@davidahmann/mill 0.1.4 → 0.2.1

package/dist/runtime/delivery.js

@@ -1,12 +1,14 @@
+import { assertEffectAllowsNewWork, assertNoUnresolvedEffect, reconcilableDraftEffect, maximumRemoteEffectAttempts, } from "./effect-boundary.js";
+import { parse as parseYaml } from "yaml";
 import { canonicalDigest } from "../contracts/canonical.js";
-import { deliveryRecordSchema, reviewResultSchema, validationEvidenceSchema, } from "../contracts/schemas.js";
+import { deliveryRecordSchema, millConfigSchema, reviewResultSchema, validationEvidenceSchema, } from "../contracts/schemas.js";
 import { ExitCode, MillError, asMillError } from "../errors.js";
 import { createGitHubAdapter, } from "./github.js";
 import { loadRuntimeInputs } from "./inputs.js";
 import { assertRunBindings } from "./lifecycle.js";
-import { commonGitDirectory, repositoryRemoteUrl } from "./repository.js";
+import { publicPullRequestTitle } from "./public-metadata.js";
+import { commonGitDirectory, captureReviewScope, readCommittedFile, repositoryRemoteUrl, } from "./repository.js";
 import { acquireWriterLease, publicRunRecord, StateStore, } from "./state.js";
-const maximumRemoteEffectAttempts = 2;
 function operationDeadline(config) {
     return Date.now() + config.pollTimeoutSeconds * 1000;
 }
@@ -69,35 +71,27 @@ function setRunBlocker(store, run, code, eventType, details = {}) {
         : store.transition(run.id, "blocked", eventType, { code, ...details });
 }
 function reconcileAbsentEffect(store, run, delivery, effectValue) {
-    if (cancellationRequested(store, run.id)) {
-        stopCancelledDelivery(store, run.id, delivery);
-    }
-    if (effectValue.attemptCount >= maximumRemoteEffectAttempts) {
-        const blocked = persistDelivery(store, run.id, {
-            ...upsertEffect(delivery, {
-                ...effectValue,
-                status: "blocked",
-                errorCode: "REMOTE_EFFECT_RETRY_EXHAUSTED",
-                updatedAt: new Date().toISOString(),
-            }),
-            state: "blocked",
-            lastErrorCode: "REMOTE_EFFECT_RETRY_EXHAUSTED",
-        }, "delivery.retry_exhausted", { effectId: effectValue.id });
-        const blockedRun = setRunBlocker(store, run, "REMOTE_EFFECT_RETRY_EXHAUSTED", "delivery.blocked");
-        return { run: publicRunRecord(blockedRun), delivery: blocked };
-    }
-    const retryable = persistDelivery(store, run.id, {
+    const exhausted = effectValue.attemptCount >= maximumRemoteEffectAttempts;
+    const errorCode = exhausted ? "REMOTE_EFFECT_RETRY_EXHAUSTED" : null;
+    return completeDraftReconciliation(store, run, {
         ...upsertEffect(delivery, {
             ...effectValue,
-            status: "retryable_absent",
-            errorCode: null,
+            status: exhausted ? "blocked" : "retryable_absent",
+            errorCode,
             updatedAt: new Date().toISOString(),
         }),
-        state: "proposing",
-        lastErrorCode: null,
-    }, "delivery.effect_absent", { effectId: effectValue.id, attemptCount: effectValue.attemptCount });
-    const retryableRun = store.transition(run.id, "proposing", "delivery.retry_authorized");
-    return { run: publicRunRecord(retryableRun), delivery: retryable };
+        state: exhausted ? "blocked" : "proposing",
+        lastErrorCode: errorCode,
+    });
+}
+function completeDraftReconciliation(store, run, delivery) {
+    if (run.deliveryJson === undefined)
+        throw new MillError("DELIVERY_PLAN_MISSING", "The journal disappeared during readback.", ExitCode.data);
+    const settled = store.settleDraftEffect(run.id, run.deliveryJson, JSON.stringify(deliveryRecordSchema.parse(delivery)));
+    const journal = storedDelivery(settled);
+    if (journal.state === "cancelled")
+        throw new MillError("OPERATOR_CANCELLED", "The effect was reconciled; cancellation prevents further mutation.", ExitCode.temporary);
+    return { run: publicRunRecord(settled), delivery: journal };
 }
 async function assertReviewedCandidate(root, run, inputs) {
     if (run.status !== "reviewed" && run.status !== "proposing") {
@@ -122,8 +116,31 @@ async function assertReviewedCandidate(root, run, inputs) {
         throw new MillError("LOCAL_EVIDENCE_STALE", "Validation and local review must pass on the exact candidate head.", ExitCode.configuration);
     }
     const candidate = await assertRunBindings(root, run, inputs);
+    const expectedScope = await captureReviewScope(candidate.worktree, review.scope?.baseCommit ??
