From 499e2a40f6357b3675f0b30577428f7e33b81029 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 00:38:08 +1100
Subject: [PATCH 01/15] feat(github): show pull request state as the icon of PR
 links in messages

GitHub pull request links in messages rendered the Links plugin's static
octocat. The GitHub plugin now contributes a `LinkRenderer` (order -1, below
Links' default band) for `kind === "pull"` URLs that reuses Links' `LinkLabel`
with the pull request's state glyph: open (success), draft and closed
(subtle), merged (categorical purple). The plain pull request glyph shows
until the state is read, and when it cannot be, so the icon never swaps.
Repositories, issues and commits stay with Links, which also stands in when
the plugin is disabled or the renderer fails.

The batched, visibility-aware state poller moves out of `createSoloPulls`
into a URL-keyed `createPullStates(gh)` store shared by every session's
sidebar and every inline link, so one pull request shown in both costs one
read. Merged stays terminal, closed is read at the slow five-minute cadence,
and without `gh` each pull request is read from the public API once. The
state icons, words and tone move to `pull-state-view.ts` so the sidebar,
panel and inline link agree; closed stays grey on all three.

`LinkLabel` gains an optional `icon` override. Docs and the plugin README
note the renderer and that Links remains the fallback.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/plugin-architecture.md            |   8 +-
 src/bundled/github/GitHub.module.css   |  13 +-
 src/bundled/github/PullLink.test.tsx   | 200 +++++++++++++++++++
 src/bundled/github/PullLink.tsx        |  34 ++++
 src/bundled/github/README.md           |   4 +-
 src/bundled/github/SoloPull.test.tsx   |   6 +-
 src/bundled/github/SoloPull.tsx        |  39 +---
 src/bundled/github/index.tsx           |  28 ++-
 src/bundled/github/pull-state-view.ts  |  44 ++++
 src/bundled/github/pull-states.test.ts | 262 ++++++++++++++++++++++++
 src/bundled/github/pull-states.ts      | 266 +++++++++++++++++++++++++
 src/bundled/github/solo-pull.test.ts   | 245 +++--------------------
 src/bundled/github/solo-pull.ts        | 259 +++++-------------------
 src/bundled/links/InlineLink.test.tsx  |  19 ++
 src/bundled/links/InlineLink.tsx       |  10 +-
 15 files changed, 957 insertions(+), 480 deletions(-)
 create mode 100644 src/bundled/github/PullLink.test.tsx
 create mode 100644 src/bundled/github/PullLink.tsx
 create mode 100644 src/bundled/github/pull-state-view.ts
 create mode 100644 src/bundled/github/pull-states.test.ts
 create mode 100644 src/bundled/github/pull-states.ts

diff --git a/docs/plugin-architecture.md b/docs/plugin-architecture.md
index 57cf83bc34..a5d214d692 100644
--- a/docs/plugin-architecture.md
+++ b/docs/plugin-architecture.md
@@ -1399,7 +1399,13 @@ does not fetch metadata or infer a service from names in paths or query strings.
 Its `order` is a function: recognised services and Buzz entities claim the default
 band, the globe case the catch-all band, so a renderer dedicated to one website
 wins it at the default.
-It does not fetch titles. Messages currently recognize
+It does not fetch titles. The bundled GitHub plugin contributes a pull request
+renderer at a lower `order` for github.com pull request URLs: the same label
+with the pull request's state (open, draft, merged, closed) as a coloured icon,
+read with the person's `gh` sign-in or the public API and kept current while
+shown. Repositories, issues and commits, and every pull request link when that
+plugin is disabled or its renderer fails, keep the Links presentation.
+Messages currently recognize
 credential-free HTTP(S) and supported Buzz links. Markdown labels preserve their
 formatting, escaped pasted wrappers are normalized outside code, and paired `<…>`
 autolink wrappers are hidden in display. Buzz links use known channel names with corresponding icons, falling back
diff --git a/src/bundled/github/GitHub.module.css b/src/bundled/github/GitHub.module.css
index 667e23a4fc..fa8116b14e 100644
--- a/src/bundled/github/GitHub.module.css
+++ b/src/bundled/github/GitHub.module.css
@@ -393,9 +393,17 @@
   justify-content: center;
   width: var(--space-5);
   flex: 0 0 var(--space-5);
+}
+/* The sidebar's icon and a message link's icon take one colour per state, as
+   the panel's chip above does; a link's text stays a link. Draft, closed and
+   not yet read are quiet: closed is not red here. Only the sidebar shows an
+   open one's checks and conflicts. */
+.soloPull,
+.pullState {
   color: var(--text-subtle);
 }
-.soloPull[data-tone="open"] {
+.soloPull[data-tone="open"],
+.pullState[data-pr-state="open"] {
   color: var(--text-success);
 }
 .soloPull[data-tone="failure"] {
@@ -404,7 +412,8 @@
 .soloPull[data-tone="pending"] {
   color: var(--text-warning);
 }
-.soloPull[data-tone="merged"] {
+.soloPull[data-tone="merged"],
+.pullState[data-pr-state="merged"] {
   color: var(--text-categorical-purple);
 }
 .soloLink {
diff --git a/src/bundled/github/PullLink.test.tsx b/src/bundled/github/PullLink.test.tsx
new file mode 100644
index 0000000000..43d9b19213
--- /dev/null
+++ b/src/bundled/github/PullLink.test.tsx
@@ -0,0 +1,200 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { afterEach, expect, it, vi } from "vitest";
+import type { Contribution } from "../../plugins/contributions";
+import type { LinkRenderer } from "../../features/conversation/contracts";
+import { LinkLabelContext } from "../../features/conversation/LinkLabelContext";
+import {
+  MessageLink,
+  resolveLink,
+} from "../../features/conversation/MessageLink";
+import { ToastProvider } from "../../shared/design-system/ui/Toast";
+import inlineStyles from "../../shared/InlineReference.module.css";
+import { apply as applyLinks } from "../links/index";
+import { apply } from "./index";
+import { PullLink } from "./PullLink";
+import { stateIcons } from "./pull-state-view";
+import type { PullState, PullStates } from "./pull-states";
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+const pull = "https://github.com/block/buzz-app/pull/7";
+
+/** A store the test moves by hand. */
+function fakeStates(initial?: PullState | "failed") {
+  let value = initial;
+  const listeners = new Set<() => void>();
+  const unwatch = vi.fn();
+  return {
+    watch: vi.fn((_url: string, listener: () => void) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+        unwatch();
+      };
+    }),
+    get: () => value,
+    unwatch,
+    set(next: PullState | "failed" | undefined) {
+      value = next;
+      for (const listener of listeners) listener();
+    },
+  } satisfies PullStates & Record<string, unknown>;
+}
+const glyph = (Icon: (typeof stateIcons)[keyof typeof stateIcons]) =>
+  renderToStaticMarkup(
+    <Icon aria-hidden="true" className={inlineStyles.icon} />,
+  );
+const icon = (container: HTMLElement) =>
+  container.querySelector("[data-pr-state]");
+
+it("shows the authored label with the plain pull request glyph until read, then each state's own", () => {
+  const states = fakeStates();
+  const { container } = render(
+    <LinkLabelContext value="fix(search): tokens">
+      <PullLink url={pull} states={states} />
+    </LinkLabelContext>,
+  );
+  expect(container).toHaveTextContent("fix(search): tokens");
+  expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
+  expect(icon(container)).toHaveAttribute("title", "Pull request");
+  expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
+  for (const [state, words] of [
+    [
+      { state: "open", checks: "pending" },
+      "Pull request, open, checks running",
+    ],
+    [{ state: "draft", conflicts: true }, "Pull request, draft, conflicts"],
+    [{ state: "merged" }, "Pull request, merged"],
+    [{ state: "closed" }, "Pull request, closed"],
+  ] as const) {
+    act(() => states.set(state));
+    expect(icon(container)).toHaveAttribute("data-pr-state", state.state);
+    expect(icon(container)).toHaveAttribute("title", words);
+    expect(icon(container)?.innerHTML).toBe(glyph(stateIcons[state.state]));
+  }
+  // One GitHub cannot read keeps the plain glyph, and says so.
+  act(() => states.set("failed"));
+  expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
+  expect(icon(container)).toHaveAttribute("title", "Pull request, unavailable");
+  expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
+});
+
+it("watches the pull request only while shown", () => {
+  const states = fakeStates({ state: "open" });
+  const { unmount } = render(<PullLink url={pull} states={states} />);
+  expect(states.watch).toHaveBeenCalledWith(pull, expect.any(Function));
+  expect(states.watch).toHaveBeenCalledOnce();
+  unmount();
+  expect(states.unwatch).toHaveBeenCalledOnce();
+});
+
+/** Both bundled renderers, registered as the host would hold them. */
+function renderers() {
+  const found: Contribution<LinkRenderer>[] = [];
+  const register = (pluginId: string) => (renderer: LinkRenderer) => {
+    found.push({
+      ...renderer,
+      key: `${pluginId}/${renderer.id}`,
+      pluginId,
+      revision: "one",
+    });
+  };
+  applyLinks({
+    conversation: { registerLink: register("buzz.links") },
+  } as never);
+  apply({
+    host: {},
+    panels: { register: () => {} },
+    conversation: {
+      registerChatIcon: () => {},
+      registerChatMenu: () => {},
+      registerLink: register("buzz.github"),
+    },
+    relay: {},
+    agents: { addTool: () => {} },
+    inject: () => {},
+  } as never);
+  const [links, github] = found;
+  if (!links || !github) throw new Error("expected both renderers");
+  return { links, github };
+}
+const registry = (entries: readonly Contribution<LinkRenderer>[]) => ({
+  snapshot: () => entries,
+  subscribe: () => () => {},
+});
+const message = (entries: readonly Contribution<LinkRenderer>[]) =>
+  render(
+    <ToastProvider>
+      <MessageLink
+        url={pull}
+        registry={registry(entries)}
+        onOpenLink={() => true}
+        label="Fix the lab"
+      />
+    </ToastProvider>,
+  );
+
+it("takes pull request links from Links, which keeps the rest of GitHub and stands in without it", async () => {
+  const { links, github } = renderers();
+  expect(resolveLink(pull, [links, github])).toBe(github);
+  expect(
+    resolveLink("https://github.com/block/buzz-app", [github, links]),
+  ).toBe(links);
+  expect(
+    resolveLink("https://github.com/block/buzz-app/issues/7", [github, links]),
+  ).toBe(links);
+  expect(resolveLink(`${pull}#issuecomment-1`, [github, links])).toBe(links);
+
+  // Without gh in this host, the state comes from the public API.
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => new Response(JSON.stringify({ state: "open" }))),
+  );
+  const both = message([links, github]);
+  const anchor = screen.getByRole("link", { name: "Fix the lab" });
+  expect(anchor).toHaveAttribute("href", pull);
+  expect(anchor).toHaveAttribute("data-link-renderer", "buzz.github/pull");
+  expect(anchor.className).toBe(inlineStyles.link);
+  expect(icon(both.container)).toHaveAttribute("data-pr-state", "unknown");
+  await waitFor(() =>
+    expect(icon(both.container)).toHaveAttribute("data-pr-state", "open"),
+  );
+  cleanup();
+
+  const only = message([links]);
+  expect(screen.getByRole("link")).toHaveAttribute(
+    "data-link-renderer",
+    "buzz.links/links",
+  );
+  expect(icon(only.container)).toBeNull();
+  expect(only.container.querySelector("[data-link-kind]")).toHaveAttribute(
+    "data-link-kind",
+    "github",
+  );
+});
+
+it("leaves the plain link when the renderer fails", () => {
+  const { links, github } = renderers();
+  const broken = {
+    ...github,
+    component: () => {
+      throw new Error("broken renderer");
+    },
+  };
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  try {
+    const { container } = message([links, broken]);
+    const anchor = screen.getByRole("link", { name: "Fix the lab" });
+    expect(anchor).toHaveAttribute("href", pull);
+    expect(anchor).not.toHaveAttribute("data-link-renderer");
+    expect(container.querySelector("[data-link-kind]")).toBeNull();
+  } finally {
+    error.mockRestore();
+  }
+});
diff --git a/src/bundled/github/PullLink.tsx b/src/bundled/github/PullLink.tsx
new file mode 100644
index 0000000000..a081c07bc3
--- /dev/null
+++ b/src/bundled/github/PullLink.tsx
@@ -0,0 +1,34 @@
+import { useCallback, useSyncExternalStore } from "react";
+import { LinkLabel } from "../links/InlineLink";
+import inlineStyles from "../../shared/InlineReference.module.css";
+import { describePull, stateIcons } from "./pull-state-view";
+import type { PullStates } from "./pull-states";
+import styles from "./GitHub.module.css";
+
+/** A pull request link in a message: the Links label with the pull request's
+ * state as its icon, in place of the GitHub logo. */
+export function PullLink({ url, states }: { url: string; states: PullStates }) {
+  const subscribe = useCallback(
+    (listener: () => void) => states.watch(url, listener),
+    [states, url],
+  );
+  const read = useSyncExternalStore(subscribe, () => states.get(url));
+  const state = typeof read === "object" ? read : undefined;
+  // The plain pull request glyph until read, and when it can't be, so the
+  // icon doesn't swap when the state arrives.
+  const Icon = stateIcons[state?.state ?? "open"];
+  return (
+    <LinkLabel
+      href={url}
+      icon={
+        <span
+          className={styles.pullState}
+          data-pr-state={state?.state ?? "unknown"}
+          title={describePull({ state, failed: read === "failed" })}
+        >
+          <Icon aria-hidden="true" className={inlineStyles.icon} />
+        </span>
+      }
+    />
+  );
+}
diff --git a/src/bundled/github/README.md b/src/bundled/github/README.md
index 521ab43d2f..c63c058da8 100644
--- a/src/bundled/github/README.md
+++ b/src/bundled/github/README.md
@@ -4,6 +4,8 @@ Preview GitHub repositories, pull requests, issues, and commits without leaving
 
 ## Getting started
 
-1. Click a github.com link in a conversation to open it in a side panel.
+1. Pull request links in messages show the pull request's state as their
+   icon, kept current while shown. Click any github.com link to open it in a
+   side panel.
 2. On a pull request, switch between **Discussion** and **Checks**.
 3. Choose **Open on GitHub** to see the full page.
diff --git a/src/bundled/github/SoloPull.test.tsx b/src/bundled/github/SoloPull.test.tsx
index 289641739f..def6085028 100644
--- a/src/bundled/github/SoloPull.test.tsx
+++ b/src/bundled/github/SoloPull.test.tsx
@@ -165,7 +165,11 @@ it("gives agents a github_link_pr tool for the Solo chat they work in", async ()
   apply({
     host: {},
     panels: { register: () => {} },
-    conversation: { registerChatIcon: () => {}, registerChatMenu: () => {} },
+    conversation: {
+      registerChatIcon: () => {},
+      registerChatMenu: () => {},
+      registerLink: () => {},
+    },
     relay,
     agents: {
       addTool: (added: AddedTool) => {
diff --git a/src/bundled/github/SoloPull.tsx b/src/bundled/github/SoloPull.tsx
index 9df44266a3..fa1bab0831 100644
--- a/src/bundled/github/SoloPull.tsx
+++ b/src/bundled/github/SoloPull.tsx
@@ -1,10 +1,4 @@
 import { useCallback, useState, useSyncExternalStore } from "react";
-import {
-  CircleDashedIcon,
-  GitMergeIcon,
-  GitPullRequestIcon,
-  XCircleIcon,
-} from "../../shared/design-system/icons/index";
 import { MenuItem } from "../../shared/design-system/ui/Menu";
 import { useToastNotification } from "../../shared/design-system/ui/Toast";
 import { Button } from "../../shared/design-system/ui/Button";
@@ -13,37 +7,10 @@ import type { RelayData } from "../../features/relay/service";
 import type { RelaySession } from "../../features/relay/session";
 import { useChannelList } from "../../features/relay/react";
 import { ownSolo } from "../../features/solo/labels";
-import { writeLink, type SoloPull, type SoloPulls } from "./solo-pull";
+import { writeLink, type SoloPulls } from "./solo-pull";
+import { describePull, pullTone, stateIcons } from "./pull-state-view";
 import styles from "./GitHub.module.css";
 
-export const stateIcons = {
-  open: GitPullRequestIcon,
-  draft: CircleDashedIcon,
-  closed: XCircleIcon,
-  merged: GitMergeIcon,
-};
-
-/** The words for what the icon shows. */
-export function describePull({ state, failed }: SoloPull) {
-  if (failed) return "Pull request, unavailable";
-  if (!state) return "Pull request";
-  const notes = [state.state === "draft" ? "draft" : state.state];
-  if (state.state === "open" || state.state === "draft") {
-    if (state.checks === "failure") notes.push("checks failing");
-    if (state.checks === "pending") notes.push("checks running");
-    if (state.conflicts) notes.push("conflicts");
-  }
-  return `Pull request, ${notes.join(", ")}`;
-}
-
-/** The tone a linked pull request shows: whether it needs attention. */
-function toneOf({ state }: SoloPull) {
-  if (!state) return "unknown";
-  if (state.state !== "open") return state.state;
-  if (state.checks === "failure" || state.conflicts) return "failure";
-  return state.checks === "pending" ? "pending" : "open";
-}
-
 /** A Solo chat's linked pull request in place of its chat icon. */
 export function SoloPullIcon({
   pulls,
@@ -54,7 +21,7 @@ export function SoloPullIcon({
   if (!pull) return fallback;
   const Icon = stateIcons[pull.state?.state ?? "open"];
   return (
-    <span className={styles.soloPull} data-tone={toneOf(pull)}>
+    <span className={styles.soloPull} data-tone={pullTone(pull)}>
       <Icon size={16} aria-hidden="true" />
       <span className="sr-only">{describePull(pull)}: </span>
     </span>
diff --git a/src/bundled/github/index.tsx b/src/bundled/github/index.tsx
index 89429c9dd4..f9c672e705 100644
--- a/src/bundled/github/index.tsx
+++ b/src/bundled/github/index.tsx
@@ -29,12 +29,10 @@ import { relativeTimestamp } from "../../shared/relative-timestamp";
 import type { RelaySession } from "../../features/relay/session";
 import { ownSolo } from "../../features/solo/labels";
 import { createSoloPulls, writeLink, type SoloPulls } from "./solo-pull";
-import {
-  SoloPullIcon,
-  SoloPullLink,
-  SoloPullMenu,
-  stateIcons,
-} from "./SoloPull";
+import { createPullStates } from "./pull-states";
+import { stateIcons } from "./pull-state-view";
+import { PullLink } from "./PullLink";
+import { SoloPullIcon, SoloPullLink, SoloPullMenu } from "./SoloPull";
 import { watchPulls } from "./watcher";
 import { SubmitReview } from "./SubmitReview";
 
