@cleocode/core 2026.9.22 → 2026.9.24

package/dist/tasks/component-pr.js

@@ -15,23 +15,107 @@
  *  - its files are the ones its merge commit changed that still exist in the
  *    integration PR's merge commit — never the whole integration diff.
  *
+ * A component that did not merge into the integration branch as a PR — closed
+ * by hand after a `git merge --no-ff`, marked merged by GitHub, stacked on
+ * another component, main-merged afterwards, or rebased into the batch — is
+ * verified commit by commit instead (T12710): every commit of its own is in
+ * the integration merge by ancestry, or by `git patch-id` when rebased, and
+ * {@link findComponentLanding} follows it to that integration PR.
+ *
  * @task T12671
  * @task T12672
+ * @task T12710
  */
 import { execFileSync } from 'node:child_process';
-import { ghQueryTimeoutMs } from '../release/github-pr.js';
-function git(root, args) {
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ghQueryTimeoutMs, ghTimeoutReason, isGhTimeout } from '../release/github-pr.js';
+/** Output ceiling for ordinary git reads. */
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+/** Default deadline for one git subprocess. */
+const GIT_TIMEOUT_MS = 30_000;
+/** Default ceiling on the patch a candidate's merge introduces (patch-id mapping). */
+const CANDIDATE_PATCH_MAX_BYTES = 32 * 1024 * 1024;
+/** Default total time spent checking body-hint candidates. */
+const CANDIDATE_BUDGET_MS = 60_000;
+function envInt(name, fallback) {
+    const raw = Number(process.env[name]);
+    return Number.isInteger(raw) && raw > 0 ? raw : fallback;
+}
+/**
+ * Deadline for one git subprocess in component verification
+ * (`CLEO_GIT_TIMEOUT_MS`, default 30 s). A read that outlives it is killed
+ * and the verification refuses with `E_EVIDENCE_TOOL_FAILED` (T12710 review).
+ *
+ * @returns Milliseconds.
+ * @task T12710
+ */
+export function gitTimeoutMs() {
+    return envInt('CLEO_GIT_TIMEOUT_MS', GIT_TIMEOUT_MS);
+}
+/**
+ * A git subprocess outlived {@link gitTimeoutMs} and was killed.
+ *
+ * @task T12710
+ */
+export class GitTimeoutError extends Error {
+    /** @param args - The git arguments that timed out. */
+    constructor(args) {
+        super(`git ${args.slice(0, 3).join(' ')} timed out after ${gitTimeoutMs()}ms (CLEO_GIT_TIMEOUT_MS); the repository or the range is too large to verify here.`);
+        this.name = 'GitTimeoutError';
+    }
+}
+/** git output exceeded its buffer ceiling. */
+class GitOutputTooLargeError extends Error {
+}
+/**
+ * Run one bounded git subprocess. SIGKILL at the deadline; lazy fetches of a
+ * partial clone are disabled (`GIT_NO_LAZY_FETCH`) so git spawns no network
+ * child that could outlive it, and no credential prompt can block.
+ *
+ * @throws GitTimeoutError at the deadline; GitOutputTooLargeError past
+ *   `maxBuffer`; the exec error for any other failure.
