@algosuite/vo-mcp 0.2.0-beta.60 → 0.2.0-beta.62

package/dist/runner-cli.js

@@ -636,6 +636,49 @@ var init_codex_mcp_config = __esm({
   }
 });
 
+// src/remote-mcp-entry.ts
+function remoteMcpOptIn(env2) {
+  return (env2["VO_REMOTE_MCP"] ?? "").trim() === "1";
+}
+function remoteMcpUrl(controlPlaneUrl2) {
+  return `${controlPlaneUrl2.trim().replace(/\/+$/, "")}${REMOTE_MCP_ENDPOINT_PATH}`;
+}
+function buildRemoteMcpEntry(controlPlaneUrl2) {
+  return {
+    type: "http",
+    url: remoteMcpUrl(controlPlaneUrl2),
+    headers: { Authorization: REMOTE_MCP_AUTH_HEADER }
+  };
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function isManagedRemoteMcpEntry(value) {
+  const entry = asRecord(value);
+  if (!entry) return false;
+  if (entry["type"] !== "http") return false;
+  const url = entry["url"];
+  if (typeof url !== "string" || !url.endsWith(REMOTE_MCP_ENDPOINT_PATH)) return false;
+  const headers = asRecord(entry["headers"]);
+  return headers?.["Authorization"] === REMOTE_MCP_AUTH_HEADER;
+}
+function remoteMcpEntryIsCurrent(value, desired) {
+  const entry = asRecord(value);
+  if (!entry) return false;
+  const headers = asRecord(entry["headers"]);
+  return entry["type"] === desired.type && entry["url"] === desired.url && headers?.["Authorization"] === desired.headers["Authorization"];
+}
+var REMOTE_MCP_SERVER_KEY, REMOTE_MCP_TOKEN_ENV, REMOTE_MCP_ENDPOINT_PATH, REMOTE_MCP_AUTH_HEADER;
+var init_remote_mcp_entry = __esm({
+  "src/remote-mcp-entry.ts"() {
+    "use strict";
+    REMOTE_MCP_SERVER_KEY = "vo-mcp-remote";
+    REMOTE_MCP_TOKEN_ENV = "VO_MCP_REMOTE_TOKEN";
+    REMOTE_MCP_ENDPOINT_PATH = "/api/v1/mcp";
+    REMOTE_MCP_AUTH_HEADER = `Bearer \${${REMOTE_MCP_TOKEN_ENV}}`;
+  }
+});
+
 // src/autostart.ts
 import { homedir as homedir4, platform as platform2 } from "node:os";
 import { isAbsolute as isAbsolute2, join as join5 } from "node:path";
@@ -913,7 +956,20 @@ function preferredNodeCommand(existing) {
 function resolveVoMcpCliPath() {
   return join6(dirname4(fileURLToPath(import.meta.url)), "cli.js");
 }
-function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label, launcher = { launcherPath: null, ...INSTALL_LAUNCHER }) {
+function reconcileRemoteEntry(mcpServers, remote) {
+  const existing = mcpServers[REMOTE_MCP_SERVER_KEY];
+  if (remote) {
+    return {
+      fragment: { [REMOTE_MCP_SERVER_KEY]: remote },
+      current: remoteMcpEntryIsCurrent(existing, remote)
+    };
+  }
+  if (existing !== void 0 && isManagedRemoteMcpEntry(existing)) {
+    return { fragment: { [REMOTE_MCP_SERVER_KEY]: void 0 }, current: false };
+  }
+  return { fragment: {}, current: true };
+}
+function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label, launcher = { launcherPath: null, ...INSTALL_LAUNCHER }, remote = null) {
   if (launcher.onlyExisting && !existsSync7(configPath)) return;
   const read = readClaudeConfig(configPath);
   if (read.kind === "invalid" || read.kind === "empty" && launcher.onlyExisting) {
@@ -927,8 +983,9 @@ function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label,
   const voEntry = managedEntry ?? mcpServers["vo"];
   const { launcherPath } = launcher;
   const fallbackCli = chooseFallbackCli(voEntry?.env?.[MCP_FALLBACK_CLI_ENV], cliPath, launcher.sticky, launcherPath ? dirname4(launcherPath) : null);
-  const current = launcherPath ? !isStaleVoMcpEntry(voEntry, launcherPath, fallbackCli) : Boolean(voEntry?.args?.some((a) => a.includes(cliPath)));
-  if (current) {
+  const localCurrent = launcherPath ? !isStaleVoMcpEntry(voEntry, launcherPath, fallbackCli) : Boolean(voEntry?.args?.some((a) => a.includes(cliPath)));
+  const remoteState = reconcileRemoteEntry(mcpServers, remote);
+  if (localCurrent && remoteState.current) {
     log2(`  ${label} already current: ${configPath}`);
     return;
   }
@@ -948,7 +1005,11 @@ function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label,
           ...preservedEnv,
           ...launcherPath && fallbackCli ? { [MCP_FALLBACK_CLI_ENV]: fallbackCli } : {}
         }
-      }
+      },
+      // Additive remote entry (11.3 slice A) — or the removal of one we wrote,
+      // when the operator has opted back out. Spread LAST so it can delete its
+      // own key; it never names 'vo-mcp', so the stdio entry above is safe.
+      ...remoteState.fragment
     }
   };
   if (readMtime !== null && (!existsSync7(configPath) || statSync3(configPath).mtimeMs !== readMtime)) {
@@ -957,6 +1018,12 @@ function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label,
   }
   writeClaudeConfig(configPath, merged);
   log2(`\u2713 Wrote vo-mcp to ${label}: ${configPath}`);
+  if (remote) {
+    log2(`  + remote MCP entry '${REMOTE_MCP_SERVER_KEY}' \u2192 ${remote.url} (serves vo_skill_list; every other tool stays on the local vo-mcp entry)`);
+    log2(`    Set ${REMOTE_MCP_TOKEN_ENV} in your environment to authenticate it \u2014 no token is written to this file.`);
+  } else if (!remoteState.current) {
+    log2(`  - removed the remote MCP entry '${REMOTE_MCP_SERVER_KEY}' (VO_REMOTE_MCP is not set to 1)`);
+  }
 }
 function installMcpConfig(log2, env2, mode = "install") {
   const home = env2["HOME"]?.trim() || env2["USERPROFILE"]?.trim() || homedir5();
@@ -964,6 +1031,7 @@ function installMcpConfig(log2, env2, mode = "install") {
   const plat = platform3();
   const cliPath = resolveVoMcpCliPath();
   const controlPlaneUrl2 = env2["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL2;
+  const remote = remoteMcpOptIn(env2) ? buildRemoteMcpEntry(controlPlaneUrl2) : null;
   const launcherPath = writeMcpLauncherForEnv(env2, log2, { platform: plat, home });
   const launcher = { launcherPath, ...mode === "heal" ? HEAL_LAUNCHER : INSTALL_LAUNCHER };
   const leg = (label, run) => {
@@ -974,8 +1042,8 @@ function installMcpConfig(log2, env2, mode = "install") {
       log2(`  \u26A0 ${label}: could not update the MCP registration \u2014 ${err instanceof Error ? err.message : String(err)}`);
     }
   };
-  leg("Claude Code CLI", () => installMcpConfigAt(resolveCodeConfigPath(home), cliPath, controlPlaneUrl2, log2, "Claude Code CLI", launcher));
-  leg("Claude Desktop", () => installMcpConfigAt(resolveDesktopConfigPath(home, plat, appData), cliPath, controlPlaneUrl2, log2, "Claude Desktop", launcher));
+  leg("Claude Code CLI", () => installMcpConfigAt(resolveCodeConfigPath(home), cliPath, controlPlaneUrl2, log2, "Claude Code CLI", launcher, remote));
+  leg("Claude Desktop", () => installMcpConfigAt(resolveDesktopConfigPath(home, plat, appData), cliPath, controlPlaneUrl2, log2, "Claude Desktop", launcher, remote));
   const codexPath = resolveCodexConfigPath(home);
   if (launcher.onlyExisting && !existsSync7(codexPath)) return;
   leg("Codex", () => {
@@ -1088,6 +1156,7 @@ var init_install = __esm({
     init_codex_mcp_config();
     init_mcp_launcher();
     init_config_backup();
+    init_remote_mcp_entry();
     init_autostart();
     DEFAULT_CONTROL_PLANE_URL2 = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
     INSTALL_LAUNCHER = { sticky: false, onlyExisting: false };
@@ -7284,18 +7353,49 @@ function publicationTitlePrompt(task = {}) {
   if (!original) return prompt;
   return original.split(/\n\n(?:Operator follow-up instructions|Treat these as task-scoped)/u)[0].trim() || prompt;
 }
+async function resolveInPlacePrMetadata(worktreeDir, prNumber, { note, env: env2, runFn } = {}) {
+  try {
+    const raw = await runFn("gh", ["pr", "view", String(prNumber), "--json", "title,body"], worktreeDir, { env: env2 });
+    const parsed = JSON.parse(String(raw || "{}"));
+    const title = String(parsed?.title || "").trim();
+    if (!title) return { editMetadata: false };
+    const kept = String(parsed?.body ?? "").split(IN_PLACE_REPAIR_NOTE_MARKER)[0].trimEnd();
+    const trailer = String(note || "").trim();
+    return {
+      editMetadata: true,
+      title,
+      body: trailer ? `${kept}
+
+${IN_PLACE_REPAIR_NOTE_MARKER}
+${trailer}` : kept
+    };
+  } catch {
+    return { editMetadata: false };
+  }
+}
 async function syncExistingPrAsync(worktreeDir, existing, options = {}) {
-  const { title, body, draft = false, demoteToDraft = false, env: env2, runFn } = options;
-  await editExistingPrMetadata(worktreeDir, existing.number, { title, body, env: env2, runFn });
-  const markedReady = !draft && existing.isDraft;
+  const {
+    title,
+    body,
+    draft = false,
+    demoteToDraft = false,
+    editMetadata = true,
+    preserveDraftState = false,
+    env: env2,
+    runFn
+  } = options;
+  if (editMetadata) await editExistingPrMetadata(worktreeDir, existing.number, { title, body, env: env2, runFn });
+  const markedReady = !preserveDraftState && !draft && existing.isDraft;
   if (markedReady) await markExistingPrReady(worktreeDir, existing.number, { env: env2, runFn });
   const demoted = draft && demoteToDraft && existing.isDraft === false;
   if (demoted) await demoteExistingPrToDraft(worktreeDir, existing.number, { env: env2, runFn });
   return { markedReady, demoted };
 }
+var IN_PLACE_REPAIR_NOTE_MARKER;
 var init_existing_pr_publication = __esm({
   "../../scripts/virtual-office/code-runner/existing-pr-publication.mjs"() {
     "use strict";
+    IN_PLACE_REPAIR_NOTE_MARKER = "<!-- vo-repair-in-place -->";
   }
 });
 
@@ -7932,194 +8032,43 @@ var init_process_runner2 = __esm({
   }
 });
 
-// ../../scripts/virtual-office/code-runner/partial-pr-continuation.mjs
-function partialPrContinuationResult(run = {}, maxLength = 2e3, reason = null) {
-  const summary = String(run.summary || "agent stopped before completing the task").trim();
-  const reasonMarker = reason === "rate_limited" ? `
-${RATE_LIMITED_CONTINUATION_MARKER}` : "";
-  return `${PARTIAL_PR_CONTINUATION_MARKER}${reasonMarker}
-${summary}`.slice(0, Math.max(0, maxLength));
-}
-var PARTIAL_PR_CONTINUATION_MARKER, RATE_LIMITED_CONTINUATION_MARKER;
-var init_partial_pr_continuation = __esm({
-  "../../scripts/virtual-office/code-runner/partial-pr-continuation.mjs"() {
-    "use strict";
-    PARTIAL_PR_CONTINUATION_MARKER = "ALGOSUITE_TASK_OUTCOME: NEEDS_CONTINUATION";
-    RATE_LIMITED_CONTINUATION_MARKER = "ALGOSUITE_CONTINUATION_REASON: RATE_LIMITED";
-  }
-});
-
-// ../../scripts/virtual-office/code-runner/publish-async.mjs
-function compactTitle(value, max = 100) {
-  return String(value || "").replace(/\s+/g, " ").trim().slice(0, max) || "code-task";
-}
-function gitRetryLog(op) {
-  return ({ attempt, delayMs, err }) => {
-    const why = String(err && err.message || err).replace(/\s+/g, " ").slice(0, 120);
-    console.error(`[publish] transient ${op} failure (attempt ${attempt}): ${why} \u2014 retrying in ${Math.round(delayMs / 1e3)}s`);
-  };
-}
-async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom, onRetry } = {}) {
-  let lastErr;
-  for (let i = 0; i < attempts; i += 1) {
-    try {
-      return await fn(i);
-    } catch (err) {
-      lastErr = err;
-      if (i >= attempts - 1 || !isTransientGitError(err)) throw err;
-      const delayMs = computeGitBackoffMs(i, { baseMs, capMs, rng });
-      if (typeof onRetry === "function") onRetry({ err, attempt: i + 1, delayMs });
-      await sleep(delayMs);
-    }
-  }
-  throw lastErr;
