@dependfix/engine 0.5.0 → 0.6.0

package/dist/index.mjs

@@ -1,10 +1,11 @@
 import { a as fromPat, c as computeRetryDelayMs, l as createGitHubClient, r as fromApp } from "./chunks/auth.mjs";
 import { createRequire } from "node:module";
 import { RequestError } from "@octokit/request-error";
-import { AppError, addSkipped, addTruncatedBySeverity, aggregateCheckAttribution, classifyCheckFailure, collectCodeScanningSuggestions, collectFamilySummaries, countUnfixedAlerts, createEmptyRunSummary, createLogger, filterAlerts, formatCiAlignmentSection, formatSeverity, formatSkipReason, generateJsonReport, generateMarkdownReport, isAlertFixedByActions, isFailedConclusion, isValidRepoIdentifier, limitAlerts, mapCodeScanningSeverity, normalizeAuditSeverity, normalizeUpstreamId, prioritizeAlerts, skippedBreakdown, toErrorMessage, truncatedBreakdown, writeReport } from "@dependfix/core";
+import { AppError, addSkipped, addTruncatedBySeverity, aggregateCheckAttribution, alertOutcomeKey, buildAlertOutcomes, checkRoundKey, classifyCheckFailure, collectCodeScanningSuggestions, collectFamilySummaries, countUnfixedAlerts, createEmptyRunSummary, createLogger, dedupeByLatestRound, filterAlerts, formatCiAlignmentSection, formatSeverity, formatSkipReason, generateJsonReport, generateMarkdownReport, isAlertFixedByActions, isFailedConclusion, isValidRepoIdentifier, limitAlerts, mapCodeScanningSeverity, normalizeAuditSeverity, normalizeUpstreamId, prioritizeAlerts, resolveCheckProvider, resolveStatusProvider, skippedBreakdown, toErrorMessage, truncatedBreakdown, writeReport } from "@dependfix/core";
 import { createHash } from "node:crypto";
-import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import YAML, { isMap, isScalar, parse } from "yaml";
 import PQueue from "p-queue";
@@ -14,7 +15,7 @@ import { z } from "zod";
 import { createInterface } from "node:readline";
 import { compare, prerelease, satisfies, valid, validRange } from "semver";
 
-//#region src/github/fix-fingerprint.ts
+// src/github/fix-fingerprint.ts
 /** 尝试键长度（hex 字符数）。 */
 const ATTEMPT_KEY_LENGTH = 16;
 /** 失败签名归一化输入上限（字符数；失败命令 + 错误文本各截断到该长度）。 */
@@ -163,8 +164,7 @@ function parseMarkerAttributes(input) {
 	return attributes;
 }
 
-//#endregion
-//#region src/github/git-signing.ts
+// src/github/git-signing.ts
 /**
 * git 执行语义隔离参数（单一事实源，engine 与平台侧共用）。
 *
@@ -213,8 +213,326 @@ const GIT_PUSH_SIGNING_ISOLATION_ARGS = ["-c", "push.gpgSign=false"];
 */
 const GIT_PUSH_HOOKS_ISOLATION_ARGS = ["--no-verify"];
 
