@brainervirus/workit-claude-code 2.8.0 → 2.9.0

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "2.7.0",
+    version: "2.8.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -13539,6 +13539,11 @@ function worktreeSignal(cwd, options = {}) {
   }
   return `sig:${hash.digest("hex")}`;
 }
+function mergeBase(cwd, a, b) {
+  if (!safeArg(a) || !safeArg(b))
+    return null;
+  return line(git2(cwd, ["merge-base", a, b]));
+}
 function patchId(cwd, base, head) {
   if (!safeArg(base) || !safeArg(head))
     return null;
@@ -20350,6 +20355,27 @@ function effectiveOf(rows, authors) {
   }
   return effective;
 }
+function restackCarries(rows, branch, from, to) {
+  if (!from || !to)
+    return false;
+  const edges = new Map;
+  for (const row of rows)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+      edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
+  const seen = new Set([from]);
+  const queue = [from];
+  while (queue.length) {
+    const next = queue.shift();
+    if (next === to)
+      return true;
+    for (const target of edges.get(next) ?? [])
+      if (!seen.has(target)) {
+        seen.add(target);
+        queue.push(target);
+      }
+  }
+  return false;
+}
 function checkVerdicts(cwd, branch, rows) {
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase2(cwd);
@@ -20376,7 +20402,9 @@ function checkVerdicts(cwd, branch, rows) {
     const row = effectiveOf(list, authors);
     if (!row)
       continue;
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    let basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    if (basis === "stale" && restackCarries(rows, branch, row.head, head))
+      basis = "carried";
     const current = basis !== "stale";
     const independence = independenceReasons(row, authors);
     const reasons = [
@@ -76857,6 +76885,8 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     });
   if (doc.next !== "READY")
     return refuse(`not_ready: ${label} is ${doc.next} (${doc.blockers.join(", ") || doc.next.toLowerCase()})`, NEXT_HINTS[doc.next] ?? "workit pr status", { reason: "not_ready", next: doc.next, blockers: doc.blockers });
+  if (input.expect && (doc.base !== input.expect.base || doc.head.branch !== input.expect.branch))
+    return refuse(`base_mismatch: ${label} is ${doc.head.branch} -> ${doc.base}, expected ${input.expect.branch} -> ${input.expect.base}`, "workit stack sync  # retarget it, then land again", { reason: "base_mismatch" });
   const branch = doc.head.branch;
   const head = doc.head.sha;
   if (input.deleteBranch) {
@@ -77951,7 +77981,25 @@ async function status(argv, io) {
   });
   if (!report.ok)
     return forgeFail(io, report);
-  return emit(io, ok(report.data.doc), renderStatus);
+  const doc = report.data.doc;
+  return emit(io, ok({ ...doc, verdict: verdictBlock(io.cwd, doc.head.branch) }), (data) => {
+    const lines = renderStatus(data);
+    lines.splice(lines.length - 1, 0, data.verdict ? `verdict: ${data.verdict.accepted ? `accepted (${data.verdict.basis})` : `not accepted (${data.verdict.reasons.join(", ") || data.verdict.basis})`}` : "verdict: unknown (ledger unreadable)");
+    return lines;
+  });
+}
+function verdictBlock(cwd, branch) {
+  const ledger = readLedger(cwd);
+  if (!ledger.ok)
+    return null;
+  const check = checkVerdicts(cwd, branch, ledger.value.rows);
+  return {
+    accepted: check.accepted.accepted,
+    basis: check.current.basis,
+    reasons: check.accepted.reasons,
+    head: check.head,
+    verdictId: check.accepted.accepted && typeof check.accepted.verdict?.id === "string" ? check.accepted.verdict.id : null
+  };
 }
 async function create4(argv, io) {
   const flags = parseFlags(argv, {
@@ -78732,12 +78780,1206 @@ var init_verify_delivery = __esm(() => {
   };
 });
 
-// packages/workit-cli/src/verbs/stub.ts
-var notImplemented = (verb, slice) => async (argv, io) => emit(io, fail("not_implemented", `${verb} is not implemented yet (planned in ${slice})`, {
-  data: { verb, subcommand: argv.find((arg) => !arg.startsWith("-")) ?? null, slice }
-}));
-var init_stub = __esm(() => {
-  init_output();
+// packages/workit-core/src/stack.ts
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
+import fs23 from "node:fs";
+import path42 from "node:path";
+function worktreeOf(cwd, branch) {
+  const list = gitRun2(cwd, ["worktree", "list", "--porcelain"]);
+  if (!list.ok)
+    return null;
+  let current = null;
+  for (const line of list.stdout.split(`
+`)) {
+    if (line.startsWith("worktree "))
+      current = line.slice("worktree ".length);
+    else if (line === `branch refs/heads/${branch}` && current)
+      return current;
+    else if (line === "detached" && current && rebasingBranch(current) === `refs/heads/${branch}`)
+      return current;
+  }
+  return null;
+}
+function rebasingBranch(dir) {
+  for (const name of ["rebase-merge/head-name", "rebase-apply/head-name"]) {
+    const found = gitRun2(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (!found.ok)
+      continue;
+    try {
+      return fs23.readFileSync(found.stdout.trim(), "utf8").trim();
+    } catch {}
+  }
+  return null;
+}
+function rebaseInProgress(dir) {
+  for (const name of ["rebase-merge", "rebase-apply"]) {
+    const found = gitRun2(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (found.ok && fs23.existsSync(found.stdout.trim()))
+      return true;
+  }
+  return false;
+}
+function gitRestack(cwd, input) {
+  const owner = worktreeOf(cwd, input.branch);
+  let dir = owner;
+  if (!dir) {
+    const scratch = scratchDir(cwd);
+    if (!scratch)
+      return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+    fs23.mkdirSync(scratch, { recursive: true });
+    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    const added = gitRun2(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
+    if (!added.ok)
+      return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+  }
+  const run = gitRun2(dir, [
+    "-c",
+    "rebase.autoStash=false",
+    "-c",
+    "rebase.updateRefs=false",
+    "rebase",
+    "--no-autosquash",
+    "--onto",
+    input.onto,
+    input.from
+  ], stackDeps.rebaseTimeoutMs);
+  if (!run.ok) {
+    if (run.timedOut)
+      return {
+        ok: false,
+        conflict: false,
+        timedOut: true,
+        worktree: dir,
+        error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`
+      };
+    if (rebaseInProgress(dir))
+      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+    if (!owner)
+      gitRun2(cwd, ["worktree", "remove", "--force", dir]);
+    return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
+  }
+  if (!owner)
+    gitRun2(cwd, ["worktree", "remove", "--force", dir]);
+  const head = branchTip(cwd, input.branch);
+  return head ? { ok: true, head } : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+}
+function pruneScratch(cwd) {
+  const scratch = scratchDir(cwd);
+  if (!scratch || !fs23.existsSync(scratch))
+    return;
+  for (const name of fs23.readdirSync(scratch)) {
+    const dir = path42.join(scratch, name);
+    if (!rebaseInProgress(dir) && !trackedDirt(dir))
+      gitRun2(cwd, ["worktree", "remove", "--force", dir]);
+  }
+  gitRun2(cwd, ["worktree", "prune"]);
+}
+function stacksDir(cwd) {
+  const root = storeRoot(cwd);
+  if (!root.ok)
+    return stackFail(root.code, root.error, root.unblock);
+  return { ok: true, data: path42.join(root.value.root, "stacks") };
+}
+function parseStack(raw) {
+  if (!isRecord7(raw) || !Array.isArray(raw.branches))
+    return null;
+  const name = str2(raw.name);
+  const trunk = str2(raw.trunk);
+  if (!name || !trunk)
+    return null;
+  const branches = [];
+  for (const item of raw.branches) {
+    if (!isRecord7(item))
+      return null;
+    const branch = str2(item.branch);
+    if (!branch)
+      return null;
+    const merged = isRecord7(item.merged) ? {
+      pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
+      mergeSha: str2(item.merged.mergeSha),
+      at: str2(item.merged.at) ?? ""
+    } : null;
+    branches.push({
+      branch,
+      parent: str2(item.parent) ?? trunk,
+      pr: typeof item.pr === "number" ? item.pr : null,
+      lastHead: str2(item.lastHead),
+      lastParentHead: str2(item.lastParentHead),
+      patchId: str2(item.patchId),
+      merged,
+      ...isRecord7(item.pendingRestack) && str2(item.pendingRestack.from) && str2(item.pendingRestack.tip) && str2(item.pendingRestack.onto) ? {
+        pendingRestack: {
+          from: str2(item.pendingRestack.from),
+          tip: str2(item.pendingRestack.tip),
+          onto: str2(item.pendingRestack.onto)
+        }
+      } : {}
+    });
+  }
+  return {
+    v: typeof raw.v === "number" ? raw.v : STACK_VERSION,
+    name,
+    trunk,
+    forge: raw.forge === "github" || raw.forge === "gitlab" ? raw.forge : null,
+    repo: str2(raw.repo),
+    branches,
+    updatedAt: str2(raw.updatedAt) ?? ""
+  };
+}
+function readStack(cwd, name) {
+  const dir = stacksDir(cwd);
