From 00e82eb2f6299de3250664ecdf420172e3e92225 Mon Sep 17 00:00:00 2001
From: Darrien Rushing <drushing.dev@gmail.com>
Date: Mon, 2 Nov 2026 15:43:42 -0600
Subject: [PATCH] feat(core): store Dependabot runs and findings, lock
 concurrent checks, add dismissals

Each `gitlib dependabot check` now saves its result as the newest run in
gitlib.db (dependabot_runs, dependabot_findings; the newest 60 runs are kept),
so the findings can be read without the network. A lease row taken under
BEGIN IMMEDIATE stops two checks from running at once; it lapses after 15
minutes if the holder crashed. Findings for an owner that could not be asked
are carried forward from the previous run with their original time.

Putting a PR aside is the user's decision, so it lives in planning.db
(append-only migration 4) rather than in the derived findings.

CLI: `check` saves by default (`--no-save` to skip), plus `show`, `dismiss`
and `restore`. Reports leave dismissed or snoozed PRs out and count them.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 README.md                                   |  33 +-
 apps/cli/src/cli.ts                         |  93 ++++-
 apps/cli/src/render.ts                      | 111 ++++--
 apps/cli/test/dependabot.test.ts            | 147 ++++++++
 docs/dependabot-watch.md                    |  11 +-
 packages/core/src/app.ts                    |  62 ++++
 packages/core/src/dependabot/dismissals.ts  |  29 ++
 packages/core/src/dependabot/index.ts       |   2 +
 packages/core/src/dependabot/store.ts       | 266 ++++++++++++++
 packages/core/src/planning/migrations.ts    |  15 +
 packages/core/src/planning/store.ts         |  35 ++
 packages/core/src/planning/types.ts         |  13 +
 packages/core/test/dependabot-fixtures.ts   | 136 +++++++
 packages/core/test/dependabot-store.test.ts | 382 ++++++++++++++++++++
 packages/core/test/dependabot.test.ts       | 131 +------
 15 files changed, 1283 insertions(+), 183 deletions(-)
 create mode 100644 packages/core/src/dependabot/dismissals.ts
 create mode 100644 packages/core/src/dependabot/store.ts
 create mode 100644 packages/core/test/dependabot-fixtures.ts
 create mode 100644 packages/core/test/dependabot-store.test.ts

diff --git a/README.md b/README.md
index 627ba1d..d8d5a17 100644
--- a/README.md
+++ b/README.md
@@ -155,15 +155,18 @@ reasonable start; check with `ollama ps` on that machine that the model is fully
 `gitlib dependabot check` reports which open [Dependabot](https://docs.github.com/code-security/dependabot) pull
 requests on your **starred** repositories can be merged and which need work. "Starred" is the Star toggle in gitlib
 (`repo_favorites`), not GitHub stars, and only favorites with a github.com remote can be watched; the report says
-how many were skipped and why. It is report-only: nothing is written to GitHub or to gitlib's database, no model is
-involved, and the verdict comes only from fields GitHub returns (never from the PR text, which quotes third-party
-release notes). The research and the reasoning behind it are in
-[`docs/dependabot-watch.md`](docs/dependabot-watch.md).
+how many were skipped and why. Nothing is ever written to GitHub, and the verdict comes only from fields GitHub
+returns (never from the PR text, which quotes third-party release notes). The research and the reasoning behind it
+are in [`docs/dependabot-watch.md`](docs/dependabot-watch.md).
 
 ```bash
 export GITLIB_GITHUB_TOKEN=...      # or GITHUB_TOKEN; GitHub's GraphQL API does not answer without one
-gitlib dependabot check             # grouped by bucket, with reasons and suggested actions
+gitlib dependabot check             # asks GitHub, saves the result, prints it grouped by bucket
 gitlib dependabot check --json      # the same, machine-readable
+gitlib dependabot check --no-save   # print only; nothing is stored and no lock is taken
+gitlib dependabot show [--json]     # the newest saved check, without contacting GitHub
+gitlib dependabot dismiss meddlin/gitlib#41 [--until 2026-12-01]   # put a PR aside
+gitlib dependabot restore meddlin/gitlib#41
 ```
 
 | Bucket | Meaning |
@@ -179,11 +182,20 @@ PRs, plus one small lookup that tells which watched repositories your token cann
 few points of the 5,000 an hour; the report prints the actual cost. Anything it could not check is listed under
 `NOT CHECKED` or `INCOMPLETE` rather than left out, and the command exits with status 1 if a whole owner failed.
 
+**Saved runs.** Each check is stored in `gitlib.db` (`dependabot_runs`, `dependabot_findings`; the newest 60 runs
+are kept) so the findings can be read offline and compared over time; they are derived from GitHub and can be fetched
+again. If one owner cannot be asked (network, rate limit), the last findings for its repositories are kept, marked
+`last seen <time>`, and the run is flagged `NOT CHECKED`, so a blip does not empty the list. A lock row in the same
+database stops two checks (this command, the web page, a schedule) from running at once; it lapses after 15 minutes
+if the holder crashed. **Putting a PR aside** is your decision, not derived data, so it is stored in `planning.db`
+(and covered by `gitlib backup`): `dismiss` hides it until it closes or until the date you give, and reports leave it
+out while counting it under `Put aside`.
+
 **CI unknown.** A PR whose check results GitHub did not return is shown as `CI unknown` with the reason, filed under
 *Review first*, and never as ready. GitHub's token guide lists the Checks API among the things fine-grained tokens
 cannot do, and whether GraphQL `statusCheckRollup` works with one is undocumented, so with a fine-grained token you
 may see `CI unknown` on every PR. [`docs/dependabot-watch.md`](docs/dependabot-watch.md#verify-with-your-own-token)
-has the commands that settle it. Still to come: storing findings, a web page, a schedule and notifications.
+has the commands that settle it.
 
 ## Planning
 
@@ -324,7 +336,10 @@ gitlib open code <repo>
 gitlib open remote <repo>
 gitlib tui
 gitlib notes edit <repo>
-gitlib dependabot check [--json]
+gitlib dependabot check [--json] [--no-save]
+gitlib dependabot show [--json]
+gitlib dependabot dismiss <owner/repo#number> [--until DATE]
+gitlib dependabot restore <owner/repo#number>
 gitlib planning backup [path]
 gitlib backup create [dir] [--keep N]
 gitlib backup verify <archive>
@@ -344,8 +359,8 @@ Command summary:
 - `gitlib open remote <repo>` opens the preferred configured remote in your browser.
 - `gitlib tui` launches the interactive terminal UI.
 - `gitlib notes edit <repo>` opens your configured editor to update repo notes.
-- `gitlib dependabot check [--json]` reports which Dependabot PRs on starred repositories can be merged (see
-  [Dependabot watch](#dependabot-watch)).
+- `gitlib dependabot check|show|dismiss|restore` reports which Dependabot PRs on starred repositories can be merged,
+  shows the last saved report, and puts PRs aside (see [Dependabot watch](#dependabot-watch)).
 - `gitlib planning backup [path]` snapshots the planning database (see [Planning](#planning)).
 - `gitlib backup create [dir]` writes a verified archive of everything gitlib stores that cannot be rebuilt
   (config, notes, descriptions, favorites, planning) to `dir` (default `$GITLIB_BACKUP_DIR`, else
diff --git a/apps/cli/src/cli.ts b/apps/cli/src/cli.ts
index 8d06582..5efc15e 100644
--- a/apps/cli/src/cli.ts
+++ b/apps/cli/src/cli.ts
@@ -32,6 +32,8 @@ import {
 
 export const VERSION = "0.1.0";
 
+const TRIGGER_NAMES = { cli: "the CLI", web: "the web page", schedule: "the schedule" } as const;
+
 export interface CliIo {
   /** Merged over `process.env`, so callers only need to pass overrides. */
   env?: Env;
@@ -62,7 +64,10 @@ type Invocation =
   | { name: "open-code"; repo: string }
   | { name: "open-remote"; repo: string }
   | { name: "notes-edit"; repo: string }
-  | { name: "dependabot-check"; json?: boolean }
+  | { name: "dependabot-check"; json?: boolean; save: boolean }
+  | { name: "dependabot-show"; json?: boolean }
+  | { name: "dependabot-dismiss"; pr: DependabotPrRef; until?: string }
+  | { name: "dependabot-restore"; pr: DependabotPrRef }
   | { name: "planning-backup"; destination?: string }
   | { name: "backup-create"; directory?: string; keep?: number }
   | { name: "backup-verify"; archive: string }
@@ -73,6 +78,18 @@ type BackupInvocation = Extract<Invocation, { name: `backup-${string}` }>;
 const isBackupInvocation = (invocation: Invocation): invocation is BackupInvocation =>
   invocation.name.startsWith("backup-");
 
+interface DependabotPrRef {
+  repo: string;
+  number: number;
+}
+
+/** `owner/repo#123`, the way the report prints a pull request. */
+function parsePrRef(value: string): DependabotPrRef {
+  const match = /^(?<repo>[^#\s]+\/[^#\s]+)#(?<number>\d+)$/.exec(value);
+  if (!match?.groups) throw new InvalidArgumentError("expected owner/repo#number, e.g. meddlin/gitlib#41");
+  return { repo: match.groups["repo"]!, number: Number(match.groups["number"]) };
+}
+
 function parsePositiveInt(value: string): number {
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < 1) throw new InvalidArgumentError("must be a positive whole number");
@@ -178,7 +195,25 @@ function buildProgram(
     .command("check")
     .description("Report which open Dependabot PRs on starred repositories can be merged and which need work")
     .option("--json", "machine-readable output")
-    .action((options: { json?: boolean }) => onInvoke({ name: "dependabot-check", json: options.json }));
+    .option("--no-save", "do not store the result as the newest run")
+    .action((options: { json?: boolean; save: boolean }) => onInvoke({ name: "dependabot-check", json: options.json, save: options.save }));
+  dependabot
+    .command("show")
+    .description("Show the newest stored Dependabot check without contacting GitHub")
+    .option("--json", "machine-readable output")
+    .action((options: { json?: boolean }) => onInvoke({ name: "dependabot-show", json: options.json }));
+
+  dependabot
+    .command("dismiss")
+    .description("Put a Dependabot PR aside so reports and the badge leave it out")
+    .argument("<pr>", "owner/repo#number, as printed in the report", parsePrRef)
+    .option("--until <date>", "bring it back on this date (e.g. 2026-12-01); default is until the PR closes")
+    .action((pr: DependabotPrRef, options: { until?: string }) => onInvoke({ name: "dependabot-dismiss", pr, until: options.until }));
+  dependabot
+    .command("restore")
+    .description("Bring a dismissed Dependabot PR back")
+    .argument("<pr>", "owner/repo#number", parsePrRef)
+    .action((pr: DependabotPrRef) => onInvoke({ name: "dependabot-restore", pr }));
 
