } from "../kernel/own_repo.ts";
/** How many gates in a row, red on one base, make landing stopped. */
export const STOPPED_GATES = 3;
export interface Stopped {
  /** When the earliest of the red gates finished. */
  readonly since: string;
  readonly gates: number;
}
/** The repository's stop, if its last gates are all red on a base nothing has landed on since. */
export function landingStopped(db: Database, repoId: string): Stopped | undefined {
  const gates = db
    .query<{ state: string; finished_at: string; reason: string | null; tests: string }, [string, number]>(
      "SELECT state, finished_at, reason, tests FROM gate_result WHERE repo_id = ?1 ORDER BY id DESC LIMIT ?2",
    )
    .all(repoId, STOPPED_GATES);
  if (gates.length < STOPPED_GATES || gates.some((g) => g.state !== "red")) return undefined;
  if (!oneCause(gates)) return undefined;
  const since = gates.reduce((a, g) => (g.finished_at < a ? g.finished_at : a), gates[0]!.finished_at);
  const landed = db
    .query<{ at: string | null }, [string]>(
      `SELECT MAX(p.merged_at) AS at FROM pull p JOIN issue i ON i.id = p.issue_id WHERE i.repo_id = ?1`,
    )
    .get(repoId);
  if (landed?.at != null && landed.at >= since) return undefined;
  return { since, gates: gates.length };
}
/** The failing test names a gate row kept; a row this build cannot read names none. */
function failingNames(tests: string): string[] {
  try {
    const list: unknown = JSON.parse(tests);
    if (!Array.isArray(list)) return [];
    return list.flatMap((t: unknown) =>
      typeof t === "object" && t !== null && typeof (t as { name?: unknown }).name === "string" ? [(t as { name: string }).name] : [],
    );
  } catch {
    return [];
  }
}
/** Whether the red gates share one cause: a failing test in all, or no test named and one reason. */
function oneCause(gates: readonly { reason: string | null; tests: string }[]): boolean {
  const names = gates.map((g) => new Set(failingNames(g.tests)));
  if (names.every((n) => n.size === 0)) return gates.every((g) => g.reason !== null && g.reason === gates[0]!.reason);
  return [...names[0]!].some((n) => names.every((set) => set.has(n)));
}
/** The stop, only for the forge's own repository: the one place the break-glass is offered. */
export function ownLandingStopped(db: Database, repo: { readonly id: string }): Stopped | undefined {
  const [owner, name] = ownRepoPath().split("/");
  const own = owner && name ? getRepo(db, owner, name) : undefined;
  return own !== undefined && own.id === repo.id ? landingStopped(db, own.id) : undefined;
}
/** The one sentence home and the pipeline carry. */
export const stoppedSentence = (s: Stopped): string =>
  `Landing has stopped: the last ${s.gates} gates were all red on the same base since ${s.since.slice(0, 16).replace("T", " ")} UTC, so no pull can pass; an owner can land one past the gate with a reason.`;
@@ -70,6 +70,7 @@
const READER_KINDS: ReadonlySet<string> = new Set([
  "pull.reopened",
  "pull.opened",
  "pull.merged",
  "pull.bypassed",
  "issue.opened",
  "spend.reported",
  "forge.proposal",
@@ -7,6 +7,7 @@
 */
import type { Database } from "bun:sqlite";
import { landingStopped, stoppedSentence } from "../checks/gate_stopped.ts";
import { redHref, redMain } from "../checks/red_main.ts";
import { getRepo } from "../core/repos.ts";
import { ownRepoPath } from "../kernel/own_repo.ts";
@@ -16,7 +17,7 @@
import { redMainAlarm } from "./alarm_red_main.ts";
import { alarmStuck } from "./alarm_stuck.ts";
export interface FiredAlarm {
  readonly key: "red_main" | "stuck" | "idle_crew" | "no_release";
  readonly key: "landing_stopped" | "red_main" | "stuck" | "idle_crew" | "no_release";
  readonly says: string;
  readonly since: string;
  /** A same-origin path to the item the alarm names. */
@@ -36,6 +37,10 @@
export function firedAlarms(
  opts: { readonly publicOnly?: boolean; readonly ceilingUsd?: number | null } = {},
): FiredAlarm[] {
  const out: FiredAlarm[] = [];
  const [owner, name] = ownRepoPath().split("/");
  const own = owner && name ? getRepo(db, owner, name) : undefined;
  const stopped = own && !opts.publicOnly ? landingStopped(db, own.id) : undefined;
  if (stopped) out.push({ key: "landing_stopped", says: stoppedSentence(stopped), since: stopped.since, href: "/boards" });
  const red = redMainAlarm(db, now);
  if (red.fired) out.push({ key: "red_main", says: red.says, since: red.since!, href: redMainHref(db) });
  const stuck = alarmStuck(db, now, opts.publicOnly ? { publicOnly: true } : {});
@@ -71,6 +71,7 @@
export { tool as invites } from "./invites.ts";
export { tool as issue } from "./issue.ts";
export { tool as issue_teams } from "./issue_teams.ts";
export { tool as labels } from "./labels.ts";
export { tool as land_past_gate } from "./land_past_gate.ts";
export { tool as limb } from "./limb.ts";
export { tool as limits } from "./limits.ts";
export { tool as make_it_yours } from "./make_it_yours.ts";
@@ -0,0 +1,58 @@
import { mayView } from "../../../core/sealed.ts";
import { landPastGate, planBypass, type BypassError } from "../../../checks/bypass.ts";
import { getPull } from "../../../core/pulls.ts";
import { good, bad, type Tool, REPO_ARG, repoArg, isAnswer } from "../shared.ts";
/**
 * The owner's break-glass (#7790) from any MCP client: the pull page's
 * "Land past the gate", in the same words. A person who administers the
 * repository, never an agent; the reason lands on the pull's trail.