-}
-function defaultRunCommand(cmd, args, cwd, opts = {}) {
-  return runProcess2(cmd, args, { cwd, ...opts });
-}
-async function resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand = defaultRunCommand) {
-  let branch = "";
-  try {
-    branch = await runCommand("git", ["branch", "--show-current"], worktreeDir, { timeout: 3e4 });
-  } catch {
-  }
-  if (!branch || branch === "main" || branch === "HEAD") {
-    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    branch = `${branchPrefix}-${stamp}`;
-    await runCommand("git", ["checkout", "-b", branch], worktreeDir);
-  }
-  return branch;
-}
-async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null, log: log2 = (m) => console.warn(`[pr-overlap-gate] ${m}`) } = {}) {
-  const { scriptPath, trusted } = resolveOverlapScript({ worktreeDir });
-  const childEnv = trusted ? env2 : stripCredentials(env2);
-  if (!trusted) {
-    log2(`WARNING: trusted overlap script not found; running worktree copy ${scriptPath} with credentials stripped.`);
-  }
-  try {
-    const output = await runProcess2("node", [
-      scriptPath,
-      "--stdin",
-      ...branch ? ["--branch", String(branch)] : [],
-      ...excludePrNumber ? ["--exclude-pr", String(excludePrNumber)] : []
-    ], {
-      cwd: worktreeDir,
-      env: childEnv,
-      input: JSON.stringify([...new Set((files || []).map((file) => String(file || "").trim()).filter(Boolean))]),
-      timeout: 12e4
-    });
-    return { ok: true, output };
-  } catch (err) {
-    return {
-      ok: false,
-      status: err.status ?? 1,
-      output: `${err.stdout || ""}${err.stderr || ""}`.trim() || String(err.message || err)
-    };
-  }
-}
-async function maybeArmAutoMergeAsync({
-  worktreeDir,
-  prNumber,
-  githubToken,
-  armAutoMerge,
-  draft,
-  runCommand = defaultRunCommand
-}) {
-  if (!armAutoMerge || draft) return { autoMergeArmed: false };
-  try {
-    await runCommand("gh", autoMergeArgs(prNumber), worktreeDir, {
-      env: githubToken ? installationTokenEnv(githubToken) : void 0,
-      timeout: 6e4
-    });
-    return { autoMergeArmed: true };
-  } catch (err) {
-    return {
-      autoMergeArmed: false,
-      autoMergeError: err && err.message ? err.message : String(err)
-    };
-  }
-}
-async function listChangedFilesAsync(cwd, { runCommand = defaultRunCommand } = {}) {
-  const out = await runCommand("git", ["-c", "core.quotepath=false", "status", "--porcelain", "-z"], cwd, {
-    timeout: 6e4,
-    raw: true
-  });
-  return parsePorcelainZ(out);
-}
-async function listCommittedFilesAsync(cwd, base = "origin/main", { runCommand = defaultRunCommand } = {}) {
-  try {
-    await runCommand("git", ["fetch", "origin", "main"], cwd, { timeout: 6e4 });
-  } catch {
-  }
-  try {
-    const out = await runCommand(
-      "git",
-      ["-c", "core.quotepath=false", "diff", "--name-only", "-z", `${base}...HEAD`],
-      cwd,
-      { timeout: 6e4, raw: true }
-    );
-    return String(out).split("\0").map((item) => item.trim()).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-async function commitWorkLocallyAsync(worktreeDir, files, {
-  title,
-  branchPrefix = "vo/code-task",
-  botName = "vo-code-runner",
-  botEmail = "vo-code-runner@algosuite.ai",
-  runCommand = defaultRunCommand
-} = {}) {
-  const cleaned = (files || []).filter((file) => !isAgentScratch(file));
-  if (cleaned.length === 0) throw new Error("commitWorkLocallyAsync: only scratch files, nothing to commit");
-  await runCommand("git", ["config", "user.name", botName], worktreeDir);
-  await runCommand("git", ["config", "user.email", botEmail], worktreeDir);
-  const branch = await resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand);
-  for (let i = 0; i < cleaned.length; i += 100) {
-    await runCommand("git", ["add", "--", ...cleaned.slice(i, i + 100)], worktreeDir, { timeout: 12e4 });
-  }
-  if (await nothingStagedAsync(worktreeDir, runCommand)) return { branch, truncated: false, committed: false };
-  await runCommand("git", ["commit", "-m", compactTitle(title, 180)], worktreeDir);
-  return { branch, truncated: false, committed: true };
-}
-async function existingPrUrlAsync(worktreeDir, branch, githubToken = null, { runCommand = defaultRunCommand } = {}) {
-  try {
-    const out = await runCommand(
-      "gh",
-      ["pr", "list", "--head", branch, "--state", "open", "--json", "url,number,isDraft", "--limit", "1"],
-      worktreeDir,
-      { env: githubToken ? installationTokenEnv(githubToken) : void 0 }
-    );
-    const list = JSON.parse(out || "[]");
-    if (Array.isArray(list) && list[0] && list[0].url) {
-      return { url: String(list[0].url), number: Number(list[0].number), isDraft: Boolean(list[0].isDraft) };
-    }
-  } catch {
-  }
-  return null;
-}
-async function closeSupersededPrAsync(worktreeDir, prNumber, replacementUrl, githubToken = null, { runCommand = defaultRunCommand } = {}) {
-  if (!Number.isInteger(prNumber) || prNumber <= 0) return false;
-  if (!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+$/u.test(String(replacementUrl || ""))) return false;
+// ../../scripts/virtual-office/code-runner/superseded-pr-cleanup.mjs
+async function closeSupersededPrAsync(worktreeDir, prNumber, replacementUrl, githubToken = null, { runCommand = defaultRunCommand, expectedHeadSha = null } = {}) {
+  if (!Number.isInteger(prNumber) || prNumber <= 0) return { closed: false, reason: "invalid_pr_number" };
+  if (!REPLACEMENT_URL_RE.test(String(replacementUrl || ""))) return { closed: false, reason: "invalid_replacement_url" };
   const env2 = githubToken ? installationTokenEnv(githubToken) : void 0;
-  const raw = await runCommand("gh", ["pr", "view", String(prNumber), "--json", "state"], worktreeDir, { env: env2 });
-  const state = JSON.parse(raw || "{}")?.state;
-  if (state !== "OPEN") return false;
+  const raw = await runCommand("gh", ["pr", "view", String(prNumber), "--json", "state,headRefOid"], worktreeDir, { env: env2 });
+  const view = JSON.parse(raw || "{}");
+  if (view?.state !== "OPEN") return { closed: false, reason: "not_open" };
+  const liveHead = String(view?.headRefOid || "").trim().toLowerCase();
+  const derivedFrom = String(expectedHeadSha || "").trim().toLowerCase();
+  if (derivedFrom && liveHead && liveHead !== derivedFrom) {
+    return { closed: false, reason: "head_moved" };
+  }
+  const replacementNumber = String(replacementUrl).match(REPLACEMENT_URL_RE)[1];
   await runCommand(
     "gh",
-    ["pr", "close", String(prNumber), "--comment", `Superseded by ${replacementUrl}, rebuilt from current main by AlgoHQ repair.`],
+    [
+      "pr",
+      "close",
+      String(prNumber),
+      "--comment",
+      `Superseded by ${replacementUrl} (PR #${replacementNumber}), rebuilt from current main by AlgoHQ repair. Closed at publish time so this lineage keeps exactly one open PR.`
+    ],
     worktreeDir,
     { env: env2, timeout: 6e4 }
   );
-  return true;
+  return { closed: true, reason: null };
 }
 async function cleanupSupersededPrAsync({
   worktreeDir,
   supersedesPrNumber,
+  supersedesHeadSha = null,
   replacementUrl,
   replacementNumber,
   githubToken,
   runCommand,
+  retry = (fn) => fn(),
   onCleanupWarning
 }) {
   if (!supersedesPrNumber) return {};
@@ -8127,11 +8076,16 @@ async function cleanupSupersededPrAsync({
     return { supersededPrClosed: false };
   }
   try {
-    const closed = await retryTransientAsync(
-      () => closeSupersededPrAsync(worktreeDir, supersedesPrNumber, replacementUrl, githubToken, { runCommand }),
-      { onRetry: gitRetryLog("gh pr close superseded") }
+    const result = await retry(
+      () => closeSupersededPrAsync(worktreeDir, supersedesPrNumber, replacementUrl, githubToken, {
+        runCommand,
+        expectedHeadSha: supersedesHeadSha
+      })
     );
-    return { supersededPrClosed: closed };
+    return {
+      supersededPrClosed: result.closed,
+      ...result.closed ? {} : { supersededPrCloseSkipped: result.reason }
+    };
   } catch (err) {
     const message = err && err.message ? err.message : String(err);
     onCleanupWarning?.(
@@ -8140,56 +8094,651 @@ async function cleanupSupersededPrAsync({
     return { supersededPrClosed: false, supersededPrCloseError: message };
   }
 }
-async function pushBranchAsync(worktreeDir, branch, githubToken, { runCommand = defaultRunCommand, allowAmbientFallback = false, remoteBranch = branch } = {}) {
-  const pushRef = remoteBranch && remoteBranch !== branch ? `HEAD:refs/heads/${remoteBranch}` : branch;
-  const { primary, fallback } = pushPlan(pushRef, githubToken, { allowAmbientFallback });
-  try {
-    await runCommand("git", primary.args, worktreeDir, { env: primary.env });
-    return primary.tokenUsed;
-  } catch (err) {
-    if (!fallback) throw err;
-    await runCommand("git", fallback.args, worktreeDir, { env: fallback.env });
-    return fallback.tokenUsed;
+var defaultRunCommand, REPLACEMENT_URL_RE;
+var init_superseded_pr_cleanup = __esm({
+  "../../scripts/virtual-office/code-runner/superseded-pr-cleanup.mjs"() {
+    "use strict";
+    init_publish();
+    init_process_runner2();
+    defaultRunCommand = (cmd, args, cwd, opts = {}) => runProcess2(cmd, args, { cwd, ...opts });
+    REPLACEMENT_URL_RE = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/(\d+)$/u;
   }
+});
+
+// ../../scripts/virtual-office/code-runner/github-git-auth-env.mjs
+function githubGitAuthEnv2(githubToken) {
+  if (!githubToken) return void 0;
+  const credentials = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+  return {
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${credentials}`
+  };
 }
-async function openCodeTaskPrAsync(worktreeDir, files, {
-  title,
-  body,
-  branchPrefix = "vo/code-task",
-  botName = "vo-code-runner",
-  botEmail = "vo-code-runner@algosuite.ai",
-  alreadyCommitted = false,
-  githubToken = null,
-  allowAmbientGithubFallback = false,
-  draft = false,
-  armAutoMerge = false,
-  targetBranch = null,
-  targetPrNumber = null,
-  supersedesPrNumber = null,
-  deferSupersededPrCleanup = false,
-  onCleanupWarning = console.error,
-  runCommand = defaultRunCommand,
-  runOverlapGate = runLocalPrOverlapGateAsync
-} = {}) {
-  if (!Array.isArray(files) || files.length === 0) throw new Error("openCodeTaskPrAsync: no files to commit");
-  let branch;
-  let truncated = false;
-  let newCommit = null;
-  if (alreadyCommitted) {
-    branch = await resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand);
-  } else {
-    const committed = await commitWorkLocallyAsync(worktreeDir, files, {
-      title,
-      branchPrefix,
-      botName,
-      botEmail,
-      runCommand
-    });
-    branch = committed.branch;
-    truncated = committed.truncated;
-    newCommit = committed.committed;
+var init_github_git_auth_env = __esm({
+  "../../scripts/virtual-office/code-runner/github-git-auth-env.mjs"() {
+    "use strict";
   }
-  const prBranch = String(targetBranch || branch).trim() || branch;
+});
+
+// ../../scripts/virtual-office/code-runner/resume-branch.mjs
+function compactBranchSegment(value) {
+  return String(value || "").trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "resume";
+}