   const planning = program.command("planning").description("Manage gitlib's own planning data (issues)");
   planning
@@ -356,11 +391,61 @@ async function execute(
       return 0;
     }
     case "dependabot-check": {
-      const report = await app.checkDependabot();
-      print(invocation.json ? renderJson(dependabotReportToDict(report)) : renderDependabotReport(report, color));
+      const now = new Date();
+      const dismissals = app.listDependabotDismissals();
+      // A stored check also takes the lock that keeps the web button and the schedule from running at the same time.
+      const stored = invocation.save ? await app.runDependabotCheck({ trigger: "cli", now }) : null;
+      const report = stored?.report ?? (await app.checkDependabot({ now }));
+      const run = stored ? { id: stored.id, trigger: stored.trigger } : null;
+      print(
+        invocation.json
+          ? renderJson(dependabotReportToDict(report, { run, dismissals, now }))
+          : renderDependabotReport(report, {
+              color,
+              dismissals,
+              now,
+              footer: stored ? [`Saved as run ${stored.id}; read it again with \`gitlib dependabot show\`.`] : [],
+            }),
+      );
       // A report that could not cover every owner is not a clean bill of health, so a scheduler can notice.
       return report.errors.length > 0 ? 1 : 0;
     }
+    case "dependabot-show": {
+      const stored = app.latestDependabotRun();
+      if (!stored) {
+        printError("No Dependabot check has been saved yet. Run `gitlib dependabot check` first.");
+        return 1;
+      }
+      const now = new Date();
+      const dismissals = app.listDependabotDismissals();
+      const run = { id: stored.id, trigger: stored.trigger };
+      print(
+        invocation.json
+          ? renderJson(dependabotReportToDict(stored.report, { run, dismissals, now }))
+          : renderDependabotReport(stored.report, {
+              color,
+              dismissals,
+              now,
+              header: [`Stored run ${stored.id}, started by ${TRIGGER_NAMES[stored.trigger]}; GitHub was not contacted.`, ""],
+            }),
+      );
+      return 0;
+    }
+    case "dependabot-dismiss": {
+      const { repo, number } = invocation.pr;
+      const dismissal = app.dismissDependabotPr(repo, number, invocation.until ?? null);
+      print(
+        dismissal.snoozedUntil
+          ? `Put ${repo}#${number} aside until ${dismissal.snoozedUntil}.`
+          : `Put ${repo}#${number} aside until it closes. Bring it back with \`gitlib dependabot restore ${repo}#${number}\`.`,
+      );
+      return 0;
+    }
+    case "dependabot-restore": {
+      app.restoreDependabotPr(invocation.pr.repo, invocation.pr.number);
+      print(`${invocation.pr.repo}#${invocation.pr.number} is no longer put aside.`);
+      return 0;
+    }
     case "planning-backup": {
       print(`Backed up the planning database to ${app.backupPlanning(invocation.destination)}.`);
       return 0;
diff --git a/apps/cli/src/render.ts b/apps/cli/src/render.ts
index fee9d54..f571029 100644
--- a/apps/cli/src/render.ts
+++ b/apps/cli/src/render.ts
@@ -1,9 +1,11 @@
 import {
   BUCKETS,
   renderSegments,
+  splitDismissed,
   type Bucket,
   type CiState,
   type ClassifiedPr,
+  type DependabotDismissal,
   type DependabotReport,
   type RepoRecord,
   type SearchField,
@@ -135,8 +137,24 @@ function ciLabel(ci: CiState): string {
   }
 }
 
-function renderPullRequest({ pr, reasons, actions }: ClassifiedPr): string[] {
+/** A report as `check` produces it, or as the store gives it back (then each PR says when GitHub was last asked). */
+export type ReportLike = Omit<DependabotReport, "items"> & { items: (ClassifiedPr & { observedAt?: string })[] };
+
+export interface DependabotRenderOptions {
+  color?: boolean;
+  /** PRs the user put aside are left out of the buckets and counted instead. */
+  dismissals?: readonly DependabotDismissal[];
+  now?: Date;
+  /** Lines printed before the report, e.g. which stored run this is. */
+  header?: string[];
+  /** Lines printed after it. */
+  footer?: string[];
+}
+
+function renderPullRequest({ pr, reasons, actions, observedAt }: ClassifiedPr & { observedAt?: string }, checkedAt: string): string[] {
   const facts = [pr.ecosystem, pr.updateType === "unknown" ? "update type unknown" : `${pr.updateType} update`, ciLabel(pr.ci)];
+  // A finding carried over from an earlier check says so, because GitHub could not be asked this time.
+  if (observedAt && observedAt !== checkedAt) facts.push(`last seen ${observedAt}`);
   return [
     `  ${pr.repo}#${pr.number}  ${pr.title}`,
     `    ${facts.filter(Boolean).join(" | ")}`,
@@ -148,28 +166,32 @@ function renderPullRequest({ pr, reasons, actions }: ClassifiedPr): string[] {
 
 const plural = (count: number, one: string, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
 
-/** The text report of `dependabot check`: PRs grouped by bucket, then everything that was not or could not be checked. */
-export function renderDependabotReport(report: DependabotReport, color = false): string {
-  const bold = (text: string) => (color ? `\u001b[1m${text}\u001b[22m` : text);
-  const lines: string[] = [];
+/** The text report of `dependabot check` and `dependabot show`: PRs grouped by bucket, then everything not checked. */
+export function renderDependabotReport(report: ReportLike, options: DependabotRenderOptions = {}): string {
+  const bold = (text: string) => (options.color ? `\u001b[1m${text}\u001b[22m` : text);
+  const { active: items, dismissed } = splitDismissed(report.items, options.dismissals ?? [], options.now ?? new Date());
+  const lines: string[] = [...(options.header ?? [])];
   const checked = report.watched.filter((repo) => repo.status === "checked");
 
-  const counts = BUCKETS.map((bucket) => `${report.items.filter((item) => item.bucket === bucket).length} ${BUCKET_TITLES[bucket].toLowerCase()}`);
+  const counts = BUCKETS.map((bucket) => `${items.filter((item) => item.bucket === bucket).length} ${BUCKET_TITLES[bucket].toLowerCase()}`);
   lines.push(
     `Dependabot pull requests on ${plural(report.watched.length, "starred repository", "starred repositories")} (checked ${report.checkedAt})`,
   );
-  lines.push(report.items.length > 0 ? counts.join(", ") : "No open Dependabot pull requests.");
+  lines.push(items.length > 0 ? counts.join(", ") : "No open Dependabot pull requests.");
 
   for (const bucket of BUCKETS) {
-    const items = report.items.filter((item) => item.bucket === bucket);
-    if (items.length === 0) continue;
-    lines.push("", bold(`${BUCKET_TITLES[bucket].toUpperCase()} (${items.length})`));
-    for (const item of items) lines.push(...renderPullRequest(item));
+    const inBucket = items.filter((item) => item.bucket === bucket);
+    if (inBucket.length === 0) continue;
+    lines.push("", bold(`${BUCKET_TITLES[bucket].toUpperCase()} (${inBucket.length})`));
+    for (const item of inBucket) lines.push(...renderPullRequest(item, report.checkedAt));
   }
 
   const quiet = checked.filter((repo) => repo.openPrs === 0).map((repo) => repo.slug);
   const notes: string[] = [];
   if (quiet.length > 0 && report.items.length > 0) notes.push(`No open Dependabot pull requests: ${quiet.join(", ")}.`);
+  if (dismissed.length > 0) {
+    notes.push(`Put aside (${dismissed.length}): ${dismissed.map(({ pr }) => `${pr.repo}#${pr.number}`).join(", ")}.`);
+  }
   if (report.watched.length === 0) {
     notes.push("No starred repository has a GitHub remote, so there is nothing to check. Star repositories in the web app, then run `gitlib scan`.");
   }
@@ -192,37 +214,52 @@ export function renderDependabotReport(report: DependabotReport, color = false):
     notes.push(`GitHub quota: this check cost ${report.rateLimit.cost}, ${report.rateLimit.remaining} left until ${report.rateLimit.resetAt}.`);
   }
   if (notes.length > 0) lines.push("", ...notes);
+  if (options.footer?.length) lines.push("", ...options.footer);
   return lines.join("\n");
 }
 
-/** The stable, snake_case JSON shape emitted by `dependabot check --json`. */
-export function dependabotReportToDict(report: DependabotReport): Record<string, unknown> {
+/** The stable, snake_case JSON shape emitted by `dependabot check --json` and `dependabot show --json`. */
+export function dependabotReportToDict(
+  report: ReportLike,
+  options: { run?: { id: number; trigger: string } | null; dismissals?: readonly DependabotDismissal[]; now?: Date } = {},
+): Record<string, unknown> {
+  const { active, dismissed } = splitDismissed(report.items, options.dismissals ?? [], options.now ?? new Date());
+  const entries = [
+    ...active.map((item) => ({ item, dismissal: null })),
+    ...dismissed.map(({ dismissal, ...item }) => ({ item, dismissal })),
+  ];
   return {
+    run: options.run ?? null,
     checked_at: report.checkedAt,
-    summary: Object.fromEntries(BUCKETS.map((bucket) => [bucket, report.items.filter((item) => item.bucket === bucket).length])),
-    pull_requests: report.items.map(({ pr, bucket, reasons, actions }) => ({
-      repo: pr.repo,
-      number: pr.number,
-      title: pr.title,
-      url: pr.url,
-      bucket,
-      reasons,
-      actions,
-      update_type: pr.updateType,
-      ecosystem: pr.ecosystem,
-      dependencies: pr.dependencies,
-      branch: pr.headRefName,
-      author: pr.author,
-      is_draft: pr.isDraft,
-      mergeable: pr.mergeable,
-      merge_state_status: pr.mergeStateStatus,
-      review_decision: pr.reviewDecision,
-      labels: pr.labels,
-      commit_count: pr.commitCount,
-      ci: pr.ci,
-      created_at: pr.createdAt,
-      updated_at: pr.updatedAt,
-    })),
+    summary: Object.fromEntries(BUCKETS.map((bucket) => [bucket, active.filter((item) => item.bucket === bucket).length])),
+    pull_requests: entries.map(({ item, dismissal }) => {
+      const { pr, bucket, reasons, actions } = item;
+      return {
+        repo: pr.repo,
+        number: pr.number,
+        title: pr.title,
+        url: pr.url,
+        bucket,
+        reasons,
+        actions,
+        update_type: pr.updateType,
+        ecosystem: pr.ecosystem,
+        dependencies: pr.dependencies,
+        branch: pr.headRefName,
+        author: pr.author,
+        is_draft: pr.isDraft,
+        mergeable: pr.mergeable,
+        merge_state_status: pr.mergeStateStatus,
+        review_decision: pr.reviewDecision,
+        labels: pr.labels,
+        commit_count: pr.commitCount,
+        ci: pr.ci,
+        created_at: pr.createdAt,
+        updated_at: pr.updatedAt,
+        observed_at: item.observedAt ?? report.checkedAt,
+        dismissed: dismissal ? { snoozed_until: dismissal.snoozedUntil, created_at: dismissal.createdAt } : null,
+      };
+    }),
     repositories: report.watched.map((repo) => ({
       repo: repo.slug,
       status: repo.status,
diff --git a/apps/cli/test/dependabot.test.ts b/apps/cli/test/dependabot.test.ts
index 437c961..c28bfda 100644
--- a/apps/cli/test/dependabot.test.ts
+++ b/apps/cli/test/dependabot.test.ts
@@ -124,6 +124,8 @@ describe("gitlib dependabot check", () => {
       "    Next: Run the check again in a minute or two.",
       "",
       "GitHub quota: this check cost 3, 4997 left until 2026-11-02T13:00:00Z.",
+      "",
+      "Saved as run 1; read it again with `gitlib dependabot show`.",
     ]);
   });
 