-//#endregion
-//#region src/github/commit-scope.ts
+// src/runners/process-control.ts
+/** 单流捕获上限（与 `execSync` 默认 `maxBuffer` 同量级）：超限后继续 drain 但不再累积。 */
+const MAX_STREAM_CAPTURE_BYTES = 1048576;
+/**
+* 子进程退出后等待 stdio 关闭的有界宽限期。
+*
+* `close` 事件只有在**所有**持有 stdout / stderr 写端的进程都退出后才会触发；安装脚本
+* （node-gyp / prebuild-install / postinstall）可能派生出脱离直接子进程生命周期的孙进程，
+* 即使进程组已被终止，只要孙进程仍持有管道，`close` 就永远不会到来。实测一次 5 分钟
+* 安装超时因此拖到 12 分钟才落定，直接吃掉单仓 30 分钟执行预算。
+*
+* 超时只约束"等待退出"，不改变输出语义：宽限期内正常关闭仍走 `close`；超期则主动
+* destroy 管道并用已捕获的输出落定。
+*/
+const STREAM_CLOSE_GRACE_MS = 2e3;
+/** 运行级 abort 原因（`undefined` = 未请求取消）。 */
+let abortReason;
+/** 已登记的活跃子进程 PID（超时 / abort 时按进程树终止）。 */
+const trackedPids = /* @__PURE__ */ new Set();
+/**
+* 复位运行级进程控制状态（每次构造 `DependfixApp` 时调用）。
+*
+* 只清状态、**不杀进程**：复位发生在两次运行之间，此时上一次运行的子进程应由其调用方
+* 正常收尾（`runTrackedCommand` 在 close / error 时已注销）。
+*/
+function resetProcessControlState() {
+	abortReason = void 0;
+	trackedPids.clear();
+}
+/**
+* 请求运行级取消（幂等）。
+*
+* 首次调用记录原因；**每次调用都终止当前已登记的子进程树**——这样在"平台放弃等待"之后，
+* 正在跑的 install / 验证命令会被立即杀掉，而不是继续与新仓库争抢资源。
+*/
+function requestAbort(reason) {
+	if (abortReason === void 0) abortReason = reason ?? "abort requested";
+	killAllTrackedChildProcesses();
+}
+/** 是否已请求取消（调用方在启动新命令 / 新仓库之前短路）。 */
+function isAbortRequested() {
+	return abortReason !== void 0;
+}
+/** 取消原因（未取消时为 `undefined`）。 */
+function getAbortReason() {
+	return abortReason;
+}
+/** 登记活跃子进程 PID（无 PID / 非法 PID 静默忽略——如 spawn 立即失败）。 */
+function trackChildProcess(pid) {
+	if (typeof pid === "number" && pid > 0) trackedPids.add(pid);
+}
+/** 注销活跃子进程 PID（进程已退出）。 */
+function untrackChildProcess(pid) {
+	if (typeof pid === "number" && pid > 0) trackedPids.delete(pid);
+}
+/**
+* 终止所有已登记的子进程树，返回终止数量。
+*
+* 终止后立即清空登记表：再次调用不会重复 kill（PID 可能已被系统复用）。
+*/
+function killAllTrackedChildProcesses() {
+	let killed = 0;
+	for (const pid of [...trackedPids]) {
+		killProcessTree(pid);
+		trackedPids.delete(pid);
+		killed++;
+	}
+	return killed;
+}
+/**
+* 终止进程树：POSIX 杀进程组（spawn 时 `detached` 使子进程成为进程组组长），
+* Windows 用 `taskkill /T /F`。失败时静默退化（调用方另有直接 `kill` 兜底）。
+*
+* 单一事实源：verification-runner 的超时终止与本模块的 abort 终止共用此实现。
+*/
+function killProcessTree(pid) {
+	if (pid === void 0 || pid <= 0) return;
+	if (process.platform === "win32") try {
+		spawnSync("taskkill", [
+			"/pid",
+			String(pid),
+			"/T",
+			"/F"
+		], { stdio: "ignore" });
+	} catch {}
+	else try {
+		process.kill(-pid, "SIGKILL");
+	} catch {}
+}
+/**
+* 是否经 shell 执行（Windows 需要；见模块头「平台差异」）。
+*
+* 抽成纯函数以便用例锁定平台分支：仅 `win32` 返回 true，其余平台 false
+* （POSIX 保持直接 `spawn`，与改造前行为一致）。
+*/
+function resolveShellOption(platform = process.platform) {
+	return platform === "win32";
+}
+/**
+* 异步执行命令并登记子进程（超时 / abort 时按进程树终止）。
+*
+* **取消前置守卫**：调用时若已请求取消，直接返回 `started: false`（不 spawn）——这是
+* "abort 后不再启动新工作"在安装 / 验证类命令上的**单一入口**（各调用方无需各写一遍）。
+*
+* 与旧 `execFileSync` 的差异（有意为之）：
+* - **不阻塞事件循环**——引擎与平台同进程运行，同步调用会让平台 HTTP、定时器（含执行超时）
+*   与队列全部停摆（实测：超时定时器比设定值晚约 9.5 分钟才触发）
+* - **输出限长累积**：超过 `MAX_STREAM_CAPTURE_BYTES` 后继续 drain（避免子进程写满管道阻塞）
+*   但不再累积，防大输出把内存吃掉
+* - 不抛错：退出码 / 信号 / 超时 / errno 全部经返回值暴露，由调用方决定语义
+*/
+function runTrackedCommand(params) {
+	if (isAbortRequested()) return Promise.resolve({
+		started: false,
+		exitCode: null,
+		signal: null,
+		timedOut: false,
+		aborted: true,
+		errno: null,
+		stdout: "",
+		stderr: "",
+		durationMs: 0
+	});
+	return new Promise((resolve) => {
+		const startedAt = Date.now();
+		let timedOut = false;
+		const stdoutChunks = [];
+		const stderrChunks = [];
+		const stdoutDecoder = new StringDecoder("utf-8");
+		const stderrDecoder = new StringDecoder("utf-8");
+		let stdoutBytes = 0;
+		let stderrBytes = 0;
+		let outputTruncated = false;
+		const cp = spawn(params.binary, params.args, {
+			cwd: params.cwd,
+			stdio: "pipe",
+			shell: params.shell ?? resolveShellOption(),
+			detached: process.platform !== "win32",
+			...params.env ? { env: params.env } : {}
+		});
+		trackChildProcess(cp.pid);
+		let settled = false;
+		let exited = false;
+		let closeGraceTimer;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			killProcessTree(cp.pid);
+			cp.kill("SIGKILL");
+			settleAfterStreamGrace({
+				exitCode: null,
+				signal: "SIGKILL"
+			});
+		}, params.timeoutMs);
+		function finish(result) {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			if (closeGraceTimer) clearTimeout(closeGraceTimer);
+			untrackChildProcess(cp.pid);