+  if (!dir.ok)
+    return dir;
+  const file = path42.join(dir.data, fileFor(name));
+  let text;
+  try {
+    text = fs23.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { ok: true, data: null };
+    return stackFail("unavailable", `cannot read ${file}: ${error.message}`);
+  }
+  let parsed = null;
+  try {
+    parsed = parseStack(JSON.parse(text));
+  } catch {
+    parsed = null;
+  }
+  return parsed ? { ok: true, data: parsed } : stackFail("failed", `stack file ${file} is not a valid stack`, `workit stack plan --name ${name} <branch…>  # rebuild it`);
+}
+function writeStack(cwd, stack, now = new Date) {
+  const dir = stacksDir(cwd);
+  if (!dir.ok)
+    return dir;
+  const file = path42.join(dir.data, fileFor(stack.name));
+  const temp = `${file}.${process.pid}.tmp`;
+  try {
+    fs23.mkdirSync(dir.data, { recursive: true });
+    stack.updatedAt = now.toISOString();
+    fs23.writeFileSync(temp, `${JSON.stringify(stack, null, 2)}
+`);
+    fs23.renameSync(temp, file);
+    return { ok: true, data: undefined };
+  } catch (error) {
+    fs23.rmSync(temp, { force: true });
+    return stackFail("unavailable", `cannot write ${file}: ${error.message}`);
+  }
+}
+function listStacks(cwd) {
+  const dir = stacksDir(cwd);
+  if (!dir.ok)
+    return dir;
+  let names = [];
+  try {
+    names = fs23.readdirSync(dir.data).filter((name) => name.endsWith(".json"));
+  } catch {
+    return { ok: true, data: [] };
+  }
+  const out = [];
+  for (const name of names) {
+    let parsed = null;
+    try {
+      parsed = parseStack(JSON.parse(fs23.readFileSync(path42.join(dir.data, name), "utf8")));
+    } catch {
+      parsed = null;
+    }
+    if (parsed && fileFor(parsed.name) === name)
+      out.push(parsed);
+  }
+  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+}
+function selectStack(cwd, name) {
+  if (name !== null && !validName(name))
+    return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
+  if (name) {
+    const read = readStack(cwd, name);
+    if (!read.ok)
+      return read;
+    return read.data ? { ok: true, data: read.data } : stackFail("not_found", `no stack named ${name}`, `workit stack plan --name ${name} <branch…>`);
+  }
+  const all = listStacks(cwd);
+  if (!all.ok)
+    return all;
+  const branch = currentBranch(cwd);
+  const holding = all.data.filter((stack) => stack.branches.some((entry) => entry.branch === branch));
+  if (holding.length === 1)
+    return { ok: true, data: holding[0] };
+  if (holding.length === 0 && all.data.length === 1)
+    return { ok: true, data: all.data[0] };
+  return stackFail("not_found", holding.length > 1 || all.data.length > 1 ? `several stacks match; pick one (${(holding.length > 1 ? holding : all.data).map((stack) => stack.name).join(", ")})` : "no stack is planned here", holding.length > 1 || all.data.length > 1 ? "pass --name <stack>" : "workit stack plan [<branch>…]  # from the current branch chain by default");
+}
+function stackLockStale(raw, age) {
+  let payload = null;
+  try {
+    payload = raw ? JSON.parse(raw) : null;
+  } catch {
+    payload = null;
+  }
+  if (payload === null)
+    return age !== null && age > OWNERLESS_STALE_MS;
+  const owner = classifyLockOwner(payload, age);
+  if (owner.state === "live")
+    return false;
+  if (owner.state === "stale")
+    return true;
+  return age !== null && age > HEARTBEAT_STALE_MS;
+}
+function takeLock(lock) {
+  try {
+    fs23.mkdirSync(lock);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return null;
+    throw error;
+  }
+  const owner = {
+    pid: process.pid,
+    processStart: processStartOf(process.pid),
+    host: localLockHost(),
+    nonce: randomBytes3(8).toString("hex")
+  };
+  fs23.writeFileSync(path42.join(lock, OWNER), JSON.stringify(owner));
+  return owner;
+}
+function reapLock(lock, observed) {
+  const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
+  try {
+    fs23.renameSync(lock, tomb);
+  } catch {
+    return false;
+  }
+  if (readOwner(tomb).raw === observed) {
+    fs23.rmSync(tomb, { recursive: true, force: true });
+    return true;
+  }
+  try {
+    fs23.renameSync(tomb, lock);
+  } catch {
+    fs23.rmSync(tomb, { recursive: true, force: true });
+  }
+  return false;
+}
+function releaseLock(lock, owner) {
+  const { raw } = readOwner(lock);
+  if (raw !== JSON.stringify(owner))
+    return;
+  const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
+  try {
+    fs23.renameSync(lock, tomb);
+    fs23.rmSync(tomb, { recursive: true, force: true });
+  } catch {}
+}
+async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
+  const dir = stacksDir(cwd);
+  if (!dir.ok)
+    return dir;
+  if (!validName(name))
+    return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
+  const lock = path42.join(dir.data, `${fileFor(name)}.lock`);
+  try {
+    fs23.mkdirSync(dir.data, { recursive: true });
+  } catch (error) {
+    return stackFail("unavailable", `cannot create ${dir.data}: ${error.message}`);
+  }
+  const deadline = Date.now() + waitMs;
+  let owner = null;
+  for (;; ) {
+    owner = takeLock(lock);
+    if (owner)
+      break;
+    const seen = readOwner(lock);
+    if (stackLockStale(seen.raw, seen.age) && reapLock(lock, seen.raw))
+      continue;
+    if (Date.now() >= deadline) {
+      let holder = {};
+      try {
+        holder = seen.raw ? JSON.parse(seen.raw) : {};
+      } catch {
+        holder = {};
+      }
+      return stackFail("busy", `stack ${name} is busy: another workit stack command${holder.pid ? ` (pid ${holder.pid} on ${holder.host ?? "?"})` : ""} holds ${lock}`, "retry when it finishes; a lock whose holder stopped heartbeating is reclaimed automatically", { lock, pid: holder.pid ?? null, host: holder.host ?? null });
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  const held = owner;
+  const touch = () => {
+    try {
+      const now = new Date;
+      fs23.utimesSync(path42.join(lock, OWNER), now, now);
+    } catch {}
+  };
+  const beat = setInterval(touch, HEARTBEAT_MS);
+  beat.unref?.();
+  const previous = activeBeat;
+  activeBeat = touch;
+  try {
+    return await fn();
+  } finally {
+    activeBeat = previous;
+    clearInterval(beat);
+    releaseLock(lock, held);
+  }
+}
+function deriveChain(cwd, trunk, base) {
+  const branch = currentBranch(cwd);
+  if (!branch || branch === trunk)
+    return stackFail("invalid_input", branch ? `you are on the trunk ${trunk}` : "HEAD is detached", "switch to the top branch of the stack, or name the branches: workit stack plan <bottom> … <top>");
+  const refs = gitRun2(cwd, [
+    "for-each-ref",
+    "--format=%(refname:short) %(objectname)",
+    "refs/heads"
+  ]);
+  const head = branchTip(cwd, branch);
+  if (!refs.ok || !head)
+    return stackFail("failed", "cannot list local branches");
+  const below = [];
+  for (const line of refs.stdout.split(`
+`)) {
+    const [name, sha] = line.trim().split(" ");
+    if (!name || !sha || name === branch || name === trunk)
+      continue;
+    if (sha === head || isAncestor(cwd, sha, base) || !isAncestor(cwd, sha, head))
+      continue;
+    const count = gitRun2(cwd, ["rev-list", "--count", `${base}..${sha}`]);
+    below.push({ branch: name, depth: Number(count.stdout.trim()) || 0 });
+  }
+  below.sort((a, b) => a.depth - b.depth || a.branch.localeCompare(b.branch));
+  return { ok: true, data: [...below.map((entry) => entry.branch), branch] };
+}
+function planStack(cwd, resolved, input, existing) {
+  const remote = remoteFor(cwd, resolved, input.trunk);
+  const notes = [];
+  const trunkSha = trunkTip(cwd, remote, input.trunk);
+  if (!trunkSha)
+    return stackFail("not_found", `trunk ${input.trunk} is not available locally`, `git fetch ${remote} ${input.trunk}  # or pass --trunk <branch>`);
+  let branches = input.branches;
+  if (branches.length === 0) {
+    if (existing)
+      branches = existing.branches.map((entry) => entry.branch);
+    else {
+      const derived = deriveChain(cwd, input.trunk, trunkSha);
+      if (!derived.ok)
+        return derived;
+      branches = derived.data;
+    }
+  }
+  if (new Set(branches).size !== branches.length)
+    return stackFail("invalid_input", "a branch is listed twice");
+  if (branches.includes(input.trunk))
+    return stackFail("invalid_input", `the trunk ${input.trunk} cannot be in the stack`);
+  for (const branch of branches)
+    if (!safeRef2(branch) || !branchTip(cwd, branch))
+      return stackFail("not_found", `branch ${branch} does not exist locally`, `git switch ${branch}  # or git branch ${branch} ${remote}/${branch}`);
+  const previous = new Map((existing?.branches ?? []).map((entry) => [entry.branch, entry]));
+  const entries = [];
+  const checks = [];
+  let parent = input.trunk;
+  let parentSha = trunkSha;
+  for (const branch of branches) {
+    const tip = branchTip(cwd, branch);
+    const before = previous.get(branch);
+    if (before?.merged) {
+      let still = false;