@@ -314,6 +316,7 @@ describe("gitlib dependabot check", () => {
       expect(result.code, result.stderr).toBe(0);
       const report = JSON.parse(result.stdout);
       expect(Object.keys(report)).toEqual([
+        "run",
         "checked_at",
         "summary",
         "pull_requests",
@@ -324,6 +327,7 @@ describe("gitlib dependabot check", () => {
         "warnings",
         "rate_limit",
       ]);
+      expect(report.run).toEqual({ id: 1, trigger: "cli" });
       expect(report.summary).toEqual({ ready: 1, "review-first": 1, "needs-work": 1, waiting: 0 });
       expect(report.pull_requests.map((p: { number: number; bucket: string }) => [p.number, p.bucket])).toEqual([
         [41, "ready"],
@@ -342,7 +346,9 @@ describe("gitlib dependabot check", () => {
         commit_count: 1,
         labels: ["dependencies", "security"],
         ci: { state: "unknown", reason: "no rollup" },
+        dismissed: null,
       });
+      expect(report.pull_requests[1].observed_at).toBe(report.checked_at);
       expect(report.pull_requests[1].reasons[0]).toBe("CI unknown: no rollup");
       expect(report.pull_requests[2].actions.join("\n")).toContain("`@dependabot rebase`");
       expect(report.repositories).toEqual([{ repo: "meddlin/gitlib", status: "checked", open_pull_requests: 3, paths: ["gitlib"] }]);
@@ -361,3 +367,144 @@ describe("gitlib dependabot check", () => {
     });
   });
 });
+
+describe("saving and showing", () => {
+  const twoPrs = () => new FakeBackend({ meddlin: { prs: [pr({ number: 41 }), pr({ number: 43, mergeStateStatus: "BEHIND" })] } });
+
+  it("saves each check, and show prints it again without contacting GitHub", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const backend = twoPrs();
+    const check = await fx.runCli(["dependabot", "check"], { dependabotBackend: backend });
+    expect(check.stdout).toContain("Saved as run 1; read it again with `gitlib dependabot show`.");
+
+    const never: DependabotBackend = { label: "never", fetchOwner: () => Promise.reject(new Error("must not be called")) };
+    const show = await fx.runCli(["dependabot", "show"], { dependabotBackend: never, env: { GITLIB_GITHUB_TOKEN: "" } });
+
+    expect(show.code, show.stderr).toBe(0);
+    expect(show.stdout.split("\n").slice(0, 2)).toEqual(["Stored run 1, started by the CLI; GitHub was not contacted.", ""]);
+    expect(show.stdout).toContain("READY (1)");
+    expect(show.stdout).toContain("meddlin/gitlib#43");
+    expect(show.stdout).not.toContain("Saved as run");
+    // Same data as the check: compare the structured output.
+    const fromCheck = JSON.parse((await fx.runCli(["dependabot", "show", "--json"])).stdout);
+    expect(fromCheck.run).toEqual({ id: 1, trigger: "cli" });
+    expect(fromCheck.pull_requests.map((p: { number: number }) => p.number)).toEqual([41, 43]);
+  });
+
+  it("show says so, and exits 1, when nothing has been saved", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const result = await fx.runCli(["dependabot", "show"]);
+    expect(result.code).toBe(1);
+    expect(result.stderr.trim()).toBe("No Dependabot check has been saved yet. Run `gitlib dependabot check` first.");
+  });
+
+  it("--no-save prints the report and stores nothing", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const check = await fx.runCli(["dependabot", "check", "--no-save"], { dependabotBackend: twoPrs() });
+    expect(check.code, check.stderr).toBe(0);
+    expect(check.stdout).not.toContain("Saved as run");
+    expect(JSON.parse((await fx.runCli(["dependabot", "check", "--no-save", "--json"], { dependabotBackend: twoPrs() })).stdout).run).toBeNull();
+    expect((await fx.runCli(["dependabot", "show"])).code).toBe(1);
+  });
+
+  it("leaves out pull requests the user put aside, and counts them", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const app = createApplication(fx.env());
+    app.dismissDependabotPr("Meddlin/GitLib", 43);
+
+    const text = await fx.runCli(["dependabot", "check"], { dependabotBackend: twoPrs() });
+    expect(text.stdout).toContain("1 ready, 0 review first, 0 needs work, 0 waiting");
+    expect(text.stdout).not.toContain("NEEDS WORK");
+    expect(text.stdout).toContain("Put aside (1): meddlin/gitlib#43.");
+
+    const json = JSON.parse((await fx.runCli(["dependabot", "show", "--json"])).stdout);
+    expect(json.summary).toEqual({ ready: 1, "review-first": 0, "needs-work": 0, waiting: 0 });
+    expect(json.pull_requests.map((p: { number: number; dismissed: unknown }) => [p.number, p.dismissed !== null])).toEqual([
+      [41, false],
+      [43, true],
+    ]);
+
+    app.restoreDependabotPr("meddlin/gitlib", 43);
+    expect((await fx.runCli(["dependabot", "show"])).stdout).toContain("NEEDS WORK (1)");
+  });
+
+  it("brings a snoozed pull request back once the snooze has ended", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const app = createApplication(fx.env());
+    app.dismissDependabotPr("meddlin/gitlib", 43, new Date(Date.now() + 3_600_000).toISOString());
+    expect((await fx.runCli(["dependabot", "check"], { dependabotBackend: twoPrs() })).stdout).toContain("Put aside (1)");
+    app.planning.dismissDependabotPr("meddlin/gitlib", 43, new Date(Date.now() - 1_000).toISOString(), new Date().toISOString());
+    const after = await fx.runCli(["dependabot", "show"]);
+    expect(after.stdout).toContain("NEEDS WORK (1)");
+    expect(after.stdout).not.toContain("Put aside");
+  });
+
+  it("refuses to run while another check holds the lock", async () => {
+    starRepos({ gitlib: "https://github.com/meddlin/gitlib.git" });
+    const app = createApplication(fx.env());
+    app.dependabotStore.acquireLease("web:4242", new Date(), 60_000);
+
+    const backend = twoPrs();
+    const result = await fx.runCli(["dependabot", "check"], { dependabotBackend: backend });
+
+    expect(result.code).toBe(1);
+    expect(result.stderr).toMatch(/^A Dependabot check is already running \(started \S+ by web\)\.$/m);
+    expect(backend.calls).toEqual([]);
+    // --no-save does not store anything, so it does not need the lock.
+    expect((await fx.runCli(["dependabot", "check", "--no-save"], { dependabotBackend: twoPrs() })).code).toBe(0);
+  });
+
+  it("keeps what it last saw for an owner that could not be asked, and says when", async () => {
+    starRepos({ a: "https://github.com/aaa/a.git", b: "https://github.com/bbb/b.git" });
+    const ok = new FakeBackend({
+      aaa: { prs: [pr({ repo: "aaa/a", number: 1 })] },
+      bbb: { prs: [pr({ repo: "bbb/b", number: 2, mergeStateStatus: "BEHIND" })] },
+    });
+    const first = JSON.parse((await fx.runCli(["dependabot", "check", "--json"], { dependabotBackend: ok })).stdout);
+
+    const flaky = new FakeBackend({
+      aaa: { prs: [pr({ repo: "aaa/a", number: 1 })] },
+      bbb: new DependabotUnavailableError("Could not reach GitHub at api.github.com (ENOTFOUND)."),
+    });
+    const second = await fx.runCli(["dependabot", "check"], { dependabotBackend: flaky });
+
+    expect(second.code).toBe(1);
+    expect(second.stdout).toContain("bbb/b#2");
+    expect(second.stdout).toContain(`last seen ${first.checked_at}`);
+    expect(second.stdout).toContain("NOT CHECKED: bbb: Could not reach GitHub");
+    const lines = second.stdout.split("\n");
+    const factsOf = (needle: string) => lines[lines.findIndex((line) => line.includes(needle)) + 1];
+    expect(factsOf("aaa/a#1")).not.toContain("last seen");
+    expect(factsOf("bbb/b#2")).toContain("last seen");
+  });
+});
+
+describe("dismiss and restore", () => {
+  it("puts a pull request aside until it closes, or until a date, and brings it back", async () => {
+    fx.writeConfig();
+    const dismiss = await fx.runCli(["dependabot", "dismiss", "Meddlin/GitLib#43"]);
+    expect(dismiss.code, dismiss.stderr).toBe(0);
+    expect(dismiss.stdout.trim()).toBe(
+      "Put Meddlin/GitLib#43 aside until it closes. Bring it back with `gitlib dependabot restore Meddlin/GitLib#43`.",
+    );
+    expect(createApplication(fx.env()).listDependabotDismissals()).toMatchObject([{ repo: "meddlin/gitlib", number: 43, snoozedUntil: null }]);
+
+    const snooze = await fx.runCli(["dependabot", "dismiss", "meddlin/gitlib#43", "--until", "2030-01-02"]);
+    expect(snooze.stdout.trim()).toBe("Put meddlin/gitlib#43 aside until 2030-01-02T00:00:00.000Z.");
+
+    const restore = await fx.runCli(["dependabot", "restore", "meddlin/gitlib#43"]);
+    expect(restore.code).toBe(0);
+    expect(restore.stdout.trim()).toBe("meddlin/gitlib#43 is no longer put aside.");
+    expect(createApplication(fx.env()).listDependabotDismissals()).toEqual([]);
+  });
+
+  it("explains a malformed reference or date", async () => {
+    fx.writeConfig();
+    const bad = await fx.runCli(["dependabot", "dismiss", "meddlin/gitlib"]);
+    expect(bad.code).not.toBe(0);
+    expect(bad.stderr).toContain("expected owner/repo#number");
+    const date = await fx.runCli(["dependabot", "dismiss", "meddlin/gitlib#1", "--until", "someday"]);
+    expect(date.code).toBe(1);
+    expect(date.stderr).toContain('"someday" is not a date');
+  });
+});
diff --git a/docs/dependabot-watch.md b/docs/dependabot-watch.md
index 24e41a6..b2000fc 100644
--- a/docs/dependabot-watch.md
+++ b/docs/dependabot-watch.md
@@ -4,7 +4,7 @@ Status: **research, with a proposed plan** (2026-11-02). Nothing is decided. The
 record what the primary sources say; "Fit with gitlib" is read from this repository's code and "Recommendation" is the
 author's proposal, so neither is sourced the way the rest is.
 