 */
export const tool: Tool = {
  name: "land_past_gate",
  doc: "`{ repo, number, reason, dryRun? }` (an owner, never an agent): land one named pull past the checks when landing has stopped (the forge's own repository, three red gates of one cause); `reason` (8 to 500 characters) is recorded on the pull's trail and the outbox as `pull.bypassed`; planned unless `dryRun` is false; takes an rw token",
  description: "Land one pull past a broken gate, with a recorded reason; an owner's only.",
  inputSchema: {
    type: "object",
    properties: {
      repo: REPO_ARG,
      number: { type: "integer", minimum: 1 },
      reason: { type: "string", minLength: 8, maxLength: 500 },
      dryRun: { type: "boolean" },
    },
    required: ["repo", "number", "reason"],
  },
  writes: true,
  dryByDefault: true,
  async run(ctx, user, args) {
    if (user.kind === "agent") return bad("forbidden", "the crew proposes and an owner lands; an agent may not bypass the gate");
    const repo = repoArg(ctx, user, args);
    if (isAnswer(repo)) return repo;
    const n = args["number"];
    const pull = typeof n === "number" && Number.isInteger(n) && n > 0 ? getPull(ctx.app.db, repo.id, n) : undefined;
    if (pull === undefined || !mayView(ctx.app.db, repo, pull, user)) return bad("no_such_pull", `no pull #${String(n)}`);
    const reason = typeof args["reason"] === "string" ? args["reason"] : "";
    const refused = planBypass(ctx.app, user, repo, pull, reason);
    if (refused !== undefined) return refusal(refused);
    if (args["dryRun"] !== false)
      return good({ dryRun: true, number: pull.number, reason, says: "This is the plan; nothing changed. Send dryRun: false to land past the gate." });
    const landed = await landPastGate(ctx.app, user, repo, pull, reason);
    if (!landed.ok) return refusal(landed.error);
    return good({ dryRun: false, landed: true, mergeOid: landed.value.mergeOid, says: `Landed #${pull.number} past the gate; the reason is on its trail.` });
  },
};
function refusal(e: BypassError): ReturnType<typeof bad> {
  switch (e.kind) {
    case "reason":
      return bad("reason", "the reason must be 8 to 500 characters");
    case "not_stopped":
      return bad("not_stopped", "landing has not stopped; wait for the checks, there is no way past the gate");
    case "merge":
      return bad("refused", `the merge was refused: ${typeof e.error === "string" ? e.error : e.error.kind}`);
    case "not_found":
      return bad("no_such_pull", "no such pull");
    default:
      return bad("forbidden", "only an owner may land a pull past the gate");
  }
}
@@ -357,6 +357,7 @@
import {
  pullFilesPage,
  pullChecksFragment,
  pullMergeSubmit,
  pullLandPastSubmit,
  pullChecksSubmit,
  pullReviewStateSubmit,
  pullApproveHereSubmit,
@@ -1259,6 +1260,7 @@
export function buildRouter(): Router<Handler> {
    threadResolveSubmit(false),
  );
  router.add("POST", "/:owner/:name/pulls/:number/merge", pullMergeSubmit);
  router.add("POST", "/:owner/:name/pulls/:number/land-past", pullLandPastSubmit);
  router.add("POST", "/:owner/:name/pulls/:number/state", (ctx) =>
    stateSubmit(ctx, "pull"),
  );
@@ -41,6 +41,7 @@
import {
} from "../../actions/pulls.ts";
import { holdPull, releasePull } from "../../actions/holds.ts";
import { getHold, type Hold } from "../../core/holds.ts";
import { bypassOffered, cleanReason, landPastGate } from "../../checks/bypass.ts";
import { revertPull } from "../../actions/revert.ts";
import { takeBackWords } from "../../actions/revert_words.ts";
import { openEnvUrl } from "../../actions/apps.ts";
@@ -691,6 +692,59 @@
export function pullScreen(
    });
  };
  /**
   * Whether `L` is on offer: an open pull, an owner who is a person, and
   * landing stopped (`checks/bypass.ts`). The same rule the page's form follows.
   */
  const mayLandPast = (): boolean => {
    if (repo === undefined || !bypassOffered(f.app, f.user, repo)) return false;
    const row = getPull(f.db, repo.id, number);
    return row !== undefined && row.mergedAt === null && detail?.issue.state === "open";
  };
  /** `L` — a reason, then a plan to confirm, then the landing; `landPastGate` decides. */
  const landPast = (): void => {
    if (repo === undefined) return;
    const target = repo;
    ctx.push(
      promptScreen(ctx, screen, {
        title: `Land #${number} past the gate`,
        label: "Why this lands without its checks",
        hint: "Landing has stopped. 8 to 500 characters; it goes on the pull's trail.",
        onSubmit: (value) => {
          const reason = cleanReason(value);
          if (reason === undefined) return "Say why in 8 to 500 characters.";
          // After the prompt closes itself, so the confirm is not the screen it pops.
          return Promise.resolve().then(() => ctx.push(
            confirmScreen(ctx, screen, {
              title: `Land #${number} past the gate`,
              body: [`Land "${getPull(f.db, target.id, number)?.title ?? ""}" without its checks?`, `Reason: ${reason}`, "Review and conflicts still count."],
              actions: [{ label: "Cancel", variant: "ghost" }, { label: "Land past the gate", variant: "danger" }],
              onChoose: (choice) => {
                if (choice !== 1) return;
                runAsync(ctx, async () => {
                  const row = getPull(f.db, target.id, number);
                  if (row === undefined) return;
                  const landed = await landPastGate(f.app, f.user, target, row, reason);
                  if (!landed.ok) {
                    const e = landed.error;
                    ctx.toast(
                      e.kind === "merge" ? errorText(String(typeof e.error === "string" ? e.error : e.error.kind)) : `not landed: ${e.kind.replace("_", " ")}`,
                      "danger",
                    );
                    return;
                  }
                  await reload();
                  ctx.toast(`landed past the gate as ${landed.value.mergeOid.slice(0, 8)}`, "success");
                });
              },
            }),
          ));
        },
      }),
    );
  };
  /**
   * Whether `T` takes this back: a shipped pull on a local repository, for a
   * person who may write. The same gate `revertPull` holds; it decides only
@@ -866,6 +920,7 @@
export function pullScreen(
                ? [binding(["v"], "see the conflict blocks")]
                : []),
              binding(["m"], "merge", { disabled: state() !== "ready" }),
              ...(mayLandPast() ? [binding(["L"], "land past the gate")] : []),
              ...(tab === 1 && view.threadHere() !== null
                ? [
                    binding(
@@ -1064,6 +1119,10 @@
export function pullScreen(
          );
        return true;
      }
      if (e.key === "L" && mayLandPast()) {
        landPast();
        return true;
      }
      if (e.key === "R" && mayWrite()) {
        review();
        return true;
@@ -54,7 +54,8 @@
import {
  type Side,
} from "../../core/reviews.ts";
import { getUsersByIds } from "../../core/users.ts";
import { canWrite, getRepoById, type Repo } from "../../core/repos.ts";
import { canAdmin, canWrite, getRepoById, type Repo } from "../../core/repos.ts";
import { bypassOffered, landPastGate, type BypassError } from "../../checks/bypass.ts";
import { commitLog, readerFor } from "../../git/read.ts";
import { wallOf } from "../../contract/policy.ts";
import type { Ctx } from "../../http/context.ts";
@@ -87,6 +88,7 @@
import {
  badge,
  btn,
  card,
  field as formField,
  icon,
  labelCss,
  queuedPhrase,
@@ -587,12 +589,25 @@
function mergeBox(
      "Waiting on checks.",
      html`${why} ${reviewsChip(status.reviews, by)} ${checks}`,
      when(mayMerge, () =>
        btn("Merge pull request", {
        html`${btn("Merge pull request", {
          variant: "primary",
          icon: "merge",
          disabled: true,
          title: "A passing deploy of this head is required first",
        }),
        })}${when(
      
        sentinelcrew
        12d ago
        outdated
      
      Gate this on the landing-stopped state, and use the named form/button components instead of hand-rolled markup (see body items 2 and 3).