+      if (before.pr && resolved) {
+        const status = resolved.forge.prStatus(before.pr);
+        still = status.ok && status.data.state === "merged";
+      } else
+        still = hasOwnCommits(cwd, tip, before.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+      if (still) {
+        entries.push(before);
+        continue;
+      }
+      notes.push(`${branch} was recorded as merged but is not; it is back in the stack`);
+    }
+    const onParent = isAncestor(cwd, parentSha, tip);
+    let builtOn = parentSha;
+    if (!onParent) {
+      if (before?.lastParentHead && isAncestor(cwd, before.lastParentHead, tip))
+        builtOn = before.lastParentHead;
+      else {
+        const old = oldParentVersion(cwd, parent, parentSha, tip) ?? oldParentLookalike(cwd, parentSha, tip);
+        if (old)
+          return stackFail("blocked", `parent_rewritten: ${branch} is built on an older version of ${parent} (${old.slice(0, 12)}); replaying it from the merge base would bring the old ${parent} commits back`, `git rebase --onto ${parent} ${old} ${branch}  # moves only ${branch}'s own commits; then workit stack plan`, { branch, parent, oldParentTip: old });
+        builtOn = mergeBase(cwd, parentSha, tip) ?? parentSha;
+        notes.push(`${branch} is not on ${parent} and has no recorded base; sync will replay every commit since their merge base ${builtOn.slice(0, 12)}`);
+      }
+    }
+    let pr = before?.pr ?? null;
+    let prBase = null;
+    if (resolved) {
+      const found = resolved.forge.findPr(branch, {
+        owner: resolved.headRepo.split("/")[0] ?? null,
+        projectId: resolved.headProjectId,
+        sha: tip
+      });
+      if (found.ok && found.data && found.data.state === "open") {
+        pr = found.data.number;
+        const status = resolved.forge.prStatus(pr);
+        if (status.ok)
+          prBase = status.data.base;
+      } else if (!found.ok)
+        notes.push(`${branch}: PR lookup failed (${found.error})`);
+    }
+    entries.push({
+      ...before?.pendingRestack ? { pendingRestack: before.pendingRestack } : {},
+      branch,
+      parent,
+      pr,
+      lastHead: tip,
+      lastParentHead: builtOn,
+      patchId: patchId(cwd, builtOn, tip),
+      merged: null
+    });
+    checks.push({
+      branch,
+      parent,
+      onParent,
+      pr,
+      prBase,
+      baseMatches: prBase === null ? null : prBase === parent
+    });
+    if (!onParent)
+      notes.push(`${branch} is not on ${parent}; workit stack sync rebases it`);
+    if (prBase !== null && prBase !== parent)
+      notes.push(`${branch}: PR base is ${prBase}, the stack says ${parent}; workit stack sync retargets it`);
+    parent = branch;
+    parentSha = tip;
+  }
+  if (!resolved)
+    notes.push("forge not resolved: PR numbers were not looked up");
+  const name = input.name ?? existing?.name ?? branches[0];
+  return {
+    ok: true,
+    data: {
+      stack: {
+        v: STACK_VERSION,
+        name,
+        trunk: input.trunk,
+        forge: resolved?.forge.kind ?? existing?.forge ?? null,
+        repo: resolved?.forge.repo ?? existing?.repo ?? null,
+        branches: entries,
+        updatedAt: ""
+      },
+      created: existing === null,
+      checks,
+      notes
+    }
+  };
+}
+function hasOwnCommits(cwd, tip, base) {
+  if (!base)
+    return false;
+  return tip !== base && !isAncestor(cwd, tip, base);
+}
+function oldParentVersion(cwd, parent, parentSha, child) {
+  if (!safeRef2(parent))
+    return null;
+  const log = gitRun2(cwd, ["reflog", "show", "--format=%H", `refs/heads/${parent}`, "--"]);
+  if (!log.ok)
+    return null;
+  for (const sha of log.stdout.split(`
+`).map((line) => line.trim())) {
+    if (!sha || sha === parentSha)
+      continue;
+    if (isAncestor(cwd, sha, child) && !isAncestor(cwd, sha, parentSha))
+      return sha;
+  }
+  return null;
+}
+function commitKeys(cwd, range) {
+  const log = gitRun2(cwd, ["log", "--reverse", "--no-merges", "--format=%H%x00%s", range]);
+  if (!log.ok)
+    return [];
+  const patches = new Map;
+  const diff = gitRun2(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
+  if (diff.ok && diff.stdout.trim()) {
+    const ids = spawnSync21("git", ["patch-id", "--stable"], {
+      cwd,
+      input: diff.stdout,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+    for (const line of (ids.stdout ?? "").split(`
+`)) {
+      const [patch, sha] = line.trim().split(/\s+/u);
+      if (patch && sha)
+        patches.set(sha, patch);
+    }
+  }
+  return log.stdout.split(`
+`).filter(Boolean).map((line) => {
+    const [sha, subject = ""] = line.split("\x00");
+    return { sha, subject, patch: patches.get(sha) ?? null };
+  });
+}
+function oldParentLookalike(cwd, parentSha, child) {
+  const base = mergeBase(cwd, parentSha, child);
+  if (!base)
+    return null;
+  const parentCommits = commitKeys(cwd, `${base}..${parentSha}`);
+  if (parentCommits.length === 0)
+    return null;
+  const patches = new Set(parentCommits.map((commit) => commit.patch).filter(Boolean));
+  const subjects = new Set(parentCommits.map((commit) => commit.subject).filter(Boolean));
+  let last = null;
+  for (const commit of commitKeys(cwd, `${base}..${child}`))
+    if (commit.patch && patches.has(commit.patch) || subjects.has(commit.subject))
+      last = commit.sha;
+  return last;
+}
+function statusDoc(ctx, pr) {
+  const status = ctx.resolved.forge.prStatus(pr);
+  if (!status.ok)
+    return status;
+  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, { logLines: 0, behind: false });
+}
+function prBinding(ctx, entry, doc) {
+  const label = noun2(ctx.resolved, entry.pr);
+  if (doc.head.branch !== entry.branch)
+    return `${label} is for ${doc.head.branch}, not ${entry.branch}`;
+  const found = ctx.resolved.forge.findPr(entry.branch, {
+    owner: ctx.resolved.headRepo.split("/")[0] ?? null,
+    projectId: ctx.resolved.headProjectId,
+    sha: null
+  });
+  if (!found.ok)
+    return `cannot confirm ${label} belongs to ${entry.branch}: ${found.error}`;
+  if (found.data?.number !== entry.pr)
+    return `${entry.branch} from ${ctx.resolved.headRepo} is ${found.data ? noun2(ctx.resolved, found.data.number) : "without a PR"}, not ${label}`;
+  return null;
+}
+function repoMismatch(ctx, stack) {
+  const { kind, repo } = ctx.resolved.forge;
+  if (stack.repo && stack.repo !== repo || stack.forge && stack.forge !== kind)
+    return stackFail("blocked", `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`, `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`, { planned: { forge: stack.forge, repo: stack.repo }, resolved: { forge: kind, repo } });
+  return null;
+}
+function qualify(ctx, stack, entry, doc, verdict, grant, binding = null) {
+  const label = entry.pr ? noun2(ctx.resolved, entry.pr) : entry.branch;
+  const stop = (reason, detail, unblock, ready = false) => ({
+    ok: false,
+    reason,
+    detail,
+    unblock,
+    ready
+  });
+  if (!entry.pr || !doc)
+    return stop("no_pr", `${entry.branch} has no open PR`, `git switch ${entry.branch} && workit pr create --fill --base ${entry.parent}  # then workit stack plan`);
+  if (binding)
+    return stop("pr_mismatch", binding, `workit stack plan --name ${stack.name}  # re-resolve the PRs`);
+  if (doc.state !== "open")
+    return stop("pr_closed", `${label} is ${doc.state}`, "reopen it, or drop the branch from the stack: workit stack plan <branches…>");
+  if (doc.base !== stack.trunk)
+    return stop("base_not_trunk", `${label} targets ${doc.base}, not ${stack.trunk}`, "workit stack sync");
+  if (doc.next !== "READY")
+    return stop("not_ready", `${label} is ${doc.next}${doc.blockers.length ? ` (${doc.blockers.join(", ")})` : ""}`, doc.next === "WAITING_CI" ? `workit ci wait --pr ${entry.pr}` : `workit pr status --pr ${entry.pr}`);
+  const requireVerdict = grant.allowed ? grant.requireVerdict : true;
+  if (requireVerdict && !verdict.accepted)
+    return stop(verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict", `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`, `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}`);
+  if (!grant.allowed)
+    return stop("grant_required", `${label} is verified and ready, but ${grant.error}`, grant.unblock, true);
+  return { ok: true };
+}
+function stackStatus(ctx, stack) {
+  const mismatch = repoMismatch(ctx, stack);
+  if (mismatch)
+    return mismatch;
+  const ledger = readLedger(ctx.cwd);
+  if (!ledger.ok)
+    return stackFail(ledger.code, ledger.error, ledger.unblock);
+  const remote = remoteFor(ctx.cwd, ctx.resolved, stack.trunk);
+  const trunkSha = trunkTip(ctx.cwd, remote, stack.trunk);
+  const grant = requireGrant(ctx.cwd, "merge");
+  const branches = [];
+  let verdict = null;
+  let reason = null;
+  let next = null;
+  let parentName = stack.trunk;
+  let parentSha = trunkSha;
+  let mergedSeen = false;
+  for (const entry of stack.branches) {