-**Built so far** (2026-11-02): the report-only slice, Recommendation items 1, 2, 4 and 11 (b) and (c) without storage:
+**Built so far** (2026-11-02): slice 1, the report, Recommendation items 1, 2, 4 and 11 (b) and (c):
 `gitlib dependabot check [--json]` (README, "Dependabot watch"), backed by `packages/core/src/dependabot/` (a pure
 `classify`, a GraphQL fetch behind a `DependabotBackend` interface with a fake in the tests, and `checkDependabot`).
 The verdict never reads the PR body. Choices the plan left open:
@@ -15,8 +15,13 @@ The verdict never reads the PR body. Choices the plan left open:
   that is required, a `security` label, extra commits, a major or unstated update type, or an unrecognised value from
   GitHub are review first.
 - Not built: the "Maintainer changes" phrase and Dependabot-alert matching (both need the body or the alerts API;
-  the `security` label stands in), `isRequired` per check, the retry of `UNKNOWN` mergeability, storage (item 7),
-  the web page and badge (11 d), the lease and schedule (items 5 and 6), and the LLM prose layer (item 8).
+  the `security` label stands in), `isRequired` per check, and the retry of `UNKNOWN` mergeability.
+- Slice 2, storage (item 7 and the lease of item 6): `dependabot_runs` and `dependabot_findings` in `gitlib.db`
+  (newest 60 runs), a one-row lease table taken under `BEGIN IMMEDIATE` with a 5 s busy timeout and a 15 minute expiry,
+  and dismiss/snooze in `planning.db` (migration 4, since it is the user's decision). `gitlib dependabot check` saves
+  by default; `show`, `dismiss` and `restore` were added. Findings of an owner that could not be asked are carried
+  forward from the previous run with their original time, which is the "partial failure per PR" of "Where the
+  existing scheduler falls short", point 4.
 - Added to the plan: a lookup of which watched repositories the token can see, so a private repository the token
   cannot reach is reported as `NOT CHECKED` instead of looking like "no open PRs".
 - 11 (a) has **not** been run: the tests use fixtures shaped like the GraphQL response in "Verify with your own
diff --git a/packages/core/src/app.ts b/packages/core/src/app.ts
index 3f28cb4..d93d9c6 100644
--- a/packages/core/src/app.ts
+++ b/packages/core/src/app.ts
@@ -4,11 +4,17 @@ import { buildChatSystemPrompt, OllamaBackend, type ChatBackend } from "./ai/ind
 import { loadConfig, type AppConfig, type Env } from "./config.js";
 import {
   checkDependabot,
+  DependabotBusyError,
+  DependabotStore,
   DependabotUnavailableError,
   GitHubDependabotBackend,
+  isValidOwner,
+  isValidRepoName,
   resolveGitHubToken,
   type DependabotBackend,
   type DependabotReport,
+  type RunTrigger,
+  type StoredRun,
 } from "./dependabot/index.js";
 import { discoverRepos } from "./discovery.js";
 import { GitLibError } from "./errors.js";
@@ -16,6 +22,7 @@ import type { DiscoveredRepo, RemoteTarget, RepoDetails, RepoRecord } from "./mo
 import {
   LocalIssueNotFoundError,
   PlanningStore,
+  type DependabotDismissal,
   normalizeIssueBody,
   normalizeIssueTitle,
   normalizeProjectName,
@@ -85,12 +92,17 @@ export interface SearchOptions extends Omit<FilterOptions, "search"> {
 
 export const DEFAULT_SEARCH_LIMIT = 200;
 
+/** A Dependabot check is a few requests per owner; this is far longer than one takes, and bounds a crashed holder. */
+const DEPENDABOT_LEASE_MS = 15 * 60_000;
+
 export class GitLibApp {
   readonly search: RepoSearch;
   /** The language-model server behind the chat panel; null when `ollama.enabled = false`. */
   readonly chat: ChatBackend | null;
   /** Where Dependabot pull requests come from; null when no GitHub token is set. */
   readonly dependabot: DependabotBackend | null;
+  /** What the Dependabot checks found, kept in `gitlib.db`. */
+  readonly dependabotStore: DependabotStore;
 
   constructor(
     readonly config: AppConfig,
@@ -104,6 +116,7 @@ export class GitLibApp {
     this.search = new RepoSearch(config.search, searchBackend);
     this.chat = chatBackend !== undefined ? chatBackend : config.ollama.enabled ? new OllamaBackend(config.ollama) : null;
     this.dependabot = dependabotBackend;
+    this.dependabotStore = new DependabotStore(config.dbPath);
   }
 
   refresh(): RepoRecord[] {
@@ -221,6 +234,55 @@ export class GitLibApp {
     return checkDependabot({ repositories: this.loadRepositories(), backend: this.dependabot, system: this.system, ...options });
   }
 