    
          bypassOffered(ctx.app, ctx.auth.user, repo),
          () => html`<form method="post" action="${thread}/land-past">
            ${formField({
              name: "reason",
              label: "Land past the gate",
              hint: "Landing has stopped. Say why this pull lands without its checks; it goes on the pull's trail. Review and conflicts still count.",
              required: true,
              minlength: 8,
              maxlength: 500,
            })}
            <div class="form-actions">${btn("Land past the gate", { variant: "danger", icon: "merge" })}</div>
          </form>`,
        )}`,
      ),
    );
  }
@@ -1376,6 +1391,34 @@
export async function pullMergeSubmit(ctx: Ctx): Promise<Response> {
  return flashTo(ctx, dest, { message: "Pull request merged." });
}
// POST /:owner/:name/pulls/:number/land-past — the owner's break-glass (#7790).
export async function pullLandPastSubmit(ctx: Ctx): Promise<Response> {
  const found = pullContext(ctx);
  if (found instanceof Response) return found;
  const user = ctx.auth.user;
  if (!user || user.kind === "agent" || !canAdmin(ctx.app.db, found.repo, user))
    return new Response("forbidden", { status: 403 });
  const form = await readForm(ctx, "rw");
  if (form instanceof Response) return form;
  const dest = `${repoBase(found.repo)}/pulls/${found.pull.number}`;
  const landed = await landPastGate(ctx.app, user, found.repo, found.pull, field(form, "reason") ?? "");
  if (!landed.ok) return flashTo(ctx, dest, { tone: "danger", message: bypassWords(landed.error) });
  return flashTo(ctx, dest, { message: "Landed past the gate; the reason is on the trail." });
}
function bypassWords(e: BypassError): string {
  switch (e.kind) {
    case "reason":
      return "Say why in 8 to 500 characters: it goes on the pull's trail.";
    case "not_stopped":
      return "Landing has not stopped, so there is no way past the gate: wait for the checks.";
    case "merge":
      return `Not landed: ${mergeFailure(e.error)}`;
    default:
      return "Only an owner can land a pull past the gate.";
  }
}
/**
 * GET /:owner/:name/pulls/:number/checks-line — the checks line alone, for
 * the region that shows it. Authorized as the page is: a viewer who cannot
@@ -0,0 +1,348 @@
/**
 * The gate cannot lock itself out (#7790): three red gates of one cause say
 * landing has stopped, in the flow alarms (owner-only); only then, and only
 * on the forge's own repository, an owner lands one named pull past the
 * checks with a recorded reason, from the page, the MCP and the terminal.
 * Review and conflicts still hold; the next pull lands normally.
 */
import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { landPastGate } from "../src/checks/bypass.ts";
import { landingStopped } from "../src/checks/gate_stopped.ts";
import { keepGateResult } from "../src/checks/gate_result.ts";
import { createAgentRow } from "../src/core/agents.ts";
import { claimRun, createRun, finishRun, setRunBase } from "../src/core/runs.ts";
import { getPull, type Pull } from "../src/core/pulls.ts";
import { listComments } from "../src/core/issues.ts";
import { updateRepoSettings, type Repo } from "../src/core/repos.ts";
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { firedAlarms } from "../src/flow/alarms.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { pullScreen } from "../src/tui/screens/pull.ts";
import { local } from "../src/tui/screens/where.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
quietLogs();
describe("landing past a broken gate", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let owner: User;
  let outsider: User;
  let agent: User;
  let repo: Repo;
  let other: Repo;
  let ownerCookie: string;
  let n = 0;
  const HOUR = 3_600_000;
  const pullIn = async (r: Repo, branch: string, file = `${branch}.txt`, content = `${branch}\n`) => {
    const made = await commitToBranch(app, owner, r, { branch, message: branch, files: [{ path: file, content }] });
    if (!made.ok) throw new Error(JSON.stringify(made.error));
    const opened = await openPull(app, owner, r, { title: branch, baseBranch: "main", headBranch: branch });
    if (!opened.ok) throw new Error(String(opened.error));
    return opened.value;
  };
  const pullOf = (branch: string) => pullIn(repo, branch);
  const gate = (at: number, state: "red" | "green", failing: string[], reason = "tests") => {
    n += 1;
    keepGateResult(app.db, `gate-${String(n).padStart(4, "0")}`, {
      repoId: repo.id,
      runId: `gate-${n}`,
      tipOid: "a".repeat(40),
      pulls: [n],
      state,
      ...(state === "red" ? { reason } : {}),
      passed: 1,
      failed: failing.length,
      failing: failing.map((name) => ({ name, errors: [] })),
      startedAt: new Date(at).toISOString(),
      finishedAt: new Date(at).toISOString(),
    });
  };
  /** Three red gates of one cause, in the future so no earlier landing clears them. */
  const stop = () => {
    const t = Date.now() + HOUR;
    for (let i = 0; i < 3; i++) gate(t + i * 1000, "red", ["the gate > is broken", `unrelated ${i}`]);
  };
  const green = async (pull: Pull) => {
    const base = (await resolveOid(repoDir(app.reposRoot, "trevato", "forge"), "refs/heads/main"))!;
    const run = createRun(app.db, { repoId: repo.id, kind: "check", issueId: pull.id, env: "pull", commitOid: pull.headOid });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, { state: "ok", summary: "all green" });
    setRunBase(app.db, run.id, base);
  };
  const post = (p: Pull, cookie: string | null, reason: string, extra: Record<string, string> = {}, bearer?: string) =>
    fetch(`${servers.url}/trevato/forge/pulls/${p.number}/land-past`, {
      method: "POST",
      redirect: "manual",
      headers: {
        "content-type": "application/x-www-form-urlencoded",
        ...(cookie === null ? {} : { cookie }),
        ...(bearer === undefined ? {} : { authorization: `Bearer ${bearer}` }),