@@ -44,11 +42,15 @@ export const REFRESH_MS = 30_000;
 export const inject = ["panels", "host", "conversation", "relay", "agents"];
 export const apply: PluginModule["apply"] = (ctx) => {
   const gh = gitHubCli(ctx.host);
+  // A pull request's state is nobody's community's: one store serves every
+  // session's sidebar and every link in messages, so one shown in both costs
+  // one read.
+  const states = createPullStates(gh);
   const pulls = new WeakMap<RelaySession, SoloPulls>();
   const pullsFor = (session: RelaySession) => {
     let found = pulls.get(session);
     if (!found) {
-      found = createSoloPulls(session, gh);
+      found = createSoloPulls(session, states);
       pulls.set(session, found);
     }
     return found;
@@ -91,6 +93,18 @@ export const apply: PluginModule["apply"] = (ctx) => {
       );
     },
   });
+  ctx.conversation.registerLink({
+    id: "pull",
+    title: "Pull request state",
+    matches: (url) => parseGitHubReference(url)?.kind === "pull",
+    // Links claims GitHub at the default band, 0, and a tie falls to the
+    // contribution key; only a lower order makes this the pull request
+    // renderer whichever plugin registered first. Repositories, issues and
+    // commits stay with Links.
+    order: -1,
+    className: inlineStyles.link,
+    component: ({ url }) => <PullLink url={url} states={states} />,
+  });
   ctx.conversation.registerChatMenu(({ session, channelId }) => (
     <SoloPullMenu
       session={session}
diff --git a/src/bundled/github/pull-state-view.ts b/src/bundled/github/pull-state-view.ts
new file mode 100644
index 0000000000..67aeede9e4
--- /dev/null
+++ b/src/bundled/github/pull-state-view.ts
@@ -0,0 +1,44 @@
+// How a pull request's state looks and reads, the same in the sidebar, the
+// panel and links in messages.
+import {
+  CircleDashedIcon,
+  GitMergeIcon,
+  GitPullRequestIcon,
+  XCircleIcon,
+} from "../../shared/design-system/icons/index";
+import type { PullState } from "./pull-states";
+
+export const stateIcons = {
+  open: GitPullRequestIcon,
+  draft: CircleDashedIcon,
+  closed: XCircleIcon,
+  merged: GitMergeIcon,
+};
+
+type Read = Readonly<{
+  state?: PullState | undefined;
+  /** It could not be read. */
+  failed?: boolean | undefined;
+}>;
+
+/** The words for what the icon shows. */
+export function describePull({ state, failed }: Read) {
+  if (failed) return "Pull request, unavailable";
+  if (!state) return "Pull request";
+  const notes = [state.state === "draft" ? "draft" : state.state];
+  if (state.state === "open" || state.state === "draft") {
+    if (state.checks === "failure") notes.push("checks failing");
+    if (state.checks === "pending") notes.push("checks running");
+    if (state.conflicts) notes.push("conflicts");
+  }
+  return `Pull request, ${notes.join(", ")}`;
+}
+
+/** The tone a pull request shows: its state, or whether an open one needs
+ * attention. */
+export function pullTone({ state }: Read) {
+  if (!state) return "unknown";
+  if (state.state !== "open") return state.state;
+  if (state.checks === "failure" || state.conflicts) return "failure";
+  return state.checks === "pending" ? "pending" : "open";
+}
diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
new file mode 100644
index 0000000000..d189d41e0c
--- /dev/null
+++ b/src/bundled/github/pull-states.test.ts
@@ -0,0 +1,262 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from "vitest";
+import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
+import {
+  createPullStates,
+  PULL_REFRESH_MS,
+  PULL_SLOW_REFRESH_MS,
+} from "./pull-states";
+
+const pull = "https://github.com/block/buzz-app/pull/7";
+const second = "https://github.com/block/buzz/pull/9";
+const third = "https://github.com/block/goose/pull/3";
+
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+
+const rollup = (
+  state: string,
+  extra: Record<string, unknown> = {},
+  checks?: string,
+) => ({
+  pullRequest: {
+    state,
+    isDraft: false,
+    mergeStateStatus: "CLEAN",
+    commits: {
+      nodes: [
+        { commit: { statusCheckRollup: checks ? { state: checks } : null } },
+      ],
+    },
+    ...extra,
+  },
+});
+const mockGh = (implementation: (...args: never[]) => unknown) =>
+  vi.fn(implementation) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
+
+it("reads every watched pull request together, once, then again each minute while watched", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => ({
+    r0: rollup("OPEN", { mergeStateStatus: "DIRTY" }, "FAILURE"),
+    r1: rollup("MERGED"),
+  }));
+  const states = createPullStates(gh);
+  const changed = [vi.fn(), vi.fn(), vi.fn()] as const;
+  const stop = [
+    states.watch(pull, changed[0]),
+    states.watch(pull, changed[1]),
+    states.watch(second, changed[2]),
+  ];
+  await vi.waitFor(() => expect(states.get(second)).toBeDefined());
+  // Two links to one pull request cost one read, and both hear of it.
+  expect(gh).toHaveBeenCalledOnce();
+  expect(gh.mock.calls[0]?.[1]).toEqual({
+    o0: "block",
+    n0: "buzz-app",
+    p0: 7,
+    o1: "block",
+    n1: "buzz",
+    p1: 9,
+  });
+  for (const listener of changed) expect(listener).toHaveBeenCalledOnce();
+  expect(states.get(pull)).toEqual({
+    state: "open",
+    checks: "failure",
+    conflicts: true,
+  });
+  expect(states.get(pull)).toBe(states.get(pull));
+  expect(states.get(second)).toEqual({ state: "merged", conflicts: false });
+
+  // Only the open one is polled: a merged pull request stays that way.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(gh.mock.calls[1]?.[1]).toEqual({ o0: "block", n0: "buzz-app", p0: 7 });
+  for (const unwatch of stop) unwatch();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS * 3);
+  expect(gh).toHaveBeenCalledTimes(2);
+});
+
+it("keeps what it read for a pull request watched again within the minute", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => ({ r0: rollup("OPEN", {}, "SUCCESS") }));
+  const states = createPullStates(gh);
+  const unwatch = states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toBeDefined());
+  unwatch();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  // A row that scrolls out and back shows its state at once, unread.
+  states.watch(pull, () => {});
+  await vi.advanceTimersByTimeAsync(0);
+  expect(states.get(pull)).toEqual({
+    state: "open",
+    checks: "success",
+    conflicts: false,
+  });
+  expect(gh).toHaveBeenCalledOnce();
+  // The poll keeps its original time.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(gh).toHaveBeenCalledTimes(2);
+});
+
+it("leaves an unreadable pull request out of the shared query, trying it alone every 5 minutes", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  // GitHub answers the pull requests it can read and an error for the rest.
+  const gh = mockGh(
+    async (_query: string, variables: Record<string, unknown>) => {
+      const data: Record<string, unknown> = {};
+      let missing = false;
+      for (let i = 0; `n${i}` in variables; i++)
+        if (variables[`n${i}`] === "buzz") {
+          data[`r${i}`] = null;
+          missing = true;
+        } else data[`r${i}`] = rollup("OPEN", { isDraft: true }, "PENDING");
+      if (missing) throw new GitHubError("Not found", "NOT_FOUND", data);
+      return data;
+    },
+  );
+  const states = createPullStates(gh);
+  for (const url of [pull, second, third]) states.watch(url, () => {});
+  await vi.waitFor(() => expect(states.get(second)).toBe("failed"));
+  expect(gh).toHaveBeenCalledOnce();
+  expect(states.get(pull)).toEqual({
+    state: "draft",
+    checks: "pending",
+    conflicts: false,
+  });
+  const repositories = () =>
+    gh.mock.calls.map(([, variables]) =>
+      Object.entries(variables as Record<string, unknown>)
+        .filter(([key]) => key.startsWith("n"))
+        .map(([, name]) => name),
+    );
+  // Four minutes of polls: the two readable ones together, once a minute.
+  await vi.advanceTimersByTimeAsync(4 * PULL_REFRESH_MS);
+  expect(repositories().slice(1)).toEqual(
+    Array.from({ length: 4 }, () => ["buzz-app", "goose"]),
+  );
+  // The fifth also tries the missing one, alone.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(repositories().slice(5)).toEqual([["buzz-app", "goose"], ["buzz"]]);
+  expect(states.get(second)).toBe("failed");
+});
+
+it("reads a closed pull request, which can reopen, again every few minutes rather than every minute", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = vi
+    .fn()
+    .mockResolvedValueOnce({ r0: rollup("CLOSED") })
+    .mockResolvedValue({
+      r0: rollup("OPEN", {}, "SUCCESS"),
+    }) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
+  const states = createPullStates(gh);
+  states.watch(pull, () => {});
+  await vi.waitFor(() =>
+    expect(states.get(pull)).toMatchObject({ state: "closed" }),
+  );
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledOnce();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(states.get(pull)).toMatchObject({ state: "open" });
+  // Open again, it is polled every minute.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(3);
+});
+
+it("reads public data once without gh, never on a timer", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi.fn(
+    async () => new Response(JSON.stringify({ title: "A", state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "open" }));
+  expect(fetch).toHaveBeenCalledWith(
+    "https://api.github.com/repos/block/buzz-app/pulls/7",
+    expect.anything(),
+  );
+  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledOnce();
+});
+
+it("reads public data while gh is unavailable, and goes back to gh once it is available again", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => new Response(JSON.stringify({ state: "open" }))),
+  );
+  let signedIn = false;
+  const gh = mockGh(async () => {
+    if (!signedIn) throw new GhUnavailable();
+    return { r0: rollup("OPEN", {}, "SUCCESS") };
+  });
+  const states = createPullStates(gh);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "open" }));
+  // Public reads are sparse: the next one, with gh back, is in five minutes.
+  signedIn = true;
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledOnce();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(states.get(pull)).toMatchObject({ checks: "success" });
+});
+
+it("keeps a refresh that was given up on from marking pull requests unavailable", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  let answer: (value: unknown) => void = () => {};
+  const gh = mockGh(
+    (_query: string, _variables: unknown, signal?: AbortSignal) =>
+      new Promise((resolve, reject) => {
+        answer = resolve;
+        signal?.addEventListener("abort", () => reject(signal.reason));
+      }),
+  );
+  const states = createPullStates(gh);
+  const unwatch = states.watch(pull, () => {});
+  await vi.waitFor(() => expect(gh).toHaveBeenCalledOnce());
+  // The last row goes away mid-read, then comes back.
+  unwatch();
+  await vi.advanceTimersByTimeAsync(0);
+  states.watch(pull, () => {});
+  expect(states.get(pull)).toBeUndefined();
+  await vi.waitFor(() => expect(gh).toHaveBeenCalledTimes(2));
+  answer({ r0: rollup("OPEN", {}, "SUCCESS") });
+  await vi.waitFor(() =>
+    expect(states.get(pull)).toMatchObject({ checks: "success" }),
+  );
+});
+
+it("keeps what a timed-out refresh read, and marks what it could not", async () => {
+  const deadline = new AbortController();
+  vi.spyOn(AbortSignal, "timeout").mockReturnValue(deadline.signal);
+  let started = 0;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (input: string, init?: RequestInit) => {
+      started++;
+      if (input.includes("/buzz-app/"))
+        return new Response(JSON.stringify({ state: "open" }));
+      // The other never answers before the deadline.
+      return new Promise<Response>((_, reject) =>
+        init?.signal?.addEventListener("abort", () =>
+          reject(init.signal?.reason),
+        ),
+      );
+    }),
+  );
+  const states = createPullStates(undefined);
+  states.watch(pull, () => {});
+  states.watch(second, () => {});
+  await vi.waitFor(() => expect(started).toBe(2));
+  try {
+    deadline.abort(new DOMException("Timed out", "TimeoutError"));
+    await vi.waitFor(() => expect(states.get(second)).toBe("failed"));
+    expect(states.get(pull)).toEqual({ state: "open" });
+  } finally {
+    vi.restoreAllMocks();
+  }
+});
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
new file mode 100644
index 0000000000..55344e0ef5
--- /dev/null
+++ b/src/bundled/github/pull-states.ts
@@ -0,0 +1,266 @@
+// The state of every pull request shown somewhere in the app, read together
+// and kept current while shown.
+import { loadGitHubDetails } from "./data";
+import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
+import { parseGitHubReference } from "./references";
+
+/** How often shown pull requests that can change are read again. */
+export const PULL_REFRESH_MS = 60_000;
+/** Without `gh`, GitHub allows 60 public reads an hour. A pull request `gh`
+ * could not read is tried again alone this often, and a closed one, which
+ * rarely reopens, is read again this often too. */
+export const PULL_SLOW_REFRESH_MS = 5 * 60_000;
+
+export type PullState = Readonly<{
+  state: "open" | "draft" | "merged" | "closed";
+  /** The head commit's combined checks, when read with `gh`. */
+  checks?: "success" | "failure" | "pending" | undefined;
+  conflicts?: boolean | undefined;
+}>;
+
+export type PullStates = Readonly<{
+  /** Keeps `url`'s state current while subscribed. */
+  watch(url: string, listener: () => void): () => void;
+  /** Its state, `"failed"` when it could not be read, or undefined before
+   * the first read. */
+  get(url: string): PullState | "failed" | undefined;
+}>;
+
+type Rollup = "SUCCESS" | "FAILURE" | "ERROR" | "PENDING" | "EXPECTED";
+type StateData = {
+  pullRequest?: {
+    state: "OPEN" | "CLOSED" | "MERGED";
+    isDraft: boolean;
+    mergeStateStatus?: string;
+    commits?: {
+      nodes?: ({
+        commit?: { statusCheckRollup?: { state?: Rollup } | null };
+      } | null)[];
+    };
+  } | null;
+} | null;
+
+const checksOf = (rollup: Rollup | undefined): PullState["checks"] =>
+  rollup === "SUCCESS"
+    ? "success"
+    : rollup === "FAILURE" || rollup === "ERROR"
+      ? "failure"
+      : rollup
+        ? "pending"
+        : undefined;
+
+/** All of `urls` in one GitHub request: each one's state, or undefined for
+ * one GitHub could not read. Throws when it answered for none. */
+async function readStates(
+  gh: GitHubCli,
+  urls: readonly string[],
+  signal: AbortSignal,
+) {
+  const variables: Record<string, string | number> = {};
+  const fields = urls.map((url, i) => {
+    const reference = parseGitHubReference(url);
+    const [owner = "", name = ""] = reference?.repository.split("/") ?? [];
+    variables[`o${i}`] = owner;
+    variables[`n${i}`] = name;
+    variables[`p${i}`] = Number(url.split("/").at(-1));
+    return `r${i}:repository(owner:$o${i},name:$n${i}){pullRequest(number:$p${i}){
+      state isDraft mergeStateStatus commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}`;
+  });
+  const declared = urls
+    .map((_, i) => `$o${i}:String!,$n${i}:String!,$p${i}:Int!`)
+    .join(",");
+  let data: Record<string, StateData>;
+  try {
+    data = await gh<Record<string, StateData>>(
+      `query(${declared}){${fields.join("\n")}}`,
+      variables,
+      signal,
+    );
+  } catch (error) {
+    // A missing pull request is an error for its alias alone; GitHub still
+    // answers the rest.
+    if (!(error instanceof GitHubError) || typeof error.data !== "object")
+      throw error;
+    data = error.data as Record<string, StateData>;
+  }
+  return urls.map((_, i): PullState | undefined => {
+    const pull = data[`r${i}`]?.pullRequest;
+    if (!pull) return undefined;
+    return {
+      state:
+        pull.state === "MERGED"
+          ? "merged"
+          : pull.state === "CLOSED"
+            ? "closed"
+            : pull.isDraft
+              ? "draft"
+              : "open",
+      checks: checksOf(
+        pull.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state,
+      ),
+      conflicts: pull.mergeStateStatus === "DIRTY",
+    };
+  });
+}
+
+async function readPublicState(
+  url: string,
+  signal: AbortSignal,
+): Promise<PullState | undefined> {
+  const reference = parseGitHubReference(url);
+  if (!reference) return undefined;
+  const { state } = await loadGitHubDetails(reference, signal);
+  return {
+    state:
+      state === "Merged"
+        ? "merged"
+        : state === "closed"
+          ? "closed"
+          : state === "Draft"
+            ? "draft"
+            : "open",
+  };
+}
+
+/** The app's pull request states, read with `gh` when there is one.
+ *
+ * A pull request is read once for every subscriber that appears together,
+ * then polled only while shown, visible and able to change: a merged one is
+ * never read again, a closed one every few minutes. One that GitHub cannot
+ * read leaves the shared query and is tried alone every few minutes. Without
+ * `gh`, each is read from the public API once; the panel has the live view. */
+export function createPullStates(gh: GitHubCli | undefined): PullStates {
+  const listeners = new Map<string, Set<() => void>>();
+  const states = new Map<string, PullState | "failed">();
+  /** When each read pull request is read again; never for a settled one. */
+  const nextRead = new Map<string, number>();
+  /** Until when to read public data instead, after `gh` was unavailable. */
+  let publicUntil = 0;
+  const readsPublic = () => !gh || Date.now() < publicUntil;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let controller: AbortController | undefined;
+  let scheduled = false;
+  const notify = () => {
+    for (const set of listeners.values())
+      for (const listener of set) listener();
+  };
+  const dueAt = (url: string) => nextRead.get(url) ?? 0;
+  /** When `state`, read now, is read again. */
+  const again = (state: PullState | undefined, now: number) => {
+    if (!gh || state?.state === "merged") return Infinity;
+    return !state || state.state === "closed" || readsPublic()
+      ? now + PULL_SLOW_REFRESH_MS
+      : now + PULL_REFRESH_MS;
+  };
+  /** The next poll, when a shown pull request is next due. A hidden window
+   * looks again later rather than reading. */
+  const later = (atLeast = 0) => {
+    clearTimeout(timer);
+    timer = undefined;
+    const due = Math.min(...[...listeners.keys()].map(dueAt));
+    if (due === Infinity) return;
+    timer = setTimeout(
+      () =>
+        document.visibilityState === "visible"
+          ? void refresh()
+          : later(PULL_REFRESH_MS),
+      Math.max(atLeast, due - Date.now()),
+    );
+  };
+  /** Reads every shown pull request that is due. */
+  async function refresh() {
+    controller?.abort();
+    const current = new AbortController();
+    controller = current;
+    clearTimeout(timer);
+    timer = undefined;
+    const signal = AbortSignal.any([
+      current.signal,
+      AbortSignal.timeout(30_000),
+    ]);
+    try {
+      const now = Date.now();
+      const due = [...listeners.keys()].filter((url) => dueAt(url) <= now);
+      if (!due.length) return;
+      const together = due.filter((url) => states.get(url) !== "failed");
+      const alone = due.filter((url) => states.get(url) === "failed");
+      const [found, retried] = await Promise.all([
+        readAll(together, signal),
+        Promise.all(
+          alone.map((url) =>
+            readAll([url], signal).then(
+              ([state]) => state,
+              () => undefined,
+            ),
+          ),
+        ),
+      ]);
+      // One that timed out still records what it read, and what it could not.
+      if (current.signal.aborted) return;
+      const read = (url: string, state: PullState | undefined) => {
+        states.set(url, state ?? "failed");
+        nextRead.set(url, again(state, now));
+      };
+      for (const [i, url] of together.entries()) read(url, found[i]);
+      for (const [i, url] of alone.entries()) read(url, retried[i]);
+      notify();
+    } catch {
+      // Keep what is shown; the next refresh tries again.
+    } finally {
+      if (controller === current) {
+        controller = undefined;
+        if (listeners.size) later();
+      }
+    }
+  }
+  async function readAll(
+    urls: readonly string[],
+    signal: AbortSignal,
+  ): Promise<readonly (PullState | undefined)[]> {
+    if (!urls.length) return [];
+    if (gh && !readsPublic())
+      try {
+        return await readStates(gh, urls, signal);
+      } catch (error) {
+        // Offline or signed out for now; gh is tried again next public read.
+        if (!(error instanceof GhUnavailable)) throw error;
+        publicUntil = Date.now() + PULL_SLOW_REFRESH_MS;
+      }
+    return Promise.all(
+      urls.map((url) => readPublicState(url, signal).catch(() => undefined)),
+    );
+  }
+  /** Reads soon, once for every subscriber that starts watching together. */
+  function schedule() {
+    if (scheduled) return;
+    scheduled = true;
+    queueMicrotask(() => {
+      scheduled = false;
+      if (listeners.size) void refresh();
+    });
+  }
+  return {
+    watch(url, listener) {
+      let set = listeners.get(url);
+      if (!set) {
+        set = new Set();
+        listeners.set(url, set);
+        // One read within the poll window keeps what it read.
+        if (dueAt(url) <= Date.now()) schedule();
+        else if (!controller) later();
+      }
+      set.add(listener);
+      return () => {
+        set.delete(listener);
+        if (set.size) return;
+        listeners.delete(url);
+        if (listeners.size) return;
+        clearTimeout(timer);
+        timer = undefined;
+        controller?.abort();
+        controller = undefined;
+      };
+    },
+    get: (url) => states.get(url),
+  };
+}
diff --git a/src/bundled/github/solo-pull.test.ts b/src/bundled/github/solo-pull.test.ts
index 376edd75f9..5d8af2711b 100644
--- a/src/bundled/github/solo-pull.test.ts
+++ b/src/bundled/github/solo-pull.test.ts
@@ -6,7 +6,8 @@ import { uuidv5 } from "../../features/agents/agent-config-artifacts";
 import type { ReadFilter } from "../../features/relay/events";
 import { createRelaySession } from "../../features/relay/session";
 import { keypair } from "../../features/relay/testing";
-import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
+import type { GitHubCli } from "./gh";
+import { createPullStates, PULL_REFRESH_MS } from "./pull-states";
 import {
   createSoloPulls,
   linkOf,
@@ -137,11 +138,7 @@ it("creates, replaces and unlinks a chat's pull request as one artifact", async
   );
 });
 
-const rollup = (
-  state: string,
-  extra: Record<string, unknown> = {},
-  checks?: string,
-) => ({
+const rollup = (state: string, checks?: string) => ({
   pullRequest: {
     state,
     isDraft: false,
@@ -151,18 +148,19 @@ const rollup = (
         { commit: { statusCheckRollup: checks ? { state: checks } : null } },
       ],
     },
-    ...extra,
   },
 });
+/** Solo pull requests over a store with `gh`, or the public API without. */
+const pullsOver = (relay: RelaySession, gh?: GitHubCli) =>
+  createSoloPulls(relay, createPullStates(gh));
 
-it("reads every shown chat's link and pull request together, then again each minute", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
-  const relay = session([revision(chat, pull), revision(other, second)]);
+it("shows every shown chat's linked pull request from one shared read", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const relay = session([revision(chat, pull), revision(other, pull)]);
   const gh = vi.fn(async () => ({
-    r0: rollup("OPEN", { mergeStateStatus: "DIRTY" }, "FAILURE"),
-    r1: rollup("MERGED"),
+    r0: rollup("OPEN", "FAILURE"),
   })) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
+  const pulls = pullsOver(relay.session, gh);
   const changed = vi.fn();
   const stop = [
     pulls.watch(chat, changed),
@@ -176,122 +174,22 @@ it("reads every shown chat's link and pull request together, then again each min
       "#h": [chat, other, "33333333-3333-4333-8333-333333333333"],
     }),
   ]);
+  // Two chats linking one pull request cost one read of it.
   expect(gh).toHaveBeenCalledOnce();
-  expect(gh.mock.calls[0]?.[1]).toEqual({
-    o0: "block",
-    n0: "buzz-app",
-    p0: 7,
-    o1: "block",
-    n1: "buzz",
-    p1: 9,
-  });
+  expect(gh.mock.calls[0]?.[1]).toEqual({ o0: "block", n0: "buzz-app", p0: 7 });
   expect(pulls.get(chat)).toEqual({
     url: pull,
-    state: { state: "open", checks: "failure", conflicts: true },
+    state: { state: "open", checks: "failure", conflicts: false },
   });
   expect(pulls.get(chat)).toBe(pulls.get(chat));
-  expect(pulls.get(other)?.state?.state).toBe("merged");
+  expect(pulls.get(other)?.state).toBe(pulls.get(chat)?.state);
   expect(pulls.get("33333333-3333-4333-8333-333333333333")).toBeUndefined();
-
-  await vi.advanceTimersByTimeAsync(SOLO_REFRESH_MS);
+  // The store polls it while a chat that links it is shown.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
   expect(gh).toHaveBeenCalledTimes(2);
   for (const unwatch of stop) unwatch();
-  await vi.advanceTimersByTimeAsync(SOLO_REFRESH_MS * 3);
-  expect(gh).toHaveBeenCalledTimes(2);
-});
-
-it("leaves an unreadable pull request out of the shared query, trying it alone every 5 minutes", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  const third = "https://github.com/block/goose/pull/3";
-  const chats = [chat, other, "33333333-3333-4333-8333-333333333333"];
-  const relay = session([
-    revision(chats[0] as string, pull),
-    revision(chats[1] as string, second),
-    revision(chats[2] as string, third),
-  ]);
-  // GitHub answers the pull requests it can read and an error for the rest.
-  const gh = vi.fn(
-    async (_query: string, variables: Record<string, unknown>) => {
-      const data: Record<string, unknown> = {};
-      let missing = false;
-      for (let i = 0; `n${i}` in variables; i++)
-        if (variables[`n${i}`] === "buzz") {
-          data[`r${i}`] = null;
-          missing = true;
-        } else data[`r${i}`] = rollup("OPEN", { isDraft: true }, "PENDING");
-      if (missing) throw new GitHubError("Not found", "NOT_FOUND", data);
-      return data;
-    },
-  ) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
-  for (const id of chats) pulls.watch(id, () => {});
-  await vi.waitFor(() => expect(pulls.get(other)?.failed).toBe(true));
-  expect(gh).toHaveBeenCalledOnce();
-  expect(pulls.get(chat)?.state).toEqual({
-    state: "draft",
-    checks: "pending",
-    conflicts: false,
-  });
-  const repositories = () =>
-    gh.mock.calls.map(([, variables]) =>
-      Object.entries(variables as Record<string, unknown>)
-        .filter(([key]) => key.startsWith("n"))
-        .map(([, name]) => name),
-    );
-  // Four minutes of polls: the two readable ones together, once a minute.
-  await vi.advanceTimersByTimeAsync(4 * SOLO_REFRESH_MS);
-  expect(repositories().slice(1)).toEqual(
-    Array.from({ length: 4 }, () => ["buzz-app", "goose"]),
-  );
-  // The fifth also tries the missing one, alone.
-  await vi.advanceTimersByTimeAsync(SOLO_REFRESH_MS);
-  expect(repositories().slice(5)).toEqual([["buzz-app", "goose"], ["buzz"]]);
-  expect(pulls.get(other)?.failed).toBe(true);
-});
-
-it("reads public data without gh", async () => {
-  const relay = session([revision(chat, pull)]);
-  const fetch = vi.fn(
-    async () =>
-      new Response(
-        JSON.stringify({ title: "A", state: "closed", merged: true }),
-      ),
-  );
-  vi.stubGlobal("fetch", fetch);
-  const signedOut = createSoloPulls(relay.session, async () => {
-    throw new GhUnavailable();
-  });
-  signedOut.watch(chat, () => {});
-  await vi.waitFor(() =>
-    expect(signedOut.get(chat)?.state).toEqual({ state: "merged" }),
-  );
-  expect(fetch).toHaveBeenCalledWith(
-    "https://api.github.com/repos/block/buzz-app/pulls/7",
-    expect.anything(),
-  );
-});
-
-it("goes back to gh once it is available again", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async () => new Response(JSON.stringify({ state: "open" }))),
-  );
-  const relay = session([revision(chat, pull)]);
-  let signedIn = false;
-  const gh = vi.fn(async () => {
-    if (!signedIn) throw new GhUnavailable();
-    return { r0: rollup("OPEN", {}, "SUCCESS") };
-  }) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
-  pulls.watch(chat, () => {});
-  await vi.waitFor(() =>
-    expect(pulls.get(chat)?.state).toEqual({ state: "open" }),
-  );
-  signedIn = true;
-  await vi.advanceTimersByTimeAsync(5 * SOLO_REFRESH_MS);
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS * 3);
   expect(gh).toHaveBeenCalledTimes(2);
-  expect(pulls.get(chat)?.state?.checks).toBe("success");
 });
 
 it("reads links within the session reader's limit, only the link artifacts", async () => {
@@ -304,7 +202,7 @@ it("reads links within the session reader's limit, only the link artifacts", asy
     subscribe: () => ({ update() {}, retry() {}, dispose() {} }),
   });
   try {
-    const pulls = createSoloPulls(owner.session, undefined);
+    const pulls = pullsOver(owner.session);
     pulls.watch(chat, () => {});
     await vi.waitFor(() => expect(query).toHaveBeenCalled());
     const [filter] = query.mock.calls[0]?.[0] ?? [];
@@ -317,42 +215,16 @@ it("reads links within the session reader's limit, only the link artifacts", asy
   }
 });
 
-it("keeps a refresh that was given up on from marking pull requests unavailable", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
-  const relay = session([revision(chat, pull)]);
-  let answer: (value: unknown) => void = () => {};
-  const gh = vi.fn(
-    (_query: string, _variables: unknown, signal?: AbortSignal) =>
-      new Promise((resolve, reject) => {
-        answer = resolve;
-        signal?.addEventListener("abort", () => reject(signal.reason));
-      }),
-  ) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
-  const unwatch = pulls.watch(chat, () => {});
-  await vi.waitFor(() => expect(gh).toHaveBeenCalledOnce());
-  // The last row goes away mid-read, then comes back.
-  unwatch();
-  await vi.advanceTimersByTimeAsync(0);
-  pulls.watch(chat, () => {});
-  expect(pulls.get(chat)?.failed).toBeUndefined();
-  await vi.waitFor(() => expect(gh).toHaveBeenCalledTimes(2));
-  answer({ r0: rollup("OPEN", {}, "SUCCESS") });
-  await vi.waitFor(() =>
-    expect(pulls.get(chat)?.state?.checks).toBe("success"),
-  );
-});
-
 it("reads links once, not on the poll, and only a new row's own link", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const relay = session([revision(chat, pull)]);
   const gh = vi.fn(async () => ({
-    r0: rollup("OPEN", {}, "SUCCESS"),
+    r0: rollup("OPEN", "SUCCESS"),
   })) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
+  const pulls = pullsOver(relay.session, gh);
   pulls.watch(chat, () => {});
   await vi.waitFor(() => expect(pulls.get(chat)?.state).toBeDefined());
-  await vi.advanceTimersByTimeAsync(3 * SOLO_REFRESH_MS);
+  await vi.advanceTimersByTimeAsync(3 * PULL_REFRESH_MS);
   expect(relay.snapshotRead).toHaveBeenCalledOnce();
   expect(gh).toHaveBeenCalledTimes(4);
   pulls.watch(other, () => {});
@@ -362,25 +234,10 @@ it("reads links once, not on the poll, and only a new row's own link", async ()
   ]);
 });
 
-it("polls GitHub only for linked pull requests that can still change", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  const relay = session([revision(chat, pull)]);
-  const gh = vi.fn(async () => ({
-    r0: rollup("MERGED"),
-  })) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
-  pulls.watch(chat, () => {});
-  pulls.watch(other, () => {});
-  await vi.waitFor(() => expect(pulls.get(chat)?.state?.state).toBe("merged"));
-  await vi.advanceTimersByTimeAsync(5 * SOLO_REFRESH_MS);
-  expect(gh).toHaveBeenCalledOnce();
-  expect(relay.snapshotRead).toHaveBeenCalledOnce();
-});
-
 it("reads shown chats' links again when the window comes back after a while", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const relay = session([revision(chat, null)]);
-  const pulls = createSoloPulls(relay.session, undefined);
+  const pulls = pullsOver(relay.session);
   pulls.watch(chat, () => {});
   await vi.waitFor(() => expect(relay.snapshotRead).toHaveBeenCalledOnce());
   document.dispatchEvent(new Event("visibilitychange"));
@@ -394,8 +251,8 @@ it("reads shown chats' links again when the window comes back after a while", as
 
 it("shows a link this device wrote before the next read", async () => {
   const relay = session();
-  const gh = vi.fn(async () => ({ r0: rollup("OPEN", {}, "SUCCESS") }));
-  const pulls = createSoloPulls(relay.session, gh as unknown as GitHubCli);
+  const gh = vi.fn(async () => ({ r0: rollup("OPEN", "SUCCESS") }));
+  const pulls = pullsOver(relay.session, gh as unknown as GitHubCli);
   const changed = vi.fn();
   pulls.watch(chat, changed);
   await vi.waitFor(() => expect(relay.snapshotRead).toHaveBeenCalled());
@@ -410,9 +267,9 @@ it("reads links again on the poll after a first read fails", async () => {
   const relay = session([revision(chat, pull)]);
   relay.snapshotRead.mockRejectedValueOnce(new Error("relay unavailable"));
   const gh = vi.fn(async () => ({
-    r0: rollup("OPEN", {}, "SUCCESS"),
+    r0: rollup("OPEN", "SUCCESS"),
   })) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
+  const pulls = pullsOver(relay.session, gh);
   pulls.watch(chat, () => {});
   await vi.waitFor(() => expect(relay.snapshotRead).toHaveBeenCalledOnce());
   await vi.advanceTimersByTimeAsync(0);
@@ -424,51 +281,3 @@ it("reads links again on the poll after a first read fails", async () => {
   await vi.advanceTimersByTimeAsync(SOLO_REFRESH_MS);
   expect(relay.snapshotRead).toHaveBeenCalledTimes(2);
 });
-
-it("keeps polling a closed pull request, which can reopen", async () => {
-  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  const relay = session([revision(chat, pull)]);
-  const gh = vi
-    .fn()
-    .mockResolvedValueOnce({ r0: rollup("CLOSED") })
-    .mockResolvedValue({
-      r0: rollup("OPEN", {}, "SUCCESS"),
-    }) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
-  const pulls = createSoloPulls(relay.session, gh);
-  pulls.watch(chat, () => {});
-  await vi.waitFor(() => expect(pulls.get(chat)?.state?.state).toBe("closed"));
-  await vi.advanceTimersByTimeAsync(SOLO_REFRESH_MS);
-  expect(pulls.get(chat)?.state?.state).toBe("open");
-});
-
-it("keeps what a timed-out refresh read, and marks what it could not", async () => {
-  const deadline = new AbortController();
-  vi.spyOn(AbortSignal, "timeout").mockReturnValue(deadline.signal);
-  const relay = session([revision(chat, pull), revision(other, second)]);
-  let started = 0;
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async (input: string, init?: RequestInit) => {
-      started++;
-      if (input.includes("/buzz-app/"))
-        return new Response(JSON.stringify({ state: "open" }));
-      // The other never answers before the deadline.
-      return new Promise<Response>((_, reject) =>
-        init?.signal?.addEventListener("abort", () =>
-          reject(init.signal?.reason),
-        ),
-      );
-    }),
-  );
-  const pulls = createSoloPulls(relay.session, undefined);
-  pulls.watch(chat, () => {});
-  pulls.watch(other, () => {});
-  await vi.waitFor(() => expect(started).toBe(2));
-  try {
-    deadline.abort(new DOMException("Timed out", "TimeoutError"));
-    await vi.waitFor(() => expect(pulls.get(other)?.failed).toBe(true));
-    expect(pulls.get(chat)?.state).toEqual({ state: "open" });
-  } finally {
-    vi.restoreAllMocks();
-  }
-});
diff --git a/src/bundled/github/solo-pull.ts b/src/bundled/github/solo-pull.ts
index 681fd5485b..dbf9ca7d80 100644
--- a/src/bundled/github/solo-pull.ts
+++ b/src/bundled/github/solo-pull.ts
@@ -1,22 +1,18 @@
 // A Solo chat's pull request: one link per chat, kept as a NIP-AR artifact in
-// the chat so every device and agent in it sees the same one, and the state
-// of every linked pull request, read together and kept current while shown.
+// the chat so every device and agent in it sees the same one, with its state
+// from the app's shared pull request states while shown.
 import {
   ARTIFACT_KIND,
   uuidv5,
 } from "../../features/agents/agent-config-artifacts";
 import type { EventData } from "../../features/relay/events";
 import type { RelaySession } from "../../features/relay/session";
-import { loadGitHubDetails } from "./data";
-import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
+import type { PullState, PullStates } from "./pull-states";
 import { parseGitHubReference } from "./references";
 
 export const SOLO_PULL_TYPE = "buzz.solo.pr";
-/** How often shown chats read their links and pull requests again. */
+/** How soon shown chats whose links could not be read try again. */
 export const SOLO_REFRESH_MS = 60_000;
-/** Without `gh`, GitHub allows 60 public reads an hour. A pull request `gh`
- * could not read is tried again alone this often too. */
-const PUBLIC_REFRESH_MS = 5 * 60_000;
 /** Links change rarely and only by hand, so shown chats read them again when
  * the window comes back, at most this often. */
 const LINKS_AGAIN_MS = 5 * 60_000;
@@ -25,12 +21,6 @@ const LINKS_AGAIN_MS = 5 * 60_000;
 const CHANNELS_PER_READ = 100;
 const LINKS_PER_READ = 500;
 
-export type PullState = Readonly<{
-  state: "open" | "draft" | "merged" | "closed";
-  /** The head commit's combined checks, when read with `gh`. */
-  checks?: "success" | "failure" | "pending" | undefined;
-  conflicts?: boolean | undefined;
-}>;
 /** A chat's linked pull request, and its state once read. */
 export type SoloPull = Readonly<{
   url: string;
@@ -150,102 +140,6 @@ export async function writeLink(
   await writer.publish(event, signal);
 }
 