+  /**
+   * Like `checkDependabot`, but takes the lock that keeps two checks (CLI, web button, schedule) from running at
+   * once and saves the result as the newest run. Throws `DependabotBusyError` when another check holds the lock.
+   */
+  async runDependabotCheck(options: { trigger: RunTrigger; signal?: AbortSignal; now?: Date }): Promise<StoredRun> {
+    const startedAt = options.now ?? new Date();
+    const holder = `${options.trigger}:${process.pid}`;
+    const lease = this.dependabotStore.acquireLease(holder, startedAt, DEPENDABOT_LEASE_MS);
+    if (!lease.acquired) {
+      throw new DependabotBusyError(
+        `A Dependabot check is already running (started ${lease.heldBy.takenAt} by ${lease.heldBy.holder.split(":")[0]}).`,
+      );
+    }
+    try {
+      const report = await this.checkDependabot({ signal: options.signal, now: startedAt });
+      return this.dependabotStore.saveRun(report, {
+        trigger: options.trigger,
+        startedAt: startedAt.toISOString(),
+        finishedAt: new Date().toISOString(),
+      });
+    } finally {
+      this.dependabotStore.releaseLease(holder);
+    }
+  }
+
+  /** The newest saved Dependabot check, or null if none has run. */
+  latestDependabotRun(): StoredRun | null {
+    return this.dependabotStore.latestRun();
+  }
+
+  /** Puts a Dependabot PR aside until `until` (an ISO time), or until it closes when `until` is null. */
+  dismissDependabotPr(repo: string, number: number, until: string | null = null): DependabotDismissal {
+    const [owner, name, ...rest] = repo.split("/");
+    if (!owner || !name || rest.length > 0 || !isValidOwner(owner) || !isValidRepoName(name)) {
+      throw new GitLibError(`"${repo}" is not a GitHub repository (expected owner/repo).`);
+    }
+    if (!Number.isInteger(number) || number < 1) throw new GitLibError(`"${number}" is not a pull request number.`);
+    if (until !== null && Number.isNaN(Date.parse(until))) throw new GitLibError(`"${until}" is not a date.`);
+    return this.planning.dismissDependabotPr(repo, number, until === null ? null : new Date(until).toISOString(), utcNow());
+  }
+
+  restoreDependabotPr(repo: string, number: number): void {
+    this.planning.restoreDependabotPr(repo, number);
+  }
+
+  listDependabotDismissals(): DependabotDismissal[] {
+    return this.planning.listDependabotDismissals();
+  }
+
   listRepositories(options: FilterOptions & { refresh?: boolean } = {}): RepoRecord[] {
     const { refresh = true, ...filters } = options;
     const repositories = refresh ? this.refresh() : this.loadRepositories();
diff --git a/packages/core/src/dependabot/dismissals.ts b/packages/core/src/dependabot/dismissals.ts
new file mode 100644
index 0000000..f7d6f74
--- /dev/null
+++ b/packages/core/src/dependabot/dismissals.ts
@@ -0,0 +1,29 @@
+import type { DependabotDismissal } from "../planning/types.js";
+
+/** A dismissal that still hides its pull request at `now`: dismissed until closed, or snoozed and not yet due. */
+export function isDismissalActive(dismissal: DependabotDismissal, now: Date): boolean {
+  return dismissal.snoozedUntil === null || Date.parse(dismissal.snoozedUntil) > now.getTime();
+}
+
+/**
+ * Splits findings into those to act on and those the user put aside. A dismissal applies to a pull request by
+ * repository (without regard to case) and number, so a PR that Dependabot replaces with a new number comes back.
+ */
+export function splitDismissed<T extends { pr: { repo: string; number: number } }>(
+  items: readonly T[],
+  dismissals: readonly DependabotDismissal[],
+  now: Date,
+): { active: T[]; dismissed: (T & { dismissal: DependabotDismissal })[] } {
+  const hiding = new Map<string, DependabotDismissal>();
+  for (const dismissal of dismissals) {
+    if (isDismissalActive(dismissal, now)) hiding.set(`${dismissal.repo.toLowerCase()}#${dismissal.number}`, dismissal);
+  }
+  const active: T[] = [];
+  const dismissed: (T & { dismissal: DependabotDismissal })[] = [];
+  for (const item of items) {
+    const dismissal = hiding.get(`${item.pr.repo.toLowerCase()}#${item.pr.number}`);
+    if (dismissal) dismissed.push({ ...item, dismissal });
+    else active.push(item);
+  }
+  return { active, dismissed };
+}
diff --git a/packages/core/src/dependabot/index.ts b/packages/core/src/dependabot/index.ts
index 37c70a8..f98b34a 100644
--- a/packages/core/src/dependabot/index.ts
+++ b/packages/core/src/dependabot/index.ts
@@ -1,5 +1,7 @@
 export * from "./check.js";
 export * from "./classify.js";
+export * from "./dismissals.js";
 export * from "./github-backend.js";
 export * from "./metadata.js";
+export * from "./store.js";
 export * from "./types.js";
diff --git a/packages/core/src/dependabot/store.ts b/packages/core/src/dependabot/store.ts
new file mode 100644
index 0000000..e56ff28
--- /dev/null
+++ b/packages/core/src/dependabot/store.ts
@@ -0,0 +1,266 @@
+import fs from "node:fs";
+import path from "node:path";
+import type { DatabaseSync as DatabaseSyncType } from "node:sqlite";
+import { GitLibError } from "../errors.js";
+import type { DependabotReport } from "./check.js";
+import { BUCKETS, type Bucket, type ClassifiedPr } from "./types.js";
+
+// Loaded via getBuiltinModule for the same bundler reason as in ../store.ts.
+const { DatabaseSync } = process.getBuiltinModule("node:sqlite");
+type DatabaseSync = DatabaseSyncType;
+
+/** How long a connection waits on another process's write lock before giving up. */
+const BUSY_TIMEOUT_MS = 5_000;
+/** Older runs (and their findings) are deleted when a new one is saved. */
+export const KEEP_RUNS = 60;
+
+/** Tables live in `gitlib.db` next to the scan data: everything here can be fetched from GitHub again. */
+const SCHEMA = `
+  -- One row per check of GitHub. \`summary\` is the report without its pull requests.
+  CREATE TABLE IF NOT EXISTS dependabot_runs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    started_at TEXT NOT NULL,
+    finished_at TEXT NOT NULL,
+    trigger TEXT NOT NULL,
+    summary TEXT NOT NULL
+  );
+
+  -- The verdict for each pull request in a run. \`repo\` is the lowercased owner/repo; \`observed_at\` is when GitHub
+  -- was actually asked, which is older than the run for a finding carried over from an earlier run.
+  CREATE TABLE IF NOT EXISTS dependabot_findings (
+    run_id INTEGER NOT NULL,
+    position INTEGER NOT NULL,
+    repo TEXT NOT NULL,
+    number INTEGER NOT NULL,
+    bucket TEXT NOT NULL,
+    observed_at TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    PRIMARY KEY (run_id, position),
+    FOREIGN KEY (run_id) REFERENCES dependabot_runs(id) ON DELETE CASCADE
+  );
+  CREATE INDEX IF NOT EXISTS dependabot_findings_by_pr ON dependabot_findings (repo, number);
+
+  -- At most one row: who is checking GitHub now, and when that claim lapses if they crashed.
+  CREATE TABLE IF NOT EXISTS dependabot_lease (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    holder TEXT NOT NULL,
+    taken_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+  );
+`;
+
+/** Who started a check. */
+export type RunTrigger = "cli" | "web" | "schedule";
+
+/** A classified PR plus when GitHub was last asked about it. */
+export interface StoredFinding extends ClassifiedPr {
+  observedAt: string;
+}
+
+export interface StoredReport extends Omit<DependabotReport, "items"> {
+  items: StoredFinding[];
+}
+
+export interface StoredRun {
+  id: number;
+  trigger: RunTrigger;
+  startedAt: string;
+  finishedAt: string;
+  report: StoredReport;
+}
+
+export interface Lease {
+  holder: string;
+  takenAt: string;
+  expiresAt: string;
+}
+
+export type LeaseResult = { acquired: true } | { acquired: false; heldBy: Lease };
+
+/** Another check is already talking to GitHub. */
+export class DependabotBusyError extends GitLibError {}
+
+interface RunRow {
+  id: number;
+  started_at: string;
+  finished_at: string;
+  trigger: RunTrigger;
+  summary: string;
+}
+
+interface FindingRow {
+  observed_at: string;
+  payload: string;
+}
+
+const parseJson = (text: string): unknown => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && !Array.isArray(value);
+
+const isStringArray = (value: unknown): value is string[] => Array.isArray(value) && value.every((item) => typeof item === "string");
+
+/** A stored finding, or null when the row is unreadable (written by something else, or damaged). */
+function parseFinding(row: FindingRow): StoredFinding | null {
+  const value = parseJson(row.payload);
+  if (!isRecord(value) || !isRecord(value["pr"])) return null;
+  const { pr, bucket, reasons, actions } = value;
+  if (typeof pr["repo"] !== "string" || typeof pr["number"] !== "number") return null;
+  if (!BUCKETS.includes(bucket as Bucket) || !isStringArray(reasons) || !isStringArray(actions)) return null;
+  return { ...(value as unknown as ClassifiedPr), observedAt: row.observed_at };
+}
+
+const lowerRepo = (repo: string): string => repo.toLowerCase();
+
+/** Dependabot runs and findings in `gitlib.db`. Timestamps are passed in by the caller, as with `Store`. */
+export class DependabotStore {
+  constructor(readonly dbPath: string) {
+    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+    this.withConnection((db) => db.exec(SCHEMA));
+  }
+
+  private withConnection<T>(operation: (db: DatabaseSync) => T): T {
+    const db = new DatabaseSync(this.dbPath, { timeout: BUSY_TIMEOUT_MS });
+    try {
+      db.exec("PRAGMA foreign_keys = ON");
+      return operation(db);
+    } finally {
+      db.close();
+    }
+  }
+
+  private transaction<T>(operation: (db: DatabaseSync) => T): T {
+    return this.withConnection((db) => {
+      // IMMEDIATE takes the write lock up front, so two processes cannot both read-then-write the same state.
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const result = operation(db);
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    });
+  }
+
+  /**
+   * Saves a report as the newest run and deletes runs beyond `KEEP_RUNS`. A repository whose owner could not be
+   * asked this time keeps the findings it had in the previous run, with their old `observedAt`, so one network
+   * failure does not empty the page.
+   */
+  saveRun(report: DependabotReport, options: { trigger: RunTrigger; startedAt: string; finishedAt: string }): StoredRun {
+    return this.transaction((db) => {
+      const previous = this.latestRunRow(db);
+      const failed = new Set(report.watched.filter((repo) => repo.status === "failed").map((repo) => lowerRepo(repo.slug)));
+
+      const findings: StoredFinding[] = report.items.map((item) => ({ ...item, observedAt: report.checkedAt }));
+      if (previous && failed.size > 0) {
+        for (const row of this.findingRows(db, previous.id)) {
+          const carried = parseFinding(row);
+          if (carried && failed.has(lowerRepo(carried.pr.repo))) findings.push(carried);
+        }
+      }
+      findings.sort(
+        (a, b) =>
+          BUCKETS.indexOf(a.bucket) - BUCKETS.indexOf(b.bucket) || a.pr.repo.localeCompare(b.pr.repo) || a.pr.number - b.pr.number,
+      );
+
+      const { items: _items, ...summary } = report;
+      const { lastInsertRowid } = db
+        .prepare("INSERT INTO dependabot_runs (started_at, finished_at, trigger, summary) VALUES (?, ?, ?, ?)")
+        .run(options.startedAt, options.finishedAt, options.trigger, JSON.stringify(summary));
+      const runId = Number(lastInsertRowid);
+
+      const insert = db.prepare(
+        "INSERT INTO dependabot_findings (run_id, position, repo, number, bucket, observed_at, payload) VALUES (?, ?, ?, ?, ?, ?, ?)",
+      );
+      findings.forEach(({ observedAt, ...classified }, position) => {
+        insert.run(runId, position, lowerRepo(classified.pr.repo), classified.pr.number, classified.bucket, observedAt, JSON.stringify(classified));
+      });
+
+      db.prepare("DELETE FROM dependabot_runs WHERE id NOT IN (SELECT id FROM dependabot_runs ORDER BY id DESC LIMIT ?)").run(KEEP_RUNS);
+      return this.readRun(db, runId)!;
+    });
+  }
+
+  /** The newest run, or null when nothing has been checked yet (or its summary cannot be read). */
+  latestRun(): StoredRun | null {
+    return this.withConnection((db) => {
+      const row = this.latestRunRow(db);
+      return row ? this.readRun(db, row.id) : null;
+    });
+  }
+
+  /** How many runs are kept; for tests and the status line. */
+  runCount(): number {
+    return this.withConnection((db) => Number((db.prepare("SELECT COUNT(*) AS n FROM dependabot_runs").get() as { n: number }).n));
+  }
+
+  /**
+   * Claims the right to talk to GitHub. A claim lapses after `ttlMs`, so a crashed holder cannot block checks
+   * forever. Returns who holds it when it is taken.
+   */
+  acquireLease(holder: string, now: Date, ttlMs: number): LeaseResult {
+    return this.transaction((db) => {
+      const current = db.prepare("SELECT holder, taken_at, expires_at FROM dependabot_lease WHERE id = 1").get() as
+        | { holder: string; taken_at: string; expires_at: string }
+        | undefined;
+      if (current && Date.parse(current.expires_at) > now.getTime()) {
+        return { acquired: false, heldBy: { holder: current.holder, takenAt: current.taken_at, expiresAt: current.expires_at } };
+      }
+      db.prepare(
+        `INSERT INTO dependabot_lease (id, holder, taken_at, expires_at) VALUES (1, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET holder = excluded.holder, taken_at = excluded.taken_at, expires_at = excluded.expires_at`,
+      ).run(holder, now.toISOString(), new Date(now.getTime() + ttlMs).toISOString());
+      return { acquired: true };
+    });
+  }
+
+  /** Gives the claim back. Does nothing if it already lapsed and someone else took it. */
+  releaseLease(holder: string): void {
+    this.transaction((db) => void db.prepare("DELETE FROM dependabot_lease WHERE id = 1 AND holder = ?").run(holder));
+  }
+
+  /** The live claim, or null when nobody holds one or it has lapsed. */
+  currentLease(now: Date): Lease | null {
+    return this.withConnection((db) => {
+      const row = db.prepare("SELECT holder, taken_at, expires_at FROM dependabot_lease WHERE id = 1").get() as
+        | { holder: string; taken_at: string; expires_at: string }
+        | undefined;
+      return row && Date.parse(row.expires_at) > now.getTime()
+        ? { holder: row.holder, takenAt: row.taken_at, expiresAt: row.expires_at }
+        : null;
+    });
+  }
+
+  private latestRunRow(db: DatabaseSync): RunRow | undefined {
+    return db.prepare("SELECT * FROM dependabot_runs ORDER BY id DESC LIMIT 1").get() as unknown as RunRow | undefined;
+  }
+
+  private findingRows(db: DatabaseSync, runId: number): FindingRow[] {
+    return db
+      .prepare("SELECT observed_at, payload FROM dependabot_findings WHERE run_id = ? ORDER BY position")
+      .all(runId) as unknown as FindingRow[];
+  }
+
+  private readRun(db: DatabaseSync, runId: number): StoredRun | null {
+    const row = db.prepare("SELECT * FROM dependabot_runs WHERE id = ?").get(runId) as unknown as RunRow | undefined;
+    const summary = row ? parseJson(row.summary) : null;
+    if (!row || !isRecord(summary)) return null;
+    const items = this.findingRows(db, runId).flatMap((finding) => parseFinding(finding) ?? []);
+    return {
+      id: Number(row.id),
+      trigger: row.trigger,
+      startedAt: row.started_at,
+      finishedAt: row.finished_at,
+      report: { ...(summary as unknown as Omit<StoredReport, "items">), items },
+    };
+  }
+}
diff --git a/packages/core/src/planning/migrations.ts b/packages/core/src/planning/migrations.ts
index 8d9ec85..7ff54be 100644
--- a/packages/core/src/planning/migrations.ts
+++ b/packages/core/src/planning/migrations.ts
@@ -67,6 +67,21 @@ export const MIGRATIONS: readonly Migration[] = [
       CREATE INDEX local_issues_by_project ON local_issues (project_id);
     `,
   },
+  {
+    version: 4,
+    name: "dependabot dismissals",
+    sql: `
+      -- A Dependabot PR the user has put aside. The findings themselves are derived from GitHub and live in
+      -- gitlib.db; this is the user's decision, which cannot be derived. repo is the lowercased owner/repo.
+      CREATE TABLE dependabot_dismissals (
+        repo TEXT NOT NULL,
+        number INTEGER NOT NULL,
+        snoozed_until TEXT,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY (repo, number)
+      );
+    `,
+  },
 ];
 
 export const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]!.version;
diff --git a/packages/core/src/planning/store.ts b/packages/core/src/planning/store.ts
index 886f1a2..67ffd9b 100644
--- a/packages/core/src/planning/store.ts
+++ b/packages/core/src/planning/store.ts
@@ -4,6 +4,7 @@ import type { DatabaseSync as DatabaseSyncType } from "node:sqlite";
 import { GitLibError } from "../errors.js";
 import { MIGRATIONS, migrate, schemaVersion, type Migration } from "./migrations.js";
 import type {
+  DependabotDismissal,
   IssueStatus,
   LocalIssue,
   LocalIssueChanges,
@@ -289,6 +290,40 @@ export class PlanningStore {
     });
   }
 