+    let doc = null;
+    if (entry.pr) {
+      const read = statusDoc(ctx, entry.pr);
+      if (!read.ok)
+        return fromForge(read);
+      doc = read.data;
+    }
+    const merged = entry.merged !== null || doc?.state === "merged";
+    const head = branchTip(ctx.cwd, entry.branch);
+    const row = {
+      branch: entry.branch,
+      parent: parentName,
+      pr: entry.pr,
+      merged,
+      head,
+      onParent: merged || !head || !parentSha ? null : isAncestor(ctx.cwd, parentSha, head),
+      prState: doc?.state ?? null,
+      prBase: doc?.base ?? null,
+      baseMatches: doc && !merged ? doc.base === parentName : null,
+      next: doc?.next ?? null,
+      checks: doc?.checks.state ?? null,
+      blockers: doc?.blockers ?? [],
+      verdict: merged ? { accepted: true, basis: "none", reasons: [], verdictId: null } : verdictOf(ctx.cwd, entry.branch, ledger.value.rows)
+    };
+    branches.push(row);
+    if (merged) {
+      mergedSeen = true;
+      continue;
+    }
+    if (verdict === null) {
+      const stale = row.onParent === false || row.baseMatches === false;
+      if (mergedSeen && stale) {
+        verdict = "ADVANCE";
+        reason = "a parent merged; the rest is not restacked or retargeted yet";
+        next = "workit stack sync";
+      } else {
+        const q = qualify(ctx, stack, entry, doc, row.verdict, grant, doc ? prBinding(ctx, entry, doc) : null);
+        if (q.ok) {
+          verdict = "READY";
+          next = "workit stack land";
+        } else {
+          verdict = "WAITING";
+          reason = `${q.reason}: ${q.detail}`;
+          next = q.unblock;
+        }
+      }
+    }
+    parentName = entry.branch;
+    parentSha = head;
+  }
+  return {
+    ok: true,
+    data: {
+      name: stack.name,
+      trunk: stack.trunk,
+      verdict: verdict ?? "COMPLETE",
+      reason,
+      next,
+      branches
+    }
+  };
+}
+function detectMerged(ctx, cwd, stack, trunkSha, state) {
+  const newly = [];
+  for (const entry of stack.branches) {
+    if (entry.merged)
+      continue;
+    let merged = false;
+    if (entry.pr && ctx) {
+      const read = statusDoc(ctx, entry.pr);
+      if (!read.ok)
+        return fromForge(read);
+      if (read.data.head.branch !== entry.branch)
+        return stackFail("blocked", `pr_mismatch: ${noun2(ctx.resolved, entry.pr)} is for ${read.data.head.branch}, not ${entry.branch}`, `workit stack plan --name ${stack.name}  # re-resolve the PRs`, { branch: entry.branch, pr: entry.pr });
+      state.docs.set(entry.pr, read.data);
+      merged = read.data.state === "merged";
+    } else {
+      const tip = branchTip(cwd, entry.branch);
+      merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+    }
+    if (merged) {
+      entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
+      newly.push({ branch: entry.branch, pr: entry.pr });
+    }
+  }
+  return { ok: true, data: newly };
+}
+function pushBranch(cwd, actor, branch, priorTip) {
+  const plan = stackDeps.pushPlan(cwd, branch);
+  if (!plan.ok)
+    return fromForge(plan);
+  const remote = remoteRefTip(cwd, plan.data.rawUrl, `refs/heads/${branch}`);
+  if (!remote.ok)
+    return stackFail(remote.code, remote.error);
+  if (remote.sha === plan.data.sha)
+    return { ok: true, data: { pushed: false, forced: false, sha: plan.data.sha } };
+  const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
+  if (!grant.allowed)
+    return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
+  const force = remote.sha !== null && !isAncestor(cwd, remote.sha, plan.data.sha);
+  const expect = !force ? null : remote.sha === priorTip ? priorTip : recordedRemoteTip(cwd, plan.data) ?? null;
+  const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
+  if (!pushed.ok)
+    return { ...fromForge(pushed), data: { branch } };
+  return {
+    ok: true,
+    data: { pushed: pushed.data.pushed, forced: pushed.data.forced, sha: plan.data.sha }
+  };
+}
+function syncStack(cwd, ctx, stack, options, actor) {
+  const remote = remoteFor(cwd, ctx?.resolved ?? null, stack.trunk);
+  let observedTrunk = null;
+  if (!options.dryRun && safeRef2(stack.trunk)) {
+    const fetched = fetchRefs(cwd, remote, [
+      `+refs/heads/${stack.trunk}:refs/remotes/${remote}/${stack.trunk}`
+    ]);
+    if (!fetched.ok)
+      return stackFail(fetched.code, fetched.error, `git fetch ${remote} ${stack.trunk}`);
+  } else if (safeRef2(stack.trunk)) {
+    const remoteTrunk = remoteRefTip(cwd, remote, `refs/heads/${stack.trunk}`);
+    if (remoteTrunk.ok && remoteTrunk.sha) {
+      if (!hasCommit(cwd, remoteTrunk.sha))
+        fetchRefs(cwd, remote, [remoteTrunk.sha]);
+      if (hasCommit(cwd, remoteTrunk.sha))
+        observedTrunk = remoteTrunk.sha;
+    }
+  }
+  const trunkSha = observedTrunk ?? trunkTip(cwd, remote, stack.trunk);
+  if (!trunkSha)
+    return stackFail("not_found", `trunk ${stack.trunk} is not available`, `git fetch ${remote} ${stack.trunk}`);
+  if (ctx) {
+    const mismatch = repoMismatch(ctx, stack);
+    if (mismatch)
+      return mismatch;
+  }
+  const state = { docs: new Map };
+  const merged = detectMerged(ctx, cwd, stack, trunkSha, state);
+  if (!merged.ok)
+    return merged;
+  const outcome = {
+    name: stack.name,
+    dryRun: options.dryRun,
+    merged: merged.data,
+    steps: []
+  };
+  pruneScratch(cwd);
+  let parent = { name: stack.trunk, tip: trunkSha };
+  let processed = 0;
+  for (const entry of stack.branches) {
+    if (entry.merged)
+      continue;
+    if (options.limit !== undefined && processed >= options.limit)
+      break;
+    processed += 1;
+    touchStackLock();
+    const tip = branchTip(cwd, entry.branch);
+    if (!tip)
+      return stackFail("not_found", `stack branch ${entry.branch} does not exist locally`, `git branch ${entry.branch} ${remote}/${entry.branch}  # then workit stack sync`, { progress: outcome });
+    const step = {
+      branch: entry.branch,
+      pr: entry.pr,
+      parent: parent.name,
+      restack: null,
+      push: null,
+      retarget: null
+    };
+    let newTip = tip;
+    const parentTip = parent.tip;
+    if (parentTip === null) {
+      step.restack = {
+        from: entry.lastParentHead ?? "?",
+        onto: `${parent.name} (restacked)`,
+        head: null,
+        carried: null
+      };
+      newTip = null;
+    } else if (!isAncestor(cwd, parentTip, tip)) {
+      const pending = entry.pendingRestack ?? null;
+      const from = pending && isAncestor(cwd, pending.onto, tip) ? pending.onto : entry.lastParentHead && isAncestor(cwd, entry.lastParentHead, tip) ? entry.lastParentHead : mergeBase(cwd, entry.lastParentHead ?? parentTip, tip) ?? parentTip;
+      if (options.dryRun) {
+        step.restack = { from, onto: parentTip, head: null, carried: null };
+        newTip = null;
+      } else {
+        touchStackLock();
+        const merges = gitRun2(cwd, ["rev-list", "--merges", `${from}..${tip}`]);
+        if (!merges.ok || merges.stdout.trim())
+          return stackFail("blocked", `merge_commits: ${entry.branch} has merge commits since ${from.slice(0, 12)}; restacking would drop what they resolved`, `git rebase --rebase-merges --onto ${parentTip} ${from} ${entry.branch}  # check the result, then: workit stack sync`, {
+            branch: entry.branch,
+            merges: merges.stdout.trim().split(`
+`).filter(Boolean),
+            progress: outcome
+          });
+        const owner = worktreeOf(cwd, entry.branch);
+        if (owner && rebaseInProgress(owner))
+          return stackFail("blocked", `a rebase is in progress in ${owner}`, `cd ${owner} && git rebase --continue  # or --abort; then workit stack sync`, { conflict: entry.branch, worktree: owner, progress: outcome });
+        if (owner && trackedDirt(owner))
+          return stackFail("blocked", `dirty_worktree: ${owner} has ${entry.branch} checked out with uncommitted changes; restacking needs it clean`, `commit or stash the changes in ${owner}, then workit stack sync`, { branch: entry.branch, worktree: owner, progress: outcome });
+        entry.pendingRestack = pending ? { ...pending, onto: parentTip } : { from, tip, onto: parentTip };
+        const recorded = writeStack(cwd, stack);
+        if (!recorded.ok)
+          return recorded;
+        const rebased = stackDeps.adapter.restack(cwd, {
+          branch: entry.branch,
+          onto: parentTip,
+          from
+        });
+        touchStackLock();
+        if (!rebased.ok) {
+          outcome.steps.push(step);
+          if (rebased.timedOut)
+            return stackFail("failed", `timed_out: restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`, `finish or abort the rebase in ${rebased.worktree} (git rebase --continue | --abort), then workit stack sync  # slow hooks: raise WORKIT_STACK_REBASE_TIMEOUT_MS`, {
+              reason: "timed_out",
+              branch: entry.branch,
+              worktree: rebased.worktree,
+              progress: outcome
