@brainervirus/workit-core 8.35.0 → 8.36.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.35.0",
+  "version": "8.36.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/skills/workit-implement/SKILL.md

@@ -23,7 +23,7 @@ description: Build a requested change in small verified steps - follow local pat
    (`workit check test`, plus `lint` and `typecheck` when the repo has them),
    not after every edit. Heavy work runs under one machine-wide lease: an ad-hoc
    suite is `workit check --heavy -- <cmd>`, never a hand-made flock; a busy
-   lease waits and names its holder (`workit lock status`).
+   lease waits and names its holder (`workit lock status`). A tool warning is a finding: fix it in this PR in the right layer, or record the false positive with evidence; pre-existing ones get their own PR.
 5. Prove the feature on its real surface with the project's `verify-<app>`
    skill; none yet? Write one (workit-verify-app). Tests show branch behavior,
    not that the feature works. The report carries what you observed: a UI

package/skills/workit-ship/SKILL.md

@@ -49,7 +49,7 @@ the same check. Fix round and recheck both failed: a decider (workit-fanout).
 5. **CI.** Local gates mirror CI: push and continue; `workit ci wait` once on
    the final head, in the background where the host allows. Red: read `logTail`, classify. Flake or infra: one
    `workit ci rerun --failed --reason flake|infra` per head. Real: reproduce
-   with `workit check`, fix the root cause, batch every fix in one push.
+   with `workit check`, fix the root cause, batch every fix in one push. A tool warning is a finding: fix it in this PR in the right layer, or record the false positive with evidence; pre-existing ones get their own PR.
 6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (workit-review), on Claude Code with the `model` and `effort` of `workit models show --role verifier`. A docs-only push (or test-only under a unit verdict) keeps the verdict (`carried`); `reverify: focused` re-checks only the new diff, reusing green CI; one verdict at a stack's top covers its unchanged lower PRs. Land only when
    granted: `workit stack land` or `workit pr merge`; `--unverified --reason` if user-asked.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed

package/src/core/workspaces.ts

@@ -103,7 +103,11 @@ const releaseTrackSchema = z
       ["requiredChecks", track.requiredChecks ?? []],
     ] as const) {
       if (new Set(values).size !== values.length) {
-        context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+        context.addIssue({
+          code: "custom",
+          path: [field],
+          message: "entries must be unique",
+        });
       }
     }
     if (
@@ -192,7 +196,10 @@ const workspaceConfigSchema = z
       .passthrough()
       .optional(),
     youtrack: z
-      .object({ baseUrl: nonBlank.optional(), link_issues: z.boolean().optional() })
+      .object({
+        baseUrl: nonBlank.optional(),
+        link_issues: z.boolean().optional(),
+      })
       .passthrough()
       .optional(),
     /**
@@ -302,9 +309,16 @@ export const workspacesRevision = (contents: string | null): string =>
 
 export const validateWorkspacesDocument = (parsed: unknown, file: string): WorkspacesResult => {
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} is not a JSON object`,
+    };
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  const validated = workspacesFileSchema.safeParse(parsed, {
+    reportInput: true,
+  });
   if (!validated.success) {
     const detail = validated.error.issues
       .map((issue) => {
@@ -353,7 +367,12 @@ export const readWorkspacesResult = (dir: string = configDir()): WorkspacesResul
     raw = readFileSync(file, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+      return {
+        status: "missing",
+        path: file,
+        entries: [],
+        revision: workspacesRevision(null),
+      };
     return {
       status: "malformed",
       path: file,
@@ -373,7 +392,10 @@ export const readWorkspacesResult = (dir: string = configDir()): WorkspacesResul
       error: `${file} is not valid JSON`,
     };
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+  return {
+    ...validateWorkspacesDocument(parsed, file),
+    revision: workspacesRevision(raw),
+  };
 };
 