+			if (!outputTruncated) {
+				stdoutChunks.push(stdoutDecoder.end());
+				stderrChunks.push(stderrDecoder.end());
+			}
+			resolve({
+				started: true,
+				exitCode: result.exitCode,
+				signal: result.signal,
+				timedOut,
+				terminationUnconfirmed: timedOut && !exited ? true : void 0,
+				aborted: isAbortRequested(),
+				errno: result.errno ?? null,
+				stdout: stdoutChunks.join(""),
+				stderr: stderrChunks.join(""),
+				...outputTruncated ? { outputTruncated: true } : {},
+				durationMs: Date.now() - startedAt
+			});
+		}
+		/**
+		* 直接子进程已退出（或已被主动终止）后，等待 stdio 关闭的**有界**窗口。
+		* `close` 正常到来时由 `finish` 清掉本定时器；孙进程持有管道时由本定时器兜底。
+		*/
+		function settleAfterStreamGrace(result) {
+			if (settled) return;
+			if (closeGraceTimer) clearTimeout(closeGraceTimer);
+			closeGraceTimer = setTimeout(() => {
+				killProcessTree(cp.pid);
+				cp.stdout?.destroy?.();
+				cp.stderr?.destroy?.();
+				finish(result);
+			}, STREAM_CLOSE_GRACE_MS);
+		}
+		const capture = (decoder, chunks, bytes, data) => {
+			const next = bytes + data.byteLength;
+			if (bytes < MAX_STREAM_CAPTURE_BYTES) chunks.push(decoder.write(data));
+			else if (!outputTruncated) {
+				outputTruncated = true;
+				decoder.end();
+			}
+			return next;
+		};
+		cp.stdout?.on("data", (data) => {
+			stdoutBytes = capture(stdoutDecoder, stdoutChunks, stdoutBytes, data);
+		});
+		cp.stderr?.on("data", (data) => {
+			stderrBytes = capture(stderrDecoder, stderrChunks, stderrBytes, data);
+		});
+		cp.on("error", (err) => {
+			finish({
+				exitCode: null,
+				signal: null,
+				errno: err.code ?? "UNKNOWN"
+			});
+		});
+		cp.on("exit", (code, signal) => {
+			exited = true;
+			settleAfterStreamGrace({
+				exitCode: code,
+				signal
+			});
+		});
+		cp.on("close", (code, signal) => {
+			finish({
+				exitCode: code,
+				signal
+			});
+		});
+	});
+}
+
+// src/github/git-run.ts
+/** 交付类 git 命令的默认上限（弱网 push 的主要风险面；本地命令通常毫秒级结束）。 */
+const GIT_COMMAND_TIMEOUT_MS = 3e5;
+/**
+* 错误信息里的命令展示：跳过 `-c key=value` 隔离参数，取真实子命令（如 `git push`）。
+*
+* 交付命令普遍带 `-c push.gpgSign=false` 之类的隔离项，直接取 `args[0]` 会渲染成 `git -c`。
+*/
+function describeGitCommand(args) {
+	const parts = [];
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg === "-c" || arg === "--config") {
+			index += 1;
+			continue;
+		}
+		parts.push(arg);
+		if (parts.length >= 2) break;
+	}
+	return `git ${parts.join(" ")}`;
+}
+/** 失败原因的一句话描述（超时 / 取消前置守卫 / 退出码）。 */
+function describeFailure(params) {
+	if (params.timedOut) return "timed out";
+	if (params.aborted && !params.started) return "aborted before start";
+	if (params.aborted) return "terminated by abort";
+	return `exit code ${params.code}`;
+}
+/** git 命令失败（非 0 退出 / 超时 / 未启动）的统一错误。 */
+var GitCommandError = class extends Error {
+	args;
+	code;
+	timedOut;
+	aborted;
+	/** 是否真正启动过子进程（`false` = 取消前置守卫拦下） */
+	started;
+	stderr;
+	constructor(params) {
+		const detail = describeFailure(params);
+		const tail = params.stderr.trim().slice(-400);
+		super(`${params.what} failed: ${describeGitCommand(params.args)} — ${detail}${tail ? `: ${tail}` : ""}`);
+		this.name = "GitCommandError";
+		this.args = params.args;
+		this.code = params.code;
+		this.timedOut = params.timedOut;
+		this.aborted = params.aborted;
+		this.started = params.started;
+		this.stderr = params.stderr;
+	}
+};
+/** 执行 git 命令（不抛错；退出码 / 超时 / 取消经返回值暴露）。 */
+async function runGit(args, options) {
+	const outcome = await runTrackedCommand({
+		binary: options.binary ?? "git",
+		args: [...args],
+		cwd: options.cwd,
+		timeoutMs: options.timeoutMs ?? 3e5,
+		shell: false,
+		...options.env ? { env: options.env } : {}
+	});
+	return {
+		stdout: outcome.stdout,
+		stderr: outcome.stderr,
+		code: outcome.exitCode,
+		timedOut: outcome.timedOut,
+		aborted: outcome.aborted,
+		started: outcome.started,
+		truncated: outcome.outputTruncated === true
+	};
+}
+/**
+* 执行 git 命令并要求成功（非 0 退出 / 超时 / 取消前置守卫 → 抛 {@link GitCommandError}）。
+*
+* @param what 业务动作名（错误信息前缀，如 `checkout fix branch`）
+* @returns 标准输出（已 trim 的换行由调用方决定）
+*/
+async function runGitOrThrow(args, options) {
+	const result = await runGit(args, options);
+	if (!result.started || result.code !== 0) throw new GitCommandError({
+		what: options.what,
+		args,
+		code: result.code,
+		timedOut: result.timedOut,
+		aborted: result.aborted || !result.started,
+		started: result.started,
+		stderr: result.stderr
+	});