+        (inputs.config.propose === undefined
+            ? run.baseCommit
+            : `refs/heads/${inputs.config.propose.baseBranch}`), candidate.commit);
+    if (review.scope?.digest !== expectedScope.digest) {
+        throw new MillError("REVIEW_SCOPE_STALE", "Delivery requires a fresh complete base-to-candidate review, including preparatory commits.", ExitCode.configuration);
+    }
     return { commit: candidate.commit, tree: candidate.tree };
 }
+async function assertProviderReviewScope(run, config, adapter, deadlineMs) {
+    const base = await adapter.readBranch({
+        config,
+        branch: config.baseBranch,
+        deadlineMs,
+    });
+    if (base === null ||
+        run.candidateCommit === undefined ||
+        run.worktreePath === undefined)
+        throw new MillError("REVIEW_BASE_UNAVAILABLE", "The authoritative PR base and local candidate must be available.", ExitCode.configuration);
+    const review = reviewResultSchema.parse(JSON.parse(run.reviewJson ?? "null"));
+    const scope = await captureReviewScope(run.worktreePath, base, run.candidateCommit);
+    if (review.scope?.digest !== scope.digest)
+        throw new MillError("REVIEW_SCOPE_STALE", "The reviewed diff differs from GitHub's actual PR base. Before any remote attempt, use attended review --refresh --base with the exact locally available provider commit, then plan delivery again. Do not change frozen refs.", ExitCode.configuration);
+    // Reading the provider SHA never fetches or changes local refs implicitly.
+}
 function expectedRemoteUrls(config, cloneUrl) {
     return new Set([
         cloneUrl,
@@ -164,6 +181,17 @@ function target(config, binding) {
         actorId: binding.actorId,
     };
 }
+function postMergeRequiredChecks(config) {
+    return config.postMergeRequiredChecks ?? config.requiredChecks;
+}
+function postMergePolicySource(config) {
+    return config.postMergeRequiredChecks === undefined
+        ? "implicit_default"
+        : "configured";
+}
+function isCheckSubset(candidate, required) {
+    return candidate.every((check) => required.includes(check));
+}
 function proposalDigest(input) {
     return canonicalDigest({
         schemaVersion: "1",
@@ -176,6 +204,10 @@ function proposalDigest(input) {
         branchName: input.branchName,
         approvalExpiresAt: input.approvalExpiresAt,
         requiredChecks: input.config.requiredChecks,
+        ...(input.config.checkProducers === undefined
+            ? {}
+            : { checkProducers: input.config.checkProducers }),
+        postMergeRequiredChecks: postMergeRequiredChecks(input.config),
         reviewPolicy: input.config.reviewPolicy,
         allowedMergeMethods: input.config.allowedMergeMethods,
         allowedMergerLogins: input.config.allowedMergerLogins,
@@ -240,10 +272,54 @@ function assertPushBoundaryPullRequest(pullRequest, delivery, expectedOldCommit)
         throw new MillError("PULL_REQUEST_IDENTITY_MISMATCH", "The recorded pull request is no longer the expected open draft at the observed branch head.", ExitCode.configuration);
     }
 }
-function assertDeliveryContinuity(input) {
+async function candidateUsedImplicitPostMergePolicy(root, delivery) {
+    let source;
+    try {
+        source = await readCommittedFile(root, delivery.candidateCommit, "mill.yaml");
+    }
+    catch (error) {
+        throw new MillError("LEGACY_POST_MERGE_POLICY_SOURCE_UNAVAILABLE", "The reviewed candidate's mill.yaml cannot be read to prove an implicit post-merge policy.", ExitCode.configuration, { cause: String(error) });
+    }
+    let raw;
+    try {
+        raw = parseYaml(source);
+    }
+    catch (error) {
+        throw new MillError("LEGACY_POST_MERGE_POLICY_SOURCE_INVALID", "The reviewed candidate's mill.yaml is not valid YAML.", ExitCode.configuration, { cause: String(error) });
+    }
+    const parsed = millConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new MillError("LEGACY_POST_MERGE_POLICY_SOURCE_INVALID", "The reviewed candidate's mill.yaml does not satisfy the Mill configuration contract.", ExitCode.configuration);