        ...extra,
      },
      body: new URLSearchParams({ reason }),
    });
  const page = async (p: Pull, cookie: string) =>
    (await fetch(`${servers.url}/trevato/forge/pulls/${p.number}/files`, { headers: { cookie } })).text();
  const mcp = async (token: string, args: Record<string, unknown>) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: { "content-type": "application/json", accept: "application/json, text/event-stream", authorization: `Bearer ${token}` },
      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "land_past_gate", arguments: args } }),
    });
    const body: any = await res.json();
    const text: string = body.result.content[0].text;
    return body.result.isError === true ? { error: text } : { value: JSON.parse(text) };
  };
  const isMerged = (p: Pull) => getPull(app.db, repo.id, p.number)?.mergedAt != null;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-bypass-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    const mk = async (username: string, first = false, isAgent = false) => {
      const made = await createUser(app.db, {
        origin: isAgent ? "agent" : "seed",
        trusted: true,
        username,
        email: `${username}@forge.local`,
        password: isAgent ? "" : "a-good-passphrase",
        adminIfFirst: first,
        ...(isAgent ? { agent: true } : {}),
      });
      if (!made.ok) throw new Error(made.error);
      return made.value;
    };
    owner = await mk("trevato", true);
    outsider = await mk("mallory");
    agent = await mk("wright", false, true);
    createAgentRow(app.db, { userId: agent.id, brief: "Builds." });
    ownerCookie = `forge_session=${createSession(app.db, owner.id).token}`;
    for (const [name, mine] of [["forge", true], ["elsewhere", false]] as const) {
      const made = await createRepo(app, owner, { name, visibility: "public", description: "f" });
      if (!made.ok) throw new Error(JSON.stringify(made.error));
      const done = await commitToBranch(app, owner, made.value, { branch: "main", message: "seed", files: [{ path: "README.md", content: "x\n" }] });
      if (!done.ok) throw new Error(JSON.stringify(done.error));
      const set = updateRepoSettings(app.db, made.value, { requireChecks: true });
      if (mine) repo = set;
      else other = set;
    }
  }, 30_000);
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  beforeEach(() => {
    app.db.query("DELETE FROM gate_result").run();
    repo = updateRepoSettings(app.db, repo, { requireChecks: true, requireReview: false });
  });
  test("two red gates are not a stop; three of one cause are, in one sentence", () => {
    const t = Date.now() + HOUR;
    gate(t, "red", ["the gate > is broken"]);
    gate(t + 1, "red", ["the gate > is broken"]);
    expect(landingStopped(app.db, repo.id)).toBeUndefined();
    gate(t + 2, "red", ["the gate > is broken", "other"]);
    expect(landingStopped(app.db, repo.id)?.gates).toBe(3);
    const alarm = firedAlarms(app.db, new Date()).find((a) => a.key === "landing_stopped");
    expect(alarm?.says).toStartWith("Landing has stopped:");
    expect(alarm?.says.split(". ").length).toBe(1);
  });
  test("the alarm is the owner's: a public-only reader never sees it", () => {
    stop();
    expect(firedAlarms(app.db, new Date()).some((a) => a.key === "landing_stopped")).toBe(true);
    expect(firedAlarms(app.db, new Date(), { publicOnly: true }).some((a) => a.key === "landing_stopped")).toBe(false);
  });
  test("three red gates of different causes, or mixed with a green, are not a stop", () => {
    const t = Date.now() + HOUR;
    gate(t, "red", ["a > broke"]);
    gate(t + 1, "red", ["b > broke"]);
    gate(t + 2, "red", ["c > broke"]);
    expect(landingStopped(app.db, repo.id)).toBeUndefined();
    gate(t + 3, "red", ["a > broke"]);
    gate(t + 4, "green", []);
    gate(t + 5, "red", ["a > broke"]);
    expect(landingStopped(app.db, repo.id)).toBeUndefined();
  });
  test("three reds followed by a landing do not alarm", async () => {
    const t = Date.now() - 5000;
    for (let i = 0; i < 3; i++) gate(t + i, "red", ["the gate > is broken"]);
    expect(landingStopped(app.db, repo.id)?.gates).toBe(3);
    const next = await pullOf("lands-after-reds");
    await green(next);
    expect((await mergePull(app, owner, repo, next, "squash")).ok).toBe(true);
    expect(landingStopped(app.db, repo.id)).toBeUndefined();
    expect(firedAlarms(app.db, new Date()).some((a) => a.key === "landing_stopped")).toBe(false);
  });
  test("core: refused while landing is running, for an outsider, an agent, a short reason; then it lands and records", async () => {
    const fix = await pullOf("fix-the-gate");
    expect(await landPastGate(app, owner, repo, fix, "a fine reason here")).toEqual({ ok: false, error: { kind: "not_stopped" } });
    stop();
    expect((await mergePull(app, owner, repo, fix, "squash")).ok).toBe(false);
    expect(await landPastGate(app, outsider, repo, fix, "a fine reason here")).toEqual({ ok: false, error: { kind: "forbidden" } });
    expect(await landPastGate(app, agent, repo, fix, "a fine reason here")).toEqual({ ok: false, error: { kind: "forbidden" } });
    expect(await landPastGate(app, owner, repo, fix, "no")).toEqual({ ok: false, error: { kind: "reason" } });
    expect(isMerged(fix)).toBe(false);
    const landed = await landPastGate(app, owner, repo, fix, "the gate's own bug blocks its fix");
    expect(landed.ok).toBe(true);
    expect(isMerged(fix)).toBe(true);
    const bodies = listComments(app.db, fix.id).map((c) => c.body);
    expect(bodies.some((b) => b.includes("past the gate") && b.includes("the gate's own bug blocks its fix"))).toBe(true);
    const event = app.db.query<{ payload: string }, []>("SELECT payload FROM event WHERE kind = 'pull.bypassed'").get();
    expect(JSON.parse(event!.payload).reason).toBe("the gate's own bug blocks its fix");
    // The next pull needs its green and lands by the usual road.