+            });
+          return rebased.conflict ? stackFail("blocked", `conflict restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`, `resolve the conflicts in ${rebased.worktree}, git rebase --continue, then workit stack sync  # or git rebase --abort`, { conflict: entry.branch, worktree: rebased.worktree, progress: outcome }) : stackFail("failed", `restacking ${entry.branch} failed: ${rebased.error}`, undefined, {
+            branch: entry.branch,
+            progress: outcome
+          });
+        }
+        newTip = rebased.head;
+        step.restack = { from, onto: parentTip, head: newTip, carried: null };
+      }
+    }
+    if (!options.dryRun && newTip) {
+      const check = entry.pendingRestack && parentTip && isAncestor(cwd, parentTip, newTip) ? entry.pendingRestack : null;
+      let forced = false;
+      if (check && parentTip) {
+        const before = {
+          d: diffHash(cwd, check.from, check.tip),
+          commits: commitCount(cwd, check.from, check.tip)
+        };
+        const after = {
+          d: diffHash(cwd, parentTip, newTip),
+          commits: commitCount(cwd, parentTip, newTip)
+        };
+        const sameContent = before.d !== null && before.d === after.d;
+        const dropped = Math.max(0, before.commits - after.commits);
+        if (!sameContent || dropped > 0) {
+          if (!options.force?.has(entry.branch)) {
+            outcome.steps.push(step);
+            const written = writeStack(cwd, stack);
+            if (!written.ok)
+              return written;
+            return stackFail("blocked", `content_changed: ${entry.branch} on ${parent.name} is not the same change it was on ${check.from.slice(0, 12)}${dropped ? ` (${dropped} commit${dropped === 1 ? "" : "s"} dropped as empty or already applied)` : ""}; nothing was pushed`, `inspect: git range-diff ${check.from}..${check.tip} ${parentTip}..${newTip}  # if intended: workit stack sync --force ${entry.branch}; to undo: git branch -f ${entry.branch} ${check.tip}`, {
+              reason: "content_changed",
+              branch: entry.branch,
+              before: {
+                base: check.from,
+                head: check.tip,
+                commits: before.commits,
+                stat: shortStat(cwd, check.from, check.tip)
+              },
+              after: {
+                base: parentTip,
+                head: newTip,
+                commits: after.commits,
+                stat: shortStat(cwd, parentTip, newTip)
+              },
+              dropped,
+              progress: outcome
+            });
+          }
+          forced = true;
+        }
+        entry.pendingRestack = null;
+      }
+      const moved = entry.lastHead !== null && entry.lastHead !== newTip && entry.lastParentHead !== null && parentTip !== null && parentTip !== entry.lastParentHead;
+      if (moved && parentTip) {
+        const fromBase = entry.lastParentHead;
+        const fromHead = entry.lastHead;
+        const before = {
+          p: patchId(cwd, fromBase, fromHead),
+          d: diffHash(cwd, fromBase, fromHead)
+        };
+        const after = { p: patchId(cwd, parentTip, newTip), d: diffHash(cwd, parentTip, newTip) };
+        const equal = before.d !== null && before.d === after.d && before.p !== null && before.p === after.p;
+        appendObserved(cwd, {
+          type: "stack.restacked",
+          actor,
+          stack: stack.name,
+          branch: entry.branch,
+          head: newTip,
+          fromHead,
+          fromBase,
+          toBase: parentTip,
+          patchId: after.p,
+          diffHash: after.d,
+          patchEqual: equal,
+          forced
+        });
+        if (step.restack)
+          step.restack.carried = equal;
+        else
+          step.restack = { from: fromBase, onto: parentTip, head: newTip, carried: equal };
+      }
+      if (options.publish) {
+        touchStackLock();
+        const pushed = pushBranch(cwd, actor, entry.branch, entry.lastHead ?? tip);
+        touchStackLock();
+        if (!pushed.ok) {
+          outcome.steps.push(step);
+          return { ...pushed, data: { ...pushed.data, progress: outcome } };
+        }
+        step.push = pushed.data;
+      }
+      entry.lastHead = newTip;
+      entry.lastParentHead = parentTip;
+      entry.patchId = parentTip ? patchId(cwd, parentTip, newTip) : null;
+    }
+    if (options.publish && ctx && entry.pr) {
+      const doc = state.docs.get(entry.pr);
+      if (doc && doc.state === "open" && doc.base !== parent.name) {
+        step.retarget = { from: doc.base, to: parent.name };
+        if (!options.dryRun) {
+          const grant = requireGrant(cwd, "pr");
+          if (!grant.allowed)
+            return stackFail("blocked", grant.error, grant.unblock, {
+              reason: grant.reason,
+              progress: outcome
+            });
+          const updated = ctx.resolved.forge.updateBase(entry.pr, parent.name);
+          if (!updated.ok)
+            return { ...fromForge(updated), data: { branch: entry.branch, progress: outcome } };
+          appendObserved(cwd, {
+            type: "pr.retargeted",
+            actor,
+            stack: stack.name,
+            branch: entry.branch,
+            head: newTip,
+            pr: entry.pr,
+            base: parent.name,
+            previousBase: doc.base
+          });
+        }
+      }
+    }
+    entry.parent = parent.name;
+    outcome.steps.push(step);
+    if (!options.dryRun) {
+      const written = writeStack(cwd, stack);
+      if (!written.ok)
+        return written;
+    }
+    parent = { name: entry.branch, tip: newTip };
+  }
+  if (!options.dryRun) {
+    const written = writeStack(cwd, stack);
+    if (!written.ok)
+      return written;
+  }
+  return { ok: true, data: outcome };
+}
+async function awaitChecks(ctx, pr, head, options) {
+  let waited = 0;
+  for (let poll = 0;; poll += 1) {
+    touchStackLock();
+    const doc = statusDoc(ctx, pr);
+    if (!doc.ok)
+      return doc;
+    const verdict = waitVerdict(doc.data, { head, elapsedMs: waited });
+    if (verdict.state !== "waiting" || waited >= options.timeoutMs)
+      return doc;
+    const delay = Math.min(pollDelay(options.intervalMs, poll), Math.max(1, options.timeoutMs - waited));
+    await ctx.sleep(delay);
+    waited += delay;
+  }
+}
+async function landStack(ctx, stack, options) {
+  const outcome = {
+    name: stack.name,
+    dryRun: options.dryRun,
+    landed: [],
+    wouldLand: [],
+    stoppedAt: null,
+    retargeted: [],
+    restacked: [],
+    complete: false
+  };
+  const absorb = (sync) => {
+    for (const step of sync.steps) {
+      if (step.retarget && step.pr && !outcome.retargeted.includes(step.pr))
+        outcome.retargeted.push(step.pr);
+      if (step.restack?.head && !outcome.restacked.includes(step.branch))
+        outcome.restacked.push(step.branch);
+    }
+  };
+  const failWith = (error) => ({
+    ...error,
+    data: { ...error.data, land: outcome }
+  });
+  const mismatch = repoMismatch(ctx, stack);
+  if (mismatch)
+    return failWith(mismatch);
+  if (!options.dryRun) {
+    const synced = syncStack(ctx.cwd, ctx, stack, { publish: true, dryRun: false, limit: 1 }, ctx.actor);
+    if (!synced.ok)
+      return failWith(synced);
+    absorb(synced.data);
+  }
+  const ledgerRows = () => {
+    const ledger = readLedger(ctx.cwd);
+    return ledger.ok ? ledger.value.rows : [];
+  };
+  const simulated = new Set;
+  let justRestacked = new Set(outcome.restacked);
+  for (;; ) {
+    touchStackLock();
+    const entry = stack.branches.find((candidate) => !candidate.merged && !simulated.has(candidate.branch));
+    if (!entry) {
+      outcome.complete = !options.dryRun || stack.branches.every((candidate) => candidate.merged || simulated.has(candidate.branch));
+      break;
+    }
+    if (options.max !== null && outcome.landed.length + outcome.wouldLand.length >= options.max) {
+      outcome.stoppedAt = {
+        pr: entry.pr,
+        branch: entry.branch,
+        reason: "max_reached",
+        detail: `--max ${options.max} reached`,
+        unblock: "workit stack land",
+        ready: false
+      };
+      break;
+    }
+    let doc = null;
+    if (entry.pr) {
+      const head = branchTip(ctx.cwd, entry.branch);
+      const read = justRestacked.has(entry.branch) && head ? await awaitChecks(ctx, entry.pr, head, options) : statusDoc(ctx, entry.pr);
+      if (!read.ok)
+        return failWith(fromForge(read));
+      doc = read.data;
+      if (options.dryRun && doc.state === "merged") {
+        simulated.add(entry.branch);
+        continue;
+      }
+    }
+    const grant = requireGrant(ctx.cwd, "merge");
+    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows());
+    const effective = options.dryRun && simulated.size > 0 && doc ? { ...doc, base: stack.trunk } : doc;
+    const q = qualify(ctx, stack, entry, effective, verdict, grant, doc ? prBinding(ctx, entry, doc) : null);
