@aviaratech/ai-delivery 0.3.23 → 0.3.25

package/dist/pr.js

@@ -1,265 +1,464 @@
-import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
-import { z } from 'zod';
-import { loadDeliveryConfig } from './config/deliveryConfig.js';
-import { assertPrivateFile, digestBytes } from './delivery/common.js';
-import { digestValue, loadSelectedRepositoryPolicy, validateRepositoryPolicyBoundary, } from './delivery/index.js';
 import { DeliveryError } from './errors.js';
-import { coordinate, defaultBaseRef, git, gitCommonDir, gitExitCode, gitRoot } from './git.js';
-import { resolveGitRemoteName } from './github/repo.js';
-import { createDeliveryGitHubClients, withAuthorGitToken } from './github/client.js';
-import { getConfiguredNativeIssueMetadata, nativeIssueSettingsFromDeliveryConfig, } from './github/nativeIssueMetadata.js';
+import { createDeliveryGitHubClients } from './github/client.js';
 import { getNativeBlockerRelationships } from './github/relationships.js';
-import { getIssueProjectStatus, projectSettingsFromDeliveryConfig, syncIssueProjectStatus, } from './github/projectDelivery.js';
-import { commentIssue } from './issue.js';
-import { acceptanceCriteria, issueFollowUps } from './issueJournal.js';
-import { loadPrepublicationArtifact, loadSubmittedReview, reviewArtifactApproval, assertSubmittedReviewCurrent, parseReviewArtifact, readRequiredReviewState, submitReview, } from './review.js';
-import { getIssueWorktreeStrict, listWorktreesStrict, updateIssueWorktreeDelivery, } from './services/worktreeRegistry.js';
-import { getDeliveryRecords, recordMergedDelivery } from './services/deliveryRecordService.js';
-import { createIssuePhaseEvidence, loadHistoricalMergedRun, loadRemovedMergedRun, loadVerifiedRun, } from './verification.js';
-import { writePrivateJsonFileAtomically } from './utils/atomicJson.js';
-import { readNativeWorktreePrLineage } from './worktreeTransition.js';
-import { cleanupMergedIssueWorktree, preparePrWorktree } from './worktree.js';
-const Digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
-const Sha = z.string().regex(/^[a-f0-9]{40}$/u);
-const PublicationSchema = z
-    .object({
-    baseSha: Sha,
-    evidenceId: Digest,
-    headSha: Sha,
-    issueNumber: z.number().int().positive(),
-    prNumber: z.number().int().positive(),
-    publicationId: Digest,
-    schemaVersion: z.literal('ai-delivery.publication@1'),
-})
-    .strict()
-    .superRefine((value, ctx) => {
-    const { publicationId, ...content } = value;
-    if (publicationId !== digestValue(content))
-        ctx.addIssue({ code: 'custom', message: 'Publication identity is invalid.' });
-});
-const MergeStrategy = z.enum(['merge', 'squash', 'rebase']);
-const MergeIntentShape = z
-    .object({
-    baseBranch: z.string().regex(/^[A-Za-z0-9._/-]+$/u),
-    baseSha: Sha,
-    evidenceId: Digest,
-    exactBaseHeadLease: z.boolean(),
-    headBranch: z.string().regex(/^[A-Za-z0-9._/-]+$/u),
-    headSha: Sha,
-    headTree: Sha,
-    intentId: Digest,
-    issueNumber: z.number().int().positive(),
-    prNumber: z.number().int().positive(),
-    reviewReceiptId: Digest,
-    schemaVersion: z.literal('ai-delivery.merge-intent@2'),
-    strategy: MergeStrategy,
-})
-    .strict();
-const MergeIntentSchema = MergeIntentShape.superRefine((value, ctx) => {
-    const { intentId, ...content } = value;
-    if (intentId !== digestValue(content))
-        ctx.addIssue({ code: 'custom', message: 'Merge intent identity is invalid.' });
-});
-const MergeAttemptSchema = z
-    .object({
-    actor: z.string().min(1),
-    actorLogin: z.string().min(1),
-    attemptId: Digest,
-    authSource: z.enum(['app', 'personal']),
-    credentialIdentity: z.string().min(1),
-    intentId: Digest,
-    operation: z.enum(['pulls.merge', 'updateRefs']),
-    schemaVersion: z.literal('ai-delivery.merge-attempt@1'),
-})
-    .strict()
-    .superRefine((value, ctx) => {
-    const { attemptId, ...content } = value;
-    if (attemptId !== digestValue(content))
-        ctx.addIssue({ code: 'custom', message: 'Merge attempt identity is invalid.' });
-});
-const MergeResultSchema = z
-    .object({
-    attemptId: Digest,
-    mergeSha: Sha,
-    resultId: Digest,
-    schemaVersion: z.literal('ai-delivery.merge-result@1'),
-})
-    .strict()
-    .superRefine((value, ctx) => {
-    const { resultId, ...content } = value;
-    if (resultId !== digestValue(content))
-        ctx.addIssue({ code: 'custom', message: 'Merge result identity is invalid.' });
-});
-const MergeSchema = MergeIntentShape.omit({ intentId: true, schemaVersion: true })
-    .extend({
-    intentId: Digest,
-    mergeId: Digest,
-    mergeSha: Sha,
-    mergeTree: Sha,
-    schemaVersion: z.literal('ai-delivery.merge@3'),
-})
-    .strict()
-    .superRefine((value, ctx) => {
-    const { mergeId, ...content } = value;
-    if (mergeId !== digestValue(content))
-        ctx.addIssue({ code: 'custom', message: 'Merge identity is invalid.' });
-});
-function publicationPath(root, issueNumber, headSha) {
-    return join(gitCommonDir(root), 'ai-delivery', 'publications', String(issueNumber), `${headSha}.json`);
+import { issueBranch, linkedIssueBranches, startIssueBranch } from './issue.js';
+import { parseGitHubReviewArtifact, parseReviewArtifact, readGitHubPrScopeHash, readRequiredReviewState, submitReview, } from './review.js';
+const Sha = /^[a-f0-9]{40}$/u;
+const Branch = /^(?!.*(?:\.\.|@\{|\/\/))[A-Za-z0-9._/-]+$/u;
+// Conservative refusals also cover Markdown decoration/escaped references.
+// This is a closure safety check, never authority for an issue association.
+function refuseClosingDirective(text) {
+    if (typeof text !== 'string')
+        throw new DeliveryError('Incomplete non-closing message readback.');
+    const normalized = text.replace(/[*_~`\\<>[\]]/gu, '');
+    if (/\b(?:close[sd]?|fix(?:es|ed)?|resolve[sd]?)\b(?:\s*:\s*|\s+)[^\n]*?(?:#[0-9]+|[A-Za-z0-9.-]+\/[A-Za-z0-9.-]+#[0-9]+|https?:\/\/(?:www\.)?github\.com\/[A-Za-z0-9.-]+\/[A-Za-z0-9.-]+\/(?:issues|pull)\/[0-9]+)/iu.test(normalized))
+        throw new DeliveryError('Non-closing delivery refuses closing directives in body, title or commit messages.');
 }
-function mergePath(root, issueNumber, headSha) {
-    return join(gitCommonDir(root), 'ai-delivery', 'merges', String(issueNumber), `${headSha}.json`);
+function referenceLine(context, issueNumber) {
+    return `References ${context.config.repository}#${issueNumber}`;
 }
-function mergeIntentPath(root, issueNumber, headSha) {
-    return join(gitCommonDir(root), 'ai-delivery', 'merge-intents', String(issueNumber), `${headSha}.json`);
+function nonClosingBody(context, issueNumber, requested) {
+    refuseClosingDirective(requested);
+    const line = referenceLine(context, issueNumber);
+    const body = requested.startsWith(`${line}\n`) || requested === line ? requested : `${line}\n\n${requested}`;
+    verifyReferenceBody(context, issueNumber, body);
+    return body;
 }
-function mergeAttemptPath(root, issueNumber, headSha) {
-    return join(gitCommonDir(root), 'ai-delivery', 'merge-attempts', String(issueNumber), `${headSha}.json`);
+function verifyReferenceBody(context, issueNumber, body) {
+    refuseClosingDirective(body);
+    const lines = body.split(/\r?\n/u);
+    if (lines[0] !== referenceLine(context, issueNumber) ||
+        lines.filter((line) => /^References\s/iu.test(line)).length !== 1)
+        throw new DeliveryError('Non-closing PR body must retain one leading canonical References line.');
 }
-function mergeResultPath(root, issueNumber, headSha) {
-    return join(gitCommonDir(root), 'ai-delivery', 'merge-results', String(issueNumber), `${headSha}.json`);
+function pageCursor(connection, seen) {
+    const info = connection.pageInfo;
+    if (!info ||
+        typeof info.hasNextPage !== 'boolean' ||
+        !(info.endCursor === null || typeof info.endCursor === 'string'))
+        throw new DeliveryError('Incomplete non-closing native pagination.');
+    if (!info.hasNextPage)
+        return null;
+    if (!info.endCursor || seen.has(info.endCursor))
+        throw new DeliveryError('Non-closing native pagination did not advance.');
+    seen.add(info.endCursor);
+    return info.endCursor;
 }
-function readOptionalPrivate(path, parse) {
-    let raw;
-    try {
-        raw = JSON.parse(assertPrivateFile(path).toString('utf8'));
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        throw new DeliveryError('Stored lifecycle receipt is unreadable.');
-    }
-    try {
-        return parse(raw);
+async function openReferenceIssue(context, issueNumber) {
+    const issue = (await context.clients.rest.issues.get({ ...context.repo, issue_number: issueNumber })).data;
+    if (issue.number !== issueNumber ||
+        'pull_request' in issue ||
+        issue.state !== 'open' ||
+        typeof issue.node_id !== 'string' ||
+        !issue.node_id ||
+        typeof issue.title !== 'string' ||
+        typeof issue.body !== 'string' ||
+        issue.html_url?.toLowerCase() !==
+            `https://github.com/${context.config.repository}/issues/${issueNumber}`.toLowerCase())
+        throw new DeliveryError('Non-closing delivery requires the exact canonical OPEN issue and complete title/body.');
+    return issue;
+}
+function sameReferencePr(before, after, expectedMerge = false) {
+    if (expectedMerge
+        ? before.state !== 'open' ||
+            before.draft ||
+            before.merged ||
+            after.state !== 'closed' ||
+            after.draft ||
+            !after.merged
+        : before.state !== after.state || before.draft !== after.draft || before.merged !== after.merged)
+        throw new DeliveryError('Non-closing PR state/draft/merged readback drifted; reconcile read-only.');
+    if (before.node_id !== after.node_id ||
+        before.head.sha !== after.head.sha ||
+        before.head.ref !== after.head.ref ||
+        before.base.sha !== after.base.sha ||
+        before.base.ref !== after.base.ref ||
+        before.body !== after.body ||
+        before.title !== after.title ||
+        before.user.login.toLowerCase() !== after.user.login.toLowerCase())
+        throw new DeliveryError('Non-closing PR identity, reference, message or head/base drifted; reconcile read-only.');
+}
+function sameReferenceIssue(before, after) {
+    if (before.node_id !== after.node_id || before.title !== after.title || before.body !== after.body)
+        throw new DeliveryError('Non-closing issue identity/title/criteria drifted; reconcile read-only.');
+}
+function nonClosingMode(value) {
+    if (value !== undefined && typeof value !== 'boolean')
+        throw new DeliveryError('nonClosing must be a boolean.');
+    return value === true;
+}
+async function nonClosingRoute(context, base) {
+    const authorContext = context.clients.role === 'author'
+        ? context
+        : {
+            ...context,
+            clients: await createDeliveryGitHubClients({
+                config: context.config,
+                identity: context.config.roles.author.identity,
+                role: 'author',
+            }),
+            reviewerClients: context.clients,
+        };
+    const route = await preflightReviewRoute(authorContext, base);
+    if (route.rules.visibility !== 'complete' || route.approvalEligibility === 'insufficient-permission')
+        throw new DeliveryError('Non-closing delivery requires complete native rule visibility and an independent reviewer route.');
+    return route;
+}
+async function verifyNonClosingCommits(context, pr) {
+    let cursor = null;
+    const cursors = new Set();
+    const commits = new Map();
+    let total;
+    for (let page = 0; page < 20; page++) {
+        const data = await context.clients.graphql('query DeliveryNonClosingCommits($owner:String!,$repo:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$repo){nameWithOwner pullRequest(number:$number){id number headRefOid baseRefOid baseRefName commits(first:100,after:$cursor){totalCount nodes{commit{oid message parents(first:100){totalCount nodes{oid} pageInfo{hasNextPage endCursor}}}} pageInfo{hasNextPage endCursor}}}}}', { ...context.repo, number: pr.number, cursor });
+        const live = data.repository?.pullRequest;
+        const connection = live?.commits;
+        if (data.repository?.nameWithOwner?.toLowerCase() !== context.config.repository.toLowerCase() ||
+            live?.id !== pr.node_id ||
+            live.number !== pr.number ||
+            live.headRefOid !== pr.head.sha ||
+            live.baseRefOid !== pr.base.sha ||
+            live.baseRefName !== pr.base.ref ||
+            !connection ||
+            !Array.isArray(connection.nodes) ||
+            connection.nodes.length > 100 ||
+            !Number.isSafeInteger(connection.totalCount) ||
+            connection.totalCount < 1 ||
+            connection.totalCount > 2000 ||
+            (total !== undefined && total !== connection.totalCount))
+            throw new DeliveryError('Incomplete or moved introduced commit graph at the non-closing head/base.');
+        total = connection.totalCount;
+        for (const node of connection.nodes) {
+            const commit = node?.commit;
+            if (!commit ||
+                !validSha(commit.oid) ||
+                commits.has(commit.oid) ||
+                !commit.parents ||
+                !Array.isArray(commit.parents.nodes) ||
+                commit.parents.nodes.length > 100 ||
+                !Number.isSafeInteger(commit.parents.totalCount) ||
+                commit.parents.totalCount < 1 ||