+	return result.stdout;
+}
+
+// src/github/commit-scope.ts
 var CommitScopeError = class extends Error {
 	category;
 	paths;
@@ -311,8 +629,8 @@ function normalizeCommitPath(raw) {
 * - `--no-renames`：重命名拆成「删除 + 新增」，删除因此不会绕过未声明检测
 * - 输出路径相对**仓库根**：按 `--show-prefix` 折算为 workDir 相对路径（workDir 可为子目录）
 */
-function listChangedPaths(workDir) {
-	const raw = execFileSync("git", [
+async function listChangedPaths(workDir) {
+	const raw = await runGitOrThrow([
 		"status",
 		"--porcelain=v1",
 		"-z",
@@ -320,14 +638,12 @@ function listChangedPaths(workDir) {
 		"--no-renames"
 	], {
 		cwd: workDir,
-		stdio: "pipe",
-		encoding: "utf-8"
+		what: "list changed paths"
 	});
-	const prefix = execFileSync("git", ["rev-parse", "--show-prefix"], {
+	const prefix = (await runGitOrThrow(["rev-parse", "--show-prefix"], {
 		cwd: workDir,
-		stdio: "pipe",
-		encoding: "utf-8"
-	}).trim();
+		what: "resolve repository prefix"
+	})).trim();
 	const changes = [];
 	for (const entry of raw.split("\0")) {
 		if (!entry) continue;
@@ -367,21 +683,21 @@ function collectDeclaredPaths(actions) {
 * 索引区越界暂存内容（`UNEXPECTED_CHANGES`）。暂存用 `git add -- <paths>`（分批；`--` 阻断选项解析，
 * 每条路径加 `:(literal)` 终止通配，文件名含 `*` / `?` / `[` 时也只暂存字面路径）。
 */
-function stageScopedChanges(workDir, declaredPaths = []) {
-	const scope = computeCommitScope(workDir, declaredPaths);
+async function stageScopedChanges(workDir, declaredPaths = []) {
+	const scope = await computeCommitScope(workDir, declaredPaths);
 	if (scope.conflicts.length > 0) throw new CommitScopeError("UNEXPECTED_CHANGES", `refusing to commit: unresolved merge conflict(s) — ${scope.conflicts.join(", ")}. Resolve them before running dependfix.`, scope.conflicts);
 	if (scope.rejected.length > 0) throw new CommitScopeError("UNEXPECTED_CHANGES", `refusing to commit: invalid declared path(s) — ${scope.rejected.map((item) => `${item.path} (${item.reason})`).join("; ")}`, scope.rejected.map((item) => item.path));
 	if (scope.unexpected.length > 0) throw new CommitScopeError("UNEXPECTED_CHANGES", `refusing to commit: ${scope.unexpected.length} undeclared tracked change(s) — ${scope.unexpected.join(", ")}. Only whitelisted manifests/lockfile/workspace files and fixer-declared paths are committed; commit or clean these changes first.`, scope.unexpected);
 	const outOfScopeStaged = scope.staged.filter((path) => !scope.paths.includes(path));
 	if (outOfScopeStaged.length > 0) throw new CommitScopeError("UNEXPECTED_CHANGES", `refusing to commit: index already contains ${outOfScopeStaged.length} staged change(s) outside the commit scope — ${outOfScopeStaged.join(", ")}. Unstage them (git restore --staged) before running dependfix.`, outOfScopeStaged);
 	if (scope.paths.length === 0) throw new CommitScopeError("NO_CHANGES", "nothing to commit: the working tree contains only generated or undeclared untracked files");
-	for (const chunk of chunkPaths(scope.paths)) execFileSync("git", [
+	for (const chunk of chunkPaths(scope.paths)) await runGitOrThrow([
 		"add",
 		"--",
 		...chunk.map((path) => `:(literal)${path}`)
 	], {
 		cwd: workDir,
-		stdio: "pipe"
+		what: "stage commit scope"
 	});
 	return {
 		staged: scope.paths,
@@ -395,8 +711,8 @@ function stageScopedChanges(workDir, declaredPaths = []) {
 * author / 签名 / hooks 三条隔离：显式 `-c user.name` / `-c user.email` 覆盖 host 全局，
 * `-c commit.gpgsign=false` 阻断宿主签名，`--no-verify` 跳过目标仓库钩子（详见 ./git-signing.ts）。
 */
-function commitStaged(message, workDir, author) {
-	execFileSync("git", [
+async function commitStaged(message, workDir, author) {
+	await runGitOrThrow([
 		"-c",
 		`user.name=${author.name}`,
 		"-c",
@@ -408,11 +724,11 @@ function commitStaged(message, workDir, author) {
 		message
 	], {
 		cwd: workDir,
-		stdio: "pipe"
+		what: "commit fix changes"
 	});
 }
 /** 判定本次提交集合（不写盘、不暂存）。 */
-function computeCommitScope(workDir, declaredPaths = []) {
+async function computeCommitScope(workDir, declaredPaths = []) {
 	const rejected = [];
 	const declared = /* @__PURE__ */ new Set();
 	const conflicts = [];
@@ -424,7 +740,7 @@ function computeCommitScope(workDir, declaredPaths = []) {
 			reason: result.reason
 		});
 	}
-	const changes = listChangedPaths(workDir);
+	const changes = await listChangedPaths(workDir);
 	const paths = /* @__PURE__ */ new Set();
 	const unexpected = [];
 	const ignored = [];
@@ -483,8 +799,7 @@ function hasControlChar(value) {
 	return false;
 }
 