-type Rollup = "SUCCESS" | "FAILURE" | "ERROR" | "PENDING" | "EXPECTED";
-type StateData = {
-  pullRequest?: {
-    state: "OPEN" | "CLOSED" | "MERGED";
-    isDraft: boolean;
-    mergeStateStatus?: string;
-    commits?: {
-      nodes?: ({
-        commit?: { statusCheckRollup?: { state?: Rollup } | null };
-      } | null)[];
-    };
-  } | null;
-} | null;
-
-const checksOf = (rollup: Rollup | undefined): PullState["checks"] =>
-  rollup === "SUCCESS"
-    ? "success"
-    : rollup === "FAILURE" || rollup === "ERROR"
-      ? "failure"
-      : rollup
-        ? "pending"
-        : undefined;
-
-/** All of `urls` in one GitHub request: each one's state, or undefined for
- * one GitHub could not read. Throws when it answered for none. */
-async function readStates(
-  gh: GitHubCli,
-  urls: readonly string[],
-  signal: AbortSignal,
-) {
-  const variables: Record<string, string | number> = {};
-  const fields = urls.map((url, i) => {
-    const reference = parseGitHubReference(url);
-    const [owner = "", name = ""] = reference?.repository.split("/") ?? [];
-    variables[`o${i}`] = owner;
-    variables[`n${i}`] = name;
-    variables[`p${i}`] = Number(url.split("/").at(-1));
-    return `r${i}:repository(owner:$o${i},name:$n${i}){pullRequest(number:$p${i}){
-      state isDraft mergeStateStatus commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}`;
-  });
-  const declared = urls
-    .map((_, i) => `$o${i}:String!,$n${i}:String!,$p${i}:Int!`)
-    .join(",");
-  let data: Record<string, StateData>;
-  try {
-    data = await gh<Record<string, StateData>>(
-      `query(${declared}){${fields.join("\n")}}`,
-      variables,
-      signal,
-    );
-  } catch (error) {
-    // A missing pull request is an error for its alias alone; GitHub still
-    // answers the rest.
-    if (!(error instanceof GitHubError) || typeof error.data !== "object")
-      throw error;
-    data = error.data as Record<string, StateData>;
-  }
-  return urls.map((_, i): PullState | undefined => {
-    const pull = data[`r${i}`]?.pullRequest;
-    if (!pull) return undefined;
-    return {
-      state:
-        pull.state === "MERGED"
-          ? "merged"
-          : pull.state === "CLOSED"
-            ? "closed"
-            : pull.isDraft
-              ? "draft"
-              : "open",
-      checks: checksOf(
-        pull.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state,
-      ),
-      conflicts: pull.mergeStateStatus === "DIRTY",
-    };
-  });
-}
-
-async function readPublicState(
-  url: string,
-  signal: AbortSignal,
-): Promise<PullState | undefined> {
-  const reference = parseGitHubReference(url);
-  if (!reference) return undefined;
-  const { state } = await loadGitHubDetails(reference, signal);
-  return {
-    state:
-      state === "Merged"
-        ? "merged"
-        : state === "closed"
-          ? "closed"
-          : state === "Draft"
-            ? "draft"
-            : "open",
-  };
-}
-
 export type SoloPulls = Readonly<{
   /** Keeps `channel`'s link and pull request current while subscribed. */
   watch(channel: string, listener: () => void): () => void;
@@ -254,69 +148,54 @@ export type SoloPulls = Readonly<{
   linked(channel: string, url: string | null): void;
 }>;
 
-/** One session's Solo pull requests, read with `gh` when there is one.
+/** One session's Solo pull requests, with their states from `states`.
  *
  * Links are read once per shown chat, batched for rows that appear together,
- * and again when the window comes back after a while; never on a timer.
- * Pull requests are polled only while a shown chat links one that can still
- * change. One that GitHub cannot read leaves the shared query and is tried
- * alone every few minutes. */
+ * and again when the window comes back after a while; never on a timer. A
+ * shown chat's linked pull request is watched in `states` while shown. */
 export function createSoloPulls(
   session: RelaySession,
-  gh: GitHubCli | undefined,
+  states: PullStates,
 ): SoloPulls {
   const listeners = new Map<string, Set<() => void>>();
   const links = new Map<string, string | null>();
-  const states = new Map<string, PullState | "failed">();
   /** Shown chats whose link is still to be read. */
   const unread = new Set<string>();
-  /** Pull requests GitHub could not read, and when to try each alone again. */
-  const retryAt = new Map<string, number>();
-  /** Until when to read public data instead, after `gh` was unavailable. */
-  let publicUntil = 0;
-  const readsPublic = () => !gh || Date.now() < publicUntil;
+  /** Each shown chat's subscription to its linked pull request's state. */
+  const watching = new Map<string, () => void>();
   let linksReadAt = 0;
   let timer: ReturnType<typeof setTimeout> | undefined;
   let controller: AbortController | undefined;
   let scheduled = false;
   /** What `get` answered since the last change, so it answers the same. */
   const views = new Map<string, SoloPull | undefined>();
-  const notify = () => {
-    views.clear();
-    for (const set of listeners.values())
-      for (const listener of set) listener();
+  const notify = (channel: string) => {
+    views.delete(channel);
+    for (const listener of listeners.get(channel) ?? []) listener();
   };
-  const shown = () => [
-    ...new Set(
-      [...listeners.keys()]
-        .map((channel) => links.get(channel))
-        .filter((url): url is string => !!url),
-    ),
-  ];
-  /** A merged pull request stays that way; a closed one can reopen. */
-  const settled = (url: string) => {
-    const state = states.get(url);
-    return !!state && state !== "failed" && state.state === "merged";
+  /** Watches the pull request `channel` links now, while the chat is shown. */
+  const follow = (channel: string) => {
+    watching.get(channel)?.();
+    watching.delete(channel);
+    const url = links.get(channel);
+    if (url && listeners.has(channel))
+      watching.set(
+        channel,
+        states.watch(url, () => notify(channel)),
+      );
   };
-  /** The next poll, while a shown chat's link is unread or links a pull
-   * request that can change. */
+  /** Tries again in a while, while a shown chat's link is still unread. */
   const later = () => {
     clearTimeout(timer);
     timer = undefined;
-    if (
-      ![...unread].some((channel) => listeners.has(channel)) &&
-      !shown().some((url) => !settled(url))
-    )
-      return;
+    if (![...unread].some((channel) => listeners.has(channel))) return;
     timer = setTimeout(
-      () =>
-        document.visibilityState === "visible" ? void refresh(true) : later(),
-      readsPublic() ? PUBLIC_REFRESH_MS : SOLO_REFRESH_MS,
+      () => (document.visibilityState === "visible" ? void refresh() : later()),
+      SOLO_REFRESH_MS,
     );
   };
-  /** Reads the links still unread, then pull requests: on a poll, every one
-   * that can change and is due; otherwise only those not read yet. */
-  async function refresh(poll: boolean) {
+  /** Reads the links still unread. */
+  async function refresh() {
     controller?.abort();
     const current = new AbortController();
     controller = current;
@@ -328,43 +207,16 @@ export function createSoloPulls(
     ]);
     try {
       const channels = [...unread].filter((channel) => listeners.has(channel));
-      if (channels.length) {
-        const read = await readLinks(session, channels, signal);
-        // A refresh that was stopped or replaced changes nothing.
-        if (current.signal.aborted) return;
-        for (const [channel, url] of read) {
-          links.set(channel, url);
-          unread.delete(channel);
-        }
-        notify();
-      }
-      const now = Date.now();
-      const due = shown().filter((url) =>
-        poll ? !settled(url) : !states.has(url),
-      );
-      const together = due.filter((url) => !retryAt.has(url));
-      const alone = due.filter((url) => (retryAt.get(url) ?? Infinity) <= now);
-      const [found, retried] = await Promise.all([
-        readAll(together, signal),
-        Promise.all(
-          alone.map((url) =>
-            readAll([url], signal).then(
-              ([state]) => state,
-              () => undefined,
-            ),
-          ),
-        ),
-      ]);
-      // One that timed out still records what it read, and what it could not.
+      if (!channels.length) return;
+      const read = await readLinks(session, channels, signal);
+      // A refresh that was stopped or replaced changes nothing.
       if (current.signal.aborted) return;
-      const read = (url: string, state: PullState | undefined) => {
-        states.set(url, state ?? "failed");
-        if (state) retryAt.delete(url);
-        else retryAt.set(url, now + PUBLIC_REFRESH_MS);
-      };
-      for (const [i, url] of together.entries()) read(url, found[i]);
-      for (const [i, url] of alone.entries()) read(url, retried[i]);
-      notify();
+      for (const [channel, url] of read) {
+        links.set(channel, url);
+        unread.delete(channel);
+        follow(channel);
+        notify(channel);
+      }
     } catch {
       // Keep what is shown; the next refresh tries again.
     } finally {
@@ -374,30 +226,13 @@ export function createSoloPulls(
       }
     }
   }
-  async function readAll(
-    urls: readonly string[],
-    signal: AbortSignal,
-  ): Promise<readonly (PullState | undefined)[]> {
-    if (!urls.length) return [];
-    if (gh && !readsPublic())
-      try {
-        return await readStates(gh, urls, signal);
-      } catch (error) {
-        // Offline or signed out for now; gh is tried again next public read.
-        if (!(error instanceof GhUnavailable)) throw error;
-        publicUntil = Date.now() + PUBLIC_REFRESH_MS;
-      }
-    return Promise.all(
-      urls.map((url) => readPublicState(url, signal).catch(() => undefined)),
-    );
-  }
   /** Reads soon, once for every row that starts watching together. */
   function schedule() {
     if (scheduled) return;
     scheduled = true;
     queueMicrotask(() => {
       scheduled = false;
-      if (listeners.size) void refresh(false);
+      if (listeners.size) void refresh();
     });
   }
   /** Back in the window after a while: shown chats read their links again. */
@@ -421,16 +256,19 @@ export function createSoloPulls(
           document.addEventListener("visibilitychange", returned);
         }
         listeners.set(channel, set);
-        const url = links.get(channel);
-        if (!links.has(channel)) unread.add(channel);
-        if (!links.has(channel) || (url && !states.has(url))) schedule();
-        else if (!controller && timer === undefined) later();
+        if (links.has(channel)) follow(channel);
+        else {
+          unread.add(channel);
+          schedule();
+        }
       }
       set.add(listener);
       return () => {
         set.delete(listener);
         if (set.size) return;
         listeners.delete(channel);
+        watching.get(channel)?.();
+        watching.delete(channel);
         if (listeners.size) return;
         document.removeEventListener("visibilitychange", returned);
         clearTimeout(timer);
@@ -457,9 +295,8 @@ export function createSoloPulls(
     linked(channel, url) {
       links.set(channel, url);
       unread.delete(channel);
-      notify();
-      if (url && !states.has(url)) schedule();
-      else if (listeners.size && !controller) later();
+      follow(channel);
+      notify(channel);
     },
   };
 }
diff --git a/src/bundled/links/InlineLink.test.tsx b/src/bundled/links/InlineLink.test.tsx
index db617a71e7..3b2df15473 100644
--- a/src/bundled/links/InlineLink.test.tsx
+++ b/src/bundled/links/InlineLink.test.tsx
@@ -66,6 +66,25 @@ it("renders private channel links with the design-system lock icon", () => {
   expect(textOf(markup)).toBe("private");
 });
 
+it("shows a supplied icon in place of the service's, with the label intact", () => {
+  const href = "https://github.com/block/buzz/pull/1234";
+  const icon = <TableIcon data-supplied="" className={styles.icon} />;
+  const markup = renderToStaticMarkup(
+    <LinkLabel href={href} label="Fix the lab" icon={icon} />,
+  );
+  expect(markup).toContain(renderToStaticMarkup(icon));
+  expect(markup).not.toContain("tabler-icon-brand-github");
+  expect(textOf(markup)).toBe("Fix the lab");
+  // Authored formatting takes the supplied icon too.
+  const formatted = renderToStaticMarkup(
+    <LinkContentContext value={<em>Fix</em>}>
+      <LinkLabel href={href} label="Fix" icon={icon} />
+    </LinkContentContext>,
+  );
+  expect(formatted).toContain(renderToStaticMarkup(icon));
+  expect(formatted).toContain("<em>Fix</em>");
+});
+
 it.each([
   "javascript:alert(1)",
   "JaVaScRiPt:alert(1)",
diff --git a/src/bundled/links/InlineLink.tsx b/src/bundled/links/InlineLink.tsx
index 8be279fc23..abf73f4488 100644
--- a/src/bundled/links/InlineLink.tsx
+++ b/src/bundled/links/InlineLink.tsx
@@ -20,7 +20,7 @@ import {
   HashIcon,
   LockIcon,
 } from "../../shared/design-system/icons/index";
-import { useContext, type ComponentProps } from "react";
+import { useContext, type ComponentProps, type ReactNode } from "react";
 import {
   LinkLabelContext,
   LinkContentContext,
@@ -123,9 +123,12 @@ export function InlineLink({
 export function LinkLabel({
   href,
   label = href,
+  icon,
 }: {
   href: string;
   label?: string;
+  /** In place of the service's icon, for a renderer that knows more. */
+  icon?: ReactNode;
 }) {
   const contextualLabel = useContext(LinkLabelContext);
   const content = useContext(LinkContentContext);
@@ -150,10 +153,11 @@ export function LinkLabel({
     label === href ||
     (linkKind(label) !== null && new URL(label).href === new URL(href).href);
   const Icon = kind === "channel" && privateChannel ? LockIcon : icons[kind];
+  icon ??= <Icon aria-hidden="true" className={styles.icon} />;
   if (content !== undefined && !rawDestination)
     return (
       <span data-link-kind={kind}>
-        <Icon aria-hidden="true" className={styles.icon} />
+        {icon}
         {visibleContent}
       </span>
     );
@@ -168,7 +172,7 @@ export function LinkLabel({
   return (
     <span data-link-kind={kind}>
       <span className={styles.lead}>
-        <Icon aria-hidden="true" className={styles.icon} />
+        {icon}
         {lead}
       </span>
       {label.slice(lead.length)}

From f7c6d84a600e3d5bee346e2fb5e5d50422528991 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 00:50:15 +1100
Subject: [PATCH 02/15] fix(github): back off failed pull request reads and
 keep one query per poll
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the review of 4a1f445f3 on the shared pull request state store.

A shared `gh` read that threw with no usable data (rate limited, a non-zero
exit, the 30 s deadline) recorded nothing, so every URL in the batch stayed
due and `finally → later()` armed a 0 ms timer: a spawn-and-fail loop while
GitHub was already refusing. The catch now moves every due URL's next read
out a minute, keeping what is shown.

Without `gh`, every outcome was read once, so a public read that failed for
a passing reason (offline at launch, a shared NAT's 403) marked the link
unavailable for good. A successful public read is still read once; a failed
one is tried again at the slow five-minute cadence until it is read.

`refresh` aborted any read in flight, and inline links mount per virtualised
row, so scrolling through a channel of PR links restarted the batch on every
newly mounted one and spent a rate-limit point on each discarded query. A
read in flight is now left to finish; its `finally → later()` picks up what
became due meanwhile at once. Aborting is reserved for the last unsubscribe.

Pull requests GitHub could not read were retried as one `gh` process each,
concurrently, every five minutes. They now stay in the one aliased query
with the rest: `readStates` already takes the NOT_FOUND aliases from the
error's partial data, so the retry costs no extra process. Only the cadence
distinguishes them.

Tests cover each: a thrown shared read waits a minute and does not spin, a
failed public read is retried on the slow cadence then read once, watching a
second URL mid-read neither aborts the first nor delays the second, two
unreadable URLs retry inside the shared query, and a hidden window re-arms
without reading. Each behaviour test fails on the previous store.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 115 ++++++++++++++++++++++---
 src/bundled/github/pull-states.ts      |  55 +++++-------
 2 files changed, 127 insertions(+), 43 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index d189d41e0c..72bd584acd 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -14,6 +14,7 @@ const third = "https://github.com/block/goose/pull/3";
 afterEach(() => {
   vi.useRealTimers();
   vi.unstubAllGlobals();
+  vi.restoreAllMocks();
 });
 
 const rollup = (
@@ -100,7 +101,7 @@ it("keeps what it read for a pull request watched again within the minute", asyn
   expect(gh).toHaveBeenCalledTimes(2);
 });
 
-it("leaves an unreadable pull request out of the shared query, trying it alone every 5 minutes", async () => {
+it("tries unreadable pull requests again every 5 minutes, in the one query with the rest", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   // GitHub answers the pull requests it can read and an error for the rest.
   const gh = mockGh(
@@ -108,18 +109,21 @@ it("leaves an unreadable pull request out of the shared query, trying it alone e
       const data: Record<string, unknown> = {};
       let missing = false;
       for (let i = 0; `n${i}` in variables; i++)
-        if (variables[`n${i}`] === "buzz") {
+        if (variables[`n${i}`] === "buzz-app")
+          data[`r${i}`] = rollup("OPEN", { isDraft: true }, "PENDING");
+        else {
           data[`r${i}`] = null;
           missing = true;
-        } else data[`r${i}`] = rollup("OPEN", { isDraft: true }, "PENDING");
+        }
       if (missing) throw new GitHubError("Not found", "NOT_FOUND", data);
       return data;
     },
   );
   const states = createPullStates(gh);
   for (const url of [pull, second, third]) states.watch(url, () => {});
-  await vi.waitFor(() => expect(states.get(second)).toBe("failed"));
+  await vi.waitFor(() => expect(states.get(third)).toBe("failed"));
   expect(gh).toHaveBeenCalledOnce();
+  expect(states.get(second)).toBe("failed");
   expect(states.get(pull)).toEqual({
     state: "draft",
     checks: "pending",
@@ -131,17 +135,88 @@ it("leaves an unreadable pull request out of the shared query, trying it alone e
         .filter(([key]) => key.startsWith("n"))
         .map(([, name]) => name),
     );
-  // Four minutes of polls: the two readable ones together, once a minute.
+  // Four minutes of polls: only the readable one, once a minute.
   await vi.advanceTimersByTimeAsync(4 * PULL_REFRESH_MS);
   expect(repositories().slice(1)).toEqual(
-    Array.from({ length: 4 }, () => ["buzz-app", "goose"]),
+    Array.from({ length: 4 }, () => ["buzz-app"]),
   );
-  // The fifth also tries the missing one, alone.
+  // The fifth also tries both missing ones, in the same query: one gh run.
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
-  expect(repositories().slice(5)).toEqual([["buzz-app", "goose"], ["buzz"]]);
+  expect(repositories().slice(5)).toEqual([["buzz-app", "buzz", "goose"]]);
   expect(states.get(second)).toBe("failed");
 });
 
+it("tries again in a minute, not at once, when GitHub answers for none", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => {
+    throw new GitHubError("API rate limit exceeded", "RATE_LIMITED");
+  });
+  const states = createPullStates(gh);
+  const changed = vi.fn();
+  states.watch(pull, changed);
+  states.watch(second, changed);
+  await vi.waitFor(() => expect(gh).toHaveBeenCalledOnce());
+  // Nothing was learnt, so nothing is shown as unavailable, and the next
+  // try waits the poll interval rather than spinning while GitHub refuses.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(gh).toHaveBeenCalledOnce();
+  expect(changed).not.toHaveBeenCalled();
+  expect(states.get(pull)).toBeUndefined();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(gh.mock.calls[1]?.[1]).toEqual(gh.mock.calls[0]?.[1]);
+});
+
+it("leaves a read in flight alone when another pull request is watched, reading it next", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  let answer: (value: unknown) => void = () => {};
+  const signals: (AbortSignal | undefined)[] = [];
+  const gh = mockGh(
+    (
+      _query: string,
+      variables: Record<string, unknown>,
+      signal?: AbortSignal,
+    ) => {
+      signals.push(signal);
+      if ("p1" in variables || variables.n0 === "buzz")
+        return Promise.resolve({ r0: rollup("MERGED") });
+      return new Promise((resolve) => {
+        answer = resolve;
+      });
+    },
+  );
+  const states = createPullStates(gh);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(gh).toHaveBeenCalledOnce());
+  // A row mounting mid-read neither restarts the read nor loses its result.
+  states.watch(second, () => {});
+  await vi.advanceTimersByTimeAsync(0);
+  expect(gh).toHaveBeenCalledOnce();
+  expect(signals[0]?.aborted).toBe(false);
+  answer({ r0: rollup("OPEN", {}, "SUCCESS") });
+  await vi.waitFor(() => expect(states.get(second)).toBeDefined());
+  expect(states.get(pull)).toMatchObject({ checks: "success" });
+  expect(states.get(second)).toMatchObject({ state: "merged" });
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(gh.mock.calls[1]?.[1]).toEqual({ o0: "block", n0: "buzz", p0: 9 });
+});
+
+it("looks again later rather than reading while the window is hidden", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => ({ r0: rollup("OPEN", {}, "SUCCESS") }));
+  const visibility = vi
+    .spyOn(document, "visibilityState", "get")
+    .mockReturnValue("hidden");
+  const states = createPullStates(gh);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toBeDefined());
+  await vi.advanceTimersByTimeAsync(2 * PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledOnce();
+  visibility.mockReturnValue("visible");
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(2);
+});
+
 it("reads a closed pull request, which can reopen, again every few minutes rather than every minute", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const gh = vi
@@ -182,6 +257,25 @@ it("reads public data once without gh, never on a timer", async () => {
   expect(fetch).toHaveBeenCalledOnce();
 });
 
+it("tries a public read that failed again every few minutes, until it is read", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi
+    .fn()
+    .mockResolvedValueOnce(new Response(null, { status: 403 }))
+    .mockResolvedValue(new Response(JSON.stringify({ state: "closed" })));
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toBe("failed"));
+  // One bad moment, offline or over the limit, is not for good.
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledOnce();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "closed" }));
+  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(2);
+});
+
 it("reads public data while gh is unavailable, and goes back to gh once it is available again", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   vi.stubGlobal(
@@ -249,14 +343,13 @@ it("keeps what a timed-out refresh read, and marks what it could not", async ()
     }),
   );
   const states = createPullStates(undefined);
-  states.watch(pull, () => {});
-  states.watch(second, () => {});
+  const stop = [states.watch(pull, () => {}), states.watch(second, () => {})];
   await vi.waitFor(() => expect(started).toBe(2));
   try {
     deadline.abort(new DOMException("Timed out", "TimeoutError"));
     await vi.waitFor(() => expect(states.get(second)).toBe("failed"));
     expect(states.get(pull)).toEqual({ state: "open" });
   } finally {
-    vi.restoreAllMocks();
+    for (const unwatch of stop) unwatch();
   }
 });
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 55344e0ef5..b2786b063e 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -6,9 +6,9 @@ import { parseGitHubReference } from "./references";
 
 /** How often shown pull requests that can change are read again. */
 export const PULL_REFRESH_MS = 60_000;
-/** Without `gh`, GitHub allows 60 public reads an hour. A pull request `gh`
- * could not read is tried again alone this often, and a closed one, which
- * rarely reopens, is read again this often too. */
+/** Without `gh`, GitHub allows 60 public reads an hour. A pull request that
+ * could not be read is tried again this often, and a closed one, which rarely
+ * reopens, is read again this often too. */
 export const PULL_SLOW_REFRESH_MS = 5 * 60_000;
 
 export type PullState = Readonly<{
@@ -124,11 +124,12 @@ async function readPublicState(
 
 /** The app's pull request states, read with `gh` when there is one.
  *
- * A pull request is read once for every subscriber that appears together,
- * then polled only while shown, visible and able to change: a merged one is
- * never read again, a closed one every few minutes. One that GitHub cannot
- * read leaves the shared query and is tried alone every few minutes. Without
- * `gh`, each is read from the public API once; the panel has the live view. */
+ * Every shown pull request that is due is read in one request, once for every
+ * subscriber that appears together, then polled only while shown, visible and
+ * able to change: a merged one is never read again, a closed one or one GitHub
+ * could not read every few minutes. Without `gh`, each is read from the
+ * public API once, tried again every few minutes until it is; the panel has
+ * the live view. */
 export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const listeners = new Map<string, Set<() => void>>();
   const states = new Map<string, PullState | "failed">();
@@ -147,7 +148,7 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const dueAt = (url: string) => nextRead.get(url) ?? 0;
   /** When `state`, read now, is read again. */
   const again = (state: PullState | undefined, now: number) => {
-    if (!gh || state?.state === "merged") return Infinity;
+    if (state?.state === "merged" || (!gh && state)) return Infinity;
     return !state || state.state === "closed" || readsPublic()
       ? now + PULL_SLOW_REFRESH_MS
       : now + PULL_REFRESH_MS;
@@ -167,9 +168,10 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       Math.max(atLeast, due - Date.now()),
     );
   };
-  /** Reads every shown pull request that is due. */
+  /** Reads every shown pull request that is due. A read in flight is left to
+   * finish; it picks up what became due meanwhile. */
   async function refresh() {
-    controller?.abort();
+    if (controller) return;
     const current = new AbortController();
     controller = current;
     clearTimeout(timer);
@@ -178,34 +180,24 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       current.signal,
       AbortSignal.timeout(30_000),
     ]);
+    const now = Date.now();
+    const due = [...listeners.keys()].filter((url) => dueAt(url) <= now);
     try {
-      const now = Date.now();
-      const due = [...listeners.keys()].filter((url) => dueAt(url) <= now);
       if (!due.length) return;
-      const together = due.filter((url) => states.get(url) !== "failed");
-      const alone = due.filter((url) => states.get(url) === "failed");
-      const [found, retried] = await Promise.all([
-        readAll(together, signal),
-        Promise.all(
-          alone.map((url) =>
-            readAll([url], signal).then(
-              ([state]) => state,
-              () => undefined,
-            ),
-          ),
-        ),
-      ]);
+      const found = await readAll(due, signal);
       // One that timed out still records what it read, and what it could not.
       if (current.signal.aborted) return;
-      const read = (url: string, state: PullState | undefined) => {
+      for (const [i, url] of due.entries()) {
+        const state = found[i];
         states.set(url, state ?? "failed");
         nextRead.set(url, again(state, now));
-      };
-      for (const [i, url] of together.entries()) read(url, found[i]);
-      for (const [i, url] of alone.entries()) read(url, retried[i]);
+      }
       notify();
     } catch {
-      // Keep what is shown; the next refresh tries again.
+      // GitHub answered for none, or not in time: keep what is shown and try
+      // again in a minute rather than at once.
+      if (current.signal.aborted) return;
+      for (const url of due) nextRead.set(url, now + PULL_REFRESH_MS);
     } finally {
       if (controller === current) {
         controller = undefined;
@@ -217,7 +209,6 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
     urls: readonly string[],
     signal: AbortSignal,
   ): Promise<readonly (PullState | undefined)[]> {
-    if (!urls.length) return [];
     if (gh && !readsPublic())
       try {
         return await readStates(gh, urls, signal);

From 7b38476e3a5f18a8b6b4a003a98d807a0275f57a Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 00:58:21 +1100
Subject: [PATCH 03/15] fix(github): key pull request states by canonical URL
 and refresh re-watched sidebar views
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the review of a659ce7a8 on the shared pull request state store.

The store keyed each entry on the URL it was given and read the number off
its last path segment, but `parseGitHubReference` accepts a query string and
a trailing slash, which inline links pass through as pasted. `…/pull/123?x`
gave `Number("123?x")`, `NaN`, serialised as `null` for `$pN: Int!`; GitHub
rejected the whole query with no data, so every due URL in the batch backed
off together and failed the same way a minute later, leaving every PR link
in the channel on the plain glyph while that one was shown. `…/pull/123/`
gave number 0, NOT_FOUND, and an unavailable icon for a pull request that
exists. `watch` and `get` now key on the pull request's canonical URL from
`parseGitHubReference`, so the variants of one pull request, and an inline
link and the sidebar's normalised link to it, share one entry and one read,
and `readStates` only ever sees canonical URLs. A URL that is not a pull
request's is not watched and reads as `"failed"` rather than throwing.

Re-watching a chat whose link was already known called `follow` but kept the
cached `views` entry. The shared store can advance a URL while that chat is
unwatched, kept current by another chat or an inline link, and notifies only
its current subscribers, so on remount `useSyncExternalStore` read the stale
view. Pollable states healed within a minute, but merged is terminal and
never re-read, so the sidebar showed open for a merged pull request until a
re-read on returning to the window. `follow` now drops the cached view, so
`get` reads the store afresh.

