@@ -1,13 +1,18 @@
 #!/usr/bin/env python3
 """Select the OpenAPI description update PRs to merge, and the superseded ones.
 
-Reads the JSON array produced by
+Reads the pages produced by
 
-    gh pr list --state open --author <bot> \
-        --json number,title,headRefOid,createdAt
+    gh api --paginate --slurp "repos/{repo}/pulls?state=open&per_page=100"
 
 on stdin and writes `key=value` lines suitable for `$GITHUB_OUTPUT`.
 
+Every open pull request is read, following pagination to the end, because a
+capped listing would silently drop the oldest matches. Those are exactly the
+superseded pull requests that must be closed: one left open becomes the
+newest open pull request for its title once the merged one closes, and
+merging it would put an earlier description back on the default branch.
+
 Two properties matter for safety and are the reason this is a script rather
 than an inline `jq` filter:
 
@@ -23,6 +28,10 @@
 * The head commit SHA of each selected pull request is emitted alongside its
   number, so every later step can pin to the exact commit that was inspected
   instead of resolving a branch name again.
+* The author is matched here rather than by a listing flag, because the
+  endpoint that pages over every open pull request cannot filter by author.
+  Keeping the author and title rules together means one tested place decides
+  what is eligible.
 """
 
 import argparse
@@ -37,6 +46,44 @@
 GROUPS = (('30', TITLE_30), ('31', TITLE_31))
 
 
+def normalise(payload, author):
+    """Flatten paginated pages and map API fields to the names used below.
+
+    `--slurp` yields one list per page, so the payload is a list of lists.
+    A single flat list is accepted too, which keeps the parsing rules the
+    same whichever way the input was produced.
+    """
+    flat = []
+    for entry in payload:
+        if isinstance(entry, list):
+            flat.extend(entry)
+        else:
+            flat.append(entry)
+
+    normalised = []
+    for pr in flat:
+        if not isinstance(pr, dict):
+            continue
+        # An entry whose author cannot be read is skipped rather than
+        # assumed to match: it must never become a merge candidate, and it
+        # must never be closed as superseded.
+        user = pr.get('user')
+        login = user.get('login') if isinstance(user, dict) else None
+        if login != author:
+            continue
+        head = pr.get('head')
+        normalised.append(
+            {
+                'number': pr.get('number'),
+                'title': pr.get('title'),
+                'headRefOid': head.get('sha') if isinstance(head, dict) else None,
+                'createdAt': pr.get('created_at'),
+            }
+        )
+
+    return normalised
+
+
 def _sort_key(pr):
     # `createdAt` is RFC 3339 in UTC, so lexical order is chronological.
     # The number breaks ties deterministically.
@@ -94,6 +141,10 @@ def outputs(pull_requests):
 
 def main(argv=None):
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument(
+        '--author',
+        help='only consider pull requests opened by this login',
+    )
     parser.add_argument(
         '--title',
         choices=[suffix for suffix, _ in GROUPS],
@@ -105,12 +156,16 @@ def main(argv=None):
         print(dict(GROUPS)[args.title])
         return 0
 
+    if not args.author:
+        print('--author is required when selecting', file=sys.stderr)
+        return 2
+
     payload = json.load(sys.stdin)
     if not isinstance(payload, list):
         print('expected a JSON array of pull requests', file=sys.stderr)
         return 2
 
-    for line in outputs(payload):
+    for line in outputs(normalise(payload, args.author)):
         print(line)
     return 0
 
 
@@ -155,6 +155,78 @@ def test_malformed_entries_are_ignored(self):
         self.assertEqual(out['superseded_30'], '')
 