+function defaultRunCommand2(cmd, args, cwd, opts = {}) {
+  return runProcess2(cmd, args, { cwd, ...opts });
+}
+function buildResumeLocalBranchName(remoteBranch, {
+  now = () => /* @__PURE__ */ new Date(),
+  pid = process.pid,
+  random = secureUnitRandom
+} = {}) {
+  const stamp = now().toISOString().replace(/[:.]/g, "-");
+  const unique = `${pid}-${random().toString(36).slice(2, 8)}`;
+  return `vo/resume-${compactBranchSegment(remoteBranch)}-${stamp}-${unique}`;
+}
+async function assertBranchName(worktreeDir, branch, { env: env2, runCommand = defaultRunCommand2 } = {}) {
+  const candidate = String(branch || "").trim();
+  if (!candidate) throw new Error("resume branch is required");
+  await runCommand("git", ["check-ref-format", "--branch", candidate], worktreeDir, {
+    env: env2,
+    timeout: 3e4
+  });
+  return candidate;
+}
+async function restoreContinuationBranch(worktreeDir, remoteBranch, {
+  env: env2,
+  runCommand = defaultRunCommand2,
+  localBranchName
+} = {}) {
+  const branch = await assertBranchName(worktreeDir, remoteBranch, { env: env2, runCommand });
+  const localBranch = await assertBranchName(
+    worktreeDir,
+    localBranchName || buildResumeLocalBranchName(branch),
+    { env: env2, runCommand }
+  );
+  await runCommand(
+    "git",
+    ["fetch", "origin", `${branch}:refs/remotes/origin/${branch}`],
+    worktreeDir,
+    { env: env2, timeout: 12e4 }
+  );
+  await runCommand("git", ["checkout", "-b", localBranch, `origin/${branch}`], worktreeDir, {
+    env: env2,
+    timeout: 6e4
+  });
+  return { localBranch, remoteBranch: branch };
+}
+function parseHeadRefName(output) {
+  const parsed = JSON.parse(String(output || "{}"));
+  const branch = String(parsed?.headRefName || "").trim();
+  return branch || null;
+}
+async function resolvePrHeadBranch(worktreeDir, {
+  repo,
+  prNumber,
+  githubToken = null,
+  allowAmbientGithubFallback = false,
+  runCommand = defaultRunCommand2
+} = {}) {
+  if (!repo || !Number.isInteger(prNumber) || prNumber <= 0) return null;
+  const args = ["pr", "view", String(prNumber), "-R", String(repo), "--json", "headRefName"];
+  try {
+    const output = await runCommand("gh", args, worktreeDir, {
+      env: githubToken ? installationTokenEnv(githubToken) : void 0,
+      timeout: 6e4
+    });
+    return parseHeadRefName(output);
+  } catch (error) {
+    if (!githubToken || !allowAmbientGithubFallback) throw error;
+  }
+  const fallback = await runCommand("gh", args, worktreeDir, { timeout: 6e4 });
+  return parseHeadRefName(fallback);
+}
+async function prepareContinuationBranch(worktreeDir, {
+  task,
+  parentTask,
+  githubToken = null,
+  allowAmbientGithubFallback = false,
+  runCommand = defaultRunCommand2
+} = {}) {
+  const continuationBranch = task?.pr_branch || parentTask?.pr_branch || (parentTask?.pr_number ? await resolvePrHeadBranch(worktreeDir, {
+    repo: task?.repo,
+    prNumber: parentTask.pr_number,
+    githubToken,
+    allowAmbientGithubFallback,
+    runCommand
+  }) : null);
+  if (!continuationBranch && (task?.pr_branch || parentTask?.pr_url || parentTask?.pr_number)) {
+    throw new Error(`continuation PR branch could not be resolved for task ${task?.code_task_id || "unknown"}`);
+  }
+  if (!continuationBranch) return null;
+  return restoreContinuationBranch(worktreeDir, continuationBranch, {
+    env: githubToken ? installationTokenEnv(githubToken) : void 0,
+    runCommand
+  });
+}
+var init_resume_branch = __esm({
+  "../../scripts/virtual-office/code-runner/resume-branch.mjs"() {
+    "use strict";
+    init_publish();
+    init_process_runner2();
+    init_secure_random();
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/repair-source-materialization.mjs
+function assertRepairSource({ repo, prNumber, headSha }) {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(String(repo || ""))) {
+    throw new Error("repair source repository is invalid");
+  }
+  if (!Number.isInteger(prNumber) || prNumber < 1) {
+    throw new Error("repair source PR number is invalid");
+  }
+  if (!/^[0-9a-f]{40}$/u.test(String(headSha || "").toLowerCase())) {
+    throw new Error("repair source head SHA is missing or invalid");
+  }
+}
+function defaultRun(command, args, cwd, options = {}) {
+  const env2 = options.env ? { ...process.env, ...options.env } : process.env;
+  return runProcess2(command, args, { cwd, ...options, env: env2 });
+}
+async function materializeRepairSource(worktreeDir, {
+  repo,
+  prNumber,
+  headSha,
+  githubToken = null,
+  runCommand = defaultRun
+} = {}) {
+  assertRepairSource({ repo, prNumber, headSha });
+  const expectedHead = headSha.toLowerCase();
+  const sourceRef = `refs/vo/repairs/${expectedHead}`;
+  const env2 = githubToken ? githubGitAuthEnv2(githubToken) : void 0;
+  await runCommand(
+    "git",
+    ["fetch", "origin", `+refs/pull/${prNumber}/head:${sourceRef}`],
+    worktreeDir,
+    { env: env2, timeout: 12e4 }
+  );
+  const fetchedHead = String(await runCommand(
+    "git",
+    ["rev-parse", sourceRef],
+    worktreeDir,
+    { env: env2, timeout: 3e4 }
+  )).trim().toLowerCase();
+  if (fetchedHead !== expectedHead) {
+    throw new Error(`repair source head changed: admitted ${expectedHead}, fetched ${fetchedHead || "none"}`);
+  }
+  let conflicted = false;
+  try {
+    await runCommand(
+      "git",
+      ["merge", "--squash", "--no-commit", sourceRef],
+      worktreeDir,
+      { env: env2, timeout: 12e4 }
+    );
+  } catch (error) {
+    const conflicts = String(await runCommand(
+      "git",
+      ["diff", "--name-only", "--diff-filter=U"],
+      worktreeDir,
+      { env: env2, timeout: 3e4 }
+    )).trim();
+    if (!conflicts) throw error;
+    conflicted = true;
+  }
+  const status = String(await runCommand(
+    "git",
+    ["status", "--porcelain"],
+    worktreeDir,
+    { env: env2, timeout: 3e4 }
+  )).trim();
+  if (!status) {
+    throw new Error(`repair source ${repo}#${prNumber}@${expectedHead} produced no changes on current main`);
+  }
+  return { sourceRef, headSha: expectedHead, conflicted };
+}
+var init_repair_source_materialization = __esm({
+  "../../scripts/virtual-office/code-runner/repair-source-materialization.mjs"() {
+    "use strict";
+    init_process_runner2();
+    init_github_git_auth_env();
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/repair-publication-strategy.mjs
+function isPushRejection(error) {
+  if (!error) return false;
+  const text = `${error.message || ""} ${error.stderr || ""} ${error.stdout || ""}`;
+  return PUSH_REJECTION_RE.test(text);
+}
+function defaultRun2(command, args, cwd, options = {}) {
+  return runProcess2(command, args, { cwd, ...options });
+}
+function decideRepairStrategy({
+  headBranch,
+  prState,
+  isCrossRepository = false,
+  admittedHeadSha = null,
+  liveHeadSha = null,
+  branchFetched = true,
+  behindCount = null,
+  maxBehindCommits = DEFAULT_MAX_BEHIND_COMMITS,
+  inPlaceEnabled = true
+} = {}) {
+  const supersede = (reason) => ({ strategy: "supersede", reason });
+  if (!inPlaceEnabled) return supersede(SUPERSEDE_REASONS.disabled);
+  if (!String(headBranch || "").trim()) return supersede(SUPERSEDE_REASONS.branchUnresolved);
+  if (prState && String(prState).toUpperCase() !== "OPEN") return supersede(SUPERSEDE_REASONS.predecessorNotOpen);
+  if (isCrossRepository) return supersede(SUPERSEDE_REASONS.crossForkHead);
+  if (admittedHeadSha && liveHeadSha && String(liveHeadSha).toLowerCase() !== String(admittedHeadSha).toLowerCase()) {
+    return supersede(SUPERSEDE_REASONS.headMoved);
+  }
+  if (branchFetched === false) return supersede(SUPERSEDE_REASONS.branchDeleted);
+  if (Number.isInteger(behindCount) && Number.isInteger(maxBehindCommits) && behindCount > maxBehindCommits) {
+    return supersede(SUPERSEDE_REASONS.baseDiverged);
+  }
+  return { strategy: "in-place", reason: null };
+}
+async function viewRepairPr(worktreeDir, { repo, prNumber, env: env2, runCommand }) {
+  try {
+    const raw = await runCommand("gh", [
+      "pr",
+      "view",
+      String(prNumber),
+      "-R",
+      String(repo),
+      "--json",
+      "headRefName,headRefOid,isCrossRepository,state"
+    ], worktreeDir, { env: env2, timeout: 6e4 });
+    const parsed = JSON.parse(String(raw || "{}"));
+    return {
+      headBranch: String(parsed.headRefName || "").trim(),
+      liveHeadSha: String(parsed.headRefOid || "").trim().toLowerCase() || null,
+      isCrossRepository: Boolean(parsed.isCrossRepository),
+      prState: String(parsed.state || "").trim() || null
+    };
+  } catch {
+    return { headBranch: "", liveHeadSha: null, isCrossRepository: false, prState: null };
+  }
+}
+async function probeRepairBranch(worktreeDir, { headBranch, env: env2, runCommand }) {
+  try {
+    await runCommand("git", ["check-ref-format", "--branch", headBranch], worktreeDir, { env: env2, timeout: 3e4 });
+    await runCommand(
+      "git",
+      ["fetch", "origin", `+refs/heads/${headBranch}:refs/remotes/origin/${headBranch}`],
+      worktreeDir,
+      { env: env2, timeout: 12e4 }
+    );
+  } catch {
+    return { branchFetched: false, fetchedHeadSha: null, behindCount: null };
+  }
+  const fetchedHeadSha = String(await runCommand(
+    "git",
+    ["rev-parse", `refs/remotes/origin/${headBranch}`],
+    worktreeDir,
+    { env: env2, timeout: 3e4 }
+  ) || "").trim().toLowerCase() || null;
+  let behindCount = null;
+  try {
+    const raw = await runCommand(
+      "git",
+      ["rev-list", "--count", `refs/remotes/origin/${headBranch}..origin/main`],
+      worktreeDir,
+      { env: env2, timeout: 6e4 }
+    );
+    const parsed = Number.parseInt(String(raw || "").trim(), 10);
+    if (Number.isInteger(parsed)) behindCount = parsed;
+  } catch {
+  }
+  return { branchFetched: true, fetchedHeadSha, behindCount };
+}
+async function planRepairPublication(worktreeDir, {
+  repo,
+  prNumber,
+  headSha,
+  githubToken = null,
+  env: env2 = process.env,
+  maxBehindCommits = DEFAULT_MAX_BEHIND_COMMITS,
+  runCommand = defaultRun2,
+  materializeSource = materializeRepairSource,
+  log: log2 = () => {
+  }
+} = {}) {
+  if (!Number.isInteger(prNumber) || prNumber <= 0) {
+    throw new Error("structured repair PR target is invalid; refusing publication");
+  }
+  const ghEnv = githubToken ? installationTokenEnv(githubToken) : void 0;
+  const gitEnv = githubToken ? githubGitAuthEnv2(githubToken) : void 0;
+  const admittedHeadSha = String(headSha || "").trim().toLowerCase() || null;
+  const inPlaceEnabled = String(env2?.[REPAIR_IN_PLACE_ENV] ?? "1") !== "0";
+  const view = await viewRepairPr(worktreeDir, { repo, prNumber, env: ghEnv, runCommand });
+  let decision = decideRepairStrategy({ ...view, admittedHeadSha, inPlaceEnabled, maxBehindCommits });
+  let probe = { branchFetched: true, fetchedHeadSha: null, behindCount: null };
+  if (decision.strategy === "in-place") {
+    probe = await probeRepairBranch(worktreeDir, { headBranch: view.headBranch, env: gitEnv, runCommand });
+    decision = decideRepairStrategy({
+      ...view,
+      ...probe,
+      admittedHeadSha,
+      inPlaceEnabled,
+      maxBehindCommits,
+      // The fetched tip is the authoritative head; `gh` can lag a force-push.