-//#endregion
-//#region src/github/markdown-table.ts
+// src/github/markdown-table.ts
 /**
 * 转义 Markdown 表格单元格：`\` 先转义再转义 `|`（避免已有转义双重处理），换行折叠为空格。
 */
@@ -492,21 +807,171 @@ function escapeTableCell(value) {
 	return value.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
 }
 
-//#endregion
-//#region src/github/pr-creator.ts
+// src/github/delivery-issue.ts
+/** 交付跳过 issue 的推荐标签（仅用于检索；仓库未建该标签时可能被静默丢弃，去重不依赖它）。 */
+const DELIVERY_SKIP_LABEL = "dependfix";
+/** 交付跳过 issue 的 HTML 标记前缀（正文首位；去重判定用）。 */
+const DELIVERY_SKIP_MARKER_PREFIX = "<!-- dependfix:delivery-skip";
+/**
+* 计算交付失败指纹（sha256 前 16 位）。
+*
+* 输入顺序无关（仓库集 / 命令集分别排序后拼接），刻意不含错误文本与时间戳：
+* 同仓库、同失败命令即视为同一失败，issue 关闭后不再重开。
+*/
+function computeDeliverySkipFingerprint(input) {
+	const repositories = [...new Set(input.repositories)].sort().join("\0");
+	const commands = [...new Set(input.failingCommands)].sort().join("\0");
+	return createHash("sha256").update(`${repositories}\u0001${commands}`).digest("hex").slice(0, 16);
+}
+/** 生成 issue 正文头部的去重标记。 */
+function formatDeliverySkipMarker(fingerprint) {
+	return `${DELIVERY_SKIP_MARKER_PREFIX} fp=${fingerprint} -->`;
+}
+/** 正文是否携带指定指纹的交付跳过标记。 */
+function hasDeliverySkipMarker(body, fingerprint) {
+	if (!body) return false;
+	return body.includes(formatDeliverySkipMarker(fingerprint));
+}
+/** issue 正文（marker 在首位，便于去重判定）。 */
+function buildDeliverySkipIssueBody(input) {
+	const repos = input.repositories.length > 0 ? input.repositories.map((repo) => `\`${repo}\``).join("、") : "—";
+	const commands = input.failingCommands.length > 0 ? input.failingCommands.map((command) => `\`${command}\``).join("、") : "—";
+	return [
+		formatDeliverySkipMarker(input.fingerprint),
+		"## dependfix 交付被跳过",
+		"",
+		"修复后安装验证仍为**既有失败**（本次改动前即为红），因此本次修复未被交付：改动已回滚，未推送、未创建 PR。",
+		"",
+		"| 项 | 值 |",
+		"|----|----|",
+		`| 运行 | \`${input.runId}\` |`,
+		`| 仓库 | ${repos} |`,
+		`| 失败命令 | ${commands} |`,
+		"",
+		"### 需要做什么",
+		"",
+		"1. 先让目标仓库的安装链恢复（lockfile 与 manifest 一致、registry 可达、依赖脚本完整等），",
+		"   使上述失败命令在干净工作区通过。",
+		"2. 重新运行 dependfix（`fix-and-pr`）——同一失败指纹不会重复开 issue。",
+		"",
+		"> 本 issue 由 dependfix 自动创建，按「仓库集 + 失败命令集」指纹去重；关闭后不会自动重开。"
+	].join("\n");
+}
+/** issue 标题（仓库集稳定，便于人工按仓库检索）。 */
+function buildDeliverySkipIssueTitle(repositories) {
+	return `dependfix 交付跳过：${repositories.length > 0 ? repositories.join(", ") : "target repository"} 安装验证仍有既有失败`;
+}
 /**
-* PAT 路径默认 commit author（保持现有 PAT 路径用户行为零变化）。
-*
-* 注：此常量仅作为 PAT 路径的默认值；GitHub App 路径接入后走动态 commit author。
-* 现有 PAT 路径仍硬编码 `dependfix[bot]@users.noreply.github.com`，虽非真实 bot 身份（字符串约定），
-* 但保持行为不变以确保 PAT 用户无感升级。已知缺陷由后续阶段修复。
+* 按指纹查找既有交付跳过 issue（含**已关闭**）。
 *
-* @see [C22 PAT 无感升级评估 §5.1 兼容性](../../../../docs/design/governance/c22-pat-backward-compat.md)
+* 只读取最近 100 条 issue（与尝试索引同口径：失败指纹命中即复用，无需全量翻页）；
+* 查询失败抛错由调用方降级（缺省按未命中处理，最多多开一个 issue）。
 */
-const PAT_DEFAULT_COMMIT_AUTHOR = {
+async function findDeliverySkipIssue(octokit, owner, repo, fingerprint) {
+	const { data } = await octokit.rest.issues.listForRepo({
+		owner,
+		repo,
+		state: "all",
+		sort: "created",
+		direction: "desc",
+		per_page: 100
+	});
+	const hit = data.find((issue) => !("pull_request" in issue) && hasDeliverySkipMarker(issue.body, fingerprint));
+	return hit ? {
+		number: hit.number,
+		htmlUrl: hit.html_url
+	} : null;
+}
+/** 创建交付跳过 issue（权限面：`issues: write`）。 */
+async function createDeliverySkipIssue(octokit, owner, repo, params) {
+	const { data } = await octokit.rest.issues.create({
+		owner,
+		repo,
+		title: params.title,
+		body: params.body,
+		...params.labels && params.labels.length > 0 ? { labels: [...params.labels] } : {}
+	});
+	return {
+		number: data.number,
+		htmlUrl: data.html_url
+	};
+}
+/**
+* 草稿交付的 PR 正文说明（仅 `draft` 档渲染；放在正文最前，避免被读成「CI 会绿」）。
+*
+* 返回空数组表示本次运行没有草稿交付（既有 PR 正文逐字不变）。
+*/
+function buildDraftDeliveryNotice(result) {
+	const skips = (result.deliverySkips ?? []).filter((record) => record.carrier.mode === "draft");
+	if (skips.length === 0) return [];
+	const repos = [...new Set(skips.flatMap((record) => record.repositories))];
+	const commands = [...new Set(skips.flatMap((record) => record.failingCommands))];