+                commit.parents.totalCount !== commit.parents.nodes.length ||
+                commit.parents.pageInfo?.hasNextPage !== false ||
+                commit.parents.nodes.some((parent) => !validSha(parent?.oid)))
+                throw new DeliveryError('Incomplete, duplicate or truncated introduced commit identity/parents.');
+            refuseClosingDirective(commit.message);
+            commits.set(commit.oid, commit.message);
+        }
+        cursor = pageCursor(connection, cursors);
+        if (cursor === null) {
+            if (commits.size !== total || !commits.has(pr.head.sha))
+                throw new DeliveryError('Introduced commit count/head is incomplete.');
+            return;
+        }
     }
-    catch {
-        throw new DeliveryError('Stored lifecycle receipt is corrupt.');
+    throw new DeliveryError('Non-closing commit graph exceeds the bounded readback window.');
+}
+async function verifyUnpublishedCommits(context, baseSha, headSha) {
+    const commits = new Set();
+    let total;
+    for (let page = 1; page <= 20; page++) {
+        const comparison = (await context.clients.rest.repos.compareCommitsWithBasehead({
+            ...context.repo,
+            basehead: `${baseSha}...${headSha}`,
+            per_page: 100,
+            page,
+        })).data;
+        if (comparison.base_commit?.sha !== baseSha ||
+            !validSha(comparison.merge_base_commit?.sha) ||
+            !['ahead', 'diverged'].includes(comparison.status) ||
+            !Number.isSafeInteger(comparison.total_commits) ||
+            comparison.total_commits < 1 ||
+            comparison.total_commits > 2000 ||
+            (total !== undefined && total !== comparison.total_commits) ||
+            !Array.isArray(comparison.commits) ||
+            comparison.commits.length > 100)
+            throw new DeliveryError('Incomplete introduced commit range before non-closing publication.');
+        total = comparison.total_commits;
+        for (const commit of comparison.commits) {
+            if (!validSha(commit.sha) ||
+                commits.has(commit.sha) ||
+                !Array.isArray(commit.parents) ||
+                commit.parents.length < 1 ||
+                commit.parents.length > 100 ||
+                commit.parents.some((parent) => !validSha(parent.sha)))
+                throw new DeliveryError('Incomplete or duplicate introduced commit identity.');
+            refuseClosingDirective(commit.commit?.message);
+            commits.add(commit.sha);
+        }
+        if (commits.size === total && commits.has(headSha))
+            return;
+        if (comparison.commits.length < 100)
+            throw new DeliveryError('Truncated introduced commit range before publication.');
     }
+    throw new DeliveryError('Introduced commit range exceeds the bounded readback window.');
 }
-function readPrivate(path, parse) {
-    let raw;
-    try {
-        raw = JSON.parse(assertPrivateFile(path).toString('utf8'));
+async function verifyNonClosingReference(context, issueNumber, pr) {
+    if (typeof pr.node_id !== 'string' ||
+        !pr.node_id ||
+        pr.html_url?.toLowerCase() !== `https://github.com/${context.config.repository}/pull/${pr.number}`.toLowerCase())
+        throw new DeliveryError('Incomplete non-closing PR node identity.');
+    verifyReferenceBody(context, issueNumber, pr.body);
+    refuseClosingDirective(pr.title);
+    const issue = await openReferenceIssue(context, issueNumber);
+    const repository = (await context.clients.rest.repos.get({ ...context.repo })).data;
+    if (repository.full_name?.toLowerCase() !== context.config.repository.toLowerCase() ||
+        pr.base.ref !== repository.default_branch ||
+        typeof repository.node_id !== 'string' ||
+        !repository.node_id)
+        throw new DeliveryError('Non-closing PR must target the canonical default repository/base.');
+    const route = await nonClosingRoute(context, pr.base.ref);
+    if (pr.user.login.toLowerCase() !== route.author.actorLogin.toLowerCase())
+        throw new DeliveryError('Non-closing PR author differs from the configured author.');
+    let cursor = null;
+    const cursors = new Set();
+    const events = new Map();
+    let matched = false;
+    for (let page = 0; page < 20; page++) {
+        const data = await context.clients.graphql('query DeliveryNonClosingReferences($owner:String!,$repo:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$repo){id nameWithOwner issue(number:$number){id number state timelineItems(first:100,after:$cursor,itemTypes:[CROSS_REFERENCED_EVENT]){nodes{... on CrossReferencedEvent{id actor{login} isCrossRepository willCloseTarget source{__typename ... on Issue{id number repository{id nameWithOwner}} ... on PullRequest{id number repository{id nameWithOwner}}} target{__typename ... on Issue{id number repository{id nameWithOwner}} ... on PullRequest{id number repository{id nameWithOwner}}}}} pageInfo{hasNextPage endCursor}}}}}', { ...context.repo, number: issueNumber, cursor });
+        const target = data.repository?.issue;
+        const connection = target?.timelineItems;
+        if (data.repository?.id !== repository.node_id ||
+            data.repository.nameWithOwner?.toLowerCase() !== context.config.repository.toLowerCase() ||
+            target?.id !== issue.node_id ||
+            target.number !== issueNumber ||
+            target.state !== 'OPEN' ||
+            !connection ||
+            !Array.isArray(connection.nodes) ||
+            connection.nodes.length > 100)
+            throw new DeliveryError('Incomplete or conflicting native non-closing issue identity.');
+        for (const event of connection.nodes) {
+            const source = event?.source;
+            const referenced = event?.target;
+            if (!event ||
+                !nativeId(event.id) ||
+                !source ||
+                !referenced ||
+                !['Issue', 'PullRequest'].includes(source.__typename) ||
+                !nativeId(source.id) ||
+                !Number.isSafeInteger(source.number) ||
+                source.number <= 0 ||
+                !nativeId(source.repository?.id) ||
+                typeof source.repository.nameWithOwner !== 'string' ||
+                referenced.__typename !== 'Issue' ||
+                referenced.id !== issue.node_id ||
+                referenced.number !== issueNumber ||
+                referenced.repository?.id !== repository.node_id ||
+                referenced.repository.nameWithOwner?.toLowerCase() !== context.config.repository.toLowerCase() ||
+                typeof event.isCrossRepository !== 'boolean' ||
+                typeof event.willCloseTarget !== 'boolean' ||
+                !nativeId(event.actor?.login))
+                throw new DeliveryError('Incomplete native cross-reference event identity/actor.');
+            const signature = JSON.stringify([
+                source.__typename,
+                source.id,
+                source.number,
+                source.repository.id,
+                source.repository.nameWithOwner.toLowerCase(),
+                referenced.id,
+                referenced.number,
+                referenced.repository.id,
+                referenced.repository.nameWithOwner.toLowerCase(),
+                event.actor.login.toLowerCase(),
+                event.isCrossRepository,
+                event.willCloseTarget,
+            ]);
+            if (events.has(event.id) && events.get(event.id) !== signature)
+                throw new DeliveryError('Conflicting duplicate native reference event.');
+            events.set(event.id, signature);
+            if (source.id === pr.node_id ||
+                (source.__typename === 'PullRequest' &&
+                    source.number === pr.number &&
+                    source.repository.nameWithOwner.toLowerCase() === context.config.repository.toLowerCase())) {
+                if (source.__typename !== 'PullRequest' ||
+                    source.id !== pr.node_id ||
+                    source.number !== pr.number ||
+                    source.repository.id !== repository.node_id ||
+                    source.repository.nameWithOwner.toLowerCase() !== context.config.repository.toLowerCase() ||
+                    event.isCrossRepository ||
+                    event.willCloseTarget !== false ||
+                    event.actor.login.toLowerCase() !== route.author.actorLogin.toLowerCase())
+                    throw new DeliveryError('Conflicting, closing or unauthorized native PR reference.');
+                matched = true;
+            }
+        }
+        cursor = pageCursor(connection, cursors);
+        if (cursor === null)
+            break;
+        if (page === 19)
+            throw new DeliveryError('Native non-closing references exceed the bounded readback window.');
     }
-    catch {
-        throw new DeliveryError('Required private lifecycle receipt is missing or unreadable.');
+    if (!matched)
+        throw new DeliveryError('Missing authorized native non-closing PR-to-issue reference.');
+    await verifyPrIssueAssociation(context, pr.number, issueNumber, true, pr.node_id);
+    await verifyNonClosingCommits(context, pr);
+    if (!pr.merged) {
+        const ref = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${pr.base.ref}` })).data;
+        if (ref.ref !== `refs/heads/${pr.base.ref}` || ref.object.type !== 'commit' || ref.object.sha !== pr.base.sha)
+            throw new DeliveryError('Non-closing default base has moved or is incomplete.');
     }
-    return parse(raw);
+    const after = await openReferenceIssue(context, issueNumber);
+    sameReferenceIssue(issue, after);
+    sameReferencePr(pr, await getPr(context, pr.number));
+    return issue;
 }
-export function loadPublication(root, issueNumber, headSha) {
-    return readPrivate(publicationPath(root, issueNumber, headSha), (value) => PublicationSchema.parse(value));
+function nativeId(value) {
+    return typeof value === 'string' && value.trim().length > 0;
 }
-function validateDeliveryImpact(body) {
-    if ((body.match(/^## Delivery Impact\s*$/gmu) ?? []).length !== 1 ||
-        (body.match(/^Roadmap impact:\s*(?:updated|none)\s*$/gmu) ?? []).length !== 1 ||
-        (body.match(/^Docs impact:\s*(?:updated|none)\s*$/gmu) ?? []).length !== 1) {
-        throw new DeliveryError('PR body requires one Delivery Impact section with Roadmap impact and Docs impact.');
-    }
+function validSha(value) {
+    return typeof value === 'string' && Sha.test(value);
 }
-function baseBranch(root, selectedRemote) {
-    const remote = resolveGitRemoteName(root, selectedRemote);
-    const ref = defaultBaseRef(root, remote);
-    const value = ref.slice(`refs/remotes/${remote}/`.length);
-    if (!/^[A-Za-z0-9._/-]+$/u.test(value))
-        throw new DeliveryError('Invalid configured default branch.');
-    return value;
+function validBranch(value) {
+    if (typeof value !== 'string' ||
+        !Branch.test(value) ||
+        value.startsWith('/') ||
+        value.endsWith('/') ||
+        value.endsWith('.lock'))
+        throw new DeliveryError('Invalid GitHub branch name.');
 }
-/** @internal Selected-author Git transport, exported for process-boundary tests. */
-export async function runAuthorGit(context, path, args, operation) {
-    await withAuthorGitToken(context.clients, (token) => {
-        const gitEnv = {
-            PATH: process.env.PATH ?? '',
-            GIT_CONFIG_GLOBAL: '/dev/null',
-            GIT_CONFIG_NOSYSTEM: '1',
-        };
-        const unsafeConfig = spawnSync('git', ['config', '--includes', '--get-regexp', '^(url\\..*\\.(insteadof|pushinsteadof)|http(\\..*)?\\.extraheader)$'], {
-            cwd: path,
-            env: gitEnv,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        if (unsafeConfig.error || (unsafeConfig.status !== 0 && unsafeConfig.status !== 1)) {
-            throw new DeliveryError(`Cannot verify effective Git HTTP transport configuration (git exit ${String(unsafeConfig.status)}).`);
-        }
-        if (unsafeConfig.status === 0) {
-            throw new DeliveryError('Local Git transport configuration conflicts with selected author authentication.');
-        }
-        const temporary = mkdtempSync(join(tmpdir(), 'ai-delivery-git-auth-'));
-        const askpass = join(temporary, 'askpass.sh');
-        try {
-            writeFileSync(askpass, '#!/bin/sh\ncase "$1" in\n  *Username*) printf "%s\\n" x-access-token ;;\n  *Password*) printf "%s\\n" "$AI_DELIVERY_GIT_TOKEN" ;;\n  *) exit 1 ;;\nesac\n', { mode: 0o700 });
-            execFileSync('git', ['-c', 'credential.helper=', ...args], {
-                cwd: path,
-                encoding: 'utf8',
-                env: { ...gitEnv, AI_DELIVERY_GIT_TOKEN: token, GIT_ASKPASS: askpass, GIT_TERMINAL_PROMPT: '0' },
-                maxBuffer: 4 * 1024 * 1024,
-                stdio: ['ignore', 'pipe', 'pipe'],
-            });
-        }
-        catch (cause) {
-            const error = cause;
-            const detail = String(error.stderr ?? '')
-                .trim()
-                .replaceAll(token, '[redacted]');
-            throw new DeliveryError(`git ${operation} failed${detail ? `: ${detail}` : ''}`);
+async function getPr(context, prNumber) {
+    if (context.config.repository.toLowerCase() !== `${context.repo.owner}/${context.repo.repo}`.toLowerCase())
+        throw new DeliveryError('Configured and selected GitHub repository identities disagree.');
+    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