 /** Parse the workspaces.json list under an explicit config dir; [] when missing/malformed. */
@@ -615,7 +637,7 @@ export const workspaceOverlaps = (
     for (const b of entries.slice(i + 1)) {
       const aInB = matchWorkspace(b.glob, globRoot(a.glob));
       const bInA = matchWorkspace(a.glob, globRoot(b.glob));
-      if (!aInB && !bInA) continue;
+      if (!aInB && !bInA && !globsMayOverlap(a.glob, b.glob)) continue;
       const [inner, outer] =
         aInB && !bInA
           ? [a, b]
@@ -818,7 +840,10 @@ export const resolveRuntimeReleaseTracks = (
 ): { workspace: string; releaseTracks: unknown } | null => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched
-    ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks }
+    ? {
+        workspace: matched.selected.name,
+        releaseTracks: matched.selected.releaseTracks,
+      }
     : null;
 };
 
@@ -846,7 +871,10 @@ const inheritedSetting = (
   const enclosing = matches
     .filter((entry) => entry !== selected)
     .toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+  return {
+    workspace: selected.name,
+    source: [selected, ...enclosing].find(has) ?? null,
+  };
 };
 
 /** Whether `pr merge` deletes the head branch by default: true unless a covering entry sets `deleteBranch: false`. */
@@ -906,8 +934,18 @@ export const workspaceDelegation = (cwd: string, dir?: string): DelegationMode =
 export const modelSources = (
   cwd: string,
   dir?: string,
-): Array<{ name: string; global: boolean; models: unknown; tierModels: unknown }> => {
-  const out: Array<{ name: string; global: boolean; models: unknown; tierModels: unknown }> = [];
+): Array<{
+  name: string;
+  global: boolean;
+  models: unknown;
+  tierModels: unknown;
+}> => {
+  const out: Array<{
+    name: string;
+    global: boolean;
+    models: unknown;
+    tierModels: unknown;
+  }> = [];
   try {
     const matched = matchRuntimeWorkspace(cwd, dir);
     if (matched) {
@@ -1099,7 +1137,10 @@ export const resolveWorkspacePolicy = (
         status: "resolved" as const,
         profileName: null,
         workspace: null,
-        provenance: { branchPolicy: "user-default", commitPolicy: "user-default" },
+        provenance: {
+          branchPolicy: "user-default",
+          commitPolicy: "user-default",
+        },
       };
   if (selected.status === "invalid") return selected;
   return {
@@ -1130,7 +1171,11 @@ export const selectReleaseTrack = (
       error: `workspace ${JSON.stringify(workspace.name)} has no release track ${JSON.stringify(requestedTrack)}`,
     };
   }
-  return { status: "selected", name: requestedTrack, track: tracks[requestedTrack] };
+  return {
+    status: "selected",
+    name: requestedTrack,
+    track: tracks[requestedTrack],
+  };
 };
 
 /**

package/src/hooks/context.ts

@@ -223,7 +223,10 @@ function entryCompactContext(
     return hit.value;
   const task = entry ? store.readTask(entry.id) : null;
   if (task && !task.ok) return null;
-  const freshness: Freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const freshness: Freshness = {
+    mode: "signal",
+    current: () => recentSignal(store.root),
+  };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
   const files = (task?.data.decisions ?? []).flatMap((decision) =>
     decision.data.binding.contentRefs.flatMap((ref) =>
@@ -298,7 +301,6 @@ export const sessionContextText = (
   return `<workit-contract>\n${invariantBootstrap()}${compact}${offer ? `\n${offer}` : ""}${options.addendum ? `\n${options.addendum}` : ""}\n</workit-contract>`;
 };
 
