@brainervirus/workit-cli 8.10.0 → 8.12.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.10.0",
+    version: "8.12.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.10.0",
-      "@brainervirus/workit-cursor": "^8.10.0",
-      "@brainervirus/workit-opencode": "^8.10.0",
+      "@brainervirus/workit-core": "^8.12.0",
+      "@brainervirus/workit-cursor": "^8.12.0",
+      "@brainervirus/workit-opencode": "^8.12.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -298,7 +298,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 function matchesNamedCheck(config, name, argv, cwd) {
   if (config.error || name === null || cwd !== ".")
@@ -13404,7 +13404,7 @@ var PREFIXES, branchNames = (workspaceRoot) => {
     return new Set;
   return new Set((r.stdout ?? "").split(`
 `).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
-}, detectBranchPolicy = (workspaceRoot) => {
+}, productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main", detectBranchPolicy = (workspaceRoot) => {
   const names = branchNames(workspaceRoot);
   const develop = names.has("develop");
   const main = names.has("main");
@@ -13690,8 +13690,8 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     profiles: record(nonBlank, profileSchema).optional()
   }).passthrough();
   return entrySchema;
-}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd) => {
-  const file = path12.join(configDir(), "workspaces.json");
+}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path12.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13720,10 +13720,27 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 }, resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+}, workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
 }, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -13874,6 +13891,7 @@ var init_workspaces = __esm(() => {
     autoApprove: union([boolean2(), array(nonBlank)]).optional(),
     defaultEndpoint: unknown().optional(),
     verification: _enum(["self", "independent"]).optional(),
+    trailers: boolean2().optional(),
     autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
       kind,
       union([boolean2(), literal("verified")]).optional()
@@ -16808,10 +16826,35 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
     ])
   };
-}, validateBranchNamePolicy = (name, policy, source) => {
+}, KIND_SYNONYMS, allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+], editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+}, suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+}, kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", "), validateBranchNamePolicy = (name, policy, source) => {
   const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
   if (policy.protected.has(name.toLowerCase())) {
-    const correction = `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "protected_ref",
@@ -16822,7 +16865,8 @@ var withReleaseTracks = (workspaceRoot, policy) => {
     };
   }
   if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const correction = `choose a branch matching one of: ${allowed.join(", ")}`;
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "allowed_pattern",
@@ -16898,7 +16942,45 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       error: `policy_unavailable: cannot validate commit subject ${JSON.stringify(attempted)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
     };
   }
-}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, resolveCommitPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "commit", profileName).commitPolicy, policy = (root) => resolveBranchPolicyFor(root), isProtected = (root, name) => policy(root).protected.has(name.toLowerCase()), isProtectedTarget = (root, name) => {
+}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, resolveCommitPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "commit", profileName).commitPolicy, BRANCH_KINDS, branchKindOf = (name) => {
+  const prefix = name?.split("/", 1)[0]?.toLowerCase() ?? "";
+  return name?.includes("/") && BRANCH_KINDS.includes(prefix) ? prefix : null;
+}, gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+}, flowRoute = (flow, kind) => kind === "hotfix" ? { kind, base: flow.production, target: flow.production, mergeBack: flow.develop } : kind === "release" ? { kind, base: flow.develop, target: flow.production, mergeBack: flow.develop } : { kind, base: flow.develop, target: flow.develop, mergeBack: null }, releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+}, releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase()), shortBranch = (ref) => ref.replace(/^refs\/heads\//u, "").replace(/^(?:refs\/remotes\/)?origin\//u, ""), flowMismatch = (flow, kind, ref, role) => {
+  if (!flow || !kind || !flow.developExists)
+    return null;
+  const route = flowRoute(flow, kind);
+  const expected = role === "base" ? route.base : route.target;
+  const given = shortBranch(ref).toLowerCase();
+  const longLived = [flow.develop, flow.production].map((name) => name.toLowerCase());
+  const backMerge = role === "target" && route.mergeBack?.toLowerCase() === given;
+  if (!longLived.includes(given) || given === expected.toLowerCase() || backMerge)
+    return null;
+  return role === "base" ? `gitflow_base: git-flow starts ${kind}/* from ${expected}, not ${shortBranch(ref)}` : `gitflow_target: git-flow lands ${kind}/* on ${expected}, not ${shortBranch(ref)}`;
+}, policy = (root) => resolveBranchPolicyFor(root), isProtected = (root, name) => policy(root).protected.has(name.toLowerCase()), isProtectedTarget = (root, name) => {
   try {
     return isProtected(root, name);
   } catch {
@@ -16942,11 +17024,116 @@ var init_branch = __esm(() => {
   init_workspaces();
   init_vcs_config();
   init_release_tracks();
+  KIND_SYNONYMS = {
+    fix: "bugfix",
+    fixes: "bugfix",
+    bug: "bugfix",
+    bugs: "bugfix",
+    bugfixes: "bugfix",
+    feat: "feature",
+    features: "feature",
+    chore: "feature",
+    docs: "feature",
+    doc: "feature",
+    refactor: "feature",
+    test: "feature",
+    tests: "feature",
+    ci: "feature",
+    build: "feature",
+    perf: "feature",
+    style: "feature",
+    deps: "feature",
+    task: "feature",
+    enhancement: "feature",
+    hot: "hotfix",
+    hotfixes: "hotfix",
+    releases: "release",
+    rel: "release"
+  };
+  BRANCH_KINDS = ["feature", "bugfix", "release", "hotfix"];
+});
+
+// packages/workit-core/src/hooks/session-marker.ts
+var init_session_marker = __esm(() => {
+  init_paths();
+});
+// packages/workit-core/src/hooks/raw-git.ts
+var SHELLS, PREFIXES2, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, LAUNCHERS, PUSH_VALUE_OPTIONS, VALUE_OPTIONS;
+var init_raw_git = __esm(() => {
+  init_branch();
+  init_workspaces();
+  init_rev();
+  init_ledger();
+  init_paths();
+  init_session_marker();
+  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
+  CD = new Set(["cd", "chdir", "set-location", "sl"]);
+  PUSHD = new Set(["pushd", "push-location"]);
+  POPD = new Set(["popd", "pop-location"]);
+  GIT_VALUE_OPTIONS = new Set([
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--exec-path",
+    "--config-env",
+    "--super-prefix"
+  ]);
+  LAUNCHERS = new Set([
+    "npx",
+    "bunx",
+    "pnpx",
+    "-y",
+    "--yes",
+    "pnpm",
+    "dlx",
+    "exec",
+    "env",
+    "sudo",
+    "command"
+  ]);
+  PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
+  VALUE_OPTIONS = {
+    git: new Set([
+      "-m",
+      "--message",
+      "-F",
+      "--file",
+      "-C",
+      "-c",
+      "--reuse-message",
+      "--reedit-message",
+      "--author",
+      "--date",
+      "--trailer",
+      "-t",
+      "--template",
+      "--cleanup",
+      "--fixup",
+      "--squash",
+      "-o",
+      "--push-option",
+      "--repo",
+      "--receive-pack",
+      "--exec"
+    ]),
+    gh: new Set(["-b", "--body", "-F", "--body-file", "-t", "--title", "--subject", "-A", "--author-email"].concat(["-B", "--base", "-H", "--head", "-l", "--label", "-a", "--assignee"]).concat(["-r", "--reviewer", "-m", "--milestone", "-p", "--project", "-T", "--template"]).concat(["--match-head-commit", "-R", "--repo"])),
+    glab: new Set(["-m", "--message", "--squash-message", "--sha", "-t", "--title", "-d", "--description"].concat(["-b", "--target-branch", "-s", "--source-branch", "-l", "--label"]).concat(["-a", "--assignee", "--reviewer", "-R", "--repo"]))
+  };
 });
 
 // packages/workit-core/src/core/route-intent.ts
+var SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, WORKTREE_VALUES;
 var init_route_intent = __esm(() => {
+  init_raw_git();
   init_branch();
+  SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
+  CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
+  WORKTREE_CREATE = new Set(["-b", "-B"]);
+  BRANCH_NO_CREATE = new Set(["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"].concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"]).concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"]).concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]));
+  BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
+  WORKTREE_VALUES = new Set(["--reason"]);
 });
 
 // packages/workit-core/src/core/runtime-identity.ts
@@ -64278,6 +64465,26 @@ function installSessionHook(cwd, env = process.env) {
     detail: `${verb} the Workit ${SESSION_HOOK_NAME} hook at ${status.hookPath}${helper}`
   };
 }
+function removeSessionHook(cwd, env = process.env) {
+  const status = inspectSessionHook(cwd, env);
+  if (status.state === "not_git")
+    return { action: "skipped", removed: [], status, detail: "not inside a git work tree" };
+  const removed = [];
+  if (workitHookIn(status)) {
+    rmSync2(status.hookPath, { force: true });
+    removed.push(status.hookPath);
+  }
+  if (helperIn(status)) {
+    rmSync2(status.helperPath, { force: true });
+    removed.push(status.helperPath);
+  }
+  return {
+    action: removed.length ? "removed" : "unchanged",
+    removed,
+    status: inspectSessionHook(cwd, env),
+    detail: removed.length ? `removed ${removed.join(" and ")}` : "no Workit session hook or helper to remove"
+  };
+}
 var SESSION_HOOK_NAME = "prepare-commit-msg", SESSION_HOOK_MARKER = "# workit-session-trailer-hook", HELPER, LEGACY_CHAINED = "commit-msg.workit-chained", SESSION_TRAILER_SCRIPT = `#!/bin/sh
 # Workit (https://github.com/BrainerVirus/workit) wrote this file with
 # \`workit doctor --fix\`. A prepare-commit-msg hook runs it with its own
@@ -64305,6 +64512,19 @@ fi
 [ -n "$session" ] || exit 0
 [ \${#session} -le 128 ] || exit 0
 case "$session" in *[!A-Za-z0-9_.:@/+-]*) exit 0 ;; esac
+# A workspace with \`trailers: false\` keeps authorship in the ledger only.
+# \`workit git commit\` decides it already (WORKIT_TRAILERS); otherwise ask
+# workit, bounded, and add the trailer when it cannot answer.
+case "\${WORKIT_TRAILERS-}" in
+  off) exit 0 ;;
+  on) ;;
+  *)
+    if command -v workit >/dev/null 2>&1; then
+      t=; ! command -v timeout >/dev/null 2>&1 || t="timeout 5"
+      [ "$($t workit git trailers 2>/dev/null)" != off ] || exit 0
+    fi
+    ;;
+esac
 add_trailer() {
   [ -f "$1" ] && [ -r "$1" ] || return 0
   body=$(sed '/^# -\\{24\\} >8 -\\{24\\}$/,$d' "$1" | git stripspace --strip-comments)
@@ -64448,7 +64668,7 @@ exit 0
   } finally {
     rmSync2(staged, { force: true });
   }
-};
+}, workitHookIn = (status) => status.hookPath !== null && (readText2(status.hookPath)?.includes(SESSION_HOOK_MARKER) ?? false), helperIn = (status) => status.helperPath !== null && exists(status.helperPath);
 var init_session_hook = __esm(() => {
   init_rev();
   HELPER = ["workit", "session-trailer.sh"];
@@ -65883,12 +66103,34 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       };
   }
 }, checkSessionHook = (res) => {
-  if (!matchedWorkspace(res))
+  const workspace = matchedWorkspace(res);
+  if (!workspace)
     return {
       id: "session_hook",
       status: "pass",
       detail: `not in a Workit workspace — skipping the ${SESSION_HOOK_NAME} session hook`
     };
+  const trailers = workspaceTrailers(res.cwd, res.configDir);
+  if (!trailers.enabled) {
+    const setting = `workspace ${trailers.from ?? workspace.name} sets trailers: false`;
+    const left = inspectSessionHook(res.cwd, res.env);
+    const files = [
+      ...workitHookIn(left) ? [left.hookPath] : [],
+      ...helperIn(left) ? [left.helperPath] : []
+    ];
+    if (files.length)
+      return {
+        id: "session_hook",
+        status: "warn",
+        detail: `${setting}, but Workit's ${files.join(" and ")} ${files.length > 1 ? "are" : "is"} still installed: plain git commits still get a Workit-Session trailer whenever the helper cannot ask workit (it fails open)`,
+        fix: SESSION_HOOK_FIX
+      };
+    return {
+      id: "session_hook",
+      status: "pass",
+      detail: `${setting} (authorship in the ledger only) — no ${SESSION_HOOK_NAME} session hook needed`
+    };
+  }
   const hook = inspectSessionHook(res.cwd, res.env);
   const finding = sessionHookFinding(hook);
   if (!hook.leftover)
@@ -65908,6 +66150,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `${res.cwd} is not in a Workit workspace; no hook installed`,
       workspace: null
     };
+  if (!workspaceTrailers(res.cwd, res.configDir).enabled) {
+    const removal = removeSessionHook(res.cwd, res.env);
+    return {
+      ...removal,
+      detail: `trailers: false; no hook installed (${removal.detail})`,
+      workspace: workspace.name
+    };
+  }
   return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
@@ -72346,7 +72596,10 @@ function runCheckCommand(argv, options) {
   const buffer = new TailBuffer(MAX_LOG_BYTES);
   const redactor = new StreamRedactor((text) => buffer.push(text));
   const env = options.env ?? process.env;
-  const plan = planSpawn(argv, { platform, env, cwd: options.cwd, shell: options.shell });
+  const wrapped = Boolean(options.wrapper?.length) && platform !== "win32";
+  const command = wrapped ? [...options.wrapper, ...options.shell ? ["/bin/sh", "-c", argv[0]] : argv] : argv;
+  const shell = wrapped ? false : options.shell;
+  const plan = planSpawn(command, { platform, env, cwd: options.cwd, shell });
   return new Promise((resolve) => {
     let settled = false;
     let timedOut = false;
@@ -72409,6 +72662,8 @@ function runCheckCommand(argv, options) {
       finish(null, null, error.code ?? error.message);
       return;
     }
+    if (child.pid)
+      options.onSpawn?.(child.pid);
     if (!windows)
       for (const name of FORWARDED_SIGNALS) {
         const handler = () => {
@@ -72715,7 +72970,7 @@ async function runGrant(argv, io, deps = defaultDeps) {
   return usage2(io, `unknown subcommand "${sub}"`);
 }
 var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, describe2 = (grants, configured, endpoint, verification) => [
-  ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (no consumer yet: reserved, not enforced)" : ""}`),
+  ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (workit git push --release: git-flow main and develop, landed v* tags)" : ""}`),
   `  default endpoint: ${endpointLabel(endpoint)} (an unnamed request stops at ${STOPS_AT[endpoint.effectiveEndpoint]})`,
   ...endpoint.endpointIssue ? [`  note: ${endpoint.endpointIssue}`] : [],
   `  verification: ${verification} (${verification === "independent" ? "a normal-risk behavior change needs a non-author verdict" : "a normal-risk behavior change needs a passing check and the author's --self verdict, shown as self-reviewed"})`
@@ -72746,18 +73001,503 @@ var init_grant = __esm(() => {
   };
 });
 