+    if (pr.number !== prNumber ||
+        typeof pr.base.repo?.full_name !== 'string' ||
+        typeof pr.head.repo?.full_name !== 'string' ||
+        pr.base.repo?.full_name.toLowerCase() !== context.config.repository.toLowerCase() ||
+        pr.head.repo?.full_name.toLowerCase() !== context.config.repository.toLowerCase() ||
+        !validSha(pr.head.sha) ||
+        !validSha(pr.base.sha) ||
+        (pr.state !== 'open' && pr.state !== 'closed') ||
+        typeof pr.merged !== 'boolean' ||
+        typeof pr.draft !== 'boolean' ||
+        (pr.merged && pr.state !== 'closed'))
+        throw new DeliveryError('GitHub PR identity or exact head readback is invalid.');
+    validBranch(pr.head.ref);
+    validBranch(pr.base.ref);
+    return pr;
+}
+async function verifyPrIssueAssociation(context, prNumber, issueNumber, nonClosing = false, expectedPrId, onlyIntended = false, expectedIssueId, expectedRepositoryId) {
+    let cursor = null;
+    const cursors = new Set();
+    let matches = 0;
+    for (let page = 0; page < 20; page++) {
+        const result = await context.clients.graphql('query DeliveryClosingIssues($owner:String!,$repo:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$repo){nameWithOwner pullRequest(number:$number){id number closingIssuesReferences(first:100,after:$cursor){nodes{__typename id number repository{id nameWithOwner}} pageInfo{hasNextPage endCursor}}}}}', { ...context.repo, number: prNumber, cursor });
+        const connection = result.repository?.pullRequest?.closingIssuesReferences;
+        if (typeof result.repository?.nameWithOwner !== 'string' ||
+            result.repository.nameWithOwner.toLowerCase() !== context.config.repository.toLowerCase() ||
+            result.repository?.pullRequest?.number !== prNumber ||
+            (expectedPrId !== undefined && result.repository?.pullRequest?.id !== expectedPrId) ||
+            !connection ||
+            !Array.isArray(connection.nodes) ||
+            connection.nodes.length > 100 ||
+            typeof connection.pageInfo?.hasNextPage !== 'boolean' ||
+            !(connection.pageInfo.endCursor === null || typeof connection.pageInfo.endCursor === 'string'))
+            throw new DeliveryError('Incomplete or conflicting native GitHub PR issue association readback.');
+        for (const issue of connection.nodes) {
+            if (onlyIntended &&
+                (!issue ||
+                    issue.__typename !== 'Issue' ||
+                    !nativeId(expectedIssueId) ||
+                    issue.id !== expectedIssueId ||
+                    !nativeId(expectedRepositoryId) ||
+                    issue.repository?.id !== expectedRepositoryId))
+                throw new DeliveryError('Incomplete or conflicting typed closing issue/repository identity before body transition.');
+            if (nonClosing)
+                throw new DeliveryError('Non-closing PR has an unintended native closing association.');
+            if (!issue ||
+                !Number.isSafeInteger(issue.number) ||
+                issue.number <= 0 ||
+                typeof issue.repository?.nameWithOwner !== 'string' ||
+                !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(issue.repository.nameWithOwner))
+                throw new DeliveryError('Incomplete native PR closing-issue identity.');
+            if (issue.number === issueNumber &&
+                issue.repository.nameWithOwner.toLowerCase() === context.config.repository.toLowerCase())
+                matches++;
+            else if (onlyIntended)
+                throw new DeliveryError('Existing PR has conflicting closing associations; body transition refused.');
         }
-        finally {
-            rmSync(temporary, { recursive: true, force: true });
+        if (!connection.pageInfo.hasNextPage) {
+            if (!nonClosing && matches !== 1)
+                throw new DeliveryError('Native GitHub PR closing-issue association does not identify the intended issue.');
+            return;
         }
-    });
+        const next = connection.pageInfo.endCursor;
+        if (!next || cursors.has(next))
+            throw new DeliveryError('Native PR issue pagination did not advance.');
+        cursors.add(next);
+        cursor = next;
+    }
+    throw new DeliveryError('Native PR issue association exceeds the bounded readback window.');
 }
-async function pushReviewedHead(context, path, branch, sha) {
-    await runAuthorGit(context, path, ['push', `https://github.com/${context.repo.owner}/${context.repo.repo}.git`, `${sha}:refs/heads/${branch}`], 'push');
+async function matchingPrs(context, branch, base) {
+    const matches = [];
+    for (let page = 1; page <= 20; page++) {
+        const batch = (await context.clients.rest.pulls.list({
+            ...context.repo,
+            head: `${context.repo.owner}:${branch}`,
+            ...(base === undefined ? {} : { base }),
+            state: 'all',
+            page,
+            per_page: 100,
+        })).data;
+        if (!Array.isArray(batch) || batch.some((pr) => !pr || !Number.isSafeInteger(pr.number) || pr.number <= 0))
+            throw new DeliveryError('Incomplete GitHub PR match readback.');
+        matches.push(...batch);
+        if (batch.length < 100)
+            return matches;
+    }
+    throw new DeliveryError('GitHub PR match history exceeds the bounded readback window.');
 }
-async function fetchMergedBase(context, branch) {
-    const remote = resolveGitRemoteName(context.root, context.configuration?.remote);
-    const refspec = `${branch}:refs/remotes/${remote}/${branch}`;
-    const url = git(context.root, 'remote', 'get-url', remote);
-    if (isAbsolute(url) || url.startsWith('file://')) {
-        git(context.root, 'fetch', remote, refspec);
-        return;
+async function verifyIssuePr(context, issueNumber, prNumber, nonClosing = false) {
+    const pr = await getPr(context, prNumber);
+    if (nonClosing)
+        await verifyNonClosingReference(context, issueNumber, pr);
+    else
+        await verifyPrIssueAssociation(context, prNumber, issueNumber);
+    if (!pr.merged) {
+        // GitHub replaces the issue's branch connection with its PR on publication.
+        // Existing connections remain consistency evidence, never a fallback authority.
+        const branches = await linkedIssueBranches(context, issueNumber);
+        if (branches.length > 0) {
+            const matches = branches.filter((branch) => branch.name === pr.head.ref);
+            if (matches.length !== 1 || matches[0].sha !== pr.head.sha)
+                throw new DeliveryError('Native linked issue branches conflict with the exact PR head/ref.');
+        }
+        const ref = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${pr.head.ref}` })).data;
+        if (ref.ref !== `refs/heads/${pr.head.ref}` || ref.object.type !== 'commit' || ref.object.sha !== pr.head.sha)
+            throw new DeliveryError('Current remote PR head/ref readback is incomplete or has moved.');
     }
-    await runAuthorGit(context, context.root, ['fetch', `https://github.com/${context.repo.owner}/${context.repo.repo}.git`, refspec], 'fetch');
+    return pr;
 }
 export async function prInfo(context, input) {
-    if (input.prNumber !== undefined) {
-        const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-        return {
-            number: pr.number,
-            state: pr.state,
-            headSha: pr.head.sha,
-            baseSha: pr.base.sha,
-            draft: pr.draft ?? null,
-            authorLogin: pr.user?.login ?? null,
-            url: pr.html_url,
-        };
+    const nonClosing = nonClosingMode(input.nonClosing);
+    if (nonClosing && (input.issueNumber === undefined || input.prNumber === undefined))
+        throw new DeliveryError('Non-closing inspection requires explicit canonical issue and PR numbers.');
+    let number = input.prNumber;
+    if (number === undefined) {
+        if (input.issueNumber === undefined)
+            throw new DeliveryError('prNumber or issueNumber is required.');
+        const branches = await linkedIssueBranches(context, input.issueNumber);
+        if (branches.length !== 1)
+            throw new DeliveryError('Issue-only PR inspection requires one GitHub-linked issue branch. After publication, supply the exact issue and PR numbers (CLI --issue and --pr) to verify the native PR closing-issue association.');
+        const branch = branches[0].name;
+        const matches = await matchingPrs(context, branch);
+        if (matches.length !== 1)
+            throw new DeliveryError('Select an explicit PR number when the remote issue branch has zero or multiple PRs.');
+        number = matches[0].number;
     }
-    if (input.issueNumber === undefined)
-        throw new DeliveryError('Provide an issue or PR number.');
-    const row = getIssueWorktreeStrict(input.issueNumber, context.root);
-    const matches = (await context.clients.rest.pulls.list({
-        ...context.repo,
-        head: `${context.repo.owner}:${row.branch}`,
-        state: 'open',
-        per_page: 100,
-    })).data;
-    if (matches.length > 1)
-        throw new DeliveryError('Multiple open PRs match the registered branch.');
-    const pr = matches[0];
-    return pr
-        ? {
-            number: pr.number,
-            state: pr.state,
-            headSha: pr.head.sha,
-            baseSha: pr.base.sha,
-            draft: pr.draft ?? null,
-            authorLogin: pr.user?.login ?? null,
-            url: pr.html_url,
-        }
-        : { number: null, state: null, headSha: null, baseSha: null, draft: null, authorLogin: null, url: null };
+    const pr = input.issueNumber === undefined
+        ? await getPr(context, number)
+        : await verifyIssuePr(context, input.issueNumber, number, nonClosing);
+    return {
+        prNumber: pr.number,
+        url: pr.html_url,
+        state: pr.state,
+        draft: pr.draft,
+        headSha: pr.head.sha,
+        headBranch: pr.head.ref,
+        baseBranch: pr.base.ref,
+        merged: pr.merged,
+    };
 }
 export async function listPrs(context, state = 'open') {
     const prs = await context.clients.rest.paginate(context.clients.rest.pulls.list, {
@@ -299,42 +498,6 @@ export async function prChecks(context, prNumber) {
         })),
     };
 }
-export async function checkoutPr(context, prNumber) {
-    if (!Number.isSafeInteger(prNumber) || prNumber <= 0)
-        throw new DeliveryError('PR number must be positive.');
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
-    const repository = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
-    if (pr.state !== 'open' ||
-        pr.head.repo?.full_name.toLowerCase() !== repository ||
-        pr.base.repo?.full_name.toLowerCase() !== repository ||
-        gitExitCode(context.root, 'check-ref-format', '--branch', pr.head.ref) !== 0) {
-        throw new DeliveryError('PR checkout requires an open in-repository branch with a valid ref.');
-    }
-    const remoteHead = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${pr.head.ref}` })).data
-        .object.sha;
-    if (remoteHead !== pr.head.sha)
-        throw new DeliveryError('PR branch ref drifted from the observed head.');
-    const remote = resolveGitRemoteName(context.root, context.configuration?.remote);
-    const fetchedRef = `refs/remotes/${remote}/ai-delivery-pr-${prNumber}`;
-    await runAuthorGit(context, context.root, [
-        'fetch',
-        `https://github.com/${context.repo.owner}/${context.repo.repo}.git`,
-        `refs/heads/${pr.head.ref}:${fetchedRef}`,
-    ], 'fetch');
-    if (git(context.root, 'rev-parse', fetchedRef) !== pr.head.sha) {
-        throw new DeliveryError('Fetched PR branch disagrees with the live head.');
-    }
-    const live = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
-    if (live.state !== 'open' || live.head.sha !== pr.head.sha || live.head.ref !== pr.head.ref) {
-        throw new DeliveryError('PR changed during selected-App checkout.');
-    }
-    return preparePrWorktree({
-        headSha: pr.head.sha,
-        identity: context.config.roles.author.identity,
-        prNumber,
-        repoRoot: context.root,
-    });
-}
 function requiredApprovalCount(value) {
     if (typeof value !== 'object' || value === null)
         return null;
@@ -342,7 +505,15 @@ function requiredApprovalCount(value) {
     return typeof count === 'number' && Number.isSafeInteger(count) && count >= 0 ? count : null;
 }
 /** Check selected actors and rule evidence; publication also requires the configured author source. */
-export async function preflightReviewRoute(context, base = baseBranch(context.root, context.configuration?.remote), selectedReviewer, purpose = 'publication', control) {
+export async function preflightReviewRoute(context, base, selectedReviewer, purpose = 'publication', control) {
+    if (base === undefined) {
+        try {
+            base = (await context.clients.rest.repos.get({ ...context.repo })).data.default_branch;
+        }
+        catch {
+            throw new DeliveryError('Author cannot read the selected GitHub repository; verify configured access.');
+        }
+    }
     const check = async () => {
         await control?.checkResources();
         control?.signal.throwIfAborted();
@@ -364,6 +535,7 @@ export async function preflightReviewRoute(context, base = baseBranch(context.ro
         throw new DeliveryError('Author GitHub identity readback is incomplete.');
     }
     const reviewer = selectedReviewer ??