-/** Per-turn task context only (no bootstrap or offer), or null when none applies. */
 /** The checkout holding `cwd` and its branch, read from the git dir (no spawn). */
 const checkoutAt = (cwd: string): { root: string; branch: string | null } | null => {
   for (let dir = path.resolve(cwd); ; dir = path.dirname(dir)) {
@@ -311,7 +313,10 @@ const checkoutAt = (cwd: string): { root: string; branch: string | null } | null
           )
         : dotGit;
       const head = fs.readFileSync(path.join(admin, "HEAD"), "utf8").trim();
-      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+      return {
+        root: dir,
+        branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null,
+      };
     }
     if (path.dirname(dir) === dir) return null;
   }
@@ -333,6 +338,7 @@ export const whereLine = (cwd: string): string | null => {
   }
 };
 
+/** Per-turn task context only (no bootstrap or offer), or null when none applies. */
 export const turnContextText = (input: HookInput, descriptor: HostDescriptor): string | null => {
   try {
     const text = sessionCompactContext(
@@ -422,7 +428,9 @@ export const changedTurnContext = (input: HookInput, text: string | null): strin
   if (!file) return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs.readFileSync(file, "utf8")) as { digest?: unknown };
+    const previous = JSON.parse(fs.readFileSync(file, "utf8")) as {
+      digest?: unknown;
+    };
     if (previous.digest === digest) return null;
   } catch {
     // Missing or unreadable digest: treat as changed.

package/src/ledger.ts

@@ -110,7 +110,11 @@ export const PR_ROW_TYPES: ReadonlySet<string> = new Set([
 ]);
 
 /** Who wrote a row. Unverified: the environment says so (D18). */
-export type LedgerActor = { host: string; session: string | null; agentId: string | null };
+export type LedgerActor = {
+  host: string;
+  session: string | null;
+  agentId: string | null;
+};
 
 /** The code state a row was recorded against (§2.2). */
 export type CodeKey = {
@@ -180,7 +184,11 @@ export type VerdictRow = RowCommon & {
   untracked?: string[];
   untrackedCount?: number;
 };
-export type HandoffRow = RowCommon & { type: "handoff"; note: string | null; next: string };
+export type HandoffRow = RowCommon & {
+  type: "handoff";
+  note: string | null;
+  next: string;
+};
 /**
  * A lead's standing order for every worker of a fanout ("no new dependencies").
  * `stop` marks the stop line: running workers stop and report.
@@ -801,7 +809,11 @@ export type UnverifiedRow = {
   reason: UnverifiedReason;
 };
 /** The hash chain over the file: rows the CLI wrote, rows from before the chain, and the rest. */
-export type LedgerIntegrity = { chained: number; legacy: number; unverified: UnverifiedRow[] };
+export type LedgerIntegrity = {
+  chained: number;
+  legacy: number;
+  unverified: UnverifiedRow[];
+};
 export type LedgerRead = {
   path: string;
   rows: ReadRow[];
@@ -950,7 +962,12 @@ export function readLedger(
     });
   return {
     ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null },
+    value: {
+      path: file.value,
+      rows,
+      skipped,
+      integrity: options.integrity ? integrity : null,
+    },
   };
 }
 
@@ -997,7 +1014,12 @@ const tamperedWarning = (cwd: string, breaks: readonly UnverifiedRow[]): string
       ", ",
     )}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 
-export type RowFilter = { branch?: string; pr?: number; type?: string; last?: number };
+export type RowFilter = {
+  branch?: string;
+  pr?: number;
+  type?: string;
+  last?: number;
+};
 
 export function filterRows(rows: readonly ReadRow[], filter: RowFilter): ReadRow[] {
   const matched = rows.filter(
@@ -1088,7 +1110,11 @@ export function codeKey(
 
 export type VerdictBasis = "fresh" | "carried" | "stale" | "none";
 
-type Keyed = { head: string | null; patchId: string | null; diffHash: string | null };
+type Keyed = {
+  head: string | null;
+  patchId: string | null;
+  diffHash: string | null;
+};
 