+ */
+function runGit(root, args, opts = {}) {
     try {
         return execFileSync('git', args, {
             cwd: root,
             encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
+            input: opts.input,
+            stdio: [opts.input === undefined ? 'ignore' : 'pipe', 'pipe', 'ignore'],
+            env: { ...(opts.env ?? process.env), GIT_NO_LAZY_FETCH: '1', GIT_TERMINAL_PROMPT: '0' },
+            maxBuffer: opts.maxBuffer ?? GIT_MAX_BUFFER,
+            timeout: gitTimeoutMs(),
+            killSignal: 'SIGKILL',
+        });
     }
-    catch {
+    catch (err) {
+        const code = err?.code;
+        if (code === 'ETIMEDOUT')
+            throw new GitTimeoutError(args);
+        if (code === 'ENOBUFS')
+            throw new GitOutputTooLargeError(`git ${args[0]} output too large`);
+        throw err;
+    }
+}
+/** A bounded git read, trimmed; null on failure. A timeout propagates. */
+function git(root, args) {
+    try {
+        return runGit(root, args).trim();
+    }
+    catch (err) {
+        if (err instanceof GitTimeoutError)
+            throw err;
         return null;
     }
 }
+/** Map a timeout to the refusal every entry point returns; rethrow anything else. */
+function timeoutRefusal(err) {
+    if (err instanceof GitTimeoutError)
+        return refuse('E_EVIDENCE_TOOL_FAILED', err.message);
+    throw err;
+}
 function hasCommit(root, sha) {
     return (typeof sha === 'string' &&
         sha !== '' &&
@@ -46,7 +130,7 @@ export const defaultViewComponentPr = async (prNumber, root) => {
             'view',
             String(prNumber),
             '--json',
-            'number,title,body,headRefName,baseRefName,state,mergeCommit',
+            'number,title,body,headRefName,baseRefName,state,mergeCommit,headRefOid,commits',
         ], {
             cwd: root,
             encoding: 'utf-8',
@@ -69,8 +153,22 @@ export const defaultViewComponentPr = async (prNumber, root) => {
         baseRefName: str(row.baseRefName),
         state: str(row.state),
         mergeCommitSha: typeof merge?.oid === 'string' ? merge.oid : null,
+        headRefOid: typeof row.headRefOid === 'string' ? row.headRefOid : null,
+        commits: commitOids(row.commits),
     };
 };
+/** `commits[].oid` of a `gh --json commits` row, oldest first. */
+function commitOids(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const c of raw) {
+        const oid = c?.oid;
+        if (typeof oid === 'string' && oid !== '')
+            out.push(oid);
+    }
+    return out;
+}
 /**
  * The component's change as it landed: first-parent name-status of its merge
  * (or squash) commit, keeping only the changes the landing merge commit still
@@ -91,6 +189,18 @@ export const defaultViewComponentPr = async (prNumber, root) => {
  * @task T12672
  */
 export function componentLandedChanges(root, componentMerge, landingMerge) {
+    try {
+        return landedChangesOfMerge(root, componentMerge, landingMerge);
+    }
+    catch (err) {
+        // A timed-out read credits nothing (fails closed).
+        if (err instanceof GitTimeoutError)
+            return { files: [], deleted: [] };
+        throw err;
+    }
+}
+/** {@link componentLandedChanges}, letting a git timeout propagate. */
+function landedChangesOfMerge(root, componentMerge, landingMerge) {
     const out = git(root, [
         'diff-tree',
         '--root',
@@ -102,28 +212,510 @@ export function componentLandedChanges(root, componentMerge, landingMerge) {
         '--first-parent',
         componentMerge,
     ]) ?? '';
+    return survivingChanges(root, out, `${componentMerge}^1`, componentMerge, landingMerge);
+}
+/**
+ * Keep the changes of a `from`..`tip` name-status listing that the landing
+ * commit still carries: a changed path whose landing blob equals `tip`'s, or
+ * whose `from`..`tip` hunks reverse-apply there and do not re-apply (T12689);
+ * a deletion whose path the landing commit lacks.
+ */
+function survivingChanges(root, nameStatus, from, tip, landingMerge) {
     const files = [];
     const deleted = [];
     const blob = (commit, path) => git(root, ['rev-parse', '--verify', '--quiet', `${commit}:${path}`]);
+    const stillApplies = hunkChecker(root, from, tip, landingMerge);
+    try {
+        for (const line of nameStatus.split('\n')) {
+            const [status, ...rest] = line.split('\t');
+            const path = rest.join('\t');
+            if (!status || !path)
+                continue;
+            if (status.startsWith('D')) {
+                if (blob(landingMerge, path) === null)
+                    deleted.push(path);
+                continue;
+            }
+            const own = blob(tip, path);
+            const landed = blob(landingMerge, path);
+            // Identical bytes, or (T12689) a file a later change also edited whose
+            // own hunks the landing version still carries.