+        context.reviewerClients ??
         (await createDeliveryGitHubClients({
             config: context.config,
             identity: context.config.roles.reviewer.identity,
@@ -458,851 +630,431 @@ export async function preflightReviewRoute(context, base = baseBranch(context.ro
     };
 }
 export async function publishPr(context, input) {
-    const root = gitRoot(context.root);
-    const row = getIssueWorktreeStrict(input.issueNumber, root);
-    if (row.type !== 'issue' || row.status === 'merged')
-        throw new DeliveryError('PR publication requires an active issue worktree.');
-    const run = loadVerifiedRun(row.path, input.issueNumber);
-    const head = coordinate(row.path);
-    if (input.draft === false) {
-        const publication = loadPublication(row.path, input.issueNumber, head.sha);
-        const receipt = loadSubmittedReview(row.path, input.issueNumber, head.sha);
-        if (!receipt || receipt.publicationEvidenceId !== publication.evidenceId) {
-            throw new DeliveryError('Ready promotion requires a submitted review of the exact published head.');
-        }
-        await assertSubmittedReviewCurrent(context, receipt);
-        const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: publication.prNumber })).data;
-        if (pr.head.sha !== head.sha)
-            throw new DeliveryError('PR head drifted before ready promotion.');
-        if (pr.draft) {
-            await context.clients.graphql(`mutation Ready($id: ID!) { markPullRequestReadyForReview(input: {pullRequestId: $id}) { pullRequest { id isDraft } } }`, { id: pr.node_id });
+    const nonClosing = nonClosingMode(input.nonClosing);
+    if (input.prNumber !== undefined && (!Number.isSafeInteger(input.prNumber) || input.prNumber <= 0))
+        throw new DeliveryError('Existing PR selector must be a positive safe integer.');
+    const issue = nonClosing
+        ? await openReferenceIssue(context, input.issueNumber)
+        : (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
+    if ('pull_request' in issue || issue.number !== input.issueNumber || issue.state !== 'open')
+        throw new DeliveryError('PR creation requires the requested open GitHub issue.');
+    const repository = (await context.clients.rest.repos.get({ ...context.repo })).data;
+    if (repository.full_name?.toLowerCase() !== context.config.repository.toLowerCase() ||
+        context.config.repository.toLowerCase() !== `${context.repo.owner}/${context.repo.repo}`.toLowerCase())
+        throw new DeliveryError('Configured and selected GitHub repository identities disagree.');
+    if (nonClosing && !nativeId(repository.node_id))
+        throw new DeliveryError('Incomplete canonical non-closing repository node identity.');
+    const base = input.baseBranch ?? repository.default_branch;
+    if (base !== repository.default_branch)
+        throw new DeliveryError('PR delivery requires the repository default branch for durable issue association.');
+    validBranch(base);
+    if (input.headBranch !== undefined)
+        validBranch(input.headBranch);
+    const explicit = input.prNumber === undefined ? undefined : await getPr(context, input.prNumber);
+    const explicitPromotion = input.draft === false && input.headBranch !== undefined;
+    const selectedMatches = explicit
+        ? await matchingPrs(context, explicit.head.ref, base)
+        : explicitPromotion
+            ? await matchingPrs(context, input.headBranch, base)
+            : undefined;
+    const branch = explicit
+        ? explicit.head.ref
+        : explicitPromotion && selectedMatches.length > 0
+            ? input.headBranch
+            : await issueBranch(context, input.issueNumber, input.headBranch);
+    if (input.headBranch !== undefined && branch !== input.headBranch)
+        throw new DeliveryError('Explicit PR and head selectors disagree.');
+    validBranch(branch);
+    const ref = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${branch}` })).data;
+    if (ref.ref !== `refs/heads/${branch}` || ref.object.type !== 'commit' || !validSha(ref.object.sha))
+        throw new DeliveryError('Remote issue branch head/ref readback is invalid.');
+    const matches = selectedMatches ?? (await matchingPrs(context, branch, base));
+    if (matches.length > 1 || (explicit && (matches.length !== 1 || matches[0].number !== explicit.number)))
+        throw new DeliveryError('Remote issue branch has conflicting PR matches.');
+    let pr = explicit ?? (matches[0] === undefined ? undefined : await getPr(context, matches[0].number));
+    const requestedBody = input.body ??
+        (nonClosing ? (pr?.body ?? referenceLine(context, input.issueNumber)) : `Closes #${input.issueNumber}`);
+    if (!requestedBody.trim())
+        throw new DeliveryError('PR body must contain text.');
+    const body = nonClosing
+        ? nonClosingBody(context, input.issueNumber, requestedBody)
+        : new RegExp(`(?:close[sd]?|fix(?:es|ed)?|resolve[sd]?)\\s+#${input.issueNumber}(?![0-9])`, 'iu').test(requestedBody)
+            ? requestedBody
+            : `${requestedBody}\n\nCloses #${input.issueNumber}`;
+    const transition = nonClosing && pr !== undefined && pr.body !== body;
+    if (transition && (input.prNumber === undefined || input.body === undefined))
+        throw new DeliveryError('Non-closing body transition requires an explicit existing PR number and body.');
+    if (pr &&
+        (pr.head.sha !== ref.object.sha ||
+            pr.head.ref !== branch ||
+            pr.base.ref !== base ||
+            pr.state !== 'open' ||
+            pr.merged ||
+            (!transition && input.body !== undefined && pr.body !== body) ||
+            (input.title !== undefined && pr.title !== input.title)))
+        throw new DeliveryError('Existing remote PR conflicts with the requested branch, intent or state.');
+    const reviewRoute = nonClosing ? await nonClosingRoute(context, base) : await preflightReviewRoute(context, base);
+    if (pr && pr.user.login.toLowerCase() !== reviewRoute.author.actorLogin.toLowerCase())
+        throw new DeliveryError('Existing PR author differs from the configured authenticated author.');
+    if (pr && (typeof pr.node_id !== 'string' || !pr.node_id))
+        throw new DeliveryError('Existing PR publication identity is incomplete.');
+    if (nonClosing)
+        refuseClosingDirective(input.title ?? pr?.title ?? issue.title);
+    const creationTitle = input.title ?? issue.title;
+    let publicationBaseSha;
+    const existing = pr;
+    let pendingTransition = transition;
+    let expectedBody = pr?.body;
+    const transitionDraft = pr?.draft;
+    let promotionApplied = false;
+    const preserveIssue = async () => {
+        if (nonClosing)
+            sameReferenceIssue(issue, await openReferenceIssue(context, input.issueNumber));
+    };
+    const readExisting = async () => {
+        const current = await verifyIssuePr(context, input.issueNumber, existing.number, nonClosing && !pendingTransition);
+        if (current.state !== 'open' ||
+            current.merged ||
+            current.node_id !== existing.node_id ||
+            current.head.sha !== ref.object.sha ||
+            current.head.ref !== branch ||
+            current.base.ref !== base ||
+            current.base.sha !== existing.base.sha ||
+            current.user.login.toLowerCase() !== reviewRoute.author.actorLogin.toLowerCase() ||
+            (transition && !promotionApplied && current.draft !== transitionDraft) ||
+            current.body !== expectedBody ||
+            current.title !== existing.title)
+            throw new DeliveryError('Existing PR publication head, identity, intent or author readback drifted.');
+        if (pendingTransition) {
+            await verifyPrIssueAssociation(context, current.number, input.issueNumber, false, current.node_id, true, issue.node_id, repository.node_id);
+            refuseClosingDirective(current.title);
+            await verifyNonClosingCommits(context, current);
+            const baseRef = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${base}` })).data;
+            if (baseRef.ref !== `refs/heads/${base}` ||
+                baseRef.object.type !== 'commit' ||
+                baseRef.object.sha !== current.base.sha)
+                throw new DeliveryError('Non-closing transition default base drifted.');
+            sameReferencePr(current, await getPr(context, current.number));
         }
-        const readback = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: publication.prNumber }))
-            .data;
-        if (readback.draft || readback.head.sha !== head.sha)
-            throw new DeliveryError('PR ready readback failed.');
+        await preserveIssue();
+        return current;
+    };
+    const readNew = async () => {
+        const baseRef = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${base}` })).data;
+        if (baseRef.ref !== `refs/heads/${base}` || baseRef.object.type !== 'commit' || !validSha(baseRef.object.sha))
+            throw new DeliveryError('Incomplete publication default base.');
+        if (publicationBaseSha !== undefined && publicationBaseSha !== baseRef.object.sha)
+            throw new DeliveryError('Publication default base drifted before creation.');
+        publicationBaseSha = baseRef.object.sha;
+        if (nonClosing)
+            await verifyUnpublishedCommits(context, baseRef.object.sha, ref.object.sha);
+        const afterHead = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${branch}` })).data;
+        const afterBase = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${base}` })).data;
+        if (afterHead.ref !== ref.ref ||
+            afterHead.object.type !== 'commit' ||
+            afterHead.object.sha !== ref.object.sha ||
+            afterBase.ref !== baseRef.ref ||
+            afterBase.object.type !== 'commit' ||
+            afterBase.object.sha !== baseRef.object.sha)
+            throw new DeliveryError('Non-closing publication head/base drifted.');
+        await preserveIssue();
+    };
+    if (pr)
+        pr = await readExisting();
+    else
+        await readNew();
+    if (input.dryRun)
         return {
-            prNumber: publication.prNumber,
-            url: readback.html_url,
-            publicationEvidenceId: publication.evidenceId,
-            reviewState: await readRequiredReviewState(context, publication.prNumber, head.sha),
+            dryRun: true,
+            ...(pr === undefined ? {} : { prNumber: pr.number, draft: pr.draft }),
+            ...(nonClosing
+                ? {
+                    nonClosing: true,
+                    nonClosingVerified: pr !== undefined && !pendingTransition,
+                    body,
+                    bodyTransition: pendingTransition,
+                }
+                : {}),
+            headSha: ref.object.sha,
+            headBranch: branch,
+            baseBranch: base,
+            reviewRoute,
         };
+    let created = false;
+    if (pr) {
+        if (pendingTransition) {
+            pr = await readExisting();
+            await context.clients.rest.pulls.update({ ...context.repo, pull_number: pr.number, body });
+            pendingTransition = false;
+            expectedBody = body;
+            pr = await readExisting();
+        }
+        if (input.draft === false && pr.draft) {
+            pr = await readExisting();
+            if (pr.draft) {
+                const promoted = await context.clients.graphql('mutation DeliveryReadyPr($id:ID!){markPullRequestReadyForReview(input:{pullRequestId:$id}){pullRequest{id isDraft}}}', { id: pr.node_id });
+                if (promoted?.markPullRequestReadyForReview?.pullRequest?.id !== pr.node_id ||
+                    promoted.markPullRequestReadyForReview.pullRequest.isDraft !== false)
+                    throw new DeliveryError('PR promotion mutation readback is incomplete or conflicting; reconcile this PR.');
+                promotionApplied = true;
+            }
+            pr = await readExisting();
+            if (pr.draft)
+                throw new DeliveryError('PR promotion readback is still draft.');
+        }
     }
-    const prepublication = loadPrepublicationArtifact(row.path, input.issueNumber, head.sha);
-    const approval = prepublication
-        ? reviewArtifactApproval({
-            artifact: prepublication,
-            classification: run.classification,