Tests: a query-string and a trailing-slash variant resolve, cost one query
with the canonical numbers alongside a plain URL, and share one state object;
a non-pull URL is neither read nor thrown on; a chat re-watched after the
store moved to merged shows merged. Each fails on the previous code.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 54 ++++++++++++++++++++++++++
 src/bundled/github/pull-states.ts      | 29 ++++++++++----
 src/bundled/github/solo-pull.test.ts   | 25 ++++++++++++
 src/bundled/github/solo-pull.ts        |  4 +-
 4 files changed, 104 insertions(+), 8 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index 72bd584acd..07924193ad 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -79,6 +79,60 @@ it("reads every watched pull request together, once, then again each minute whil
   expect(gh).toHaveBeenCalledTimes(2);
 });
 
+it("keys a pull request by its canonical URL, so pasted variants share one entry and read", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => ({
+    r0: rollup("OPEN", {}, "SUCCESS"),
+    r1: rollup("MERGED"),
+  }));
+  const states = createPullStates(gh);
+  const changed = [vi.fn(), vi.fn(), vi.fn()] as const;
+  // As pasted from a GitHub email, from the address bar, and plain.
+  const query = `${pull}?notification_referrer_id=abc&diff=split`;
+  const slash = `${pull}/`;
+  const stop = [
+    states.watch(query, changed[0]),
+    states.watch(slash, changed[1]),
+    states.watch(second, changed[2]),
+  ];
+  await vi.waitFor(() => expect(states.get(second)).toBeDefined());
+  // One query, with the numbers GitHub needs, not `null` or 0 for the
+  // variants, which would fail the whole batch.
+  expect(gh).toHaveBeenCalledOnce();
+  expect(gh.mock.calls[0]?.[1]).toEqual({
+    o0: "block",
+    n0: "buzz-app",
+    p0: 7,
+    o1: "block",
+    n1: "buzz",
+    p1: 9,
+  });
+  for (const listener of changed) expect(listener).toHaveBeenCalledOnce();
+  const state = { state: "open", checks: "success", conflicts: false };
+  expect(states.get(query)).toEqual(state);
+  expect(states.get(slash)).toBe(states.get(query));
+  expect(states.get(pull)).toBe(states.get(query));
+  expect(states.get(second)).toEqual({ state: "merged", conflicts: false });
+  for (const unwatch of stop) unwatch();
+});
+
+it("neither watches nor throws for a URL that is not a pull request's", async () => {
+  const gh = mockGh(async () => ({}));
+  const states = createPullStates(gh);
+  const unwatch = states.watch(
+    "https://github.com/block/buzz-app/issues/7",
+    () => {},
+  );
+  states.watch("not a url", () => {})();
+  await vi.waitFor(() => expect(states.get(pull)).toBeUndefined());
+  expect(gh).not.toHaveBeenCalled();
+  expect(states.get("https://github.com/block/buzz-app/issues/7")).toBe(
+    "failed",
+  );
+  expect(states.get("not a url")).toBe("failed");
+  unwatch();
+});
+
 it("keeps what it read for a pull request watched again within the minute", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const gh = mockGh(async () => ({ r0: rollup("OPEN", {}, "SUCCESS") }));
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index b2786b063e..270e0c9aca 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -19,10 +19,11 @@ export type PullState = Readonly<{
 }>;
 
 export type PullStates = Readonly<{
-  /** Keeps `url`'s state current while subscribed. */
+  /** Keeps `url`'s state current while subscribed. A URL that is not a pull
+   * request's is not watched. */
   watch(url: string, listener: () => void): () => void;
-  /** Its state, `"failed"` when it could not be read, or undefined before
-   * the first read. */
+  /** Its state, `"failed"` when it could not be read or `url` is not a pull
+   * request's, or undefined before the first read. */
   get(url: string): PullState | "failed" | undefined;
 }>;
 
@@ -49,8 +50,9 @@ const checksOf = (rollup: Rollup | undefined): PullState["checks"] =>
         ? "pending"
         : undefined;
 
-/** All of `urls` in one GitHub request: each one's state, or undefined for
- * one GitHub could not read. Throws when it answered for none. */
+/** All of `urls`, canonical pull request URLs, in one GitHub request: each
+ * one's state, or undefined for one GitHub could not read. Throws when it
+ * answered for none. */
 async function readStates(
   gh: GitHubCli,
   urls: readonly string[],
@@ -122,6 +124,14 @@ async function readPublicState(
   };
 }
 
+/** The pull request `url` names, as the store keys it: its canonical URL, so
+ * a link pasted with a query string or trailing slash shares the entry, and
+ * the read, of the plain one. Undefined for a URL that is not a pull request's. */
+const keyOf = (url: string) => {
+  const reference = parseGitHubReference(url);
+  return reference?.kind === "pull" ? reference.url : undefined;
+};
+
 /** The app's pull request states, read with `gh` when there is one.
  *
  * Every shown pull request that is due is read in one request, once for every
@@ -231,7 +241,9 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
     });
   }
   return {
-    watch(url, listener) {
+    watch(raw, listener) {
+      const url = keyOf(raw);
+      if (!url) return () => {};
       let set = listeners.get(url);
       if (!set) {
         set = new Set();
@@ -252,6 +264,9 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         controller = undefined;
       };
     },
-    get: (url) => states.get(url),
+    get(url) {
+      const key = keyOf(url);
+      return key ? states.get(key) : "failed";
+    },
   };
 }
diff --git a/src/bundled/github/solo-pull.test.ts b/src/bundled/github/solo-pull.test.ts
index 5d8af2711b..5466d9f721 100644
--- a/src/bundled/github/solo-pull.test.ts
+++ b/src/bundled/github/solo-pull.test.ts
@@ -192,6 +192,31 @@ it("shows every shown chat's linked pull request from one shared read", async ()
   expect(gh).toHaveBeenCalledTimes(2);
 });
 
+it("shows a state the shared store moved to while the chat was not shown", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const relay = session([revision(chat, pull), revision(other, pull)]);
+  let state = "OPEN";
+  const gh = vi.fn(async () => ({
+    r0: rollup(state),
+  })) as unknown as GitHubCli & ReturnType<typeof vi.fn>;
+  const pulls = pullsOver(relay.session, gh);
+  const unwatch = pulls.watch(chat, () => {});
+  const stopOther = pulls.watch(other, () => {});
+  await vi.waitFor(() => expect(pulls.get(chat)?.state?.state).toBe("open"));
+  // The chat scrolls out; the other, still shown, keeps the pull request read.
+  unwatch();
+  state = "MERGED";
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(pulls.get(other)?.state?.state).toBe("merged");
+  // Back in view, the chat shows where the pull request is now, not where it
+  // was: merged is terminal, so no later read would have corrected it.
+  const changed = vi.fn();
+  pulls.watch(chat, changed);
+  expect(pulls.get(chat)?.state?.state).toBe("merged");
+  expect(pulls.get(chat)).toBe(pulls.get(chat));
+  stopOther();
+});
+
 it("reads links within the session reader's limit, only the link artifacts", async () => {
   const query = vi.fn(async (_filters: readonly ReadFilter[]) => []);
   const owner = createRelaySession({
diff --git a/src/bundled/github/solo-pull.ts b/src/bundled/github/solo-pull.ts
index dbf9ca7d80..27ba6dac66 100644
--- a/src/bundled/github/solo-pull.ts
+++ b/src/bundled/github/solo-pull.ts
@@ -173,10 +173,12 @@ export function createSoloPulls(
     views.delete(channel);
     for (const listener of listeners.get(channel) ?? []) listener();
   };
-  /** Watches the pull request `channel` links now, while the chat is shown. */
+  /** Watches the pull request `channel` links now, while the chat is shown.
+   * The store may have moved on while the chat was not: `get` reads afresh. */
   const follow = (channel: string) => {
     watching.get(channel)?.();
     watching.delete(channel);
+    views.delete(channel);
     const url = links.get(channel);
     if (url && listeners.has(channel))
       watching.set(

From 5c73fda9d4914e55d567d5eabcac5f1d768d2ddf Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 01:04:58 +1100
Subject: [PATCH 04/15] perf(github): notify only the pull requests a poll read

Addresses the optional finding of the review of 7aedd9123.

`notify()` fired every listener of every watched URL after each poll, not
just those whose state the poll recorded. Inline `PullLink`s were unaffected,
since `get` returns a stable reference and React bails out, but each Solo
sidebar listener drops its cached view on notify, so every shown Solo row
with a link rebuilt its view and re-rendered once a minute, including rows
whose pull request is merged and was never in the batch. `notify` now takes
the `due` URLs and tells only their listeners. The thrown-batch back-off
records no state and so, as before, notifies nobody; the public fallback
reads the same `due` URLs and notifies them.

The first store test, which already polls only the open pull request on its
second tick, now checks that the open URL's two listeners hear of it and the
merged URL's does not. It fails on the previous store.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 6 +++++-
 src/bundled/github/pull-states.ts      | 9 +++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index 07924193ad..ce871f0e10 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -70,10 +70,14 @@ it("reads every watched pull request together, once, then again each minute whil
   expect(states.get(pull)).toBe(states.get(pull));
   expect(states.get(second)).toEqual({ state: "merged", conflicts: false });
 
-  // Only the open one is polled: a merged pull request stays that way.
+  // Only the open one is polled: a merged pull request stays that way, and
+  // whoever shows it is not told of a poll that did not touch it.
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
   expect(gh).toHaveBeenCalledTimes(2);
   expect(gh.mock.calls[1]?.[1]).toEqual({ o0: "block", n0: "buzz-app", p0: 7 });
+  expect(changed[0]).toHaveBeenCalledTimes(2);
+  expect(changed[1]).toHaveBeenCalledTimes(2);
+  expect(changed[2]).toHaveBeenCalledOnce();
   for (const unwatch of stop) unwatch();
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS * 3);
   expect(gh).toHaveBeenCalledTimes(2);
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 270e0c9aca..39dcebb67c 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -151,9 +151,10 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   let timer: ReturnType<typeof setTimeout> | undefined;
   let controller: AbortController | undefined;
   let scheduled = false;
-  const notify = () => {
-    for (const set of listeners.values())
-      for (const listener of set) listener();
+  /** Tells whoever shows `urls` that their states were recorded. */
+  const notify = (urls: readonly string[]) => {
+    for (const url of urls)
+      for (const listener of listeners.get(url) ?? []) listener();
   };
   const dueAt = (url: string) => nextRead.get(url) ?? 0;
   /** When `state`, read now, is read again. */
@@ -202,7 +203,7 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         states.set(url, state ?? "failed");
         nextRead.set(url, again(state, now));
       }
-      notify();
+      notify(due);
     } catch {
       // GitHub answered for none, or not in time: keep what is shown and try
       // again in a minute rather than at once.

From 3e348fa5faae09164263e7b2d12ffc202227a5ce Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 11:34:06 +1100
Subject: [PATCH 05/15] fix(github): paint open and merged pull request icons
 with icon-tier roles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The open glyph of a pull request link in a message was painted `--text-success`,
a step-12 ink chosen for reading text on fills. Inside a bubble whose body and
link inks are also step 12 it clears the bubble at 10:1 but the neighbouring
ink at only 1.1–1.5:1, so the eye reads a dark mark, not green; merged read
only because purple's hue is far from olive, which does not hold for every
accent. The cascade was correct; the role was the wrong tier.

Two icon-tier roles join `tokens.css` and the registry, next to
`--icon-status-complete` and `--text-categorical-purple`: `--icon-success`
(green-11 in both modes) and `--icon-categorical-purple` (purple-11 in both
modes). The sidebar's and the inline link's open and merged icons move to them;
the panel's chip keeps the text-tier roles, since there green and purple text
sits on a tinted fill and needs 4.5:1. Draft and closed stay `--text-subtle`.

Measured against the own bubble at the tinted levels across all six accents:
green-11 3.89–3.99:1 light and 7.48–7.62:1 dark (Citrus 3.99 / 7.48), purple-11
5.01–5.15:1 light and 6.67–6.79:1 dark (Citrus 5.15 / 6.67); received bubble
4.25 / 7.76 and 5.49 / 6.91; page surfaces 4.33–4.72 / 7.86–11.2 and
5.58–6.08 / 7.01–9.98. Dark green-10 would also clear (4.92–5.27) but green-11
matches `--status-online` and keeps one step in both modes; dark purple-10
clears by only 3.01–3.22, so purple stays at 11.

The contrast guard now measures both roles against the page surfaces and, per
accent family, against both message bubbles at 3:1. On the high colour level
the own bubble is the solid accent step and no single hue clears 3:1 on every
family, a gap the previous text roles shared; the guard names it and skips that
one pairing rather than hiding it in an exception. Tests move each role one
step thinner (green-10, purple-9): both still clear the page, so only the new
bubble pairings fail them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/design-system.md                         |  3 +-
 scripts/design-system/check-contrast.mjs      | 29 +++++++++++++++++++
 src/bundled/github/GitHub.module.css          | 11 +++----
 src/shared/design-system/styles/tokens.css    |  4 +++
 .../design-system/tokens/contrast.test.mjs    | 26 +++++++++++++++++
 src/shared/design-system/tokens/registry.ts   | 14 +++++++++
 6 files changed, 81 insertions(+), 6 deletions(-)

diff --git a/docs/design-system.md b/docs/design-system.md
index 6a98d29a05..3b045547a0 100644
--- a/docs/design-system.md
+++ b/docs/design-system.md
@@ -87,7 +87,8 @@ Plugins define integration-specific semantic mappings in their own styles, using
 shared roles where shared improvements should flow through. The shared system
 owns palette values and generic paint roles, not integration-specific status
 names. Categorical purple (`--text-categorical-purple` paired with
-`--surface-categorical-purple`) stays independent of customizable app accent.
+`--surface-categorical-purple`, and `--icon-categorical-purple` for state icons)
+stays independent of customizable app accent.
 
 GitHub owns its `--github-*` status/diff mappings and browser coverage of the
 resolved text/fill pairs in both themes, including shared-role updates and merged
diff --git a/scripts/design-system/check-contrast.mjs b/scripts/design-system/check-contrast.mjs
index d12ba4b0e2..aa63a4428b 100644
--- a/scripts/design-system/check-contrast.mjs
+++ b/scripts/design-system/check-contrast.mjs
@@ -239,6 +239,15 @@ const BOUNDARY_SURFACES = [
   "--surface-inset",
   "--surface-popover",
 ];
+/**
+ * State icons that also sit inside message bubbles: a pull request link's
+ * glyph and the sidebar's. They are measured against both bubbles per accent
+ * family below. On the high level the own bubble is the solid accent step and
+ * no one hue clears 3:1 on every family there, so that level is a known gap,
+ * not a pairing this guard enforces.
+ */
+const MESSAGE_ICON_ROLES = ["--icon-success", "--icon-categorical-purple"];
+const SOLID_OWN_BUBBLE_LEVEL = "high";
 const BOUNDARY_ROLES = [
   // Dots and insertion lines in the prominent color stand alone on a surface.
   "--affordance-prominent-mark",
@@ -254,6 +263,7 @@ const BOUNDARY_ROLES = [
   "--chart-series-2",
   "--chart-series-3",
   "--chart-series-4",
+  ...MESSAGE_ICON_ROLES,
 ];
 
 const TINT_PAIRS = [
@@ -543,6 +553,25 @@ for (const family of accentFamilies) {
             `${family}/${level}/${mode}: --border-accent on ${surfaceRole} — ${ratio === null ? "unresolved color" : `${ratio.toFixed(3)}:1`}, needs 3:1`,
           );
       }
+      for (const role of MESSAGE_ICON_ROLES) {
+        for (const surfaceRole of [
+          "--surface-message",
+          "--surface-message-own",
+        ]) {
+          if (
+            surfaceRole === "--surface-message-own" &&
+            level === SOLID_OWN_BUBBLE_LEVEL
+          )
+            continue;
+          const icon = resolve(map, role);
+          const surface = resolve(map, surfaceRole);
+          const ratio = icon && surface ? wcagRatio(icon, surface) : null;
+          if (ratio === null || ratio < 3)
+            boundaryFailures.push(
+              `${family}/${level}/${mode}: ${role} on ${surfaceRole} — ${ratio === null ? "unresolved color" : `${ratio.toFixed(3)}:1`}, needs 3:1`,
+            );
+        }
+      }
     }
   }
 }
diff --git a/src/bundled/github/GitHub.module.css b/src/bundled/github/GitHub.module.css
index fa8116b14e..e79f781f7f 100644
--- a/src/bundled/github/GitHub.module.css
+++ b/src/bundled/github/GitHub.module.css
@@ -395,16 +395,17 @@
   flex: 0 0 var(--space-5);
 }
 /* The sidebar's icon and a message link's icon take one colour per state, as
-   the panel's chip above does; a link's text stays a link. Draft, closed and
-   not yet read are quiet: closed is not red here. Only the sidebar shows an
-   open one's checks and conflicts. */
+   the panel's chip above does; a link's text stays a link. Open and merged
+   use the icon-tier roles: the chip's step-12 text inks are indistinguishable
+   from a bubble's own ink. Draft, closed and not yet read are quiet: closed is
+   not red here. Only the sidebar shows an open one's checks and conflicts. */
 .soloPull,
 .pullState {
   color: var(--text-subtle);
 }
 .soloPull[data-tone="open"],
 .pullState[data-pr-state="open"] {
-  color: var(--text-success);
+  color: var(--icon-success);
 }
 .soloPull[data-tone="failure"] {
   color: var(--text-danger);
@@ -414,7 +415,7 @@
 }
 .soloPull[data-tone="merged"],
 .pullState[data-pr-state="merged"] {
-  color: var(--text-categorical-purple);
+  color: var(--icon-categorical-purple);
 }
 .soloLink {
   display: flex;
diff --git a/src/shared/design-system/styles/tokens.css b/src/shared/design-system/styles/tokens.css
index cd72ce2e36..504ac35114 100644
--- a/src/shared/design-system/styles/tokens.css
+++ b/src/shared/design-system/styles/tokens.css
@@ -1098,6 +1098,7 @@
   --text-success: var(--green-12);
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
+  --icon-success: var(--green-11);
   --status-online: var(--green-11);
   --status-availability-online: var(--green-10);
   --status-avatar-online: var(--green-10);
@@ -1112,6 +1113,7 @@
   --chart-series-4: var(--purple-9);
   --text-categorical-purple: var(--purple-12);
   --surface-categorical-purple: var(--purple-3);
+  --icon-categorical-purple: var(--purple-11);
   --text-link: var(--text-standard);
   --affordance-link-hover: var(--affordance-subtle-hover);
   --border-standard: var(--neutral-3);
@@ -1231,6 +1233,7 @@
   --text-success: var(--green-12);
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
+  --icon-success: var(--green-11);
   --status-online: var(--green-11);
   --status-availability-online: var(--green-10);
   --status-avatar-online: var(--green-10);
@@ -1244,6 +1247,7 @@
   --chart-series-4: var(--purple-10);
   --text-categorical-purple: var(--purple-12);
   --surface-categorical-purple: var(--purple-3);
+  --icon-categorical-purple: var(--purple-11);
   --text-link: var(--text-standard);
   --affordance-link-hover: var(--affordance-subtle-hover);
   --border-standard: var(--neutral-5);
diff --git a/src/shared/design-system/tokens/contrast.test.mjs b/src/shared/design-system/tokens/contrast.test.mjs
index 44236b0872..0d19a678ca 100644
--- a/src/shared/design-system/tokens/contrast.test.mjs
+++ b/src/shared/design-system/tokens/contrast.test.mjs
@@ -383,4 +383,30 @@ describe("semantic contrast contract", () => {
       expect(result.output).toContain(`on --affordance-${role}`);
     },
   );
+
+  // Each step below clears the page surfaces, so only the bubble pairings
+  // can catch it: green-10 falls short on the light tinted own bubbles and
+  // purple-9 on the dark bubbles.
+  it.each([
+    [
+      "success",
+      "--icon-success: var(--green-11);",
+      "--icon-success: var(--green-10);",
+      "--icon-success on --surface-message-own",
+    ],
+    [
+      "categorical purple",
+      "--icon-categorical-purple: var(--purple-11);",
+      "--icon-categorical-purple: var(--purple-9);",
+      "--icon-categorical-purple on --surface-message",
+    ],
+  ])(
+    "checks the %s state icon against the message bubbles, not only the page",
+    (_name, from, to, pairing) => {
+      expect(tokens).toContain(from);
+      const result = check(tokens.replaceAll(from, to));
+      expect(result.status, result.output).toBe(1);
+      expect(result.output).toContain(pairing);
+    },
+  );
 });
diff --git a/src/shared/design-system/tokens/registry.ts b/src/shared/design-system/tokens/registry.ts
index 5d08e38bef..142cc5f5a0 100644
--- a/src/shared/design-system/tokens/registry.ts
+++ b/src/shared/design-system/tokens/registry.ts
@@ -555,6 +555,13 @@ export const ROLE_GROUPS: RoleGroup[] = [
         use: "Completed task icons, paired with a checkmark and accessible status label. Not text.",
         status: "core",
       },
+      {
+        token: "icon-success",
+        variable: "--icon-success",
+        pointsAt: "green-11 light / green-11 dark",
+        use: "Success / positive state icons, including inside message bubbles. Not text.",
+        status: "core",
+      },
       {
         token: "text-link",
         variable: "--text-link",
@@ -606,6 +613,13 @@ export const ROLE_GROUPS: RoleGroup[] = [
         use: "Accent-independent categorical text, paired with surface-categorical-purple.",
         status: "core",
       },
+      {
+        token: "icon-categorical-purple",
+        variable: "--icon-categorical-purple",
+        pointsAt: "purple-11 light / purple-11 dark",
+        use: "Accent-independent categorical state icons, the icon tier of text-categorical-purple. Not text.",
+        status: "core",
+      },
       {
         token: "text-accent",
         variable: "--text-accent",

From 39a49465769364d2d59fe6bec5a52e40f04ef1ba Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 11:46:30 +1100
Subject: [PATCH 06/15] fix(design-system): paint state icons in solid own
 bubbles with the link ink
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the review of d077059d4 on the pull request state icons.

On the high colour level the own bubble is the solid accent step, and no
green or purple clears it on every family: `--icon-success` and
`--icon-categorical-purple` measured 1.05–1.69:1 there, so a pull request's
state glyph was effectively invisible in your own messages. The guard knew
and skipped that one pairing rather than enforcing it.

The high level is expressed in `tokens.css` as a global block that swaps the
`-own` roles, not an own-bubble-scoped block, so redefining the icon roles
there would also repaint received bubbles and the Solo sidebar. The fix
follows the existing `-own` pair pattern instead. `--icon-success-own` and
`--icon-categorical-purple-own` join the role layer and the registry,
pointing at their base role on the neutral and touch levels and at
`--text-message-link-own` in both high blocks. `.messageBubble[data-own]`
hands the pair to whatever sits inside it by shadowing the two roles, as it
already does for links, mentions and selection, so `GitHub.module.css` keeps
no host knowledge and the pair covers any state icon rendered in an own
bubble. On the high own bubble both roles now measure the link ink's floor:
magenta and cobalt 4.50:1, iris 5.04:1, bee 12.88:1, citrus 13.27:1 and
mono 17.40:1 light / 16.83:1 dark, with every other family identical in
both modes since the accent-9 fill and its ink do not change with the mode.

The contrast guard drops the `SOLID_OWN_BUBBLE_LEVEL` skip and measures each
base role on the received bubble and its `-own` pair on the own bubble at
every level. The test's framing is corrected: purple-9 is two steps thinner,
since purple-10 passes the whole guard at 3.01–3.22:1 on the dark bubbles,
and purple-9 also fails the dark popover, which the pinned received-bubble
pairing does not depend on. A third case points the high-level `-own` pair
back at the base role and expects the own-bubble pairing to fail on the high
level, so the previously skipped pairing is shown to be guarded.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/design-system.md                         |  5 ++++-
 scripts/design-system/check-contrast.mjs      | 22 +++++++------------
 src/features/messages/Messages.module.css     |  3 +++
 src/shared/design-system/styles/tokens.css    |  8 +++++++
 .../design-system/tokens/contrast.test.mjs    | 18 +++++++++++----
 src/shared/design-system/tokens/registry.ts   | 15 +++++++++++++
 6 files changed, 52 insertions(+), 19 deletions(-)

diff --git a/docs/design-system.md b/docs/design-system.md
index 3b045547a0..d7fcd93e19 100644
--- a/docs/design-system.md
+++ b/docs/design-system.md
@@ -88,7 +88,10 @@ shared roles where shared improvements should flow through. The shared system
 owns palette values and generic paint roles, not integration-specific status
 names. Categorical purple (`--text-categorical-purple` paired with
 `--surface-categorical-purple`, and `--icon-categorical-purple` for state icons)
-stays independent of customizable app accent.
+stays independent of customizable app accent. Inside your own bubble the host
+hands state icons their `-own` pair (`--icon-success-own`,
+`--icon-categorical-purple-own`), which is the bubble's link ink at Buzzin’,
+where the solid accent fill clears no state hue.
 
 GitHub owns its `--github-*` status/diff mappings and browser coverage of the
 resolved text/fill pairs in both themes, including shared-role updates and merged
diff --git a/scripts/design-system/check-contrast.mjs b/scripts/design-system/check-contrast.mjs
index aa63a4428b..3c88fe13f5 100644
--- a/scripts/design-system/check-contrast.mjs
+++ b/scripts/design-system/check-contrast.mjs
@@ -241,13 +241,12 @@ const BOUNDARY_SURFACES = [
 ];
 /**
  * State icons that also sit inside message bubbles: a pull request link's
- * glyph and the sidebar's. They are measured against both bubbles per accent
- * family below. On the high level the own bubble is the solid accent step and
- * no one hue clears 3:1 on every family there, so that level is a known gap,
- * not a pairing this guard enforces.
+ * glyph and the sidebar's. Each is measured against the received bubble, and
+ * its `-own` pair against the own bubble, per accent family and level below.
+ * On the high level the own bubble is the solid accent step, which no one hue
+ * clears on every family, so there the `-own` pair is the bubble's link ink.
  */
 const MESSAGE_ICON_ROLES = ["--icon-success", "--icon-categorical-purple"];
-const SOLID_OWN_BUBBLE_LEVEL = "high";
 const BOUNDARY_ROLES = [
   // Dots and insertion lines in the prominent color stand alone on a surface.
   "--affordance-prominent-mark",
@@ -553,16 +552,11 @@ for (const family of accentFamilies) {
             `${family}/${level}/${mode}: --border-accent on ${surfaceRole} — ${ratio === null ? "unresolved color" : `${ratio.toFixed(3)}:1`}, needs 3:1`,
           );
       }
-      for (const role of MESSAGE_ICON_ROLES) {
-        for (const surfaceRole of [
-          "--surface-message",
-          "--surface-message-own",
+      for (const baseRole of MESSAGE_ICON_ROLES) {
+        for (const [role, surfaceRole] of [
+          [baseRole, "--surface-message"],
+          [`${baseRole}-own`, "--surface-message-own"],
         ]) {
-          if (
-            surfaceRole === "--surface-message-own" &&
-            level === SOLID_OWN_BUBBLE_LEVEL
-          )
-            continue;
           const icon = resolve(map, role);
           const surface = resolve(map, surfaceRole);
           const ratio = icon && surface ? wcagRatio(icon, surface) : null;
diff --git a/src/features/messages/Messages.module.css b/src/features/messages/Messages.module.css
index dd4a75bdf7..6a99f1583e 100644
--- a/src/features/messages/Messages.module.css
+++ b/src/features/messages/Messages.module.css
@@ -3038,6 +3038,9 @@ html[data-keyboard-navigation] .rawDiff:focus-visible {
   --mention-fill: var(--affordance-mention-own);
   --mention-hover: var(--affordance-mention-own-hover);
   --mention-text: var(--text-mention-own);
+  /* State icons inside the bubble take their -own pair: the link ink at Buzzin’. */
+  --icon-success: var(--icon-success-own);
+  --icon-categorical-purple: var(--icon-categorical-purple-own);
 }
 /* Neutral content and unboxed renderers keep selection paired with their surface. */
 .messageBubble[data-emoji-only],
diff --git a/src/shared/design-system/styles/tokens.css b/src/shared/design-system/styles/tokens.css
index 504ac35114..24134a1831 100644
--- a/src/shared/design-system/styles/tokens.css
+++ b/src/shared/design-system/styles/tokens.css
@@ -1099,6 +1099,7 @@
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
   --icon-success: var(--green-11);
+  --icon-success-own: var(--icon-success);
   --status-online: var(--green-11);
   --status-availability-online: var(--green-10);
   --status-avatar-online: var(--green-10);
@@ -1114,6 +1115,7 @@
   --text-categorical-purple: var(--purple-12);
   --surface-categorical-purple: var(--purple-3);
   --icon-categorical-purple: var(--purple-11);
+  --icon-categorical-purple-own: var(--icon-categorical-purple);
   --text-link: var(--text-standard);
   --affordance-link-hover: var(--affordance-subtle-hover);
   --border-standard: var(--neutral-3);
@@ -1234,6 +1236,7 @@
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
   --icon-success: var(--green-11);
+  --icon-success-own: var(--icon-success);
   --status-online: var(--green-11);
   --status-availability-online: var(--green-10);
   --status-avatar-online: var(--green-10);
@@ -1248,6 +1251,7 @@
   --text-categorical-purple: var(--purple-12);
   --surface-categorical-purple: var(--purple-3);
   --icon-categorical-purple: var(--purple-11);
+  --icon-categorical-purple-own: var(--icon-categorical-purple);
   --text-link: var(--text-standard);
   --affordance-link-hover: var(--affordance-subtle-hover);
   --border-standard: var(--neutral-5);
@@ -1839,6 +1843,8 @@
   --surface-text-selection-own: var(--accent-ink);
   --text-on-selection-own: var(--surface-message-own);
   --text-message-link-own: var(--accent-ink);
+  --icon-success-own: var(--text-message-link-own);
+  --icon-categorical-purple-own: var(--text-message-link-own);
 }
 