    app.db.query("DELETE FROM gate_result").run();
    const next = await pullOf("next-change");
    expect((await mergePull(app, owner, repo, next, "squash")).ok).toBe(false);
    await green(next);
    expect((await mergePull(app, owner, repo, next, "squash")).ok).toBe(true);
  });
  test("core: only the forge's own repository has a break-glass", async () => {
    stop();
    const p = await pullIn(other, "elsewhere-change");
    expect(await landPastGate(app, owner, other, p, "a fine reason here")).toEqual({ ok: false, error: { kind: "not_stopped" } });
  });
  test("core: review and conflicts still hold, and the intent is on the trail even when the merge is refused", async () => {
    stop();
    repo = updateRepoSettings(app.db, repo, { requireReview: true });
    const unreviewed = await pullOf("needs-review");
    const held = await landPastGate(app, owner, repo, unreviewed, "a fine reason here");
    expect(held).toEqual({ ok: false, error: { kind: "merge", error: "review_required" } });
    expect(isMerged(unreviewed)).toBe(false);
    const bodies = listComments(app.db, unreviewed.id).map((c) => c.body);
    expect(bodies.some((b) => b.startsWith("Landing past the gate"))).toBe(true);
    expect(app.db.query("SELECT 1 FROM event WHERE kind = 'pull.bypassed' AND payload LIKE ?1").get(`%"number":${unreviewed.number},%`)).toBeNull();
    repo = updateRepoSettings(app.db, repo, { requireReview: false });
    const clash = await pullIn(repo, "clash", "clash.txt", "theirs\n");
    const moved = await commitToBranch(app, owner, repo, { branch: "main", message: "mine", files: [{ path: "clash.txt", content: "mine\n" }] });
    if (!moved.ok) throw new Error(JSON.stringify(moved.error));
    const conflicted = await landPastGate(app, owner, repo, getPull(app.db, repo.id, clash.number)!, "a fine reason here");
    expect(conflicted.ok).toBe(false);
    if (!conflicted.ok) expect(conflicted.error.kind).toBe("merge");
    expect(isMerged(clash)).toBe(false);
  });
  test("web: the form shows only while landing has stopped, and works with a plain post", async () => {
    const p = await pullOf("web-form");
    expect(await page(p, ownerCookie)).not.toContain("Land past the gate");
    stop();
    const html = await page(p, ownerCookie);
    expect(html).toContain("Land past the gate");
    expect(html).toContain(`action="/trevato/forge/pulls/${p.number}/land-past"`);
    expect(html).toContain('data-variant="danger"');
    expect(html).not.toContain("row-fields");
    const guest = await fetch(`${servers.url}/trevato/forge/pulls/${p.number}/files`).then((r) => r.text());
    expect(guest).not.toContain("Land past the gate");
  });
  test("web: 403 for a guest, a non-admin and an agent; cross-origin refused; a short reason flashes", async () => {
    stop();
    const p = await pullOf("web-route");
    const reason = "the gate's own bug blocks it";
    expect((await post(p, null, reason)).status).toBe(403);
    const mallory = `forge_session=${createSession(app.db, outsider.id).token}`;
    expect((await post(p, mallory, reason)).status).toBe(403);
    const token = createToken(app.db, agent.id, "rw", "rw").token;
    expect((await post(p, null, reason, {}, token)).status).toBe(403);
    expect((await post(p, ownerCookie, reason, { origin: "https://evil.example" })).status).toBe(403);
    const short = await post(p, ownerCookie, "no");
    expect(short.status).toBe(303);
    expect(short.headers.get("set-cookie") ?? "").toContain("8%20to%20500");
    expect(isMerged(p)).toBe(false);
    const done = await post(p, ownerCookie, reason);
    expect(done.status).toBe(303);
    expect(isMerged(p)).toBe(true);
  });
  test("web: refused while landing has not stopped", async () => {
    const p = await pullOf("web-not-stopped");
    const res = await post(p, ownerCookie, "a fine reason here");
    expect(res.status).toBe(303);
    expect(isMerged(p)).toBe(false);
  });
  test("mcp: an agent is refused; a dry run changes nothing and checks the reason; dryRun false lands; an unseen pull is not found", async () => {
    const p = await pullOf("mcp-door");
    const ownerRw = createToken(app.db, owner.id, "rw", "rw").token;
    const agentRw = createToken(app.db, agent.id, "rw", "rw").token;
    const args = { repo: "trevato/forge", number: p.number, reason: "the gate's own bug blocks it" };
    expect((await mcp(agentRw, { ...args, dryRun: false })).error).toContain("owner");
    expect((await mcp(ownerRw, args)).error).toContain("not stopped");
    stop();
    const plan = await mcp(ownerRw, args);
    expect(plan.value.dryRun).toBe(true);
    expect(isMerged(p)).toBe(false);
    expect((await mcp(ownerRw, { ...args, reason: "no" })).error).toContain("8 to 500");
    expect((await mcp(ownerRw, { ...args, reason: "no", dryRun: false })).error).toContain("8 to 500");
    expect((await mcp(ownerRw, { ...args, number: 9999, dryRun: false })).error).toContain("no pull");
    const landed = await mcp(ownerRw, { ...args, dryRun: false });
    expect(landed.value.landed).toBe(true);
    expect(isMerged(p)).toBe(true);
    const mallory = createToken(app.db, outsider.id, "rw", "rw").token;
    const q = await pullOf("mcp-outsider");
    expect((await mcp(mallory, { ...args, number: q.number, dryRun: false })).error).toBeDefined();
    expect(isMerged(q)).toBe(false);
  });
  test("terminal: L asks a reason, then a confirm, then lands; it is not offered when landing runs", async () => {
    const p = await pullOf("tty-door");
    const drive = async (who: User, keys: string[]) => {
      const terminal = headlessTerminal(160, 44);
      const { app: tui, session } = createForgeApp(
        app,
        { sshUsername: who.username, remoteAddress: "127.0.0.1", fingerprint: "SHA256:t", user: who },
        { terminal, exitHooks: false },
      );
      tui.start();
      await settleApp(tui);
      tui.push(pullScreen(session, tui.ctx, local(session, repo), p.number));
      await settleApp(tui);
      const frames = [tui.screen.toText()];
      for (const k of keys) {
        terminal.feed(k);
        await settleApp(tui);
        frames.push(tui.screen.toText());
      }
      tui.stop();
      return frames;
    };
    expect((await drive(owner, ["L"])).at(-1)).not.toContain("past the gate");
    stop();
    const [first] = await drive(owner, []);
    expect(first).toContain("land past the gate");
    expect((await drive(outsider, []))[0]).not.toContain("land past the gate");
    const short = await drive(owner, ["L", "no", "\r"]);
    expect(short.at(-1)).toContain("8 to 500");
    expect(isMerged(p)).toBe(false);
    const planned = await drive(owner, ["L", "the gate's own bug blocks it", "\r"]);
    expect(planned.at(-1)).toContain("Reason: the gate's own bug blocks it");
    expect(isMerged(p)).toBe(false);
    await drive(owner, ["L", "the gate's own bug blocks it", "\r", "\x1b[C", "\r"]);
    expect(isMerged(p)).toBe(true);
  }, 60_000);
});
@@ -295,6 +295,7 @@
describe("the forge over MCP", () => {
      "subscriptions",
      "usage",
      "labels",
      "land_past_gate",
      "repo_labels",
      "wait_for",
      "confirm_wait",
		@@ -87,6 +87,8 @@ An issue's title and body are edited on its page, with MCP `edit`, or with `e` o
87	87
88	88	Reports from outside (sent with no account) are decided in the terminal too: open the repository as a person who writes it, press `:` and pick "Reports (N)"; beside each title is when it was sent, the page it came from and its words. `a` accepts the one under the cursor as an issue and says its number, `d` dismisses it after a confirm, and one someone else already decided says "this report was already decided". The row shows only while reports wait, and only to a person — not an agent — who can write the repository (`src/tui/screens/reports.ts`).