+      liveHeadSha: probe.fetchedHeadSha || view.liveHeadSha
+    });
+  }
+  if (decision.strategy === "supersede") {
+    log2(`repair PR #${prNumber}: in-place impossible (${decision.reason}) \u2014 superseding from current main`);
+    const source = await materializeSource(worktreeDir, { repo, prNumber, headSha, githubToken, runCommand });
+    return { strategy: "supersede", reason: decision.reason, prNumber, headSha: source.headSha, conflicted: source.conflicted };
+  }
+  const localBranch = buildResumeLocalBranchName(view.headBranch);
+  await runCommand("git", ["check-ref-format", "--branch", localBranch], worktreeDir, { env: gitEnv, timeout: 3e4 });
+  await runCommand(
+    "git",
+    ["checkout", "-b", localBranch, `refs/remotes/origin/${view.headBranch}`],
+    worktreeDir,
+    { env: gitEnv, timeout: 6e4 }
+  );
+  log2(`repair PR #${prNumber}: repairing IN PLACE on its own branch ${view.headBranch} (local ${localBranch})`);
+  return {
+    strategy: "in-place",
+    reason: null,
+    prNumber,
+    remoteBranch: view.headBranch,
+    localBranch,
+    headSha: probe.fetchedHeadSha || admittedHeadSha
+  };
+}
+async function pushWithInPlaceFallback({
+  worktreeDir,
+  branch,
+  remoteBranch,
+  githubToken,
+  allowAmbientFallback = false,
+  supersedeFallback = false,
+  push,
+  retry,
+  onFallback = () => {
+  }
+}) {
+  const target = String(remoteBranch || branch);
+  try {
+    const tokenUsed = await retry(() => push(worktreeDir, branch, githubToken, { allowAmbientFallback, remoteBranch: target }));
+    return { tokenUsed, remoteBranch: target, fallbackReason: null };
+  } catch (error) {
+    if (!supersedeFallback || target === branch || !isPushRejection(error)) throw error;
+    onFallback(error);
+    const tokenUsed = await retry(() => push(worktreeDir, branch, githubToken, { allowAmbientFallback, remoteBranch: branch }));
+    return { tokenUsed, remoteBranch: branch, fallbackReason: SUPERSEDE_REASONS.pushRejected };
+  }
+}
+var REPAIR_IN_PLACE_ENV, DEFAULT_MAX_BEHIND_COMMITS, SUPERSEDE_REASONS, PUSH_REJECTION_RE;
+var init_repair_publication_strategy = __esm({
+  "../../scripts/virtual-office/code-runner/repair-publication-strategy.mjs"() {
+    "use strict";
+    init_process_runner2();
+    init_publish();
+    init_github_git_auth_env();
+    init_resume_branch();
+    init_repair_source_materialization();
+    REPAIR_IN_PLACE_ENV = "VO_CODE_RUNNER_REPAIR_IN_PLACE";
+    DEFAULT_MAX_BEHIND_COMMITS = 20;
+    SUPERSEDE_REASONS = Object.freeze({
+      branchUnresolved: "branch_unresolved",
+      predecessorNotOpen: "predecessor_not_open",
+      crossForkHead: "cross_fork_head",
+      headMoved: "head_moved",
+      branchDeleted: "branch_deleted",
+      baseDiverged: "base_diverged",
+      pushRejected: "push_rejected",
+      disabled: "in_place_disabled"
+    });
+    PUSH_REJECTION_RE = new RegExp([
+      "\\[rejected\\]",
+      "non-fast-forward",
+      "fetch first",
+      "updates were rejected",
+      "protected branch",
+      "pre-receive hook declined",
+      "remote rejected",
+      "permission to [^\\s]+ denied",
+      "write access to repository not granted",
+      "refusing to allow",
+      "the requested url returned error: 40[13]"
+    ].join("|"), "iu");
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/partial-pr-continuation.mjs
+function partialPrContinuationResult(run = {}, maxLength = 2e3, reason = null) {
+  const summary = String(run.summary || "agent stopped before completing the task").trim();
+  const reasonMarker = reason === "rate_limited" ? `
+${RATE_LIMITED_CONTINUATION_MARKER}` : "";
+  return `${PARTIAL_PR_CONTINUATION_MARKER}${reasonMarker}
+${summary}`.slice(0, Math.max(0, maxLength));
+}
+var PARTIAL_PR_CONTINUATION_MARKER, RATE_LIMITED_CONTINUATION_MARKER;
+var init_partial_pr_continuation = __esm({
+  "../../scripts/virtual-office/code-runner/partial-pr-continuation.mjs"() {
+    "use strict";
+    PARTIAL_PR_CONTINUATION_MARKER = "ALGOSUITE_TASK_OUTCOME: NEEDS_CONTINUATION";
+    RATE_LIMITED_CONTINUATION_MARKER = "ALGOSUITE_CONTINUATION_REASON: RATE_LIMITED";
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/publish-async.mjs
+function compactTitle(value, max = 100) {
+  return String(value || "").replace(/\s+/g, " ").trim().slice(0, max) || "code-task";
+}
+function gitRetryLog(op) {
+  return ({ attempt, delayMs, err }) => {
+    const why = String(err && err.message || err).replace(/\s+/g, " ").slice(0, 120);
+    console.error(`[publish] transient ${op} failure (attempt ${attempt}): ${why} \u2014 retrying in ${Math.round(delayMs / 1e3)}s`);
+  };
+}
+async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom, onRetry } = {}) {
+  let lastErr;
+  for (let i = 0; i < attempts; i += 1) {
+    try {
+      return await fn(i);
+    } catch (err) {
+      lastErr = err;
+      if (i >= attempts - 1 || !isTransientGitError(err)) throw err;
+      const delayMs = computeGitBackoffMs(i, { baseMs, capMs, rng });
+      if (typeof onRetry === "function") onRetry({ err, attempt: i + 1, delayMs });
+      await sleep(delayMs);
+    }
+  }
+  throw lastErr;
+}
+function defaultRunCommand3(cmd, args, cwd, opts = {}) {
+  return runProcess2(cmd, args, { cwd, ...opts });
+}
+async function resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand = defaultRunCommand3) {
+  let branch = "";
+  try {
+    branch = await runCommand("git", ["branch", "--show-current"], worktreeDir, { timeout: 3e4 });
+  } catch {
+  }
+  if (!branch || branch === "main" || branch === "HEAD") {
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    branch = `${branchPrefix}-${stamp}`;
+    await runCommand("git", ["checkout", "-b", branch], worktreeDir);
+  }
+  return branch;
+}
+async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null, log: log2 = (m) => console.warn(`[pr-overlap-gate] ${m}`) } = {}) {
+  const { scriptPath, trusted } = resolveOverlapScript({ worktreeDir });
+  const childEnv = trusted ? env2 : stripCredentials(env2);
+  if (!trusted) {
+    log2(`WARNING: trusted overlap script not found; running worktree copy ${scriptPath} with credentials stripped.`);
+  }
+  try {
+    const output = await runProcess2("node", [
+      scriptPath,
+      "--stdin",
+      ...branch ? ["--branch", String(branch)] : [],
+      ...excludePrNumber ? ["--exclude-pr", String(excludePrNumber)] : []
+    ], {
+      cwd: worktreeDir,
+      env: childEnv,
+      input: JSON.stringify([...new Set((files || []).map((file) => String(file || "").trim()).filter(Boolean))]),
+      timeout: 12e4
+    });
+    return { ok: true, output };
+  } catch (err) {
+    return {
+      ok: false,
+      status: err.status ?? 1,
+      output: `${err.stdout || ""}${err.stderr || ""}`.trim() || String(err.message || err)
+    };
+  }
+}
+async function maybeArmAutoMergeAsync({
+  worktreeDir,
+  prNumber,
+  githubToken,
+  armAutoMerge,
+  draft,
+  runCommand = defaultRunCommand3
+}) {
+  if (!armAutoMerge || draft) return { autoMergeArmed: false };
+  try {
+    await runCommand("gh", autoMergeArgs(prNumber), worktreeDir, {
+      env: githubToken ? installationTokenEnv(githubToken) : void 0,
+      timeout: 6e4
+    });
+    return { autoMergeArmed: true };
+  } catch (err) {
+    return {
+      autoMergeArmed: false,
+      autoMergeError: err && err.message ? err.message : String(err)
+    };
+  }
+}
+async function listChangedFilesAsync(cwd, { runCommand = defaultRunCommand3 } = {}) {
+  const out = await runCommand("git", ["-c", "core.quotepath=false", "status", "--porcelain", "-z"], cwd, {
+    timeout: 6e4,
+    raw: true
+  });
+  return parsePorcelainZ(out);
+}
+async function listCommittedFilesAsync(cwd, base = "origin/main", { runCommand = defaultRunCommand3 } = {}) {
+  try {
+    await runCommand("git", ["fetch", "origin", "main"], cwd, { timeout: 6e4 });
+  } catch {
+  }
+  try {
+    const out = await runCommand(
+      "git",
+      ["-c", "core.quotepath=false", "diff", "--name-only", "-z", `${base}...HEAD`],
+      cwd,
+      { timeout: 6e4, raw: true }
+    );
+    return String(out).split("\0").map((item) => item.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function commitWorkLocallyAsync(worktreeDir, files, {
+  title,
+  branchPrefix = "vo/code-task",
+  botName = "vo-code-runner",
+  botEmail = "vo-code-runner@algosuite.ai",
+  runCommand = defaultRunCommand3
+} = {}) {
+  const cleaned = (files || []).filter((file) => !isAgentScratch(file));
+  if (cleaned.length === 0) throw new Error("commitWorkLocallyAsync: only scratch files, nothing to commit");
+  await runCommand("git", ["config", "user.name", botName], worktreeDir);
+  await runCommand("git", ["config", "user.email", botEmail], worktreeDir);
+  const branch = await resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand);
+  for (let i = 0; i < cleaned.length; i += 100) {
+    await runCommand("git", ["add", "--", ...cleaned.slice(i, i + 100)], worktreeDir, { timeout: 12e4 });
+  }
+  if (await nothingStagedAsync(worktreeDir, runCommand)) return { branch, truncated: false, committed: false };
+  await runCommand("git", ["commit", "-m", compactTitle(title, 180)], worktreeDir);
+  return { branch, truncated: false, committed: true };
+}
+async function existingPrUrlAsync(worktreeDir, branch, githubToken = null, { runCommand = defaultRunCommand3 } = {}) {
+  try {
+    const out = await runCommand(
+      "gh",
+      ["pr", "list", "--head", branch, "--state", "open", "--json", "url,number,isDraft", "--limit", "1"],
+      worktreeDir,
+      { env: githubToken ? installationTokenEnv(githubToken) : void 0 }
+    );
+    const list = JSON.parse(out || "[]");
+    if (Array.isArray(list) && list[0] && list[0].url) {
+      return { url: String(list[0].url), number: Number(list[0].number), isDraft: Boolean(list[0].isDraft) };
+    }
+  } catch {
+  }
+  return null;
+}
+function cleanupSuperseded(options) {
+  return cleanupSupersededPrAsync({
+    ...options,
+    retry: (fn) => retryTransientAsync(fn, { onRetry: gitRetryLog("gh pr close superseded") })
+  });
+}
+async function pushBranchAsync(worktreeDir, branch, githubToken, { runCommand = defaultRunCommand3, allowAmbientFallback = false, remoteBranch = branch } = {}) {
+  const pushRef = remoteBranch && remoteBranch !== branch ? `HEAD:refs/heads/${remoteBranch}` : branch;
+  const { primary, fallback } = pushPlan(pushRef, githubToken, { allowAmbientFallback });
+  try {
+    await runCommand("git", primary.args, worktreeDir, { env: primary.env });
+    return primary.tokenUsed;
+  } catch (err) {
+    if (!fallback) throw err;
+    await runCommand("git", fallback.args, worktreeDir, { env: fallback.env });
+    return fallback.tokenUsed;
+  }
+}
+async function openCodeTaskPrAsync(worktreeDir, files, {
+  title,
+  body,
+  branchPrefix = "vo/code-task",
+  botName = "vo-code-runner",
+  botEmail = "vo-code-runner@algosuite.ai",
+  alreadyCommitted = false,
+  githubToken = null,
+  allowAmbientGithubFallback = false,
+  draft = false,
+  armAutoMerge = false,
+  targetBranch = null,
+  targetPrNumber = null,
+  supersedesPrNumber = null,
+  supersedesHeadSha = null,
+  deferSupersededPrCleanup = false,
+  preserveExistingPr = false,
+  inPlaceNote = "",
+  supersedeFallback = false,
+  onCleanupWarning = console.error,
+  runCommand = defaultRunCommand3,
+  runOverlapGate = runLocalPrOverlapGateAsync