 :root[data-color-level="high"][data-color-mode="dark"],
@@ -1851,6 +1857,8 @@
   --surface-text-selection-own: var(--accent-ink);
   --text-on-selection-own: var(--surface-message-own);
   --text-message-link-own: var(--accent-ink);
+  --icon-success-own: var(--text-message-link-own);
+  --icon-categorical-purple-own: var(--text-message-link-own);
 }
 
 /* Raised dark composers need a distinct nested fill and progressively lighter
diff --git a/src/shared/design-system/tokens/contrast.test.mjs b/src/shared/design-system/tokens/contrast.test.mjs
index 0d19a678ca..1c0e5c07ea 100644
--- a/src/shared/design-system/tokens/contrast.test.mjs
+++ b/src/shared/design-system/tokens/contrast.test.mjs
@@ -384,15 +384,19 @@ describe("semantic contrast contract", () => {
     },
   );
 
-  // Each step below clears the page surfaces, so only the bubble pairings
-  // can catch it: green-10 falls short on the light tinted own bubbles and
-  // purple-9 on the dark bubbles.
+  // Green-10 still clears the page surfaces and falls short only on the light
+  // tinted own bubbles, through the -own pair. Purple-10 passes the whole
+  // guard (3.01–3.22:1 on the dark bubbles), so purple-9 is the first step it
+  // can see; purple-9 also fails the dark popover, but the pinned pairing is
+  // the dark received bubble. At Buzzin’ the own bubble is solid accent-9,
+  // which the base role never clears: pointing the -own pair back at it fails
+  // the own-bubble pairing on the high level.
   it.each([
     [
       "success",
       "--icon-success: var(--green-11);",
       "--icon-success: var(--green-10);",
-      "--icon-success on --surface-message-own",
+      "--icon-success-own on --surface-message-own",
     ],
     [
       "categorical purple",
@@ -400,6 +404,12 @@ describe("semantic contrast contract", () => {
       "--icon-categorical-purple: var(--purple-9);",
       "--icon-categorical-purple on --surface-message",
     ],
+    [
+      "high-level own success",
+      "--icon-success-own: var(--text-message-link-own);",
+      "--icon-success-own: var(--icon-success);",
+      "/high/light: --icon-success-own on --surface-message-own",
+    ],
   ])(
     "checks the %s state icon against the message bubbles, not only the page",
     (_name, from, to, pairing) => {
diff --git a/src/shared/design-system/tokens/registry.ts b/src/shared/design-system/tokens/registry.ts
index 142cc5f5a0..12c8d16e43 100644
--- a/src/shared/design-system/tokens/registry.ts
+++ b/src/shared/design-system/tokens/registry.ts
@@ -562,6 +562,13 @@ export const ROLE_GROUPS: RoleGroup[] = [
         use: "Success / positive state icons, including inside message bubbles. Not text.",
         status: "core",
       },
+      {
+        token: "icon-success-own",
+        variable: "--icon-success-own",
+        pointsAt: "icon-success; the own bubble's link ink at Buzzin’",
+        use: "Success state icons inside your own bubble, where the solid fill clears no green.",
+        status: "core",
+      },
       {
         token: "text-link",
         variable: "--text-link",
@@ -620,6 +627,14 @@ export const ROLE_GROUPS: RoleGroup[] = [
         use: "Accent-independent categorical state icons, the icon tier of text-categorical-purple. Not text.",
         status: "core",
       },
+      {
+        token: "icon-categorical-purple-own",
+        variable: "--icon-categorical-purple-own",
+        pointsAt:
+          "icon-categorical-purple; the own bubble's link ink at Buzzin’",
+        use: "Categorical state icons inside your own bubble, where the solid fill clears no purple.",
+        status: "core",
+      },
       {
         token: "text-accent",
         variable: "--text-accent",

From eae255898a39f460484b4259ddd098ed26ad0de5 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 13:56:21 +1100
Subject: [PATCH 07/15] fix(design-system): paint subtle state icons in solid
 own bubbles with the link ink
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses item 1 of the rendered check of de5abe4a2 on the pull request
state icons.

Draft and closed pull request glyphs were painted `--text-subtle`, a text
role the own bubble does not pair, so on the high colour level, where that
bubble is the solid accent step, the grey measured 1.04–2.98:1 on most
families in both modes, 1.07:1 on citrus in dark: the glyph of a draft or
closed pull request in your own message was effectively invisible while the
open and merged glyphs beside it had already moved to their `-own` pair in
de5abe4a2. The guard did not measure these two states at all.

The fix is the same pair, one tier down. `--icon-subtle`, pointing at
`--text-subtle`, and `--icon-subtle-own` join the role layer and the registry
next to the two existing icon pairs; the `-own` role is its base on the
neutral and touch levels and `--text-message-link-own` in both high blocks.
`.messageBubble[data-own]` shadows it alongside the other two, so
`GitHub.module.css` only switches the draft/closed/unknown default of
`.soloPull` and `.pullState` to `--icon-subtle`; the panel chip's text and
every other supporting text keep `--text-subtle`, which is not shadowed for
the bubble as a whole. On the high own bubble the role now measures the link
ink's floor: magenta and cobalt 4.50:1, iris 5.04:1, bee 12.88:1, citrus
13.27:1 and mono 17.40:1 light / 16.83:1 dark, identical in both modes
elsewhere. On the tinted levels it measures 6.44 light / 8.03 dark at neutral
and 6.44–6.61 light / 8.30–8.46 dark at touch across the six families, and
the base role measures 7.05 light / 8.61 dark on the received bubble.

The contrast guard adds `--icon-subtle` to the message icon roles, so it is
measured on the page surfaces and the received bubble and its `-own` pair on
the own bubble at every family and level. A fourth test case points the
high-level pair back at the base role and expects the dark own-bubble pairing
to fail; the previous guard passes that stylesheet.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/design-system.md                             |  4 ++--
 scripts/design-system/check-contrast.mjs          | 11 ++++++++---
 src/bundled/github/GitHub.module.css              |  2 +-
 src/features/messages/Messages.module.css         |  1 +
 src/shared/design-system/styles/tokens.css        |  6 ++++++
 src/shared/design-system/tokens/contrast.test.mjs | 10 +++++++++-
 src/shared/design-system/tokens/registry.ts       | 14 ++++++++++++++
 7 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/docs/design-system.md b/docs/design-system.md
index d7fcd93e19..ab1df50005 100644
--- a/docs/design-system.md
+++ b/docs/design-system.md
@@ -89,9 +89,9 @@ owns palette values and generic paint roles, not integration-specific status
 names. Categorical purple (`--text-categorical-purple` paired with
 `--surface-categorical-purple`, and `--icon-categorical-purple` for state icons)
 stays independent of customizable app accent. Inside your own bubble the host
-hands state icons their `-own` pair (`--icon-success-own`,
+hands state icons their `-own` pair (`--icon-subtle-own`, `--icon-success-own`,
 `--icon-categorical-purple-own`), which is the bubble's link ink at Buzzin’,
-where the solid accent fill clears no state hue.
+where the solid accent fill clears neither grey nor any state hue.
 
 GitHub owns its `--github-*` status/diff mappings and browser coverage of the
 resolved text/fill pairs in both themes, including shared-role updates and merged
diff --git a/scripts/design-system/check-contrast.mjs b/scripts/design-system/check-contrast.mjs
index 3c88fe13f5..8d2bee6299 100644
--- a/scripts/design-system/check-contrast.mjs
+++ b/scripts/design-system/check-contrast.mjs
@@ -243,10 +243,15 @@ const BOUNDARY_SURFACES = [
  * State icons that also sit inside message bubbles: a pull request link's
  * glyph and the sidebar's. Each is measured against the received bubble, and
  * its `-own` pair against the own bubble, per accent family and level below.
- * On the high level the own bubble is the solid accent step, which no one hue
- * clears on every family, so there the `-own` pair is the bubble's link ink.
+ * On the high level the own bubble is the solid accent step, which neither
+ * grey nor any one hue clears on every family, so there the `-own` pair is the
+ * bubble's link ink.
  */
-const MESSAGE_ICON_ROLES = ["--icon-success", "--icon-categorical-purple"];
+const MESSAGE_ICON_ROLES = [
+  "--icon-subtle",
+  "--icon-success",
+  "--icon-categorical-purple",
+];
 const BOUNDARY_ROLES = [
   // Dots and insertion lines in the prominent color stand alone on a surface.
   "--affordance-prominent-mark",
diff --git a/src/bundled/github/GitHub.module.css b/src/bundled/github/GitHub.module.css
index e79f781f7f..34be51f22f 100644
--- a/src/bundled/github/GitHub.module.css
+++ b/src/bundled/github/GitHub.module.css
@@ -401,7 +401,7 @@
    not red here. Only the sidebar shows an open one's checks and conflicts. */
 .soloPull,
 .pullState {
-  color: var(--text-subtle);
+  color: var(--icon-subtle);
 }
 .soloPull[data-tone="open"],
 .pullState[data-pr-state="open"] {
diff --git a/src/features/messages/Messages.module.css b/src/features/messages/Messages.module.css
index 6a99f1583e..8e6f343799 100644
--- a/src/features/messages/Messages.module.css
+++ b/src/features/messages/Messages.module.css
@@ -3039,6 +3039,7 @@ html[data-keyboard-navigation] .rawDiff:focus-visible {
   --mention-hover: var(--affordance-mention-own-hover);
   --mention-text: var(--text-mention-own);
   /* State icons inside the bubble take their -own pair: the link ink at Buzzin’. */
+  --icon-subtle: var(--icon-subtle-own);
   --icon-success: var(--icon-success-own);
   --icon-categorical-purple: var(--icon-categorical-purple-own);
 }
diff --git a/src/shared/design-system/styles/tokens.css b/src/shared/design-system/styles/tokens.css
index 24134a1831..5b503aad6a 100644
--- a/src/shared/design-system/styles/tokens.css
+++ b/src/shared/design-system/styles/tokens.css
@@ -1098,6 +1098,8 @@
   --text-success: var(--green-12);
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
+  --icon-subtle: var(--text-subtle);
+  --icon-subtle-own: var(--icon-subtle);
   --icon-success: var(--green-11);
   --icon-success-own: var(--icon-success);
   --status-online: var(--green-11);
@@ -1235,6 +1237,8 @@
   --text-success: var(--green-12);
   --icon-status-progress: var(--amber-10);
   --icon-status-complete: var(--green-10);
+  --icon-subtle: var(--text-subtle);
+  --icon-subtle-own: var(--icon-subtle);
   --icon-success: var(--green-11);
   --icon-success-own: var(--icon-success);
   --status-online: var(--green-11);
@@ -1843,6 +1847,7 @@
   --surface-text-selection-own: var(--accent-ink);
   --text-on-selection-own: var(--surface-message-own);
   --text-message-link-own: var(--accent-ink);
+  --icon-subtle-own: var(--text-message-link-own);
   --icon-success-own: var(--text-message-link-own);
   --icon-categorical-purple-own: var(--text-message-link-own);
 }
@@ -1857,6 +1862,7 @@
   --surface-text-selection-own: var(--accent-ink);
   --text-on-selection-own: var(--surface-message-own);
   --text-message-link-own: var(--accent-ink);
+  --icon-subtle-own: var(--text-message-link-own);
   --icon-success-own: var(--text-message-link-own);
   --icon-categorical-purple-own: var(--text-message-link-own);
 }
diff --git a/src/shared/design-system/tokens/contrast.test.mjs b/src/shared/design-system/tokens/contrast.test.mjs
index 1c0e5c07ea..d2df05a757 100644
--- a/src/shared/design-system/tokens/contrast.test.mjs
+++ b/src/shared/design-system/tokens/contrast.test.mjs
@@ -390,7 +390,9 @@ describe("semantic contrast contract", () => {
   // can see; purple-9 also fails the dark popover, but the pinned pairing is
   // the dark received bubble. At Buzzin’ the own bubble is solid accent-9,
   // which the base role never clears: pointing the -own pair back at it fails
-  // the own-bubble pairing on the high level.
+  // the own-bubble pairing on the high level. Subtle grey falls short of that
+  // fill on most families in both modes (1.04–2.98:1); the dark pairing from
+  // the report, 1.07:1 on citrus, is the one pinned here.
   it.each([
     [
       "success",
@@ -410,6 +412,12 @@ describe("semantic contrast contract", () => {
       "--icon-success-own: var(--icon-success);",
       "/high/light: --icon-success-own on --surface-message-own",
     ],
+    [
+      "high-level own subtle",
+      "--icon-subtle-own: var(--text-message-link-own);",
+      "--icon-subtle-own: var(--icon-subtle);",
+      "/high/dark: --icon-subtle-own on --surface-message-own",
+    ],
   ])(
     "checks the %s state icon against the message bubbles, not only the page",
     (_name, from, to, pairing) => {
diff --git a/src/shared/design-system/tokens/registry.ts b/src/shared/design-system/tokens/registry.ts
index 12c8d16e43..a507283c69 100644
--- a/src/shared/design-system/tokens/registry.ts
+++ b/src/shared/design-system/tokens/registry.ts
@@ -555,6 +555,20 @@ export const ROLE_GROUPS: RoleGroup[] = [
         use: "Completed task icons, paired with a checkmark and accessible status label. Not text.",
         status: "core",
       },
+      {
+        token: "icon-subtle",
+        variable: "--icon-subtle",
+        pointsAt: "text-subtle",
+        use: "Neutral / inactive state icons, including inside message bubbles. Not text.",
+        status: "core",
+      },
+      {
+        token: "icon-subtle-own",
+        variable: "--icon-subtle-own",
+        pointsAt: "icon-subtle; the own bubble's link ink at Buzzin’",
+        use: "Neutral state icons inside your own bubble, where the solid fill clears no grey.",
+        status: "core",
+      },
       {
         token: "icon-success",
         variable: "--icon-success",

From f0d04b25fecca624cf40489654c96589ca0ece31 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 15:14:49 +1100
Subject: [PATCH 08/15] fix(github): meter public pull request reads, keep
 unchanged states, read on window return

Addresses the three ranked concerns of the refresh timing and performance
assessment of 05be7a72e on the shared pull request state store.

Without `gh`, every due pull request was read from the public API at once,
one `fetch` each with no cap, against the 60 reads an hour GitHub allows an
address. Thirty links in view spent thirty at once; a second channel ran out
the hour, after which each failed URL was tried again every five minutes
and refused again, starving the panel's public reads too. A public poll now
reads at most `PUBLIC_READS_PER_POLL` (10) of the due URLs, in the order
they were shown, and moves the rest a minute on rather than leaving them
due. `loadGitHubDetails` throws a typed `GitHubRateLimited` for a 403 or
429, with the same message the panel shows, carrying GitHub's
`x-ratelimit-reset` or an hour on without it; the store catches it, records
nothing for the batch, and holds every public read until that time, as it
already holds a thrown `gh` batch for a minute. A pull request shown during
the hold waits for it too. With `gh`, the hold ends at the earlier of the
reset and `gh`'s next try, so a signed-in `gh` is not kept waiting an hour
behind a public refusal.

Each poll stored a fresh state object even when nothing changed, so every
mounted open or draft link re-rendered once a minute and each Solo sidebar
row with a pollable link dropped and rebuilt its view. An unchanged state,
with the same `state`, `checks` and `conflicts`, now keeps its object, and
only the URLs whose state changed are notified, so `useSyncExternalStore`
bails out and the sidebar keeps its view.

Returning to the window after a long hidden stretch waited for the hidden
tick's re-arm, up to a minute, before reading what had become due. The store
now listens for `visibilitychange` while anything is watched and runs the
scheduler on return: anything due is read at once, and otherwise the poll
keeps its time. The hidden window still looks again later rather than
reading.

Tests: twelve public links cost ten reads, then the other two a minute later,
each once; a refusal with and without a reset header holds every public read,
including a link shown meanwhile, until the reset or an hour, telling no one
and showing nothing as unavailable; a refusal does not keep `gh` waiting past
its retry; a poll reading the same state keeps the object and tells no one,
and the sidebar row's view and listener are left alone; coming back after two
hidden minutes reads at once, after half a minute with nothing due it does
not; the loader's limit error names the reset. The first store test now
changes the checks between polls, since an unchanged poll is no longer heard,
and the failed-public-read test uses a 502, since a 403 is now a hold. Each
new behaviour test fails on the previous store or loader, except the `gh`
retry one, which pins the new hold's bound.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/data.test.tsx       |  27 ++++-
 src/bundled/github/data.ts             |  15 ++-
 src/bundled/github/pull-states.test.ts | 157 ++++++++++++++++++++++++-
 src/bundled/github/pull-states.ts      |  72 +++++++++---
 src/bundled/github/solo-pull.test.ts   |   7 +-
 5 files changed, 257 insertions(+), 21 deletions(-)

diff --git a/src/bundled/github/data.test.tsx b/src/bundled/github/data.test.tsx
index e21f044ffe..5e807d6ebe 100644
--- a/src/bundled/github/data.test.tsx
+++ b/src/bundled/github/data.test.tsx
@@ -1,5 +1,5 @@
 import { assert, afterEach, expect, it, vi } from "vitest";
-import { loadGitHubDetails } from "./data";
+import { GitHubRateLimited, loadGitHubDetails } from "./data";
 import { GitHubError } from "./gh";
 import { loadGitHubObject } from "./object";
 import { parseGitHubReference } from "./references";
@@ -71,6 +71,31 @@ it.each([
   ).rejects.toThrow(String(message));
 });
 
+it("says when GitHub's public limit resets, an hour on when it does not say", async () => {
+  vi.useFakeTimers({ toFake: ["Date"] });
+  const fetch = vi
+    .fn()
+    .mockResolvedValueOnce(
+      new Response(null, {
+        status: 429,
+        headers: { "x-ratelimit-reset": String(Date.now() / 1000 + 1800) },
+      }),
+    )
+    .mockResolvedValueOnce(new Response(null, { status: 403 }));
+  vi.stubGlobal("fetch", fetch);
+  try {
+    const signal = new AbortController().signal;
+    const told = await loadGitHubDetails(reference, signal).catch((e) => e);
+    expect(told).toBeInstanceOf(GitHubRateLimited);
+    expect(told.resetAt).toBe(Date.now() + 1800_000);
+    const untold = await loadGitHubDetails(reference, signal).catch((e) => e);
+    expect(untold).toBeInstanceOf(GitHubRateLimited);
+    expect(untold.resetAt).toBe(Date.now() + 3600_000);
+  } finally {
+    vi.useRealTimers();
+  }
+});
+
 it("does not expose check head plumbing on non-PR objects", async () => {
   const issue = parseGitHubReference(
     "https://github.com/sample/project/issues/1",
diff --git a/src/bundled/github/data.ts b/src/bundled/github/data.ts
index 3392cd2dbe..a9e80c4abb 100644
--- a/src/bundled/github/data.ts
+++ b/src/bundled/github/data.ts
@@ -60,6 +60,16 @@ type ResponseData = {
   default_branch?: string;
 };
 
+/** GitHub refused a public read for this hour's limit; `resetAt` is when it
+ * lifts, by its `x-ratelimit-reset` header, or an hour on without one. */
+export class GitHubRateLimited extends Error {
+  constructor(readonly resetAt: number) {
+    super(
+      "GitHub’s public API limit was reached. Try again later or open it on GitHub.",
+    );
+  }
+}
+
 export function branchLink(branch: BranchData, pullRepository: string): Branch {
   const repository = branch.repo?.full_name;
   return {
@@ -102,8 +112,9 @@ export async function loadGitHubDetails(
         "This is private or unavailable. Sign in to the gh CLI to see private repositories, or open it on GitHub.",
       );
     if (response.status === 403 || response.status === 429)
-      throw new Error(
-        "GitHub’s public API limit was reached. Try again later or open it on GitHub.",
+      throw new GitHubRateLimited(
+        Number(response.headers.get("x-ratelimit-reset")) * 1000 ||
+          Date.now() + 60 * 60_000,
       );
     const message = `GitHub couldn’t load this object (${response.status}).`;
     // `loadGitHubObject` retries server failures quietly.
diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index ce871f0e10..08de4009da 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -3,6 +3,7 @@ import { afterEach, expect, it, vi } from "vitest";
 import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
 import {
   createPullStates,
+  PUBLIC_READS_PER_POLL,
   PULL_REFRESH_MS,
   PULL_SLOW_REFRESH_MS,
 } from "./pull-states";
@@ -39,8 +40,9 @@ const mockGh = (implementation: (...args: never[]) => unknown) =>
 
 it("reads every watched pull request together, once, then again each minute while watched", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  let checks = "FAILURE";
   const gh = mockGh(async () => ({
-    r0: rollup("OPEN", { mergeStateStatus: "DIRTY" }, "FAILURE"),
+    r0: rollup("OPEN", { mergeStateStatus: "DIRTY" }, checks),
     r1: rollup("MERGED"),
   }));
   const states = createPullStates(gh);
@@ -72,17 +74,41 @@ it("reads every watched pull request together, once, then again each minute whil
 
   // Only the open one is polled: a merged pull request stays that way, and
   // whoever shows it is not told of a poll that did not touch it.
+  checks = "SUCCESS";
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
   expect(gh).toHaveBeenCalledTimes(2);
   expect(gh.mock.calls[1]?.[1]).toEqual({ o0: "block", n0: "buzz-app", p0: 7 });
   expect(changed[0]).toHaveBeenCalledTimes(2);
   expect(changed[1]).toHaveBeenCalledTimes(2);
   expect(changed[2]).toHaveBeenCalledOnce();
+  expect(states.get(pull)).toMatchObject({ checks: "success" });
   for (const unwatch of stop) unwatch();
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS * 3);
   expect(gh).toHaveBeenCalledTimes(2);
 });
 
+it("keeps the state object, and tells no one, when a poll reads the same state", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  let checks = "PENDING";
+  const gh = mockGh(async () => ({ r0: rollup("OPEN", {}, checks) }));
+  const states = createPullStates(gh);
+  const changed = vi.fn();
+  states.watch(pull, changed);
+  await vi.waitFor(() => expect(states.get(pull)).toBeDefined());
+  const before = states.get(pull);
+  // GitHub answers the same each time, so the links and sidebar rows showing
+  // the pull request have nothing to re-render for.
+  await vi.advanceTimersByTimeAsync(2 * PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(3);
+  expect(states.get(pull)).toBe(before);
+  expect(changed).toHaveBeenCalledOnce();
+  checks = "SUCCESS";
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(states.get(pull)).not.toBe(before);
+  expect(states.get(pull)).toMatchObject({ checks: "success" });
+  expect(changed).toHaveBeenCalledTimes(2);
+});
+
 it("keys a pull request by its canonical URL, so pasted variants share one entry and read", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const gh = mockGh(async () => ({
@@ -275,6 +301,38 @@ it("looks again later rather than reading while the window is hidden", async ()
   expect(gh).toHaveBeenCalledTimes(2);
 });
 
+it("reads what became due while the window was hidden as soon as it comes back", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const gh = mockGh(async () => ({ r0: rollup("OPEN", {}, "SUCCESS") }));
+  const visibility = vi
+    .spyOn(document, "visibilityState", "get")
+    .mockReturnValue("hidden");
+  const states = createPullStates(gh);
+  const unwatch = states.watch(pull, () => {});
+  await vi.waitFor(() => expect(states.get(pull)).toBeDefined());
+  await vi.advanceTimersByTimeAsync(2 * PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledOnce();
+  // Back after two minutes: the overdue read is now, not at the next look.
+  visibility.mockReturnValue("visible");
+  document.dispatchEvent(new Event("visibilitychange"));
+  await vi.advanceTimersByTimeAsync(0);
+  expect(gh).toHaveBeenCalledTimes(2);
+  // Back after half a minute, with nothing due: the poll keeps its time.
+  visibility.mockReturnValue("hidden");
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  visibility.mockReturnValue("visible");
+  document.dispatchEvent(new Event("visibilitychange"));
+  await vi.advanceTimersByTimeAsync(0);
+  expect(gh).toHaveBeenCalledTimes(2);
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(gh).toHaveBeenCalledTimes(3);
+  // Nothing watched, nothing to read on return.
+  unwatch();
+  document.dispatchEvent(new Event("visibilitychange"));
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(3);
+});
+
 it("reads a closed pull request, which can reopen, again every few minutes rather than every minute", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const gh = vi
@@ -319,13 +377,13 @@ it("tries a public read that failed again every few minutes, until it is read",
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const fetch = vi
     .fn()
-    .mockResolvedValueOnce(new Response(null, { status: 403 }))
+    .mockResolvedValueOnce(new Response(null, { status: 502 }))
     .mockResolvedValue(new Response(JSON.stringify({ state: "closed" })));
   vi.stubGlobal("fetch", fetch);
   const states = createPullStates(undefined);
   states.watch(pull, () => {});
   await vi.waitFor(() => expect(states.get(pull)).toBe("failed"));
-  // One bad moment, offline or over the limit, is not for good.
+  // One bad moment, GitHub's or the network's, is not for good.
   await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
   expect(fetch).toHaveBeenCalledOnce();
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
@@ -334,6 +392,99 @@ it("tries a public read that failed again every few minutes, until it is read",
   expect(fetch).toHaveBeenCalledTimes(2);
 });
 
+const pulls = Array.from(
+  { length: PUBLIC_READS_PER_POLL + 2 },
+  (_, i) => `https://github.com/block/repo-${i}/pull/1`,
+);
+const limited = (resetAt?: number) =>
+  new Response(null, {
+    status: 403,
+    headers: resetAt ? { "x-ratelimit-reset": String(resetAt / 1000) } : {},
+  });
+
+it("reads a few public pull requests at a time, the rest a minute later", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi.fn(
+    async () => new Response(JSON.stringify({ state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  for (const url of pulls) states.watch(url, () => {});
+  await vi.waitFor(() =>
+    expect(states.get(pulls[PUBLIC_READS_PER_POLL - 1] ?? "")).toBeDefined(),
+  );
+  // A channel of links does not spend the hour's public reads at once.
+  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL);
+  expect(states.get(pulls.at(-1) ?? "")).toBeUndefined();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL);
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(fetch).toHaveBeenCalledTimes(pulls.length);
+  expect(states.get(pulls.at(-1) ?? "")).toEqual({ state: "open" });
+  // Each read once, none again.
+  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(pulls.length);
+});
+
+it.each([
+  ["when GitHub says it resets", 30 * 60_000],
+  ["for an hour when it does not say", undefined],
+])(
+  "holds every public read once GitHub refuses one, %s",
+  async (_, resetIn) => {
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+    const hold = resetIn ?? 60 * 60_000;
+    const resetAt = resetIn && Date.now() + resetIn;
+    let refusals = 2;
+    const fetch = vi.fn(async () =>
+      refusals-- > 0
+        ? limited(resetAt)
+        : new Response(JSON.stringify({ state: "open" })),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const states = createPullStates(undefined);
+    const changed = vi.fn();
+    states.watch(pull, changed);
+    states.watch(second, changed);
+    await vi.waitFor(() => expect(fetch).toHaveBeenCalledTimes(2));
+    // Over the limit, nothing is learnt or shown as unavailable, and neither
+    // these nor a link shown meanwhile is tried until the limit resets.
+    states.watch(third, changed);
+    await vi.advanceTimersByTimeAsync(hold - PULL_REFRESH_MS);
+    expect(fetch).toHaveBeenCalledTimes(2);
+    expect(changed).not.toHaveBeenCalled();
+    expect(states.get(pull)).toBeUndefined();
+    expect(states.get(third)).toBeUndefined();
+    await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+    expect(fetch).toHaveBeenCalledTimes(5);
+    for (const url of [pull, second, third])
+      expect(states.get(url)).toEqual({ state: "open" });
+  },
+);
+
+it("tries gh again before GitHub's public limit resets, when there is one", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => limited(Date.now() + 60 * 60_000)),
+  );
+  let signedIn = false;
+  const gh = mockGh(async () => {
+    if (!signedIn) throw new GhUnavailable();
+    return { r0: rollup("OPEN", {}, "SUCCESS") };
+  });
+  const states = createPullStates(gh);
+  states.watch(pull, () => {});
+  await vi.waitFor(() => expect(fetch).toHaveBeenCalledOnce());
+  signedIn = true;
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledOnce();
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(gh).toHaveBeenCalledTimes(2);
+  expect(states.get(pull)).toMatchObject({ checks: "success" });
+  expect(fetch).toHaveBeenCalledOnce();
+});
+
 it("reads public data while gh is unavailable, and goes back to gh once it is available again", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   vi.stubGlobal(
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 39dcebb67c..3e5df7ca91 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -1,6 +1,6 @@
 // The state of every pull request shown somewhere in the app, read together
 // and kept current while shown.
-import { loadGitHubDetails } from "./data";
+import { GitHubRateLimited, loadGitHubDetails } from "./data";
 import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
 import { parseGitHubReference } from "./references";
 