89	89
	90	Landing past a stopped gate (#7790): when the last three merge-queue gates of the forge's own repository went red for one cause and nothing has landed since, home, `/boards` and the terminal's Flow dialog (owners only) say `Landing has stopped: …`. Only then can an owner (repository admin, a person, never an agent) land one named pull without its checks, with a reason of 8 to 500 characters that goes on the pull's trail and the outbox (`pull.bypassed`): the Land past the gate form on the pull's Files step, `L` on the terminal's pull screen (reason, then a confirm), or MCP `land_past_gate` (planned unless `dryRun: false`). Review and conflicts still hold. `docs/features/gate-bypass.md`.
	91
90	92	Taking a shipped pull back: `POST /api/v1/repos/:owner/:name/pulls/:number/take-back` (a person who can write here, `rw` token scope; a session needs a same-origin request) opens a new pull, `Revert "<title>"` from the branch `revert-<n>` into the default branch, that undoes exactly what the shipped pull merged. Nothing lands until a person merges it. It takes no body and answers 201 with the new pull, as `POST …/pulls` answers one. Refusals: an agent or a reader gets 403 `forbidden`; a read-only token gets 403; a pull that is unknown or that you may not see gets 404 `not_found`; 409 `not_shipped` (it never merged), 409 `already_reverted`, 409 `mirrored` (the origin owns the history); 409 `conflict` when the undo no longer applies cleanly, with the conflicting files in `message`, and nothing is left behind. A failure of the forge's own git is 500 `git_failed` with a fixed message; git's words go to the server log. The pull page's Take back is the same verb (`revertPull` in `src/actions/revert.ts`). The terminal's pull screen does not offer it yet.
91	93
92	94	The terminal's history says each commit's check, as MCP `commits` with `oid` does: a ✓ or ✗ mark on a log row where the commit's own check on the default branch passed or failed (blank where it has no verdict yet), and a `check:` line under one commit's title: `green`, `red · <first line of the failing step>`, `running`, `superseded` or `not run`, with `· via <sha>` when a later main commit's check answers for it. Nothing shows to a viewer who may not read the repository's runs (`src/checks/commit_check.ts`, `src/tui/screens/commits.ts`).
		@@ -101,6 +101,7 @@ for a tunnel and a forge that sleeps.
101	101	\| `issue` \| `{ repo, number }`: one issue's title, state, closeReason, body, labels, assignee, the newest 50 comments (author, authorIsAgent, body, at), `commentsTotal` and `commentsNext` (older ones: `GET …/comments?cursor=`), and blockedBy/blocks, as `GET …/issues/:number`; a sealed one you cannot see is not found; draws the `ui://forge/issue` card: title, state, assignee, labels and what it waits for, never the body or comments \| \|
102	102	\| `issue_teams` \| `{ repo, number, teams? }`: the crew teams an issue names; with `teams` (at most two slugs, `[]` clears) names them, and each reviews the closing pull \| yes \|
103	103	\| `labels` \| `{ repo, number, labels }`: set an issue's or a pull's labels to exactly these (`[]` clears); only labels the repository has, by a writer \| yes \|
	104	\| `land_past_gate` \| `{ repo, number, reason, dryRun? }` (an owner, never an agent): land one named pull past the checks when landing has stopped (the forge's own repository, three red gates of one cause); `reason` (8 to 500 characters) is recorded on the pull's trail and the outbox as `pull.bypassed`; planned unless `dryRun` is false; takes an rw token \| yes \|
104	105	\| `limb` \| `{ app, issue, action, reason?, pillar?, operation?, dryRun? }`: defer, resume or close a whole limb as not doing, or undo an operation; plans unless `dryRun` is false, and applying takes an admin token \| yes \|
105	106	\| `limits` \| `{ key?, value?, dryRun? }` (forge admin): every limit the forge's owner can hit, with its value, default and bounds; with `key` and `value` (`""` restores the default), planned first (`dryRun` is true unless `false`); a value out of bounds is refused, applying needs an admin-scope token \| yes \|
106	107	\| `make_it_yours` \| `{ repo, name?, visibility?, dryRun? }`: a fork of an app you can see, as your own app, following the original; code and history copied, data and secrets not; private unless `visibility` is public (a public original only); at most 5 copies an account a day; plans unless `dryRun` is false \| yes \|
		@@ -4,3 +4,5 @@ A form's fields and its buttons sit in two rows, one for what you fill in and on
4	4
5	5	- `.field-row` — a row of `.field`s side by side that wraps on a narrow screen, each at least 160px wide and aligned to the bottom so a labelled input and the button beside it share a baseline. Styled in `style/components.ts`; written by `createForm` in `pages/branches.ts` (the new-branch form), the graph filter in `pages/fleet-graph.ts`, the freeze form in `pages/frozen.ts` and the new-pull form in `pages/pulls.ts`.
6	6	- `.form-actions` — the row of a form's buttons under its fields: 16px above, 8px apart, wrapping. Styled in `style/components.ts`, and in `style/content.ts` for a thread's close reason and "close into" input and for `.comment-form` on a narrow screen; written by nearly every form in `src/web/pages/` (`account.ts`, `settings.ts`, `crew.ts`, `edit.ts`, `issues.ts`, `pulls.ts`, `oauth.ts`, `teams.ts`, `chain.ts`, `everyday.ts`) and by the review comment form in `diff-view.ts`; `client.ts` finds its `.muted` note to report a save.
	7
	8	- The gate break-glass (#7790) on the pull's Files step is a plain `field()` with a hint and a `.form-actions` row holding one `btn` in the `danger` variant; no new class. It sits under the disabled primary Merge button, so the page keeps one accent.
		@@ -0,0 +1,13 @@
	1	# The gate cannot lock itself out (#7790)
	2
	3	On 2026-11-01 a bug in the live gate could not be fixed through the gate, and landing stopped for about 4.7 days.
	4
	5	- It says so. When the last 3 merge-queue gates of the forge's own repository were all red for one cause (they share a failing test; or none names a test and they share a reason) and nothing has landed since the first of them, the flow alarms carry one sentence, `Landing has stopped: …`, on home, on `/boards` and in the terminal's Flow dialog. Owner-only, like every flow alarm (an agent reader and `publicOnly` never see it). "One cause" stands in for "one base", which a gate result does not keep: three unrelated broken pulls fail different tests and do not raise it. `checks/gate_stopped.ts`.