+  /** Puts a Dependabot PR aside (or changes how long). `repo` is `owner/repo`, in any case. */
+  dismissDependabotPr(repo: string, number: number, snoozedUntil: string | null, now: string): DependabotDismissal {
+    const entry: DependabotDismissal = { repo: repo.toLowerCase(), number, snoozedUntil, createdAt: now };
+    this.transaction(
+      (db) =>
+        void db
+          .prepare(
+            `INSERT INTO dependabot_dismissals (repo, number, snoozed_until, created_at) VALUES (?, ?, ?, ?)
+             ON CONFLICT(repo, number) DO UPDATE SET snoozed_until = excluded.snoozed_until, created_at = excluded.created_at`,
+          )
+          .run(entry.repo, number, snoozedUntil, now),
+    );
+    return entry;
+  }
+
+  /** Brings a dismissed Dependabot PR back. Does nothing if it was not dismissed. */
+  restoreDependabotPr(repo: string, number: number): void {
+    this.transaction((db) => void db.prepare("DELETE FROM dependabot_dismissals WHERE repo = ? AND number = ?").run(repo.toLowerCase(), number));
+  }
+
+  /** Every dismissal, including snoozes that have ended; callers compare `snoozedUntil` with the time. */
+  listDependabotDismissals(): DependabotDismissal[] {
+    return this.withConnection((db) =>
+      (
+        db.prepare("SELECT repo, number, snoozed_until, created_at FROM dependabot_dismissals ORDER BY repo, number").all() as unknown as {
+          repo: string;
+          number: number;
+          snoozed_until: string | null;
+          created_at: string;
+        }[]
+      ).map((row) => ({ repo: row.repo, number: Number(row.number), snoozedUntil: row.snoozed_until, createdAt: row.created_at })),
+    );
+  }
+
   /**
    * Writes a consistent snapshot of the database to `destination` (SQLite `VACUUM INTO`), which is
    * safe to run while the web app is using the database. Never overwrites an existing file.
diff --git a/packages/core/src/planning/types.ts b/packages/core/src/planning/types.ts
index 025bf42..2107ab9 100644
--- a/packages/core/src/planning/types.ts
+++ b/packages/core/src/planning/types.ts
@@ -66,3 +66,16 @@ export interface Project {
   createdAt: string;
   updatedAt: string;
 }
+
+/**
+ * A Dependabot pull request the user has put aside. With `snoozedUntil` it comes back at that time; without it,
+ * it stays hidden until the pull request goes away.
+ */
+export interface DependabotDismissal {
+  /** Lowercased `owner/repo`. */
+  repo: string;
+  number: number;
+  /** ISO-8601 time the snooze ends, or null for "until closed". */
+  snoozedUntil: string | null;
+  createdAt: string;
+}
diff --git a/packages/core/test/dependabot-fixtures.ts b/packages/core/test/dependabot-fixtures.ts
new file mode 100644
index 0000000..35babd2
--- /dev/null
+++ b/packages/core/test/dependabot-fixtures.ts
@@ -0,0 +1,136 @@
+import {
+  parsePullRequest,
+  type DependabotBackend,
+  type DependabotPr,
+  type OwnerPulls,
+} from "../src/index.js";
+
+// Fixtures shaped like the GraphQL response of the search query in src/dependabot/github-backend.ts.
+
+export const checkRun = (name: string, status = "COMPLETED", conclusion: string | null = "SUCCESS") => ({
+  __typename: "CheckRun",
+  name,
+  status,
+  conclusion,
+});
+export const statusContext = (context: string, state: string) => ({ __typename: "StatusContext", context, state });
+export const rollup = (state: string, ...contexts: object[]) => ({ state, contexts: { nodes: contexts } });
+export const green = () => rollup("SUCCESS", checkRun("build"), checkRun("test"), statusContext("codecov/patch", "SUCCESS"));
+
+/** Dependabot's commit message, ending in the YAML block between `---` and `...`. */
+export function commitMessage(...updates: { name: string; type?: string | null }[]): string {
+  const items = updates.flatMap(({ name, type }) => [
+    `- dependency-name: ${name}`,
+    "  dependency-version: 6.29.1",
+    "  dependency-type: direct:production",
+    ...(type ? [`  update-type: version-update:semver-${type}`] : []),
+  ]);
+  return [
+    "build(deps): bump undici from 6.27.0 to 6.29.1",
+    "",
+    "Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.29.1.",
+    "",
+    "---",
+    "updated-dependencies:",
+    ...items,
+    "...",
+    "",
+    "Signed-off-by: dependabot[bot] <support@github.com>",
+  ].join("\n");
+}
+
+export interface NodeOptions {
+  number?: number;
+  repo?: string;
+  title?: string;
+  headRefName?: string;
+  isDraft?: boolean;
+  mergeable?: string;
+  mergeStateStatus?: string;
+  reviewDecision?: string | null;
+  labels?: string[];
+  commitCount?: number;
+  message?: string;
+  rollup?: object | null;
+}
+
+/** One element of `data.search.nodes`, clean and green unless an override says otherwise. */
+export function node(options: NodeOptions = {}): Record<string, unknown> {
+  const o = {
+    number: 41,
+    repo: "meddlin/gitlib",
+    title: "build(deps): bump undici from 6.27.0 to 6.29.1",
+    headRefName: "dependabot/npm_and_yarn/undici-6.29.1",
+    isDraft: false,
+    mergeable: "MERGEABLE",
+    mergeStateStatus: "CLEAN",
+    reviewDecision: null,
+    labels: ["dependencies", "javascript"],
+    commitCount: 1,
+    message: commitMessage({ name: "undici", type: "patch" }),
+    rollup: green() as object | null,
+    ...options,
+  };
+  return {
+    number: o.number,
+    title: o.title,
+    url: `https://github.com/${o.repo}/pull/${o.number}`,
+    createdAt: "2026-10-26T06:00:00Z",
+    updatedAt: "2026-10-30T06:00:00Z",
+    headRefName: o.headRefName,
+    isDraft: o.isDraft,
+    mergeable: o.mergeable,
+    mergeStateStatus: o.mergeStateStatus,
+    reviewDecision: o.reviewDecision,
+    author: { __typename: "Bot", login: "dependabot" },
+    repository: { nameWithOwner: o.repo },
+    labels: { nodes: o.labels.map((name) => ({ name })) },
+    commits: { totalCount: o.commitCount, nodes: [{ commit: { message: o.message, statusCheckRollup: o.rollup } }] },
+  };
+}
+
+export interface PageOptions {
+  nodes?: unknown[];
+  issueCount?: number;
+  hasNextPage?: boolean;
+  endCursor?: string | null;
+  cost?: number;
+  errors?: object[];
+}
+
+/** A whole GraphQL response body for one page of the search. */
+export function searchResponse(options: PageOptions = {}): Record<string, unknown> {
+  const nodes = options.nodes ?? [node()];
+  return {
+    data: {
+      rateLimit: { cost: options.cost ?? 1, remaining: 4990, resetAt: "2026-11-02T13:00:00Z" },
+      search: {
+        issueCount: options.issueCount ?? nodes.length,
+        pageInfo: { hasNextPage: options.hasNextPage ?? false, endCursor: options.endCursor ?? null },
+        nodes,
+      },
+    },
+    ...(options.errors ? { errors: options.errors } : {}),
+  };
+}
+
+/** A PR as the classifier sees it, parsed from a fixture node. */
+export const pr = (options: NodeOptions = {}): DependabotPr => {
+  const parsed = parsePullRequest(node(options));
+  if (!parsed) throw new Error("fixture did not parse");
+  return parsed;
+};
+
+/** Lets a test script what GitHub says per owner. */
+export class FakeBackend implements DependabotBackend {
+  readonly label = "fake";
+  calls: { owner: string; repoNames: string[] }[] = [];
+  constructor(private readonly byOwner: Record<string, Partial<OwnerPulls> | Error>) {}
+
+  async fetchOwner(owner: string, repoNames: readonly string[]): Promise<OwnerPulls> {
+    this.calls.push({ owner, repoNames: [...repoNames] });
+    const answer = this.byOwner[owner];
+    if (answer instanceof Error) throw answer;
+    return { owner, prs: [], truncated: false, unreachable: [], warnings: [], rateLimit: null, ...answer };
+  }
+}
diff --git a/packages/core/test/dependabot-store.test.ts b/packages/core/test/dependabot-store.test.ts
new file mode 100644
index 0000000..9eef7b3
--- /dev/null
+++ b/packages/core/test/dependabot-store.test.ts
@@ -0,0 +1,382 @@
+import fs from "node:fs";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  DependabotBusyError,
+  DependabotStore,
+  DependabotUnavailableError,
+  GitLibError,
+  KEEP_RUNS,
+  LATEST_SCHEMA_VERSION,
+  MIGRATIONS,
+  PlanningStore,
+  classify,
+  createApplication,
+  isDismissalActive,
+  splitDismissed,
+  type ClassifiedPr,
+  type DependabotReport,
+  type WatchedRepo,
+} from "../src/index.js";
+import { FakeBackend, commitMessage, pr } from "./dependabot-fixtures.js";
+import { Fixture } from "./fixture.js";
+
+let fx: Fixture;
+beforeEach(() => {
+  fx = new Fixture();
+});
+afterEach(() => fx.cleanup());
+
+const classified = (options: Parameters<typeof pr>[0] = {}): ClassifiedPr => {
+  const parsed = pr(options);
+  return { pr: parsed, ...classify(parsed) };
+};
+
+const watched = (slug: string, status: WatchedRepo["status"] = "checked", openPrs = 0): WatchedRepo => {
+  const [owner, repo] = slug.split("/") as [string, string];
+  return { ref: { owner, repo }, slug, paths: [repo], status, openPrs };
+};
+
+/** A report as `checkDependabot` would build it, with sensible empty parts. */
+function report(items: ClassifiedPr[], overrides: Partial<DependabotReport> = {}): DependabotReport {
+  return {
+    checkedAt: "2026-11-02T08:00:00.000Z",
+    watched: [watched("meddlin/gitlib", "checked", items.length)],
+    skipped: [],
+    items,
+    errors: [],
+    truncatedOwners: [],
+    warnings: [],
+    rateLimit: { cost: 2, remaining: 4998, resetAt: "2026-11-02T13:00:00Z" },
+    ...overrides,
+  };
+}
+
+const times = (n: number) => ({ trigger: "web" as const, startedAt: `2026-11-02T08:0${n}:00.000Z`, finishedAt: `2026-11-02T08:0${n}:05.000Z` });
+
+describe("DependabotStore runs", () => {
+  let store: DependabotStore;
+  beforeEach(() => {
+    store = new DependabotStore(path.join(fx.base, "nested", "gitlib.db"));
+  });
+
+  it("has nothing before the first run", () => {
+    expect(store.latestRun()).toBeNull();
+    expect(store.runCount()).toBe(0);
+  });
+
+  it("round-trips a report, its verdicts and where it came from", () => {
+    const items = [classified({ number: 1 }), classified({ number: 2, mergeStateStatus: "BEHIND" })];
+    const saved = store.saveRun(report(items, { warnings: ["careful"], truncatedOwners: ["meddlin"], skipped: [{ relativePath: "x", reason: "it has no git remote" }] }), times(1));
+
+    expect(saved).toMatchObject({ id: 1, trigger: "web", startedAt: "2026-11-02T08:01:00.000Z", finishedAt: "2026-11-02T08:01:05.000Z" });
+    expect(store.latestRun()).toEqual(saved);
+    expect(saved.report).toMatchObject({
+      checkedAt: "2026-11-02T08:00:00.000Z",
+      warnings: ["careful"],
+      truncatedOwners: ["meddlin"],
+      skipped: [{ relativePath: "x", reason: "it has no git remote" }],
+      rateLimit: { cost: 2, remaining: 4998, resetAt: "2026-11-02T13:00:00Z" },
+    });
+    expect(saved.report.watched[0]).toMatchObject({ slug: "meddlin/gitlib", status: "checked", openPrs: 2 });
+    // Verdicts come back whole, stamped with when GitHub was asked.
+    expect(saved.report.items).toHaveLength(2);
+    expect(saved.report.items[0]).toEqual({ ...items[0], observedAt: "2026-11-02T08:00:00.000Z" });
+    expect(saved.report.items[1]!.reasons).toEqual(["Behind the base branch."]);
+  });
+
+  it("returns the newest run and keeps the older ones apart", () => {
+    store.saveRun(report([classified({ number: 1 })]), times(1));
+    const second = store.saveRun(report([classified({ number: 2 }), classified({ number: 3 })], { checkedAt: "2026-11-02T08:02:00.000Z" }), times(2));
+    expect(store.latestRun()?.id).toBe(second.id);
+    expect(store.latestRun()?.report.items.map((item) => item.pr.number)).toEqual([2, 3]);
+    expect(store.runCount()).toBe(2);
+  });
+
+  it("orders findings by bucket, then repository, then number", () => {
+    const saved = store.saveRun(
+      report([
+        classified({ number: 9, mergeStateStatus: "BEHIND" }),
+        classified({ number: 5, repo: "zeta/z" }),
+        classified({ number: 7 }),
+        classified({ number: 3 }),
+      ]),
+      times(1),
+    );
+    expect(saved.report.items.map((item) => [item.bucket, item.pr.repo, item.pr.number])).toEqual([
+      ["ready", "meddlin/gitlib", 3],
+      ["ready", "meddlin/gitlib", 7],
+      ["ready", "zeta/z", 5],
+      ["needs-work", "meddlin/gitlib", 9],
+    ]);
+  });
+
+  describe("when an owner could not be asked", () => {
+    const watchedBoth = (bStatus: WatchedRepo["status"]) => [watched("aaa/a", "checked", 1), watched("bbb/b", bStatus, 0)];
+
+    it("carries that repository's last findings forward with their old observation time", () => {
+      store.saveRun(
+        report([classified({ repo: "aaa/a", number: 1 }), classified({ repo: "bbb/b", number: 2, mergeStateStatus: "BEHIND" })], {
+          watched: watchedBoth("checked"),
+          checkedAt: "2026-11-01T08:00:00.000Z",
+        }),
+        times(1),
+      );
+
+      const second = store.saveRun(
+        report([classified({ repo: "aaa/a", number: 1 })], { watched: watchedBoth("failed"), checkedAt: "2026-11-02T08:00:00.000Z", errors: [{ owner: "bbb", message: "down" }] }),