+    if (!q.ok) {
+      outcome.stoppedAt = {
+        pr: entry.pr,
+        branch: entry.branch,
+        reason: q.reason,
+        detail: q.detail,
+        unblock: q.unblock,
+        ready: q.ready
+      };
+      break;
+    }
+    const pr = entry.pr;
+    if (options.dryRun) {
+      outcome.wouldLand.push({ pr, branch: entry.branch });
+      simulated.add(entry.branch);
+      continue;
+    }
+    const merged = await mergePullRequest(ctx.cwd, ctx.resolved, {
+      pr,
+      method: options.method,
+      deleteBranch: false,
+      actor: ctx.actor,
+      expect: { base: stack.trunk, branch: entry.branch }
+    }, ctx.sleep);
+    if (!merged.ok) {
+      if (merged.code === "blocked" && "refusal" in merged && merged.refusal) {
+        outcome.stoppedAt = {
+          pr,
+          branch: entry.branch,
+          reason: "merge_refused",
+          detail: merged.error,
+          unblock: merged.unblock ?? `workit pr status --pr ${pr}`,
+          ready: false
+        };
+        break;
+      }
+      return failWith(stackFail(merged.code, merged.error, merged.unblock));
+    }
+    outcome.landed.push({ pr, branch: entry.branch, mergeSha: merged.data.mergeSha });
+    entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
+    const written = writeStack(ctx.cwd, stack);
+    if (!written.ok)
+      return failWith(written);
+    const before = new Set(outcome.restacked);
+    const synced = syncStack(ctx.cwd, ctx, stack, { publish: true, dryRun: false, limit: 1 }, ctx.actor);
+    if (!synced.ok)
+      return failWith(synced);
+    absorb(synced.data);
+    justRestacked = new Set(outcome.restacked.filter((branch) => !before.has(branch)));
+    for (const step of synced.data.steps)
+      if (step.restack?.head)
+        justRestacked.add(step.branch);
+  }
+  return { ok: true, data: outcome };
+}
+var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {},
+  ...data ? { data } : {}
+}), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
+  const run = spawnSync21("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_EDITOR: "true",
+      GIT_SEQUENCE_EDITOR: "true",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const failure = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: run.error ? String(run.error.message) : run.stderr ?? "",
+    timedOut: failure?.code === "ETIMEDOUT"
+  };
+}, safeRef2 = (value) => value.length > 0 && !value.startsWith("-"), isAncestor = (cwd, ancestor, descendant) => safeRef2(ancestor) && safeRef2(descendant) && gitRun2(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`), trackedDirt = (dir) => {
+  const status = gitRun2(dir, ["status", "--porcelain", "--untracked-files=no"]);
+  return !status.ok || status.stdout.trim() !== "";
+}, scratchDir = (cwd) => {
+  const dir = stacksDir(cwd);
+  return dir.ok ? path42.join(dir.data, "worktrees") : null;
+}, firstLine = (run) => (`${run.stderr}
+${run.stdout}`.split(`
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+  if (name.length === 0 || name.length > 200)
+    return false;
+  for (let index = 0;index < name.length; index += 1) {
+    const code = name.charCodeAt(index);
+    if (code < 32 || code === 127)
+      return false;
+  }
+  return true;
+}, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str2 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+  let raw = null;
+  try {
+    raw = fs23.readFileSync(path42.join(lock, OWNER), "utf8");
+  } catch {
+    raw = null;
+  }
+  let age = null;
+  for (const target of [path42.join(lock, OWNER), lock])
+    try {
+      age = Date.now() - fs23.statSync(target).mtimeMs;
+      break;
+    } catch {}
+  return { raw, age };
+}, activeBeat = null, touchStackLock = () => activeBeat?.(), remoteFor = (cwd, resolved, trunk) => resolved?.baseRemote ?? pushRemoteName(cwd, trunk) ?? "origin", trunkTip = (cwd, remote, trunk) => resolveRef(cwd, `refs/remotes/${remote}/${trunk}`) ?? branchTip(cwd, trunk), noun2 = (resolved, pr) => `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${pr}`, verdictOf = (cwd, branch, rows) => {
+  const check = checkVerdicts(cwd, branch, rows);
+  return {
+    accepted: check.accepted.accepted,
+    basis: check.current.basis,
+    reasons: check.accepted.reasons,
+    verdictId: typeof check.accepted.verdict?.id === "string" && check.accepted.accepted ? check.accepted.verdict.id : null
+  };
+}, commitCount = (cwd, base, head) => Number(gitRun2(cwd, ["rev-list", "--count", "--no-merges", `${base}..${head}`]).stdout.trim()) || 0, shortStat = (cwd, base, head) => gitRun2(cwd, ["diff", "--shortstat", `${base}...${head}`]).stdout.trim();
+var init_stack = __esm(() => {
+  init_autonomy();
+  init_store_lock();
+  init_pr_ops();
+  init_report();
+  init_ops();
+  init_rev();
+  init_ledger();
+  stackDeps = {
+    pushPlan: (cwd, branch) => pushPreflight(cwd, { branch }),
+    adapter: { name: "git", restack: (cwd, input) => gitRestack(cwd, input) },
+    rebaseTimeoutMs: Number(process.env.WORKIT_STACK_REBASE_TIMEOUT_MS) || 10 * 60000
+  };
+  fileFor = stackFileName;
+  HEARTBEAT_STALE_MS = 2 * 60000;
 });
 
 // packages/workit-cli/src/verbs/stack.ts
@@ -78745,10 +79987,199 @@ var exports_stack = {};
 __export(exports_stack, {
   run: () => run17
 });
-var run17;
-var init_stack = __esm(() => {
-  init_stub();
-  run17 = notImplemented("stack", "S12");
+async function plan(argv, io) {
+  const flags = parseFlags(argv, { name: "value", trunk: "value" });
+  if (typeof flags === "string")
+    return usage3(io, flags, PLAN_USAGE);
+  const name = flags.values.name ?? null;
+  const existingByName = name ? readStack(io.cwd, name) : null;
+  if (existingByName && !existingByName.ok)
+    return stackFailed(io, existingByName);
+  let existing = existingByName?.ok ? existingByName.data : null;
+  if (!name && flags.positionals.length === 0) {
+    const selected = selectStack(io.cwd, null);
+    if (selected.ok)
+      existing = selected.data;
+  }
+  const trunk = flags.values.trunk ?? existing?.trunk ?? defaultTrunk(io) ?? "main";
+  const connected = connect(io, flags.positionals[0] ?? null);
+  const resolved = connected.ok ? connected.data : null;
+  const planned = planStack(io.cwd, resolved, { name, trunk, branches: flags.positionals }, existing);
+  if (!planned.ok)
+    return stackFailed(io, planned);
+  if (!connected.ok)
+    planned.data.notes.push(`forge: ${connected.error}${connected.unblock ? ` (${connected.unblock})` : ""}`);
+  const result = await withStackLock(io.cwd, planned.data.stack.name, async () => {
+    const written = writeStack(io.cwd, planned.data.stack);
+    return written.ok ? planned : written;
+  });
+  if (!result.ok)
+    return stackFailed(io, result);
+  return emit(io, ok(result.data), (data) => [
+    `${data.created ? "planned" : "re-planned"} stack ${data.stack.name} on ${data.stack.trunk}:`,
+    ...data.stack.branches.map((entry, index) => {
+      const check = data.checks.find((item) => item.branch === entry.branch);
+      return `  ${index + 1}. ${entry.branch} <- ${entry.parent}  ${entry.merged ? "merged" : label(data.stack.forge, entry.pr)}${check && !check.onParent ? "  (not on its parent)" : ""}${check?.baseMatches === false ? `  (PR base ${check.prBase})` : ""}`;
+    }),
+    ...data.notes.map((note) => `note: ${note}`)
+  ]);
+}
+async function status2(argv, io) {
+  const flags = parseFlags(argv, { name: "value" });
+  if (typeof flags === "string")
+    return usage3(io, flags, STATUS_USAGE2);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE2);
+  const selected = selectStack(io.cwd, flags.values.name ?? null);
+  if (!selected.ok)
+    return stackFailed(io, selected);
+  const connected = connect(io, selected.data.branches[0]?.branch ?? null);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const result = stackStatus({ cwd: io.cwd, resolved: connected.data, actor: actorFromEnv(io.env), sleep: forgeDeps.sleep }, selected.data);
+  if (!result.ok)
+    return stackFailed(io, result);
+  return emit(io, ok(result.data), (data) => [
+    `stack ${data.name} on ${data.trunk}: ${data.verdict}${data.reason ? ` (${data.reason})` : ""}`,
+    ...data.branches.map((row, index) => `  ${index + 1}. ${row.branch} ${label(connected.data.forge.kind, row.pr)} ${row.merged ? "merged" : `${row.next ?? "?"} · checks ${row.checks ?? "?"} · verdict ${row.verdict.accepted ? `accepted (${row.verdict.basis})` : `missing (${row.verdict.reasons.join(", ") || row.verdict.basis})`} · ${row.onParent === false ? `not on ${row.parent}` : `on ${row.parent}`}${row.baseMatches === false ? ` · PR base ${row.prBase}` : ""}`}`),
+    ...data.next ? [`next: ${data.next}`] : []
+  ]);
+}
+async function sync(argv, io) {
+  const flags = parseFlags(argv, {
+    name: "value",
+    local: "boolean",
+    "dry-run": "boolean",
+    force: "list"
+  });
+  if (typeof flags === "string")
+    return usage3(io, flags, SYNC_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, SYNC_USAGE);
