[kiki830621]

Refs #411
Refs #412
Refs #413

Summary

Three Simple-tier bugs from the 2026-10-26 batch, in one cluster PR (the maintainer asked for one PR per batch, the #374 decision). #411 and #412 are in idd-issue; #413 is in idd-update.

• idd-issue: Step 3.6 baseline tag 未檢查 issue 號非空，建立失敗時會推出 idd--baseline #412 — idd-issue no longer tags idd--baseline when the issue was not created. Step 3.A captures the URL from gh-egress.sh, checks that it ends in an issue number, and stops otherwise. It also sets NEW_ISSUE_NUMBER, which Step 4.6 reads, and says "the issue may exist" when a URL was printed with a non-zero exit, so it is not retried into a duplicate. Step 3.6 tags only a numeric number and prints a graceful-skip reason otherwise.
• idd-issue: label_exists() 用 --search 判斷存在，短 label 名稱（如 P0）查不到 #411 — label_exists() finds labels that exist. It is now an exact REST lookup (repos/$GITHUB_REPO/labels/<encoded>) instead of gh label list --search … | grep -qx, which missed labels outside the 30 best matches, read the name as a regex and is GraphQL (blocked in cloud sessions). A failed lookup returns 2 with gh's message instead of "missing". Step 3.5 (b) uses $GITHUB_REPO instead of the bare repo name.
• idd-update Branch B 在正文結尾沒有空行時寫出 setext 標題，使上一節無法就地更正 #413 — idd-update never writes a setext heading above Current Status. Step 5 has one executable splice for both branches. It strips the body's trailing newlines and joins with one blank line. It reads the body itself, in the same call, and sends it through gh-egress.sh there too. The ## Current Status anchor follows CommonMark fences. Branch A also repairs the 23 bodies an older Branch B wrote as setext; that blank line is the one stated exception to the managed-zone rule (maintainer decision 2026-10-26).

No version bump: PR #426 and #424 both claim 3.6.0 and PR #418 claims 3.5.1, so the CHANGELOG entry is under [Unreleased].

Fixed before merge (verify)

Two independent reviewers (requirements + logic; security + regression + devil's advocate), Claude-only. Reports: #411 Verify（cluster 報告）；#412、#413 有指向它的 pointer。

• Blocking, fixed: the first version of the splice used a BODY nothing in the block assigned. If it was lost between Bash calls, the issue was overwritten with the status block alone; this was confirmed through the real gh-egress.sh. The block now reads the body via REST and stops when the read fails.
• Fences: ``` and ~~~, fence length, info string. An unclosed trailing fence no longer grows one Current Status block per run (idd-close 的 checklist gate 對 Spectra path 永遠 fallback 掃 Strategy——那些 checkbox 沒有任何一步會勾 #290).
• label_exists refuses ./.. and empty path parts. TAG is safe under set -u. A CR is stripped from the URL. Safeguard 1 uses exit 1.
• Tests were strengthened after mutation testing. Every new suite fails on origin/main.

Test plan

• New suites: baseline-tag-guard (40), label-exists (40), idd-update-splice (91). Each runs the changed SKILL.md blocks against stubs, with positive controls.
• bash plugins/issue-driven-dev/scripts/run-all-tests.sh: 66 suites, 63 pass. The 3 failures are environment-only and also fail on origin/main under the same conditions: idd-repo-map and idd-tree-lock (run as root), verify-scratch-paths (checkout under /tmp).
• Splice run over all 337 real issue bodies (read-only): setext above Current Status 23 → 0, idempotent on a second run, no lines lost.
• Codex cross-model verify was not run (cloud session); run /idd-verify --pr <this PR> locally before merging.

After merge: /idd-close 411 412 413.

https://claude.ai/code/session_01PJZJ8sbcVVqqLngBfkGNUq

---

Generated by Claude Code