+            if (own !== null && landed !== null && (own === landed || stillApplies(path)))
+                files.push(path);
+        }
+    }
+    finally {
+        stillApplies.dispose();
+    }
+    return { files: [...new Set(files)], deleted: [...new Set(deleted)] };
+}
+/**
+ * Whether the component's hunks for one path are still present in the
+ * landing commit: its first-parent patch reverse-applies cleanly to the
+ * landing tree (checked in a throwaway index, never the working tree). A
+ * revert fails this; a later edit elsewhere in the file does not (T12689).
+ */
+function hunkChecker(root, from, tip, landingMerge) {
+    let dir = null;
+    let env = null;
+    let failed = false;
+    const ready = () => {
+        if (env || failed)
+            return env;
+        dir = mkdtempSync(join(tmpdir(), 'cleo-component-index-'));
+        const candidate = { ...process.env, GIT_INDEX_FILE: join(dir, 'index') };
+        try {
+            runGit(root, ['read-tree', landingMerge], { env: candidate });
+            env = candidate;
+        }
+        catch (err) {
+            // No index, no credit — and no retry leaving another temp dir behind.
+            failed = true;
+            rmSync(dir, { recursive: true, force: true });
+            dir = null;
+            if (err instanceof GitTimeoutError)
+                throw err;
+        }
+        return env;
+    };
+    const applies = (patch, indexEnv, reverse) => {
+        try {
+            runGit(root, ['apply', '--cached', '--check', ...(reverse ? ['-R'] : [])], {
+                env: indexEnv,
+                input: `${patch}\n`,
+            });
+            return true;
+        }
+        catch (err) {
+            if (err instanceof GitTimeoutError)
+                throw err;
+            return false;
+        }
+    };
+    const check = (path) => {
+        const patch = git(root, [
+            'diff',
+            '--binary',
+            '--no-renames',
+            '--no-color',
+            from,
+            tip,
+            '--',
+            path,
+        ]);
+        const indexEnv = patch ? ready() : null;
+        if (!patch || !indexEnv)
+            return false;
+        // `git apply` finds a hunk at ANY offset (T12689 review MED): the reverse
+        // patch can match an identical block elsewhere while the component's own
+        // lines were reverted. So the change must also NOT be re-applicable — a
+        // reverted change is, at its original spot. When both could match the
+        // file is not credited (fails closed).
+        return applies(patch, indexEnv, true) && !applies(patch, indexEnv, false);
+    };
+    return Object.assign(check, {
+        dispose: () => {
+            if (dir)
+                rmSync(dir, { recursive: true, force: true });
+        },
+    });
+}
+function refuse(codeName, reason) {
+    return { ok: false, codeName, reason };
+}
+function isAncestor(root, ancestor, descendant) {
+    return git(root, ['merge-base', '--is-ancestor', ancestor, descendant]) !== null;
+}
+/** Parent count of a commit (0 for a root commit); -1 when unreadable. */
+function parentCount(root, sha) {
+    const line = git(root, ['rev-list', '--parents', '-n', '1', sha]);
+    return line === null ? -1 : line.split(' ').length - 1;
+}
+/** The PR's commits (oldest first), else its head; empty when neither is known. */
+function componentCommits(c) {
+    if (c.commits && c.commits.length > 0)
+        return c.commits;
+    return c.headRefOid ? [c.headRefOid] : [];
+}
+/**
+ * `git patch-id --stable` of every non-merge commit `git log -p <args>`
+ * prints, keyed by patch id. A patch id survives a rebase that does not
+ * change the diff, which is how a rebased batch is mapped back (T12710).
+ */
+function patchIds(root, logArgs) {
+    const ids = new Map();
+    let patch = '';
+    let out = '';
+    try {
+        // Capped (T12710 review): a candidate whose merge introduces a patch
+        // larger than the ceiling throws GitOutputTooLargeError and is skipped.