+// packages/workit-core/src/core/resources.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
+import fs20 from "node:fs";
+import os14 from "node:os";
+import path40 from "node:path";
+function memoryValue(value, host) {
+  const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
+  const percent = PERCENT.exec(text.trim());
+  if (percent) {
+    const share = Number(percent[1]);
+    if (share <= 0 || share > 100)
+      return new Error(`memoryMax ${text} must be 1-100%`);
+    return Math.floor(host.totalMemBytes * share / 100);
+  }
+  const size = SIZE.exec(text.trim());
+  if (size && Number(size[1]) > 0)
+    return Math.floor(Number(size[1]) * UNITS[size[2].toUpperCase()]);
+  return new Error(`memoryMax must be a percent of RAM ("40%") or a size ("8G"), got ${text}`);
+}
+function cpuValue(value, host) {
+  if (typeof value === "number" && value > 0)
+    return Math.round(value * 100);
+  const percent = typeof value === "string" ? PERCENT.exec(value.trim()) : null;
+  if (percent) {
+    const share = Number(percent[1]);
+    if (share <= 0 || share > 100)
+      return new Error(`cpuQuota ${percent[0]} must be 1-100%`);
+    return Math.max(1, Math.round(host.cpus * share));
+  }
+  return new Error(`cpuQuota must be a percent of the machine ("70%") or a CPU count, got ${String(value)}`);
+}
+function resolveResourceSettings(sources, host = hostShape()) {
+  let memory = Math.floor(host.totalMemBytes * DEFAULT_MEMORY_SHARE);
+  let cpu = Math.max(1, Math.round(host.cpus * DEFAULT_CPU_SHARE * 100));
+  const settings = {
+    slots: DEFAULT_SLOTS,
+    heavy: [...DEFAULT_HEAVY_CHECKS],
+    memoryMax: "",
+    cpuQuota: "",
+    waitMs: DEFAULT_WAIT_S * 1000,
+    scope: true
+  };
+  const warnings = [];
+  const ordered = [
+    ...sources.filter((source) => source.trust === "machine"),
+    ...sources.filter((source) => source.trust === "repo")
+  ];
+  for (const { label, trust, value } of ordered) {
+    if (value === undefined || value === null)
+      continue;
+    if (!isRecord7(value)) {
+      warnings.push(`${label}: resources must be an object`);
+      continue;
+    }
+    const repo = trust === "repo";
+    const warn = (field, message) => warnings.push(`${label}: ${field}: ${message}`);
+    const machineOnly = (field) => warn(field, "is machine-wide; set it in your workspaces.json, not in the repo");
+    if (value.slots !== undefined) {
+      const slots = value.slots;
+      if (repo)
+        machineOnly("slots");
+      else if (typeof slots === "number" && Number.isInteger(slots) && slots >= 1 && slots <= MAX_SLOTS)
+        settings.slots = slots;
+      else
+        warn("slots", `must be an integer 1-${MAX_SLOTS}`);
+    }
+    if (value.scope !== undefined) {
+      if (repo)
+        machineOnly("scope");
+      else if (typeof value.scope === "boolean")
+        settings.scope = value.scope;
+      else
+        warn("scope", "must be true or false");
+    }
+    if (value.heavy !== undefined) {
+      const heavy = isRecord7(value.heavy) ? Object.keys(value.heavy) : value.heavy;
+      if (!Array.isArray(heavy) || !heavy.every((item) => typeof item === "string"))
+        warn("heavy", "must be a list of check names");
+      else
+        settings.heavy = repo ? [...new Set([...settings.heavy, ...heavy])] : heavy;
+    }
+    if (value.memoryMax !== undefined) {
+      const next = memoryValue(value.memoryMax, host);
+      if (next instanceof Error)
+        warn("memoryMax", next.message);
+      else if (repo && next > memory)
+        warn("memoryMax", "a repo can only lower it");
+      else
+        memory = next;
+    }
+    if (value.cpuQuota !== undefined) {
+      const next = cpuValue(value.cpuQuota, host);
+      if (next instanceof Error)
+        warn("cpuQuota", next.message);
+      else if (repo && next > cpu)
+        warn("cpuQuota", "a repo can only lower it");
+      else
+        cpu = next;
+    }
+    if (value.wait !== undefined) {
+      if (typeof value.wait === "number" && value.wait >= 0)
+        settings.waitMs = value.wait * 1000;
+      else
+        warn("wait", "must be a number of seconds");
+    }
+  }
+  settings.memoryMax = String(memory);
+  settings.cpuQuota = `${cpu}%`;
+  return { settings, warnings };
+}
+function stateDir(env, platform = process.platform) {
+  if (env.WORKFLOW_TOOLKIT_STATE)
+    return env.WORKFLOW_TOOLKIT_STATE;
+  if (env.XDG_STATE_HOME)
+    return path40.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os14.homedir();
+  if (platform === "darwin")
+    return path40.join(home, "Library", "Application Support", "workit");
+  if (platform === "win32")
+    return path40.join(env.LOCALAPPDATA ?? path40.join(home, "AppData", "Local"), "workit");
+  return path40.join(home, ".local", "state", "workit");
+}
+function scopeBusy(unit) {
+  if (process.platform !== "linux" || !SCOPE_UNIT.test(unit))
+    return false;
+  const uid = process.getuid?.() ?? 0;
+  const manager = `/sys/fs/cgroup/user.slice/user-${uid}.slice/user@${uid}.service`;
+  return [`${manager}/app.slice/${unit}`, `${manager}/${unit}`].some((dir) => (readText3(`${dir}/cgroup.procs`) ?? "").trim() !== "");
+}
+function isAncestor(pid) {
+  if (process.platform !== "linux")
+    return true;
+  let current = process.pid;
+  for (let step = 0;step < 128 && current > 1; step += 1) {
+    if (current === pid)
+      return true;
+    const ppid = Number(statFields(current)?.[1]);
+    if (!Number.isInteger(ppid) || ppid <= 0)
+      return false;
+    current = ppid;
+  }
+  return current === pid;
+}
+function staleReason(lease, probe = {}) {
+  const boot = probe.boot === undefined ? bootId() : probe.boot;
+  if (lease.bootId && boot) {
+    if (lease.bootId !== boot)
+      return "taken before a reboot";
+  } else if (typeof lease.bootTime === "number") {
+    const now = probe.bootTime === undefined ? bootTime() : probe.bootTime;
+    if (now !== null && Math.abs(now - lease.bootTime) > BOOT_SLACK_MS)
+      return "taken before a reboot";
+  }
+  const start = lease.processStart ? (probe.start ?? processStart)(lease.pid) : null;
+  const age = (probe.now ?? Date.now()) - Date.parse(lease.startedAt);
+  if (!start && typeof lease.maxAgeMs === "number" && age > lease.maxAgeMs)
+    return `older than its ${Math.round(lease.maxAgeMs / 1000)} s bound`;
+  const holder = !(probe.alive ?? pidAlive2)(lease.pid) ? `holder pid ${lease.pid} is gone` : start && start !== lease.processStart ? `pid ${lease.pid} now belongs to another process` : null;
+  if (!holder)
+    return null;
+  if (typeof lease.pgid === "number" && lease.pgid > 0 && (probe.group ?? groupAlive)(lease.pgid))
+    return null;
+  if (lease.scope && (probe.scope ?? scopeBusy)(lease.scope))
+    return null;
+  return holder;
+}
+function reclaim(file, stale) {
+  const guard = `${file}.reclaim`;
+  try {
+    fs20.mkdirSync(guard);
+  } catch {
+    try {
+      if (Date.now() - fs20.statSync(guard).mtimeMs > GUARD_TTL_MS)
+        fs20.rmSync(guard, { force: true, recursive: true });
+    } catch {}
+    return false;
+  }
+  try {
+    let ageMs = 0;
+    try {
+      ageMs = Date.now() - fs20.statSync(file).mtimeMs;
+    } catch {
+      return true;
+    }
+    if (!stale(parseLease(readText3(file)), ageMs))
+      return false;
+    fs20.rmSync(file, { force: true });
+    return true;
+  } finally {
+    fs20.rmSync(guard, { force: true, recursive: true });
+  }
+}
+function tryOnce(options, record, reclaimed) {
+  const holders = [];
+  const text = `${JSON.stringify(record)}
+`;
+  for (let slot = 0;slot < options.slots; slot += 1) {
+    const file = path40.join(options.dir, `slot-${slot}.json`);
+    for (let attempt = 0;attempt < 2; attempt += 1) {
+      try {
+        const fd = fs20.openSync(file, "wx", 384);
+        try {
+          fs20.writeSync(fd, text);
+        } finally {
+          fs20.closeSync(fd);
+        }
+        return { slot, file };
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+      const lease = parseLease(readText3(file));
+      let reason = null;
+      const removed = reclaim(file, (current, ageMs) => {
+        reason = current ? staleReason(current, options.probe) : ageMs > UNREADABLE_TTL_MS ? "unreadable" : null;
+        return reason !== null;
+      });
+      if (removed) {
+        if (lease && reason)
+          reclaimed.push({ ...holderOf(lease), reason });
+        continue;
+      }
+      if (lease)
+        holders.push(holderOf(lease));
+      break;
+    }
+  }
+  return { holders };
+}
+function removeOwn(file, id) {
+  if (parseLease(readText3(file))?.id === id)
+    fs20.rmSync(file, { force: true });
+}
+async function acquireLease(options) {
+  const pid = options.pid ?? process.pid;
+  const boot = bootId();
+  const record = {
+    id: randomUUID5(),
+    pid,
+    processStart: processStart(pid),
+    bootId: boot,
+    bootTime: boot ? null : bootTime(),
+    pgid: null,
+    maxAgeMs: options.maxAgeMs ?? null,
+    check: options.check,
+    cwd: options.cwd,
+    session: options.session,
+    startedAt: new Date().toISOString(),
+    scope: null
+  };
+  try {
+    fs20.mkdirSync(options.dir, { recursive: true, mode: 448 });
+  } catch (error) {
+    return { ok: false, reason: "unavailable", error: error.message };
+  }
+  const started = Date.now();
+  const reclaimed = [];
+  let waitedOn = [];
+  for (;; ) {
+    let outcome;
+    try {
+      outcome = tryOnce(options, record, reclaimed);
+    } catch (error) {
+      return { ok: false, reason: "unavailable", error: error.message };
+    }
+    if ("slot" in outcome) {
+      const { file, slot } = outcome;
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        process.off("exit", release);
+        removeOwn(file, record.id);
+      };
+      process.on("exit", release);
+      return {
+        ok: true,
+        lease: {
+          record,
+          slot,
+          file,
+          waitedOn,
+          waitedMs: waitedOn.length ? Date.now() - started : 0,
+          reclaimed,
+          release
+        }
+      };
+    }
+    const waited = Date.now() - started;
+    if (!waitedOn.length) {
+      waitedOn = outcome.holders;
+      options.onWait?.(outcome.holders);
+    }
+    if (waited >= options.waitMs)
+      return { ok: false, reason: "timeout", holders: outcome.holders, waitedMs: waited };
+    await sleep(Math.min(options.pollMs ?? 2000, Math.max(1, options.waitMs - waited)));
+  }
+}
+function updateLease(lease, patch) {
+  Object.assign(lease.record, patch);
+  try {
+    if (parseLease(readText3(lease.file))?.id !== lease.record.id)
+      return;
+    const temp = `${lease.file}.${process.pid}.tmp`;
+    fs20.writeFileSync(temp, `${JSON.stringify(lease.record)}
+`, { mode: 384 });
+    fs20.renameSync(temp, lease.file);
+  } catch {}
+}
+function heldLease(dir, id, options = {}) {
+  if (!id || !/^[0-9a-f-]{36}$/u.test(id))
+    return null;
+  let names;
+  try {
+    names = fs20.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  for (const name of names) {
+    if (!/^slot-\d+\.json$/u.test(name))
+      continue;
+    const lease = parseLease(readText3(path40.join(dir, name)));
+    if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
+      return lease;
+  }
+  return null;
+}
+function describeHolder(holder, now = Date.now()) {
+  const seconds = Math.max(0, Math.round((now - Date.parse(holder.startedAt)) / 1000));
+  const age = seconds >= 60 ? `${Math.floor(seconds / 60)}m ${seconds % 60}s` : `${seconds}s`;
+  return `${holder.check}, pid ${holder.pid}${holder.session ? `, session ${holder.session}` : ""}, ${age}, ${holder.cwd}`;
+}
+function scopeSupport(env, platform = process.platform, read = readText3) {
+  if (platform !== "linux")
+    return { ok: false, reason: `no systemd scopes on ${platform}` };
+  if (!onPath("systemd-run", env))
+    return { ok: false, reason: "systemd-run is not on PATH" };
+  const uid = process.getuid?.() ?? 0;
+  const runtime = env.XDG_RUNTIME_DIR || `/run/user/${uid}`;
+  if (!fs20.existsSync(path40.join(runtime, "systemd", "private")))
+    return { ok: false, reason: "no user systemd manager is running" };
+  const controllers = read(`/sys/fs/cgroup/user.slice/user-${uid}.slice/user@${uid}.service/cgroup.controllers`);
+  if (controllers === null)
+    return { ok: false, reason: "cgroup v2 is not mounted for the user manager" };
+  const missing = ["memory", "cpu"].filter((name) => !controllers.split(/\s+/u).includes(name));
+  if (missing.length)
+    return { ok: false, reason: `the user manager is not delegated ${missing.join(" and ")}` };
+  return { ok: true };
+}
+function scopePrefix(unit, settings) {
+  return [
+    "systemd-run",
+    "--user",
+    "--scope",
+    "--quiet",
+    "--collect",
+    `--unit=${unit}`,
+    "-p",
+    `MemoryMax=${settings.memoryMax}`,
+    "-p",
+    `CPUQuota=${settings.cpuQuota}`,
+    "--"
+  ];
+}
+async function runScoped(run, wrapper, sinks) {
+  if (!wrapper)
+    return { result: await run(null, sinks), fallback: null };
+  let state = "deciding";
+  let firstLine = "";
+  const held = [];
+  const flush = () => {
+    state = "passing";
+    for (const [sink, text] of held.splice(0))
+      sinks[sink](text);
+  };
+  const result = await run(wrapper, {
+    onStdout: (text) => {
+      if (state === "passing")
+        return sinks.onStdout(text);
+      held.push(["onStdout", text]);
+      if (state === "deciding")
+        flush();
+    },
+    onStderr: (text) => {
+      if (state === "passing")
+        return sinks.onStderr(text);
+      held.push(["onStderr", text]);
+      if (state === "held")
+        return;
+      firstLine += text;
+      const newline = firstLine.indexOf(`
+`);
+      if (newline < 0 && firstLine.length < 4096)
+        return;
+      if (SCOPE_START_FAILURE.test(firstLine.slice(0, newline < 0 ? undefined : newline)))
+        state = "held";
+      else
+        flush();
+    }
+  });
+  const lines = tailLines(result.log, 2);
+  if (state !== "passing" && result.exitCode !== 0 && lines.length === 1 && SCOPE_START_FAILURE.test(lines[0]))
+    return { result: await run(null, sinks), fallback: lines[0] };
+  flush();
+  return { result, fallback: null };
+}
+function firstNotice(env, session, key, now = Date.now()) {
+  const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
+  const dir = path40.join(stateDir(env), "notices");
+  try {
+    fs20.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs20.writeFileSync(path40.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (error) {
+    return error.code !== "EEXIST";
+  }
+  try {
+    for (const name of fs20.readdirSync(dir)) {
+      const file = path40.join(dir, name);
+      if (now - fs20.statSync(file).mtimeMs > NOTICE_TTL_MS)
+        fs20.rmSync(file, { force: true });
+    }
+  } catch {}
+  return true;
+}
+var DEFAULT_HEAVY_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 600, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
+  totalMemBytes: os14.totalmem(),
+  cpus: Math.max(1, os14.availableParallelism?.() ?? os14.cpus().length)
+}), isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path40.join(stateDir(env), "leases"), readText3 = (file) => {
+  try {
+    return fs20.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}, bootId = () => readText3("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os14.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
+  const stat = readText3(`/proc/${pid}/stat`);
+  return stat ? stat.slice(stat.lastIndexOf(")") + 2).split(" ") : null;