-            config: context.config,
-            issueNumber: input.issueNumber,
-        })
-        : undefined;
-    const evidence = await createIssuePhaseEvidence({
-        personalAuth: context.clients.authSource === 'personal' && context.config.roles.author.authSource !== 'personal',
-        ...(approval === undefined ? {} : { approval }),
-        issueNumber: input.issueNumber,
-        phase: 'publish',
-        repoRoot: row.path,
-    });
-    const issue = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
-    const title = input.title ?? `${input.issueNumber}: ${issue.title}`;
-    const body = input.body ?? `Closes #${input.issueNumber}\n\n## Delivery Impact\n\nRoadmap impact: none\nDocs impact: none\n`;
-    validateDeliveryImpact(body);
-    const remoteHead = (await context.clients.rest.git.getRef({
-        ...context.repo,
-        ref: `heads/${baseBranch(root, context.configuration?.remote)}`,
-    })).data.object.sha;
-    if (remoteHead !== run.classification.base.sha)
-        throw new DeliveryError('Remote base changed after exact-head verification.');
-    const reviewRoute = await preflightReviewRoute(context, baseBranch(root, context.configuration?.remote));
-    const matches = (await context.clients.rest.pulls.list({
-        ...context.repo,
-        head: `${context.repo.owner}:${row.branch}`,
-        state: 'open',
-        per_page: 100,
-    })).data;
-    if (matches.length > 1)
-        throw new DeliveryError('Multiple open PRs match the registered branch.');
-    const existing = matches[0];
-    if (existing?.user?.login && existing.user.login.toLowerCase() !== reviewRoute.author.actorLogin.toLowerCase()) {
-        throw new DeliveryError('Existing PR author differs from the configured author actor; inspect the PR and resolve the actor mismatch explicitly.');
+    else {
+        await readNew();
+        let response;
+        try {
+            response = await context.clients.rest.pulls.create({
+                ...context.repo,
+                head: branch,
+                base,
+                title: creationTitle,
+                body,
+                draft: input.draft !== false,
+            });
+        }
+        catch (error) {
+            throw new DeliveryError(`PR creation acknowledgement is uncertain; reconcile the remote head read-only before any new mutation. ${error instanceof Error ? error.message : 'Unknown failure'}`);
+        }
+        if (!Number.isSafeInteger(response.data.number) || response.data.number <= 0)
+            throw new DeliveryError('PR creation acknowledgement lacks a valid PR identity; reconcile the remote head read-only, do not create again.');
+        created = true;
+        try {
+            pr = await getPr(context, response.data.number);
+        }
+        catch (error) {
+            throw new DeliveryError(`GitHub returned created PR #${response.data.number}; identity readback is unresolved. Reconcile read-only; do not create again. ${error instanceof Error ? error.message : 'Unknown failure'}`);
+        }
     }
-    await pushReviewedHead(context, row.path, row.branch, head.sha);
-    const pr = existing
-        ? (await context.clients.rest.pulls.get({ ...context.repo, pull_number: existing.number })).data
-        : (await context.clients.rest.pulls.create({
-            ...context.repo,
-            base: baseBranch(root, context.configuration?.remote),
-            body,
-            draft: true,
-            head: row.branch,
-            title,
-        })).data;
-    if (pr.head.sha !== head.sha || pr.base.sha !== remoteHead || pr.state !== 'open' || !pr.draft) {
-        throw new DeliveryError('Draft PR readback does not match the verified head and base.');
+    try {
+        if (created &&
+            (pr.body !== body ||
+                pr.title !== creationTitle ||
+                pr.draft !== (input.draft !== false) ||
+                pr.state !== 'open' ||
+                pr.merged ||
+                pr.base.sha !== publicationBaseSha))
+            throw new DeliveryError('Created PR body, title, draft/open state or default base differs from publication intent.');
+        if (pr.head.sha !== ref.object.sha || pr.head.ref !== branch || pr.base.ref !== base)
+            throw new DeliveryError('GitHub PR creation readback drifted.');
+        if (pr.user.login.toLowerCase() !== reviewRoute.author.actorLogin.toLowerCase())
+            throw new DeliveryError('Published PR author differs from the configured authenticated author.');
+        if (nonClosing) {
+            const verified = await verifyIssuePr(context, input.issueNumber, pr.number, true);
+            sameReferencePr(pr, verified);
+            pr = verified;
+            await preserveIssue();
+        }
+        else
+            await verifyPrIssueAssociation(context, pr.number, input.issueNumber);
+        if (created) {
+            const final = await getPr(context, pr.number);
+            sameReferencePr(pr, final);
+            pr = final;
+        }
     }
-    if (!pr.user?.login || pr.user.login.toLowerCase() !== reviewRoute.author.actorLogin.toLowerCase()) {
-        throw new DeliveryError('Published PR author differs from the selected author credential; inspect the PR before continuing.');
+    catch (error) {
+        if (!created)
+            throw error;
+        throw new DeliveryError(`GitHub created PR #${pr.number} (${pr.html_url}) at ${pr.head.sha}; post-publication association/identity verification is unresolved. Reconcile this PR read-only; do not create again. ${error instanceof Error ? error.message : 'Unknown failure'}`);
     }
-    const content = {
-        baseSha: remoteHead,
-        evidenceId: evidence.evidenceId,
-        headSha: head.sha,
-        issueNumber: input.issueNumber,
+    return {
         prNumber: pr.number,
-        schemaVersion: 'ai-delivery.publication@1',
+        url: pr.html_url,
+        headSha: pr.head.sha,
+        draft: pr.draft,
+        reviewRoute,
+        ...(nonClosing ? { nonClosing: true } : {}),
     };
-    const publication = PublicationSchema.parse({ ...content, publicationId: digestValue(content) });
-    writePrivateJsonFileAtomically(publicationPath(row.path, input.issueNumber, head.sha), publication);
-    await updateIssueWorktreeDelivery({
-        branch: row.branch,
-        issueNumber: input.issueNumber,
-        path: row.path,
-        prNumber: pr.number,
-        projectRoot: root,
-        status: 'pr-published',
-    });
-    return { prNumber: pr.number, url: pr.html_url, publicationEvidenceId: evidence.evidenceId, reviewRoute };
 }
 export async function submitFormalReview(context, input) {
-    const row = getIssueWorktreeStrict(input.issueNumber, context.root);
-    const run = loadVerifiedRun(row.path, input.issueNumber);
-    const publication = loadPublication(row.path, input.issueNumber, run.classification.head.sha);
-    if (publication.prNumber !== input.prNumber)
-        throw new DeliveryError('Review PR does not match exact publication.');
-    const receipt = await submitReview({
-        artifact: parseReviewArtifact(input.artifact),
-        classification: run.classification,
+    const nonClosing = nonClosingMode(input.nonClosing);
+    const pr = await verifyIssuePr(context, input.issueNumber, input.prNumber, nonClosing);
+    const issue = nonClosing ? await openReferenceIssue(context, input.issueNumber) : undefined;
+    const result = await submitReview({
         context,
+        artifact: parseReviewArtifact(input.artifact),
         issueNumber: input.issueNumber,
         prNumber: input.prNumber,
-        publicationEvidenceId: publication.evidenceId,
-    });
-    return {
-        receiptId: receipt.receiptId,
-        githubReviewId: receipt.githubReviewId,
-        reviewState: await readRequiredReviewState(context, input.prNumber, run.classification.head.sha, {
-            id: receipt.githubReviewId,
-            login: receipt.login,
-        }),
-    };
-}
-async function checkPrMergeability(context, prNumber, expectedHead) {
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: prNumber })).data;
-    if (pr.state !== 'open' || pr.draft || pr.head.sha !== expectedHead)
-        throw new DeliveryError('PR is not clean, ready and mergeable at the exact reviewed head.');
-    const reviewState = await readRequiredReviewState(context, prNumber, expectedHead);
-    if (reviewState.status === 'still-required') {
-        throw new DeliveryError(`The submitted APPROVED review is stored, but GitHub still requires a qualifying approval. ${reviewState.nextAction}`);
-    }
-    if (reviewState.status === 'changes-requested') {
-        throw new DeliveryError(`GitHub reports changes requested. ${reviewState.nextAction}`);
-    }
-    if (pr.mergeable !== true || pr.mergeable_state !== 'clean')
-        throw new DeliveryError('PR is not clean, ready and mergeable at the exact reviewed head.');
-    const issueNumber = Number(/^issue\/(\d+)$/u.exec(pr.head.ref)?.[1]);
-    if (!Number.isSafeInteger(issueNumber))
-        throw new DeliveryError('PR branch is not a registered issue branch.');
-    const relationships = await getNativeBlockerRelationships({
-        graphql: context.clients.graphql,
-        issueNumber,
-        repo: context.repo,
-    });
-    const blockedBy = relationships.blockers.filter((value) => value.state === 'OPEN').map((value) => value.number);
-    const [checks, statuses] = await Promise.all([
-        context.clients.rest.checks.listForRef({ ...context.repo, ref: expectedHead, per_page: 100 }),
-        context.clients.rest.repos.getCombinedStatusForRef({ ...context.repo, ref: expectedHead }),
-    ]);
-    const checksPassed = checks.data.total_count === checks.data.check_runs.length &&
-        checks.data.check_runs.every((check) => check.status === 'completed' && ['success', 'neutral', 'skipped'].includes(check.conclusion ?? '')) &&
-        (statuses.data.statuses.length === 0 || statuses.data.state === 'success');
-    if (!checksPassed || blockedBy.length > 0)
-        throw new DeliveryError('PR has failed or pending checks or unresolved native blockers.');
-    return {
-        baseSha: pr.base.sha,
-        baseBranch: pr.base.ref,
-        headBranch: pr.head.ref,
-        title: pr.title,
-        blockedBy,
-        checksPassed,
-    };
-}
-/** @internal Lifecycle primitive; exported for local interruption tests. */
-export async function mergeWithExactLease(context, input) {
-    if (gitExitCode(input.worktreePath, 'merge-base', '--is-ancestor', input.baseSha, input.headSha) !== 0) {
-        throw new DeliveryError('Exact-lease merge requires the verified base to be an ancestor of the reviewed head.');
-    }
-    const latest = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-    if (latest.base.sha !== input.baseSha ||
-        latest.head.sha !== input.headSha ||
-        latest.base.ref !== input.baseBranch ||
-        latest.head.ref !== input.headBranch)
-        throw new DeliveryError('Exact base or head drifted before atomic merge.');
-    const repo = await context.clients.graphql('query RepositoryId($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { id } }', { owner: context.repo.owner, name: context.repo.repo });
-    if (!repo.repository?.id)
-        throw new DeliveryError('GitHub omitted repository node identity.');
-    input.beforeMutation?.();
-    const created = (await context.clients.rest.git.createCommit({
-        ...context.repo,
-        message: input.title,
-        parents: [input.baseSha, input.headSha],
-        tree: input.headTree,
-    })).data;
-    const mergeSha = Sha.parse(created.sha);
-    input.onPreparedMergeCommit?.(mergeSha);
-    const clientMutationId = `ai-delivery-exact-${mergeSha}`;
-    const response = await context.clients.graphql('mutation UpdateExactRefs($input: UpdateRefsInput!) { updateRefs(input: $input) { clientMutationId } }', {
-        input: {
-            clientMutationId,
-            repositoryId: repo.repository.id,
-            refUpdates: [
-                { name: `refs/heads/${input.baseBranch}`, beforeOid: input.baseSha, afterOid: mergeSha, force: false },
-                { name: `refs/heads/${input.headBranch}`, beforeOid: input.headSha, afterOid: input.headSha, force: false },
-            ],
-        },
+        ...(input.dryRun === undefined ? {} : { dryRun: input.dryRun }),
     });
-    if (response.updateRefs.clientMutationId !== clientMutationId)