+} = {}) {
+  if (!Array.isArray(files) || files.length === 0) throw new Error("openCodeTaskPrAsync: no files to commit");
+  let branch;
+  let truncated = false;
+  let newCommit = null;
+  if (alreadyCommitted) {
+    branch = await resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand);
+  } else {
+    const committed = await commitWorkLocallyAsync(worktreeDir, files, {
+      title,
+      branchPrefix,
+      botName,
+      botEmail,
+      runCommand
+    });
+    branch = committed.branch;
+    truncated = committed.truncated;
+    newCommit = committed.committed;
+  }
+  let prBranch = String(targetBranch || branch).trim() || branch;
+  let inPlacePrNumber = targetPrNumber;
+  let inPlace = preserveExistingPr;
   const overlap = await runOverlapGate(worktreeDir, files.filter((file) => !isAgentScratch(file)), {
     branch: prBranch,
     env: githubToken ? installationTokenEnv(githubToken) : process.env,
@@ -8198,26 +8747,47 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
   const policy = applyOverlapPublishPolicy({ overlap, draft, body });
   ({ draft, body } = policy);
   const { overlapDraft, overlapBlockedBy } = policy;
-  const tokenUsed = await retryTransientAsync(
-    () => pushBranchAsync(worktreeDir, branch, githubToken, {
-      runCommand,
-      allowAmbientFallback: allowAmbientGithubFallback,
-      remoteBranch: prBranch
-    }),
-    { onRetry: gitRetryLog("git push") }
-  );
+  const pushed = await pushWithInPlaceFallback({
+    worktreeDir,
+    branch,
+    remoteBranch: prBranch,
+    githubToken,
+    allowAmbientFallback: allowAmbientGithubFallback,
+    supersedeFallback,
+    push: (dir, localBranch, token2, options) => pushBranchAsync(dir, localBranch, token2, { ...options, runCommand }),
+    retry: (fn) => retryTransientAsync(fn, { onRetry: gitRetryLog("git push") }),
+    onFallback: (err) => onCleanupWarning?.(
+      `[publish] in-place push to ${prBranch} was refused (${String(err?.message || err).replace(/\s+/g, " ").slice(0, 160)}); superseding on ${branch} instead`
+    )
+  });
+  const tokenUsed = pushed.tokenUsed;
+  if (pushed.fallbackReason) {
+    prBranch = pushed.remoteBranch;
+    inPlacePrNumber = null;
+    inPlace = false;
+  }
   const authToken = tokenUsed ? githubToken : null;
   const existing = await existingPrUrlAsync(worktreeDir, prBranch, authToken, { runCommand });
-  if (targetPrNumber && existing?.number !== targetPrNumber) {
-    throw new Error(`explicit target PR #${targetPrNumber} was not found on ${prBranch}; refusing duplicate publication`);
+  if (inPlacePrNumber && existing?.number !== inPlacePrNumber) {
+    throw new Error(`explicit target PR #${inPlacePrNumber} was not found on ${prBranch}; refusing duplicate publication`);
   }
   if (existing) {
+    const env2 = authToken ? installationTokenEnv(authToken) : void 0;
+    const meta = inPlace ? await resolveInPlacePrMetadata(worktreeDir, existing.number, {
+      note: overlapDraft ? `${body}` : inPlaceNote,
+      env: env2,
+      runFn: runCommand
+    }) : { editMetadata: true, title: compactTitle(title), body };
     const { markedReady } = await retryTransientAsync(() => syncExistingPrAsync(worktreeDir, existing, {
-      title: compactTitle(title),
-      body,
+      title: meta.title ?? compactTitle(title),
+      body: meta.body ?? body,
       draft,
       demoteToDraft: overlapDraft,
-      env: authToken ? installationTokenEnv(authToken) : void 0,
+      editMetadata: meta.editMetadata !== false,
+      // Promoting a draft would remove the only merge guard it carries, and the
+      // repair task did not author that readiness decision. Demotion still runs.
+      preserveDraftState: inPlace,
+      env: env2,
       runFn: runCommand
     }), { onRetry: gitRetryLog("gh pr sync") });
     const autoMerge2 = await maybeArmAutoMergeAsync({
@@ -8228,9 +8798,10 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
       draft,
       runCommand
     });
-    const superseded2 = deferSupersededPrCleanup ? {} : await cleanupSupersededPrAsync({
+    const superseded2 = deferSupersededPrCleanup ? {} : await cleanupSuperseded({
       worktreeDir,
       supersedesPrNumber,
+      supersedesHeadSha,
       replacementUrl: existing.url,
       replacementNumber: existing.number,
       githubToken: authToken,
@@ -8245,6 +8816,7 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
       newCommit,
       resumed: true,
       markedReady,
+      repairedInPlace: inPlace,
       overlapDraft,
       overlapBlockedBy,
       ...autoMerge2,
@@ -8272,16 +8844,28 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
     draft,
     runCommand
   });
-  const superseded = deferSupersededPrCleanup ? {} : await cleanupSupersededPrAsync({
+  const superseded = deferSupersededPrCleanup ? {} : await cleanupSuperseded({
     worktreeDir,
     supersedesPrNumber,
+    supersedesHeadSha,
     replacementUrl: prUrl,
     replacementNumber: prNumber,
     githubToken: authToken,
     runCommand,
     onCleanupWarning
   });
-  return { prUrl, prNumber, branch: prBranch, truncated, newCommit, overlapDraft, overlapBlockedBy, ...autoMerge, ...superseded };
+  return {
+    prUrl,
+    prNumber,
+    branch: prBranch,
+    truncated,
+    newCommit,
+    overlapDraft,
+    overlapBlockedBy,
+    ...pushed.fallbackReason ? { supersedeFallbackReason: pushed.fallbackReason } : {},
+    ...autoMerge,
+    ...superseded
+  };
 }
 var sleep;
 var init_publish_async = __esm({
@@ -8295,7 +8879,10 @@ var init_publish_async = __esm({
     init_secure_random();
     init_pr_overlap_gate();
     init_existing_pr_publication();
+    init_superseded_pr_cleanup();
+    init_repair_publication_strategy();
     init_partial_pr_continuation();
+    init_superseded_pr_cleanup();
     sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
   }
 });
@@ -8350,15 +8937,25 @@ function parseFrontmatterNameDescription(raw) {
   }
   return name && description ? { name, description } : null;
 }
+function isRepoCheckout(dir) {
+  try {
+    if (!statSync4(join10(dir, ".claude", "skills")).isDirectory()) return false;
+  } catch {
+    return false;
+  }
+  try {
+    statSync4(join10(dir, ".git"));
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveDefaultRepoRoot() {
   const starts = [dirname7(fileURLToPath4(import.meta.url)), process.cwd()];
   for (const start of starts) {
     let dir = start;
     for (let i = 0; i < 8; i += 1) {
-      try {
-        if (statSync4(join10(dir, ".claude", "skills")).isDirectory()) return dir;
-      } catch {
-      }
+      if (isRepoCheckout(dir)) return dir;
       const parent = dirname7(dir);
       if (parent === dir) break;
       dir = parent;
@@ -8719,11 +9316,12 @@ function methodologyLedgerFields(methodology) {
   return { ...shape ? { methodology_shape: shape } : {}, ...stakes ? { governed_stakes: stakes } : {} };
 }
 async function composeCodeTaskPrompt(client, task, { log: log2 = () => {
-}, allowMissingKnowledgeContext = false, attachmentManifestMarkdown = "", onMethodology } = {}) {
+}, allowMissingKnowledgeContext = false, attachmentManifestMarkdown = "", onMethodology, repoRoot: repoRoot2 } = {}) {
   const taskId = task?.code_task_id;
   if (!taskId) {
     return composeDispatchPrompt(withComposedMethodology(withAttachmentManifest(task?.prompt, attachmentManifestMarkdown), task, log2, taskId, onMethodology), {
       repo: task?.repo,
+      repoRoot: repoRoot2,
       knowledgeContextMarkdown: handleMissingKnowledgeContext(taskId, "missing code_task_id on the claimed task", {
         allowMissingKnowledgeContext,
         log: log2
@@ -8733,6 +9331,7 @@ async function composeCodeTaskPrompt(client, task, { log: log2 = () => {
   if (typeof client?.getTaskKnowledgeContext !== "function") {
     return composeDispatchPrompt(withComposedMethodology(withAttachmentManifest(task?.prompt, attachmentManifestMarkdown), task, log2, taskId, onMethodology), {
       repo: task?.repo,
+      repoRoot: repoRoot2,
       knowledgeContextMarkdown: handleMissingKnowledgeContext(taskId, "control-plane client cannot fetch knowledge context", {
         allowMissingKnowledgeContext,
         log: log2
@@ -8762,6 +9361,7 @@ async function composeCodeTaskPrompt(client, task, { log: log2 = () => {
 ${operatorInstructions}` : task?.prompt;
   return composeDispatchPrompt(withComposedMethodology(withAttachmentManifest(prompt, attachmentManifestMarkdown), task, log2, taskId, onMethodology), {
     repo: task?.repo,
+    repoRoot: repoRoot2,
     knowledgeContextMarkdown
   });
 }
@@ -10021,6 +10621,167 @@ var init_local_model_remote_config = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/prepared-job-divergence.mjs
+function context7LocalOnlyEnvPresent(env2 = {}) {
+  return CONTEXT7_LOCAL_ONLY_ENV_KEYS.some((k) => String(env2?.[k] ?? "").trim().length > 0);
+}
+function argvDivergesOnlyOnModel(runnerArgv, planeArgv, { runnerModel, planeModel } = {}) {
+  if (!Array.isArray(runnerArgv) || !Array.isArray(planeArgv)) return false;
+  if (runnerArgv.length !== planeArgv.length) return false;
+  if (runnerModel === void 0 || runnerModel === null) return false;
+  if (planeModel === void 0 || planeModel === null) return false;
+  let modelValueDiffs = 0;
+  for (let i = 0; i < runnerArgv.length; i += 1) {
+    if (runnerArgv[i] === planeArgv[i]) continue;
+    if (i === 0) return false;
+    if (runnerArgv[i - 1] !== MODEL_FLAG || planeArgv[i - 1] !== MODEL_FLAG) return false;
+    if (runnerArgv[i] !== String(runnerModel) || planeArgv[i] !== String(planeModel)) return false;
+    modelValueDiffs += 1;
+  }
+  return modelValueDiffs > 0;
+}
+function splitPromptSections(prompt) {
+  const text = String(prompt ?? "");
+  const hits = [];
+  let cursor = 0;
+  for (const [name, marker] of PROMPT_SECTION_MARKERS) {
+    const at = text.indexOf(marker, cursor);
+    if (at === -1) continue;
+    hits.push({ name, at });
+    cursor = at + marker.length;
+  }
+  const sections = { preamble: text.slice(0, hits.length ? hits[0].at : text.length) };
+  for (let i = 0; i < hits.length; i += 1) {
+    sections[hits[i].name] = text.slice(hits[i].at, i + 1 < hits.length ? hits[i + 1].at : text.length);
+  }
+  return sections;
+}
+function promptSectionDivergence(runnerPrompt, planePrompt) {
+  const a = splitPromptSections(runnerPrompt);
+  const b = splitPromptSections(planePrompt);
+  const names = PROMPT_SECTION_ORDER.filter((n) => n in a || n in b);
+  if (names.some((n) => !(n in a) || !(n in b))) return null;
+  return names.filter((n) => a[n] !== b[n]);
+}
+function promptConfinedTo(sections, section) {
+  return Array.isArray(sections) && sections.length === 1 && sections[0] === section;
+}
+function context7Config(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(String(raw));
+  } catch {
+    return null;
+  }
+  const server = parsed?.mcpServers?.context7;
+  return server && typeof server === "object" && !Array.isArray(server) ? parsed : null;
+}
+function mcpConfigDiffersOnlyOnHostLocalContext7(runnerRaw, planeRaw) {
+  const runner = context7Config(runnerRaw);
+  const plane = context7Config(planeRaw);
+  if (!runner || !plane) return false;
+  if (plane.mcpServers.context7.headers !== void 0) return false;
+  const strip = (cfg) => {
+    const copy = JSON.parse(JSON.stringify(cfg));
+    for (const field of CONTEXT7_HOST_LOCAL_FIELDS) delete copy.mcpServers.context7[field];