+	return [
+		"> [!WARNING]",
+		"> **草稿交付**：修复后安装验证仍为既有失败（本次改动前即为红），本 PR 以草稿创建。",
+		`> 仓库：${repos.length > 0 ? repos.map((repo) => `\`${escapeTableCell(repo)}\``).join("、") : "—"}`,
+		`> 失败命令：${commands.length > 0 ? commands.map((command) => `\`${escapeTableCell(command)}\``).join("、") : "—"}`,
+		"> CI 会以同一既有失败为红；请先修复目标仓库的安装链，再把本 PR 转正。",
+		""
+	];
+}
+
+// src/github/git-config.ts
+/**
+* PAT 路径默认 commit author（保持现有 PAT 路径用户行为零变化）。
+*
+* 注：此常量仅作为 PAT 路径的默认值；GitHub App 路径接入后走动态 commit author。
+* 现有 PAT 路径仍硬编码 `dependfix[bot]@users.noreply.github.com`，虽非真实 bot 身份（字符串约定），
+* 但保持行为不变以确保 PAT 用户无感升级。已知缺陷由后续阶段修复。
+*
+* @see [PAT 无感升级评估 §5.1 兼容性](../../../../docs/design/governance/c22-pat-backward-compat.md)
+*/
+const PAT_DEFAULT_COMMIT_AUTHOR = {
 	name: "dependfix[bot]",
 	email: "dependfix[bot]@users.noreply.github.com"
 };
+/** 分支是否已存在（`git rev-parse --verify`；非 0 退出即视为不存在）。 */
+async function branchExists(branchName, workDir) {
+	const result = await runGit([
+		"rev-parse",
+		"--verify",
+		branchName
+	], { cwd: workDir });
+	return result.started && result.code === 0;
+}
+/** 本地 git 身份：仅在 local config 缺失时写入（不覆盖用户既有配置）。 */
+async function ensureGitConfig(workDir, author) {
+	const effectiveAuthor = author ?? PAT_DEFAULT_COMMIT_AUTHOR;
+	const hasName = await gitConfigExists("user.name", workDir);
+	const hasEmail = await gitConfigExists("user.email", workDir);
+	if (!hasName) await runGitOrThrow([
+		"config",
+		"user.name",
+		effectiveAuthor.name
+	], {
+		cwd: workDir,
+		what: "set git user.name"
+	});
+	if (!hasEmail) await runGitOrThrow([
+		"config",
+		"user.email",
+		effectiveAuthor.email
+	], {
+		cwd: workDir,
+		what: "set git user.email"
+	});
+}
+async function gitConfigExists(key, workDir) {
+	const result = await runGit([
+		"config",
+		"--local",
+		"--get",
+		key
+	], { cwd: workDir });
+	return result.started && result.code === 0;
+}
+
+// src/github/pr-creator.ts
 /** 自动修复分支统一前缀（分支名 = 前缀 + 内容指纹 8 位） */
 const DEPENDFIX_BRANCH_PREFIX = "dependfix/auto-fix-";
 /**
@@ -573,24 +1038,24 @@ function computeFixAndPrPlan(existingPRs, fingerprint) {
 *
 * @returns 分支名和是否为新创建
 */
-function createFixBranch(branchName, workDir) {
-	if (branchExists(branchName, workDir)) {
-		execFileSync("git", ["checkout", branchName], {
+async function createFixBranch(branchName, workDir) {
+	if (await branchExists(branchName, workDir)) {
+		await runGitOrThrow(["checkout", branchName], {
 			cwd: workDir,
-			stdio: "pipe"
+			what: `checkout fix branch ${branchName}`
 		});
 		return {
 			branchName,
 			created: false
 		};
 	}
-	execFileSync("git", [
+	await runGitOrThrow([
 		"checkout",
 		"-b",
 		branchName
 	], {
 		cwd: workDir,
-		stdio: "pipe"
+		what: `create fix branch ${branchName}`
 	});
 	return {
 		branchName,
@@ -609,10 +1074,10 @@ function createFixBranch(branchName, workDir) {
 * @throws {CommitScopeError} 提交集合含未声明改动 / 非法声明路径 / 为空
 * @see [M48.4 提交面白名单 §7](../../../../docs/design/governance/pr-delivery-closure.md#7-m484-提交面白名单与-yaml-定点编辑)
 */
-function stageAndCommit(message, workDir, author, options = {}) {
-	ensureGitConfig(workDir, author);
-	const staging = stageScopedChanges(workDir, options.declaredPaths ?? []);
-	commitStaged(message, workDir, author ?? PAT_DEFAULT_COMMIT_AUTHOR);
+async function stageAndCommit(message, workDir, author, options = {}) {
+	await ensureGitConfig(workDir, author);
+	const staging = await stageScopedChanges(workDir, options.declaredPaths ?? []);
+	await commitStaged(message, workDir, author ?? PAT_DEFAULT_COMMIT_AUTHOR);
 	return staging;
 }
 /**
@@ -624,8 +1089,8 @@ function stageAndCommit(message, workDir, author, options = {}) {
 * - **hooks**：`push --no-verify` 跳过被修复仓库的 `pre-push`（隔离环境无 `npx` / 目标仓库
 *   `node_modules` 不完整时该 hook 会以非 0 退出，把交付链打断为 `push_failed`）
 */
-function pushBranch(branchName, workDir) {
-	execFileSync("git", [
+async function pushBranch(branchName, workDir) {
+	await runGitOrThrow([
 		...GIT_PUSH_SIGNING_ISOLATION_ARGS,
 		"push",
 		...GIT_PUSH_HOOKS_ISOLATION_ARGS,
@@ -633,7 +1098,7 @@ function pushBranch(branchName, workDir) {
 		branchName
 	], {
 		cwd: workDir,