+    }
+    return parsed.data.propose?.postMergeRequiredChecks === undefined;
+}
+async function assertDeliveryContinuity(input) {
     const { run, inputs, config, delivery, binding } = input;
+    const configuredPostMergeChecks = postMergeRequiredChecks(config);
+    const configuredLegacyPolicy = input.allowLegacyPostMergePolicy === true &&
+        delivery.postMergePolicySource === undefined &&
+        delivery.postMergeRequiredChecks !== undefined &&
+        delivery.legacyPostMergePolicyConfigDigest === undefined &&
+        config.postMergeRequiredChecks !== undefined &&
+        isCheckSubset(config.postMergeRequiredChecks, delivery.requiredChecks) &&
+        JSON.stringify(delivery.postMergeRequiredChecks) ===
+            JSON.stringify(delivery.requiredChecks) &&
+        (await candidateUsedImplicitPostMergePolicy(input.root, delivery));
+    const bindLegacyPostMergePolicy = input.allowLegacyPostMergePolicy === true &&
+        (delivery.postMergeRequiredChecks === undefined ||
+            configuredLegacyPolicy) &&
+        delivery.legacyPostMergePolicyConfigDigest === undefined &&
+        config.postMergeRequiredChecks !== undefined &&
+        isCheckSubset(config.postMergeRequiredChecks, delivery.requiredChecks);
+    const hasBoundLegacyPostMergePolicy = input.allowLegacyPostMergePolicy === true &&
+        delivery.postMergeRequiredChecks !== undefined &&
+        delivery.postMergePolicySource === "legacy_migrated" &&
+        delivery.legacyPostMergePolicyConfigDigest === inputs.configDigest;
+    const configDigestMatches = bindLegacyPostMergePolicy ||
+        hasBoundLegacyPostMergePolicy ||
+        run.configDigest === inputs.configDigest;
     if (run.taskDigest !== inputs.taskDigest ||
-        run.configDigest !== inputs.configDigest ||
+        !configDigestMatches ||
         delivery.runId !== run.id ||
         delivery.candidateCommit !== run.candidateCommit ||
         delivery.candidateTree !== run.candidateTree ||
@@ -258,6 +334,15 @@ function assertDeliveryContinuity(input) {
         delivery.target.cloneUrl !== binding.cloneUrl ||
         JSON.stringify(delivery.requiredChecks) !==
             JSON.stringify(config.requiredChecks) ||
+        canonicalDigest(delivery.checkProducers ?? {}) !==
+            canonicalDigest(config.checkProducers ?? {}) ||
+        (delivery.postMergeRequiredChecks !== undefined &&
+            !bindLegacyPostMergePolicy &&
+            !hasBoundLegacyPostMergePolicy &&
+            JSON.stringify(delivery.postMergeRequiredChecks) !==
+                JSON.stringify(configuredPostMergeChecks)) ||
+        (delivery.legacyPostMergePolicyConfigDigest !== undefined &&
+            !hasBoundLegacyPostMergePolicy) ||
         JSON.stringify(delivery.reviewPolicy) !==
             JSON.stringify(config.reviewPolicy) ||
         JSON.stringify(delivery.allowedMergerLogins) !==
@@ -266,13 +351,21 @@ function assertDeliveryContinuity(input) {
             JSON.stringify(config.allowedMergeMethods)) {
         throw new MillError("DELIVERY_AUTHORITY_DRIFT", "The task, configuration, candidate, actor, or repository changed after delivery approval.", ExitCode.configuration);
     }
+    return { bindLegacyPostMergePolicy };
 }
-function checkDecision(required, checks) {
+export function checkDecision(required, checks, producers, phase = "pull_request", headSha) {
     const missing = [];
     const failed = [];
     let pending = false;
     for (const name of required) {
-        const matching = checks.filter((check) => check.name === name);
+        const producer = producers?.[name];
+        const matching = checks.filter((check) => check.name === name &&
+            (producers === undefined ||
+                (producer !== undefined &&
+                    check.appId === producer.appId &&
+                    check.workflowPath === producer.workflowPath &&
+                    check.event === phase &&
+                    check.headSha === headSha)));