+        patch = runGit(root, ['log', '-p', '--no-color', '--no-merges', ...logArgs], {
+            maxBuffer: envInt('CLEO_COMPONENT_PATCH_MAX_BYTES', CANDIDATE_PATCH_MAX_BYTES),
+        });
+        if (!patch.trim())
+            return ids;
+        out = runGit(root, ['patch-id', '--stable'], { input: patch });
+    }
+    catch (err) {
+        if (err instanceof GitTimeoutError || err instanceof GitOutputTooLargeError)
+            throw err;
+        return ids;
+    }
     for (const line of out.split('\n')) {
-        const [status, ...rest] = line.split('\t');
-        const path = rest.join('\t');
-        if (!status || !path)
+        const [id, commit] = line.trim().split(/\s+/);
+        if (id && commit && !ids.has(id))
+            ids.set(id, commit);
+    }
+    return ids;
+}
+/** Paths a commit changed against its first parent. */
+function commitPaths(root, sha) {
+    const out = git(root, [
+        'diff-tree',
+        '--root',
+        '--no-commit-id',
+        '-r',
+        '--name-only',
+        '--no-renames',
+        '-m',
+        '--first-parent',
+        sha,
+    ]);
+    return out ? out.split('\n').filter(Boolean) : [];
+}
+/**
+ * Verify, commit by commit, that a landing merge carries a component PR's
+ * change, whatever happened to the PR itself (T12710): closed by hand, marked
+ * merged by GitHub, stacked on another component, main merged into its head
+ * afterwards, or rebased into the batch.
+ *
+ * - Every non-merge commit of the PR is an ancestor of the landing merge, or
+ *   — when the batch was rebased — has the same `git patch-id` as a commit
+ *   the landing merge introduced (`<merge>^1..<merge>`). Git is the proof;
+ *   no PR body is consulted.
+ * - At least one of them is new in the landing merge (not already on its
+ *   first parent), so the landing PR is the one that landed it.
+ * - The credited files are only the paths the PR's own commits changed, and
+ *   only where the landing merge still carries the change (blob identical,
+ *   or the component's hunks reverse-apply and do not re-apply — T12689).
+ *
+ * @param root - Git checkout holding every commit.
+ * @param c - The component PR, with its commit list.
+ * @param landing - The integration PR number and its merge commit.
+ * @returns The component's tip and surviving changes, or the refusal.
+ * @task T12710
+ */
+export function componentCommitsLanded(root, c, landing) {
+    try {
+        return proveCommitsLanded(root, c, landing);
+    }
+    catch (err) {
+        if (err instanceof GitOutputTooLargeError) {
+            return refuse('E_EVIDENCE_INSUFFICIENT', `PR #${landing.prNumber} skipped: the patch its merge introduces exceeds ${envInt('CLEO_COMPONENT_PATCH_MAX_BYTES', CANDIDATE_PATCH_MAX_BYTES)} bytes (CLEO_COMPONENT_PATCH_MAX_BYTES), too large to map by patch-id.`);
+        }
+        return timeoutRefusal(err);
+    }
+}
+/** {@link componentCommitsLanded}, letting timeouts and oversize patches propagate. */
+function proveCommitsLanded(root, c, landing) {
+    const n = c.number;
+    const i = landing.prNumber;
+    const m = landing.mergeCommitSha;
+    const commits = componentCommits(c);
+    if (commits.length === 0) {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `gh reports no commits for component PR #${n}.`);
+    }
+    const missing = commits.find((sha) => !hasCommit(root, sha));
+    if (missing || !hasCommit(root, m)) {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `${missing ? `Component PR #${n}'s commit ${missing.slice(0, 12)}` : `PR #${i}'s merge commit ${m.slice(0, 12)}`} is not available locally in ${root} (git fetch origin pull/${n}/head).`);
+    }
+    const firstParent = git(root, ['rev-parse', '--verify', '--quiet', `${m}^1`]);
+    if (!firstParent) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `PR #${i}'s merge commit has no parent.`);
+    }
+    const own = commits.filter((sha) => {
+        const parents = parentCount(root, sha);
+        return parents === 0 || parents === 1;
+    });
+    if (own.length === 0) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `Component PR #${n} has no commits of its own, only merges.`);