+}, processStart = (pid) => statFields(pid)?.[19] ?? null, pidAlive2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}, groupAlive = (pgid) => process.platform === "win32" ? pidAlive2(pgid) : pidAlive2(-pgid), SCOPE_UNIT, parseLease = (text) => {
+  if (!text)
+    return null;
+  try {
+    const value = JSON.parse(text);
+    return isRecord7(value) && typeof value.id === "string" && typeof value.pid === "number" ? value : null;
+  } catch {
+    return null;
+  }
+}, holderOf = (lease) => ({
+  pid: lease.pid,
+  check: lease.check,
+  cwd: lease.cwd,
+  session: lease.session,
+  startedAt: lease.startedAt
+}), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), onPath = (command, env) => (env.PATH ?? "").split(path40.delimiter).filter(Boolean).some((dir) => {
+  try {
+    fs20.accessSync(path40.join(dir, command), fs20.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}), SCOPE_START_FAILURE, NOTICE_TTL_MS;
+var init_resources = __esm(() => {
+  init_checks3();
+  DEFAULT_HEAVY_CHECKS = ["test", "build", "typecheck"];
+  SIZE = /^(\d+(?:\.\d+)?)([KMGT]?)$/iu;
+  PERCENT = /^(\d+(?:\.\d+)?)%$/u;
+  UNITS = { "": 1, K: 1024, M: 1024 ** 2, G: 1024 ** 3, T: 1024 ** 4 };
+  SCOPE_UNIT = /^[\w.@-]+\.scope$/u;
+  SCOPE_START_FAILURE = /^Failed to (?:connect to bus|create bus connection|start transient scope unit|parse \S+?=)/u;
+  NOTICE_TTL_MS = 7 * 86400000;
+});
+
 // packages/workit-cli/src/verbs/check.ts
 var exports_check = {};
 __export(exports_check, {
   run: () => run10
 });
-import path40 from "node:path";
+import os15 from "node:os";
+import path41 from "node:path";
 function parse5(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
   const options = {
     name: null,
     shell: false,
+    heavy: false,
+    noLease: false,
     timeoutMs: 0,
     task: null,
     base: null,
@@ -72777,6 +73517,13 @@ function parse5(argv) {
       options.shell = true;
       continue;
     }
+    if (flag === "--heavy" || flag === "--no-lease") {
+      if (flag === "--heavy")
+        options.heavy = true;
+      else
+        options.noLease = true;
+      continue;
+    }
     if (flag === "--name" || flag === "--task" || flag === "--base" || flag === "--timeout") {
       const got = value();
       if (got instanceof Error)
@@ -72900,6 +73647,90 @@ function boundedArgv(argv) {
   const truncated = cut.length !== argv.length || cut.some((item, index) => item !== argv[index]);
   return { argv: cut, truncated };
 }
+async function workspaceResources(io) {
+  const env = io.env;
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path41.join(env.XDG_CONFIG_HOME || path41.join(env.HOME || os15.homedir(), ".config"), "workit");
+  try {
+    await Promise.resolve().then(() => init_workspaces());
+    const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+    return { value: workspace?.resources, warning: null };
+  } catch (error) {
+    return { value: undefined, warning: `workspaces.json: ${error.message}` };
+  }
+}
+async function prepareHeavy(io, settings, label, runCwd, timeoutMs) {
+  const session = hostSessionFromEnv(io.env).session;
+  const dir = leaseDir(io.env);
+  const outer = heldLease(dir, io.env.WORKIT_LEASE);
+  if (outer)
+    return {
+      lease: null,
+      leaseReport: { slot: null, waitedMs: 0, holder: null, reclaimed: [], inherited: true },
+      scope: { unit: outer.scope, reason: "inherited from the outer heavy check" },
+      wrapper: null,
+      env: io.env
+    };
+  const acquired = await acquireLease({
+    dir,
+    slots: settings.slots,
+    check: label,
+    cwd: runCwd,
+    session,
+    waitMs: settings.waitMs,
+    pollMs: 1000,
+    maxAgeMs: (timeoutMs || MAX_UNVERIFIED_RUN_MS) + 60000,
+    onWait: (holders) => io.stderr(`workit: waiting for the heavy-check lease (${settings.slots} slot${settings.slots === 1 ? "" : "s"}): held by ${holders.map((holder) => describeHolder(holder)).join("; ")}
+`)
+  });
+  if (!acquired.ok && acquired.reason === "timeout") {
+    const holders = acquired.holders.map((holder) => describeHolder(holder)).join("; ");
+    emit(io, fail("busy", `the heavy-check lease stayed busy for ${Math.round(acquired.waitedMs / 1000)} s`, {
+      data: { lease: { waitedMs: acquired.waitedMs, holders: acquired.holders } },
+      unblock: `wait for ${holders || "the holders"} to finish, then run it again`
+    }));
+    return 4;
+  }
+  let lease = null;
+  if (acquired.ok)
+    lease = acquired.lease;
+  else
+    io.stderr(`workit: running without the heavy-check lease: ${acquired.error}
+`);
+  for (const stale of lease?.reclaimed ?? [])
+    io.stderr(`workit: reclaimed a stale heavy-check lease (${stale.reason}): ${describeHolder(stale)}
+`);
+  const leaseReport = lease ? {
+    slot: lease.slot,
+    waitedMs: lease.waitedMs,
+    holder: lease.waitedOn[0] ?? null,
+    reclaimed: lease.reclaimed,
+    inherited: false
+  } : null;
+  const env = lease ? { ...io.env, WORKIT_LEASE: lease.record.id } : io.env;
+  const support = settings.scope ? scopeSupport(io.env) : { ok: false, reason: "resources.scope is false" };
+  if (!support.ok) {
+    if (settings.scope && firstNotice(io.env, session, "no-scope"))
+      io.stderr(`workit: heavy checks run without a memory/CPU limit here: ${support.reason} (said once per session)
+`);
+    return {
+      lease,
+      leaseReport,
+      scope: { unit: null, reason: support.reason },
+      wrapper: null,
+      env
+    };
+  }
+  const unit = `workit-check-${(lease?.record.id ?? "nolease0").slice(0, 8)}-${process.pid}`;
+  if (lease)
+    updateLease(lease, { scope: `${unit}.scope` });
+  return {
+    lease,
+    leaseReport,
+    scope: { unit: `${unit}.scope`, memoryMax: settings.memoryMax, cpuQuota: settings.cpuQuota },
+    wrapper: scopePrefix(unit, settings),
+    env
+  };
+}
 async function run10(argv, io) {
   const options = parse5(argv);
   if (options instanceof Error)
@@ -72934,21 +73765,52 @@ async function run10(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path40.relative(top, runCwd));
+  const relCwd = posix(path41.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const actor = actorFromEnv(io.env);
   const branchKey = codeKey(io.cwd, { base: options.base });
   const detached = branchKey.tree === null ? worktreeTree(io.cwd) : null;
   const key = detached ? { ...branchKey, tree: detached.key, dirty: detached.dirty } : branchKey;
   const signal = key.tree === null ? null : worktreeSignal(io.cwd);
-  const result = await runCheckCommand(command, {
-    cwd: runCwd,
-    shell: options.shell,
-    timeoutMs: options.timeoutMs,
-    env: io.env,
-    onStdout: io.json ? io.stderr : io.stdout,
-    onStderr: io.stderr
-  });
+  let heavy = null;
+  if (!options.noLease && (options.heavy || options.command === null)) {
+    const workspace = await workspaceResources(io);
+    const { settings, warnings } = resolveResourceSettings([
+      { label: "workspaces.json", trust: "machine", value: workspace.value },
+      { label: CHECKS_FILE, trust: "repo", value: config.resources }
+    ]);
+    for (const warning of [workspace.warning, ...warnings])
+      if (warning)
+        io.stderr(`workit: resources: ${warning}
+`);
+    if (options.heavy || name !== null && settings.heavy.includes(name)) {
+      const prepared = await prepareHeavy(io, settings, name ?? command.join(" "), runCwd, options.timeoutMs);
+      if (typeof prepared === "number")
+        return prepared;
+      heavy = prepared;
+    }
+  }
+  const lease = heavy?.lease ?? null;
+  let result;
+  try {
+    const scoped = await runScoped((wrapper, sinks) => runCheckCommand(command, {
+      cwd: runCwd,
+      shell: options.shell,
+      timeoutMs: options.timeoutMs,
+      env: heavy?.env ?? io.env,
+      ...sinks,
+      ...wrapper ? { wrapper } : {},
+      ...lease ? { onSpawn: (pid) => updateLease(lease, { pgid: pid }) } : {}
+    }), heavy?.wrapper ?? null, { onStdout: io.json ? io.stderr : io.stdout, onStderr: io.stderr });
+    result = scoped.result;
+    if (heavy && scoped.fallback) {
+      io.stderr(`workit: the memory/CPU scope could not start (${scoped.fallback}); ran without it
+`);
+      heavy.scope = { unit: null, reason: `systemd-run failed: ${scoped.fallback}` };
+    }
+  } finally {
+    lease?.release();
+  }
   const treeAfter = key.tree === null ? null : worktreeTree(io.cwd)?.key ?? null;
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
@@ -73029,6 +73891,8 @@ async function run10(argv, io) {
     outputBytes: result.outputBytes,
     logTruncated: result.truncated,
     task: task.task,
+    lease: heavy?.leaseReport ?? null,
+    scope: heavy?.scope ?? null,
     ...task.note ? { taskNote: task.note } : {},
     satisfies: task.satisfies,
     stillUnsatisfied: task.stillUnsatisfied,
@@ -73058,7 +73922,7 @@ async function run10(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE3 = "workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path40.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
+var USAGE3 = "workit check <name> [--no-lease] | workit check [--name <n>] [--shell] [--heavy] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path41.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -73067,6 +73931,8 @@ var init_check = __esm(() => {
   init_ledger();
   init_output();
   init_host_session();
+  init_resources();
+  MAX_UNVERIFIED_RUN_MS = 6 * 3600000;
   ENGINE_CODES2 = {
     busy: "busy",
     not_found: "not_found",
@@ -73082,7 +73948,7 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -73095,18 +73961,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path41.resolve(cwd, line.trim()));
+`).map((line) => path42.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
     if (!marker || !existsSync19(marker))
       continue;
-    if (index === 1 && existsSync19(path41.join(marker, "applying")))
+    if (index === 1 && existsSync19(path42.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync19(path41.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync19(path42.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync19(path41.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync19(path42.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -73161,6 +74027,12 @@ function gitBranch(cwd, input) {
     return failure3("blocked", policy.error, policy.correction);
   if (resolveRef(cwd, `refs/heads/${name}`))
     return failure3("failed", `branch_exists: ${name} already exists`, `git switch ${name}`);
+  const kind = input.kind ?? branchKindOf(name);
+  const flow = resolved.ok !== false && !releaseTrack?.track ? gitFlowOf(cwd, String(resolved.defaultTargetBranch ?? "") || null) : null;
+  const route = flow && kind ? flowRoute(flow, kind) : null;
+  const mismatch = explicitBase ? flowMismatch(flow, kind, explicitBase, "base") : null;
+  if (mismatch && route)
+    return failure3("blocked", mismatch, `workit git branch ${input.kind ? `--kind ${kind} --slug ${input.slug}` : name}  # without --base it starts from ${route.base}`);
   let base = explicitBase;
   let defaultTarget = null;
   let defaultBase = null;
@@ -73170,12 +74042,14 @@ function gitBranch(cwd, input) {
     defaultTarget = String(resolved.defaultTargetBranch ?? "") || null;
     defaultBase = String(resolved.baseBranch ?? "") || defaultTarget;
   }
-  base ??= defaultBase;
+  base ??= route?.base ?? defaultBase;
   if (!base)
     return failure3("invalid_input", "no default target branch is configured; pass --base <branch>");
   if (base.startsWith("-"))
     return failure3("invalid_input", "--base must not start with -");
   const notes = [...releaseTrack?.warnings ?? []];
+  if (route?.mergeBack)
+    notes.push(`git-flow: ${route.kind}/* lands on ${route.target} (workit pr create targets it), then ${route.target} merges back into ${route.mergeBack}`);
   const remotes = remoteNames(cwd);
   const remote = remotes.includes("origin") ? "origin" : pushRemoteName(cwd);
   const localTip = resolveRef(cwd, `refs/heads/${base}`);
@@ -73218,7 +74092,8 @@ function gitBranch(cwd, input) {
     baseSha,
     carried: dirt !== "clean",
     notes,
-    releaseTrack
+    releaseTrack,
+    flow: route
   });
 }
 function lintCommitMessage(cwd, message) {
@@ -73247,6 +74122,40 @@ function lintCommitMessage(cwd, message) {
     correction: `use a ${detected} commit subject`
   };
 }
+function stripSessionTrailers(text, options) {
+  const end = text.length - (/\s*$/u.exec(text)?.[0].length ?? 0);
+  const lines = text.slice(0, end).split(`
+`);
+  let start = lines.length;
+  while (start > 0 && lines[start - 1]?.trim() !== "")
+    start -= 1;
+  if (start === 0 && options.subject)
+    return text;
+  const block = lines.slice(start);
+  if (!block.length || !TRAILER_LINE.test(block[0] ?? ""))
+    return text;
+  if (!block.every((line) => TRAILER_LINE.test(line) || /^\s+\S/u.test(line)))
+    return text;
+  const kept = [];
+  let dropping = false;
+  for (const line of block) {
+    if (TRAILER_LINE.test(line))
+      dropping = SESSION_KEY.test(line);
+    if (!dropping)
+      kept.push(line);
+  }
+  if (kept.length === block.length)
+    return text;
+  let head = lines.slice(0, start);
+  if (!kept.length) {
+    let cut = head.length;
+    while (cut > 0 && head[cut - 1]?.trim() === "")
+      cut -= 1;
+    head = head.slice(0, cut);
+  }
+  return [...head, ...kept].join(`
+`) + text.slice(end);
+}
 function messageTrailers(cwd, message) {
   const run = git5(cwd, [...TRAILER_CONFIG, "interpret-trailers", "--parse", "--no-divider"], {
     input: `${message}
@@ -73306,6 +74215,12 @@ function gitCommit(cwd, input) {
   const given = input.message?.trim() ?? "";
   if (!given && !input.amend)
     return failure3("invalid_input", "a commit message is required (-m <msg> or -F <file>)");
+  const extra = (input.trailers ?? []).map((trailer) => trailer.trim());
+  const malformed = extra.find((trailer) => !EXTRA_TRAILER.test(trailer));
+  if (malformed !== undefined)
+    return failure3("invalid_input", `--trailer ${JSON.stringify(malformed)} is not one "Key: value" line`, `workit git commit -m '<msg>' --trailer "Co-Authored-By: Name <email>"`);
+  if (extra.some((trailer) => /^workit-session:/iu.test(trailer)))
+    return failure3("invalid_input", "--trailer cannot set Workit-Session: workit writes it from the acting session");
   const paths = input.paths ?? [];
   if (input.all && paths.length)
     return failure3("invalid_input", "pass --all or paths, not both");
@@ -73327,6 +74242,7 @@ function gitCommit(cwd, input) {
   }
   let message = given;
   let carried = [];
+  let previousTrailers = [];
   if (given) {
     const lint = lintCommitMessage(cwd, given);
     if (!lint.ok)
@@ -73336,8 +74252,9 @@ function gitCommit(cwd, input) {
     const kept = git5(cwd, ["log", "-1", "--format=%B", previous]);
     if (!kept.ok)
       return failure3("failed", `could not read the message of ${branch}: ${gitError(kept)}`);
+    previousTrailers = messageTrailers(cwd, kept.stdout.trim());
     if (given)
-      carried = messageTrailers(cwd, kept.stdout.trim());
+      carried = previousTrailers;
     else
       message = kept.stdout.trim();
   }
@@ -73351,12 +74268,31 @@ function gitCommit(cwd, input) {
     args.push("--amend");
   if (input.allowEmpty || emptyAmend)
     args.push("--allow-empty");
-  args.push("-m", withTrailers(cwd, message, [...carried, ...session ? [`Workit-Session: ${session}`] : []]));
+  const trailersOn = workspaceTrailers(cwd).enabled;
+  const sessionTrailer = Boolean(session) && trailersOn;
+  if (!trailersOn) {
+    carried = carried.filter((trailer) => !SESSION_KEY.test(trailer));
+    if (!given)
+      message = stripSessionTrailers(message, { subject: true });
+  }
+  const finalMessage = withTrailers(cwd, message, [