         if (matching.length === 0) {
             missing.push(name);
             pending = true;
@@ -292,14 +385,14 @@ function checkDecision(required, checks) {
         failed,
     };
 }
-function actionableFeedback(observation, reviewPolicy, candidateCommit) {
+export function actionableFeedback(observation, reviewPolicy, candidateCommit) {
     if (reviewPolicy.mode !== "github_required")
         return [];
     return observation.feedback.filter((item) => item.commitId === candidateCommit &&
         reviewPolicy.requiredReviewerLogins.includes(item.actorLogin) &&
         item.priority !== "P3");
 }
-function reviewsPassed(observation, reviewPolicy, candidateCommit) {
+export function reviewsPassed(observation, reviewPolicy, candidateCommit) {
     if (reviewPolicy.mode === "local_only")
         return true;
     return reviewPolicy.requiredReviewerLogins.every((login) => {
@@ -353,6 +446,7 @@ export async function planDraftPr(input) {
     try {
         lease = await acquireWriterLease(store);
         const run = store.getRun(input.runId);
+        assertEffectAllowsNewWork(run);
         const candidate = await assertReviewedCandidate(input.root, run, inputs);
         const adapter = input.adapter ?? createGitHubAdapter(input.root);
         const binding = await adapter.inspect({
@@ -361,6 +455,7 @@ export async function planDraftPr(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         await assertBinding(input.root, config, binding);
+        await assertProviderReviewScope(run, config, adapter, operationDeadline(config));
         const plannedBranch = branchName(config, run);
         const approvalExpiresAt = new Date(Date.now() + config.approvalTtlSeconds * 1000).toISOString();
         const plannedTarget = target(config, binding);
@@ -393,6 +488,11 @@ export async function planDraftPr(input) {
             candidateCommit: candidate.commit,
             candidateTree: candidate.tree,
             requiredChecks: config.requiredChecks,
+            ...(config.checkProducers === undefined
+                ? {}
+                : { checkProducers: config.checkProducers }),
+            postMergeRequiredChecks: postMergeRequiredChecks(config),
+            postMergePolicySource: postMergePolicySource(config),
             reviewPolicy: config.reviewPolicy,
             allowedMergerLogins: config.allowedMergerLogins,
             allowedMergeMethods: config.allowedMergeMethods,
@@ -452,6 +552,7 @@ export async function openDraftPr(input) {
         if (run.status !== "proposing") {
             throw new MillError("DELIVERY_NOT_APPLICABLE", "Draft-PR open requires an approved plan with no unknown external effect.", ExitCode.configuration);
         }
+        assertEffectAllowsNewWork(run);
         const candidate = await assertReviewedCandidate(input.root, run, inputs);
         let delivery = storedDelivery(run);
         assertRemoteMutationNotCancelled(store, run.id, delivery);
@@ -469,6 +570,7 @@ export async function openDraftPr(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         await assertBinding(input.root, config, binding);
+        await assertProviderReviewScope(run, config, adapter, deadlineMs);
         const liveDigest = proposalDigest({
             run,
             candidate,
@@ -495,10 +597,6 @@ export async function openDraftPr(input) {
                 readback.branchSha !== delivery.remoteHeadCommit) {
                 throw new MillError("REMOTE_BRANCH_CONFLICT", "The Mill delivery branch moved outside the exact expected-head precondition.", ExitCode.configuration);
             }
-            if (push !== undefined &&
-                (push.status === "call_started" || push.status === "effect_unknown")) {
-                markUnknown(store, run, delivery, push, "GITHUB_PUSH_OUTCOME_UNKNOWN");
-            }
             if (push?.status === "verified") {
                 throw new MillError("REMOTE_BRANCH_CONFLICT", "A previously verified Mill branch no longer has its bound candidate head.", ExitCode.configuration);
             }