 /** fresh: same head · carried: same non-null patch-id AND exact diff · stale: otherwise. */
 export function verdictBasis(verdict: Keyed, current: Keyed): Exclude<VerdictBasis, "none"> {
@@ -1170,7 +1196,11 @@ export type VerdictCheck = {
    * What merge gates read: an accepted strong (`verified`/`tests-verified`)
    * verdict and no current independent failure. `type-check-only` never counts.
    */
-  accepted: { accepted: boolean; verdict: ReadRow | null; reasons: RejectReason[] };
+  accepted: {
+    accepted: boolean;
+    verdict: ReadRow | null;
+    reasons: RejectReason[];
+  };
   review: ReviewLabel;
   /** The newest current, strong, self verdict when `review` is self-reviewed. */
   selfVerdict: ReadRow | null;
@@ -1269,7 +1299,10 @@ export function authorSessions(
   cwd: string,
   rows: readonly ReadRow[],
   branch: string,
-  range: { base: string | null; head: string | null } = { base: null, head: null },
+  range: { base: string | null; head: string | null } = {
+    base: null,
+    head: null,
+  },
   scope: BranchScope = branchScope(cwd, branch),
 ): Set<string> {
   const sessions = new Set<string>();
@@ -1437,7 +1470,7 @@ function effectiveOf(
  * head to the current head. With `exactIn` (the checkout), each link is
  * re-read with exact blobs (sameOwnChange, #334), so a row recorded before
  * that check carries a pass only when the branch's own files are identical
- * across the restack. Null keeps every observed link: a failure keeps
+ * across the restack or the head is the judged head cleanly rebased (#468). Null keeps every observed link: a failure keeps
  * applying through them (failing closed the other way).
  */
 const restackExact = new WeakMap<ReadRow, boolean>();
@@ -1454,15 +1487,18 @@ function restackCarries(
     const cwd = exactIn;
     let known = restackExact.get(row);
     if (known === undefined) {
-      known =
-        typeof row.fromBase === "string" &&
-        typeof row.toBase === "string" &&
-        sameOwnChange(cwd, {
-          from: fromHead,
-          to: head,
-          fromBase: row.fromBase,
-          toBase: row.toBase,
-        });
+      // Identical own blobs, or the head is exactly the judged head cleanly
+      // rebased onto the moved base (#468): a base edit elsewhere in a shared file.
+      const range =
+        typeof row.fromBase === "string" && typeof row.toBase === "string"
+          ? {
+              from: fromHead,
+              to: head,
+              fromBase: row.fromBase,
+              toBase: row.toBase,
+            }
+          : null;
+      known = range !== null && (sameOwnChange(cwd, range) || cleanRebase(cwd, range));
       restackExact.set(row, known);
     }
     return known;
@@ -1510,7 +1546,10 @@ export function checkVerdicts(
     const cacheKey = `${base}\0${at}`;
     let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      key = {
+        patchId: patchId(cwd, base, at),
+        diffHash: diffHash(cwd, base, at),
+      };
       keyCache.set(cacheKey, key);
     }
     return key;
@@ -1575,7 +1614,10 @@ export function checkVerdicts(
   const exactCarry = (row: ReadRow): boolean =>
     FAILING.has(String(row.result)) || exactMatch(row) !== null;
   const keyBasis = (row: ReadRow): Exclude<VerdictBasis, "none"> => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const basis = verdictBasis(row, {
+      head,
+      ...keyFor(row.base ?? fallbackBase),
+    });
     return basis === "carried" && !exactCarry(row) ? "stale" : basis;
   };
   /** A pass the exact keys carry only through a clean rebase (the base also edited a branch file). */
@@ -1736,7 +1778,11 @@ export function checkVerdicts(
       (entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result)),
     ) ?? null;
   const accepted = tampered.length
-    ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] as RejectReason[] }
+    ? {
+        accepted: false,
+        verdict: null,
+        reasons: ["ledger_tampered"] as RejectReason[],
+      }
     : newestAccepted && !failing
       ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] }
       : {
@@ -1789,7 +1835,10 @@ export function checkVerdicts(
     selfVerdict: accepted.accepted ? null : (selfEntry?.verdict ?? null),
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    current: {
+      basis: newestCurrent?.basis ?? "none",
+      verdict: newestCurrent?.verdict ?? null,
+    },
     carry: carryEntry?.carry ?? null,
     reverify,
     accepted,
@@ -1868,7 +1917,13 @@ function checkSupersede(
 