+    ...carried,
+    ...extra,
+    ...sessionTrailer ? [`Workit-Session: ${session}`] : []
+  ]);
+  const allowed = new Set([
+    ...trailersOn ? sessionValues(previousTrailers) : [],
+    ...sessionTrailer && session ? [session] : []
+  ]);
+  const forged = sessionValues(messageTrailers(cwd, finalMessage)).find((value) => !allowed.has(value));
+  if (forged !== undefined)
+    return failure3("invalid_input", `forged_session_trailer: the message would carry "Workit-Session: ${forged}", which workit did not add; workit writes that trailer itself`, "drop the Workit-Session line (or the trailer.<alias>.key config that expands into it)");
+  args.push("-m", finalMessage);
   if (paths.length) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync19(path41.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync19(path42.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -73382,7 +74318,7 @@ function gitCommit(cwd, input) {
   }
   const committed = git5(cwd, args, {
     timeoutMs: COMMIT_TIMEOUT_MS,
-    env: input.env
+    env: { ...input.env ?? process.env, WORKIT_TRAILERS: trailersOn ? "on" : "off" }
   });
   if (!committed.ok)
     return failure3("failed", `git commit failed (a hook or git refused it):
@@ -73426,6 +74362,7 @@ ${gitOutput(committed)}`);
     files,
     leftDirty,
     session,
+    sessionTrailer,
     amended: previous,
     notes,
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
@@ -73439,7 +74376,7 @@ function pushPreflight(cwd, options = {}) {
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; push a branch");
   if (isProtectedTarget(cwd, branch))
-    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit never pushes to it`, "workit git branch <feature/name>  # push a feature branch and open a PR");
+    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
   const sha = resolveRef(cwd, `refs/heads/${branch}`);
   if (!sha)
     return failure3("not_found", `branch ${branch} has no commit to push`);
@@ -73606,6 +74543,125 @@ ${gitOutput(run)}`);
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
+function releasePushPreflight(cwd, names) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
+  const wanted = [...new Set(names)];
+  if (!wanted.length)
+    return failure3("invalid_input", "name the release refs to push");
+  const { preset, branches, production } = releaseBranchesOf(cwd);
+  const refs = [];
+  for (const raw of wanted) {
+    if (raw.startsWith("-") || raw.includes(":"))
+      return failure3("invalid_input", `${raw} is not a ref name (refspecs are not accepted)`);
+    const tagName = raw.replace(/^refs\/tags\//u, "");
+    const branchName = raw.replace(/^refs\/heads\//u, "");
+    const tag = raw.startsWith("refs/heads/") ? null : resolveRef(cwd, `refs/tags/${tagName}`);
+    const branch = raw.startsWith("refs/tags/") ? null : resolveRef(cwd, `refs/heads/${branchName}`);
+    if (tag && branch)
+      return failure3("invalid_input", `${raw} names both a branch and a tag`, `workit git push --release refs/heads/${raw}  # or refs/tags/${raw}`);
+    if (tag) {
+      if (!RELEASE_TAG.test(tagName))
+        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (v<version>)`, "git tag -a v<version> -m <message>  # then: workit git push --release v<version>");
+      refs.push({ kind: "tag", name: tagName, ref: `refs/tags/${tagName}`, sha: tag });
+      continue;
+    }
+    if (!branch)
+      return failure3("not_found", `${raw} is not a local branch or tag`);
+    if (!branches.some((name) => name.toLowerCase() === branchName.toLowerCase()))
+      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes v<version> tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release v<version>`);
+    refs.push({ kind: "branch", name: branchName, ref: `refs/heads/${branchName}`, sha: branch });
+  }
+  const remote = pushRemoteName(cwd, refs.find((ref) => ref.kind === "branch")?.name ?? null);
+  if (!remote)
+    return failure3("not_found", "no push remote is configured for this repository", "git remote add origin <url>");
+  const raw = pushUrl(cwd, remote);
+  if (!raw)
+    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
+  const local = parseRemoteUrl(raw)?.protocol === "file";
+  if (!local && !pushTargetIsStable(cwd, raw))
+    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
+  return success2({ refs, remote, url: redactRemote(raw), rawUrl: raw, local, production });
+}
+function executeReleasePush(cwd, plan, input) {
+  const previous = new Map;
+  for (const ref of plan.refs) {
+    const before = remoteRefTip(cwd, plan.rawUrl, ref.ref);
+    if (!before.ok)
+      return failure3(before.code, before.error);
+    previous.set(ref.ref, before.sha);
+    if (before.sha === null || before.sha === ref.sha)
+      continue;
+    if (ref.kind === "tag")
+      return failure3("blocked", `tag_exists: ${plan.remote} already has ${ref.name} at ${before.sha.slice(0, 12)}, not ${ref.sha.slice(0, 12)}; a release tag never moves`, `git tag -d ${ref.name}  # tag the next version instead`);
+    if (!git5(cwd, ["merge-base", "--is-ancestor", before.sha, ref.sha]).ok)
+      return failure3("failed", `non_fast_forward: ${plan.remote}/${ref.name} (${before.sha.slice(0, 12)}) is not part of local ${ref.name}; a release push never rewrites it`, `git fetch ${plan.remote} ${ref.name} && git switch ${ref.name} && git merge --ff-only ${plan.remote}/${ref.name}  # then: workit git push --release ${ref.name}`);
+  }
+  const tags = plan.refs.filter((ref) => ref.kind === "tag");
+  if (tags.length) {
+    let productionTip = null;
+    if (plan.production) {
+      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.production}`);
+      if (!tip.ok)
+        return failure3(tip.code, tip.error);
+      productionTip = tip.sha;
+    }
+    const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
+    for (const tag of tags) {
+      const released = productionTip !== null && contains(productionTip, tag.sha) || plan.refs.some((ref) => ref.kind === "branch" && contains(ref.sha, tag.sha));
+      if (!released)
+        return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${plan.production ?? "the production branch"}${plan.refs.some((ref) => ref.kind === "branch") ? " or a branch in this push" : ""}; a release tag marks a commit that already landed`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
+    }
+  }
+  const pending = plan.refs.filter((ref) => previous.get(ref.ref) !== ref.sha);
+  if (pending.length) {
+    const run = gitNetwork(cwd, [
+      "push",
+      "--porcelain",
+      "--atomic",
+      "--no-follow-tags",
+      "--recurse-submodules=no",
+      plan.remote,
+      ...pending.map((ref) => ref.kind === "tag" ? `${ref.ref}:${ref.ref}` : `${ref.sha}:${ref.ref}`)
+    ], input.timeoutMs ?? PUSH_TIMEOUT_MS);
+    if (!run.ok)
+      return run.timedOut ? failure3("unavailable", `git push to ${plan.url} timed out`) : failure3("failed", `git push to ${plan.url} failed:
+${gitOutput(run)}`);
+  }
+  for (const ref of plan.refs) {
+    const after = remoteRefTip(cwd, plan.rawUrl, ref.ref);
+    if (!after.ok)
+      return failure3(after.code, `push sent but not verified: ${after.error}`);
+    if (after.sha !== ref.sha)
+      return failure3("failed", `push_unverified: ${plan.remote} ${ref.ref} is at ${after.sha?.slice(0, 12) ?? "(absent)"}, not ${ref.sha.slice(0, 12)}`);
+  }
+  const refs = plan.refs.map((ref) => ({
+    ...ref,
+    previous: previous.get(ref.ref) ?? null,
+    pushed: pending.includes(ref)
+  }));
+  const row = appendObserved(cwd, {
+    type: "release.pushed",
+    actor: input.actor,
+    remote: plan.remote,
+    url: plan.url,
+    refs: refs.map(({ ref, sha, previous: before, pushed }) => ({
+      ref,
+      sha,
+      previous: before,
+      pushed
+    })),
+    grant: input.grant,
+    ...input.identity ? { identity: input.identity } : {}
+  });
+  return success2({
+    remote: plan.remote,
+    url: plan.url,
+    refs,
+    recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
+  });
+}
 function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
   if (target.startsWith("-") || branch.startsWith("-") || !SHA.test(expectedTip))
     return { ok: false, lease: false, error: "invalid branch deletion target" };
@@ -73670,29 +74726,34 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX;
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, RELEASE_TAG;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
   init_pr_create();
   init_release_tracks();
   init_vcs_config();
+  init_workspaces();
   init_redact();
   init_ledger();
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
   SESSION_SAFE = /^[\w.:@/+-]{1,128}$/u;
+  EXTRA_TRAILER = /^[A-Za-z0-9][A-Za-z0-9-]*: *\S[^\n\r]*$/u;
+  SESSION_KEY = /^workit-session\s*:/iu;
+  TRAILER_LINE = /^[A-Za-z0-9][A-Za-z0-9-]*\s*:/u;
   TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
   SHA_PREFIX = /^[0-9a-f]{7,39}$/u;
+  RELEASE_TAG = /^v\d/u;
 });
 
 // packages/workit-core/src/forge/reruns.ts
-import fs20 from "node:fs";
-import path42 from "node:path";
+import fs21 from "node:fs";
+import path43 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path42.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path43.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -73701,7 +74762,7 @@ function rerunCounts(cwd, key) {
     return counts;
   let text;
   try {
-    text = fs20.readFileSync(file, "utf8");
+    text = fs21.readFileSync(file, "utf8");
   } catch {
     return counts;
   }
@@ -73727,8 +74788,8 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs20.mkdirSync(path42.dirname(file), { recursive: true });
-    fs20.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
+    fs21.mkdirSync(path43.dirname(file), { recursive: true });
+    fs21.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
   } catch {
@@ -73740,18 +74801,18 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs20.mkdirSync(path42.dirname(lock), { recursive: true });
+  fs21.mkdirSync(path43.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
-      fs20.closeSync(fs20.openSync(lock, "wx"));
+      fs21.closeSync(fs21.openSync(lock, "wx"));
       break;
     } catch (error) {
       if (error.code !== "EEXIST")
         throw error;
       try {
-        if (Date.now() - fs20.statSync(lock).mtimeMs > LOCK_STALE_MS2) {
-          fs20.rmSync(lock, { force: true });
+        if (Date.now() - fs21.statSync(lock).mtimeMs > LOCK_STALE_MS2) {
+          fs21.rmSync(lock, { force: true });
           continue;
         }
       } catch {
@@ -73765,7 +74826,7 @@ function withRerunLock(cwd, fn) {
   try {
     return fn();
   } finally {
-    fs20.rmSync(lock, { force: true });
+    fs21.rmSync(lock, { force: true });
   }
 }
 var isRow = (value) => {
@@ -74224,7 +75285,7 @@ function boundSource(cwd, resolved) {
     return failure3("blocked", remote.sha === null ? `not_pushed: ${branch} is not on ${resolved.remote}` : `not_pushed: ${resolved.remote}/${branch} is at ${remote.sha.slice(0, 12)}, local ${branch} is at ${sha.slice(0, 12)}`, "workit git push");
   return success2({ branch, sha });
 }
-async function verifiedHead(resolved, branch, sha, first, sleep) {
+async function verifiedHead(resolved, branch, sha, first, sleep, base) {
   let ref = first;
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
     if (ref.headSha === sha)
@@ -74234,7 +75295,8 @@ async function verifiedHead(resolved, branch, sha, first, sleep) {
     const found = resolved.forge.findPr(branch, {
       owner: resolved.headRepo.split("/")[0] ?? null,
       projectId: resolved.headProjectId,
-      sha
+      sha,
+      base
     });
     if (!found.ok)
       return found;
@@ -74259,7 +75321,8 @@ async function createPullRequest(cwd, resolved, input, sleep) {
   const existing = resolved.forge.findPr(branch, {
     owner: resolved.headRepo.split("/")[0] ?? null,
     projectId: resolved.headProjectId,
-    sha
+    sha,
+    base: input.base
   });
   if (!existing.ok)
     return existing;
@@ -74282,7 +75345,7 @@ async function createPullRequest(cwd, resolved, input, sleep) {
     ref = made.data;
     created = true;
   }
-  const verified = await verifiedHead(resolved, branch, sha, ref, sleep);
+  const verified = await verifiedHead(resolved, branch, sha, ref, sleep, input.base);
   if (!verified.ok)
     return verified;
   const row = appendObserved(cwd, {
@@ -74347,6 +75410,56 @@ function nextHint(next, number) {
       return null;
   }
 }
+function squashMessageFor(cwd, resolved, input, doc) {
+  if (input.method !== "squash")
+    return null;
+  if (input.subject === undefined && input.body === undefined && workspaceTrailers(cwd).enabled)
+    return null;
+  let subject = input.subject?.trim() ?? "";
+  if (!subject) {
+    const meta = resolved.forge.prMeta(doc.number);
+    if (!meta.ok)
+      return meta;
+    subject = resolved.forge.kind === "github" ? `${meta.data.title} (#${doc.number})` : meta.data.title;
+  }
+  const body = input.body === undefined ? squashCommitList(cwd, resolved, doc.base, doc.head.sha) : stripSessionTrailers(input.body, { subject: false });
+  return success2({ subject, body });
+}
+function squashCommitList(cwd, resolved, base, head) {
+  const from = resolveRef(cwd, `refs/remotes/${resolved.baseRemote}/${base}`) ?? resolveRef(cwd, `refs/heads/${base}`);
+  if (!from)
+    return "";
+  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
+    cwd,
+    encoding: "utf8",
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (log.status !== 0)
+    return "";
+  const entries = log.stdout.split("\x1E").map((message) => stripSessionTrailers(message.replace(/^\n+/u, ""), { subject: true })).filter((message) => message.trim()).map((message) => {
+    const [subject = "", ...rest] = message.trimEnd().split(`
+`);
+    const body = rest.join(`
+`).replace(/^\n+/u, "");
+    return body ? `* ${subject}
+
+${body}` : `* ${subject}`;
+  });
+  const listed = [];
+  let size = 0;
+  for (const entry of entries) {
+    if (listed.length >= SQUASH_LIST_MAX_COMMITS || size + entry.length > SQUASH_LIST_MAX_CHARS)
+      break;
+    listed.push(entry);
+    size += entry.length + 2;
+  }
+  const more = entries.length - listed.length;
+  return [...listed, ...more ? [`… and ${more} more commit${more === 1 ? "" : "s"}`] : []].join(`
+
+`);
+}
 async function mergePullRequest(cwd, resolved, input, sleep) {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed)
@@ -74423,7 +75536,14 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
   else if (!covered)
     return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`, { reason: "needs_verdict", verdict: summary });
-  const merged = resolved.forge.merge(doc.number, { sha: head, method: input.method });
+  const squashMessage = squashMessageFor(cwd, resolved, input, doc);
+  if (squashMessage && !squashMessage.ok)
+    return squashMessage;
+  const merged = resolved.forge.merge(doc.number, {
+    sha: head,
+    method: input.method,
+    ...squashMessage ? { squashMessage: squashMessage.data } : {}
+  });
   if (!merged.ok)
     return merged;
   let state = "open";
@@ -74449,7 +75569,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     const gone = !deleted.ok && remoteRefTip(cwd, resolved.remote, `refs/heads/${branch}`);
     deletedBranch = deleted.ok || gone && gone.ok && gone.sha === null ? true : { error: deleted.error };
   }
-  const mergeBack = mergeBackFor(cwd, doc.base);
+  const mergeBack = mergeBackFor(cwd, doc.base, branch);
   const row = appendObserved(cwd, {
     type: "pr.merged",
     actor: input.actor,