+    }
+    let introduced = null;
+    let landedNow = false;
+    for (const sha of own) {
+        if (isAncestor(root, sha, m)) {
+            if (!isAncestor(root, sha, firstParent))
+                landedNow = true;
             continue;
-        if (status.startsWith('D')) {
-            if (blob(landingMerge, path) === null)
-                deleted.push(path);
+        }
+        introduced ??= patchIds(root, [`${firstParent}..${m}`]);
+        const [id] = patchIds(root, ['--no-walk', sha]).keys();
+        if (id !== undefined && introduced.has(id)) {
+            landedNow = true;
             continue;
         }
-        const own = blob(componentMerge, path);
-        if (own !== null && own === blob(landingMerge, path))
-            files.push(path);
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `Commit ${sha.slice(0, 12)} of component PR #${n} is not in PR #${i}'s merge ${m.slice(0, 12)}, by ancestry or by patch-id.`);
     }
-    return { files: [...new Set(files)], deleted: [...new Set(deleted)] };
+    if (!landedNow) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `Component PR #${n}'s commits were already on the default branch before PR #${i}; PR #${i} did not land them.`);
+    }
+    const tip = [...commits].reverse().find((sha) => isAncestor(root, sha, m)) ?? own.at(-1);
+    const from = tip ? git(root, ['merge-base', tip, firstParent]) : null;
+    if (!tip || !from) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `Component PR #${n} shares no history with PR #${i}'s base.`);
+    }
+    // Only the paths the PR's own commits changed: a stacked component's diff
+    // from the fork point also holds the component below it.
+    const paths = [...new Set(own.flatMap((sha) => commitPaths(root, sha)))];
+    const nameStatus = paths.length === 0
+        ? ''
+        : (git(root, ['diff', '--name-status', '--no-renames', from, tip, '--', ...paths]) ?? '');
+    return { ok: true, tip, ...survivingChanges(root, nameStatus, from, tip, m) };
+}
+/**
+ * The first commit on `ref`'s first-parent chain that contains `sha`: the
+ * commit that landed it on the default branch. `sha` itself when it is on
+ * that chain; null when `ref` does not contain it.
+ *
+ * @param root - Git checkout.
+ * @param sha - A commit.
+ * @param ref - The default branch ref, e.g. `origin/main`.
+ * @returns The landing commit, or null.
+ * @task T12710
+ */
+export function landingCommitOn(root, sha, ref) {
+    try {
+        return landingCommit(root, sha, ref);
+    }
+    catch (err) {
+        if (err instanceof GitTimeoutError)
+            return null;
+        throw err;
+    }
+}
+/** {@link landingCommitOn}, letting a git timeout propagate. */
+function landingCommit(root, sha, ref) {
+    if (!isAncestor(root, sha, ref))
+        return null;
+    const chain = git(root, ['rev-list', '--first-parent', `${sha}..${ref}`]);
+    if (!chain)
+        return sha;
+    const descendants = new Set((git(root, ['rev-list', '--ancestry-path', `${sha}..${ref}`]) ?? '').split('\n'));
+    const oldest = chain
+        .split('\n')
+        .reverse()
+        .find((c) => descendants.has(c));
+    if (!oldest)
+        return null;
+    return git(root, ['rev-parse', `${oldest}^1`]) === sha ? sha : oldest;
+}
+const LANDING_FIELDS = 'number,headRefName,baseRefName,state,headRefOid,mergeCommit,body';
+/** `gh pr list --state merged --search <q>`, bounded by the evidence gh deadline. */
+function searchMergedPrs(search, root) {
+    let parsed;
+    try {
+        parsed = JSON.parse(execFileSync('gh', [
+            'pr',
+            'list',
+            '--state',
+            'merged',
+            '--search',
+            search,
+            '--json',
+            LANDING_FIELDS,
+            '--limit',
+            '20',
+        ], {
+            cwd: root,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: ghQueryTimeoutMs(),
+        }));
+    }
+    catch (err) {
+        const what = `gh pr list --search '${search}'`;
+        return {
+            ok: false,