+        times(2),
+      );
+
+      expect(second.report.items.map((item) => [item.pr.repo, item.pr.number, item.observedAt])).toEqual([
+        ["aaa/a", 1, "2026-11-02T08:00:00.000Z"],
+        ["bbb/b", 2, "2026-11-01T08:00:00.000Z"],
+      ]);
+      expect(second.report.items[1]!.bucket).toBe("needs-work");
+
+      // And again: the original time sticks rather than moving to the run that merely copied it.
+      const third = store.saveRun(report([classified({ repo: "aaa/a", number: 1 })], { watched: watchedBoth("failed"), checkedAt: "2026-11-03T08:00:00.000Z" }), times(3));
+      expect(third.report.items.find((item) => item.pr.repo === "bbb/b")?.observedAt).toBe("2026-11-01T08:00:00.000Z");
+    });
+
+    it("does not carry anything forward for a repository that was asked and has no PRs now, or one the token cannot see", () => {
+      store.saveRun(report([classified({ repo: "bbb/b", number: 2 })], { watched: [watched("bbb/b", "checked", 1)] }), times(1));
+      const merged = store.saveRun(report([], { watched: [watched("bbb/b", "checked", 0)] }), times(2));
+      expect(merged.report.items).toEqual([]);
+
+      store.saveRun(report([classified({ repo: "bbb/b", number: 2 })], { watched: [watched("bbb/b", "checked", 1)] }), times(3));
+      const hidden = store.saveRun(report([], { watched: [watched("bbb/b", "unreachable", 0)] }), times(4));
+      expect(hidden.report.items).toEqual([]);
+    });
+  });
+
+  it("keeps only the newest runs", () => {
+    for (let i = 0; i < KEEP_RUNS + 3; i += 1) {
+      store.saveRun(report([classified({ number: i + 1 })]), { trigger: "schedule", startedAt: `t${i}`, finishedAt: `t${i}` });
+    }
+    expect(store.runCount()).toBe(KEEP_RUNS);
+    expect(store.latestRun()?.id).toBe(KEEP_RUNS + 3);
+    // The findings of deleted runs go with them.
+    const db = new (process.getBuiltinModule("node:sqlite").DatabaseSync)(store.dbPath);
+    expect((db.prepare("SELECT COUNT(DISTINCT run_id) AS n FROM dependabot_findings").get() as { n: number }).n).toBe(KEEP_RUNS);
+    db.close();
+  });
+
+  it("skips findings it cannot read and treats an unreadable summary as no run", () => {
+    store.saveRun(report([classified({ number: 1 }), classified({ number: 2 })]), times(1));
+    const { DatabaseSync } = process.getBuiltinModule("node:sqlite");
+    const db = new DatabaseSync(store.dbPath);
+    db.prepare("UPDATE dependabot_findings SET payload = 'not json' WHERE number = 2").run();
+    db.prepare("UPDATE dependabot_findings SET payload = '{\"pr\":{\"repo\":\"a/b\",\"number\":1},\"bucket\":\"sideways\",\"reasons\":[],\"actions\":[]}' WHERE number = 1").run();
+    db.close();
+    expect(store.latestRun()?.report.items).toEqual([]);
+
+    const damaged = new DatabaseSync(store.dbPath);
+    damaged.prepare("UPDATE dependabot_runs SET summary = '{'").run();
+    damaged.close();
+    expect(store.latestRun()).toBeNull();
+  });
+});
+
+describe("the lease", () => {
+  const T0 = new Date("2026-11-02T08:00:00Z");
+  const after = (ms: number) => new Date(T0.getTime() + ms);
+  let dbPath: string;
+  beforeEach(() => {
+    dbPath = path.join(fx.base, "gitlib.db");
+  });
+
+  it("is granted once, refused while held, and says who holds it", () => {
+    const first = new DependabotStore(dbPath);
+    const second = new DependabotStore(dbPath);
+
+    expect(first.acquireLease("web:1", T0, 60_000)).toEqual({ acquired: true });
+    const refused = second.acquireLease("cli:2", after(1_000), 60_000);
+    expect(refused).toEqual({ acquired: false, heldBy: { holder: "web:1", takenAt: T0.toISOString(), expiresAt: after(60_000).toISOString() } });
+    expect(second.currentLease(after(1_000))?.holder).toBe("web:1");
+  });
+
+  it("lapses, so a crashed holder cannot block checks forever", () => {
+    const store = new DependabotStore(dbPath);
+    store.acquireLease("web:1", T0, 60_000);
+    expect(store.currentLease(after(59_999))?.holder).toBe("web:1");
+    expect(store.currentLease(after(60_000))).toBeNull();
+    expect(store.acquireLease("cli:2", after(60_000), 60_000)).toEqual({ acquired: true });
+    expect(store.currentLease(after(61_000))?.holder).toBe("cli:2");
+  });
+
+  it("is released only by the holder", () => {
+    const store = new DependabotStore(dbPath);
+    store.acquireLease("web:1", T0, 60_000);
+    store.releaseLease("cli:2");
+    expect(store.currentLease(after(1))?.holder).toBe("web:1");
+    store.releaseLease("web:1");
+    expect(store.currentLease(after(1))).toBeNull();
+    expect(store.acquireLease("cli:2", after(2), 60_000)).toEqual({ acquired: true });
+  });
+
+  it("does not take a lease back that lapsed and was claimed by someone else", () => {
+    const store = new DependabotStore(dbPath);
+    store.acquireLease("web:1", T0, 1_000);
+    store.acquireLease("cli:2", after(2_000), 60_000);
+    store.releaseLease("web:1");
+    expect(store.currentLease(after(3_000))?.holder).toBe("cli:2");
+  });
+});
+
+describe("running a check", () => {
+  let repoCreated = false;
+  beforeEach(() => {
+    repoCreated = false;
+  });
+  /** A starred clone of meddlin/gitlib; calling it again gives another app over the same data. */
+  function setUp(backend: FakeBackend | null) {
+    if (!repoCreated) {
+      fx.writeConfig();
+      const repoPath = fx.initRealGitRepo("gitlib");
+      fx.git(repoPath, "remote", "add", "origin", "https://github.com/meddlin/gitlib.git");
+      repoCreated = true;
+    }
+    const app = createApplication(fx.env(), undefined, null, null, backend);
+    app.refresh();
+    app.saveRepositoryFavorite("gitlib", true);
+    return app;
+  }
+
+  it("saves the run with who started it, and lets go of the lock", async () => {
+    const backend = new FakeBackend({ meddlin: { prs: [pr({ number: 1 }), pr({ number: 2, message: commitMessage({ name: "x", type: "major" }) })] } });
+    const app = setUp(backend);
+
+    const run = await app.runDependabotCheck({ trigger: "schedule", now: new Date("2026-11-02T08:00:00Z") });
+
+    expect(run).toMatchObject({ id: 1, trigger: "schedule", startedAt: "2026-11-02T08:00:00.000Z" });
+    expect(run.report.items.map((item) => [item.pr.number, item.bucket])).toEqual([
+      [1, "ready"],
+      [2, "review-first"],
+    ]);
+    expect(app.latestDependabotRun()).toEqual(run);
+    expect(app.dependabotStore.currentLease(new Date())).toBeNull();
+  });
+
+  it("refuses to start while another check holds the lock, without asking GitHub", async () => {
+    const backend = new FakeBackend({ meddlin: {} });
+    const app = setUp(backend);
+    app.dependabotStore.acquireLease("web:4242", new Date(), 60_000);
+
+    const error = await app.runDependabotCheck({ trigger: "cli" }).catch((e: unknown) => e);
+
+    expect(error).toBeInstanceOf(DependabotBusyError);
+    expect(error).toBeInstanceOf(GitLibError);
+    expect((error as Error).message).toMatch(/already running \(started \S+ by web\)/);
+    expect(backend.calls).toEqual([]);
+    expect(app.latestDependabotRun()).toBeNull();
+  });
+
+  it("lets go of the lock when the check fails, and saves nothing", async () => {
+    const boom = new TypeError("a bug");
+    const app = setUp(new FakeBackend({ meddlin: boom }));
+    await expect(app.runDependabotCheck({ trigger: "web" })).rejects.toBe(boom);
+    expect(app.dependabotStore.currentLease(new Date())).toBeNull();
+    expect(app.latestDependabotRun()).toBeNull();
+
+    const noToken = setUp(null);
+    await expect(noToken.runDependabotCheck({ trigger: "web" })).rejects.toBeInstanceOf(DependabotUnavailableError);
+    expect(noToken.dependabotStore.currentLease(new Date())).toBeNull();
+  });
+
+  it("saves a run in which an owner failed, so the page can show what could not be checked", async () => {
+    const app = setUp(new FakeBackend({ meddlin: new DependabotUnavailableError("Could not reach GitHub") }));
+    const run = await app.runDependabotCheck({ trigger: "web" });
+    expect(run.report.errors).toEqual([{ owner: "meddlin", message: "Could not reach GitHub" }]);
+    expect(run.report.watched[0]!.status).toBe("failed");
+  });
+
+  it("uses the same database file as the scan data", () => {
+    const app = setUp(null);
+    expect(app.dependabotStore.dbPath).toBe(app.store.dbPath);
+    expect(fs.existsSync(app.store.dbPath)).toBe(true);
+  });
+});
+
+describe("dismissals", () => {
+  const NOW = new Date("2026-11-02T08:00:00Z");
+  const dismissal = (snoozedUntil: string | null, repo = "meddlin/gitlib", number = 1) => ({ repo, number, snoozedUntil, createdAt: "2026-11-01T00:00:00Z" });
+
+  describe("isDismissalActive", () => {
+    it("hides until closed when there is no end, and until the end otherwise", () => {
+      expect(isDismissalActive(dismissal(null), NOW)).toBe(true);
+      expect(isDismissalActive(dismissal("2026-11-02T08:00:01Z"), NOW)).toBe(true);
+      expect(isDismissalActive(dismissal("2026-11-02T08:00:00Z"), NOW)).toBe(false);
+      expect(isDismissalActive(dismissal("2026-11-01T08:00:00Z"), NOW)).toBe(false);
+    });
+  });
+
+  describe("splitDismissed", () => {
+    const items = [classified({ number: 1 }), classified({ number: 2 }), classified({ number: 3, repo: "other/thing" })];
+
+    it("separates what is put aside, matching the repository without regard to case", () => {
+      const { active, dismissed } = splitDismissed(items, [dismissal(null, "Meddlin/GitLib", 2)], NOW);
+      expect(active.map((item) => item.pr.number)).toEqual([1, 3]);
+      expect(dismissed.map((item) => [item.pr.number, item.dismissal.snoozedUntil])).toEqual([[2, null]]);
+    });
+
+    it("ignores ended snoozes, other repositories and other numbers", () => {
+      const { active, dismissed } = splitDismissed(
+        items,
+        [dismissal("2026-11-01T00:00:00Z", "meddlin/gitlib", 1), dismissal(null, "other/thing", 2), dismissal(null, "meddlin/gitlib", 99)],
+        NOW,
+      );
+      expect(dismissed).toEqual([]);
+      expect(active).toHaveLength(3);
+    });
+  });
+
+  describe("in planning.db", () => {
+    it("is stored, replaced, listed and removed", () => {
+      fx.writeConfig();
+      const app = createApplication(fx.env());
+
+      const first = app.dismissDependabotPr("Meddlin/GitLib", 7);
+      expect(first).toMatchObject({ repo: "meddlin/gitlib", number: 7, snoozedUntil: null });
+      app.dismissDependabotPr("meddlin/gitlib", 7, "2030-01-01T00:00:00Z");
+      app.dismissDependabotPr("zeta/z", 1);
+
+      expect(app.listDependabotDismissals().map((d) => [d.repo, d.number, d.snoozedUntil])).toEqual([
+        ["meddlin/gitlib", 7, "2030-01-01T00:00:00.000Z"],
+        ["zeta/z", 1, null],
+      ]);
+
+      app.restoreDependabotPr("MEDDLIN/gitlib", 7);
+      app.restoreDependabotPr("nobody/home", 1);
+      expect(app.listDependabotDismissals().map((d) => d.repo)).toEqual(["zeta/z"]);
+    });
+
+    it("refuses what is not a repository, a pull request number or a date", () => {
+      fx.writeConfig();
+      const app = createApplication(fx.env());
+      for (const repo of ["gitlib", "a/b/c", "bad owner/x", "/x", 'x/y"z']) {
+        expect(() => app.dismissDependabotPr(repo, 1)).toThrow(GitLibError);
+      }
+      expect(() => app.dismissDependabotPr("a/b", 0)).toThrow("not a pull request number");
+      expect(() => app.dismissDependabotPr("a/b", 1.5)).toThrow(GitLibError);
+      expect(() => app.dismissDependabotPr("a/b", 1, "tomorrow-ish")).toThrow("not a date");
+      expect(app.listDependabotDismissals()).toEqual([]);
+    });
+
+    it("arrives through an append-only migration that leaves older data alone", () => {
+      expect(MIGRATIONS[3]).toMatchObject({ version: 4, name: "dependabot dismissals" });
+      expect(LATEST_SCHEMA_VERSION).toBeGreaterThanOrEqual(4);
+
+      const planningDb = path.join(fx.base, "planning.db");
+      const old = new PlanningStore(planningDb, MIGRATIONS.slice(0, 3));
+      const issue = old.createIssue({ repoPath: "gitlib", title: "Keep me", body: "" }, "2026-11-01T00:00:00Z");
+      expect(old.schemaVersion()).toBe(3);
+
+      const upgraded = new PlanningStore(planningDb);
+      expect(upgraded.schemaVersion()).toBe(LATEST_SCHEMA_VERSION);
+      expect(upgraded.getIssue(issue.id)?.title).toBe("Keep me");
+      upgraded.dismissDependabotPr("a/b", 1, null, "2026-11-02T00:00:00Z");
+      expect(upgraded.listDependabotDismissals()).toHaveLength(1);
+    });
+  });
+});
diff --git a/packages/core/test/dependabot.test.ts b/packages/core/test/dependabot.test.ts
index 073f566..c5e7ba1 100644
--- a/packages/core/test/dependabot.test.ts
+++ b/packages/core/test/dependabot.test.ts
@@ -21,6 +21,7 @@ import {
   type OwnerPulls,
   type UpdateType,
 } from "../src/index.js";
+import { FakeBackend, checkRun, commitMessage, green, node, pr, rollup, searchResponse, statusContext, type NodeOptions } from "./dependabot-fixtures.js";
 import { Fixture } from "./fixture.js";
 