@@ -10,6 +10,9 @@ export const PULL_REFRESH_MS = 60_000;
  * could not be read is tried again this often, and a closed one, which rarely
  * reopens, is read again this often too. */
 export const PULL_SLOW_REFRESH_MS = 5 * 60_000;
+/** How many of the due pull requests one public poll reads; the rest take
+ * the next. */
+export const PUBLIC_READS_PER_POLL = 10;
 
 export type PullState = Readonly<{
   state: "open" | "draft" | "merged" | "closed";
@@ -124,6 +127,15 @@ async function readPublicState(
   };
 }
 
+/** Whether `b`, read now, is what `a` already shows. */
+const same = (a: PullState | "failed" | undefined, b: PullState | "failed") =>
+  a === b ||
+  (typeof a === "object" &&
+    typeof b === "object" &&
+    a.state === b.state &&
+    a.checks === b.checks &&
+    a.conflicts === b.conflicts);
+
 /** The pull request `url` names, as the store keys it: its canonical URL, so
  * a link pasted with a query string or trailing slash shares the entry, and
  * the read, of the plain one. Undefined for a URL that is not a pull request's. */
@@ -137,9 +149,9 @@ const keyOf = (url: string) => {
  * Every shown pull request that is due is read in one request, once for every
  * subscriber that appears together, then polled only while shown, visible and
  * able to change: a merged one is never read again, a closed one or one GitHub
- * could not read every few minutes. Without `gh`, each is read from the
- * public API once, tried again every few minutes until it is; the panel has
- * the live view. */
+ * could not read every few minutes. Without `gh`, a few at a time are read
+ * from the public API, each once, tried again every few minutes until it is,
+ * and none while GitHub holds its limit; the panel has the live view. */
 export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const listeners = new Map<string, Set<() => void>>();
   const states = new Map<string, PullState | "failed">();
@@ -148,6 +160,8 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   /** Until when to read public data instead, after `gh` was unavailable. */
   let publicUntil = 0;
   const readsPublic = () => !gh || Date.now() < publicUntil;
+  /** Until when GitHub refuses public reads, once it has refused one. */
+  let publicHeldUntil = 0;
   let timer: ReturnType<typeof setTimeout> | undefined;
   let controller: AbortController | undefined;
   let scheduled = false;
@@ -165,20 +179,28 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       : now + PULL_REFRESH_MS;
   };
   /** The next poll, when a shown pull request is next due. A hidden window
-   * looks again later rather than reading. */
+   * looks again later rather than reading. Public reads wait out GitHub's
+   * limit, or until `gh` is tried again, whichever is first. */
   const later = (atLeast = 0) => {
     clearTimeout(timer);
     timer = undefined;
     const due = Math.min(...[...listeners.keys()].map(dueAt));
     if (due === Infinity) return;
+    const held = readsPublic()
+      ? Math.min(publicHeldUntil, gh ? publicUntil : Infinity)
+      : 0;
     timer = setTimeout(
       () =>
         document.visibilityState === "visible"
           ? void refresh()
           : later(PULL_REFRESH_MS),
-      Math.max(atLeast, due - Date.now()),
+      Math.max(atLeast, due - Date.now(), held - Date.now()),
     );
   };
+  /** Back in the window, what became due while it was hidden is read now. */
+  const returned = () => {
+    if (document.visibilityState === "visible" && !controller) later();
+  };
   /** Reads every shown pull request that is due. A read in flight is left to
    * finish; it picks up what became due meanwhile. */
   async function refresh() {
@@ -194,19 +216,28 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
     const now = Date.now();
     const due = [...listeners.keys()].filter((url) => dueAt(url) <= now);
     try {
-      if (!due.length) return;
+      if (!due.length || (readsPublic() && now < publicHeldUntil)) return;
       const found = await readAll(due, signal);
       // One that timed out still records what it read, and what it could not.
       if (current.signal.aborted) return;
+      const changed: string[] = [];
       for (const [i, url] of due.entries()) {
-        const state = found[i];
-        states.set(url, state ?? "failed");
-        nextRead.set(url, again(state, now));
+        // Those a public poll left for the next one wait a minute.
+        if (i >= found.length) {
+          nextRead.set(url, now + PULL_REFRESH_MS);
+          continue;
+        }
+        const state = found[i] ?? "failed";
+        nextRead.set(url, again(found[i], now));
+        // An unchanged state keeps its object, so whoever shows it is left be.
+        if (same(states.get(url), state)) continue;
+        states.set(url, state);
+        changed.push(url);
       }
-      notify(due);
+      notify(changed);
     } catch {
-      // GitHub answered for none, or not in time: keep what is shown and try
-      // again in a minute rather than at once.
+      // GitHub answered for none, not in time, or refused for its limit: keep
+      // what is shown and try again in a minute, or when the limit lifts.
       if (current.signal.aborted) return;
       for (const url of due) nextRead.set(url, now + PULL_REFRESH_MS);
     } finally {
@@ -216,6 +247,9 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       }
     }
   }
+  /** Reads `urls`, or from the public API the first few of them: each one's
+   * state, or undefined for one GitHub could not read. Throws when it
+   * answered for none, or refused a public read for its limit. */
   async function readAll(
     urls: readonly string[],
     signal: AbortSignal,
@@ -229,7 +263,14 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         publicUntil = Date.now() + PULL_SLOW_REFRESH_MS;
       }
     return Promise.all(
-      urls.map((url) => readPublicState(url, signal).catch(() => undefined)),
+      urls.slice(0, PUBLIC_READS_PER_POLL).map((url) =>
+        readPublicState(url, signal).catch((error: unknown) => {
+          if (!(error instanceof GitHubRateLimited)) return undefined;
+          // Over the limit: nothing more is read until GitHub says it resets.
+          publicHeldUntil = Math.max(publicHeldUntil, error.resetAt);
+          throw error;
+        }),
+      ),
     );
   }
   /** Reads soon, once for every subscriber that starts watching together. */
@@ -248,6 +289,8 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       let set = listeners.get(url);
       if (!set) {
         set = new Set();
+        if (!listeners.size)
+          document.addEventListener("visibilitychange", returned);
         listeners.set(url, set);
         // One read within the poll window keeps what it read.
         if (dueAt(url) <= Date.now()) schedule();
@@ -259,6 +302,7 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         if (set.size) return;
         listeners.delete(url);
         if (listeners.size) return;
+        document.removeEventListener("visibilitychange", returned);
         clearTimeout(timer);
         timer = undefined;
         controller?.abort();
diff --git a/src/bundled/github/solo-pull.test.ts b/src/bundled/github/solo-pull.test.ts
index 5466d9f721..8b125b5d63 100644
--- a/src/bundled/github/solo-pull.test.ts
+++ b/src/bundled/github/solo-pull.test.ts
@@ -184,9 +184,14 @@ it("shows every shown chat's linked pull request from one shared read", async ()
   expect(pulls.get(chat)).toBe(pulls.get(chat));
   expect(pulls.get(other)?.state).toBe(pulls.get(chat)?.state);
   expect(pulls.get("33333333-3333-4333-8333-333333333333")).toBeUndefined();
-  // The store polls it while a chat that links it is shown.
+  // The store polls it while a chat that links it is shown; a poll that
+  // reads the same state leaves the rows' views, and the rows, alone.
+  const view = pulls.get(chat);
+  const told = changed.mock.calls.length;
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
   expect(gh).toHaveBeenCalledTimes(2);
+  expect(pulls.get(chat)).toBe(view);
+  expect(changed).toHaveBeenCalledTimes(told);
   for (const unwatch of stop) unwatch();
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS * 3);
   expect(gh).toHaveBeenCalledTimes(2);

From 810922f5cfe8a413ee836916e7d0dc51880acda7 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 16:14:29 +1100
Subject: [PATCH 09/15] test(app): expect the GitHub pull request link renderer
 beside Links

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/app/pages.integration.test.mjs | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/app/pages.integration.test.mjs b/src/app/pages.integration.test.mjs
index 0a7aefa715..37ba38979e 100644
--- a/src/app/pages.integration.test.mjs
+++ b/src/app/pages.integration.test.mjs
@@ -239,18 +239,19 @@ test("the app runtime exposes ready bundled pages and removes them on disable",
       ["buzz.agents"],
     );
     assert.equal(services.conversation.inline.snapshot().length, 1);
+    const linkPlugins = () =>
+      services.conversation.links
+        .snapshot()
+        .map((link) => link.pluginId)
+        .sort();
     await vi.waitFor(() =>
-      assert.equal(services.conversation.links.snapshot().length, 1),
-    );
-    assert.equal(
-      services.conversation.links.snapshot()[0].pluginId,
-      "buzz.links",
+      assert.deepEqual(linkPlugins(), ["buzz.github", "buzz.links"]),
     );
     await services.plugins.change("disable", "buzz.links");
-    assert.equal(services.conversation.links.snapshot().length, 0);
+    assert.deepEqual(linkPlugins(), ["buzz.github"]);
     await services.plugins.change("enable", "buzz.links");
     await vi.waitFor(() =>
-      assert.equal(services.conversation.links.snapshot().length, 1),
+      assert.deepEqual(linkPlugins(), ["buzz.github", "buzz.links"]),
     );
     const tools = services.conversation.tools.snapshot();
     const inline = services.conversation.inline.snapshot();

From 489c72e202d9e78a429c0a087245feadb115bec5 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Wed, 28 Oct 2026 16:59:05 +1100
Subject: [PATCH 10/15] fix(github): refuse unrepresentable numbers, hold
 public reads without gh, read nothing while composing, name the state icon

Addresses the four P2 findings of the review of 1088c2122 on PR #1790.

A displayed link ending in `/pull/2147483648` parsed as a pull request, so
the store admitted it to the shared `gh` query, where `$pN: Int!` cannot hold
it. GitHub rejected the whole request with no data, so every pull request
shown alongside stayed unknown or stale, and the batch failed the same way a
minute later for as long as the link was mounted. `parseGitHubReference` now
requires a number a signed 32-bit integer can hold, which is how GitHub
numbers them, so such a URL is no reference: Links keeps it as a plain GitHub
link, the store never sees it and the panel does not claim it.

The desktop host always supplies `gh`, so without a sign-in every poll throws
`GhUnavailable` and falls to the public API. Once `publicUntil` lapsed,
`readsPublic()` was false at the top of the poll, so the hold guard was
skipped, and the fallback read publicly without looking at `publicHeldUntil`:
a 403 with a reset an hour out produced a refused fetch every five minutes.
The fallback now checks the hold after `gh` throws and reads nothing under
it. `gh` is still tried every five minutes, so a later sign-in is picked up,
and the public API only once GitHub says it resets. The five-minute public
cadence while `gh` is unavailable is kept: that poll is what retries `gh`,
and the hold now bounds what it can spend.

Composer decorations and previews render links through `MessageLink` with
`interactive={false}`, but a renderer component knows only its URL, so typing
`/pull/1790` watched `/pull/1`, `/17`, `/179` and `/1790` in turn, spending a
public read on each prefix, or with `gh` restarting the batch per keystroke.
`LinkInteractiveContext` joins the host's other link contexts in
`LinkLabelContext.ts`; `MessageLink` provides its `interactive` prop through
it, and `PullLink` shows what the store already knows without watching when
it is false. The `LinkRenderer` contract is unchanged.

The state was a `title` on a generic span around an `aria-hidden` glyph, so
accessibility snapshots held only the link's name and URL. The span is now
`role="img"` named by `describePull`, as the status display is, so the tree
shows `img "Pull request, merged"` inside the link, while a labelled link
keeps its authored name from the anchor's `aria-label`.

Tests: a number past Int is no reference, and its neighbours are read in one
query without it; a refusal while `gh` is unavailable holds the public API
until the reset while `gh` is retried, telling no one; a non-interactive
`PullLink` shows cached state without watching, and a composed `MessageLink`
with both renderers spends no read; the state is found by role and name
through every transition while the link keeps its authored name. Each fails
on the previous code: seven refused fetches in 30 minutes, the invalid number
in the query's variables, a watched decoration, and no `img` in the tree.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/plugin-architecture.md                   |  4 +-
 src/bundled/github/PullLink.test.tsx          | 61 ++++++++++++++++++-
 src/bundled/github/PullLink.tsx               | 15 +++--
 src/bundled/github/pull-states.test.ts        | 54 ++++++++++++----
 src/bundled/github/pull-states.ts             |  7 ++-
 src/bundled/github/references.test.ts         |  3 +
 src/bundled/github/references.ts              |  4 +-
 src/features/conversation/LinkLabelContext.ts |  4 ++
 src/features/conversation/MessageLink.tsx     |  7 ++-
 9 files changed, 134 insertions(+), 25 deletions(-)

diff --git a/docs/plugin-architecture.md b/docs/plugin-architecture.md
index a5d214d692..a44174b17d 100644
--- a/docs/plugin-architecture.md
+++ b/docs/plugin-architecture.md
@@ -1420,7 +1420,9 @@ link to the same destination, routed through the same host navigation handler. O
 session's bounded thread reader; closing disposes it. The reader supplies verified
 message content, author and timestamp and preserves edit/deletion/access handling.
 Previewing never acknowledges reading or switches community. The host offers a
-resolved label to the bundled presentation via `LinkLabelContext`; no author API
+resolved label to the bundled presentation via `LinkLabelContext`, and whether
+the link is live or a composer decoration or preview via `LinkInteractiveContext`,
+so a renderer reads nothing for a draft; no author API
 contract or relay protocol changes are required. Known channel references and
 unambiguous signed person/agent mentions share the inline hover styling. Names in
 ordinary prose never create notification intent or establish an identity.
diff --git a/src/bundled/github/PullLink.test.tsx b/src/bundled/github/PullLink.test.tsx
index 43d9b19213..4ad6bcd4c4 100644
--- a/src/bundled/github/PullLink.test.tsx
+++ b/src/bundled/github/PullLink.test.tsx
@@ -1,11 +1,21 @@
 // @vitest-environment jsdom
 import "@testing-library/jest-dom/vitest";
-import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
+import {
+  act,
+  cleanup,
+  render,
+  screen,
+  waitFor,
+  within,
+} from "@testing-library/react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { afterEach, expect, it, vi } from "vitest";
 import type { Contribution } from "../../plugins/contributions";
 import type { LinkRenderer } from "../../features/conversation/contracts";
-import { LinkLabelContext } from "../../features/conversation/LinkLabelContext";
+import {
+  LinkInteractiveContext,
+  LinkLabelContext,
+} from "../../features/conversation/LinkLabelContext";
 import {
   MessageLink,
   resolveLink,
@@ -63,6 +73,10 @@ it("shows the authored label with the plain pull request glyph until read, then
   expect(container).toHaveTextContent("fix(search): tokens");
   expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
   expect(icon(container)).toHaveAttribute("title", "Pull request");
+  // The state is read out, not only shown.
+  expect(screen.getByRole("img", { name: "Pull request" })).toBe(
+    icon(container),
+  );
   expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
   for (const [state, words] of [
     [
@@ -76,15 +90,30 @@ it("shows the authored label with the plain pull request glyph until read, then
     act(() => states.set(state));
     expect(icon(container)).toHaveAttribute("data-pr-state", state.state);
     expect(icon(container)).toHaveAttribute("title", words);
+    expect(screen.getByRole("img", { name: words })).toBe(icon(container));
     expect(icon(container)?.innerHTML).toBe(glyph(stateIcons[state.state]));
   }
   // One GitHub cannot read keeps the plain glyph, and says so.
   act(() => states.set("failed"));
   expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
   expect(icon(container)).toHaveAttribute("title", "Pull request, unavailable");
+  expect(screen.getByRole("img", { name: "Pull request, unavailable" })).toBe(
+    icon(container),
+  );
   expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
 });
 
+it("shows what is known of a pull request while composing, without watching it", () => {
+  const states = fakeStates({ state: "merged" });
+  const { container } = render(
+    <LinkInteractiveContext value={false}>
+      <PullLink url={pull} states={states} />
+    </LinkInteractiveContext>,
+  );
+  expect(icon(container)).toHaveAttribute("data-pr-state", "merged");
+  expect(states.watch).not.toHaveBeenCalled();
+});
+
 it("watches the pull request only while shown", () => {
   const states = fakeStates({ state: "open" });
   const { unmount } = render(<PullLink url={pull} states={states} />);
@@ -128,7 +157,10 @@ const registry = (entries: readonly Contribution<LinkRenderer>[]) => ({
   snapshot: () => entries,
   subscribe: () => () => {},
 });
-const message = (entries: readonly Contribution<LinkRenderer>[]) =>
+const message = (
+  entries: readonly Contribution<LinkRenderer>[],
+  interactive = true,
+) =>
   render(
     <ToastProvider>
       <MessageLink
@@ -136,6 +168,7 @@ const message = (entries: readonly Contribution<LinkRenderer>[]) =>
         registry={registry(entries)}
         onOpenLink={() => true}
         label="Fix the lab"
+        interactive={interactive}
       />
     </ToastProvider>,
   );
@@ -165,6 +198,11 @@ it("takes pull request links from Links, which keeps the rest of GitHub and stan
   await waitFor(() =>
     expect(icon(both.container)).toHaveAttribute("data-pr-state", "open"),
   );
+  // The state joins the accessibility tree; the link keeps its authored name.
+  expect(within(anchor).getByRole("img", { name: "Pull request, open" })).toBe(
+    icon(both.container),
+  );
+  expect(screen.getByRole("link", { name: "Fix the lab" })).toBe(anchor);
   cleanup();
 
   const only = message([links]);
@@ -179,6 +217,23 @@ it("takes pull request links from Links, which keeps the rest of GitHub and stan
   );
 });
 
+it("reads nothing for a pull request link while it is composed", async () => {
+  const { links, github } = renderers();
+  const fetch = vi.fn(
+    async () => new Response(JSON.stringify({ state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  // Typing the link mounts a decoration for `/pull/1`, `/pull/17`, …; none of
+  // them spends a public read.
+  const { container } = message([links, github], false);
+  // The store reads in a microtask after the first subscriber; flush it.
+  await act(async () => {});
+  expect(screen.queryByRole("link")).toBeNull();
+  expect(container).toHaveTextContent("Fix the lab");
+  expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
+  expect(fetch).not.toHaveBeenCalled();
+});
+
 it("leaves the plain link when the renderer fails", () => {
   const { links, github } = renderers();
   const broken = {
diff --git a/src/bundled/github/PullLink.tsx b/src/bundled/github/PullLink.tsx
index a081c07bc3..68a060127a 100644
--- a/src/bundled/github/PullLink.tsx
+++ b/src/bundled/github/PullLink.tsx
@@ -1,4 +1,5 @@
-import { useCallback, useSyncExternalStore } from "react";
+import { useCallback, useContext, useSyncExternalStore } from "react";
+import { LinkInteractiveContext } from "../../features/conversation/LinkLabelContext";
 import { LinkLabel } from "../links/InlineLink";
 import inlineStyles from "../../shared/InlineReference.module.css";
 import { describePull, stateIcons } from "./pull-state-view";
@@ -8,15 +9,19 @@ import styles from "./GitHub.module.css";
 /** A pull request link in a message: the Links label with the pull request's
  * state as its icon, in place of the GitHub logo. */
 export function PullLink({ url, states }: { url: string; states: PullStates }) {
+  // A composer decoration or preview shows what is already known and reads
+  // nothing: typing a link mounts one for every prefix of its number.
+  const live = useContext(LinkInteractiveContext);
   const subscribe = useCallback(
-    (listener: () => void) => states.watch(url, listener),
-    [states, url],
+    (listener: () => void) => (live ? states.watch(url, listener) : () => {}),
+    [live, states, url],
   );
   const read = useSyncExternalStore(subscribe, () => states.get(url));
   const state = typeof read === "object" ? read : undefined;
   // The plain pull request glyph until read, and when it can't be, so the
   // icon doesn't swap when the state arrives.
   const Icon = stateIcons[state?.state ?? "open"];
+  const words = describePull({ state, failed: read === "failed" });
   return (
     <LinkLabel
       href={url}
@@ -24,7 +29,9 @@ export function PullLink({ url, states }: { url: string; states: PullStates }) {
         <span
           className={styles.pullState}
           data-pr-state={state?.state ?? "unknown"}
-          title={describePull({ state, failed: read === "failed" })}
+          role="img"
+          aria-label={words}
+          title={words}
         >
           <Icon aria-hidden="true" className={inlineStyles.icon} />
         </span>
diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index 08de4009da..10b35e5518 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -146,21 +146,22 @@ it("keys a pull request by its canonical URL, so pasted variants share one entry
   for (const unwatch of stop) unwatch();
 });
 
-it("neither watches nor throws for a URL that is not a pull request's", async () => {
-  const gh = mockGh(async () => ({}));
+it("neither watches nor throws for a URL that is not a pull request's, and reads the rest", async () => {
+  const gh = mockGh(async () => ({ r0: rollup("OPEN") }));
   const states = createPullStates(gh);
-  const unwatch = states.watch(
-    "https://github.com/block/buzz-app/issues/7",
-    () => {},
-  );
+  const issue = "https://github.com/block/buzz-app/issues/7";
+  // A number GraphQL's Int cannot hold would fail the whole query, and with
+  // it every pull request shown alongside.
+  const beyond = "https://github.com/block/buzz-app/pull/2147483648";
+  const stop = [issue, beyond, pull].map((url) => states.watch(url, () => {}));
   states.watch("not a url", () => {})();
-  await vi.waitFor(() => expect(states.get(pull)).toBeUndefined());
-  expect(gh).not.toHaveBeenCalled();
-  expect(states.get("https://github.com/block/buzz-app/issues/7")).toBe(
-    "failed",
-  );
-  expect(states.get("not a url")).toBe("failed");
-  unwatch();
+  await vi.waitFor(() => expect(states.get(pull)).toBeDefined());
+  expect(gh).toHaveBeenCalledOnce();
+  expect(gh.mock.calls[0]?.[1]).toEqual({ o0: "block", n0: "buzz-app", p0: 7 });
+  expect(states.get(pull)).toMatchObject({ state: "open" });
+  for (const url of [issue, beyond, "not a url"])
+    expect(states.get(url)).toBe("failed");
+  for (const unwatch of stop) unwatch();
 });
 
 it("keeps what it read for a pull request watched again within the minute", async () => {
@@ -485,6 +486,33 @@ it("tries gh again before GitHub's public limit resets, when there is one", asyn
   expect(fetch).toHaveBeenCalledOnce();
 });
 
+it("holds public reads for GitHub's limit while gh is unavailable too", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi
+    .fn()
+    .mockResolvedValueOnce(limited(Date.now() + 60 * 60_000))
+    .mockResolvedValue(new Response(JSON.stringify({ state: "open" })));
+  vi.stubGlobal("fetch", fetch);
+  // The desktop host always supplies gh; without a sign-in every read throws.
+  const gh = mockGh(async () => {
+    throw new GhUnavailable();
+  });
+  const states = createPullStates(gh);
+  const changed = vi.fn();
+  states.watch(pull, changed);
+  await vi.waitFor(() => expect(fetch).toHaveBeenCalledOnce());
+  // gh is tried again every few minutes; the public API, refused, not until
+  // GitHub says it resets, and nothing is shown as unavailable meanwhile.
+  await vi.advanceTimersByTimeAsync(30 * 60_000);
+  expect(gh).toHaveBeenCalledTimes(7);
+  expect(fetch).toHaveBeenCalledOnce();
+  expect(changed).not.toHaveBeenCalled();
+  expect(states.get(pull)).toBeUndefined();
+  await vi.advanceTimersByTimeAsync(30 * 60_000);
+  await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "open" }));
+  expect(fetch).toHaveBeenCalledTimes(2);
+});
+
 it("reads public data while gh is unavailable, and goes back to gh once it is available again", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   vi.stubGlobal(
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 3e5df7ca91..da16116836 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -150,8 +150,9 @@ const keyOf = (url: string) => {
  * subscriber that appears together, then polled only while shown, visible and
  * able to change: a merged one is never read again, a closed one or one GitHub
  * could not read every few minutes. Without `gh`, a few at a time are read
- * from the public API, each once, tried again every few minutes until it is,
- * and none while GitHub holds its limit; the panel has the live view. */
+ * from the public API, each once, tried again every few minutes until it is;
+ * while `gh` is unavailable, likewise until it is tried again. None is read
+ * while GitHub holds its limit; the panel has the live view. */
 export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const listeners = new Map<string, Set<() => void>>();
   const states = new Map<string, PullState | "failed">();
@@ -261,6 +262,8 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         // Offline or signed out for now; gh is tried again next public read.
         if (!(error instanceof GhUnavailable)) throw error;
         publicUntil = Date.now() + PULL_SLOW_REFRESH_MS;
+        // GitHub may still be refusing public reads from the last time.
+        if (Date.now() < publicHeldUntil) return [];
       }
     return Promise.all(
       urls.slice(0, PUBLIC_READS_PER_POLL).map((url) =>
diff --git a/src/bundled/github/references.test.ts b/src/bundled/github/references.test.ts
index 67257056a6..88ecd8d12a 100644
--- a/src/bundled/github/references.test.ts
+++ b/src/bundled/github/references.test.ts
@@ -7,6 +7,7 @@ it("recognizes typed GitHub references while refusing lookalike hosts and invali
     ["block/buzz/pull/23", "pull"],
     ["block/buzz/issues/12", "issue"],
     ["block/buzz/commit/abcdef1234", "commit"],
+    ["block/buzz/pull/2147483647", "pull"],
   ]) {
     expect(parseGitHubReference(`https://github.com/${path}`)?.kind).toBe(kind);
   }
@@ -17,6 +18,8 @@ it("recognizes typed GitHub references while refusing lookalike hosts and invali
     "https://github.com/block/buzz/tree/main",
     "https://github.com/block/buzz/blob/main/README.md",
     "https://github.com/block/buzz/pull/0",
+    "https://github.com/block/buzz/pull/2147483648",
+    "https://github.com/block/buzz/issues/99999999999",
     "https://github.com/block/buzz/commit/nope",
   ])
     expect(parseGitHubReference(url)).toBeUndefined();
diff --git a/src/bundled/github/references.ts b/src/bundled/github/references.ts
index 25182486c8..081967ad3a 100644
--- a/src/bundled/github/references.ts
+++ b/src/bundled/github/references.ts
@@ -31,7 +31,9 @@ export function parseGitHubReference(
     if (
       (surface === "pull" || surface === "issues") &&
       rest.length === 1 &&
-      /^[1-9]\d*$/.test(target)
+      /^[1-9]\d*$/.test(target) &&
+      // GitHub numbers these with a signed 32-bit integer; past it is no one's.
+      Number(target) <= 0x7fffffff
     ) {
       // A link to one comment or review goes to GitHub, which can show it.
       if (url.hash) return;
diff --git a/src/features/conversation/LinkLabelContext.ts b/src/features/conversation/LinkLabelContext.ts
index 5a9a7a0968..2f949543b3 100644
--- a/src/features/conversation/LinkLabelContext.ts
+++ b/src/features/conversation/LinkLabelContext.ts
@@ -9,6 +9,10 @@ export const LinkContentContext = createContext<ReactNode>(undefined);
 /** Host-resolved visibility for channel links rendered by a shared link renderer. */
 export const LinkChannelPrivateContext = createContext(false);
 
+/** Whether the link is live in a message, rather than a composer decoration or
+ * preview: a renderer that reads anything for its link does so only then. */
+export const LinkInteractiveContext = createContext(true);
+
 /** Host workspace opener for a message link's thread tab; false when it cannot. */
 export const LinkThreadTabContext = createContext<
   | ((channelId: string, messageId: string, rootId: string) => boolean)
diff --git a/src/features/conversation/MessageLink.tsx b/src/features/conversation/MessageLink.tsx
index a571c303ee..d13b6ed98d 100644
--- a/src/features/conversation/MessageLink.tsx
+++ b/src/features/conversation/MessageLink.tsx
@@ -36,6 +36,7 @@ import {
 import { parseBuzzLink, isBuzzLink } from "../navigation/buzz-links";
 import {
   LinkChannelPrivateContext,
+  LinkInteractiveContext,
   LinkLabelContext,
   LinkContentContext,
   LinkThreadTabContext,
@@ -448,7 +449,11 @@ export function MessageLink({
       value={channelPrivate || withheld || !!named?.private}
     >
       <LinkLabelContext value={display}>
-        <LinkContentContext value={shown}>{result}</LinkContentContext>
+        <LinkContentContext value={shown}>
+          <LinkInteractiveContext value={interactive}>
+            {result}
+          </LinkInteractiveContext>
+        </LinkContentContext>
       </LinkLabelContext>
     </LinkChannelPrivateContext>
   );

From 84ecf5a5ab2dacd3895e68e36a0f51c2a024a089 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Thu, 29 Oct 2026 12:10:28 +1100
Subject: [PATCH 11/15] fix(github): describe pull request links by state, keep
 their name, and expect the inline read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the two branch defects in the CI notes on #1790, which failed ten
browser journeys on both engines in every run.