+  const selected = selectStack(io.cwd, flags.values.name ?? null);
+  if (!selected.ok)
+    return stackFailed(io, selected);
+  const force = new Set(flags.lists.force ?? []);
+  const unknown = [...force].filter((branch) => !selected.data.branches.some((entry) => entry.branch === branch));
+  if (unknown.length)
+    return usage3(io, `--force ${unknown[0]}: not a branch of stack ${selected.data.name}`, SYNC_USAGE);
+  const local = flags.booleans.has("local");
+  let ctx = null;
+  if (!local) {
+    const connected = connect(io, selected.data.branches[0]?.branch ?? null);
+    if (!connected.ok)
+      return forgeFail(io, connected);
+    ctx = {
+      cwd: io.cwd,
+      resolved: connected.data,
+      actor: actorFromEnv(io.env),
+      sleep: forgeDeps.sleep
+    };
+  }
+  const name = selected.data.name;
+  const result = await withStackLock(io.cwd, name, async () => {
+    const fresh = readStack(io.cwd, name);
+    if (!fresh.ok)
+      return fresh;
+    return syncStack(io.cwd, ctx, fresh.data ?? selected.data, {
+      publish: !local,
+      dryRun: flags.booleans.has("dry-run"),
+      force
+    }, actorFromEnv(io.env));
+  });
+  if (!result.ok)
+    return stackFailed(io, result);
+  return emit(io, ok(result.data), renderSync);
+}
+async function land(argv, io) {
+  const flags = parseFlags(argv, {
+    name: "value",
+    "dry-run": "boolean",
+    max: "value",
+    method: "value",
+    timeout: "value",
+    interval: "value"
+  });
+  if (typeof flags === "string")
+    return usage3(io, flags, LAND_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, LAND_USAGE);
+  const max = positiveInt(flags.values.max, "--max");
+  if (typeof max === "string")
+    return usage3(io, max, LAND_USAGE);
+  const method = flags.values.method ?? "squash";
+  if (!METHODS3.has(method))
+    return usage3(io, "--method must be squash, merge or rebase", LAND_USAGE);
+  const timeoutMs = parseDuration2(flags.values.timeout ?? "20m");
+  const intervalMs = parseDuration2(flags.values.interval ?? "30s");
+  if (timeoutMs === null || timeoutMs > 6 * 3600000)
+    return usage3(io, "--timeout must be a duration up to 6h (20m, 90s)", LAND_USAGE);
+  if (intervalMs === null || intervalMs < 1000 || intervalMs > 600000)
+    return usage3(io, "--interval must be between 1s and 10m", LAND_USAGE);
+  const selected = selectStack(io.cwd, flags.values.name ?? null);
+  if (!selected.ok)
+    return stackFailed(io, selected);
+  const connected = connect(io, selected.data.branches[0]?.branch ?? null);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const name = selected.data.name;
+  const result = await withStackLock(io.cwd, name, async () => {
+    const fresh = readStack(io.cwd, name);
+    if (!fresh.ok)
+      return fresh;
+    return landStack({
+      cwd: io.cwd,
+      resolved: connected.data,
+      actor: actorFromEnv(io.env),
+      sleep: forgeDeps.sleep
+    }, fresh.data ?? selected.data, { dryRun: flags.booleans.has("dry-run"), max, method, timeoutMs, intervalMs });
+  });
+  if (!result.ok)
+    return stackFailed(io, result);
+  const kind = connected.data.forge.kind;
+  return emit(io, ok(result.data), (data) => [
+    ...data.dryRun ? [
+      data.wouldLand.length ? `would land: ${data.wouldLand.map((item) => `${label(kind, item.pr)} (${item.branch})`).join(", ")}` : "would land nothing"
+    ] : [
+      data.landed.length ? `landed: ${data.landed.map((item) => `${label(kind, item.pr)} (${item.branch}) -> ${short4(item.mergeSha)}`).join(", ")}` : "landed nothing"
+    ],
+    ...data.retargeted.length ? [`retargeted: ${data.retargeted.map((pr) => label(kind, pr)).join(", ")}`] : [],
+    ...data.restacked.length ? [`restacked: ${data.restacked.join(", ")}`] : [],
+    data.stoppedAt ? `stopped at ${label(kind, data.stoppedAt.pr)} (${data.stoppedAt.branch}): ${data.stoppedAt.reason}${data.stoppedAt.ready ? " (verified, ready)" : ""} - ${data.stoppedAt.detail}
+  unblock: ${data.stoppedAt.unblock}` : data.complete ? "stack complete" : ""
+  ].filter(Boolean));
+}
+async function run17(argv, io) {
+  const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
+  if (sub === "plan")
+    return plan(rest, io);
+  if (sub === "status")
+    return status2(rest, io);
+  if (sub === "sync")
+    return sync(rest, io);
+  if (sub === "land")
+    return land(rest, io);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE5);
+}
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--timeout 20m] [--interval 30s] [--json]", USAGE5 = "workit stack plan|status|sync|land ... (workit help stack)", short4 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), defaultTrunk = (io) => {
+  const resolved = vcsConfig("resolve", io.cwd);
+  return resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+}, label = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
+  `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
+  ...data.steps.map((step) => [
+    `  ${step.branch} on ${step.parent}:`,
+    step.restack ? `restacked ${short4(step.restack.from)} -> ${short4(step.restack.onto)}${step.restack.head ? ` = ${short4(step.restack.head)}` : ""}${step.restack.carried === true ? " (same change; verdict carries)" : step.restack.carried === false ? " (change differs; verdict stale)" : ""}` : "up to date",
+    step.push ? step.push.pushed ? `pushed${step.push.forced ? " (lease)" : ""}` : "remote current" : "",
+    step.retarget ? `retargeted ${step.retarget.from} -> ${step.retarget.to}` : ""
+  ].filter(Boolean).join(" "))
+], METHODS3;
+var init_stack2 = __esm(() => {
+  init_ledger();
+  init_stack();
+  init_vcs_config();
+  init_output();
+  init_forge_common();
+  METHODS3 = new Set(["squash", "merge", "rebase"]);
 });
 
 // packages/workit-cli/src/verbs/ledger.ts
@@ -78866,12 +80297,12 @@ async function run18(argv, io) {
     evidenceRefs: values.evidence
   }), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
 }
-var USAGE5 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, positiveInt2 = (value, flag) => {
+var USAGE6 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, positiveInt2 = (value, flag) => {
   if (value === undefined)
     return;
   const parsed = Number(value);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
-}, failed = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE5 })), verdictLines = (check) => {
+}, failed = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE6 })), verdictLines = (check) => {
   const lines = [
     `${check.branch} @ ${(check.head ?? "no commit").slice(0, 12)}: current: ${check.current.basis}${typeof check.current.verdict?.result === "string" ? ` (${check.current.verdict.result})` : ""}; ${check.accepted.accepted ? "accepted" : `not accepted (${check.accepted.reasons.join(", ")})`}`
   ];
@@ -93863,7 +95294,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path42 from "node:path";
+import path43 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -94356,12 +95787,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path42.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path43.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path42.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path43.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -94749,11 +96180,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync23, statSync as statSync7 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 function git5(cwd, args) {
-  const run = spawnSync21("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync22("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -94764,7 +96195,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync10(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path43.join(dir, entry.name);
+    const full = path44.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -94776,7 +96207,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path43.resolve(cwd, input);
+    const full = path44.resolve(cwd, input);
     if (!existsSync20(full))
       missing.push(input);
     else if (statSync7(full).isDirectory())
@@ -94813,11 +96244,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path43.join(root, file), lines);
+    changed.set(path44.join(root, file), lines);
   }
   const untracked = git5(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path43.join(root, file), "all");
+    changed.set(path44.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -94879,7 +96310,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path43.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path44.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -94909,7 +96340,7 @@ import {
   copyFileSync as copyFileSync4
 } from "node:fs";
 import os14 from "node:os";
-import path44 from "node:path";
+import path45 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -94982,7 +96413,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path44.posix.join(path44.posix.dirname(file), spec)) === target)