 export function recordDecision(
   context: RecordContext,
-  input: { what?: string; why?: string; refs?: string[]; by?: string; views?: string[] },
+  input: {
+    what?: string;
+    why?: string;
+    refs?: string[];
+    by?: string;
+    views?: string[];
+  },
 ): LedgerResult<DecisionRow> {
   if (input.by !== undefined && input.by !== "decider")
     return err("invalid_input", `--by takes "decider", got "${input.by}"`);
@@ -2081,7 +2136,11 @@ export function clearStanding(
 /** Lift the stop line: clear each stop order in force and keep the others; lead only. */
 export function liftStop(
   context: RecordContext,
-  input: { fanout: string; lead: string | null; leads?: readonly string[] | null },
+  input: {
+    fanout: string;
+    lead: string | null;
+    leads?: readonly string[] | null;
+  },
 ): LedgerResult<StandingClearedRow[]> {
   const lead = leadOnly(context, input.lead);
   if (!lead.ok) return lead;
@@ -2242,10 +2301,16 @@ export function recordVerdict(
   );
 }
 
-function untrackedField(cwd: string): { untracked?: string[]; untrackedCount?: number } {
+function untrackedField(cwd: string): {
+  untracked?: string[];
+  untrackedCount?: number;
+} {
   const files = untrackedFiles(cwd);
   return files.length
-    ? { untracked: files.slice(0, MAX_UNTRACKED_LISTED), untrackedCount: files.length }
+    ? {
+        untracked: files.slice(0, MAX_UNTRACKED_LISTED),
+        untrackedCount: files.length,
+      }
     : {};
 }
 
@@ -2255,7 +2320,12 @@ export function recordHandoff(
 ): LedgerResult<HandoffRow> {
   return appendRow<HandoffRow>(
     context.cwd,
-    { ...common(context, noteKey(context)), type: "handoff", note: input.note, next: input.next },
+    {
+      ...common(context, noteKey(context)),
+      type: "handoff",
+      note: input.note,
+      next: input.next,
+    },
     { now: context.now },
   );
 }
@@ -2404,7 +2474,12 @@ export function stackPosition(root: string, branch: string): StackPosition | nul
   return null;
 }
 
-export type CheckFreshness = { name: string; result: string | null; fresh: boolean; at: string };
+export type CheckFreshness = {
+  name: string;
+  result: string | null;
+  fresh: boolean;
+  at: string;
+};
 
 type VerdictSummary = Omit<VerdictEntry, "verdict"> & { summary: string };
 
@@ -2453,7 +2528,11 @@ const dirtyState = (cwd: string): HandoffBrief["dirty"] => {
     // Renames and copies carry the source path as the next entry.
     if (entry[0] === "R" || entry[0] === "C") index += 1;
   }
-  return { dirty: paths.length > 0, files: paths.length, paths: paths.slice(0, MAX_DIRTY_PATHS) };
+  return {
+    dirty: paths.length > 0,
+    files: paths.length,
+    paths: paths.slice(0, MAX_DIRTY_PATHS),
+  };
 };
 