-        throw new DeliveryError('Atomic merge mutation identity readback failed.');
-    const [base, head, commit] = await Promise.all([
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${input.baseBranch}` }),
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${input.headBranch}` }),
-        context.clients.rest.git.getCommit({ ...context.repo, commit_sha: mergeSha }),
-    ]);
-    if (base.data.object.sha !== mergeSha ||
-        head.data.object.sha !== input.headSha ||
-        commit.data.tree.sha !== input.headTree ||
-        commit.data.parents[0]?.sha !== input.baseSha ||
-        commit.data.parents[1]?.sha !== input.headSha)
-        throw new DeliveryError('Atomic merge ref or commit readback failed.');
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-    if (pr.state !== 'closed' || !pr.merged_at || pr.merge_commit_sha !== mergeSha) {
-        throw new DeliveryError('GitHub did not report the exact merge commit as the completed PR.');
+    if (nonClosing) {
+        sameReferencePr(pr, await verifyIssuePr(context, input.issueNumber, input.prNumber, true));
+        sameReferenceIssue(issue, await openReferenceIssue(context, input.issueNumber));
     }
-    return mergeSha;
+    return result;
 }
-async function readMergedResult(context, intent, expectedSha) {
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: intent.prNumber })).data;
-    if (pr.state !== 'closed' ||
-        !pr.merged_at ||
-        pr.head.sha !== intent.headSha ||
-        pr.head.ref !== intent.headBranch ||
-        pr.base.ref !== intent.baseBranch) {
-        throw new DeliveryError('Merged PR does not match the exact prepared merge intent.');
+async function allReviews(context, prNumber) {
+    const reviews = [];
+    for (let page = 1; page <= 20; page++) {
+        const batch = (await context.clients.rest.pulls.listReviews({ ...context.repo, pull_number: prNumber, page, per_page: 100 })).data;
+        reviews.push(...batch);
+        if (batch.length < 100)
+            return reviews;
     }
-    const mergeSha = Sha.parse(pr.merge_commit_sha);
-    if (expectedSha !== undefined && mergeSha !== expectedSha) {
-        throw new DeliveryError('Merged PR does not match the exact prepared merge intent.');
-    }
-    const [base, head, commit] = await Promise.all([
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${intent.baseBranch}` }),
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${intent.headBranch}` }).catch((error) => {
-            if (error.status === 404)
-                return null;
-            throw error;
-        }),
-        context.clients.rest.git.getCommit({ ...context.repo, commit_sha: mergeSha }),
-    ]);
-    const expectedMergeTree = !intent.exactBaseHeadLease && (intent.strategy === 'merge' || intent.strategy === 'squash')
-        ? git(context.root, 'merge-tree', '--write-tree', intent.baseSha, intent.headSha)
-        : intent.headTree;
-    if (!base.data.object.sha ||
-        (head !== null && head.data.object.sha !== intent.headSha) ||
-        commit.data.sha !== mergeSha ||
-        (intent.strategy === 'merge' &&
-            (commit.data.parents[0]?.sha !== intent.baseSha ||
-                commit.data.parents[1]?.sha !== intent.headSha ||
-                commit.data.tree.sha !== expectedMergeTree)) ||
-        (intent.strategy === 'squash' &&
-            (commit.data.parents[0]?.sha !== intent.baseSha || commit.data.tree.sha !== expectedMergeTree))) {
-        throw new DeliveryError('Remote merge ref, branch or commit readback disagrees with the prepared intent.');
-    }
-    if (expectedSha === undefined && intent.strategy === 'rebase') {
-        throw new DeliveryError('Rebase recovery lacks the returned exact merge SHA.');
-    }
-    return { mergeSha, mergeTree: Sha.parse(commit.data.tree.sha) };
-}
-async function expectedMergeAttempt(context, intent) {
-    if (context.clients.role !== 'author' || !context.clients.authenticatedAuthor) {
-        throw new DeliveryError('Merge recovery requires authenticated author identity readback.');
-    }
-    const verified = await context.clients.authenticatedAuthor();
-    if (!verified.actorLogin || !verified.credentialIdentity) {
-        throw new DeliveryError('Authenticated author identity readback is incomplete.');
-    }
-    const content = {
-        actor: context.config.roles.author.identity,
-        actorLogin: verified.actorLogin,
-        authSource: context.clients.authSource,
-        credentialIdentity: verified.credentialIdentity,
-        intentId: intent.intentId,
-        operation: intent.exactBaseHeadLease ? 'updateRefs' : 'pulls.merge',
-        schemaVersion: 'ai-delivery.merge-attempt@1',
-    };
-    return MergeAttemptSchema.parse({ ...content, attemptId: digestValue(content) });
-}
-function persistMergeResult(root, intent, attempt, mergeSha) {
-    const content = {
-        attemptId: attempt.attemptId,
-        mergeSha: Sha.parse(mergeSha),
-        schemaVersion: 'ai-delivery.merge-result@1',
-    };
-    writePrivateJsonFileAtomically(mergeResultPath(root, intent.issueNumber, intent.headSha), MergeResultSchema.parse({ ...content, resultId: digestValue(content) }));
-}
-/** @internal Lifecycle primitive; exported for local interruption tests. */
-export async function persistMergedResult(context, input) {
-    const { mergeSha, mergeTree } = await readMergedResult(context, input.intent, input.expectedSha);
-    const { schemaVersion: _version, ...intentContent } = input.intent;
-    const content = { ...intentContent, mergeSha, mergeTree, schemaVersion: 'ai-delivery.merge@3' };
-    const merged = MergeSchema.parse({ ...content, mergeId: digestValue(content) });
-    writePrivateJsonFileAtomically(input.path, merged);
-    await updateIssueWorktreeDelivery({
-        branch: input.branch,
-        issueNumber: input.intent.issueNumber,
-        path: input.worktreePath,
-        projectRoot: context.root,
-        status: 'merged',
-    });
-    return merged;
-}
-async function validateTerminalMerge(context, row, run, publication, existing) {
-    const head = run.classification.head;
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: existing.prNumber })).data;
-    if (existing.prNumber !== row.prNumber ||
-        existing.issueNumber !== row.issueNumber ||
-        existing.headSha !== head.sha ||
-        publication.prNumber !== existing.prNumber ||
-        publication.issueNumber !== existing.issueNumber ||
-        publication.headSha !== head.sha ||
-        publication.baseSha !== run.classification.base.sha ||
-        pr.state !== 'closed' ||
-        !pr.merged_at ||
-        pr.head.sha !== head.sha ||
-        pr.head.ref !== row.branch ||
-        pr.merge_commit_sha !== existing.mergeSha)
-        throw new DeliveryError('Merged PR readback or publication disagrees with terminal receipt.');
-    const intent = readOptionalPrivate(mergeIntentPath(row.path, existing.issueNumber, head.sha), (value) => MergeIntentSchema.parse(value));
-    if (!intent ||
-        intent.intentId !== existing.intentId ||
-        intent.baseSha !== run.classification.base.sha ||
-        intent.headSha !== head.sha ||
-        intent.headTree !== head.tree)
-        throw new DeliveryError('Terminal merge lacks its exact verified intent.');
-    const historicalReview = loadSubmittedReview(row.path, existing.issueNumber, head.sha);
-    if (!historicalReview ||
-        historicalReview.prNumber !== existing.prNumber ||
-        historicalReview.headSha !== head.sha ||
-        historicalReview.artifact.issueNumber !== existing.issueNumber ||
-        historicalReview.artifact.head.tree !== head.tree ||
-        historicalReview.artifact.diffScopeHash !== digestValue(run.classification.changedPaths) ||
-        historicalReview.artifact.verdict !== 'approve' ||
-        historicalReview.publicationEvidenceId !== publication.evidenceId ||
-        historicalReview.receiptId !== intent.reviewReceiptId)
-        throw new DeliveryError('Terminal merge publication lacks its exact historical approved review.');
-    const result = await readMergedResult(context, intent, existing.mergeSha);
-    if (result.mergeTree !== existing.mergeTree)
-        throw new DeliveryError('Terminal merge tree changed.');
-    const { schemaVersion: _version, ...intentContent } = intent;
-    const expected = { ...intentContent, ...result, schemaVersion: 'ai-delivery.merge@3' };
-    if (existing.mergeId !== digestValue(expected))
-        throw new DeliveryError('Terminal merge receipt disagrees with its intent.');
-}
-/** @internal Read-only ancestor validation for the locked committed-descendant continuation. */
-export async function readMergedContinuationTerminal(context, row, operator) {
-    if (row.status !== 'merged' || row.prNumber === undefined || row.issueNumber === undefined)
-        throw new DeliveryError('Committed continuation requires exact merged issue custody.');
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: row.prNumber })).data;
-    const historical = loadHistoricalMergedRun(row.path, Sha.parse(pr.head.sha));
-    const head = historical.run.classification.head.sha;
-    const publication = loadPublication(row.path, row.issueNumber, head);
-    const path = mergePath(row.path, row.issueNumber, head);
-    const terminal = readOptionalPrivate(path, (value) => MergeSchema.parse(value));
-    if (!terminal || !historical.run.writer || historical.run.classification.repository !== context.config.repository)
-        throw new DeliveryError('Committed continuation lacks supported exact historical terminal provenance.');
-    await validateTerminalMerge(context, row, historical.run, publication, terminal);
-    const lineage = await context.clients.graphql(`query CommittedContinuationLineage($owner: String!, $repo: String!, $number: Int!) {
-    repository(owner: $owner, name: $repo) { pullRequest(number: $number) {
-      closingIssuesReferences(first: 100) { nodes { number repository { nameWithOwner } } pageInfo { hasNextPage } }
-    } }
-  }`, { ...context.repo, number: row.prNumber });
-    const closing = z
-        .object({
-        nodes: z.array(z.object({ number: z.number().int().positive(), repository: z.object({ nameWithOwner: z.string().min(1) }) })),
-        pageInfo: z.object({ hasNextPage: z.literal(false) }),
-    })
-        .safeParse(lineage.repository?.pullRequest?.closingIssuesReferences);
-    if (!closing.success ||
-        pr.head.repo?.full_name.toLowerCase() !== context.config.repository.toLowerCase() ||
-        pr.base.repo.full_name.toLowerCase() !== context.config.repository.toLowerCase())
-        throw new DeliveryError('Native PR lineage does not establish the exact repository and complete closing connection.');
-    if (closing.data.nodes.some((issue) => issue.number === row.issueNumber &&
-        issue.repository.nameWithOwner.toLowerCase() === context.config.repository.toLowerCase())) {
-        await readNativeWorktreePrLineage(context, row.issueNumber, row.prNumber);
-    }
-    else {
-        const mergedAt = Date.parse(pr.merged_at ?? '');
-        if (closing.data.nodes.length !== 0 ||
-            !new RegExp(`^Refs[ \\t]+#${String(row.issueNumber)}(?=$|[ \\t.,;:!?])`, 'imu').test(pr.body ?? '') ||
-            !Number.isFinite(mergedAt) ||
-            !pr.merged ||
-            pr.head.ref !== row.branch ||
-            !pr.base.ref ||
-            !Sha.safeParse(pr.base.sha).success ||
-            pr.merge_commit_sha !== terminal.mergeSha)
-            throw new DeliveryError('Native PR lineage lacks the exact unfinished Refs relationship.');
-        const reference = z.object({
-            event: z.literal('cross-referenced'),
-            actor: z.object({ login: z.string(), id: z.number().int().positive(), type: z.literal('User') }),
-            created_at: z.string(),
-            source: z.object({
-                type: z.literal('issue'),
-                issue: z.object({
-                    number: z.number().int().positive(),
-                    user: z.object({ login: z.string(), id: z.number().int().positive(), type: z.literal('User') }),
-                    repository_url: z.string(),
-                    html_url: z.string(),
-                    pull_request: z.object({ url: z.string() }),
-                }),
-            }),
-        });
-        let matched = false;
-        // Read every page before accepting even a matching first-page reference.