+    return JSON.stringify(copy);
+  };
+  return strip(runner) === strip(plane);
+}
+function argvDivergesOnlyOnLocalMcpConfig(runnerArgv, planeArgv) {
+  if (!Array.isArray(runnerArgv) || !Array.isArray(planeArgv)) return false;
+  if (runnerArgv.length !== planeArgv.length) return false;
+  let diffs = 0;
+  for (let i = 0; i < runnerArgv.length; i += 1) {
+    if (runnerArgv[i] === planeArgv[i]) continue;
+    if (i === 0) return false;
+    if (runnerArgv[i - 1] !== MCP_CONFIG_FLAG || planeArgv[i - 1] !== MCP_CONFIG_FLAG) return false;
+    if (!mcpConfigDiffersOnlyOnHostLocalContext7(runnerArgv[i], planeArgv[i])) return false;
+    diffs += 1;
+  }
+  return diffs > 0;
+}
+function safeEndpoint(url) {
+  try {
+    const u = new URL(String(url));
+    return `${u.protocol}//${u.host}${u.pathname}`;
+  } catch {
+    return REDACTED;
+  }
+}
+function redactArgvForRecord(argv) {
+  if (!Array.isArray(argv)) return argv ?? null;
+  return argv.map((value, i) => {
+    if (i === 0 || argv[i - 1] !== MCP_CONFIG_FLAG) return value;
+    let parsed;
+    try {
+      parsed = JSON.parse(String(value));
+    } catch {
+      return REDACTED;
+    }
+    for (const server of Object.values(parsed?.mcpServers ?? {})) {
+      if (!server || typeof server !== "object") continue;
+      if (typeof server.url === "string") server.url = safeEndpoint(server.url);
+      if (server.headers && typeof server.headers === "object") {
+        for (const key of Object.keys(server.headers)) server.headers[key] = REDACTED;
+      }
+    }
+    return JSON.stringify(parsed);
+  });
+}
+function classifyDivergence(field, ctx = {}) {
+  const known = (reason) => ({ class: "known_remainder", reason });
+  if (Array.isArray(ctx.envDropped) && ctx.envDropped.length > 0) {
+    return known(`env_value_too_long:${ctx.envDropped.join("+")}`);
+  }
+  if ((field === "model" || field === "tier") && ctx.planeModelRegistryUnavailable) {
+    return known("no_plane_model_registry");
+  }
+  if (field === "argv" && ctx.planeModelRegistryUnavailable && ctx.argvDivergesOnlyOnModel) {
+    return known("downstream_of_model_remainder");
+  }
+  if (field === "argv" && ctx.context7LocalOnlyEnvPresent && ctx.argvDivergesOnlyOnLocalMcpConfig) {
+    return known("host_local_context7_mcp_config");
+  }
+  if (field === "dispatch_mode" && ctx.taskDispatchModeAbsent) return known("plane_dispatch_mode_default");
+  if (ctx.dispatchModeDiverged && DISPATCH_MODE_DEPENDENT.has(field)) {
+    return known("downstream_of_dispatch_mode");
+  }
+  if (field === "prompt" && ctx.attachmentManifestPresent && promptConfinedTo(ctx.promptSectionsDiverged, "task")) {
+    return known("attachment_manifest_not_sent");
+  }
+  if (field === "prompt" && ctx.planeSkillCatalogUnavailable && (ctx.promptSectionsDiverged === null || promptConfinedTo(ctx.promptSectionsDiverged, "skill_catalog"))) {
+    return known("skill_catalog_unavailable");
+  }
+  return { class: "unexplained", reason: null };
+}
+var DISPATCH_MODE_DEPENDENT, MODEL_FLAG, MCP_CONFIG_FLAG, CONTEXT7_HOST_LOCAL_FIELDS, CONTEXT7_LOCAL_ONLY_ENV_KEYS, PROMPT_SECTION_MARKERS, PROMPT_SECTION_ORDER, REDACTED;
+var init_prepared_job_divergence = __esm({
+  "../../scripts/virtual-office/code-runner/prepared-job-divergence.mjs"() {
+    "use strict";
+    DISPATCH_MODE_DEPENDENT = /* @__PURE__ */ new Set([
+      "prompt",
+      "argv",
+      "permission_mode",
+      "tier",
+      "model",
+      "effort",
+      "max_turns"
+    ]);
+    MODEL_FLAG = "--model";
+    MCP_CONFIG_FLAG = "--mcp-config";
+    CONTEXT7_HOST_LOCAL_FIELDS = ["url", "headers"];
+    CONTEXT7_LOCAL_ONLY_ENV_KEYS = ["CONTEXT7_API_KEY", "VO_CONTEXT7_URL"];
+    PROMPT_SECTION_MARKERS = [
+      ["skill_catalog", "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 ALGOSUITE SKILL CATALOG \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"],
+      ["knowledge_context", "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 ALGOHQ KNOWLEDGE CONTEXT \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"],
+      ["task", "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 YOUR TASK \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"]
+    ];
+    PROMPT_SECTION_ORDER = ["preamble", "skill_catalog", "knowledge_context", "task"];
+    REDACTED = "[redacted]";
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/prepared-job-shadow.mjs
 import { appendFileSync, mkdirSync as mkdirSync8 } from "node:fs";
 import { createHash as createHash6 } from "node:crypto";
@@ -10085,33 +10846,29 @@ function planeJobAsComparable(job = {}) {
     methodology_stakes: job.methodology?.stakes ?? null
   };
 }
-function classifyDivergence(field, ctx = {}) {
-  const known = (reason) => ({ class: "known_remainder", reason });
-  if (Array.isArray(ctx.envDropped) && ctx.envDropped.length > 0) {
-    return known(`env_value_too_long:${ctx.envDropped.join("+")}`);
-  }
-  if ((field === "model" || field === "tier") && ctx.planeModelRegistryUnavailable) {
-    return known("no_plane_model_registry");
-  }
-  if (field === "dispatch_mode" && ctx.taskDispatchModeAbsent) return known("plane_dispatch_mode_default");
-  if (ctx.dispatchModeDiverged && DISPATCH_MODE_DEPENDENT.has(field)) {
-    return known("downstream_of_dispatch_mode");
-  }
-  if (field === "prompt" && ctx.attachmentManifestPresent) return known("attachment_manifest_not_sent");
-  if (field === "prompt" && ctx.planeSkillCatalogUnavailable) return known("skill_catalog_unavailable");
-  return { class: "unexplained", reason: null };
-}
 function comparePreparedJob({ local, plane, context = {} }) {
   const L = local || {};
   const P = plane || {};
   const raw = COMPARED_FIELDS.filter((f) => !sameValue(L[f], P[f]));
-  const ctx = { ...context, dispatchModeDiverged: raw.includes("dispatch_mode") };
+  const ctx = {
+    ...context,
+    dispatchModeDiverged: raw.includes("dispatch_mode"),
+    // ADR-004 § 11.1c: computed from the argv arrays themselves, never asserted
+    // by the caller — the classifier may only explain argv when the bytes say so.
+    argvDivergesOnlyOnModel: argvDivergesOnlyOnModel(L.argv, P.argv, {
+      runnerModel: L.model,
+      planeModel: P.model
+    }),
+    argvDivergesOnlyOnLocalMcpConfig: argvDivergesOnlyOnLocalMcpConfig(L.argv, P.argv),
+    // Section NAMES, never text; null when the banners differ (fail-closed).
+    promptSectionsDiverged: promptSectionDivergence(L.prompt, P.prompt)
+  };
   const divergences = raw.map((field) => {
     const { class: cls, reason } = classifyDivergence(field, ctx);
     const entry = { field, class: cls, reason };
     if (field !== "prompt") {
-      entry.runner = L[field] ?? null;
-      entry.plane = P[field] ?? null;
+      entry.runner = (field === "argv" ? redactArgvForRecord(L.argv) : L[field]) ?? null;
+      entry.plane = (field === "argv" ? redactArgvForRecord(P.argv) : P[field]) ?? null;
     }
     return entry;
   });
@@ -10126,7 +10883,9 @@ function comparePreparedJob({ local, plane, context = {} }) {
       plane_len: String(P.prompt ?? "").length,
       runner_sha256: sha256(L.prompt),
       plane_sha256: sha256(P.prompt),
-      first_diff_index: firstDivergenceIndex(L.prompt, P.prompt)
+      first_diff_index: firstDivergenceIndex(L.prompt, P.prompt),
+      // null ⇒ the two prompts do not carry the same banners (not attributable).
+      divergent_sections: ctx.promptSectionsDiverged
     }
   };
 }
@@ -10194,6 +10953,7 @@ function formatShadowLogLine(record) {
   if (known.length) parts.push(`known=${known.map((d) => `${d.field}(${d.reason})`).join(",")}`);
   if (record.verdict === "parity_diverged" && typeof record.prompt?.first_diff_index === "number" && record.prompt.first_diff_index >= 0 && record.unexplained_fields?.includes("prompt")) {
     parts.push(`prompt_first_diff_index=${record.prompt.first_diff_index}`);
+    parts.push(`prompt_sections=${record.prompt.divergent_sections?.join(",") || "not_attributable"}`);
   }
   const loud = record.unexplained_fields?.length ? "!! " : "";
   return `${loud}[prepared-job-shadow] ${parts.join(" ")}`;
@@ -10242,6 +11002,7 @@ async function preparedJobShadowPass({
         planeSkillCatalogUnavailable: fetched.composition?.skill_catalog_available === false,
         taskDispatchModeAbsent: !task?.dispatch_mode,
         attachmentManifestPresent: Boolean(local?.attachmentManifestMarkdown),
+        context7LocalOnlyEnvPresent: context7LocalOnlyEnvPresent(env2),
         envDropped: fetched.envDropped
       }
     }) : null;
@@ -10286,11 +11047,13 @@ async function runPreparedJobShadow(options = {}) {
   }
   return result;
 }
-var PREPARED_JOB_MODES, PREPARED_JOB_MODE_ENV, PREPARED_JOB_SHADOW_TIMEOUT_ENV, DEFAULT_SHADOW_TIMEOUT_MS, PREPARED_JOB_SHADOW_SINK, remotePreparedJobMode, COMPARED_FIELDS, DISPATCH_MODE_DEPENDENT, sha256, sameValue, verdictObserver;
+var PREPARED_JOB_MODES, PREPARED_JOB_MODE_ENV, PREPARED_JOB_SHADOW_TIMEOUT_ENV, DEFAULT_SHADOW_TIMEOUT_MS, PREPARED_JOB_SHADOW_SINK, remotePreparedJobMode, COMPARED_FIELDS, sha256, sameValue, verdictObserver;
 var init_prepared_job_shadow = __esm({
   "../../scripts/virtual-office/code-runner/prepared-job-shadow.mjs"() {
     "use strict";
     init_claude_args();
+    init_prepared_job_divergence();
+    init_prepared_job_divergence();
     PREPARED_JOB_MODES = ["off", "shadow", "prepared"];
     PREPARED_JOB_MODE_ENV = "VO_CODE_RUNNER_PREPARED_JOB";
     PREPARED_JOB_SHADOW_TIMEOUT_ENV = "VO_PREPARED_JOB_SHADOW_TIMEOUT_MS";
@@ -10310,15 +11073,6 @@ var init_prepared_job_shadow = __esm({
       "methodology_shape",
       "methodology_stakes"
     ];
-    DISPATCH_MODE_DEPENDENT = /* @__PURE__ */ new Set([
-      "prompt",
-      "argv",
-      "permission_mode",
-      "tier",
-      "model",
-      "effort",
-      "max_turns"
-    ]);
     sha256 = (s) => createHash6("sha256").update(String(s ?? ""), "utf8").digest("hex");
     sameValue = (a, b) => Array.isArray(a) || Array.isArray(b) ? JSON.stringify(a) === JSON.stringify(b) : (a ?? null) === (b ?? null);
     verdictObserver = null;
@@ -11572,13 +12326,15 @@ function buildCiFixPrompt({ prNumber, repo, branch, headSha, failedChecks, prPat
     `Verified source head SHA: ${headSha || "unknown"}`,
     `Failing checks: ${failedChecks?.length ? failedChecks.join(", ") : "unknown"}`,
     "",
-    "Before you start, the runner materializes the complete verified PR head into your fresh current-main worktree.",
+    "Before you start, the runner materializes the complete verified PR head into your worktree.",
     "The bounded patch excerpt and failed-job evidence below are diagnostic context only, never source transfer.",
     "Diagnose the actual failure from this evidence and the worktree; do not substitute unrelated current-main failures.",
-    "Fix it. Follow the PR Freshness / safe-rebuild protocol: open a FRESH fix on a new",
-    `branch off current main that SUPERSEDES PR #${prNumber} (note "Supersedes #${prNumber}"`,
-    "in your summary). Your work ships: finish the fix completely, leave UNCOMMITTED edits,",
-    "and the runner opens the PR for you. A denied git/gh is EXPECTED; do NOT retry it.",
+    `Fix it. The runner owns publication and by DEFAULT repairs PR #${prNumber} IN PLACE on its own`,
+    "branch \u2014 one PR per lineage, no superseding duplicate; it opens a replacement PR only when",