 const nextCommandFor = (brief: Omit<HandoffBrief, "nextCommand" | "next">): string => {
@@ -2521,7 +2600,11 @@ export function buildHandoff(
   }));
   const lastHandoffRow = mine.findLast((row) => row.type === "handoff");
   const partial: Omit<HandoffBrief, "nextCommand" | "next"> = {
-    store: { root: store.value.root, shared: store.value.shared, ledger: ledger.path },
+    store: {
+      root: store.value.root,
+      shared: store.value.shared,
+      ledger: ledger.path,
+    },
     branch,
     head,
     subject: head ? git(cwd, ["log", "-1", "--format=%s", head]) : null,
@@ -2559,6 +2642,10 @@ export function buildHandoff(
   const nextCommand = nextCommandFor(partial);
   return {
     ok: true,
-    value: { ...partial, nextCommand, next: options.next?.trim() || nextCommand },
+    value: {
+      ...partial,
+      nextCommand,
+      next: options.next?.trim() || nextCommand,
+    },
   };
 }

package/src/stack.ts

@@ -160,7 +160,12 @@ export const stackDeps: {
 // ---------------------------------------------------------------------------
 // git plumbing
 
-type GitRun = { ok: boolean; stdout: string; stderr: string; timedOut: boolean };
+type GitRun = {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+};
 
 const gitRun = (cwd: string, args: string[], timeoutMs: number = GIT_TIMEOUTS.local): GitRun => {
   const run = spawnSync("git", args, {
@@ -245,7 +250,13 @@ const trackedDirt = (dir: string): boolean => {
 
 export type RestackOutcome =
   | { ok: true; head: string }
-  | { ok: false; conflict: boolean; timedOut?: boolean; worktree: string; error: string };
+  | {
+      ok: false;
+      conflict: boolean;
+      timedOut?: boolean;
+      worktree: string;
+      error: string;
+    };
 
 /** Where sync checks out branches nobody has checked out (never the user's checkout). */
 const scratchDir = (cwd: string): string | null => {
@@ -269,14 +280,26 @@ function gitRestack(
   let dir = owner;
   if (!dir) {
     const scratch = scratchDir(cwd);
-    if (!scratch) return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+    if (!scratch)
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: "no store root",
+      };
     fs.mkdirSync(scratch, { recursive: true });
     dir = path.join(
       scratch,
       `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes(4).toString("hex")}`,
     );
     const added = gitRun(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
-    if (!added.ok) return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+    if (!added.ok)
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: firstLine(added),
+      };
   }
   const run = gitRun(
     dir,
@@ -304,7 +327,12 @@ function gitRestack(
         error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`,
       };
     if (rebaseInProgress(dir))
-      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+      return {
+        ok: false,
+        conflict: true,
+        worktree: dir,
+        error: firstLine(run),
+      };
     if (!owner) gitRun(cwd, ["worktree", "remove", "--force", dir]);
     return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
   }
@@ -312,7 +340,12 @@ function gitRestack(
   const head = branchTip(cwd, input.branch);
   return head
     ? { ok: true, head }
-    : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+    : {
+        ok: false,
+        conflict: false,
+        worktree: dir,
+        error: `${input.branch} vanished`,
+      };
 }
 
 /** Remove temporary sync worktrees that are clean and not mid-rebase. */
@@ -489,7 +522,10 @@ export function listStacks(cwd: string): StackResult<StackFile[]> {
     // Only files at the name's own path count (a renamed copy is ignored).
     if (parsed && fileFor(parsed.name) === name) out.push(parsed);
   }
-  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+  return {
+    ok: true,
+    data: out.toSorted((a, b) => a.name.localeCompare(b.name)),
+  };
 }
 
 /** The stack `name`, else the one holding the current branch, else the only one. */
@@ -539,7 +575,12 @@ const OWNERLESS_STALE_MS = 30_000;
 
 const OWNER = "owner";
 