@@ -529,6 +627,7 @@ export async function openDraftPr(input) {
                 throw new MillError("REMOTE_BRANCH_CONFLICT", "The Mill delivery branch changed after push intent and before the mutation boundary.", ExitCode.configuration);
             }
             assertPushBoundaryPullRequest(readback.pullRequest, delivery, push.expectedOldCommit);
+            await assertProviderReviewScope(run, config, adapter, deadlineMs);
             push = {
                 ...push,
                 status: "call_started",
@@ -618,11 +717,6 @@ export async function openDraftPr(input) {
             throw new MillError("PULL_REQUEST_DISAPPEARED", "The recorded pull request cannot be found by immutable delivery identity.", ExitCode.configuration);
         }
         if (pullRequest === null) {
-            if (prEffect !== undefined &&
-                (prEffect.status === "call_started" ||
-                    prEffect.status === "effect_unknown")) {
-                markUnknown(store, run, delivery, prEffect, "GITHUB_PR_OUTCOME_UNKNOWN");
-            }
             if (prEffect?.status === "verified" || delivery.pullRequest !== null) {
                 throw new MillError("PULL_REQUEST_DISAPPEARED", "A previously verified pull request cannot be found by immutable delivery identity.", ExitCode.configuration);
             }
@@ -642,6 +736,7 @@ export async function openDraftPr(input) {
                 updatedAt: new Date().toISOString(),
             };
             delivery = persistDelivery(store, run.id, upsertEffect(delivery, prEffect), "delivery.pull_request_intent", { effectId: prEffect.id });
+            await assertProviderReviewScope(run, config, adapter, deadlineMs);
             prEffect = {
                 ...prEffect,
                 status: "call_started",
@@ -654,7 +749,7 @@ export async function openDraftPr(input) {
                 pullRequest = await adapter.createDraftPullRequest({
                     config,
                     branch: delivery.branchName,
-                    title: inputs.task.commit.message.slice(0, 240),
+                    title: publicPullRequestTitle(inputs.task.commit.message),
                     body: `${deliveryMarker(delivery.deliveryKey)}\n\nGenerated by Mill from an attended, locally validated and reviewed run. The current candidate identity is the pull-request head; configured human merge authority remains external.`,
                     deadlineMs,
                     ...(input.signal === undefined ? {} : { signal: input.signal }),
@@ -738,11 +833,9 @@ export async function reconcileDraftPr(input) {
     let lease;
     try {
         lease = await acquireWriterLease(store);
-        let run = store.getRun(input.runId);
-        if (run.status !== "effect_unknown") {
-            throw new MillError("RECONCILIATION_NOT_REQUIRED", "The run has no unknown GitHub effect to reconcile.", ExitCode.configuration);
-        }
-        let delivery = storedDelivery(run);
+        const run = store.getRun(input.runId);
+        const unknownEffect = reconcilableDraftEffect(run);
+        const delivery = storedDelivery(run);
         const adapter = input.adapter ?? createGitHubAdapter(input.root);
         const deadlineMs = operationDeadline(config);
         const binding = await adapter.inspect({
@@ -751,7 +844,14 @@ export async function reconcileDraftPr(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         await assertBinding(input.root, config, binding);
-        assertDeliveryContinuity({ run, inputs, config, delivery, binding });
+        await assertDeliveryContinuity({
+            root: input.root,
+            run,
+            inputs,
+            config,
+            delivery,
+            binding,
+        });
         const readback = await reconcileReadback({
             adapter,
             config,
@@ -759,14 +859,6 @@ export async function reconcileDraftPr(input) {
             deadlineMs,
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
-        const unknownEffects = delivery.effects.filter((item) => item.status === "effect_unknown");