	6	- An owner lands one named pull past it, only while it holds. The break-glass is offered, and accepted, only while landing has stopped and only on the forge's own repository; otherwise it is refused (`not_stopped`). An owner (repo admin, a person, never an agent) has three doors, all through `landPastGate` in `checks/bypass.ts`:
	7	- the pull's Files step: a "Land past the gate" form (a labelled reason field and a danger button, plain post, no script needed);
	8	- MCP: `land_past_gate { repo, number, reason, dryRun: false }` (planned unless `dryRun` is false; the plan checks who, the stop and the reason, as the apply does);
	9	- the terminal: `L` on the pull screen asks the reason, shows it back in a confirm, then lands.
	10	The reason (8–500 characters) is written to the pull's trail first, then the pull lands, then `pull.bypassed` goes to the outbox; a refused merge leaves a second comment saying so. Only the checks requirement is skipped; review, conflicts and the agent rule still hold.
	11	- Test: `test/gate-bypass.test.ts`.
	12
	13	Not done: running the gate from a pinned earlier release rather than the tree being judged.
		@@ -363,6 +363,8 @@ export async function mergePull(
363	363	strategy: MergeStrategy,
364	364	/** The merge queue's guard: land only onto this base, as this tree (#2036). */
365	365	expect?: LandingExpect,
	366	/** `pastGate`: the owner's break-glass (`checks/bypass.ts`) skips the checks requirement. */
	367	opts: { readonly pastGate?: boolean } = {},
366	368	): Promise<
367	369	Result<{ mergeOid: string; carried: boolean }, AccessError \| MergePullError>
368	370	> {
		@@ -409,7 +411,7 @@ export async function mergePull(
409	411	gate: {
410	412	db: app.db,
411	413	requireReview: repo.requireReview,
412		requireChecks: repo.requireChecks,
	414	requireChecks: repo.requireChecks && opts.pastGate !== true,
413	415	},
414	416	strategy,
415	417	...(expect === undefined ? {} : { expect }),
		@@ -0,0 +1,86 @@
	1	/**
	2	* The break-glass (#7790): a gate with a bug cannot judge the pull that fixes
	3	* it. While landing has stopped (`gate_stopped.ts`, the forge's own repository
	4	* only), an owner lands one named pull past the checks with one recorded
	5	* action: a reason, on the pull's trail as a comment and on the outbox as
	6	* `pull.bypassed`. Review and conflicts still count, and an agent never does
	7	* it (rule 10). The intent is written to the trail before the merge, so a
	8	* landing always has its record.
	9	*/
	10
	11	import type { App } from "../app.ts";
	12	import { mergePull } from "../actions/pulls.ts";
	13	import { addComment } from "../actions/issues.ts";
	14	import { canAdmin, type Repo } from "../core/repos.ts";
	15	import type { Pull } from "../core/pulls.ts";
	16	import type { User } from "../core/users.ts";
	17	import { getIssueById } from "../core/issues.ts";
	18	import { err, ok, type Result } from "../kernel/result.ts";
	19	import { ownLandingStopped } from "./gate_stopped.ts";
	20
	21	export const MIN_REASON = 8;
	22	export const MAX_REASON = 500;
	23
	24	/** What `mergePull` refuses with. */
	25	type MergeError = Extract<Awaited<ReturnType<typeof mergePull>>, { ok: false }>["error"];
	26
	27	export type BypassError =
	28	\| { readonly kind: "forbidden" \| "not_found" \| "reason" \| "not_stopped" }
	29	\| { readonly kind: "merge"; readonly error: MergeError };
	30
	31	/** The reason as the trail will say it, or undefined when it is too short or too long. */
	32	export function cleanReason(text: string): string \| undefined {
	33	const reason = text.replace(/\s+/g, " ").trim();
	34	return reason.length < MIN_REASON \|\| reason.length > MAX_REASON ? undefined : reason;
	35	}
	36
	37	/** Whether this person may be offered the break-glass on this repository right now. */
	38	export function bypassOffered(app: App, actor: User \| undefined, repo: Repo): boolean {
	39	return (
	40	actor !== undefined &&
	41	actor.kind !== "agent" &&
	42	canAdmin(app.db, repo, actor) &&
	43	ownLandingStopped(app.db, repo) !== undefined
	44	);
	45	}
	46
	47	/** What stops the break-glass before any reason is read, or undefined. */
	48	export function bypassRefusal(app: App, actor: User \| undefined, repo: Repo, pull: Pull): BypassError \| undefined {
	49	if (actor === undefined \|\| actor.kind === "agent" \|\| !canAdmin(app.db, repo, actor)) return { kind: "forbidden" };
	50	if (pull.repoId !== repo.id) return { kind: "not_found" };
	51	if (ownLandingStopped(app.db, repo) === undefined) return { kind: "not_stopped" };
	52	return undefined;
	53	}
	54
	55	/** The refusal a plan (a dry run) would meet, in order: who, whether stopped, the reason. */
	56	export function planBypass(app: App, actor: User \| undefined, repo: Repo, pull: Pull, reasonText: string): BypassError \| undefined {
	57	return bypassRefusal(app, actor, repo, pull) ?? (cleanReason(reasonText) === undefined ? { kind: "reason" } : undefined);
	58	}
	59
	60	/** Land `pull` past the gate. `reasonText` is what the trail will say. */
	61	export async function landPastGate(
	62	app: App,
	63	actor: User \| undefined,
	64	repo: Repo,
	65	pull: Pull,
	66	reasonText: string,
	67	): Promise<Result<{ mergeOid: string }, BypassError>> {
	68	const refused = planBypass(app, actor, repo, pull, reasonText);
	69	if (refused !== undefined \|\| actor === undefined) return err(refused ?? { kind: "forbidden" });
	70	const reason = cleanReason(reasonText)!;
	71	const issue = getIssueById(app.db, pull.id);
	72	if (issue !== undefined)
	73	addComment(app, actor, repo, issue, `Landing past the gate, by @${actor.username}: ${reason}`);
	74	const merged = await mergePull(app, actor, repo, pull, "squash", undefined, { pastGate: true });
	75	if (!merged.ok) {
		sentinelcrew 12d ago Non-blocking: check that the pull is open (not merged, not closed) in `bypassRefusal`. As written, a call on an already-merged pull leaves a misleading intent comment before the merge is refused.
	76	if (issue !== undefined) addComment(app, actor, repo, issue, "That did not land: the merge was refused, and nothing changed.");
	77	return err({ kind: "merge", error: merged.error });
	78	}
	79	app.bus.append({
	80	kind: "pull.bypassed",
	81	repoId: repo.id,
	82	actorId: actor.id,
	83	payload: { number: pull.number, reason, mergeOid: merged.value.mergeOid },
	84	});
	85	return ok({ mergeOid: merged.value.mergeOid });
	86	}
		@@ -0,0 +1,74 @@
	1	/**
	2	* Landing has stopped (#7790): the last {@link STOPPED_GATES} merge-queue
	3	* gates of a repository all went red for one cause and nothing has landed
	4	* since the first of them. "One cause" stands in for "one base" (a gate keeps
	5	* its candidate's tip, not its base): the three share a failing test, or all
	6	* failed with no test named and the same reason. Three unrelated broken pulls
	7	* fail different tests and do not make a stop. A bug in the gate itself looks
	8	* exactly so, and the gate cannot judge the pull that fixes it; the owner's way
	9	* past is `checks/bypass.ts`, offered only while this holds, and only for the
	10	* forge's own repository. Plain data: rows in, one record out.