+            reason: isGhTimeout(err)
+                ? ghTimeoutReason(what)
+                : `${what} failed (offline, or gh not authenticated): ${err instanceof Error ? err.message.slice(0, 200) : String(err)}`,
+        };
+    }
+    if (!Array.isArray(parsed))
+        return { ok: true, prs: [] };
+    const str = (v) => (typeof v === 'string' ? v : '');
+    const prs = [];
+    for (const raw of parsed) {
+        if (raw === null || typeof raw !== 'object')
+            continue;
+        const row = raw;
+        if (typeof row.number !== 'number')
+            continue;
+        const merge = row.mergeCommit;
+        prs.push({
+            number: row.number,
+            headRefName: str(row.headRefName),
+            baseRefName: str(row.baseRefName),
+            state: str(row.state),
+            headRefOid: typeof row.headRefOid === 'string' ? row.headRefOid : null,
+            mergeCommitSha: typeof merge?.oid === 'string' ? merge.oid : null,
+            body: str(row.body),
+        });
+    }
+    return { ok: true, prs };
+}
+/** Default {@link ComponentLandingDeps}: bounded `gh pr list` searches. */
+export const defaultComponentLandingDeps = {
+    prsByMergeCommit: async (sha, root) => searchMergedPrs(sha, root),
+    prsListingComponent: async (n, root) => searchMergedPrs(`${n} in:body`, root),
+};
+/** Whether a PR body lists `#<n>` (never `#<n>0`). */
+function listsPr(body, n) {
+    return new RegExp(`#${n}(?![0-9])`).test(body);
+}
+/**
+ * Follow a component PR to the PR that landed it on the default branch
+ * (T12671, T12710). Resolution, git first:
+ *
+ * 1. Ancestry: the newest PR commit the default branch contains is landed by
+ *    the first commit on the default branch's first-parent chain containing
+ *    it; the merged PR whose merge commit that is, is the landing PR. When
+ *    that commit is the component's own merge, it landed directly: `null`.
+ * 2. Rebased batch (no PR commit is on the default branch): merged PRs into
+ *    the default branch whose body lists `#<component>` are candidates — a
+ *    hint only — and each is accepted only through patch-id proof.
+ *
+ * Either way {@link componentCommitsLanded} is the proof: every commit of the
+ * component is in the landing merge, and only its surviving files are
+ * credited. A `gh` failure (offline, timeout) is a refusal, never a hang.
+ *
+ * @param root - Git checkout with the default branch fetched.
+ * @param c - The component PR (with its commits).
+ * @param defaultRef - The default branch ref, e.g. `origin/main`.
+ * @param deps - `gh` lookups (tests inject).
+ * @returns The landing PR and surviving changes, a refusal, or `null` when the
+ *   PR landed directly (its own merge is on the default branch).
+ * @task T12710
+ */
+export async function findComponentLanding(root, c, defaultRef, deps = {}) {
+    try {
+        return await locateLanding(root, c, defaultRef, deps);
+    }
+    catch (err) {
+        return timeoutRefusal(err);
+    }
+}
+/** {@link findComponentLanding}, letting a git timeout propagate. */
+async function locateLanding(root, c, defaultRef, deps) {
+    const n = c.number;
+    if (c.state === 'OPEN') {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `Component PR #${n} is open.`);
+    }
+    const commits = componentCommits(c);
+    if (commits.length === 0) {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `gh reports no commits for PR #${n}.`);
+    }
+    const missing = commits.find((sha) => !hasCommit(root, sha));
+    if (missing) {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `PR #${n}'s commit ${missing.slice(0, 12)} is not available locally in ${root} (git fetch origin pull/${n}/head).`);
+    }
+    const defaultBranch = defaultRef.replace(/^origin\//, '');
+    const lookups = { ...defaultComponentLandingDeps, ...deps };
+    const onDefault = [...commits].reverse().find((sha) => isAncestor(root, sha, defaultRef));
+    let candidates;
+    if (onDefault) {
+        const m = landingCommit(root, onDefault, defaultRef);
+        if (m === null || m === c.mergeCommitSha)
+            return null;