-        if (unknownEffects.length !== 1) {
-            throw new MillError("GITHUB_RECONCILIATION_STATE_INVALID", "Exactly one external effect must be unknown before reconciliation.", ExitCode.data);
-        }
-        const unknownEffect = unknownEffects[0];
-        if (unknownEffect === undefined) {
-            throw new MillError("GITHUB_RECONCILIATION_STATE_INVALID", "The unknown external effect could not be identified.", ExitCode.data);
-        }
         if (unknownEffect.kind === "push" &&
             (readback.branchSha === unknownEffect.expectedOldCommit ||
                 readback.branchSha === delivery.candidateCommit)) {
@@ -787,7 +879,7 @@ export async function reconcileDraftPr(input) {
         if (unknownEffect.kind === "push" &&
             readback.branchSha === delivery.candidateCommit &&
             readback.pullRequest === null) {
-            delivery = persistDelivery(store, run.id, {
+            return completeDraftReconciliation(store, run, {
                 ...upsertEffect(delivery, {
                     ...unknownEffect,
                     status: "verified",
@@ -797,10 +889,7 @@ export async function reconcileDraftPr(input) {
                 state: "proposing",
                 remoteHeadCommit: readback.branchSha,
                 lastErrorCode: null,
-            }, "delivery.push_reconciled", { effectId: unknownEffect.id });
-            assertRemoteMutationNotCancelled(store, run.id, delivery);
-            run = store.transition(run.id, "proposing", "delivery.reconciled");
-            return { run: publicRunRecord(run), delivery };
+            });
         }
         if (readback.branchSha !== delivery.candidateCommit) {
             throw new MillError("REMOTE_BRANCH_CONFLICT", "Authoritative readback found a branch head outside the reconciled effect precondition.", ExitCode.configuration);
@@ -809,7 +898,7 @@ export async function reconcileDraftPr(input) {
             throw new MillError("GITHUB_RECONCILIATION_STATE_INVALID", "Reconciliation could not classify the pull-request effect.", ExitCode.data);
         }
         assertExactPullRequest(readback.pullRequest, delivery, true);
-        delivery = persistDelivery(store, run.id, {
+        return completeDraftReconciliation(store, run, {
             ...delivery,
             state: "awaiting_ci",
             remoteHeadCommit: readback.branchSha,
@@ -827,10 +916,7 @@ export async function reconcileDraftPr(input) {
                 }
                 : item),
             lastErrorCode: null,
-        }, "delivery.reconciled", { pullRequestNumber: readback.pullRequest.number });
-        assertRemoteMutationNotCancelled(store, run.id, delivery);
-        run = store.transition(run.id, "awaiting_ci", "delivery.awaiting_ci");
-        return { run: publicRunRecord(run), delivery };
+        });
     }
     finally {
         try {
@@ -868,10 +954,12 @@ export async function observeDraftPr(input) {
                 ["REMOTE_CHECKS_FAILED", "REMOTE_REVIEW_FINDINGS"].includes(run.blockCode ?? ""))) {
             throw new MillError("DELIVERY_NOT_OBSERVABLE", "Run has no draft pull request awaiting policy observation.", ExitCode.configuration);
         }
+        assertEffectAllowsNewWork(run);
         let delivery = storedDelivery(run);
         if (delivery.pullRequest === null) {
             throw new MillError("PULL_REQUEST_IDENTITY_MISSING", "Delivery has no verified pull request identity.", ExitCode.configuration);
         }
+        const pullRequest = delivery.pullRequest;
         const adapter = input.adapter ?? createGitHubAdapter(input.root);
         const deadlineMs = operationDeadline(config);
         const binding = await adapter.inspect({
@@ -880,15 +968,22 @@ export async function observeDraftPr(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         await assertBinding(input.root, config, binding);
-        assertDeliveryContinuity({ run, inputs, config, delivery, binding });
+        await assertDeliveryContinuity({
+            root: input.root,