-type LockOwner = { pid: number; processStart: string | null; host: string; nonce: string };
+type LockOwner = {
+  pid: number;
+  processStart: string | null;
+  host: string;
+  nonce: string;
+};
 
 const readOwner = (lock: string): { raw: string | null; age: number | null } => {
   let raw: string | null = null;
@@ -1039,7 +1080,13 @@ export type BranchStatus = {
 
 export type Qualification =
   | { ok: true }
-  | { ok: false; reason: StopReason; detail: string; unblock: string; ready: boolean };
+  | {
+      ok: false;
+      reason: StopReason;
+      detail: string;
+      unblock: string;
+      ready: boolean;
+    };
 
 export type StatusOutcome = {
   name: string;
@@ -1063,7 +1110,10 @@ const noun = (resolved: ResolvedForge, pr: number): string =>
 function statusDoc(ctx: Ctx, pr: number): ForgeResult<PrStatusDoc> {
   const status = ctx.resolved.forge.prStatus(pr);
   if (!status.ok) return status;
-  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, { logLines: 0, behind: false });
+  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, {
+    logLines: 0,
+    behind: false,
+  });
 }
 
 /**
@@ -1094,7 +1144,10 @@ export function repoMismatch(ctx: Pick<Ctx, "resolved">, stack: StackFile): Stac
       "blocked",
       `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`,
       `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`,
-      { planned: { forge: stack.forge, repo: stack.repo }, resolved: { forge: kind, repo } },
+      {
+        planned: { forge: stack.forge, repo: stack.repo },
+        resolved: { forge: kind, repo },
+      },
     );
   return null;
 }
@@ -1332,7 +1385,12 @@ export type SyncStep = {
   pr: number | null;
   parent: string;
   /** null: already on its parent. */
-  restack: { from: string; onto: string; head: string | null; carried: boolean | null } | null;
+  restack: {
+    from: string;
+    onto: string;
+    head: string | null;
+    carried: boolean | null;
+  } | null;
   push: { pushed: boolean; forced: boolean; sha: string } | null;
   retarget: { from: string; to: string } | null;
 };
@@ -1383,7 +1441,11 @@ function detectMerged(
         isAncestor(cwd, tip, trunkSha);
     }
     if (merged) {
-      entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
+      entry.merged = {
+        pr: entry.pr,
+        mergeSha: null,
+        at: new Date().toISOString(),
+      };
       newly.push({ branch: entry.branch, pr: entry.pr });
     }
   }
@@ -1407,21 +1469,34 @@ function pushBranch(
   const remote = remoteRefTip(cwd, plan.data.rawUrl, `refs/heads/${branch}`);
   if (!remote.ok) return stackFail(remote.code, remote.error);
   if (remote.sha === plan.data.sha)
-    return { ok: true, data: { pushed: false, forced: false, sha: plan.data.sha } };
+    return {
+      ok: true,
+      data: { pushed: false, forced: false, sha: plan.data.sha },
+    };
   const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
-    return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
+    return stackFail("blocked", grant.error, grant.unblock, {
+      reason: grant.reason,
+    });
   const force = remote.sha !== null && !isAncestor(cwd, remote.sha, plan.data.sha);
   const expect = !force
     ? null
     : remote.sha === priorTip
       ? priorTip
       : (recordedRemoteTip(cwd, plan.data) ?? null);
-  const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
+  const pushed = executePush(cwd, plan.data, {
+    forceWithLease: force,
+    expect,
+    actor,
+  });
   if (!pushed.ok) return { ...fromForge(pushed), data: { branch } };
   return {
     ok: true,
-    data: { pushed: pushed.data.pushed, forced: pushed.data.forced, sha: plan.data.sha },
+    data: {
+      pushed: pushed.data.pushed,
+      forced: pushed.data.forced,
+      sha: plan.data.sha,
+    },
   };
 }
 