+        const found = await lookups.prsByMergeCommit(m, root);
+        if (!found.ok)
+            return refuse('E_EVIDENCE_TOOL_FAILED', found.reason);
+        const merged = found.prs.filter((p) => p.state === 'MERGED' && p.mergeCommitSha === m && p.baseRefName === defaultBranch);
+        if (merged.some((p) => p.number === n))
+            return null;
+        candidates = merged;
+        if (candidates.length === 0) {
+            return refuse('E_EVIDENCE_INSUFFICIENT', `No merged PR into ${defaultBranch} has ${m.slice(0, 12)}, the commit that landed PR #${n}'s commits, as its merge commit.`);
+        }
+    }
+    else {
+        const found = await lookups.prsListingComponent(n, root);
+        if (!found.ok)
+            return refuse('E_EVIDENCE_TOOL_FAILED', found.reason);
+        candidates = found.prs
+            .filter((p) => p.number !== n &&
+            p.state === 'MERGED' &&
+            p.baseRefName === defaultBranch &&
+            listsPr(p.body, n) &&
+            hasCommit(root, p.mergeCommitSha) &&
+            isAncestor(root, p.mergeCommitSha, defaultRef))
+            .sort((a, b) => b.number - a.number);
+        if (candidates.length === 0) {
+            return refuse('E_EVIDENCE_INSUFFICIENT', `PR #${n}'s commits are not on ${defaultBranch}, and no merged PR into ${defaultBranch} lists #${n}.`);
+        }
+    }
+    const reasons = [];
+    const budgetMs = envInt('CLEO_COMPONENT_SEARCH_BUDGET_MS', CANDIDATE_BUDGET_MS);
+    const deadline = Date.now() + budgetMs;
+    let skipped = 0;
+    for (const candidate of candidates) {
+        if (Date.now() > deadline) {
+            // T12710 review: bounded total work over body-hint candidates.
+            skipped++;
+            reasons.push(`PR #${candidate.number} skipped: the ${budgetMs}ms candidate budget (CLEO_COMPONENT_SEARCH_BUDGET_MS) is spent.`);
+            continue;
+        }
+        const mergeCommitSha = candidate.mergeCommitSha;
+        const r = componentCommitsLanded(root, c, { prNumber: candidate.number, mergeCommitSha });
+        if (!r.ok && r.codeName === 'E_EVIDENCE_TOOL_FAILED')
+            return r;
+        if (!r.ok && r.reason.includes(' skipped: '))
+            skipped++;
+        if (r.ok && (r.files.length > 0 || r.deleted.length > 0)) {
+            return {
+                ok: true,
+                landing: { ...candidate, mergeCommitSha },
+                files: r.files,
+                deleted: r.deleted,
+            };
+        }
+        reasons.push(r.ok
+            ? `None of component PR #${n}'s changes survive in PR #${candidate.number}'s merge commit.`
+            : r.reason);
+    }
+    return refuse(skipped === candidates.length ? 'E_EVIDENCE_INSUFFICIENT' : 'E_EVIDENCE_CONTENT_MISMATCH', reasons.join(' '));
+}
+/**
+ * The original T12671 proof: the component PR merged into the integration
+ * PR's head branch, and that head contains its merge commit. Null when it
+ * holds; the refusal otherwise.
+ */
+function mergedIntoIntegration(c, landing, root) {
+    const n = c.number;
+    if (c.state !== 'MERGED') {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `Component PR #${n} is ${c.state.toLowerCase() || 'not merged'}.`);
+    }
+    if (c.baseRefName !== landing.headRefName) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `Component PR #${n} merged into ${c.baseRefName || 'an unknown branch'}, not ${landing.headRefName}, the head of PR #${landing.prNumber}.`);
+    }
+    if (!hasCommit(root, c.mergeCommitSha) || !hasCommit(root, landing.headRefOid)) {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `PR #${n}'s merge commit or PR #${landing.prNumber}'s head is not available locally in ${root} (git fetch origin).`);
+    }
+    if (!isAncestor(root, c.mergeCommitSha, landing.headRefOid)) {
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `PR #${landing.prNumber}'s head does not contain component PR #${n}'s merge ${c.mergeCommitSha.slice(0, 12)}.`);
+    }
+    return null;
 }
 /**
  * Verify that `componentPrNumber` is a component the integration PR landed,
- * and derive its landed files.