+            run,
+            inputs,
+            config,
+            delivery,
+            binding,
+        });
         const observation = await adapter.observe({
             config,
-            pullRequestNumber: delivery.pullRequest.number,
+            pullRequestNumber: pullRequest.number,
             deadlineMs,
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         assertObservationIdentity(observation, delivery, false);
-        const checks = checkDecision(delivery.requiredChecks, observation.checks);
+        const checks = checkDecision(delivery.requiredChecks, observation.checks, delivery.checkProducers, "pull_request", delivery.candidateCommit);
         const feedback = actionableFeedback(observation, delivery.reviewPolicy, delivery.candidateCommit);
         const observationRecord = {
             headSha: observation.pullRequest.headSha,
@@ -974,10 +1069,12 @@ export async function finalizeDraftPr(input) {
             !(run.status === "blocked" && run.blockCode === "POST_MERGE_CHECKS_FAILED")) {
             throw new MillError("DELIVERY_NOT_FINALIZABLE", "Run is not awaiting human merge or post-merge verification.", ExitCode.configuration);
         }
+        assertNoUnresolvedEffect(run);
         let delivery = storedDelivery(run);
         if (delivery.pullRequest === null) {
             throw new MillError("PULL_REQUEST_IDENTITY_MISSING", "Delivery has no verified pull request identity.", ExitCode.configuration);
         }
+        const pullRequest = delivery.pullRequest;
         const adapter = input.adapter ?? createGitHubAdapter(input.root);
         const deadlineMs = operationDeadline(config);
         const binding = await adapter.inspect({
@@ -986,10 +1083,18 @@ export async function finalizeDraftPr(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
         await assertBinding(input.root, config, binding);
-        assertDeliveryContinuity({ run, inputs, config, delivery, binding });
+        const continuity = await assertDeliveryContinuity({
+            root: input.root,
+            run,
+            inputs,
+            config,
+            delivery,
+            binding,
+            allowLegacyPostMergePolicy: true,
+        });
         const observation = await adapter.observe({
             config,
-            pullRequestNumber: delivery.pullRequest.number,
+            pullRequestNumber: pullRequest.number,
             deadlineMs,
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
@@ -1021,6 +1126,14 @@ export async function finalizeDraftPr(input) {
         if (mergeCommit.tree !== delivery.candidateTree) {
             throw new MillError("MERGE_TREE_REVALIDATION_REQUIRED", "The merged tree differs from the reviewed candidate and requires a fresh exact-tree validation before closure.", ExitCode.configuration);
         }
+        if (continuity.bindLegacyPostMergePolicy) {
+            delivery = persistDelivery(store, run.id, {
+                ...delivery,
+                postMergeRequiredChecks: postMergeRequiredChecks(config),
+                postMergePolicySource: "legacy_migrated",
+                legacyPostMergePolicyConfigDigest: inputs.configDigest,
+            }, "delivery.legacy_post_merge_policy_bound", { checks: postMergeRequiredChecks(config).length });
+        }
         delivery = persistDelivery(store, run.id, {
             ...delivery,
             state: "merged",
@@ -1041,7 +1154,7 @@ export async function finalizeDraftPr(input) {
         if (run.status !== "merged" && run.status !== "post_merge_verified") {
             run = store.transition(run.id, "merged", "delivery.merged");
         }
-        const checks = checkDecision(delivery.requiredChecks, observation.mergeChecks);
+        const checks = checkDecision(delivery.postMergeRequiredChecks ?? delivery.requiredChecks, observation.mergeChecks, delivery.checkProducers, "push", observation.mergeCommit.sha);
         if (checks.status === "pending") {
             return { run: publicRunRecord(run), delivery };
         }