 let fx: Fixture;
@@ -29,122 +30,6 @@ beforeEach(() => {
 });
 afterEach(() => fx.cleanup());
 
-// --- Fixtures shaped like the GraphQL response of the search query in src/dependabot/github-backend.ts ---------------
-
-const checkRun = (name: string, status = "COMPLETED", conclusion: string | null = "SUCCESS") => ({
-  __typename: "CheckRun",
-  name,
-  status,
-  conclusion,
-});
-const statusContext = (context: string, state: string) => ({ __typename: "StatusContext", context, state });
-const rollup = (state: string, ...contexts: object[]) => ({ state, contexts: { nodes: contexts } });
-const green = () => rollup("SUCCESS", checkRun("build"), checkRun("test"), statusContext("codecov/patch", "SUCCESS"));
-
-/** Dependabot's commit message, ending in the YAML block between `---` and `...`. */
-function commitMessage(...updates: { name: string; type?: string | null }[]): string {
-  const items = updates.flatMap(({ name, type }) => [
-    `- dependency-name: ${name}`,
-    "  dependency-version: 6.29.1",
-    "  dependency-type: direct:production",
-    ...(type ? [`  update-type: version-update:semver-${type}`] : []),
-  ]);
-  return [
-    "build(deps): bump undici from 6.27.0 to 6.29.1",
-    "",
-    "Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.29.1.",
-    "",
-    "---",
-    "updated-dependencies:",
-    ...items,
-    "...",
-    "",
-    "Signed-off-by: dependabot[bot] <support@github.com>",
-  ].join("\n");
-}
-
-interface NodeOptions {
-  number?: number;
-  repo?: string;
-  title?: string;
-  headRefName?: string;
-  isDraft?: boolean;
-  mergeable?: string;
-  mergeStateStatus?: string;
-  reviewDecision?: string | null;
-  labels?: string[];
-  commitCount?: number;
-  message?: string;
-  rollup?: object | null;
-}
-
-/** One element of `data.search.nodes`, clean and green unless an override says otherwise. */
-function node(options: NodeOptions = {}): Record<string, unknown> {
-  const o = {
-    number: 41,
-    repo: "meddlin/gitlib",
-    title: "build(deps): bump undici from 6.27.0 to 6.29.1",
-    headRefName: "dependabot/npm_and_yarn/undici-6.29.1",
-    isDraft: false,
-    mergeable: "MERGEABLE",
-    mergeStateStatus: "CLEAN",
-    reviewDecision: null,
-    labels: ["dependencies", "javascript"],
-    commitCount: 1,
-    message: commitMessage({ name: "undici", type: "patch" }),
-    rollup: green() as object | null,
-    ...options,
-  };
-  return {
-    number: o.number,
-    title: o.title,
-    url: `https://github.com/${o.repo}/pull/${o.number}`,
-    createdAt: "2026-10-26T06:00:00Z",
-    updatedAt: "2026-10-30T06:00:00Z",
-    headRefName: o.headRefName,
-    isDraft: o.isDraft,
-    mergeable: o.mergeable,
-    mergeStateStatus: o.mergeStateStatus,
-    reviewDecision: o.reviewDecision,
-    author: { __typename: "Bot", login: "dependabot" },
-    repository: { nameWithOwner: o.repo },
-    labels: { nodes: o.labels.map((name) => ({ name })) },
-    commits: { totalCount: o.commitCount, nodes: [{ commit: { message: o.message, statusCheckRollup: o.rollup } }] },
-  };
-}
-
-interface PageOptions {
-  nodes?: unknown[];
-  issueCount?: number;
-  hasNextPage?: boolean;
-  endCursor?: string | null;
-  cost?: number;
-  errors?: object[];
-}
-
-/** A whole GraphQL response body for one page of the search. */
-function searchResponse(options: PageOptions = {}): Record<string, unknown> {
-  const nodes = options.nodes ?? [node()];
-  return {
-    data: {
-      rateLimit: { cost: options.cost ?? 1, remaining: 4990, resetAt: "2026-11-02T13:00:00Z" },
-      search: {
-        issueCount: options.issueCount ?? nodes.length,
-        pageInfo: { hasNextPage: options.hasNextPage ?? false, endCursor: options.endCursor ?? null },
-        nodes,
-      },
-    },
-    ...(options.errors ? { errors: options.errors } : {}),
-  };
-}
-
-/** A PR as the classifier sees it, parsed from a fixture node. */
-const pr = (options: NodeOptions = {}): DependabotPr => {
-  const parsed = parsePullRequest(node(options));
-  if (!parsed) throw new Error("fixture did not parse");
-  return parsed;
-};
-
 // --- Commit message and branch ---------------------------------------------------------------------------------
 
 describe("parseCommitMetadata", () => {
@@ -745,20 +630,6 @@ describe("resolveGitHubToken", () => {
 
 // --- Which repositories are watched ----------------------------------------------------------------------------
 
-/** Lets a test script what GitHub says per owner. */
-class FakeBackend implements DependabotBackend {
-  readonly label = "fake";
-  calls: { owner: string; repoNames: string[] }[] = [];
-  constructor(private readonly byOwner: Record<string, Partial<OwnerPulls> | Error>) {}
-
-  async fetchOwner(owner: string, repoNames: readonly string[]): Promise<OwnerPulls> {
-    this.calls.push({ owner, repoNames: [...repoNames] });
-    const answer = this.byOwner[owner];
-    if (answer instanceof Error) throw answer;
-    return { owner, prs: [], truncated: false, unreachable: [], warnings: [], rateLimit: null, ...answer };
-  }
-}
-
 describe("watching favorites", () => {
   function setUp(remotes: Record<string, string | null>) {
     fx.writeConfig();