	11	*/
	12
	13	import type { Database } from "bun:sqlite";
	14	import { getRepo } from "../core/repos.ts";
	15	import { ownRepoPath } from "../kernel/own_repo.ts";
	16
	17	/** How many gates in a row, red on one base, make landing stopped. */
	18	export const STOPPED_GATES = 3;
	19
	20	export interface Stopped {
	21	/** When the earliest of the red gates finished. */
	22	readonly since: string;
	23	readonly gates: number;
	24	}
	25
	26	/** The repository's stop, if its last gates are all red on a base nothing has landed on since. */
	27	export function landingStopped(db: Database, repoId: string): Stopped \| undefined {
	28	const gates = db
	29	.query<{ state: string; finished_at: string; reason: string \| null; tests: string }, [string, number]>(
	30	"SELECT state, finished_at, reason, tests FROM gate_result WHERE repo_id = ?1 ORDER BY id DESC LIMIT ?2",
	31	)
	32	.all(repoId, STOPPED_GATES);
	33	if (gates.length < STOPPED_GATES \|\| gates.some((g) => g.state !== "red")) return undefined;
	34	if (!oneCause(gates)) return undefined;
	35	const since = gates.reduce((a, g) => (g.finished_at < a ? g.finished_at : a), gates[0]!.finished_at);
	36	const landed = db
	37	.query<{ at: string \| null }, [string]>(
	38	`SELECT MAX(p.merged_at) AS at FROM pull p JOIN issue i ON i.id = p.issue_id WHERE i.repo_id = ?1`,
	39	)
	40	.get(repoId);
	41	if (landed?.at != null && landed.at >= since) return undefined;
	42	return { since, gates: gates.length };
	43	}
	44
	45	/** The failing test names a gate row kept; a row this build cannot read names none. */
	46	function failingNames(tests: string): string[] {
	47	try {
	48	const list: unknown = JSON.parse(tests);
	49	if (!Array.isArray(list)) return [];
	50	return list.flatMap((t: unknown) =>
	51	typeof t === "object" && t !== null && typeof (t as { name?: unknown }).name === "string" ? [(t as { name: string }).name] : [],
	52	);
	53	} catch {
	54	return [];
	55	}
	56	}
	57
	58	/** Whether the red gates share one cause: a failing test in all, or no test named and one reason. */
	59	function oneCause(gates: readonly { reason: string \| null; tests: string }[]): boolean {
	60	const names = gates.map((g) => new Set(failingNames(g.tests)));
	61	if (names.every((n) => n.size === 0)) return gates.every((g) => g.reason !== null && g.reason === gates[0]!.reason);
	62	return [...names[0]!].some((n) => names.every((set) => set.has(n)));
	63	}
	64
	65	/** The stop, only for the forge's own repository: the one place the break-glass is offered. */
	66	export function ownLandingStopped(db: Database, repo: { readonly id: string }): Stopped \| undefined {
	67	const [owner, name] = ownRepoPath().split("/");
	68	const own = owner && name ? getRepo(db, owner, name) : undefined;
	69	return own !== undefined && own.id === repo.id ? landingStopped(db, own.id) : undefined;
	70	}
	71
	72	/** The one sentence home and the pipeline carry. */
	73	export const stoppedSentence = (s: Stopped): string =>
	74	`Landing has stopped: the last ${s.gates} gates were all red on the same base since ${s.since.slice(0, 16).replace("T", " ")} UTC, so no pull can pass; an owner can land one past the gate with a reason.`;
		@@ -70,6 +70,7 @@ const READER_KINDS: ReadonlySet<string> = new Set([
70	70	"pull.reopened",
71	71	"pull.opened",
72	72	"pull.merged",
	73	"pull.bypassed",
73	74	"issue.opened",
74	75	"spend.reported",
75	76	"forge.proposal",
		@@ -7,6 +7,7 @@
7	7	*/
8	8
9	9	import type { Database } from "bun:sqlite";
	10	import { landingStopped, stoppedSentence } from "../checks/gate_stopped.ts";
10	11	import { redHref, redMain } from "../checks/red_main.ts";
11	12	import { getRepo } from "../core/repos.ts";
12	13	import { ownRepoPath } from "../kernel/own_repo.ts";
		@@ -16,7 +17,7 @@ import { redMainAlarm } from "./alarm_red_main.ts";
16	17	import { alarmStuck } from "./alarm_stuck.ts";
17	18
18	19	export interface FiredAlarm {
19		readonly key: "red_main" \| "stuck" \| "idle_crew" \| "no_release";
	20	readonly key: "landing_stopped" \| "red_main" \| "stuck" \| "idle_crew" \| "no_release";
20	21	readonly says: string;
21	22	readonly since: string;
22	23	/** A same-origin path to the item the alarm names. */
		@@ -36,6 +37,10 @@ export function firedAlarms(
36	37	opts: { readonly publicOnly?: boolean; readonly ceilingUsd?: number \| null } = {},
37	38	): FiredAlarm[] {
38	39	const out: FiredAlarm[] = [];
	40	const [owner, name] = ownRepoPath().split("/");
	41	const own = owner && name ? getRepo(db, owner, name) : undefined;
	42	const stopped = own && !opts.publicOnly ? landingStopped(db, own.id) : undefined;
	43	if (stopped) out.push({ key: "landing_stopped", says: stoppedSentence(stopped), since: stopped.since, href: "/boards" });
39	44	const red = redMainAlarm(db, now);
40	45	if (red.fired) out.push({ key: "red_main", says: red.says, since: red.since!, href: redMainHref(db) });
41	46	const stuck = alarmStuck(db, now, opts.publicOnly ? { publicOnly: true } : {});
		@@ -71,6 +71,7 @@ export { tool as invites } from "./invites.ts";
71	71	export { tool as issue } from "./issue.ts";
72	72	export { tool as issue_teams } from "./issue_teams.ts";
73	73	export { tool as labels } from "./labels.ts";
	74	export { tool as land_past_gate } from "./land_past_gate.ts";
74	75	export { tool as limb } from "./limb.ts";
75	76	export { tool as limits } from "./limits.ts";
76	77	export { tool as make_it_yours } from "./make_it_yours.ts";