+        if (stripExt(path45.posix.join(path45.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -95002,12 +96433,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path44.join(tmp, name);
+    const dir = path45.join(tmp, name);
     try {
       const stat = lstatSync9(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync24(path44.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync24(path45.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -95024,8 +96455,8 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
   for (const entry of readdirSync11(origin, { withFileTypes: true })) {
-    const from = path44.join(origin, entry.name);
-    const to = path44.join(target, entry.name);
+    const from = path45.join(origin, entry.name);
+    const to = path45.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -95041,9 +96472,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path44.relative(repo, real);
-      if (!relative.startsWith("..") && !path44.isAbsolute(relative) && !relative.split(path44.sep).includes("node_modules")) {
-        symlinkSync(path44.join(copy, relative), to, "junction");
+      const relative = path45.relative(repo, real);
+      if (!relative.startsWith("..") && !path45.isAbsolute(relative) && !relative.split(path45.sep).includes("node_modules")) {
+        symlinkSync(path45.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -95059,7 +96490,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync12(repo);
   if (real && inside2(realRepo, real)) {
-    symlinkSync(path44.relative(path44.dirname(to), path44.join(tree, path44.relative(realRepo, real))), to);
+    symlinkSync(path45.relative(path45.dirname(to), path45.join(tree, path45.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync8(real).isFile())
@@ -95068,10 +96499,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path44.join(copy, file);
+  const target = path45.join(copy, file);
   try {
     const stat = lstatSync9(target);
-    if (!stat.isFile() || !inside2(realpathSync12(copy), realpathSync12(path44.dirname(target))))
+    if (!stat.isFile() || !inside2(realpathSync12(copy), realpathSync12(path45.dirname(target))))
       return false;
   } catch {
     return false;
@@ -95082,9 +96513,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync2(path44.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync9(path44.join(dir, PID_FILE), String(process.pid));
-  const tree = path44.join(dir, "tree");
+  const dir = mkdtempSync2(path45.join(os14.tmpdir(), TEMP_PREFIX));
+  writeFileSync9(path45.join(dir, PID_FILE), String(process.pid));
+  const tree = path45.join(dir, "tree");
   const head = git5(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git5(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git5(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -95101,29 +96532,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path44.join(repo, relative);
+    const from = path45.join(repo, relative);
     let stat;
     try {
       stat = lstatSync9(from);
     } catch {
       continue;
     }
-    const to = path44.join(tree, relative);
-    mkdirSync10(path44.dirname(to), { recursive: true });
+    const to = path45.join(tree, relative);
+    mkdirSync10(path45.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync4(from, to);
-    let parent = path44.dirname(relative);
+    let parent = path45.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path44.dirname(parent);
+      parent = path45.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path44.join(repo, parent, "node_modules");
-    if (existsSync21(modules) && !existsSync21(path44.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path44.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path45.join(repo, parent, "node_modules");
+    if (existsSync21(modules) && !existsSync21(path45.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path45.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -95162,14 +96593,14 @@ async function runMutation(options) {
   const tracked = git5(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync24(path44.join(repo, file), "utf8") };
+      return { file, text: readFileSync24(path45.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path44.relative(repo, absolute));
+    const relative = toPosix(path45.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync21(absolute))
@@ -95183,9 +96614,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path44.relative(repo, options.cwd);
+  const cwdRelative = path45.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path44.relative(cwdRelative, file));
+    const relative = toPosix(path45.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -95220,7 +96651,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path44.join(copy, cwdRelative);
+  const copyCwd = path45.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -95255,7 +96686,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync24(path44.join(copy, mutant.file), "utf8");
+      const original = readFileSync24(path45.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -95312,8 +96743,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside2 = (root, file) => {
-  const relative = path44.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path44.isAbsolute(relative);
+  const relative = path45.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path45.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -95362,7 +96793,7 @@ __export(exports_test_audit, {
   run: () => run19
 });
 import { existsSync as existsSync22 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 function parse6(argv) {
   const options = {
     paths: [],
@@ -95460,10 +96891,10 @@ async function run19(argv, io) {
   const options = parse6(argv);
   if (typeof options === "string")
     return emit(io, fail("invalid_input", `${options}
-usage: ${USAGE6}`));
+usage: ${USAGE7}`));
   const top = git5(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path45.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path45.relative(io.cwd, file) || file);
+  const repo = top.ok ? path46.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path46.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -95546,7 +96977,7 @@ usage: ${USAGE6}`));
   }
   return emit(io, ok(data), human);
 }
-var USAGE6 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
+var USAGE7 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
 var init_test_audit = __esm(() => {
   init_audit();
   init_mutate();
@@ -95572,7 +97003,7 @@ __export(exports_handoff, {
 import { parseArgs as parseArgs2 } from "node:util";
 function human2(brief) {
   const lines = [
-    `branch: ${brief.branch ?? "(detached)"} @ ${short4(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
+    `branch: ${brief.branch ?? "(detached)"} @ ${short5(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
   ];
   if (brief.base)
     lines.push(`base:   ${brief.base}${brief.ahead === null ? "" : ` (ahead ${brief.ahead}, behind ${brief.behind})`}`);
@@ -95615,11 +97046,11 @@ async function resumeBrief(argv, io) {
       strict: true
     }));
   } catch (error) {
-    return emit(io, fail("invalid_input", error.message, { unblock: USAGE7 }));
+    return emit(io, fail("invalid_input", error.message, { unblock: USAGE8 }));
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
-    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE7 }));
+    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE8 }));
   const built = buildHandoff(io.cwd, {
     last,
     note: values.note ?? null,
@@ -95643,7 +97074,7 @@ async function run20(argv, io) {
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE7 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short4 = (sha) => sha ? sha.slice(0, 12) : "no commit";
+var USAGE8 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short5 = (sha) => sha ? sha.slice(0, 12) : "no commit";
 var init_handoff = __esm(() => {
   init_ledger();
   init_output();
@@ -95652,7 +97083,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_package();
 init_output();
-import path46 from "node:path";
+import path47 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -95768,10 +97199,9 @@ var VERBS = [
   {
     name: "stack",
     group: "delivery",
-    usage: "workit stack plan|sync|land [--json]",
-    summary: "Plan, restack and land a stack of PRs",
-    planned: "S12",
-    load: () => Promise.resolve().then(() => (init_stack(), exports_stack))
+    usage: "workit stack plan [<bottom> … <top>] | status | sync [--local] | land [--dry-run] [--max <n>] [--json]",
+    summary: "Plan, restack (lease push + retarget) and land a base-branch stack of PRs, root first",
+    load: () => Promise.resolve().then(() => (init_stack2(), exports_stack))
   },
   {
     name: "ledger",
@@ -95877,7 +97307,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path46.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path47.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));