@@ -1584,7 +1659,11 @@ export function syncStack(
                 "blocked",
                 `conflict restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`,
                 `resolve the conflicts in ${rebased.worktree}, git rebase --continue, then workit stack sync  # or git rebase --abort`,
-                { conflict: entry.branch, worktree: rebased.worktree, progress: outcome },
+                {
+                  conflict: entry.branch,
+                  worktree: rebased.worktree,
+                  progress: outcome,
+                },
               )
             : stackFail(
                 "failed",
@@ -1670,13 +1749,21 @@ export function syncStack(
           p: patchId(cwd, fromBase, fromHead),
           d: diffHash(cwd, fromBase, fromHead),
         };
-        const after = { p: patchId(cwd, parentTip, newTip), d: diffHash(cwd, parentTip, newTip) };
+        const after = {
+          p: patchId(cwd, parentTip, newTip),
+          d: diffHash(cwd, parentTip, newTip),
+        };
         const equal =
           before.d !== null &&
           before.d === after.d &&
           before.p !== null &&
           before.p === after.p &&
-          sameOwnChange(cwd, { from: fromHead, to: newTip, fromBase, toBase: parentTip });
+          sameOwnChange(cwd, {
+            from: fromHead,
+            to: newTip,
+            fromBase,
+            toBase: parentTip,
+          });
         appendObserved(cwd, {
           type: "stack.restacked",
           actor,
@@ -1692,7 +1779,13 @@ export function syncStack(
           forced,
         });
         if (step.restack) step.restack.carried = equal;
-        else step.restack = { from: fromBase, onto: parentTip, head: newTip, carried: equal };
+        else
+          step.restack = {
+            from: fromBase,
+            onto: parentTip,
+            head: newTip,
+            carried: equal,
+          };
       }
       if (options.publish) {
         touchStackLock();
@@ -1721,7 +1814,10 @@ export function syncStack(
             });
           const updated = ctx.resolved.forge.updateBase(entry.pr, parent.name);
           if (!updated.ok)
-            return { ...fromForge(updated), data: { branch: entry.branch, progress: outcome } };
+            return {
+              ...fromForge(updated),
+              data: { branch: entry.branch, progress: outcome },
+            };
           appendObserved(cwd, {
             type: "pr.retargeted",
             actor,
@@ -1766,6 +1862,8 @@ export type LandOptions = {
   method: MergeMethod;
   /** Land without verdicts (`merge: true` only); each bypass is recorded. */
   unverified?: { reason: string } | null;
+  /** Merge onto a red base (`--base-red-ok`); each merge records the reason. */
+  baseRedOk?: { reason: string } | null;
   /** How long to wait for CI on a PR that was just restacked. */
   timeoutMs: number;
   intervalMs: number;
@@ -1775,7 +1873,12 @@ export type LandOutcome = {
   name: string;
   dryRun: boolean;
   /** `unverified`: the ledger row of an `--unverified` bypass, else null. */
-  landed: Array<{ pr: number; branch: string; mergeSha: string | null; unverified: string | null }>;
+  landed: Array<{
+    pr: number;
+    branch: string;
+    mergeSha: string | null;
+    unverified: string | null;
+  }>;
   /** Dry run: the PRs that qualify now, in order (later ones assume a clean restack). */
   wouldLand: Array<{ pr: number; branch: string }>;
   stoppedAt: {
@@ -1849,7 +1952,9 @@ export async function landStack(
     const grant = requireGrant(ctx.cwd, "merge");
     if (!grant.allowed)
       return failWith(
-        stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }),
+        stackFail("blocked", grant.error, grant.unblock, {
+          reason: "grant_required",
+        }),
       );
     if (!grant.allowUnverified)
       return failWith(
@@ -1959,6 +2064,7 @@ export async function landStack(
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
         ...(bypass && !verdict.satisfied ? { unverified: bypass } : {}),
+        ...(options.baseRedOk ? { baseRedOk: options.baseRedOk } : {}),
       },
       ctx.sleep,
     );
@@ -1982,7 +2088,11 @@ export async function landStack(
       mergeSha: merged.data.mergeSha,
       unverified: merged.data.unverified?.recorded ?? null,
     });
-    entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
+    entry.merged = {
+      pr,
+      mergeSha: merged.data.mergeSha,
+      at: new Date().toISOString(),
+    };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok) return failWith(written);
     // Move the next PR onto the trunk: restack, lease push, retarget. The