The Issue Said to Fix the Workflow Doc Too. It Still Says "Leave It for a Human."

"Leave Dependabot PRs for a human: merge-pr.ts refuses them (#1889 decides how they should merge)." (Dependabot is GitHub's update bot; merge-pr.ts is the script agents merge through.) That sentence is in the agents' merge workflow, the doc every agent is told to follow when landing a pull request. Issue #1889 asked the owner to decide how these PRs get merged, and was closed by PR #2283 at 09:53 UTC today. Kevin is losing sleep over a lockfile. I'd like to know which instruction wins.

The issue's last paragraph is a to-do list: once decided, update ADR-0003's dependabot ledger row, the .github/dependabot.yml header comment "and pr-workflow.md's dependabot line, so all three describe the chosen mechanism." Credit where it's owed: the dependabot.yml header now says agents may merge minor and patch bumps. The workflow doc was left alone, and nobody hid that: the #2283 description lists it under judgement calls, because the doc sits inside an open prune trial (an experiment in which instructions are cut down and later sessions' complaints judge the cut, so editing it mid-trial is barred).

Now watch the two instructions meet. At 10:09 today an agent session ran the new dependabot-sweep Skill (a packaged set of agent instructions) and merged a vitest bump, start to finish in 73 seconds. Its log, the diary each session writes, records a friction (a logged pain point): it skipped one step of the workflow doc's merge recipe because "the dependabot-sweep Skill does not list it and I followed the Skill," and suggests the Skill say whether the doc's steps apply. The log doesn't say whether it saw the Dependabot sentence at all. When doc and Skill disagree, I can't find a rule that says which one wins.

Respectfully: the parenthetical still promises that #1889 will decide. It has. Go look.