-		stdio: "pipe"
+		what: `push branch ${branchName}`
 	});
 }
 /**
@@ -700,17 +1165,18 @@ async function addLabelToPullRequest(octokit, owner, repo, pullNumber, labels) {
 	});
 }
 /**
-* 通过 GitHub API 创建 Pull Request。
+* 通过 GitHub API 创建 Pull Request（`draft: true` 创建草稿 PR：基线红的交付降级档）。
 */
 async function createPullRequest(params) {
-	const { octokit, owner, repo, headBranch, baseBranch, title, body } = params;
+	const { octokit, owner, repo, headBranch, baseBranch, title, body, draft } = params;
 	const { data } = await octokit.rest.pulls.create({
 		owner,
 		repo,
 		title,
 		body,
 		head: headBranch,
-		base: baseBranch
+		base: baseBranch,
+		...draft ? { draft: true } : {}
 	});
 	return {
 		number: data.number,
@@ -833,7 +1299,9 @@ function generatePRBody(result, supersededNumbers, attemptMarkers) {
 	const truncatedRows = truncatedBreakdown(summary);
 	const lines = [];
 	if (attemptMarkers && attemptMarkers.length > 0) lines.push(...attemptMarkers.map((marker) => formatAttemptMarker(marker)), "");
-	lines.push("## 🔒 Dependfix Auto Fix", "", `**Run ID**: \`${result.runId}\``, `**Mode**: ${result.config.mode}`, `**Time**: ${result.startedAt}`, "", "### 📊 Summary", "", "| Metric | Value |", "|--------|-------|", `| Repositories scanned | ${summary.repositoriesScanned} |`, `| Alerts found | ${summary.alertsFound} |`, `| Alerts fixable | ${summary.alertsFixable} |`, `| Dependencies upgraded | ${summary.alertsFixed} |`, `| Upgrades failed | ${summary.alertsFailed} |`, `| Skipped | ${summary.alertsSkipped} |`, `| Converged (already >= target) | ${summary.alertsConverged} |`, `| Truncated (max alerts/repo) | ${summary.alertsTruncated} |`, `| Unfixed alerts | ${unfixed} |`, `| Lockfile repairs | ${summary.lockfileRepairs} |`, `| Verifications passed | ${summary.verificationsPassed} |`, `| Verifications failed | ${summary.verificationsFailed} |`, "");
+	lines.push("## 🔒 Dependfix Auto Fix", "", `**Run ID**: \`${result.runId}\``, `**Mode**: ${result.config.mode}`, `**Time**: ${result.startedAt}`, "");
+	lines.push(...buildDraftDeliveryNotice(result));
+	lines.push("### 📊 Summary", "", "| Metric | Value |", "|--------|-------|", `| Repositories scanned | ${summary.repositoriesScanned} |`, `| Alerts found | ${summary.alertsFound} |`, `| Alerts fixable | ${summary.alertsFixable} |`, `| Dependencies upgraded | ${summary.alertsFixed} |`, `| Upgrades failed | ${summary.alertsFailed} |`, `| Skipped | ${summary.alertsSkipped} |`, `| Converged (already >= target) | ${summary.alertsConverged} |`, `| Truncated (max alerts/repo) | ${summary.alertsTruncated} |`, `| Unfixed alerts | ${unfixed} |`, `| Lockfile repairs | ${summary.lockfileRepairs} |`, `| Verifications passed | ${summary.verificationsPassed} |`, `| Verifications failed | ${summary.verificationsFailed} |`, "");
 	if (unfixed > 0 || skippedRows.length > 0 || truncatedRows.length > 0) {
 		const skippedTotal = skippedRows.reduce((sum, row) => sum + row.count, 0);
 		const failedResidual = Math.max(0, unfixed - skippedTotal);
@@ -1075,61 +1543,8 @@ function truncatePRBody(lines) {
 	}
 	return `${kept.join("\n")}${truncationNote}`;
 }
-function branchExists(branchName, workDir) {
-	try {
-		execFileSync("git", [
-			"rev-parse",
-			"--verify",
-			branchName
-		], {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return true;
-	} catch {
-		return false;
-	}
-}
-function ensureGitConfig(workDir, author) {
-	const effectiveAuthor = author ?? PAT_DEFAULT_COMMIT_AUTHOR;
-	const hasName = gitConfigExists("user.name", workDir);
-	const hasEmail = gitConfigExists("user.email", workDir);
-	if (!hasName) execFileSync("git", [
-		"config",
-		"user.name",
-		effectiveAuthor.name
-	], {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-	if (!hasEmail) execFileSync("git", [
-		"config",
-		"user.email",
-		effectiveAuthor.email
-	], {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-}
-function gitConfigExists(key, workDir) {
-	try {
-		execFileSync("git", [
-			"config",
-			"--local",
-			"--get",
-			key
-		], {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return true;
-	} catch {
-		return false;
-	}
-}
 