 
+def api_pr(number, title, sha='sha', created='2026-01-01T00:00:00Z', login='bot'):
+    """One entry shaped like the REST pulls endpoint returns it."""
+    return {
+        'number': number,
+        'title': title,
+        'head': {'sha': sha},
+        'created_at': created,
+        'user': {'login': login},
+    }
+
+
+class NormaliseTest(unittest.TestCase):
+    """Reading every page matters: a dropped page leaves superseded PRs open."""
+
+    def test_pages_are_flattened_and_fields_mapped(self):
+        pages = [
+            [api_pr(1, sel.TITLE_30, sha='a', created='2026-01-01T00:00:00Z')],
+            [api_pr(2, sel.TITLE_30, sha='b', created='2026-02-01T00:00:00Z')],
+        ]
+        self.assertEqual(
+            sel.normalise(pages, 'bot'),
+            [
+                {
+                    'number': 1,
+                    'title': sel.TITLE_30,
+                    'headRefOid': 'a',
+                    'createdAt': '2026-01-01T00:00:00Z',
+                },
+                {
+                    'number': 2,
+                    'title': sel.TITLE_30,
+                    'headRefOid': 'b',
+                    'createdAt': '2026-02-01T00:00:00Z',
+                },
+            ],
+        )
+
+    def test_a_flat_list_is_accepted_too(self):
+        self.assertEqual(len(sel.normalise([api_pr(1, sel.TITLE_30)], 'bot')), 1)
+
+    def test_another_author_is_never_eligible(self):
+        pages = [[api_pr(1, sel.TITLE_30, login='someone-else')]]
+        self.assertEqual(sel.normalise(pages, 'bot'), [])
+
+    def test_an_unreadable_author_is_skipped_rather_than_assumed(self):
+        pages = [[{'number': 1, 'title': sel.TITLE_30, 'head': {'sha': 'a'}}]]
+        self.assertEqual(sel.normalise(pages, 'bot'), [])
+
+    def test_a_malformed_entry_does_not_abort_the_page(self):
+        pages = [['not a dict', api_pr(2, sel.TITLE_30), None]]
+        self.assertEqual([pr['number'] for pr in sel.normalise(pages, 'bot')], [2])
+
+    def test_a_missing_head_survives_normalisation_and_blocks_pinning(self):
+        pages = [[{'number': 1, 'title': sel.TITLE_30, 'user': {'login': 'bot'}}]]
+        normalised = sel.normalise(pages, 'bot')
+        self.assertIsNone(normalised[0]['headRefOid'])
+        self.assertEqual(sel.outputs(normalised)[0], 'found=false')
+
+    def test_an_older_pull_request_on_a_later_page_is_still_superseded(self):
+        # The regression this guards: the oldest matches arrive last, and
+        # dropping them would leave a stale pull request open to be selected
+        # by a later run once the merged one closes.
+        pages = [
+            [api_pr(9, sel.TITLE_30, sha='new', created='2026-05-01T00:00:00Z')],
+            [api_pr(1, sel.TITLE_30, sha='old', created='2026-01-01T00:00:00Z')],
+        ]
+        out = dict(line.split('=', 1) for line in sel.outputs(sel.normalise(pages, 'bot')))
+        self.assertEqual(out['pr_30'], '9')
+        self.assertEqual(out['sha_30'], 'new')
+        self.assertEqual(out['superseded_30'], '1')
+
+
 class CliTest(unittest.TestCase):
     def _run(self, argv):
         import io
@@ -171,6 +243,15 @@ def test_title_flag_prints_the_exact_title_for_a_group(self):
         self.assertEqual(self._run(['--title', '30']), (0, [sel.TITLE_30]))
         self.assertEqual(self._run(['--title', '31']), (0, [sel.TITLE_31]))
 
+    def test_selecting_without_an_author_is_refused(self):
+        import io
+
+        captured, sys.stderr = sys.stderr, io.StringIO()
+        try:
+            self.assertEqual(sel.main([]), 2)
+        finally:
+            sys.stderr = captured
+
     def test_title_flag_rejects_an_unknown_group(self):
         import io
 
 
@@ -98,12 +98,16 @@ jobs:
         run: |
           set -euo pipefail
 
-          gh pr list \
-            --state open \
-            --author "$BOT_LOGIN" \
-            --limit 100 \
-            --json number,title,headRefOid,createdAt \
-            | python3 tools/.github/scripts/select_openapi_prs.py >selection.txt
+          # Every open pull request by the bot, following pagination rather
+          # than stopping at a fixed count. A cap that silently drops the
+          # oldest matches would leave superseded pull requests open, and a
+          # later run would then treat one of them as the newest open
+          # candidate and put an earlier description back on the default
+          # branch. During a long freeze these accumulate well past one page.
+          gh api --paginate --slurp \
+            "repos/$GH_REPO/pulls?state=open&per_page=100" \
+            | python3 tools/.github/scripts/select_openapi_prs.py \
+                --author "$BOT_LOGIN" >selection.txt
 
           cat selection.txt
           cat selection.txt >>"$GITHUB_OUTPUT"
@@ -308,13 +312,31 @@ jobs:
               exit 0
             fi
 
-            git diff --stat "$base_commit" "$sha" | sed -n '1,60p' >"summary-$pr.txt"
+            # Kept whole: a truncated inventory would omit files and the
+            # total line, which is the part worth reading. These updates
+            # routinely touch dozens of files but only a few kilobytes of
+            # stat, so this stays far inside the comment size limit. The
+            # guard below is for the pathological case only.
+            git diff --stat "$base_commit" "$sha" >"summary-$pr.txt"
+            if [ "$(wc -c <"summary-$pr.txt")" -gt 60000 ]; then
+              echo "::notice::#$pr has an unusually large change summary; truncating."
+              # `sed -n` rather than `head`: it consumes all input, so the
+              # producer is never killed by SIGPIPE under `pipefail`.
+              sed -n '1,500p' "summary-$pr.txt" >"summary-$pr.trimmed"
+              printf '\n... truncated; see the pull request files tab.\n' \
+                >>"summary-$pr.trimmed"
+              mv "summary-$pr.trimmed" "summary-$pr.txt"
+            fi
           done
 
           echo "status=pinned" >>"$GITHUB_OUTPUT"
 
       - name: Post change summary to pull requests
-        if: steps.pin.outputs.status == 'pinned'
+        # A dry run is for confirming selection, so it stays read-only apart
+        # from the run summary. Posting here would also leave a comment
+        # carrying this commit's marker, which the later real run would treat
+        # as "already summarised" and skip.
+        if: steps.pin.outputs.status == 'pinned' && inputs.dry_run != true
         working-directory: repo
         env:
           GH_TOKEN: ${{ github.token }}