+    "in-place repair is impossible (branch deleted, fork head, push refused, base hopelessly",
+    "diverged). Do NOT open, close, rebase or supersede any PR yourself, and do not add a",
+    "VO-ALLOW-PR-OVERLAP marker. Your work ships: finish the fix completely, leave UNCOMMITTED",
+    "edits, and the runner publishes for you. A denied git/gh is EXPECTED; do NOT retry it.",
     "",
     HEADLESS_EXECUTION_CONTRACT,
     "",
@@ -12140,112 +12896,6 @@ var init_pr_watcher = __esm({
   }
 });
 
-// ../../scripts/virtual-office/code-runner/resume-branch.mjs
-function compactBranchSegment(value) {
-  return String(value || "").trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "resume";
-}
-function defaultRunCommand2(cmd, args, cwd, opts = {}) {
-  return runProcess2(cmd, args, { cwd, ...opts });
-}
-function buildResumeLocalBranchName(remoteBranch, {
-  now = () => /* @__PURE__ */ new Date(),
-  pid = process.pid,
-  random = secureUnitRandom
-} = {}) {
-  const stamp = now().toISOString().replace(/[:.]/g, "-");
-  const unique = `${pid}-${random().toString(36).slice(2, 8)}`;
-  return `vo/resume-${compactBranchSegment(remoteBranch)}-${stamp}-${unique}`;
-}
-async function assertBranchName(worktreeDir, branch, { env: env2, runCommand = defaultRunCommand2 } = {}) {
-  const candidate = String(branch || "").trim();
-  if (!candidate) throw new Error("resume branch is required");
-  await runCommand("git", ["check-ref-format", "--branch", candidate], worktreeDir, {
-    env: env2,
-    timeout: 3e4
-  });
-  return candidate;
-}
-async function restoreContinuationBranch(worktreeDir, remoteBranch, {
-  env: env2,
-  runCommand = defaultRunCommand2,
-  localBranchName
-} = {}) {
-  const branch = await assertBranchName(worktreeDir, remoteBranch, { env: env2, runCommand });
-  const localBranch = await assertBranchName(
-    worktreeDir,
-    localBranchName || buildResumeLocalBranchName(branch),
-    { env: env2, runCommand }
-  );
-  await runCommand(
-    "git",
-    ["fetch", "origin", `${branch}:refs/remotes/origin/${branch}`],
-    worktreeDir,
-    { env: env2, timeout: 12e4 }
-  );
-  await runCommand("git", ["checkout", "-b", localBranch, `origin/${branch}`], worktreeDir, {
-    env: env2,
-    timeout: 6e4
-  });
-  return { localBranch, remoteBranch: branch };
-}
-function parseHeadRefName(output) {
-  const parsed = JSON.parse(String(output || "{}"));
-  const branch = String(parsed?.headRefName || "").trim();
-  return branch || null;
-}
-async function resolvePrHeadBranch(worktreeDir, {
-  repo,
-  prNumber,
-  githubToken = null,
-  allowAmbientGithubFallback = false,
-  runCommand = defaultRunCommand2
-} = {}) {
-  if (!repo || !Number.isInteger(prNumber) || prNumber <= 0) return null;
-  const args = ["pr", "view", String(prNumber), "-R", String(repo), "--json", "headRefName"];
-  try {
-    const output = await runCommand("gh", args, worktreeDir, {
-      env: githubToken ? installationTokenEnv(githubToken) : void 0,
-      timeout: 6e4
-    });
-    return parseHeadRefName(output);
-  } catch (error) {
-    if (!githubToken || !allowAmbientGithubFallback) throw error;
-  }
-  const fallback = await runCommand("gh", args, worktreeDir, { timeout: 6e4 });
-  return parseHeadRefName(fallback);
-}
-async function prepareContinuationBranch(worktreeDir, {
-  task,
-  parentTask,
-  githubToken = null,
-  allowAmbientGithubFallback = false,
-  runCommand = defaultRunCommand2
-} = {}) {
-  const continuationBranch = task?.pr_branch || parentTask?.pr_branch || (parentTask?.pr_number ? await resolvePrHeadBranch(worktreeDir, {
-    repo: task?.repo,
-    prNumber: parentTask.pr_number,
-    githubToken,
-    allowAmbientGithubFallback,
-    runCommand
-  }) : null);
-  if (!continuationBranch && (task?.pr_branch || parentTask?.pr_url || parentTask?.pr_number)) {
-    throw new Error(`continuation PR branch could not be resolved for task ${task?.code_task_id || "unknown"}`);
-  }
-  if (!continuationBranch) return null;
-  return restoreContinuationBranch(worktreeDir, continuationBranch, {
-    env: githubToken ? installationTokenEnv(githubToken) : void 0,
-    runCommand
-  });
-}
-var init_resume_branch = __esm({
-  "../../scripts/virtual-office/code-runner/resume-branch.mjs"() {
-    "use strict";
-    init_publish();
-    init_process_runner2();
-    init_secure_random();
-  }
-});
-
 // ../../scripts/virtual-office/code-runner/existing-pr-target.mjs
 function explicitExistingPrNumber(prompt) {
   const match = String(prompt || "").match(
@@ -12253,9 +12903,32 @@ function explicitExistingPrNumber(prompt) {
   );
   return match ? Number(match[1]) : null;
 }
+function inPlaceRepairNote({ task, repairPlan } = {}) {
+  const head = String(repairPlan?.headSha || "").slice(0, 7) || "unknown";
+  const taskId = String(task?.code_task_id || "unknown").slice(0, 8);
+  return `_AlgoHQ autonomous repair updated this PR **in place** on its own branch \`${repairPlan?.remoteBranch}\` (code task \`${taskId}\`, from head \`${head}\`). No superseding PR was opened._`;
+}
+function inPlaceTarget({ task, repairPlan }) {
+  return {
+    targetBranch: repairPlan.remoteBranch,
+    targetPrNumber: repairPlan.prNumber,
+    supersedesPrNumber: repairPlan.prNumber,
+    supersedesHeadSha: repairPlan.headSha ?? null,
+    repairStrategy: "in-place",
+    // The predecessor IS this PR: never rewrite its title/body (they carry CI
+    // markers) and never promote its draft flag (the only merge guard it has).
+    preserveExistingPr: true,
+    inPlaceNote: inPlaceRepairNote({ task, repairPlan }),
+    // A remote that REFUSES the in-place push is the enumerated `push_rejected`
+    // escape; publication then falls back to a fresh branch + supersede.
+    supersedeFallback: true,
+    deferSupersededPrCleanup: false
+  };
+}
 async function resolvePublicationTarget({
   task,
   continuationRestore,
+  repairPlan = null,
   worktreeDir,
   githubToken,
   allowAmbientGithubFallback,
@@ -12266,16 +12939,26 @@ async function resolvePublicationTarget({
     if (!Number.isInteger(repairPrNumber) || repairPrNumber <= 0) {
       throw new Error("structured repair PR target is invalid; refusing publication");
     }
+    if (repairPlan?.strategy === "in-place" && repairPlan.remoteBranch && !continuationRestore) {
+      return inPlaceTarget({ task, repairPlan });
+    }
     return {
       targetBranch: continuationRestore?.remoteBranch || void 0,
-      supersedesPrNumber: repairPrNumber
+      supersedesPrNumber: repairPrNumber,
+      // Closing the predecessor at PUBLISH time is what stops a repair lineage
+      // from growing a third open layer; the head-SHA guard in
+      // closeSupersededPrAsync is what keeps that close safe.
+      supersedesHeadSha: repairPlan?.strategy === "supersede" ? repairPlan.headSha ?? null : null,
+      repairStrategy: repairPlan?.strategy ?? "supersede",
+      deferSupersededPrCleanup: !(repairPlan?.strategy === "supersede" && repairPlan.headSha)
     };
   }
   const targetPrNumber = explicitExistingPrNumber(task?.prompt);
   if (!targetPrNumber) {
     return {
       targetBranch: continuationRestore?.remoteBranch || void 0,
-      supersedesPrNumber: supersededSourcePrNumber(task?.prompt)
+      supersedesPrNumber: supersededSourcePrNumber(task?.prompt),
+      deferSupersededPrCleanup: true
     };
   }
   const targetBranch = await resolveBranch(worktreeDir, {
@@ -12287,7 +12970,7 @@ async function resolvePublicationTarget({
   if (!targetBranch) {
     throw new Error(`explicit target PR #${targetPrNumber} head branch could not be resolved; refusing duplicate publication`);
   }
-  return { targetBranch, targetPrNumber, supersedesPrNumber: targetPrNumber };
+  return { targetBranch, targetPrNumber, supersedesPrNumber: targetPrNumber, deferSupersededPrCleanup: true };
 }
 var init_existing_pr_target = __esm({
   "../../scripts/virtual-office/code-runner/existing-pr-target.mjs"() {
@@ -12578,8 +13261,8 @@ function resolveCacheBaseDir(env2 = process.env, moduleDir = __dirname) {
   if (env2.VO_MODEL_REGISTRY_CACHE_DIR) return env2.VO_MODEL_REGISTRY_CACHE_DIR;
   if (env2.VO_RUNNER_RUNTIME_ROOT) return env2.VO_RUNNER_RUNTIME_ROOT;
   const segments = moduleDir.split(path18.sep);
-  const isRepoCheckout = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
-  return isRepoCheckout ? path18.resolve(moduleDir, "..", "..") : userCacheRoot();
+  const isRepoCheckout2 = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
+  return isRepoCheckout2 ? path18.resolve(moduleDir, "..", "..") : userCacheRoot();
 }
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -14722,7 +15405,7 @@ var init_inference_task_runner = __esm({
 import fs12 from "node:fs";
 import fsp11 from "node:fs/promises";
 import path19 from "node:path";
-async function defaultRun(command, args, cwd, options = {}) {
+async function defaultRun3(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
 async function git2(run, cwd, args, options = {}) {
@@ -14758,7 +15441,7 @@ async function isVerifiedRemoteFastForward(baseline, current, run) {
     return false;
   }
 }
-async function captureCanonicalBaseline(worktreeDir, { run = defaultRun } = {}) {
+async function captureCanonicalBaseline(worktreeDir, { run = defaultRun3 } = {}) {
   const root = await canonicalRootForWorktree(worktreeDir, run);
   if (!root) return { root: null, head: null, status: "", standalone: true };
   const state = await snapshot(root, run);
@@ -14818,7 +15501,7 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     await fsp11.rm(target, { force: true });
   }
 }
-async function assertCanonicalIsolation(baseline, { worktreeDir, taskId, run = defaultRun, now = () => /* @__PURE__ */ new Date() } = {}) {
+async function assertCanonicalIsolation(baseline, { worktreeDir, taskId, run = defaultRun3, now = () => /* @__PURE__ */ new Date() } = {}) {
   if (baseline.standalone) return { ok: true, standalone: true };
   const current = await snapshot(baseline.root, run);
   if (current.head === baseline.head && !current.status) return { ok: true };
@@ -15058,7 +15741,7 @@ async function closeCancelledReplacementPr({
   githubToken,
   log: log2 = () => {
   },
-  runCommand = defaultRunCommand3,
+  runCommand = defaultRunCommand4,
   reason = "the operator cancelled the task before publication was acknowledged"
 }) {
   if (!Number.isInteger(pr?.prNumber) || pr.prNumber <= 0 || pr.resumed) return false;
@@ -15279,7 +15962,7 @@ async function finalizePublishedPr({
   log2(`task ${id} \u2192 PR ${pr.prUrl}`);
   return false;
 }
-var defaultRunCommand3;
+var defaultRunCommand4;
 var init_publication_outcome = __esm({
   "../../scripts/virtual-office/code-runner/publication-outcome.mjs"() {
     "use strict";
@@ -15292,14 +15975,14 @@ var init_publication_outcome = __esm({
     init_outcome_commit();
     init_terminal_delivery();
     init_rate_limit_resume();
-    defaultRunCommand3 = (cmd, args, cwd, opts = {}) => runProcess2(cmd, args, { cwd, ...opts });
+    defaultRunCommand4 = (cmd, args, cwd, opts = {}) => runProcess2(cmd, args, { cwd, ...opts });
   }
 });
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
 import path20 from "node:path";
-function defaultRun2(command, args, cwd, options = {}) {
+function defaultRun4(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
 async function resolveSafeScratchTarget(worktreeDir, file) {
@@ -15323,7 +16006,7 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   }