@@ -74488,9 +75608,16 @@ var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "p
   return `a non-author verifies the head (workit-review); the endpoint is ${endpoint}, so ${AFTER_REVIEW[endpoint]}`;
 }, SESSION_TRAILER, indent = (text) => text.split(`
 `).map((line) => line ? `  ${line}` : line).join(`
-`), mergeBackFor = (cwd, base) => {
+`), mergeBackFor = (cwd, base, head) => {
   try {
-    const owners = workspaceReleaseTracks(cwd).tracks.filter((track) => track.productionBranch === base);
+    const read = workspaceReleaseTracks(cwd);
+    if (!read.tracks.length) {
+      const flow = gitFlowOf(cwd);
+      const kind = branchKindOf(head);
+      const route = flow && kind ? flowRoute(flow, kind) : null;
+      return route?.mergeBack && route.target === base ? { track: "git-flow", branches: [route.mergeBack] } : { track: null, branches: [] };
+    }
+    const owners = read.tracks.filter((track) => track.productionBranch === base);
     if (owners.length !== 1)
       return { track: null, branches: [] };
     return {
@@ -74506,11 +75633,12 @@ var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "p
   error,
   unblock,
   refusal
-});
+}), SQUASH_LIST_MAX_COMMITS = 100, SQUASH_LIST_MAX_CHARS = 60000;
 var init_pr_ops = __esm(() => {
   init_autonomy();
   init_branch();
   init_vcs_config();
+  init_workspaces();
   init_release_tracks();
   init_ops();
   init_rev();
@@ -74529,8 +75657,8 @@ var init_pr_ops = __esm(() => {
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
 import { createHash as createHash17, randomBytes as randomBytes3 } from "node:crypto";
-import fs21 from "node:fs";
-import path43 from "node:path";
+import fs22 from "node:fs";
+import path44 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -74553,7 +75681,7 @@ function rebasingBranch2(dir) {
     if (!found.ok)
       continue;
     try {
-      return fs21.readFileSync(found.stdout.trim(), "utf8").trim();
+      return fs22.readFileSync(found.stdout.trim(), "utf8").trim();
     } catch {}
   }
   return null;
@@ -74561,7 +75689,7 @@ function rebasingBranch2(dir) {
 function rebaseInProgress(dir) {
   for (const name of ["rebase-merge", "rebase-apply"]) {
     const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
-    if (found.ok && fs21.existsSync(found.stdout.trim()))
+    if (found.ok && fs22.existsSync(found.stdout.trim()))
       return true;
   }
   return false;
@@ -74573,8 +75701,8 @@ function gitRestack(cwd, input) {
     const scratch = scratchDir(cwd);
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
-    fs21.mkdirSync(scratch, { recursive: true });
-    dir = path43.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    fs22.mkdirSync(scratch, { recursive: true });
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -74612,10 +75740,10 @@ function gitRestack(cwd, input) {
 }
 function pruneScratch(cwd) {
   const scratch = scratchDir(cwd);
-  if (!scratch || !fs21.existsSync(scratch))
+  if (!scratch || !fs22.existsSync(scratch))
     return;
-  for (const name of fs21.readdirSync(scratch)) {
-    const dir = path43.join(scratch, name);
+  for (const name of fs22.readdirSync(scratch)) {
+    const dir = path44.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -74625,10 +75753,10 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path43.join(root.value.root, "stacks") };
+  return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
-  if (!isRecord7(raw) || !Array.isArray(raw.branches))
+  if (!isRecord8(raw) || !Array.isArray(raw.branches))
     return null;
   const name = str3(raw.name);
   const trunk = str3(raw.trunk);
@@ -74636,12 +75764,12 @@ function parseStack(raw) {
     return null;
   const branches = [];
   for (const item of raw.branches) {
-    if (!isRecord7(item))
+    if (!isRecord8(item))
       return null;
     const branch = str3(item.branch);
     if (!branch)
       return null;
-    const merged = isRecord7(item.merged) ? {
+    const merged = isRecord8(item.merged) ? {
       pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
       mergeSha: str3(item.merged.mergeSha),
       at: str3(item.merged.at) ?? ""
@@ -74654,7 +75782,7 @@ function parseStack(raw) {
       lastParentHead: str3(item.lastParentHead),
       patchId: str3(item.patchId),
       merged,
-      ...isRecord7(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
+      ...isRecord8(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
         pendingRestack: {
           from: str3(item.pendingRestack.from),
           tip: str3(item.pendingRestack.tip),
@@ -74677,10 +75805,10 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, fileFor(name));
+  const file = path44.join(dir.data, fileFor(name));
   let text;
   try {
-    text = fs21.readFileSync(file, "utf8");
+    text = fs22.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return { ok: true, data: null };
@@ -74698,17 +75826,17 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, fileFor(stack.name));
+  const file = path44.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
-    fs21.mkdirSync(dir.data, { recursive: true });
+    fs22.mkdirSync(dir.data, { recursive: true });
     stack.updatedAt = now.toISOString();
-    fs21.writeFileSync(temp, `${JSON.stringify(stack, null, 2)}
+    fs22.writeFileSync(temp, `${JSON.stringify(stack, null, 2)}
 `);
-    fs21.renameSync(temp, file);
+    fs22.renameSync(temp, file);
     return { ok: true, data: undefined };
   } catch (error) {
-    fs21.rmSync(temp, { force: true });
+    fs22.rmSync(temp, { force: true });
     return stackFail("unavailable", `cannot write ${file}: ${error.message}`);
   }
 }
@@ -74718,7 +75846,7 @@ function listStacks(cwd) {
     return dir;
   let names = [];
   try {
-    names = fs21.readdirSync(dir.data).filter((name) => name.endsWith(".json"));
+    names = fs22.readdirSync(dir.data).filter((name) => name.endsWith(".json"));
   } catch {
     return { ok: true, data: [] };
   }
@@ -74726,7 +75854,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs21.readFileSync(path43.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs22.readFileSync(path44.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -74773,7 +75901,7 @@ function stackLockStale(raw, age) {
 }
 function takeLock(lock) {
   try {
-    fs21.mkdirSync(lock);
+    fs22.mkdirSync(lock);
   } catch (error) {
     if (error.code === "EEXIST")
       return null;
@@ -74785,24 +75913,24 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes3(8).toString("hex")
   };
-  fs21.writeFileSync(path43.join(lock, OWNER), JSON.stringify(owner));
+  fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
   const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
   try {
-    fs21.renameSync(lock, tomb);
+    fs22.renameSync(lock, tomb);
   } catch {
     return false;
   }
   if (readOwner(tomb).raw === observed) {
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.rmSync(tomb, { recursive: true, force: true });
     return true;
   }
   try {
-    fs21.renameSync(tomb, lock);
+    fs22.renameSync(tomb, lock);
   } catch {
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.rmSync(tomb, { recursive: true, force: true });
   }
   return false;
 }
@@ -74812,8 +75940,8 @@ function releaseLock(lock, owner) {
     return;
   const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
   try {
-    fs21.renameSync(lock, tomb);
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.renameSync(lock, tomb);
+    fs22.rmSync(tomb, { recursive: true, force: true });
   } catch {}
 }
 async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
@@ -74822,9 +75950,9 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path43.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path44.join(dir.data, `${fileFor(name)}.lock`);
   try {
-    fs21.mkdirSync(dir.data, { recursive: true });
+    fs22.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
     return stackFail("unavailable", `cannot create ${dir.data}: ${error.message}`);
   }
@@ -74852,7 +75980,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs21.utimesSync(path43.join(lock, OWNER), now, now);
+      fs22.utimesSync(path44.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -74885,7 +76013,7 @@ function deriveChain(cwd, trunk, base) {
     const [name, sha] = line.trim().split(" ");
     if (!name || !sha || name === branch || name === trunk)
       continue;
-    if (sha === head || isAncestor(cwd, sha, base) || !isAncestor(cwd, sha, head))
+    if (sha === head || isAncestor2(cwd, sha, base) || !isAncestor2(cwd, sha, head))
       continue;
     const count = gitRun3(cwd, ["rev-list", "--count", `${base}..${sha}`]);
     below.push({ branch: name, depth: Number(count.stdout.trim()) || 0 });
@@ -74931,17 +76059,17 @@ function planStack(cwd, resolved, input, existing) {
         const status = resolved.forge.prStatus(before.pr);
         still = status.ok && status.data.state === "merged";
       } else
-        still = hasOwnCommits(cwd, tip, before.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+        still = hasOwnCommits(cwd, tip, before.lastParentHead) && isAncestor2(cwd, tip, trunkSha);
       if (still) {
         entries.push(before);
         continue;
       }
       notes.push(`${branch} was recorded as merged but is not; it is back in the stack`);
     }
-    const onParent = isAncestor(cwd, parentSha, tip);
+    const onParent = isAncestor2(cwd, parentSha, tip);
     let builtOn = parentSha;
     if (!onParent) {
-      if (before?.lastParentHead && isAncestor(cwd, before.lastParentHead, tip))
+      if (before?.lastParentHead && isAncestor2(cwd, before.lastParentHead, tip))
         builtOn = before.lastParentHead;
       else {
         const old = oldParentVersion(cwd, parent, parentSha, tip) ?? oldParentLookalike(cwd, parentSha, tip);
@@ -75016,7 +76144,7 @@ function planStack(cwd, resolved, input, existing) {
 function hasOwnCommits(cwd, tip, base) {
   if (!base)
     return false;
-  return tip !== base && !isAncestor(cwd, tip, base);
+  return tip !== base && !isAncestor2(cwd, tip, base);
 }
 function oldParentVersion(cwd, parent, parentSha, child) {
   if (!safeRef2(parent))
@@ -75028,7 +76156,7 @@ function oldParentVersion(cwd, parent, parentSha, child) {
 `).map((line) => line.trim())) {
     if (!sha || sha === parentSha)
       continue;
-    if (isAncestor(cwd, sha, child) && !isAncestor(cwd, sha, parentSha))
+    if (isAncestor2(cwd, sha, child) && !isAncestor2(cwd, sha, parentSha))
       return sha;
   }
   return null;
@@ -75162,7 +76290,7 @@ function stackStatus(ctx, stack) {
       pr: entry.pr,
       merged,
       head,
-      onParent: merged || !head || !parentSha ? null : isAncestor(ctx.cwd, parentSha, head),
+      onParent: merged || !head || !parentSha ? null : isAncestor2(ctx.cwd, parentSha, head),
       prState: doc?.state ?? null,
       prBase: doc?.base ?? null,
       baseMatches: doc && !merged ? doc.base === parentName : null,
@@ -75225,7 +76353,7 @@ function detectMerged(ctx, cwd, stack, trunkSha, state) {
       merged = read.data.state === "merged";
     } else {
       const tip = branchTip(cwd, entry.branch);
-      merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+      merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor2(cwd, tip, trunkSha);
     }
     if (merged) {
       entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
@@ -75246,7 +76374,7 @@ function pushBranch(cwd, actor, branch, priorTip) {
   const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
     return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
-  const force = remote.sha !== null && !isAncestor(cwd, remote.sha, plan.data.sha);
+  const force = remote.sha !== null && !isAncestor2(cwd, remote.sha, plan.data.sha);
   const expect = !force ? null : remote.sha === priorTip ? priorTip : recordedRemoteTip(cwd, plan.data) ?? null;
   const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
   if (!pushed.ok)
@@ -75323,9 +76451,9 @@ function syncStack(cwd, ctx, stack, options, actor) {
         carried: null
       };
       newTip = null;
-    } else if (!isAncestor(cwd, parentTip, tip)) {
+    } else if (!isAncestor2(cwd, parentTip, tip)) {
       const pending = entry.pendingRestack ?? null;
-      const from = pending && isAncestor(cwd, pending.onto, tip) ? pending.onto : entry.lastParentHead && isAncestor(cwd, entry.lastParentHead, tip) ? entry.lastParentHead : mergeBase(cwd, entry.lastParentHead ?? parentTip, tip) ?? parentTip;
+      const from = pending && isAncestor2(cwd, pending.onto, tip) ? pending.onto : entry.lastParentHead && isAncestor2(cwd, entry.lastParentHead, tip) ? entry.lastParentHead : mergeBase(cwd, entry.lastParentHead ?? parentTip, tip) ?? parentTip;
       if (options.dryRun) {
         step.restack = { from, onto: parentTip, head: null, carried: null };
         newTip = null;
@@ -75373,7 +76501,7 @@ function syncStack(cwd, ctx, stack, options, actor) {
       }
     }
     if (!options.dryRun && newTip) {
-      const check = entry.pendingRestack && parentTip && isAncestor(cwd, parentTip, newTip) ? entry.pendingRestack : null;
+      const check = entry.pendingRestack && parentTip && isAncestor2(cwd, parentTip, newTip) ? entry.pendingRestack : null;
       let forced = false;
       if (check && parentTip) {
         const before = {
@@ -75687,12 +76815,12 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
     stderr: run.error ? String(run.error.message) : run.stderr ?? "",
     timedOut: failure?.code === "ETIMEDOUT"
   };
-}, safeRef2 = (value) => value.length > 0 && !value.startsWith("-"), isAncestor = (cwd, ancestor, descendant) => safeRef2(ancestor) && safeRef2(descendant) && gitRun3(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`), trackedDirt = (dir) => {
+}, safeRef2 = (value) => value.length > 0 && !value.startsWith("-"), isAncestor2 = (cwd, ancestor, descendant) => safeRef2(ancestor) && safeRef2(descendant) && gitRun3(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`), trackedDirt = (dir) => {
   const status = gitRun3(dir, ["status", "--porcelain", "--untracked-files=no"]);
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path43.join(dir.data, "worktrees") : null;
+  return dir.ok ? path44.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -75704,17 +76832,17 @@ ${run.stdout}`.split(`
       return false;
   }
   return true;
-}, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs21.readFileSync(path43.join(lock, OWNER), "utf8");
+    raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path43.join(lock, OWNER), lock])
+  for (const target of [path44.join(lock, OWNER), lock])
     try {
-      age = Date.now() - fs21.statSync(target).mtimeMs;
+      age = Date.now() - fs22.statSync(target).mtimeMs;
       break;
     } catch {}
   return { raw, age };
@@ -75931,16 +77059,16 @@ var init_pr_edit = __esm(() => {
 
 // packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync22 } from "node:child_process";
-import fs22 from "node:fs";
-import path44 from "node:path";
+import fs23 from "node:fs";
+import path45 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path44.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path45.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path44.join(dir, `${bin}${ext}`);
+      const candidate = path45.join(dir, `${bin}${ext}`);
       try {
-        const stat = fs22.statSync(candidate);
+        const stat = fs23.statSync(candidate);
         if (stat.isFile())
           return candidate;
       } catch {}
@@ -75972,7 +77100,7 @@ function systemRunner(kind, apiHost, env = process.env) {
       timeout: options.timeoutMs,
       killSignal: "SIGKILL",
       windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"]
+      ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
     });
     const error = result.error;
     return {
@@ -76048,8 +77176,8 @@ function apiText(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.lo
     return cliFailure(bin, apiHost, run, what, timeoutMs);
   return { ok: true, data: run.stdout };
 }
-function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api) {
-  const run = runner(bin, args, { timeoutMs });
+function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api, input) {
+  const run = runner(bin, args, input === undefined ? { timeoutMs } : { timeoutMs, input });
   if (run.status !== 0) {
     const text = redactText(`${run.stderr}
 ${run.stdout}`).trim();
@@ -76238,8 +77366,11 @@ function createGitHubForge(options) {
       if (!data.ok)
         return data;
       const nodes = data.data.repository?.pullRequests.nodes ?? [];
-      const ours = nodes.filter((node) => node.headRefName === head && (match.owner !== null && node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase() || match.sha !== null && node.headRefOid === match.sha));
-      const pick = ours.find((node) => node.state === "OPEN") ?? ours[0];
+      const ours = nodes.filter((node) => node.headRefName === head && (!match.base || node.baseRefName === undefined || node.baseRefName === match.base) && (match.owner !== null && node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase() || match.sha !== null && node.headRefOid === match.sha));
+      const open = ours.filter((node) => node.state === "OPEN");
+      if (!match.base && new Set(open.map((node) => node.baseRefName)).size > 1)
+        return failure3("blocked", `ambiguous_pr: ${head} has open pull requests ${open.map((node) => `#${node.number} -> ${node.baseRefName}`).join(", ")}`, `pass --pr <n>, e.g. --pr ${open[0].number}`);
+      const pick = open[0] ?? ours[0];
       if (!pick)
         return success2(null);
       const ref = {
@@ -76348,16 +77479,19 @@ function createGitHubForge(options) {
       });
     },
     merge(number, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       const merged = apiWrite(runner, "gh", apiHost, [
         "api",
         "-X",
         "PUT",
         `repos/${repo}/pulls/${number}/merge`,
-        "-f",
-        `sha=${mergeOptions.sha}`,
-        "-f",
-        `merge_method=${mergeOptions.method}`
-      ], `merge of pull request #${number}`);
+        ...squash ? ["--input", "-"] : ["-f", `sha=${mergeOptions.sha}`, "-f", `merge_method=${mergeOptions.method}`]
+      ], `merge of pull request #${number}`, undefined, squash ? JSON.stringify({
+        sha: mergeOptions.sha,
+        merge_method: mergeOptions.method,
+        commit_title: squash.subject,
+        commit_message: squash.body
+      }) : undefined);
       if (!merged.ok)
         return merged;
       if (merged.data.merged === false)
@@ -76459,7 +77593,7 @@ function createGitHubForge(options) {
     }
   };
 }
-var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
+var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
 var init_github = __esm(() => {
   init_exec();
   init_redact();
@@ -76576,8 +77710,11 @@ function createGitLabForge(options) {
         return list;
       if (!Array.isArray(list.data))
         return failure3("failed", "merge request list is not a list");
-      const matches = list.data.filter((mr) => mr.source_branch === head && (match.projectId !== null && mr.source_project_id === match.projectId || match.sha !== null && mr.sha === match.sha));
-      const pick = matches.find((mr) => mr.state === "opened") ?? matches[0];
+      const matches = list.data.filter((mr) => mr.source_branch === head && (!match.base || mr.target_branch === undefined || mr.target_branch === match.base) && (match.projectId !== null && mr.source_project_id === match.projectId || match.sha !== null && mr.sha === match.sha));
+      const open = matches.filter((mr) => mr.state === "opened");
+      if (!match.base && new Set(open.map((mr) => mr.target_branch)).size > 1)
+        return failure3("blocked", `ambiguous_pr: ${head} has open merge requests ${open.map((mr) => `!${mr.iid} -> ${mr.target_branch}`).join(", ")}`, `pass --pr <n>, e.g. --pr ${open[0].iid}`);
+      const pick = open[0] ?? matches[0];
       return success2(pick ? {
         number: pick.iid,
         url: pick.web_url,
@@ -76712,6 +77849,7 @@ function createGitLabForge(options) {
       });
     },
     merge(iid, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       if (mergeOptions.method === "rebase")
         return failure3("invalid_input", "GitLab merges with the project's merge method; pass --method squash or merge");
       const merged = apiWrite(runner, "glab", apiHost, [
@@ -76719,11 +77857,19 @@ function createGitLabForge(options) {
         "-X",
         "PUT",
         `${project}/merge_requests/${iid}/merge`,
-        "-f",
-        `sha=${mergeOptions.sha}`,
-        "-F",
-        `squash=${mergeOptions.method === "squash" ? "true" : "false"}`
-      ], `merge of merge request !${iid}`);
+        ...squash ? ["--input", "-"] : [
+          "-f",
+          `sha=${mergeOptions.sha}`,
+          "-F",
+          `squash=${mergeOptions.method === "squash" ? "true" : "false"}`
+        ]
+      ], `merge of merge request !${iid}`, undefined, squash ? JSON.stringify({
+        sha: mergeOptions.sha,
+        squash: true,
+        squash_commit_message: squash.body ? `${squash.subject}
+
+${squash.body}` : squash.subject
+      }) : undefined);
       if (!merged.ok)
         return merged;
       const value = merged.data;
@@ -76868,7 +78014,7 @@ var init_gitlab = __esm(() => {
 });
 
 // packages/workit-core/src/forge/resolve.ts
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 function memo4(scope, key, compute, now = Date.now) {
   let entries = memoScopes.get(scope.owner);
   if (!entries)
@@ -76913,7 +78059,7 @@ function resolveCredential(workspace, derived, run, scope) {
       return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
     let token = "";
     try {
-      token = fs23.readFileSync(tokenFile.trim(), "utf8").trim();
+      token = fs24.readFileSync(tokenFile.trim(), "utf8").trim();
     } catch {
       return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
     }
@@ -77111,16 +78257,16 @@ function parseDuration2(value) {
     return null;
   let total = 0;
   for (const [, amount, unit] of parts) {
-    const factor = UNITS.find(([pattern]) => pattern.test(unit))?.[1];
+    const factor = UNITS2.find(([pattern]) => pattern.test(unit))?.[1];
     if (factor === undefined)
       return null;
     total += Number(amount) * factor;
   }
   return Math.round(total);
 }
-var UNITS;
+var UNITS2;
 var init_duration = __esm(() => {
-  UNITS = [
+  UNITS2 = [
     [/^(?:ms|milliseconds?)$/u, 1],
     [/^(?:s|secs?|seconds?)$/u, 1000],
     [/^(?:m|mins?|minutes?)$/u, 60000],
@@ -77285,11 +78431,11 @@ __export(exports_pr, {
   run: () => run11
 });
 import { readFileSync as readFileSync21 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync21(path45.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync21(path46.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -77388,8 +78534,18 @@ async function create4(argv, io) {
   if (flags.values.base !== undefined && flags.values.track !== undefined)
     return usage3(io, "pass --base or --track, not both (--track picks the base for you)", CREATE_USAGE);
   let base = flags.values.base ?? null;
+  const branch = currentBranch(io.cwd);
+  const kind = branchKindOf(branch);
   let releaseTrack = null;
-  if (!base) {
+  let route = null;
+  if (base) {
+    const flow = gitFlowOf(io.cwd);
+    const mismatch = flowMismatch(flow, kind, base, "target");
+    if (mismatch && flow && kind)
+      return emit(io, fail("blocked", mismatch, {
+        unblock: `workit pr create …  # without --base it targets ${flowRoute(flow, kind).target}`
+      }));
+  } else {
     const resolved = vcsConfig("resolve", io.cwd, { track: flags.values.track ?? null });
     if (resolved.ok === false)
       return emit(io, fail("blocked", String(resolved.error), {
@@ -77401,10 +78557,13 @@ async function create4(argv, io) {
         unblock: "workit pr create --track <name> …  # or --base <branch>"
       }));
     base = String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = releaseTrack?.track ? null : gitFlowOf(io.cwd, base);
+    route = flow && kind ? flowRoute(flow, kind) : null;
+    if (route)
+      base = route.target;
   }
   if (!base)
     return usage3(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
-  const branch = currentBranch(io.cwd);
   const connected = connect(io, branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -77431,11 +78590,18 @@ async function create4(argv, io) {
   }, forgeDeps.sleep);
   if (!result.ok)
     return forgeFail(io, result);
-  const created = releaseTrack ? { ...result.data, releaseTrack } : result.data;
+  const created = {
+    ...result.data,
+    ...releaseTrack ? { releaseTrack } : {},
+    ...route ? { flow: route } : {}
+  };
   return emit(io, ok(created), (data) => [
     `${data.created ? "opened" : "found open"} ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number}${data.draft && data.created ? " (draft)" : ""}: ${data.branch} -> ${data.base}  ${data.url}`,
     ...data.releaseTrack?.name ? [`release track: ${data.releaseTrack.name} (${data.releaseTrack.detail})`] : [],
     ...(data.releaseTrack?.warnings ?? []).map((warning) => `note: ${warning}`),
+    ...route?.mergeBack ? [
+      `merge back: git-flow: once ${data.branch} lands on ${route.target}, bring ${route.target} into ${route.mergeBack} (workit pr create --base ${route.mergeBack} opens the back-merge PR from ${data.branch}, or merge locally and run workit git push --release ${route.mergeBack}); tag the release and push it with workit git push --release <tag>`
+    ] : [],
     `head ${data.head.slice(0, 12)} verified on the forge`,
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
     `next: ${data.next}`
@@ -77447,7 +78613,10 @@ async function merge3(argv, io) {
     method: "value",
     "delete-branch": "boolean",
     unverified: "boolean",
-    reason: "value"
+    reason: "value",
+    subject: "value",
+    body: "value",
+    "body-file": "value"
   });
   if (typeof flags === "string")
     return usage3(io, flags, MERGE_USAGE);
@@ -77462,6 +78631,21 @@ async function merge3(argv, io) {
   const method = flags.values.method ?? "squash";
   if (!METHODS2.has(method))
     return usage3(io, "--method must be squash, merge or rebase", MERGE_USAGE);
+  const { subject } = flags.values;
+  if (flags.values.body !== undefined && flags.values["body-file"] !== undefined)
+    return usage3(io, "pass --body or --body-file, not both", MERGE_USAGE);
+  let body = flags.values.body;
+  if (flags.values["body-file"] !== undefined) {
+    const read = readBodyFile(io, flags.values["body-file"]);
+    if (typeof read === "string")
+      return usage3(io, read, MERGE_USAGE);
+    body = read.body;
+  }
+  if ((subject !== undefined || body !== undefined) && method !== "squash")
+    return usage3(io, "--subject and --body set a squash message; use --method squash", MERGE_USAGE);
+  if (subject !== undefined && (!subject.trim() || subject.includes(`
+`)))
+    return usage3(io, "--subject must be one non-empty line", MERGE_USAGE);
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -77470,7 +78654,9 @@ async function merge3(argv, io) {
     method,
     deleteBranch: flags.booleans.has("delete-branch"),
     actor: actorFromEnv(io.env),
-    ...unverified ? { unverified } : {}
+    ...unverified ? { unverified } : {},
+    ...subject !== undefined ? { subject } : {},
+    ...body !== undefined ? { body } : {}
   }, forgeDeps.sleep);
   if (!result.ok)
     return emit(io, fail(result.code, result.error, {
@@ -77634,13 +78820,14 @@ async function run11(argv, io) {
     return reply(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE4);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
 var init_pr = __esm(() => {
   init_pr_body();
   init_pr_edit();
   init_pr_ops();
   init_report();
   init_rev();
+  init_branch();
   init_ledger();
   init_vcs_config();
   init_output();
@@ -77871,7 +79058,18 @@ __export(exports_git, {
   run: () => run13
 });
 import { readFileSync as readFileSync22 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
+function kindHint(cwd, kind) {
+  let kinds = [...BRANCH_KINDS];
+  try {
+    kinds = allowedKinds(branchPolicySnapshotFor(cwd).namePolicy.allowed);
+  } catch {}
+  const spellable = kinds.filter((name) => BRANCH_KINDS.includes(name));
+  if (spellable.length)
+    return `did you mean --kind ${suggestBranchName(`${kind}/x`, spellable)?.split("/")[0]}?`;
+  const named = suggestBranchName(`${kind}/<slug>`, kinds);
+  return named ? `this workspace allows ${kinds.map((name) => `${name}/`).join(", ")}: pass a name, e.g. workit git branch ${named}` : `this workspace allows any non-protected name: pass one, e.g. workit git branch ${kind}/<slug>`;
+}
 async function branch(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
@@ -77887,8 +79085,8 @@ async function branch(argv, io) {
     return usage3(io, `unexpected argument ${flags.positionals[1]}`, BRANCH_USAGE);
   if (kind === undefined !== (slug === undefined))
     return usage3(io, "--kind and --slug go together", BRANCH_USAGE);
-  if (kind !== undefined && !["feature", "bugfix", "hotfix"].includes(kind))
-    return usage3(io, "--kind must be feature, bugfix or hotfix", BRANCH_USAGE);
+  if (kind !== undefined && !BRANCH_KINDS.includes(kind))
+    return usage3(io, `--kind must be ${BRANCH_KINDS.join(", ")}; ${kindHint(io.cwd, kind)}`, BRANCH_USAGE);
   if (kind !== undefined && flags.positionals.length)
     return usage3(io, "pass a name or --kind/--slug, not both", BRANCH_USAGE);
   if (kind === undefined && !flags.positionals[0])
@@ -77911,6 +79109,7 @@ function parseCommit(argv) {
   const out = {
     messages: [],
     files: [],
+    trailers: [],
     all: false,
     amend: false,
     noEdit: false,
@@ -77932,14 +79131,15 @@ function parseCommit(argv) {
     }
     const valued = [
       ["-m", "--message", out.messages],
-      ["-F", "--file", out.files]
-    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || arg.startsWith(shortName) && arg.length > 2);
+      ["-F", "--file", out.files],
+      [null, "--trailer", out.trailers]
+    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || shortName !== null && arg.startsWith(shortName) && arg.length > 2);
     if (valued) {
       const [shortName, longName, into] = valued;
       if (arg === shortName || arg === longName) {
         const value = argv[++index];
         if (value === undefined)
-          return `${arg} requires a ${shortName === "-m" ? "message" : "file"}`;
+          return `${arg} requires a ${shortName === "-m" ? "message" : shortName === "-F" ? "file" : "Key: value trailer"}`;
         into.push(value);
       } else
         into.push(arg.startsWith(`${longName}=`) ? arg.slice(longName.length + 1) : arg.slice(2));
@@ -77962,7 +79162,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync22(0, "utf8") : readFileSync22(path46.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync22(0, "utf8") : readFileSync22(path47.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -77993,6 +79193,7 @@ async function commit(argv, io) {
     paths: parsed.paths,
     amend: parsed.amend,
     allowEmpty: parsed.allowEmpty,
+    trailers: parsed.trailers,