5a091da59 gave the state glyph `role="img"` named by `describePull`, inside
the host's anchor. A link shown as its URL has no `aria-label`, so its name is
computed from its contents and became "Pull request, openhttps://…": no
separator, and a name that changed from "Pull request" to "…open…" to
"…merged…" as the state was read. Screen readers announced it run together,
and `layout.spec.mjs`'s exact-name lookup no longer found the link.

The state now describes the link instead. `LinkDescriptionContext` joins the
host's link contexts in `LinkLabelContext.ts`. `MessageLink` provides a setter
for its live anchor's `aria-description`, the attribute it already sets for an
unavailable chat. `PullLink` sets the state's words while shown and clears
them on unmount. The glyph's span is `aria-hidden` again, keeping its `title`
tooltip, so the name stays the authored label or the URL whatever the state.
The `LinkRenderer` contract is unchanged, and a composer decoration has no
anchor to describe.

The inline link's state read made the panel's GitHub journeys count one more
`pulls/N` request than they expected. In the API-error journey, that read hit
the fixture's 403 and logged an unexpected console error. These journeys now
expect it. Before opening the panel, each waits for the inline read: the two
checklist journeys on the link's description "Pull request, open", the error
journey on the refused response. Then they expect `pulls/N` twice, or allow
the 403 twice. After the refusal, the store holds public reads until GitHub's
reset, so the retry adds no third read.

Tests: the unit test of the states expects each one's words as the
description and none once unmounted; a labelled link keeps its name with the
state as its description; and a link shown as its URL is named by the URL
alone before and after it is read as merged. All three fail on the previous
`PullLink`. `layout.spec.mjs`, `external-links.spec.mjs` and
`github-checklist.spec.mjs` pass on Chromium and WebKit (52 cases).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/plugin-architecture.md                   |  4 +-
 src/bundled/github/PullLink.test.tsx          | 73 +++++++++++++------
 src/bundled/github/PullLink.tsx               | 22 +++++-
 src/features/conversation/LinkLabelContext.ts |  7 ++
 src/features/conversation/MessageLink.tsx     | 10 ++-
 tests/browser/external-links.spec.mjs         | 17 ++++-
 tests/browser/github-checklist.spec.mjs       |  5 +-
 7 files changed, 103 insertions(+), 35 deletions(-)

diff --git a/docs/plugin-architecture.md b/docs/plugin-architecture.md
index a44174b17d..503cb9e2f5 100644
--- a/docs/plugin-architecture.md
+++ b/docs/plugin-architecture.md
@@ -1422,7 +1422,9 @@ message content, author and timestamp and preserves edit/deletion/access handlin
 Previewing never acknowledges reading or switches community. The host offers a
 resolved label to the bundled presentation via `LinkLabelContext`, and whether
 the link is live or a composer decoration or preview via `LinkInteractiveContext`,
-so a renderer reads nothing for a draft; no author API
+so a renderer reads nothing for a draft. A renderer that shows a status, such as
+a pull request's state, describes the host anchor via `LinkDescriptionContext`,
+so the link keeps its label or URL as its name; no author API
 contract or relay protocol changes are required. Known channel references and
 unambiguous signed person/agent mentions share the inline hover styling. Names in
 ordinary prose never create notification intent or establish an identity.
diff --git a/src/bundled/github/PullLink.test.tsx b/src/bundled/github/PullLink.test.tsx
index 4ad6bcd4c4..0edeb1aae4 100644
--- a/src/bundled/github/PullLink.test.tsx
+++ b/src/bundled/github/PullLink.test.tsx
@@ -1,18 +1,12 @@
 // @vitest-environment jsdom
 import "@testing-library/jest-dom/vitest";
-import {
-  act,
-  cleanup,
-  render,
-  screen,
-  waitFor,
-  within,
-} from "@testing-library/react";
+import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { afterEach, expect, it, vi } from "vitest";
 import type { Contribution } from "../../plugins/contributions";
 import type { LinkRenderer } from "../../features/conversation/contracts";
 import {
+  LinkDescriptionContext,
   LinkInteractiveContext,
   LinkLabelContext,
 } from "../../features/conversation/LinkLabelContext";
@@ -65,18 +59,19 @@ const icon = (container: HTMLElement) =>
 
 it("shows the authored label with the plain pull request glyph until read, then each state's own", () => {
   const states = fakeStates();
-  const { container } = render(
-    <LinkLabelContext value="fix(search): tokens">
-      <PullLink url={pull} states={states} />
-    </LinkLabelContext>,
+  const describe = vi.fn();
+  const { container, unmount } = render(
+    <LinkDescriptionContext value={describe}>
+      <LinkLabelContext value="fix(search): tokens">
+        <PullLink url={pull} states={states} />
+      </LinkLabelContext>
+    </LinkDescriptionContext>,
   );
   expect(container).toHaveTextContent("fix(search): tokens");
   expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
   expect(icon(container)).toHaveAttribute("title", "Pull request");
-  // The state is read out, not only shown.
-  expect(screen.getByRole("img", { name: "Pull request" })).toBe(
-    icon(container),
-  );
+  // The state is read out as the link's description, not only shown.
+  expect(describe).toHaveBeenLastCalledWith("Pull request");
   expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
   for (const [state, words] of [
     [
@@ -90,17 +85,18 @@ it("shows the authored label with the plain pull request glyph until read, then
     act(() => states.set(state));
     expect(icon(container)).toHaveAttribute("data-pr-state", state.state);
     expect(icon(container)).toHaveAttribute("title", words);
-    expect(screen.getByRole("img", { name: words })).toBe(icon(container));
+    expect(describe).toHaveBeenLastCalledWith(words);
     expect(icon(container)?.innerHTML).toBe(glyph(stateIcons[state.state]));
   }
   // One GitHub cannot read keeps the plain glyph, and says so.
   act(() => states.set("failed"));
   expect(icon(container)).toHaveAttribute("data-pr-state", "unknown");
   expect(icon(container)).toHaveAttribute("title", "Pull request, unavailable");
-  expect(screen.getByRole("img", { name: "Pull request, unavailable" })).toBe(
-    icon(container),
-  );
+  expect(describe).toHaveBeenLastCalledWith("Pull request, unavailable");
   expect(icon(container)?.innerHTML).toBe(glyph(stateIcons.open));
+  // A removed link leaves the anchor undescribed.
+  unmount();
+  expect(describe).toHaveBeenLastCalledWith(undefined);
 });
 
 it("shows what is known of a pull request while composing, without watching it", () => {
@@ -198,10 +194,8 @@ it("takes pull request links from Links, which keeps the rest of GitHub and stan
   await waitFor(() =>
     expect(icon(both.container)).toHaveAttribute("data-pr-state", "open"),
   );
-  // The state joins the accessibility tree; the link keeps its authored name.
-  expect(within(anchor).getByRole("img", { name: "Pull request, open" })).toBe(
-    icon(both.container),
-  );
+  // The state describes the link; the link keeps its authored name.
+  expect(anchor).toHaveAttribute("aria-description", "Pull request, open");
   expect(screen.getByRole("link", { name: "Fix the lab" })).toBe(anchor);
   cleanup();
 
@@ -217,6 +211,37 @@ it("takes pull request links from Links, which keeps the rest of GitHub and stan
   );
 });
 
+it("names a pull request link shown as its URL by the URL alone, whatever its state", async () => {
+  const { links, github } = renderers();
+  // Its own pull request: the store keeps what earlier tests read.
+  const raw = "https://github.com/block/buzz-app/pull/8";
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(
+      async () =>
+        new Response(JSON.stringify({ state: "closed", merged: true })),
+    ),
+  );
+  const { container } = render(
+    <ToastProvider>
+      <MessageLink
+        url={raw}
+        registry={registry([links, github])}
+        onOpenLink={() => true}
+      >
+        {raw}
+      </MessageLink>
+    </ToastProvider>,
+  );
+  const anchor = screen.getByRole("link", { name: raw });
+  expect(anchor).toHaveAttribute("aria-description", "Pull request");
+  await waitFor(() =>
+    expect(icon(container)).toHaveAttribute("data-pr-state", "merged"),
+  );
+  expect(screen.getByRole("link", { name: raw })).toBe(anchor);
+  expect(anchor).toHaveAttribute("aria-description", "Pull request, merged");
+});
+
 it("reads nothing for a pull request link while it is composed", async () => {
   const { links, github } = renderers();
   const fetch = vi.fn(
diff --git a/src/bundled/github/PullLink.tsx b/src/bundled/github/PullLink.tsx
index 68a060127a..695fdb539e 100644
--- a/src/bundled/github/PullLink.tsx
+++ b/src/bundled/github/PullLink.tsx
@@ -1,5 +1,13 @@
-import { useCallback, useContext, useSyncExternalStore } from "react";
-import { LinkInteractiveContext } from "../../features/conversation/LinkLabelContext";
+import {
+  useCallback,
+  useContext,
+  useEffect,
+  useSyncExternalStore,
+} from "react";
+import {
+  LinkDescriptionContext,
+  LinkInteractiveContext,
+} from "../../features/conversation/LinkLabelContext";
 import { LinkLabel } from "../links/InlineLink";
 import inlineStyles from "../../shared/InlineReference.module.css";
 import { describePull, stateIcons } from "./pull-state-view";
@@ -22,6 +30,13 @@ export function PullLink({ url, states }: { url: string; states: PullStates }) {
   // icon doesn't swap when the state arrives.
   const Icon = stateIcons[state?.state ?? "open"];
   const words = describePull({ state, failed: read === "failed" });
+  // The state describes the link rather than joining its name, which stays
+  // the authored label or the URL as the state changes.
+  const describe = useContext(LinkDescriptionContext);
+  useEffect(() => {
+    describe?.(words);
+    return () => describe?.(undefined);
+  }, [describe, words]);
   return (
     <LinkLabel
       href={url}
@@ -29,8 +44,7 @@ export function PullLink({ url, states }: { url: string; states: PullStates }) {
         <span
           className={styles.pullState}
           data-pr-state={state?.state ?? "unknown"}
-          role="img"
-          aria-label={words}
+          aria-hidden="true"
           title={words}
         >
           <Icon aria-hidden="true" className={inlineStyles.icon} />
diff --git a/src/features/conversation/LinkLabelContext.ts b/src/features/conversation/LinkLabelContext.ts
index 2f949543b3..619dbd5012 100644
--- a/src/features/conversation/LinkLabelContext.ts
+++ b/src/features/conversation/LinkLabelContext.ts
@@ -13,6 +13,13 @@ export const LinkChannelPrivateContext = createContext(false);
  * preview: a renderer that reads anything for its link does so only then. */
 export const LinkInteractiveContext = createContext(true);
 
+/** Sets the host anchor's description, such as a pull request's state, so a
+ * renderer's status reaches assistive technology without joining the link's
+ * name. Undefined when there is no anchor to describe. */
+export const LinkDescriptionContext = createContext<
+  ((description: string | undefined) => void) | undefined
+>(undefined);
+
 /** Host workspace opener for a message link's thread tab; false when it cannot. */
 export const LinkThreadTabContext = createContext<
   | ((channelId: string, messageId: string, rootId: string) => boolean)
diff --git a/src/features/conversation/MessageLink.tsx b/src/features/conversation/MessageLink.tsx
index d13b6ed98d..463a7b181d 100644
--- a/src/features/conversation/MessageLink.tsx
+++ b/src/features/conversation/MessageLink.tsx
@@ -36,6 +36,7 @@ import {
 import { parseBuzzLink, isBuzzLink } from "../navigation/buzz-links";
 import {
   LinkChannelPrivateContext,
+  LinkDescriptionContext,
   LinkInteractiveContext,
   LinkLabelContext,
   LinkContentContext,
@@ -92,6 +93,7 @@ export function MessageLink({
   const renderer = resolveLink(url, renderers);
   const [unavailable, setUnavailable] = useState(false);
   const [previewOpen, setPreviewOpen] = useState(false);
+  const [description, setDescription] = useState<string>();
   if (!active && previewOpen) setPreviewOpen(false);
   const trigger = useRef<HTMLAnchorElement>(null);
   const internal = isBuzzLink(url);
@@ -275,7 +277,7 @@ export function MessageLink({
         aria-description={
           chatChip && withheld
             ? "Chat unavailable. You don’t have access, or it no longer exists."
-            : undefined
+            : description
         }
         data-link-label={label ?? ""}
         data-solo-link={chatChip ? "" : undefined}
@@ -451,7 +453,11 @@ export function MessageLink({
       <LinkLabelContext value={display}>
         <LinkContentContext value={shown}>
           <LinkInteractiveContext value={interactive}>
-            {result}
+            <LinkDescriptionContext
+              value={interactive ? setDescription : undefined}
+            >
+              {result}
+            </LinkDescriptionContext>
           </LinkInteractiveContext>
         </LinkContentContext>
       </LinkLabelContext>
diff --git a/tests/browser/external-links.spec.mjs b/tests/browser/external-links.spec.mjs
index 8cda21bf65..a7227d1c81 100644
--- a/tests/browser/external-links.spec.mjs
+++ b/tests/browser/external-links.spec.mjs
@@ -115,8 +115,10 @@ test("GitHub API errors offer prominent external opening before retry", async ({
 }, testInfo) => {
   const target = github;
   const detailsUrl = "https://api.github.com/repos/block/buzz/pulls/1";
-  // Permit only this injected response's engine console report, once by exact URL.
-  app.report.githubFailures = [detailsUrl];
+  // Permit only this injected response's engine console reports by exact URL:
+  // once for the inline link's state, which then holds its public reads until
+  // GitHub's reset, and once for the panel.
+  app.report.githubFailures = [detailsUrl, detailsUrl];
   await context.route(github, (route) =>
     route.fulfill({
       contentType: "text/html",
@@ -133,8 +135,11 @@ test("GitHub API errors offer prominent external opening before retry", async ({
   );
   await page.goto(app.origin);
   await openMessages(page);
+  const stateRead = page.waitForResponse(detailsUrl);
   app.append("primary", "alpha", target);
   await expect(link(page, target)).toBeAttached();
+  // The inline link reads the state first; the panel's read is then the next.
+  await stateRead;
   await end(page);
   await link(page, target).click();
   const panel = page.getByRole("complementary", {
@@ -814,6 +819,10 @@ test("PR Last updated remains relative in the built pane beside its checklist",
   await page.goto(app.origin);
   await openMessages(page);
   app.append("primary", "alpha", "https://github.com/sample/project/pull/6");
+  // The inline link reads its state once before the panel opens.
+  await expect(
+    link(page, "https://github.com/sample/project/pull/6"),
+  ).toHaveAccessibleDescription("Pull request, open");
   await link(page, "https://github.com/sample/project/pull/6").click();
   const panel = page.getByRole("complementary", {
     name: "GitHub",
@@ -825,13 +834,15 @@ test("PR Last updated remains relative in the built pane beside its checklist",
   await expect(panel.locator("time")).toHaveCSS("font-size", "12px");
   await expect(panel.locator("time")).toHaveText("3 minutes ago");
   await expect(panel.locator("time")).toHaveAttribute("datetime", updatedAt);
-  // Without gh, the checklist reads CI on the head commit and nothing else.
+  // Without gh, the checklist reads CI on the head commit and nothing else;
+  // the pull request is read for the inline link's state and for the panel.
   await expect
     .poll(() => requests.slice().sort())
     .toEqual([
       "/repos/sample/project/commits/head-sha/check-runs",
       "/repos/sample/project/commits/head-sha/status",
       "/repos/sample/project/pulls/6",
+      "/repos/sample/project/pulls/6",
     ]);
   for (const mode of ["light", "dark"]) {
     await page.emulateMedia({ colorScheme: mode });
diff --git a/tests/browser/github-checklist.spec.mjs b/tests/browser/github-checklist.spec.mjs
index 51aeb1967b..bc52b62dd7 100644
--- a/tests/browser/github-checklist.spec.mjs
+++ b/tests/browser/github-checklist.spec.mjs
@@ -56,7 +56,8 @@ test("a PR opens on its checklist, with failing checks linked and wrapping in a
   await settle(page);
   app.append("primary", "alpha", target);
   const link = page.locator(`[data-message-id] a[href="${target}"]`);
-  await expect(link).toBeAttached();
+  // The inline link reads its state once before the panel opens.
+  await expect(link).toHaveAccessibleDescription("Pull request, open");
   await end(page);
   await link.click();
   const panel = page.getByRole("complementary", {
@@ -85,10 +86,12 @@ test("a PR opens on its checklist, with failing checks linked and wrapping in a
     .toBe(true);
   // The description is readable alongside the checklist without expanding it.
   await expect(panel.getByRole("heading", { name: "Details" })).toBeVisible();
+  // The pull request is read for the inline link's state and for the panel.
   expect([...requests].sort()).toEqual([
     "/repos/sample/project/commits/head-sha/check-runs",
     "/repos/sample/project/commits/head-sha/status",
     "/repos/sample/project/pulls/1",
+    "/repos/sample/project/pulls/1",
   ]);
   for (const mode of ["light", "dark"]) {
     await page.emulateMedia({ colorScheme: mode });

From 390247c2695391d5be79ba0ff1b5281294ef9326 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Thu, 29 Oct 2026 14:06:45 +1100
Subject: [PATCH 12/15] fix(github): keep public pull request states current,
 read the longest unread first, and keep state icons out of insets

Addresses the review of 2a4d56356 on PR #1790.

Without `gh`, a successful public read set every state's next read to
never, so an open, draft or closed pull request kept the state it was first
read in for the session: neither polling, returning to the window nor a
remount read it again. On `main`, the Solo sidebar read non-merged pull
requests publicly every five minutes. Only merged is now settled. Every
other public state is read again at `PULL_SLOW_REFRESH_MS`, which is what
the store already did while `gh` was unavailable. The 403/429 hold bounds
what that spends.

A public poll read the first ten due URLs in the order they were first
watched. URLs that kept failing, such as private repositories read without
`gh`, came round every five minutes and took the slots back. A URL never
read was left over each time and moved a minute on, so fifty failing links
kept the fifty-first unread indefinitely. Ordering by due time, as the review
suggested, does not help, because that minute moves a left-over URL level
with or behind the failures it lost to; the new test fails that way too. The
store now records when each URL was last read and takes the longest unread
first, never read before all. With `gh` the batch is read whole, so only the
aliases' order changes.

The Solo sidebar's quiet icon read `--icon-subtle`. That role is
`var(--text-subtle)` computed at `:root`, so `.navigation-item`'s hover,
highlight and selected rebinds of `--text-subtle` no longer reached it, and a
selected row showed root grey on the selected fill. `.soloPull` reads
`--text-subtle` again. Only a message link's `.pullState` uses
`--icon-subtle`.

The own bubble rebound the shared icon roles for everything inside it,
including neutral insets. At Buzzin', a pull request glyph inside a table or
revealed spoiler in your own message took the accent ink on
`--surface-panel`: `#fff` on `#fff` in light magenta, iris, cobalt and mono,
and `#000` on `#1a1a1a` in dark bee, citrus and mono. This now follows the
`--mention-*` pattern. The bubble sets `--message-icon-subtle`,
`--message-icon-success` and `--message-icon-categorical-purple`. Both neutral
inset rules reset them to `initial`, as they reset mentions. `.pullState`
reads each one with the shared role as its fallback.

Docs: `plugin-architecture.md` describes the two fallbacks separately:
Links when the plugin is disabled, a plain link when the renderer fails. The
plugin README makes no such claim. `design-system.md` names the bubble's
variables and the inset reset.

An unavailable pull request still shows the plain pull request glyph,
greyed. Tabler, the only allowed source, has no unavailable variant: its pull
request family is open, closed, draft and conflict. The neutral glyphs
already exported each mean something else here or elsewhere: circle-dashed
is draft, x-circle is closed, and help-circle means help. A new glyph meaning
is a designer call under AGENTS.md. The state stays in the link's
`aria-description` and its `title`.

Tests: the store reads a public pull request again every five minutes through
draft and closed, then never once merged. Twelve public links are read again
ten and then two at a time. A never-read link behind fifty failing ones is
read within five minutes. All three fail on the previous store, and the last
also fails with only the first fix or with due-time ordering.
`GitHub.module.test.ts` reads the stylesheets, since jsdom does not resolve
`var()`. It checks that the sidebar's quiet colour reads only roles that
`.navigation-item` rebinds. It also checks that each neutral inset resets
every icon variable the own bubble hands down, and that `.pullState` reads
each with its shared role as fallback. Both fail on the previous CSS, and the
second still fails with only the sidebar fix. The contrast guard already
measures the base roles on `--surface-panel`, which is what the inset now
shows. It reads only `tokens.css`, so it cannot see the module cascade.

A Chromium and WebKit probe of the real stylesheets confirmed the computed
colours. At high/magenta/light and high/bee/dark, an own bubble's table and
revealed-spoiler icons take the shared green, grey and purple, where they
were `#fff` and `#000` before. A selected Solo row's quiet icon takes the
row's selected ink, where it was the root grey `rgb(82, 82, 82)` before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 docs/design-system.md                     |  6 +-
 docs/plugin-architecture.md               |  3 +-
 src/bundled/github/GitHub.module.css      | 15 +++--
 src/bundled/github/GitHub.module.test.ts  | 80 +++++++++++++++++++++++
 src/bundled/github/pull-states.test.ts    | 65 ++++++++++++++----
 src/bundled/github/pull-states.ts         | 23 ++++---
 src/features/messages/Messages.module.css | 18 +++--
 7 files changed, 177 insertions(+), 33 deletions(-)
 create mode 100644 src/bundled/github/GitHub.module.test.ts

diff --git a/docs/design-system.md b/docs/design-system.md
index ab1df50005..15c38c0044 100644
--- a/docs/design-system.md
+++ b/docs/design-system.md
@@ -91,7 +91,11 @@ names. Categorical purple (`--text-categorical-purple` paired with
 stays independent of customizable app accent. Inside your own bubble the host
 hands state icons their `-own` pair (`--icon-subtle-own`, `--icon-success-own`,
 `--icon-categorical-purple-own`), which is the bubble's link ink at Buzzin’,
-where the solid accent fill clears neither grey nor any state hue.
+where the solid accent fill clears neither grey nor any state hue. It does so
+through `--message-icon-subtle`, `--message-icon-success` and
+`--message-icon-categorical-purple`, which a state icon reads with the shared
+role as its fallback. Neutral insets in the bubble (code, tables, a revealed
+spoiler) drop them, as they drop own mention pairing.
 
 GitHub owns its `--github-*` status/diff mappings and browser coverage of the
 resolved text/fill pairs in both themes, including shared-role updates and merged
diff --git a/docs/plugin-architecture.md b/docs/plugin-architecture.md
index 503cb9e2f5..c82b1eabc4 100644
--- a/docs/plugin-architecture.md
+++ b/docs/plugin-architecture.md
@@ -1404,7 +1404,8 @@ renderer at a lower `order` for github.com pull request URLs: the same label
 with the pull request's state (open, draft, merged, closed) as a coloured icon,
 read with the person's `gh` sign-in or the public API and kept current while
 shown. Repositories, issues and commits, and every pull request link when that
-plugin is disabled or its renderer fails, keep the Links presentation.
+plugin is disabled, keep the Links presentation. If the renderer fails, a pull
+request link shows as a plain link.
 Messages currently recognize
 credential-free HTTP(S) and supported Buzz links. Markdown labels preserve their
 formatting, escaped pasted wrappers are normalized outside code, and paired `<…>`
diff --git a/src/bundled/github/GitHub.module.css b/src/bundled/github/GitHub.module.css
index 34be51f22f..4cbc07fd0d 100644
--- a/src/bundled/github/GitHub.module.css
+++ b/src/bundled/github/GitHub.module.css
@@ -398,14 +398,19 @@
    the panel's chip above does; a link's text stays a link. Open and merged
    use the icon-tier roles: the chip's step-12 text inks are indistinguishable
    from a bubble's own ink. Draft, closed and not yet read are quiet: closed is
-   not red here. Only the sidebar shows an open one's checks and conflicts. */
-.soloPull,
+   not red here. Only the sidebar shows an open one's checks and conflicts.
+   The sidebar's quiet icon is the row's subtle ink, which a hovered or
+   selected row rebinds; a message's icons take the pair the bubble hands
+   them, if any. */
+.soloPull {
+  color: var(--text-subtle);
+}
 .pullState {
-  color: var(--icon-subtle);
+  color: var(--message-icon-subtle, var(--icon-subtle));
 }
 .soloPull[data-tone="open"],
 .pullState[data-pr-state="open"] {
-  color: var(--icon-success);
+  color: var(--message-icon-success, var(--icon-success));
 }
 .soloPull[data-tone="failure"] {
   color: var(--text-danger);
@@ -415,7 +420,7 @@
 }
 .soloPull[data-tone="merged"],
 .pullState[data-pr-state="merged"] {
-  color: var(--icon-categorical-purple);
+  color: var(--message-icon-categorical-purple, var(--icon-categorical-purple));
 }
 .soloLink {
   display: flex;
diff --git a/src/bundled/github/GitHub.module.test.ts b/src/bundled/github/GitHub.module.test.ts
new file mode 100644
index 0000000000..bbb4505f26
--- /dev/null
+++ b/src/bundled/github/GitHub.module.test.ts
@@ -0,0 +1,80 @@
+import { readFileSync } from "node:fs";
+import { expect, it } from "vitest";
+
+// A custom property inherits its computed value, so a role aliased at the
+// root does not follow a host that rebinds what it points at. No DOM emulator
+// resolves var(), so these read the stylesheets the state icons depend on.
+const rules = (path: string) =>
+  [
+    ...readFileSync(path, "utf8")
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .matchAll(/([^{}]+)\{([^{}]*)\}/g),
+  ].map(([, selector = "", body = ""]) => ({
+    selectors: selector.split(",").map((part) => part.trim()),
+    declarations: new Map(
+      [...body.matchAll(/([\w-]+):\s*([^;]+);/g)].map(
+        ([, name = "", value = ""]) => [name, value.trim()],
+      ),
+    ),
+  }));
+const github = rules("src/bundled/github/GitHub.module.css");
+const read = (value = "") =>
+  [...value.matchAll(/var\((--[\w-]+)/g)].map(([, name]) => name);
+
+it("paints the sidebar's quiet icon with the ink a hovered or selected row rebinds", () => {
+  const rebound = new Set(
+    rules("src/shared/design-system/styles/components.css")
+      .filter(({ selectors }) =>
+        selectors.some((selector) => selector.startsWith(".navigation-item")),
+      )
+      .flatMap(({ declarations }) => [...declarations.keys()])
+      .filter((name) => name.startsWith("--")),
+  );
+  expect(rebound).toContain("--text-subtle");
+  const quiet = github.find(
+    ({ selectors, declarations }) =>
+      selectors.includes(".soloPull") && declarations.has("color"),
+  );
+  const roles = read(quiet?.declarations.get("color"));
+  expect(roles.length).toBeGreaterThan(0);
+  for (const role of roles) expect(rebound).toContain(role);
+});
+
+it("keeps the own bubble's state icon pair out of its neutral insets", () => {
+  const messages = rules("src/features/messages/Messages.module.css");
+  // What the own bubble hands the state icons inside it.
+  const handed = [
+    ...(messages.find(({ selectors }) =>
+      selectors.includes(".messageBubble[data-own]"),
+    )?.declarations ?? []),
+  ].flatMap(([name, value]) => {
+    const shared = /^var\((--icon-[\w-]+)-own\)$/.exec(value)?.[1];
+    return shared ? [{ name, shared }] : [];
+  });
+  expect(handed.map(({ shared }) => shared).sort()).toEqual([
+    "--icon-categorical-purple",
+    "--icon-subtle",
+    "--icon-success",
+  ]);
+  // Code, tables and a revealed spoiler, which drop own mention pairing too.
+  const insets = messages.filter(
+    ({ declarations }) => declarations.get("--mention-text") === "initial",
+  );
+  expect(insets.length).toBeGreaterThanOrEqual(2);
+  for (const { selectors, declarations } of insets)
+    for (const { name } of handed)
+      expect(declarations.get(name), `${name} in ${selectors.join(", ")}`).toBe(
+        "initial",
+      );
+  // There, a message link's icon falls back to the shared role.
+  for (const { name, shared } of handed)
+    expect(
+      github.some(({ selectors, declarations }) =>
+        selectors.some((selector) => selector.startsWith(".pullState"))
+          ? declarations.get("color")?.replace(/\s+/g, "") ===
+            `var(${name},var(${shared}))`
+          : false,
+      ),
+      `.pullState reads ${name} with ${shared} as its fallback`,
+    ).toBe(true);
+});
diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index 10b35e5518..c8d3bda7c3 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -225,9 +225,10 @@ it("tries unreadable pull requests again every 5 minutes, in the one query with
   expect(repositories().slice(1)).toEqual(
     Array.from({ length: 4 }, () => ["buzz-app"]),
   );
-  // The fifth also tries both missing ones, in the same query: one gh run.
+  // The fifth also tries both missing ones, longest unread first, in the
+  // same query: one gh run.
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
-  expect(repositories().slice(5)).toEqual([["buzz-app", "buzz", "goose"]]);
+  expect(repositories().slice(5)).toEqual([["buzz", "goose", "buzz-app"]]);
   expect(states.get(second)).toBe("failed");
 });
 