   return target;
 }
-async function sanitizePublicationScratch(worktreeDir, scratchFiles, { base = "origin/main", runCommand = defaultRun2 } = {}) {
+async function sanitizePublicationScratch(worktreeDir, scratchFiles, { base = "origin/main", runCommand = defaultRun4 } = {}) {
   const unique = [...new Set(scratchFiles || [])];
   if (unique.length === 0) return false;
   const targets = /* @__PURE__ */ new Map();
@@ -15610,7 +16293,7 @@ var init_recovery_ledger = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs
-function defaultRunCommand4(cmd, args, cwd, opts = {}) {
+function defaultRunCommand5(cmd, args, cwd, opts = {}) {
   return runProcess2(cmd, args, { cwd, ...opts });
 }
 function explicitTaskOutcome(summary) {
@@ -15662,10 +16345,15 @@ async function closeSupersededSourceOnNoChanges({
   run,
   worktreeDir,
   githubToken,
+  repairInPlace = false,
   log: log2 = () => {
   },
-  runCommand = defaultRunCommand4
+  runCommand = defaultRunCommand5
 } = {}) {
+  if (repairInPlace) {
+    log2("no-changes: repair ran IN PLACE \u2014 leaving the repaired PR open");
+    return false;
+  }
   const structured = task?.repair_pr_number;
   if (structured !== void 0 && structured !== null && (!Number.isInteger(structured) || structured <= 0)) {
     throw new Error("structured repair PR target is invalid; refusing no-change completion");
@@ -15702,10 +16390,11 @@ async function finalizeNoChangesOutcome({
   maxTurns,
   worktreeDir,
   githubToken,
+  repairPlan = null,
   safeProgress: safeProgress2,
   log: log2 = () => {
   },
-  runCommand = defaultRunCommand4,
+  runCommand = defaultRunCommand5,
   beginCommit = deliverOutcomeCommit,
   deliverTerminal = deliverTerminalRun
 } = {}) {
@@ -15720,7 +16409,15 @@ async function finalizeNoChangesOutcome({
       message: "committing verified no-change outcome and source PR cleanup"
     });
     if (!committing) return terminal;
-    await closeSupersededSourceOnNoChanges({ task, run, worktreeDir, githubToken, log: log2, runCommand });
+    await closeSupersededSourceOnNoChanges({
+      task,
+      run,
+      worktreeDir,
+      githubToken,
+      log: log2,
+      runCommand,
+      repairInPlace: repairPlan?.strategy === "in-place"
+    });
   }
   const persisted = await deliverTerminal({
     client,
@@ -16089,101 +16786,6 @@ var init_daemon_config = __esm({
   }
 });
 
-// ../../scripts/virtual-office/code-runner/github-git-auth-env.mjs
-function githubGitAuthEnv2(githubToken) {
-  if (!githubToken) return void 0;
-  const credentials = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
-  return {
-    GIT_CONFIG_COUNT: "1",
-    GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
-    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${credentials}`
-  };
-}
-var init_github_git_auth_env = __esm({
-  "../../scripts/virtual-office/code-runner/github-git-auth-env.mjs"() {
-    "use strict";
-  }
-});
-
-// ../../scripts/virtual-office/code-runner/repair-source-materialization.mjs
-function assertRepairSource({ repo, prNumber, headSha }) {
-  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(String(repo || ""))) {
-    throw new Error("repair source repository is invalid");
-  }
-  if (!Number.isInteger(prNumber) || prNumber < 1) {
-    throw new Error("repair source PR number is invalid");
-  }
-  if (!/^[0-9a-f]{40}$/u.test(String(headSha || "").toLowerCase())) {
-    throw new Error("repair source head SHA is missing or invalid");
-  }
-}
-function defaultRun3(command, args, cwd, options = {}) {
-  const env2 = options.env ? { ...process.env, ...options.env } : process.env;
-  return runProcess2(command, args, { cwd, ...options, env: env2 });
-}
-async function materializeRepairSource(worktreeDir, {
-  repo,
-  prNumber,
-  headSha,
-  githubToken = null,
-  runCommand = defaultRun3
-} = {}) {
-  assertRepairSource({ repo, prNumber, headSha });
-  const expectedHead = headSha.toLowerCase();
-  const sourceRef = `refs/vo/repairs/${expectedHead}`;
-  const env2 = githubToken ? githubGitAuthEnv2(githubToken) : void 0;
-  await runCommand(
-    "git",
-    ["fetch", "origin", `+refs/pull/${prNumber}/head:${sourceRef}`],
-    worktreeDir,
-    { env: env2, timeout: 12e4 }
-  );
-  const fetchedHead = String(await runCommand(
-    "git",
-    ["rev-parse", sourceRef],
-    worktreeDir,
-    { env: env2, timeout: 3e4 }
-  )).trim().toLowerCase();
-  if (fetchedHead !== expectedHead) {
-    throw new Error(`repair source head changed: admitted ${expectedHead}, fetched ${fetchedHead || "none"}`);
-  }
-  let conflicted = false;
-  try {
-    await runCommand(
-      "git",
-      ["merge", "--squash", "--no-commit", sourceRef],
-      worktreeDir,
-      { env: env2, timeout: 12e4 }
-    );
-  } catch (error) {
-    const conflicts = String(await runCommand(
-      "git",
-      ["diff", "--name-only", "--diff-filter=U"],
-      worktreeDir,
-      { env: env2, timeout: 3e4 }
-    )).trim();
-    if (!conflicts) throw error;
-    conflicted = true;
-  }
-  const status = String(await runCommand(
-    "git",
-    ["status", "--porcelain"],
-    worktreeDir,
-    { env: env2, timeout: 3e4 }
-  )).trim();
-  if (!status) {
-    throw new Error(`repair source ${repo}#${prNumber}@${expectedHead} produced no changes on current main`);
-  }
-  return { sourceRef, headSha: expectedHead, conflicted };
-}
-var init_repair_source_materialization = __esm({
-  "../../scripts/virtual-office/code-runner/repair-source-materialization.mjs"() {
-    "use strict";
-    init_process_runner2();
-    init_github_git_auth_env();
-  }
-});
-
 // ../../scripts/virtual-office/code-runner/task-worktree-preparation.mjs
 async function prepareTaskWorktree({ client, task, cfg, safeProgress: safeProgress2, log: log2 }) {
   const id = task.code_task_id;
@@ -16214,6 +16816,7 @@ async function prepareTaskWorktree({ client, task, cfg, safeProgress: safeProgre
     githubToken,
     allowAmbientGithubFallback: cfg.allowAmbientGithub
   });
+  let repairPlan = null;
   if (continuationRestore) {
     log2(`task ${id}: restored continuation branch ${continuationRestore.remoteBranch} into ${continuationRestore.localBranch}`);
   } else if (task.repair_pr_number) {
@@ -16221,22 +16824,23 @@ async function prepareTaskWorktree({ client, task, cfg, safeProgress: safeProgre
       "preparing_worktree",
       `Materializing complete exact source PR #${task.repair_pr_number} before paid repair`
     ));
-    const source = await materializeRepairSource(wt.worktreeDir, {
+    repairPlan = await planRepairPublication(wt.worktreeDir, {
       repo: task.repo,
       prNumber: task.repair_pr_number,
       headSha: task.repair_head_sha,
-      githubToken
+      githubToken,
+      log: (message) => log2(`task ${id}: ${message}`)
     });
-    log2(`task ${id}: materialized full repair source ${task.repo}#${task.repair_pr_number}@${source.headSha}${source.conflicted ? " with conflicts for the agent to resolve" : ""}`);
+    log2(repairPlan.strategy === "in-place" ? `task ${id}: repairing ${task.repo}#${task.repair_pr_number}@${repairPlan.headSha} IN PLACE on ${repairPlan.remoteBranch}` : `task ${id}: materialized full repair source ${task.repo}#${task.repair_pr_number}@${repairPlan.headSha} for supersede (${repairPlan.reason})${repairPlan.conflicted ? " with conflicts for the agent to resolve" : ""}`);
   }
-  return { wt, githubToken, agentGithubReadToken, continuationRestore };
+  return { wt, githubToken, agentGithubReadToken, continuationRestore, repairPlan };
 }
 var init_task_worktree_preparation = __esm({
   "../../scripts/virtual-office/code-runner/task-worktree-preparation.mjs"() {
     "use strict";
     init_worktree_helper();
     init_resume_branch();
-    init_repair_source_materialization();
+    init_repair_publication_strategy();
     init_task_helpers();
   }
 });
@@ -16265,7 +16869,8 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
       wt,
       githubToken,
       agentGithubReadToken,
-      continuationRestore
+      continuationRestore,
+      repairPlan
     } = await prepareTaskWorktree({ client, task, cfg, safeProgress, log });
     worktreeName = wt.worktreeName;
     const canonicalBaseline = await captureCanonicalBaseline(wt.worktreeDir);
@@ -16279,7 +16884,9 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
         methodology = m;
       },
       allowMissingKnowledgeContext: process.env.VO_CODE_RUNNER_ALLOW_MISSING_KNOWLEDGE_CONTEXT === "1",
-      attachmentManifestMarkdown: attachmentBundle.manifestMarkdown
+      attachmentManifestMarkdown: attachmentBundle.manifestMarkdown,
+      repoRoot: wt.worktreeDir
+      // ADR-004 § 11.1c: the skill catalog must be the one THIS agent can read
     }) });
     await runPreparedJobShadow({ client, task, agent: sel.agent, env: process.env, log, local: {
       // ADR-004 § 11.1b SHADOW: default OFF; return value deliberately unread — slice C owns consumption
@@ -16400,6 +17007,7 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
         partial,
         run,
         maxTurns: effectiveMaxTurns,
+        repairPlan,
         worktreeDir: wt.worktreeDir,
         githubToken,
         safeProgress,
@@ -16410,7 +17018,7 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
     if (await taskWasCancelled({ client, id, run, safeProgress, log })) return;
     if (await gateTestGenTaskOrFail({ client, id, task, files, worktreeDir: wt.worktreeDir, log })) return;
     if (await enforceCompletionGateOrFail({ client, id, task, worktreeDir: wt.worktreeDir, run, truncated: partial, log })) return;
-    const publicationTarget = await resolvePublicationTarget({ task, continuationRestore, worktreeDir: wt.worktreeDir, githubToken, allowAmbientGithubFallback: cfg.allowAmbientGithub });
+    const publicationTarget = await resolvePublicationTarget({ task, continuationRestore, repairPlan, worktreeDir: wt.worktreeDir, githubToken, allowAmbientGithubFallback: cfg.allowAmbientGithub });
     const localBranch = await resolveOrCreateBranchAsync(wt.worktreeDir, "vo/code-task");
     const publicationBranch = publicationTarget.targetBranch || localBranch;
     if (!await recordPublicationIntent({ client, id, branch: publicationBranch, safeProgress, log })) {
@@ -16419,7 +17027,7 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
     }
     await safeProgress(client, id, runnerStagePatch("opening_pr", `opening PR for ${files.length} changed file(s)`));
     log(`task ${id}: publishing with merge-owner=${mergeOwner(cfg)}`);
-    const closesSource = publicationTarget.supersedesPrNumber ? `
+    const closesSource = publicationTarget.supersedesPrNumber && publicationTarget.supersedesPrNumber !== publicationTarget.targetPrNumber ? `
 
 Closes #${publicationTarget.supersedesPrNumber}` : "";
     const pr = await openCodeTaskPrAsync(wt.worktreeDir, files, {
@@ -16431,8 +17039,8 @@ Closes #${publicationTarget.supersedesPrNumber}` : "";
       draft: partial,
       armAutoMerge: cfg.armGhAutoMerge,
       // default OFF: the watcher waits for green CI, then uses the exact-SHA receipt-gated merge
-      ...publicationTarget,
-      deferSupersededPrCleanup: true
+      ...publicationTarget
+      // carries deferSupersededPrCleanup: a supersede now closes its predecessor at PUBLISH time (guarded by head SHA), never only at merge
     });
     if (await finalizePublishedPr({
       client,