-        for (let page = 1;; page += 1) {
-            const events = await context.clients.rest.issues.listEventsForTimeline({
-                ...context.repo,
-                issue_number: row.issueNumber,
-                per_page: 100,
-                page,
-            });
-            if (!Array.isArray(events.data))
-                throw new DeliveryError('Native PR lineage timeline is incomplete.');
-            for (const event of events.data) {
-                const parsed = reference.safeParse(event);
-                if (!parsed.success)
-                    continue;
-                const native = parsed.data;
-                const at = Date.parse(native.created_at);
-                matched ||=
-                    Number.isFinite(at) &&
-                        at < mergedAt &&
-                        native.actor.login.toLowerCase() === operator.actorLogin.toLowerCase() &&
-                        `user:${String(native.actor.id)}` === operator.credentialIdentity &&
-                        native.source.issue.number === row.prNumber &&
-                        native.source.issue.user.login.toLowerCase() === operator.actorLogin.toLowerCase() &&
-                        `user:${String(native.source.issue.user.id)}` === operator.credentialIdentity &&
-                        native.source.issue.repository_url === pr.base.repo.url &&
-                        native.source.issue.html_url === pr.html_url &&
-                        native.source.issue.pull_request.url === pr.url;
-            }
-            if (events.data.length < 100 && !/;\s*rel="next"/u.test(events.headers.link ?? ''))
-                break;
-        }
-        if (!matched)
-            throw new DeliveryError('Native PR lineage lacks complete authenticated before-merge cross-reference evidence.');
-    }
-    const attemptPath = mergeAttemptPath(row.path, row.issueNumber, head);
-    const resultPath = mergeResultPath(row.path, row.issueNumber, head);
-    const attempt = readOptionalPrivate(attemptPath, (value) => MergeAttemptSchema.parse(value));
-    const result = readOptionalPrivate(resultPath, (value) => MergeResultSchema.parse(value));
-    if (pr.number !== row.prNumber ||
-        pr.user?.type !== 'User' ||
-        pr.user.login.toLowerCase() !== operator.actorLogin.toLowerCase() ||
-        `user:${String(pr.user.id)}` !== operator.credentialIdentity ||
-        !attempt ||
-        attempt.authSource !== 'personal' ||
-        attempt.actorLogin.toLowerCase() !== operator.actorLogin.toLowerCase() ||
-        attempt.credentialIdentity !== operator.credentialIdentity ||
-        attempt.intentId !== terminal.intentId ||
-        !result ||
-        result.attemptId !== attempt.attemptId ||
-        result.mergeSha !== terminal.mergeSha)
-        throw new DeliveryError('Committed continuation authenticated host author disagrees with native historical custody.');
-    return {
-        terminal,
-        preserved: [
-            historical.path,
-            publicationPath(row.path, row.issueNumber, head),
-            join(gitCommonDir(row.path), 'ai-delivery', 'reviews', String(row.issueNumber), `${head}.json`),
-            mergeIntentPath(row.path, row.issueNumber, head),
-            attemptPath,
-            resultPath,
-            path,
-        ].map((file) => ({ path: file, digest: digestBytes(assertPrivateFile(file)) })),
-    };
+    throw new DeliveryError('GitHub review history exceeds the bounded readback window.');
 }
 export async function mergePr(context, input) {
-    const row = getIssueWorktreeStrict(input.issueNumber, context.root);
-    const receiptRoot = existsSync(row.path) ? row.path : context.root;
-    const run = receiptRoot === row.path
-        ? loadVerifiedRun(row.path, input.issueNumber)
-        : loadRemovedMergedRun(context.root, input.issueNumber);
-    const head = run.classification.head;
-    const publication = loadPublication(receiptRoot, input.issueNumber, head.sha);
-    if (publication.prNumber !== input.prNumber ||
-        publication.issueNumber !== input.issueNumber ||
-        publication.headSha !== head.sha ||
-        publication.baseSha !== run.classification.base.sha)
-        throw new DeliveryError('Merge publication does not match its exact issue, PR or verified coordinates.');
-    const existingPath = mergePath(receiptRoot, input.issueNumber, head.sha);
-    const existing = readOptionalPrivate(existingPath, (value) => MergeSchema.parse(value));
-    if (existing) {
-        await validateTerminalMerge(context, { ...row, path: receiptRoot, prNumber: input.prNumber }, run, publication, existing);
-        await updateIssueWorktreeDelivery({
-            branch: row.branch,
-            issueNumber: input.issueNumber,
-            path: row.path,
-            projectRoot: context.root,
-            status: 'merged',
-        });
-        return existing;
-    }
-    if (receiptRoot !== row.path) {
-        throw new DeliveryError('Removed merged worktree lacks its terminal merge receipt.');
-    }
-    const intentPath = mergeIntentPath(row.path, input.issueNumber, head.sha);
-    const prepared = readOptionalPrivate(intentPath, (value) => MergeIntentSchema.parse(value));
-    const attemptPath = mergeAttemptPath(row.path, input.issueNumber, head.sha);
-    const priorAttempt = readOptionalPrivate(attemptPath, (value) => MergeAttemptSchema.parse(value));
-    const priorResult = readOptionalPrivate(mergeResultPath(row.path, input.issueNumber, head.sha), (value) => MergeResultSchema.parse(value));
-    if ((priorAttempt !== null || priorResult !== null) && prepared === null) {
-        throw new DeliveryError('Merge operation record lacks its prepared intent.');
-    }
-    const review = loadSubmittedReview(row.path, input.issueNumber, head.sha);
-    if (!review || review.prNumber !== input.prNumber || review.publicationEvidenceId !== publication.evidenceId) {
-        throw new DeliveryError('Exact publication lacks its bound submitted independent review.');
-    }
-    await assertSubmittedReviewCurrent(context, review);
-    if (prepared) {
-        if (prepared.issueNumber !== input.issueNumber ||
-            prepared.prNumber !== input.prNumber ||
-            prepared.headSha !== head.sha ||
-            prepared.headTree !== head.tree ||
-            prepared.reviewReceiptId !== review.receiptId ||
-            prepared.headBranch !== row.branch ||
-            prepared.baseSha !== run.classification.base.sha ||
-            (input.strategy !== undefined && input.strategy !== prepared.strategy)) {
-            throw new DeliveryError('Prepared merge intent disagrees with this retry.');
-        }
-        if (priorAttempt !== null) {
-            const expected = await expectedMergeAttempt(context, prepared);
-            if (priorAttempt.attemptId !== expected.attemptId ||
-                (priorResult !== null && priorResult.attemptId !== priorAttempt.attemptId)) {
-                throw new DeliveryError('Merge attempt disagrees with its exact source, operation or author.');
-            }
-            const remote = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-            if (remote.state !== 'closed' || !remote.merged_at) {
-                throw new DeliveryError('Merge mutation was attempted; remote readback is unresolved. Retry readback without another mutation.');
-            }
-            return persistMergedResult(context, {
-                branch: row.branch,
-                intent: prepared,
-                path: existingPath,
-                worktreePath: row.path,
-                ...(priorResult === null ? {} : { expectedSha: priorResult.mergeSha }),
-            });
-        }
-        if (priorResult !== null)
-            throw new DeliveryError('Merge result lacks its bound attempt.');
-        const remote = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-        if (remote.state === 'closed' && remote.merged_at) {
-            return persistMergedResult(context, {
-                branch: row.branch,
-                intent: prepared,
-                path: existingPath,
-                worktreePath: row.path,
-            });
-        }
-        if (remote.state !== 'open' ||
-            remote.head.sha !== head.sha ||
-            remote.head.ref !== row.branch ||
-            remote.base.ref !== prepared.baseBranch ||
-            remote.base.sha !== prepared.baseSha) {
-            throw new DeliveryError('Prepared merge retry disagrees with the remote PR.');
+    const nonClosing = nonClosingMode(input.nonClosing);
+    if (nonClosing && input.strategy !== undefined && input.strategy !== 'squash')
+        throw new DeliveryError('Non-closing merge requires squash with explicit safe messages.');
+    if (context.clients.role !== 'author' ||
+        context.clients.authSource !== (context.config.roles.author.authSource ?? 'app') ||
+        !context.clients.authenticatedAuthor)
+        throw new DeliveryError('Merge and finish require the configured authenticated author role.');
+    const author = await context.clients.authenticatedAuthor();
+    if (!author.actorLogin || !author.credentialIdentity)
+        throw new DeliveryError('Author identity readback is incomplete.');
+    let pr = await verifyIssuePr(context, input.issueNumber, input.prNumber, nonClosing);
+    const initialPr = pr;
+    const issue = nonClosing ? await openReferenceIssue(context, input.issueNumber) : undefined;
+    const squash = nonClosing
+        ? {
+            commit_title: pr.title,
+            commit_message: `${referenceLine(context, input.issueNumber)}\n\nDelivered by PR #${pr.number}.`,
         }
+        : undefined;
+    if (squash) {
+        refuseClosingDirective(squash.commit_title);
+        refuseClosingDirective(squash.commit_message);
     }
-    const currentPublication = await createIssuePhaseEvidence({
-        personalAuth: context.clients.authSource === 'personal' && context.config.roles.author.authSource !== 'personal',
-        ...(run.classification.risk === 'high'
-            ? {
-                approval: reviewArtifactApproval({
-                    artifact: review.artifact,
-                    classification: run.classification,
-                    config: context.config,
-                    issueNumber: input.issueNumber,
-                    prNumber: input.prNumber,
-                }),
-            }
-            : {}),
-        issueNumber: input.issueNumber,
-        phase: 'publish',
-        repoRoot: row.path,
+    if (input.reviewedHeadSha !== undefined && input.reviewedHeadSha !== pr.head.sha)
+        throw new DeliveryError('Requested reviewed head differs from the GitHub PR.');
+    if (pr.merged && pr.state === 'closed' && validSha(pr.merge_commit_sha))
+        return { mergeSha: pr.merge_commit_sha, headSha: pr.head.sha, reused: true };
+    const route = await preflightReviewRoute(context, pr.base.ref);
+    if (route.approvalEligibility === 'insufficient-permission')
+        throw new DeliveryError('Configured reviewer App is ineligible for the required approval.');
+    if (pr.state !== 'open' || pr.draft)
+        throw new DeliveryError('GitHub PR must be open and ready for merge.');
+    const reviewer = context.reviewerClients ??
+        (await createDeliveryGitHubClients({
+            config: context.config,
+            identity: context.config.roles.reviewer.identity,
+            role: 'reviewer',
+            selectedAuthor: context.clients,
+        }));
+    if (reviewer.role !== 'reviewer' || reviewer.authSource !== 'app' || !reviewer.appActorLogin)
+        throw new DeliveryError('Independent reviewer App route is unavailable.');
+    const actor = await reviewer.appActorLogin();
+    if (!pr.user?.login || actor.toLowerCase() === pr.user.login.toLowerCase())
+        throw new DeliveryError('Reviewer App must differ from the PR author.');
+    const reviews = (await allReviews(context, input.prNumber)).filter((review) => review.user?.login.toLowerCase() === actor.toLowerCase() &&
+        review.commit_id === pr.head.sha &&
+        review.state === 'APPROVED' &&
+        /<!-- ai-delivery-review-artifact: sha256:[a-f0-9]{64} -->/u.test(review.body ?? ''));
+    if (reviews.length !== 1)
+        throw new DeliveryError('GitHub requires one unambiguous exact-head independent App review.');
+    const approved = reviews[0];
+    const readReview = (await context.clients.rest.pulls.getReview({ ...context.repo, pull_number: input.prNumber, review_id: approved.id })).data;
+    if (readReview.id !== approved.id ||
+        readReview.state !== 'APPROVED' ||
+        readReview.commit_id !== pr.head.sha ||
+        readReview.user?.login.toLowerCase() !== actor.toLowerCase() ||
+        readReview.body !== approved.body)
+        throw new DeliveryError('Independent GitHub review readback changed or was dismissed.');
+    const artifact = parseGitHubReviewArtifact(readReview.body);
+    if (artifact.verdict !== 'approve' ||
+        artifact.issueNumber !== input.issueNumber ||
+        (artifact.prNumber !== null && artifact.prNumber !== input.prNumber) ||
+        artifact.authorIdentity !== context.config.roles.author.identity ||
+        artifact.reviewerIdentity !== context.config.roles.reviewer.identity ||
+        artifact.head.sha !== pr.head.sha)
+        throw new DeliveryError('Independent review artifact binding is stale, foreign or rejected.');
+    const commit = (await context.clients.rest.git.getCommit({ ...context.repo, commit_sha: pr.head.sha })).data;
+    if (commit.sha !== artifact.head.sha || commit.tree.sha !== artifact.head.tree)
+        throw new DeliveryError('Independent review tree differs from the remote commit.');
+    if (artifact.diffScopeHash !== (await readGitHubPrScopeHash(context, input.prNumber, pr.changed_files)))
+        throw new DeliveryError('Independent review scope differs from the remote PR diff.');
+    const reviewedHead = artifact.head.sha;
+    if (input.reviewedHeadSha !== undefined && input.reviewedHeadSha !== reviewedHead)
+        throw new DeliveryError('Requested reviewed head differs from the independent GitHub review.');
+    const decision = await readRequiredReviewState(context, input.prNumber, reviewedHead, {
+        id: approved.id,
+        login: actor,
     });
-    if (currentPublication.evidenceId !== publication.evidenceId) {
-        throw new DeliveryError('Publication evidence changed after formal review.');
-    }
-    const readback = await checkPrMergeability(context, input.prNumber, head.sha);
-    if (readback.baseSha !== run.classification.base.sha || readback.headBranch !== row.branch) {
-        throw new DeliveryError('PR base or registered head drifted after verification.');
-    }
-    const approval = {
-        authorIdentity: context.config.roles.author.identity,
-        reviewerIdentity: context.config.roles.reviewer.identity,
-        diffScopeHash: review.artifact.diffScopeHash,
-        head,
-        result: 'approved',
-        reviewReceiptId: review.receiptId,
-    };
-    const evidence = await createIssuePhaseEvidence({
-        personalAuth: context.clients.authSource === 'personal' && context.config.roles.author.authSource !== 'personal',
-        approval,
+    if (decision.submittedReviewAuthorCanPushToRepository !== true)
+        throw new DeliveryError('Specific reviewer App approval is not verifiably qualifying for required review.');
+    if (decision.status !== 'satisfied')
+        throw new DeliveryError(`GitHub review eligibility is ${decision.status}: ${decision.nextAction}`);
+    const blockers = await getNativeBlockerRelationships({
+        graphql: context.clients.graphql,
