CI-fix triage protocol

Use this protocol before proposing a code change or emitting a CI-fixer safe
output. The calling workflow supplies its branch, labels, title prefix, attempt
limit, and allowed write surface; preserve those caller-specific restrictions.

Return a decision

For each candidate, state one terminal decision before taking an action:

• Decision: Continue — no dedup or safety gate blocks current-evidence analysis.
• Decision: Watch — exclusively an open workflow-owned CI-fix PR owns the
  issue; advance only that PR.
• Decision: Stop — an explicit human PR owns the issue; do not monitor it or
  plan a fallback CI-fix PR.
• Decision: Skip — the issue is stale, visual, already fixed, out of scope, or
  cannot be safely advanced.

Explain the concrete evidence for the decision. A search result is evidence to
inspect, not a decision by itself.

Reason through all ownership evidence before emitting the decision. Return
exactly one terminal decision; never emit a provisional decision and then
correct it later in the response.

When the caller requests a strict decision format, complete the classification
before writing any response text. Emit only the final decision and requested
next action. Do not include a draft, correction, or alternate decision.

Deduplicate without false ownership

1. An open CI-fix PR with the workflow's title prefix and exact Refs: dotnet/maui#<issue> is the only Watch case. Never open a second CI-fix
   PR for that issue.
2. A merged CI-fix PR with that exact reference is a Skip case until current
   evidence establishes a new regression.
3. A closed-unmerged CI-fix PR with that exact reference is a Skip case. A
   human closing the PR is a stop signal for the keep-one-PR loop.
4. An open human PR is always a Stop case when its own title or body
   explicitly declares that it addresses the tracking issue. Do not monitor it
   or plan a fallback CI-fix PR. Accept a Refs: declaration or a
   closing/reference keyword such as Fix, Fixes, Fixed, Close, Closes,
   Closed, Resolve, Resolves, or Resolved followed by the issue
   reference, including #<issue>, dotnet/maui#<issue>, or
   https://github.com/dotnet/maui/issues/<issue>.

GitHub search normally includes comments and incidental status text. Do not
treat a raw issue number in a comment, check summary, commit message, diff, or
unrelated list as human ownership. Inspect the PR title and body before stopping.
If every result is incidental, return Decision: Continue; an unrelated search
hit is not independently a reason to Stop or Skip.

Require current, specific evidence

Before a fresh attempt:

1. Confirm the issue is in the caller's branch and label scope.
2. Skip screenshot and visual-regression failures; do not modify baselines.
3. Verify the cited failure still reproduces on the latest completed base-branch
   build. A historical failure alone is not a reason to create a PR.
4. Trace the exact failing test, platform path, and deepest relevant stack frame.
   Check whether an intervening merged PR already fixed that path before proposing
   a duplicate or adjacent workaround.
5. Preserve the test's assertion. Do not mute, ignore, retry, weaken, or extend a
   timeout to hide a failure. A legitimate de-flake makes the state transition or
   synchronization deterministic.

Bound autonomous work

Advance only the existing CI-fix PR and respect the caller's effective attempt
counter. When the cap is reached, return Decision: Skip and defer rather than
advancing the existing PR or opening a replacement.
Never claim the target test is fixed from a category-level result or an unrelated
green leg; require evidence for the specific test on the CI-fix PR's current
head.

Fail closed at the write boundary

Before any code-push safe output, apply the caller's transport gate to the saved
base and head. Reject transport unless the saved base is an ancestor, all new
commits are append-only and merge-free, and the complete diff stays within the
caller's allowed paths, commit count, file count, and patch-byte bounds. Never
trim, conceal, or retry an unrelated or oversized diff merely to make it pass.

If a supported safe-output call returns a backend, connection, or validation
error, do not retry that mutation, continue the remaining mutation set, emit a
noop, or use a direct write path. Request one bounded report_incomplete safe
output and stop. A missing expected safe output is a failed/incomplete run, not
a successful no-write result.