     actor: actorFromEnv(io.env),
     env: io.env
   });
@@ -78016,10 +79217,17 @@ async function push(argv, io) {
     "set-upstream": "boolean",
     "force-with-lease": "boolean",
     "overwrite-unintegrated": "boolean",
-    expect: "value"
+    expect: "value",
+    release: "list"
   });
   if (typeof flags === "string")
     return usage3(io, flags, PUSH_USAGE);
+  const release = flags.lists.release;
+  if (release) {
+    if (flags.booleans.size || flags.values.expect !== undefined || flags.positionals.length)
+      return usage3(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
+    return releasePush(release, io);
+  }
   if (flags.positionals.length)
     return usage3(io, `unexpected argument ${flags.positionals[0]} (workit pushes the current branch)`, PUSH_USAGE);
   const expect = flags.values.expect ?? null;
@@ -78065,6 +79273,46 @@ async function push(argv, io) {
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
 }
+async function releasePush(names, io) {
+  const plan = releasePushPreflight(io.cwd, names);
+  if (!plan.ok)
+    return forgeFail(io, plan);
+  const release = requireGrant(io.cwd, "release");
+  if (!release.allowed)
+    return emit(io, fail("blocked", release.error, {
+      unblock: release.unblock,
+      data: { reason: release.reason }
+    }));
+  const firstBranch = plan.data.refs.find((ref) => ref.kind === "branch")?.name;
+  const identity = plan.data.local ? null : pushIdentity(io, firstBranch ?? plan.data.refs[0].name);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const pushGrant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
+  if (!pushGrant.allowed)
+    return emit(io, fail("blocked", pushGrant.error, {
+      unblock: pushGrant.unblock,
+      data: { reason: pushGrant.reason }
+    }));
+  const result = executeReleasePush(io.cwd, plan.data, {
+    actor: actorFromEnv(io.env),
+    grant: release.source,
+    ...checked ? { identity: { ...checked } } : {}
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  return emit(io, ok({ ...result.data, identity: checked }), (data) => [
+    ...data.refs.map((ref) => ref.pushed ? `pushed ${ref.name} ${short2(ref.previous)} -> ${short2(ref.sha)} to ${data.remote}; remote tip verified` : `${data.remote} ${ref.name} is already at ${short2(ref.sha)}; remote tip verified`),
+    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
+  ]);
+}
+function trailers(argv, io) {
+  const extra = argv.find((arg) => arg !== "--json");
+  if (extra !== undefined)
+    return usage3(io, `unexpected argument ${extra}`, "workit git trailers");
+  const state = workspaceTrailers(io.cwd);
+  return emit(io, ok(state), (data) => data.enabled ? "on" : "off");
+}
 async function run13(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "branch")
@@ -78073,12 +79321,16 @@ async function run13(argv, io) {
     return commit(rest, io);
   if (sub === "push")
     return push(rest, io);
+  if (sub === "trailers")
+    return trailers(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE5 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
 var init_git2 = __esm(() => {
   init_autonomy();
+  init_branch();
   init_ops();
+  init_workspaces();
   init_ledger();
   init_implicit_task();
   init_output();
@@ -78629,8 +79881,8 @@ var init_stack2 = __esm(() => {
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync24 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
-import fs24 from "node:fs";
-import path47 from "node:path";
+import fs25 from "node:fs";
+import path48 from "node:path";
 function expandBraces(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -78776,7 +80028,7 @@ function inScope(plan, slice, file) {
 }
 function parsePlan(raw, defaults, name) {
   const problems = [];
-  if (!isRecord8(raw))
+  if (!isRecord9(raw))
     return { ok: false, problems: ["the plan must be a JSON object"] };
   const planName = name ?? (typeof raw.name === "string" ? raw.name.trim() : "");
   if (!planName || planName.length > 200 || /\p{Cc}/u.test(planName))
@@ -78799,8 +80051,8 @@ function parsePlan(raw, defaults, name) {
   const seenIds = new Set;
   const seenBranches = new Map;
   raw.slices.forEach((item, index) => {
-    const where = isRecord8(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
-    if (!isRecord8(item)) {
+    const where = isRecord9(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
+    if (!isRecord9(item)) {
       problems.push(`${where}: must be an object`);
       return;
     }
@@ -78864,7 +80116,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path47.resolve(defaults.root, optional("worktree") ?? path47.join(defaults.worktreeRoot, id)),
+      worktree: path48.resolve(defaults.root, optional("worktree") ?? path48.join(defaults.worktreeRoot, id)),
       tier,
       dependsOn: [...new Set(dependsOn ?? [])],
       scope,
@@ -79093,11 +80345,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path47.basename(common) === ".git" ? path47.dirname(common) : path47.resolve(cwd);
+  return common && path48.basename(common) === ".git" ? path48.dirname(common) : path48.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path47.join(path47.dirname(main), `${path47.basename(main)}-wt`);
+  return path48.join(path48.dirname(main), `${path48.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -79115,10 +80367,10 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path47.join(root.value.root, "fanouts") };
+  return { ok: true, data: path48.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
-  if (!isRecord8(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+  if (!isRecord9(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
     return null;
   if (!Array.isArray(raw.slices))
     return null;
@@ -79135,7 +80387,7 @@ function parseStored(raw) {
   });
   const slices = [];
   for (const item of raw.slices) {
-    if (!isRecord8(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+    if (!isRecord9(item) || typeof item.id !== "string" || typeof item.branch !== "string")
       return null;
     slices.push({
       id: item.id,
@@ -79181,10 +80433,10 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path47.join(dir.data, stackFileName(name));
+  const file = path48.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
-    parsed = parseStored(JSON.parse(fs24.readFileSync(file, "utf8")));
+    parsed = parseStored(JSON.parse(fs25.readFileSync(file, "utf8")));
   } catch (error) {
     if (error.code === "ENOENT")
       return { ok: true, data: null };
@@ -79198,7 +80450,7 @@ function listFanouts(cwd) {
     return dir;
   let names = [];
   try {
-    names = fs24.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
+    names = fs25.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
   } catch {
     return { ok: true, data: [] };
   }
@@ -79206,7 +80458,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs24.readFileSync(path47.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs25.readFileSync(path48.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -79236,16 +80488,16 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path47.join(dir.data, stackFileName(plan.name));
+  const file = path48.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
-    fs24.mkdirSync(dir.data, { recursive: true });
-    fs24.writeFileSync(temp, `${JSON.stringify(plan, null, 2)}
+    fs25.mkdirSync(dir.data, { recursive: true });
+    fs25.writeFileSync(temp, `${JSON.stringify(plan, null, 2)}
 `);
-    fs24.renameSync(temp, file);
+    fs25.renameSync(temp, file);
     return { ok: true, data: file };
   } catch (error) {
-    fs24.rmSync(temp, { force: true });
+    fs25.rmSync(temp, { force: true });
     return fanoutFail("unavailable", `cannot write ${file}: ${error.message}`);
   }
 }
@@ -79258,7 +80510,7 @@ function planFanout(cwd, input, now = new Date) {
     return fanoutFail("blocked", "--take-lead needs a session: WORKIT_SESSION_ID is not set", "export WORKIT_SESSION_ID=<your session id>, then plan again with --take-lead");
   if (input.takeLead && isDelegateSession(session))
     return fanoutFail("blocked", `session ${session} is a worker or verifier id; only a lead takes the lead`, "run --take-lead from the lead's own session");
-  const parsed = parsePlan(input.trunk && isRecord8(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
+  const parsed = parsePlan(input.trunk && isRecord9(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
     trunk: input.trunk ?? defaultTrunk(cwd),
     root: mainCheckout(cwd),
     worktreeRoot: worktreeRoot(cwd)
@@ -79381,7 +80633,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
   error,
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
-}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
+}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
   if (typeof value === "string")
     return [value];
   if (Array.isArray(value) && value.every((item) => typeof item === "string"))
@@ -79439,8 +80691,8 @@ var init_fanout = __esm(() => {
 
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
-import fs25 from "node:fs";
-import path48 from "node:path";
+import fs26 from "node:fs";
+import path49 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -79500,7 +80752,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs25.readFileSync(path48.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs26.readFileSync(path49.join(file, TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -79508,7 +80760,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path48.basename(file),
+      id: path49.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -79524,7 +80776,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes4(16).toString("hex");
   try {
-    fs25.writeFileSync(path48.join(admin.path, TOKEN_FILE), `${token}
+    fs26.writeFileSync(path49.join(admin.path, TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -79539,25 +80791,25 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path48.join(common, "info", "exclude");
+  const file = path49.join(common, "info", "exclude");
   let text = "";
   try {
-    text = fs25.readFileSync(file, "utf8");
+    text = fs26.readFileSync(file, "utf8");
   } catch {
     text = "";
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs25.mkdirSync(path48.dirname(file), { recursive: true });
-  fs25.appendFileSync(file, `${text && !text.endsWith(`
+  fs26.mkdirSync(path49.dirname(file), { recursive: true });
+  fs26.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
 ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path48.join(worktree, SCRATCH_DIR);
-  fs25.mkdirSync(scratch, { recursive: true });
+  const scratch = path49.join(worktree, SCRATCH_DIR);
+  fs26.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
 function createSliceWorktree(cwd, plan, input) {
@@ -79601,8 +80853,8 @@ function createSliceWorktree(cwd, plan, input) {
     return fanoutFail("blocked", `${slice.branch} is checked out at ${elsewhere.path}: never two live workers on one branch`, `stop that worker, then workit fanout worktree release ${slice.id} (or git worktree remove ${elsewhere.path})`);
   let dirExisted = false;
   try {
-    const stat = fs25.statSync(target);
-    if (!stat.isDirectory() || fs25.readdirSync(target).length > 0)
+    const stat = fs26.statSync(target);
+    if (!stat.isDirectory() || fs26.readdirSync(target).length > 0)
       return fanoutFail("blocked", `${target} exists and is ${stat.isDirectory() ? "not empty" : "not a directory"} (not a worktree of this repository)`, `move it away, or set slice ${slice.id}'s worktree to another path`);
     dirExisted = true;
   } catch (error) {
@@ -79684,7 +80936,7 @@ function releaseSliceWorktree(cwd, plan, input) {
     notes: []
   };
   if (index < 0) {
-    if (fs25.existsSync(target))
+    if (fs26.existsSync(target))
       return fanoutFail("blocked", `${target} is not a worktree of this repository; nothing was removed`, "remove it yourself once you know what it holds");
     out.notes.push(`no worktree at ${target}; nothing to release`);
     return { ok: true, data: out };
@@ -79746,7 +80998,7 @@ function releaseSliceWorktree(cwd, plan, input) {
 `)[0]}`, entry.locked ? `git worktree unlock ${entry.path}, then release again` : undefined, { ...out });
   out.removed = true;
   if (made.dirExisted === true)
-    fs25.mkdirSync(entry.path, { recursive: true });
+    fs26.mkdirSync(entry.path, { recursive: true });
   if (out.unpushed)
     out.notes.push(`${slice.branch} is kept with ${out.unpushed} commit(s) not on the remote`);
   return { ok: true, data: out };
@@ -79774,32 +81026,32 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path48.join(worktree, SCRATCH_DIR);
+  const scratch = path49.join(worktree, SCRATCH_DIR);
   let stat;
   try {
-    stat = fs25.lstatSync(scratch);
+    stat = fs26.lstatSync(scratch);
   } catch {
     return;
   }
   if (stat.isSymbolicLink() || !stat.isDirectory())
-    fs25.unlinkSync(scratch);
+    fs26.unlinkSync(scratch);
   else
-    fs25.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
+    fs26.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
 }
 var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000, canonical2 = (target) => {
   try {
-    return fs25.realpathSync.native(target);
+    return fs26.realpathSync.native(target);
   } catch {
-    return path48.resolve(target);
+    return path49.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path48.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path48.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path48.isAbsolute(slice.worktree) ? slice.worktree : path48.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+  const relative = path49.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path49.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path49.isAbsolute(slice.worktree) ? slice.worktree : path49.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -79809,7 +81061,7 @@ var init_fanout_worktree = __esm(() => {
   SLOW = GIT_TIMEOUTS.worktree;
   EXCLUDE_LINE = `/${SCRATCH_DIR}/`;
   worktreeDeps = {
-    stat: (file) => fs25.statSync(file, { bigint: true })
+    stat: (file) => fs26.statSync(file, { bigint: true })
   };
 });
 
@@ -79850,7 +81102,9 @@ function renderBrief(cwd, plan, input) {
     id: row.id,
     what: String(row.what)
   }));
-  const session = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const identity = identityOf(input.actor.host);
+  const minted = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const session = identity === "declared" ? minted : null;
   const fanIn = plan.fanIn === "integration" ? [
     `FAN-IN: integration branch ${plan.trunk}. Before you report, merge its tip into your branch`,
     `  (\`git merge --no-edit ${plan.trunk}\`), resolve conflicts inside SCOPE and re-run VERIFY, so the`,
@@ -79879,8 +81133,8 @@ function renderBrief(cwd, plan, input) {
     ...REPORT,
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
-    `  export WORKIT_SESSION_ID=${session}`,
-    ...rules(mode, branch, slice.base)
+    ...identityLines(identity, minted),
+    ...rules(identity, mode, branch, slice.base)
   ];
   return {
     ok: true,
@@ -79901,13 +81155,38 @@ function renderBrief(cwd, plan, input) {
     }
   };
 }
-var DEFAULT_TIMEBOX = "30 minutes", REPORT, rules = (mode, branch, base) => [
-  "RULES:",
-  mode === "new" ? `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).` : `  1. First command: \`git switch ${branch}\`, then continue from its head.`,
-  '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
-  "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
-  "  4. Never record a verdict on your own work."
