fix: agent acts on / claims to post to a closed or stale PR without checking its state #85

Report (from a user on GitHub Issues)

The agent sent changes and reported posting them to PR #29 — which was already closed. It had carried the PR number over from earlier in the session and acted on it without verifying the PR still existed / was open.

Root cause

The kit never verifies PR state before operating on it:

• fix-pr / pr-fixer gather findings, push, comment, and resolve threads assuming the target PR is open — no state check, and no rule against reusing a PR number remembered from earlier in the session.
• create-pr always assumes it is creating a new PR — it doesn't check whether the branch already has one, and doesn't read back the created PR, so a reported PR number can be one that was assumed rather than returned.

Result: on a closed/merged (or simply stale) PR, the agent does nothing useful and then falsely reports having posted to it.

Fix (guardrail — same doctrine as #83)

• fix-pr / pr-fixer: resolve the PR from the current branch and require state == OPEN before doing anything. CLOSED/MERGED → stop and offer the real options (reopen / fresh PR / point at the right one), never a false "posted" report. No PR for the branch → that's create-pr.
• create-pr: check for an existing open PR on the branch (update it instead of duplicating), refuse to reuse a closed PR's number, and report only the URL the create call returned.
• coding-agent + portable work-story ship step reinforced.
• Rule throughout: never trust a PR number from memory — re-resolve from the branch.