+ * and derive its landed files. Two proofs, first match wins:
+ *
+ * - the component PR merged into the integration PR's head branch, whose
+ *   head contains its merge commit (T12671);
+ * - otherwise every commit of its own is in the integration merge, by
+ *   ancestry or patch-id ({@link componentCommitsLanded}, T12710) — a
+ *   component closed by hand, marked merged by GitHub, stacked, main-merged
+ *   afterwards, or rebased into the batch.
  *
  * @param componentPrNumber - The task's own (component) PR.
  * @param landing - The integration PR that reached the default branch.
@@ -131,51 +723,45 @@ export function componentLandedChanges(root, componentMerge, landingMerge) {
  * @param view - PR reader (tests inject).
  * @returns The component's linkage fields and files, or the refusal.
  * @task T12671
+ * @task T12710
  */
 export async function resolveComponentPr(componentPrNumber, landing, root, view = defaultViewComponentPr) {
     const c = await view(componentPrNumber, root);
     if (!c) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_TOOL_FAILED',
-            reason: `gh pr view ${componentPrNumber} failed; component PR #${componentPrNumber} cannot be verified.`,
-        };
+        return refuse('E_EVIDENCE_TOOL_FAILED', `gh pr view ${componentPrNumber} failed; component PR #${componentPrNumber} cannot be verified.`);
     }
-    if (c.state !== 'MERGED') {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_INSUFFICIENT',
-            reason: `Component PR #${componentPrNumber} is ${c.state.toLowerCase() || 'not merged'}.`,
-        };
+    if (c.state === 'OPEN') {
+        return refuse('E_EVIDENCE_INSUFFICIENT', `Component PR #${componentPrNumber} is open.`);
     }
-    if (c.baseRefName !== landing.headRefName) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `Component PR #${componentPrNumber} merged into ${c.baseRefName || 'an unknown branch'}, not ${landing.headRefName}, the head of PR #${landing.prNumber}.`,
-        };
-    }
-    if (!hasCommit(root, c.mergeCommitSha) || !hasCommit(root, landing.headRefOid)) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_INSUFFICIENT',
-            reason: `PR #${componentPrNumber}'s merge commit or PR #${landing.prNumber}'s head is not available locally in ${root} (git fetch origin).`,
-        };
+    let changes;
+    try {
+        // The change set's follow proves with componentCommitsLanded, so the
+        // validator tries the SAME prover first (T12710 review): the two can
+        // only disagree when commit data is missing, or for a squash-landed
+        // integration PR, where the merge-into-integration proof remains.
+        const viaCommits = componentCommits(c).length > 0 ? componentCommitsLanded(root, c, landing) : null;
+        if (viaCommits?.ok) {
+            changes = viaCommits;
+        }
+        else if (viaCommits && viaCommits.codeName === 'E_EVIDENCE_TOOL_FAILED') {
+            return viaCommits;
+        }
+        else {
+            const viaMerge = mergedIntoIntegration(c, landing, root);
+            if (viaMerge !== null) {
+                return viaCommits
+                    ? refuse(viaCommits.codeName, `${viaMerge.reason} ${viaCommits.reason}`)
+                    : viaMerge;
+            }
+            changes = landedChangesOfMerge(root, c.mergeCommitSha, landing.mergeCommitSha);
+        }
     }
-    if (git(root, ['merge-base', '--is-ancestor', c.mergeCommitSha, landing.headRefOid]) === null) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `PR #${landing.prNumber}'s head does not contain component PR #${componentPrNumber}'s merge ${c.mergeCommitSha.slice(0, 12)}.`,
-        };
+    catch (err) {
+        return timeoutRefusal(err);
     }
-    const { files, deleted } = componentLandedChanges(root, c.mergeCommitSha, landing.mergeCommitSha);
+    const { files, deleted } = changes;
     if (files.length === 0 && deleted.length === 0) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `None of component PR #${componentPrNumber}'s changes survive in PR #${landing.prNumber}'s merge commit.`,
-        };
+        return refuse('E_EVIDENCE_CONTENT_MISMATCH', `None of component PR #${componentPrNumber}'s changes survive in PR #${landing.prNumber}'s merge commit.`);
     }
     return {
         ok: true,