-], sessionSafe = (text) => text.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-"), SESSION_MAX = 128;
+var DEFAULT_TIMEBOX = "30 minutes", REPORT, identityOf = (host) => {
+  const family = host?.replace(/_(?:cli|desktop)$/, "") ?? "";
+  if (family === "claude_code")
+    return "issued";
+  if (family === "opencode" || family === "pi" || family === "codex")
+    return "derived";
+  return "declared";
+}, identityLines = (identity, session) => {
+  if (identity === "issued")
+    return [
+      "  Session: your env already has WORKIT_SESSION_ID (the lead's id; SubagentStart issues ids only to verifiers and reviewers). Use it as is, in your Workit-Session trailer and workit commands; never export or hand-mint one."
+    ];
+  if (identity === "derived")
+    return [
+      "  Session: your host already sets WORKIT_SESSION_ID in your shell; export nothing and never hand-mint one."
+    ];
+  return [`  export WORKIT_SESSION_ID=${session}`];
+}, rules = (identity, mode, branch, base) => {
+  const plain = identity === "issued";
+  let first = `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).`;
+  if (mode === "resume")
+    first = `  1. First command: \`git switch ${branch}\`, then continue from its head.`;
+  else if (plain)
+    first = `  1. First command: \`git fetch origin && git switch -c ${branch} origin/${base}\` (plain git: worktree isolation refuses every \`workit git\` form).`;
+  return [
+    "RULES:",
+    first,
+    '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
+    plain ? '  3. Commit with plain `git commit -m <msg> --trailer "Workit-Session: <the WORKIT_SESSION_ID in your env>" --trailer "<your host attribution trailer>" -- <paths in SCOPE>`; push only if this brief says so.' : "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
+    "  4. Never record a verdict on your own work."
+  ];
+}, sessionSafe = (text) => text.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-"), SESSION_MAX = 128;
 var init_fanout_brief = __esm(() => {
   init_ledger();
   init_fanout();
@@ -79963,9 +81242,9 @@ function hasOwnCommits2(cwd, branch, start, head) {
     const onto = /^rebase(?: -i)? \(finish\): \S+ onto ([0-9a-f]+)/u.exec(subject)?.[1];
     if (!made && !(onto && !sha.startsWith(onto) && !onto.startsWith(sha)))
       continue;
-    if (sha !== head && !isAncestor2(cwd, sha, head))
+    if (sha !== head && !isAncestor3(cwd, sha, head))
       continue;
-    if (start && (sha === start || isAncestor2(cwd, sha, start)))
+    if (start && (sha === start || isAncestor3(cwd, sha, start)))
       continue;
     return true;
   }
@@ -79975,7 +81254,7 @@ function reverted(cwd, trunk, landedHead, start) {
   const fork = mergeBase(cwd, landedHead, trunk);
   if (fork && fork !== landedHead)
     return unchangedSince(cwd, fork, landedHead, trunk);
-  const before = start && start !== landedHead && isAncestor2(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
+  const before = start && start !== landedHead && isAncestor3(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
   return before ? unchangedSince(cwd, before, landedHead, trunk) : false;
 }
 function unchangedSince(cwd, before, after, trunk) {
@@ -80083,9 +81362,9 @@ function detectLanding(ctx, slice, input) {
           }
           return merged ? landed("pr_merged", merged) : { ...out, landed: true, how: "pr_merged" };
         }
-        if (!merged || head === merged || isAncestor2(ctx.cwd, head, merged))
+        if (!merged || head === merged || isAncestor3(ctx.cwd, head, merged))
           return landed("pr_merged", merged ?? head);
-        out.note = isAncestor2(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
+        out.note = isAncestor3(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
         return out;
       }
     }
@@ -80102,7 +81381,7 @@ function detectLanding(ctx, slice, input) {
   if (trunkIds.size === 0)
     return out;
   const froms = [fork];
-  if (input.parentHead && input.parentHead !== head && isAncestor2(ctx.cwd, input.parentHead, head))
+  if (input.parentHead && input.parentHead !== head && isAncestor3(ctx.cwd, input.parentHead, head))
     froms.push(input.parentHead);
   for (const from of froms) {
     const id = patchId(ctx.cwd, from, head);
@@ -80118,7 +81397,7 @@ function sliceStart(cwd, rows, fanout, slice) {
   const row = rows.findLast((candidate) => candidate.type === "fanout.worktree.created" && candidate.fanout === fanout && candidate.slice === slice.id && typeof candidate.baseSha === "string" && inSliceRun(candidate, slice));
   return row?.baseSha ?? null;
 }
-var isAncestor2 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
+var isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
 var init_fanout_landed = __esm(() => {
   init_rev();
   init_fanout();
@@ -80175,7 +81454,7 @@ function checkFanout(cwd, plan, options = {}) {
       const b = tips.get(second);
       if (landings.get(first)?.landed || landings.get(second)?.landed)
         continue;
-      if (!a || !b || isAncestor3(cwd, a, b) || isAncestor3(cwd, b, a))
+      if (!a || !b || isAncestor4(cwd, a, b) || isAncestor4(cwd, b, a))
         continue;
       const check = checks.get(second);
       const theirs = new Map((changedBy.get(first) ?? []).map((file) => [file.toLowerCase(), file]));
@@ -80355,7 +81634,7 @@ function unblockFor(check, plan) {
     return `unblock ${check.waitsFor.join(", ")} first`;
   return check.reasons[0] ?? "workit fanout check";
 }
-var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
+var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
   id: slice.id,
   branch: slice.branch,
   head,
@@ -80574,8 +81853,8 @@ var exports_fanout = {};
 __export(exports_fanout, {
   run: () => run16
 });
-import fs26 from "node:fs";
-import path49 from "node:path";
+import fs27 from "node:fs";
+import path50 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -80636,10 +81915,10 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path49.resolve(io.cwd, flags.positionals[0]);
+  const file = path50.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
-    raw = JSON.parse(fs26.readFileSync(file, "utf8"));
+    raw = JSON.parse(fs27.readFileSync(file, "utf8"));
   } catch (error) {
     return usage3(io, `cannot read ${file} as JSON: ${error.message}`, PLAN_USAGE2);
   }
@@ -96124,7 +97403,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path50 from "node:path";
+import path51 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -96617,12 +97896,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path50.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path51.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path50.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path51.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -97012,7 +98291,7 @@ var init_rules = __esm(() => {
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync26 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync26("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -97025,7 +98304,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path51.join(dir, entry.name);
+    const full = path52.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -97037,7 +98316,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path51.resolve(cwd, input);
+    const full = path52.resolve(cwd, input);
     if (!existsSync20(full))
       missing.push(input);
     else if (statSync8(full).isDirectory())
@@ -97074,11 +98353,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path51.join(root, file), lines);
+    changed.set(path52.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path51.join(root, file), "all");
+    changed.set(path52.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -97140,7 +98419,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path51.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path52.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -97169,8 +98448,8 @@ import {
   writeFileSync as writeFileSync11,
   copyFileSync as copyFileSync6
 } from "node:fs";
-import os14 from "node:os";
-import path52 from "node:path";
+import os16 from "node:os";
+import path53 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -97243,7 +98522,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path52.posix.join(path52.posix.dirname(file), spec)) === target)
+        if (stripExt(path53.posix.join(path53.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -97251,7 +98530,7 @@ function relatedTests(source, testFiles) {
     return false;
   }).map((entry) => entry.file);
 }
-function removeStaleCopies(tmp = os14.tmpdir()) {
+function removeStaleCopies(tmp = os16.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
@@ -97263,12 +98542,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path52.join(tmp, name);
+    const dir = path53.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync24(path52.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync24(path53.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -97285,8 +98564,8 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
   for (const entry of readdirSync10(origin, { withFileTypes: true })) {
-    const from = path52.join(origin, entry.name);
-    const to = path52.join(target, entry.name);
+    const from = path53.join(origin, entry.name);
+    const to = path53.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -97302,9 +98581,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path52.relative(repo, real);
-      if (!relative.startsWith("..") && !path52.isAbsolute(relative) && !relative.split(path52.sep).includes("node_modules")) {
-        symlinkSync(path52.join(copy, relative), to, "junction");
+      const relative = path53.relative(repo, real);
+      if (!relative.startsWith("..") && !path53.isAbsolute(relative) && !relative.split(path53.sep).includes("node_modules")) {
+        symlinkSync(path53.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -97320,7 +98599,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync9(repo);
   if (real && inside4(realRepo, real)) {
-    symlinkSync(path52.relative(path52.dirname(to), path52.join(tree, path52.relative(realRepo, real))), to);
+    symlinkSync(path53.relative(path53.dirname(to), path53.join(tree, path53.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync9(real).isFile())
@@ -97329,10 +98608,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path52.join(copy, file);
+  const target = path53.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path52.dirname(target))))
+    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path53.dirname(target))))
       return false;
   } catch {
     return false;
@@ -97343,9 +98622,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path52.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync11(path52.join(dir, PID_FILE), String(process.pid));
-  const tree = path52.join(dir, "tree");
+  const dir = mkdtempSync4(path53.join(os16.tmpdir(), TEMP_PREFIX));
+  writeFileSync11(path53.join(dir, PID_FILE), String(process.pid));
+  const tree = path53.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -97362,29 +98641,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path52.join(repo, relative);
+    const from = path53.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path52.join(tree, relative);
-    mkdirSync10(path52.dirname(to), { recursive: true });
+    const to = path53.join(tree, relative);
+    mkdirSync10(path53.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path52.dirname(relative);
+    let parent = path53.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path52.dirname(parent);
+      parent = path53.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path52.join(repo, parent, "node_modules");
-    if (existsSync21(modules) && !existsSync21(path52.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path52.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path53.join(repo, parent, "node_modules");
+    if (existsSync21(modules) && !existsSync21(path53.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path53.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -97423,14 +98702,14 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync24(path52.join(repo, file), "utf8") };
+      return { file, text: readFileSync24(path53.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path52.relative(repo, absolute));
+    const relative = toPosix(path53.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync21(absolute))
@@ -97444,9 +98723,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path52.relative(repo, options.cwd);
+  const cwdRelative = path53.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path52.relative(cwdRelative, file));
+    const relative = toPosix(path53.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -97481,7 +98760,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path52.join(copy, cwdRelative);
+  const copyCwd = path53.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -97516,7 +98795,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync24(path52.join(copy, mutant.file), "utf8");
+      const original = readFileSync24(path53.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -97573,8 +98852,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside4 = (root, file) => {
-  const relative = path52.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path52.isAbsolute(relative);
+  const relative = path53.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path53.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -97623,7 +98902,7 @@ __export(exports_test_audit, {
   run: () => run18
 });
 import { existsSync as existsSync22 } from "node:fs";
-import path53 from "node:path";
+import path54 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -97727,8 +99006,8 @@ async function run18(argv, io) {
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE10}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path53.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path53.relative(io.cwd, file) || file);
+  const repo = top.ok ? path54.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path54.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -97971,7 +99250,7 @@ __export(exports_youtrack, {
   run: () => run20
 });
 import { readFileSync as readFileSync25 } from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 async function run20(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -98017,7 +99296,7 @@ async function run20(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync25(path54.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync25(path55.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
       }
@@ -98086,7 +99365,7 @@ __export(exports_changelog, {
   run: () => run21
 });
 import { readFileSync as readFileSync26 } from "node:fs";
-import path55 from "node:path";
+import path56 from "node:path";
 async function run21(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -98132,7 +99411,7 @@ async function run21(argv, io) {
   ]);
 }
 var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path55.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path56.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -98228,7 +99507,7 @@ var init_handoff = __esm(() => {
 
 // packages/workit-cli/src/main.ts
 init_package();
-import path56 from "node:path";
+import path57 from "node:path";
 
 // packages/workit-cli/src/help.ts
 var HELP_FLAGS = new Set(["--help", "-h"]);
@@ -98493,7 +99772,7 @@ var VERBS = [
   {
     name: "check",
     group: "delivery",
-    usage: "workit check <name> [--task <id>] [--base <ref>] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] -- <cmd…>",
+    usage: "workit check <name> [--task <id>] [--base <ref>] [--no-lease] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] [--heavy] [--no-lease] -- <cmd…>",
     summary: "Run a configured or ad-hoc check and record CLI-observed evidence (exit = the command's)",
     examples: ["workit check test", "workit check --name unit -- bun test test/unit"],
     load: () => Promise.resolve().then(() => (init_check(), exports_check))
@@ -98535,8 +99814,8 @@ var VERBS = [
       },
       {
         name: "merge",
-        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>]",
-        summary: "Merge when READY, verified by a non-author and granted"
+        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>]",
+        summary: "Merge when READY, verified by a non-author and granted; --subject/--body set the squash message"
       }
     ],
     examples: [
@@ -98571,23 +99850,29 @@ var VERBS = [
     subcommands: [
       {
         name: "branch",
-        usage: "workit git branch <name> | git branch --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry]",
-        summary: "Create and switch to a branch from the trunk or a release track"
+        usage: "workit git branch <name> | git branch --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry]",
+        summary: "Create and switch to a branch from the trunk, the git-flow route of its kind or a release track"
       },
       {
         name: "commit",
-        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
-        summary: "Commit (or --amend) with a linted Conventional Commit message and the session trailer"
+        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
+        summary: "Commit (or --amend) with a linted Conventional Commit message, the session trailer (unless the workspace sets trailers: false) and any --trailer"
       },
       {
         name: "push",
-        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]]",
-        summary: "Push the current branch and verify the remote tip (never a blind --force)"
+        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…]",
+        summary: "Push the current branch and verify the remote tip (never a blind --force); --release finishes a git-flow release"
+      },
+      {
+        name: "trailers",
+        usage: "workit git trailers",
+        summary: "Print on or off: whether commits in this workspace get the Workit-Session trailer"
       }
     ],
     examples: [
       "workit git branch --kind feature --slug help-everywhere",
       'workit git commit -m "fix(cli): answer help flags first" --all',
+      'workit git commit -m "feat: x" --trailer "Co-Authored-By: Name <email>" --all',
       "workit git commit --amend --no-edit -- src/forgotten.ts",
       "workit git push --set-upstream"
     ],
@@ -98874,7 +100159,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path56.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path57.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));