@@ -357,11 +358,20 @@ it("reads a closed pull request, which can reopen, again every few minutes rathe
   expect(gh).toHaveBeenCalledTimes(3);
 });
 
-it("reads public data once without gh, never on a timer", async () => {
+it("reads public data without gh every few minutes until it is merged", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  const fetch = vi.fn(
-    async () => new Response(JSON.stringify({ title: "A", state: "open" })),
-  );
+  const fetch = vi
+    .fn()
+    .mockResolvedValueOnce(
+      new Response(JSON.stringify({ title: "A", state: "open" })),
+    )
+    .mockResolvedValueOnce(
+      new Response(JSON.stringify({ state: "open", draft: true })),
+    )
+    .mockResolvedValueOnce(new Response(JSON.stringify({ state: "closed" })))
+    .mockResolvedValue(
+      new Response(JSON.stringify({ state: "closed", merged: true })),
+    );
   vi.stubGlobal("fetch", fetch);
   const states = createPullStates(undefined);
   states.watch(pull, () => {});
@@ -370,11 +380,19 @@ it("reads public data once without gh, never on a timer", async () => {
     "https://api.github.com/repos/block/buzz-app/pulls/7",
     expect.anything(),
   );
-  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
   expect(fetch).toHaveBeenCalledOnce();
+  // Open, draft and closed can each still change.
+  for (const state of ["draft", "closed", "merged"]) {
+    await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+    await vi.waitFor(() => expect(states.get(pull)).toEqual({ state }));
+    await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  }
+  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(4);
 });
 
-it("tries a public read that failed again every few minutes, until it is read", async () => {
+it("tries a public read that failed again every few minutes", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const fetch = vi
     .fn()
@@ -389,8 +407,6 @@ it("tries a public read that failed again every few minutes, until it is read",
   expect(fetch).toHaveBeenCalledOnce();
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
   await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "closed" }));
-  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
-  expect(fetch).toHaveBeenCalledTimes(2);
 });
 
 const pulls = Array.from(
@@ -422,9 +438,32 @@ it("reads a few public pull requests at a time, the rest a minute later", async
   await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
   expect(fetch).toHaveBeenCalledTimes(pulls.length);
   expect(states.get(pulls.at(-1) ?? "")).toEqual({ state: "open" });
-  // Each read once, none again.
-  await vi.advanceTimersByTimeAsync(3 * PULL_SLOW_REFRESH_MS);
-  expect(fetch).toHaveBeenCalledTimes(pulls.length);
+  // Each is read again a few minutes after it was, still a few at a time.
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(pulls.length + PUBLIC_READS_PER_POLL);
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(2 * pulls.length);
+});
+
+it("reads a public pull request never read before those that keep failing", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  // Private repositories are 404 without gh. Five polls' worth of them,
+  // tried again every few minutes, would fill every poll on their own.
+  const failing = Array.from(
+    { length: 5 * PUBLIC_READS_PER_POLL },
+    (_, i) => `https://github.com/block/private-${i}/pull/1`,
+  );
+  const fetch = vi.fn(async (url: string) =>
+    url.includes("/private-")
+      ? new Response(null, { status: 404 })
+      : new Response(JSON.stringify({ state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  for (const url of [...failing, pull]) states.watch(url, () => {});
+  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS);
+  await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "open" }));
+  expect(states.get(failing[0] ?? "")).toBe("failed");
 });
 
 it.each([
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index da16116836..475c1819f5 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -7,8 +7,8 @@ import { parseGitHubReference } from "./references";
 /** How often shown pull requests that can change are read again. */
 export const PULL_REFRESH_MS = 60_000;
 /** Without `gh`, GitHub allows 60 public reads an hour. A pull request that
- * could not be read is tried again this often, and a closed one, which rarely
- * reopens, is read again this often too. */
+ * could not be read is tried again this often, as is one read from the
+ * public API, and a closed one, which rarely reopens. */
 export const PULL_SLOW_REFRESH_MS = 5 * 60_000;
 /** How many of the due pull requests one public poll reads; the rest take
  * the next. */
@@ -149,15 +149,17 @@ const keyOf = (url: string) => {
  * Every shown pull request that is due is read in one request, once for every
  * subscriber that appears together, then polled only while shown, visible and
  * able to change: a merged one is never read again, a closed one or one GitHub
- * could not read every few minutes. Without `gh`, a few at a time are read
- * from the public API, each once, tried again every few minutes until it is;
- * while `gh` is unavailable, likewise until it is tried again. None is read
- * while GitHub holds its limit; the panel has the live view. */
+ * could not read every few minutes. Without `gh`, or while it is
+ * unavailable, a few at a time are read from the public API, the longest
+ * unread first, each every few minutes. None is read while GitHub holds its
+ * limit; the panel has the live view. */
 export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const listeners = new Map<string, Set<() => void>>();
   const states = new Map<string, PullState | "failed">();
   /** When each read pull request is read again; never for a settled one. */
   const nextRead = new Map<string, number>();
+  /** When each was last read, so a public poll takes the longest unread. */
+  const readAt = new Map<string, number>();
   /** Until when to read public data instead, after `gh` was unavailable. */
   let publicUntil = 0;
   const readsPublic = () => !gh || Date.now() < publicUntil;
@@ -174,7 +176,7 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const dueAt = (url: string) => nextRead.get(url) ?? 0;
   /** When `state`, read now, is read again. */
   const again = (state: PullState | undefined, now: number) => {
-    if (state?.state === "merged" || (!gh && state)) return Infinity;
+    if (state?.state === "merged") return Infinity;
     return !state || state.state === "closed" || readsPublic()
       ? now + PULL_SLOW_REFRESH_MS
       : now + PULL_REFRESH_MS;
@@ -215,7 +217,11 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       AbortSignal.timeout(30_000),
     ]);
     const now = Date.now();
-    const due = [...listeners.keys()].filter((url) => dueAt(url) <= now);
+    // A public poll reads only the first few: the longest unread go first, so
+    // those that keep failing cannot keep one never read waiting.
+    const due = [...listeners.keys()]
+      .filter((url) => dueAt(url) <= now)
+      .sort((a, b) => (readAt.get(a) ?? 0) - (readAt.get(b) ?? 0));
     try {
       if (!due.length || (readsPublic() && now < publicHeldUntil)) return;
       const found = await readAll(due, signal);
@@ -229,6 +235,7 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
           continue;
         }
         const state = found[i] ?? "failed";
+        readAt.set(url, now);
         nextRead.set(url, again(found[i], now));
         // An unchanged state keeps its object, so whoever shows it is left be.
         if (same(states.get(url), state)) continue;
diff --git a/src/features/messages/Messages.module.css b/src/features/messages/Messages.module.css
index 8e6f343799..6407c59653 100644
--- a/src/features/messages/Messages.module.css
+++ b/src/features/messages/Messages.module.css
@@ -2994,10 +2994,14 @@ html[data-keyboard-navigation] .rawDiff:focus-visible {
   color: var(--text-standard);
   /* Neutral inset surfaces keep their own link palette inside colored bubbles. */
   --message-link: var(--text-link);
-  /* Neutral insets drop own-bubble mention pairing back to the shared role. */
+  /* Neutral insets drop own-bubble mention and state icon pairing back to the
+     shared roles. */
   --mention-fill: initial;
   --mention-hover: initial;
   --mention-text: initial;
+  --message-icon-subtle: initial;
+  --message-icon-success: initial;
+  --message-icon-categorical-purple: initial;
 }
 .messageContent {
   position: relative;
@@ -3039,9 +3043,9 @@ html[data-keyboard-navigation] .rawDiff:focus-visible {
   --mention-hover: var(--affordance-mention-own-hover);
   --mention-text: var(--text-mention-own);
   /* State icons inside the bubble take their -own pair: the link ink at Buzzin’. */
-  --icon-subtle: var(--icon-subtle-own);
-  --icon-success: var(--icon-success-own);
-  --icon-categorical-purple: var(--icon-categorical-purple-own);
+  --message-icon-subtle: var(--icon-subtle-own);
+  --message-icon-success: var(--icon-success-own);
+  --message-icon-categorical-purple: var(--icon-categorical-purple-own);
 }
 /* Neutral content and unboxed renderers keep selection paired with their surface. */
 .messageBubble[data-emoji-only],
@@ -3077,10 +3081,14 @@ html[data-keyboard-navigation] .rawDiff:focus-visible {
   background: var(--surface-panel);
   color: var(--text-standard);
   --message-link: var(--text-link);
-  /* Neutral insets drop own-bubble mention pairing back to the shared role. */
+  /* Neutral insets drop own-bubble mention and state icon pairing back to the
+     shared roles. */
   --mention-fill: initial;
   --mention-hover: initial;
   --mention-text: initial;
+  --message-icon-subtle: initial;
+  --message-icon-success: initial;
+  --message-icon-categorical-purple: initial;
 }
 
 .threadAvatar:nth-child(1) {

From 70b369191b1e4951a12a52676d0beaa1dfd3bf20 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Thu, 29 Oct 2026 14:45:29 +1100
Subject: [PATCH 13/15] fix(github): keep public pull request reads within a
 share of GitHub's hourly limit

Addresses the review of 128bd1c8e on PR #1790.

Without `gh`, 128bd1c8e read every non-merged pull request from the public
API every five minutes. Six shown pull requests cost 72 reads an hour and ten
cost 120, against the 60 GitHub allows an address, before the panel read
anything. The 403/429 hold only stopped reads once the limit was spent. Then
the links stopped updating until the reset, and an opened panel reported the
limit.

Public reads now draw on a budget the store keeps: `PUBLIC_READS_PER_POLL`
(10) can be spent at once, as on a channel of links first shown, and it
refills at `PUBLIC_READS_PER_HOUR` (30). However many pull requests are
watched, first reads included, the store spends at most 40 public reads in
any hour, so the panel keeps at least 20. The pull requests a poll cannot
afford wait a minute, as left-overs already did. They still go longest
unread first, so the budget rotates through every shown pull request. Each
is still read at most every five minutes, and `gh` reads are unchanged.

Tests: twelve public pull requests watched for two hours cost ten reads at
once, then 30 an hour, and the last twelve reads are one of each. Under
128bd1c8e the first hour cost about 140. The never-read-first test now
watches thirteen failing links, not fifty. That is enough for some to be
unread when the first come round again. It shows a readable link is read
before any failing one is tried again. Fifty would take over an hour to read
within the budget. Watch-order selection fails it. Not run locally at the
author's request; left to CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 35 ++++++++++++++----------
 src/bundled/github/pull-states.ts      | 38 ++++++++++++++++++--------
 2 files changed, 47 insertions(+), 26 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index c8d3bda7c3..9511269cbd 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -3,6 +3,7 @@ import { afterEach, expect, it, vi } from "vitest";
 import { GhUnavailable, GitHubError, type GitHubCli } from "./gh";
 import {
   createPullStates,
+  PUBLIC_READS_PER_HOUR,
   PUBLIC_READS_PER_POLL,
   PULL_REFRESH_MS,
   PULL_SLOW_REFRESH_MS,
@@ -419,10 +420,10 @@ const limited = (resetAt?: number) =>
     headers: resetAt ? { "x-ratelimit-reset": String(resetAt / 1000) } : {},
   });
 
-it("reads a few public pull requests at a time, the rest a minute later", async () => {
+it("spends a few public reads at once, then only its share of each hour's", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   const fetch = vi.fn(
-    async () => new Response(JSON.stringify({ state: "open" })),
+    async (_url: string) => new Response(JSON.stringify({ state: "open" })),
   );
   vi.stubGlobal("fetch", fetch);
   const states = createPullStates(undefined);
@@ -433,24 +434,28 @@ it("reads a few public pull requests at a time, the rest a minute later", async
   // A channel of links does not spend the hour's public reads at once.
   expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL);
   expect(states.get(pulls.at(-1) ?? "")).toBeUndefined();
-  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
-  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL);
-  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
-  expect(fetch).toHaveBeenCalledTimes(pulls.length);
+  // Kept current for an hour, and the next, they leave the panel the rest of
+  // GitHub's 60, however many are shown.
+  await vi.advanceTimersByTimeAsync(60 * 60_000);
+  expect(fetch).toHaveBeenCalledTimes(
+    PUBLIC_READS_PER_POLL + PUBLIC_READS_PER_HOUR,
+  );
   expect(states.get(pulls.at(-1) ?? "")).toEqual({ state: "open" });
-  // Each is read again a few minutes after it was, still a few at a time.
-  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS - PULL_REFRESH_MS);
-  expect(fetch).toHaveBeenCalledTimes(pulls.length + PUBLIC_READS_PER_POLL);
-  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS);
-  expect(fetch).toHaveBeenCalledTimes(2 * pulls.length);
+  await vi.advanceTimersByTimeAsync(60 * 60_000);
+  expect(fetch).toHaveBeenCalledTimes(
+    PUBLIC_READS_PER_POLL + 2 * PUBLIC_READS_PER_HOUR,
+  );
+  // Each is read in turn, none left behind.
+  const read = fetch.mock.calls.map(([url]) => url);
+  expect(new Set(read.slice(-pulls.length)).size).toBe(pulls.length);
 });
 
 it("reads a public pull request never read before those that keep failing", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
-  // Private repositories are 404 without gh. Five polls' worth of them,
-  // tried again every few minutes, would fill every poll on their own.
+  // Private repositories are 404 without gh. Enough of them that some are
+  // still unread when the first come round again, wanting every read there is.
   const failing = Array.from(
-    { length: 5 * PUBLIC_READS_PER_POLL },
+    { length: PUBLIC_READS_PER_POLL + 3 },
     (_, i) => `https://github.com/block/private-${i}/pull/1`,
   );
   const fetch = vi.fn(async (url: string) =>
@@ -461,7 +466,7 @@ it("reads a public pull request never read before those that keep failing", asyn
   vi.stubGlobal("fetch", fetch);
   const states = createPullStates(undefined);
   for (const url of [...failing, pull]) states.watch(url, () => {});
-  await vi.advanceTimersByTimeAsync(PULL_SLOW_REFRESH_MS);
+  await vi.advanceTimersByTimeAsync(2 * PULL_SLOW_REFRESH_MS);
   await vi.waitFor(() => expect(states.get(pull)).toEqual({ state: "open" }));
   expect(states.get(failing[0] ?? "")).toBe("failed");
 });
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 475c1819f5..524fc05273 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -10,9 +10,13 @@ export const PULL_REFRESH_MS = 60_000;
  * could not be read is tried again this often, as is one read from the
  * public API, and a closed one, which rarely reopens. */
 export const PULL_SLOW_REFRESH_MS = 5 * 60_000;
-/** How many of the due pull requests one public poll reads; the rest take
- * the next. */
+/** How many public reads can be spent at once, as on a channel of links
+ * first shown; the rest wait their turn. */
 export const PUBLIC_READS_PER_POLL = 10;
+/** How many public reads an hour are spent after that, however many pull
+ * requests are shown. No hour spends more than 40 of GitHub's 60, so the
+ * panel keeps the rest. */
+export const PUBLIC_READS_PER_HOUR = 30;
 
 export type PullState = Readonly<{
   state: "open" | "draft" | "merged" | "closed";
@@ -150,9 +154,9 @@ const keyOf = (url: string) => {
  * subscriber that appears together, then polled only while shown, visible and
  * able to change: a merged one is never read again, a closed one or one GitHub
  * could not read every few minutes. Without `gh`, or while it is
- * unavailable, a few at a time are read from the public API, the longest
- * unread first, each every few minutes. None is read while GitHub holds its
- * limit; the panel has the live view. */
+ * unavailable, they are read from the public API within its own share of
+ * GitHub's limit, the longest unread first, each at most every few minutes.
+ * None is read while GitHub holds its limit; the panel has the live view. */
 export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const listeners = new Map<string, Set<() => void>>();
   const states = new Map<string, PullState | "failed">();
@@ -165,6 +169,9 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const readsPublic = () => !gh || Date.now() < publicUntil;
   /** Until when GitHub refuses public reads, once it has refused one. */
   let publicHeldUntil = 0;
+  /** The public reads that can be spent now, and when that was counted. */
+  let publicReads = PUBLIC_READS_PER_POLL;
+  let publicCountedAt = Date.now();
   let timer: ReturnType<typeof setTimeout> | undefined;
   let controller: AbortController | undefined;
   let scheduled = false;
@@ -217,8 +224,8 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       AbortSignal.timeout(30_000),
     ]);
     const now = Date.now();
-    // A public poll reads only the first few: the longest unread go first, so
-    // those that keep failing cannot keep one never read waiting.
+    // A public poll reads only as many as it can spend: the longest unread go
+    // first, so those that keep failing cannot keep one never read waiting.
     const due = [...listeners.keys()]
       .filter((url) => dueAt(url) <= now)
       .sort((a, b) => (readAt.get(a) ?? 0) - (readAt.get(b) ?? 0));
@@ -255,9 +262,9 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       }
     }
   }
-  /** Reads `urls`, or from the public API the first few of them: each one's
-   * state, or undefined for one GitHub could not read. Throws when it
-   * answered for none, or refused a public read for its limit. */
+  /** Reads `urls`, or from the public API as many of them as can be spent:
+   * each one's state, or undefined for one GitHub could not read. Throws when
+   * it answered for none, or refused a public read for its limit. */
   async function readAll(
     urls: readonly string[],
     signal: AbortSignal,
@@ -272,8 +279,17 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         // GitHub may still be refusing public reads from the last time.
         if (Date.now() < publicHeldUntil) return [];
       }
+    const now = Date.now();
+    publicReads = Math.min(
+      PUBLIC_READS_PER_POLL,
+      publicReads +
+        ((now - publicCountedAt) * PUBLIC_READS_PER_HOUR) / (60 * 60_000),
+    );
+    publicCountedAt = now;
+    const reading = urls.slice(0, Math.floor(publicReads));
+    publicReads -= reading.length;
     return Promise.all(
-      urls.slice(0, PUBLIC_READS_PER_POLL).map((url) =>
+      reading.map((url) =>
         readPublicState(url, signal).catch((error: unknown) => {
           if (!(error instanceof GitHubRateLimited)) return undefined;
           // Over the limit: nothing more is read until GitHub says it resets.

From 13e48e466601ad587a442c13f015476bd2e6cf6b Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Thu, 29 Oct 2026 16:18:10 +1100
Subject: [PATCH 14/15] fix(github): earn public pull request reads in whole
 steps, none for a clock set back

Addresses the review of c7e8bf369 on PR #1790.

The public read budget refilled by the time since it was last counted, as a
fraction of a read. With the budget spent, a clock corrected backwards made
that fraction negative, and `Math.floor(-0.5)` is -1, so `slice(0, -1)` read
every due pull request but the last: seventy links shown after a one-minute
correction cost 69 reads at once.

Reads are now earned whole, one for every `PUBLIC_READ_EARNED_MS` (two
minutes) since the budget was last earned to, and that time moves on by the
whole steps earned. The count stays an integer, so no fraction drifts across
an hour of polls. A clock set back earns nothing. Its time is earned again
once the clock passes where it was. The cadence is unchanged: one read every
two minutes once the first ten are spent.

Tests: with the first ten spent and the clock a minute back, three links
shown read nothing, and are read, with the two left over, one every two
minutes once the clock is past where it was. On c7e8bf369 they cost two
reads at once.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 22 ++++++++++++++++++++++
 src/bundled/github/pull-states.ts      | 21 ++++++++++++---------
 2 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index 9511269cbd..d37a7eabfe 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -450,6 +450,28 @@ it("spends a few public reads at once, then only its share of each hour's", asyn
   expect(new Set(read.slice(-pulls.length)).size).toBe(pulls.length);
 });
 
+it("spends nothing, rather than everything, when the clock is set back", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi.fn(
+    async () => new Response(JSON.stringify({ state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  for (const url of pulls) states.watch(url, () => {});
+  await vi.waitFor(() =>
+    expect(states.get(pulls[PUBLIC_READS_PER_POLL - 1] ?? "")).toBeDefined(),
+  );
+  // The budget spent, the clock corrected back a minute: links shown now are
+  // not read, and no time is earned until the clock passes where it was.
+  vi.setSystemTime(Date.now() - PULL_REFRESH_MS);
+  for (const url of [second, third, pull]) states.watch(url, () => {});
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL);
+  await vi.advanceTimersByTimeAsync(11 * PULL_REFRESH_MS);
+  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL + 5);
+  expect(states.get(pull)).toEqual({ state: "open" });
+});
+
 it("reads a public pull request never read before those that keep failing", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   // Private repositories are 404 without gh. Enough of them that some are
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 524fc05273..5ff9a65fa6 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -17,6 +17,8 @@ export const PUBLIC_READS_PER_POLL = 10;
  * requests are shown. No hour spends more than 40 of GitHub's 60, so the
  * panel keeps the rest. */
 export const PUBLIC_READS_PER_HOUR = 30;
+/** How often one of them is earned back. */
+const PUBLIC_READ_EARNED_MS = (60 * 60_000) / PUBLIC_READS_PER_HOUR;
 
 export type PullState = Readonly<{
   state: "open" | "draft" | "merged" | "closed";
@@ -169,9 +171,10 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
   const readsPublic = () => !gh || Date.now() < publicUntil;
   /** Until when GitHub refuses public reads, once it has refused one. */
   let publicHeldUntil = 0;
-  /** The public reads that can be spent now, and when that was counted. */
+  /** The public reads that can be spent now, and up to when they were
+   * earned. */
   let publicReads = PUBLIC_READS_PER_POLL;
-  let publicCountedAt = Date.now();
+  let publicEarnedTo = Date.now();
   let timer: ReturnType<typeof setTimeout> | undefined;
   let controller: AbortController | undefined;
   let scheduled = false;
@@ -279,14 +282,14 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
         // GitHub may still be refusing public reads from the last time.
         if (Date.now() < publicHeldUntil) return [];
       }
-    const now = Date.now();
-    publicReads = Math.min(
-      PUBLIC_READS_PER_POLL,
-      publicReads +
-        ((now - publicCountedAt) * PUBLIC_READS_PER_HOUR) / (60 * 60_000),
+    // Whole reads only, so nothing drifts; a clock set back earns none, and
+    // its time is earned again once the clock passes where it was.
+    const earned = Math.floor(
+      Math.max(0, Date.now() - publicEarnedTo) / PUBLIC_READ_EARNED_MS,
     );
-    publicCountedAt = now;
-    const reading = urls.slice(0, Math.floor(publicReads));
+    publicReads = Math.min(PUBLIC_READS_PER_POLL, publicReads + earned);
+    publicEarnedTo += earned * PUBLIC_READ_EARNED_MS;
+    const reading = urls.slice(0, publicReads);
     publicReads -= reading.length;
     return Promise.all(
       reading.map((url) =>

From 72ec63f7364d53aae0d6c090a0b22f6a2c19f65c Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Thu, 29 Oct 2026 17:22:03 +1100
Subject: [PATCH 15/15] fix(github): wait budget-blocked public reads for the
 next one earned, together

Addresses the review of 046db51b0 on PR #1790.

A public poll that could not afford a pull request moved its next read a
minute on from that poll. Reads are earned every two minutes, so pull
requests shown at different times kept separate one-minute phases, and
whichever group polled first after each read was earned took it every time.
Longest-unread ordering only compares the URLs of a single poll, so it never
saw the other group. Twelve links shown, then three more half a minute
later, read the first group over and over and never the second. In the
clock-rollback test, it left a later link unread, failing in CI.

Those a public poll cannot afford now wait for the next read earned. Every
one waiting is in that poll, and the longest unread of them takes it,
whenever it was shown. GitHub's hold and the hidden window's floor still
apply through the scheduler. Each pull request is still read at most every
five minutes, within the same 40-an-hour budget.

Tests: twelve links shown, then three more half a minute later: within ten
minutes all fifteen are read, using fifteen reads. On 046db51b0 the later
three are never read. The clock-rollback test passes again. Both fail on
the previous store.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 src/bundled/github/pull-states.test.ts | 22 ++++++++++++++++++++++
 src/bundled/github/pull-states.ts      |  6 ++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/bundled/github/pull-states.test.ts b/src/bundled/github/pull-states.test.ts
index d37a7eabfe..aebf190735 100644
--- a/src/bundled/github/pull-states.test.ts
+++ b/src/bundled/github/pull-states.test.ts
@@ -472,6 +472,28 @@ it("spends nothing, rather than everything, when the clock is set back", async (
   expect(states.get(pull)).toEqual({ state: "open" });
 });
 
+it("reads links shown while the budget is spent in turn with those left before them", async () => {
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
+  const fetch = vi.fn(
+    async (_url: string) => new Response(JSON.stringify({ state: "open" })),
+  );
+  vi.stubGlobal("fetch", fetch);
+  const states = createPullStates(undefined);
+  for (const url of pulls) states.watch(url, () => {});
+  await vi.waitFor(() =>
+    expect(states.get(pulls[PUBLIC_READS_PER_POLL - 1] ?? "")).toBeDefined(),
+  );
+  // Shown half a minute after the rest were left over, they are not out of
+  // step with them, so the earlier ones cannot take every read as it is earned.
+  await vi.advanceTimersByTimeAsync(PULL_REFRESH_MS / 2);
+  const later = [second, third, pull];
+  for (const url of later) states.watch(url, () => {});
+  await vi.advanceTimersByTimeAsync(10 * PULL_REFRESH_MS);
+  for (const url of [...pulls, ...later])
+    expect(states.get(url)).toEqual({ state: "open" });
+  expect(fetch).toHaveBeenCalledTimes(PUBLIC_READS_PER_POLL + 5);
+});
+
 it("reads a public pull request never read before those that keep failing", async () => {
   vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"] });
   // Private repositories are 404 without gh. Enough of them that some are
diff --git a/src/bundled/github/pull-states.ts b/src/bundled/github/pull-states.ts
index 5ff9a65fa6..1232d47eb6 100644
--- a/src/bundled/github/pull-states.ts
+++ b/src/bundled/github/pull-states.ts
@@ -239,9 +239,11 @@ export function createPullStates(gh: GitHubCli | undefined): PullStates {
       if (current.signal.aborted) return;
       const changed: string[] = [];
       for (const [i, url] of due.entries()) {
-        // Those a public poll left for the next one wait a minute.
+        // Those a public poll could not afford wait for the next read earned,
+        // all together, so the longest unread of them takes it whenever each
+        // was shown. One GitHub holds waits for the hold.
         if (i >= found.length) {
-          nextRead.set(url, now + PULL_REFRESH_MS);
+          nextRead.set(url, publicEarnedTo + PUBLIC_READ_EARNED_MS);
           continue;
         }
         const state = found[i] ?? "failed";