         issueNumber: input.issueNumber,
-        mergeReadback: {
-            blockedBy: readback.blockedBy,
-            checksPassed: readback.checksPassed,
-            head,
-            mergeable: true,
-            observedAt: new Date().toISOString(),
-        },
-        phase: 'merge',
-        repoRoot: row.path,
-    });
-    const loaded = await loadDeliveryConfig(row.path, {
-        personalAuth: context.clients.authSource === 'personal' && context.config.roles.author.authSource !== 'personal',
-    });
-    const selected = await loadSelectedRepositoryPolicy({
-        repoRoot: row.path,
-        policySourcePath: loaded.config.policy.module,
-    });
-    const boundary = validateRepositoryPolicyBoundary({
-        classification: run.classification,
-        configDigest: loaded.configDigest,
-        currentBase: run.classification.base,
-        currentHead: head,
-        phase: 'merge',
-        policy: selected.policy,
-        policySourcePath: loaded.config.policy.module,
-        repoRoot: row.path,
-        stageReceiptIds: run.aggregate.stages.map((stage) => ({ stageId: stage.stageId, receiptId: stage.receiptId })),
+        repo: context.repo,
     });
-    if (boundary.additionalConstraints.exactBaseHeadLease && input.strategy && input.strategy !== 'merge') {
-        throw new DeliveryError('Exact base/head lease requires merge-commit strategy.');
-    }
-    const strategy = boundary.additionalConstraints.exactBaseHeadLease
-        ? 'merge'
-        : (input.strategy ?? prepared?.strategy ?? 'squash');
-    const intentContent = {
-        baseBranch: readback.baseBranch,
-        baseSha: readback.baseSha,
-        exactBaseHeadLease: boundary.additionalConstraints.exactBaseHeadLease,
-        evidenceId: prepared?.evidenceId ?? evidence.evidenceId,
-        headBranch: readback.headBranch,
-        headSha: head.sha,
-        headTree: head.tree,
-        issueNumber: input.issueNumber,
-        prNumber: input.prNumber,
-        reviewReceiptId: review.receiptId,
-        schemaVersion: 'ai-delivery.merge-intent@2',
-        strategy,
-    };
-    const intent = MergeIntentSchema.parse({ ...intentContent, intentId: digestValue(intentContent) });
-    if (prepared && prepared.intentId !== intent.intentId) {
-        throw new DeliveryError('Prepared merge intent no longer matches reviewed inputs.');
-    }
-    if (!prepared)
-        writePrivateJsonFileAtomically(intentPath, intent);
-    const attempt = await expectedMergeAttempt(context, intent);
-    let mergeSha;
-    if (boundary.additionalConstraints.exactBaseHeadLease) {
-        mergeSha = await mergeWithExactLease(context, {
-            baseBranch: readback.baseBranch,
-            baseSha: readback.baseSha,
-            headBranch: readback.headBranch,
-            headSha: head.sha,
-            headTree: head.tree,
-            title: readback.title,
-            prNumber: input.prNumber,
-            worktreePath: row.path,
-            beforeMutation: () => writePrivateJsonFileAtomically(attemptPath, attempt),
-            onPreparedMergeCommit: (sha) => persistMergeResult(row.path, intent, attempt, sha),
-        });
+    if (blockers.blockers.some((value) => value.state === 'OPEN'))
+        throw new DeliveryError('GitHub issue has unresolved native blockers.');
+    pr = await verifyIssuePr(context, input.issueNumber, input.prNumber, nonClosing);
+    if (nonClosing) {
+        sameReferencePr(initialPr, pr);
+        sameReferenceIssue(issue, await openReferenceIssue(context, input.issueNumber));
+        refuseClosingDirective(squash.commit_title);
+        refuseClosingDirective(squash.commit_message);
     }
-    else {
-        writePrivateJsonFileAtomically(attemptPath, attempt);
-        mergeSha = (await context.clients.rest.pulls.merge({
-            ...context.repo,
-            pull_number: input.prNumber,
-            sha: head.sha,
-            merge_method: strategy,
-        })).data.sha;
+    if (pr.head.sha !== reviewedHead ||
+        pr.state !== 'open' ||
+        pr.draft ||
+        pr.mergeable !== true ||
+        pr.mergeable_state !== 'clean')
+        throw new DeliveryError(`GitHub merge eligibility is ${pr.mergeable_state ?? 'unknown'}; CLEAN at the reviewed head is required.`);
+    const currentBase = (await context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${pr.base.ref}` })).data
+        .object.sha;
+    if (!validSha(currentBase) || currentBase !== pr.base.sha)
+        throw new DeliveryError('GitHub base moved; refresh clean eligibility and independent review before merge.');
+    if (input.dryRun)
+        return {
+            dryRun: true,
+            headSha: reviewedHead,
+            prNumber: pr.number,
+            ...(squash === undefined ? {} : { nonClosing: true, ...squash }),
+        };
+    const result = (await context.clients.rest.pulls.merge({
+        ...context.repo,
+        pull_number: input.prNumber,
+        sha: reviewedHead,
+        merge_method: input.strategy ?? 'squash',
+        ...squash,
+    })).data;
+    if (!result.merged || !validSha(result.sha))
+        throw new DeliveryError('GitHub refused the reviewed-head merge.');
+    const readback = await verifyIssuePr(context, input.issueNumber, input.prNumber, nonClosing);
+    if (nonClosing) {
+        sameReferencePr(initialPr, readback, true);
+        sameReferenceIssue(issue, await openReferenceIssue(context, input.issueNumber));
     }
-    persistMergeResult(row.path, intent, attempt, mergeSha);
-    return persistMergedResult(context, {
-        branch: row.branch,
-        intent,
-        path: existingPath,
-        worktreePath: row.path,
-        expectedSha: Sha.parse(mergeSha),
-    });
+    if (!readback.merged ||
+        readback.state !== 'closed' ||
+        readback.head.sha !== reviewedHead ||
+        readback.merge_commit_sha !== result.sha)
+        throw new DeliveryError('GitHub merged PR readback disagrees with the reviewed-head mutation.');
+    return { mergeSha: result.sha, headSha: reviewedHead, reused: false };
 }
 export async function finishIssue(context, input) {
-    const matches = listWorktreesStrict(context.root).filter((entry) => entry.type === 'issue' && entry.issueNumber === input.issueNumber);
-    if (matches.length === 0)
-        return readCompletedIssue(context, input);
-    if (matches.length !== 1)
-        throw new DeliveryError('Issue has duplicate worktree registry rows.');
-    const row = getIssueWorktreeStrict(input.issueNumber, context.root);
-    const metadata = await getConfiguredNativeIssueMetadata({
-        issueNumber: input.issueNumber,
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        rest: context.clients.rest,
-        settings: nativeIssueSettingsFromDeliveryConfig(context.config),
-    });
-    if (metadata.points === undefined || !context.config.native.points.values.includes(String(metadata.points))) {
-        throw new DeliveryError('Executable issue requires configured native Points before finish.');
-    }
-    const points = metadata.points;
-    const merge = await mergePr(context, input);
-    const review = loadSubmittedReview(existsSync(row.path) ? row.path : context.root, input.issueNumber, merge.headSha);
-    if (!review)
-        throw new DeliveryError('Terminal delivery requires the submitted review receipt.');
+    if (nonClosingMode(input.nonClosing))
+        throw new DeliveryError('Non-closing delivery cannot finish or close its retained issue.');
+    const result = await mergePr(context, input);
+    if (input.dryRun)
+        return result;
+    const pr = await verifyIssuePr(context, input.issueNumber, input.prNumber);
+    if (!pr.merged || pr.state !== 'closed' || pr.merge_commit_sha !== result.mergeSha)
+        throw new DeliveryError('Intended GitHub PR is not verifiably merged; issue remains open.');
     const issue = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
+    if (issue.number !== input.issueNumber || 'pull_request' in issue)
+        throw new DeliveryError('Finish target is not the intended GitHub issue.');
     if (issue.state !== 'closed')
         await context.clients.rest.issues.update({
             ...context.repo,
             issue_number: input.issueNumber,
             state: 'closed',
+            state_reason: 'completed',
         });
-    const closed = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
-    if (closed.state !== 'closed')
-        throw new DeliveryError('Issue close readback failed.');
-    await syncIssueProjectStatus({
-        graphql: context.clients.graphql,
-        issueNodeId: closed.node_id,
-        org: context.config.native.organization,
-        ...(context.projectConfiguration ? { configuration: context.projectConfiguration } : {}),
-        settings: projectSettingsFromDeliveryConfig(context.config),
-        status: 'Done',
-    });
-    const branch = baseBranch(context.root, context.configuration?.remote);
-    await fetchMergedBase(context, branch);
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-    const [remoteBase, remoteHead] = await Promise.all([
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/${branch}` }),
-        context.clients.rest.git.getRef({ ...context.repo, ref: `heads/issue/${input.issueNumber}` }).catch((error) => {
-            if (error.status === 404)
-                return null;
-            throw error;
-        }),
-    ]);
-    if (pr.state !== 'closed' ||
-        !pr.merged_at ||
-        pr.merge_commit_sha !== merge.mergeSha ||
-        pr.head.sha !== merge.headSha ||
-        pr.head.ref !== `issue/${input.issueNumber}` ||
-        pr.base.ref !== branch)
-        throw new DeliveryError('Merged PR drifted before cleanup.');
-    const attestation = {
-        baseBranch: merge.baseBranch,
-        baseSha: merge.baseSha,
-        headBranch: merge.headBranch,
-        headSha: merge.headSha,
-        mergeSha: merge.mergeSha,
-        mergeTree: merge.mergeTree,
-        remoteBaseSha: remoteBase.data.object.sha,
-        remoteHeadSha: remoteHead?.data.object.sha ?? null,
-        strategy: merge.strategy,
-    };
-    const mergedAt = pr.merged_at;
-    if (typeof mergedAt !== 'string' || Date.parse(mergedAt) < Date.parse(row.createdAt)) {
-        throw new DeliveryError('Terminal delivery timeline is invalid.');
-    }
-    await cleanupMergedIssueWorktree({
-        ...(context.configuration?.remote ? { remote: context.configuration.remote } : {}),
-        issueNumber: input.issueNumber,
-        repoRoot: context.root,
-        merge: attestation,
-        afterRemoval: async () => {
-            const terminalCleanupAt = new Date().toISOString();
-            const metrics = review.artifact.deliveryMetrics;
-            await recordMergedDelivery({
-                blockerTimeMs: metrics?.blockerTimeMs ?? null,
-                cycleTimeMs: Date.parse(mergedAt) - Date.parse(row.createdAt),
-                firstPassApproved: metrics === undefined ? null : metrics.reviewRound === 1,
-                issueNumber: input.issueNumber,
-                mergedAt,
-                mergeSha: merge.mergeSha,
-                points,
-                recordedAt: terminalCleanupAt,
-                repository: `${context.repo.owner}/${context.repo.repo}`,
-                reviewRounds: metrics?.reviewRound ?? null,
-                schemaVersion: 'ai-delivery.delivery-record@1',
-                terminalCleanupAt,
-            }, context.root);
-        },
-    });
-    await journalIssueCloseout(context, input, merge.mergeSha);
-    return { mergeSha: merge.mergeSha, issueClosed: true, cleaned: true };
-}
-async function journalIssueCloseout(context, input, mergeSha) {
-    const issue = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-    const criteria = acceptanceCriteria(issue.body ?? '');
-    if (!criteria.length)
-        throw new DeliveryError('Closeout requires acceptance criteria with public delivery evidence.');
-    await commentIssue(context, {
-        issueNumber: input.issueNumber,
-        kind: 'closeout',
-        summary: `Merged delivery completed for ${issue.title}.`,
-        status: 'Closed; merged and cleaned',
-        acceptance: criteria.map((criterion) => ({ criterion, evidence: pr.html_url })),
-        followUps: issueFollowUps(issue.body ?? ''),
-        keyNumbers: [`${String(criteria.length)} acceptance criteria`, `PR #${String(input.prNumber)}`],
-        evidence: [pr.html_url],
-        nextStep: 'No further delivery action; see the merged PR for verification and follow-ups',
-        nextDate: null,
-    }, `closeout:${mergeSha}`);
-}
-async function readCompletedIssue(context, input) {
-    const pr = (await context.clients.rest.pulls.get({ ...context.repo, pull_number: input.prNumber })).data;
-    if (pr.state !== 'closed' || !pr.merged_at || !pr.merge_commit_sha || pr.head.ref !== `issue/${input.issueNumber}`) {
-        throw new DeliveryError('Absent issue worktree lacks an exact completed PR.');
-    }
-    const receipt = readOptionalPrivate(mergePath(context.root, input.issueNumber, pr.head.sha), (value) => MergeSchema.parse(value));
-    const intent = readOptionalPrivate(mergeIntentPath(context.root, input.issueNumber, pr.head.sha), (value) => MergeIntentSchema.parse(value));
-    if (!receipt ||
-        !intent ||
-        receipt.issueNumber !== input.issueNumber ||
-        receipt.prNumber !== input.prNumber ||
-        receipt.headSha !== pr.head.sha ||
-        receipt.mergeSha !== pr.merge_commit_sha ||
-        receipt.intentId !== intent.intentId) {
-        throw new DeliveryError('Absent issue worktree lacks exact terminal merge receipts.');
-    }
-    const result = await readMergedResult(context, intent, receipt.mergeSha);
-    const { schemaVersion: _version, ...intentContent } = intent;
-    if (result.mergeTree !== receipt.mergeTree ||
-        receipt.mergeId !== digestValue({ ...intentContent, ...result, schemaVersion: 'ai-delivery.merge@3' })) {
-        throw new DeliveryError('Completed merge receipt disagrees with its intent or remote result.');
-    }
-    const records = getDeliveryRecords(context.root).filter((record) => record.repository === `${context.repo.owner}/${context.repo.repo}` &&
-        record.issueNumber === input.issueNumber &&
-        record.mergeSha === receipt.mergeSha);
-    if (records.length !== 1)
-        throw new DeliveryError('Completed issue lacks one exact terminal delivery record.');
-    const issue = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
-    if (issue.state !== 'closed' || 'pull_request' in issue) {
-        throw new DeliveryError('Completed issue is not closed.');
-    }
-    const project = await getIssueProjectStatus({
-        graphql: context.clients.graphql,
-        issueNodeId: issue.node_id,
-        org: context.config.native.organization,
-        ...(context.projectConfiguration ? { configuration: context.projectConfiguration } : {}),
-        settings: projectSettingsFromDeliveryConfig(context.config),
-    });
-    if (project?.status !== 'Done')
-        throw new DeliveryError('Completed issue Project status is not Done.');
-    await journalIssueCloseout(context, input, receipt.mergeSha);
-    return { mergeSha: receipt.mergeSha, issueClosed: true, cleaned: true };
+    const readback = (await context.clients.rest.issues.get({ ...context.repo, issue_number: input.issueNumber })).data;
+    if (readback.number !== input.issueNumber || readback.state !== 'closed')
+        throw new DeliveryError('GitHub issue closure readback disagrees.');
+    return { ...result, issueClosed: true };
 }
+export { startIssueBranch };
 //# sourceMappingURL=pr.js.map