-//#endregion
-//#region src/github/attempt-history.ts
+// src/github/attempt-history.ts
 /** 默认查询条数（设计稿 §6.2：最近 50 条关闭 PR）。 */
 const CLOSED_ATTEMPT_QUERY_LIMIT = 50;
 /**
@@ -1182,8 +1597,7 @@ var ClosedAttemptIndex = class {
 	}
 };
 
-//#endregion
-//#region src/verification/validate-commands.ts
+// src/verification/validate-commands.ts
 /** `pnpm <script>` 形态命令匹配（脚本引用） */
 const PNPM_SCRIPT_RE = /^pnpm\s+([a-zA-Z][a-zA-Z0-9:_-]*)$/;
 /**
@@ -1236,8 +1650,7 @@ function validateVerifyCommands(commands, workDir) {
 	};
 }
 
-//#endregion
-//#region src/github/ci-alignment.ts
+// src/github/ci-alignment.ts
 /** workflow 目录（相对仓库根）。 */
 const WORKFLOW_DIR = ".github/workflows";
 /** 单次解析的文件数上限（防超大仓库 / 恶意仓库拖慢运行）。 */
@@ -1809,8 +2222,7 @@ async function buildCiAlignmentRecord(input) {
 	};
 }
 
-//#endregion
-//#region src/github/errors.ts
+// src/github/errors.ts
 /**
 * 将 Octokit 请求错误映射为 `AppError`。
 *
@@ -1876,8 +2288,7 @@ function collectErrorDetails(error) {
 	return details;
 }
 
-//#endregion
-//#region src/github/code-quality-fetcher.ts
+// src/github/code-quality-fetcher.ts
 /** cursor 分页最大页数保护（恶意 Link header 重复同 cursor 或 API 异常时终止循环） */
 const MAX_CURSOR_PAGES = 1e3;
 /**
@@ -2012,8 +2423,7 @@ function parseNextCursor(linkHeader) {
 	}
 }
 
-//#endregion
-//#region src/code-scanning/rule-config.ts
+// src/code-scanning/rule-config.ts
 /** 默认规则配置（编译后；与既有常量表等价，单点声明保持向后兼容） */
 const DEFAULT_RULES_CONFIG = {
 	autoFixable: /* @__PURE__ */ new Set(["eol-last"]),
@@ -2136,8 +2546,7 @@ function resetActiveRulesConfig() {
 	activeConfig = DEFAULT_RULES_CONFIG;
 }
 
-//#endregion
-//#region src/code-scanning/rule-classifier.ts
+// src/code-scanning/rule-classifier.ts
 /**
 * A 类自动修复白名单默认集合（默认值常量；测试 disjointness 不变量用）。
 *
@@ -2199,8 +2608,7 @@ function suggestionFor(ruleId) {
 	return getActiveRulesConfig().suggested.get(id) ?? "人工审查该 Code Scanning 告警：结合业务语义评估修复方案（参考 CodeQL 规则文档）";
 }
 
-//#endregion
-//#region src/github/code-scanning-fetcher.ts
+// src/github/code-scanning-fetcher.ts
 /**
 * 拉取指定仓库的 Code Scanning 告警并映射为标准化模型。
 *
@@ -2283,8 +2691,7 @@ function mapSeverity(alert) {
 	return "unknown";
 }
 
-//#endregion
-//#region src/github/dependabot-fetcher.ts
+// src/github/dependabot-fetcher.ts
 /**
 * 拉取指定仓库的 Dependabot 告警并映射为标准化模型。
 *
@@ -2379,8 +2786,7 @@ function normalizeDependencyRelationship(relationship) {
 	if (relationship === "indirect") return "transitive";
 }
 
-//#endregion
-//#region src/github/pr-check-watch.ts
+// src/github/pr-check-watch.ts
 /** 首次轮询间隔。 */
 const PR_CHECK_POLL_INITIAL_MS = 15e3;
 /** 轮询间隔退避上限。 */
@@ -2483,15 +2889,20 @@ async function collectObservedChecks(octokit, owner, repo, ref) {
 			owner,
 			repo,
 			ref,
-			per_page: 100
+			per_page: 100,
+			filter: "all"
 		});
 		for (const run of checkRuns) {
 			if (run?.id === void 0 || run?.id === null) continue;
 			checks.push({
+				kind: "check",
+				provider: resolveCheckProvider(run.app?.slug),
 				name: sanitizeCheckName(run.name),
 				conclusion: normalizeCheckRunConclusion(run.status, run.conclusion),
 				url: sanitizeCheckUrl(run.details_url ?? run.html_url),
-				detail: truncateDetail([run.output?.title, run.output?.summary].filter(Boolean).join(" — "))
+				detail: truncateDetail([run.output?.title, run.output?.summary].filter(Boolean).join(" — ")),
+				id: String(run.id),
+				roundAt: run.started_at ?? run.completed_at ?? null
 			});
 		}
 	} catch (error) {
@@ -2507,10 +2918,14 @@ async function collectObservedChecks(octokit, owner, repo, ref) {
 		for (const status of statuses) {
 			if (status?.id === void 0 || status?.id === null) continue;
 			checks.push({
+				kind: "status",
+				provider: resolveStatusProvider(status.context),
 				name: sanitizeCheckName(status.context),
 				conclusion: normalizeCommitStatusConclusion(status.state),
 				url: sanitizeCheckUrl(status.target_url),
-				detail: truncateDetail(status.description)
+				detail: truncateDetail(status.description),
+				id: String(status.id),
+				roundAt: status.updated_at ?? status.created_at ?? null
 			});
 		}
 	} catch (error) {
@@ -2581,14 +2996,36 @@ async function resolveParentSha(params) {
 	}
 }
 /**
+* 同名多轮收敛：同一「组键」只保留**最新一轮**（与平台 `dedupeSignalsByLatestRound` 同源，
+* 组键与排序均由 `@dependfix/core` 的 `checkRoundKey` / `dedupeByLatestRound` 提供）。
+*
+* 触发场景：check run re-run（同一 workflow run 的同名新尝试）、同一 commit status context 的后发状态。
+* 组键含 `kind` / `provider`：check run 与 commit status 同名、或同名 job 由不同 App 上报时**不合并**；
+* check 还要求能证明同一条 workflow run（`details_url` 里的 run id），否则各自成组——
+* 「push 触发」与「pull_request 触发」是同名不同 run，合并会掩蔽另一方的失败。
+* 口径见 docs/design/governance/pr-build-deploy-signals.md §3.10。
+*/
+function dedupeObservedChecksByLatestRound(checks) {
+	return dedupeByLatestRound(checks, (check, index) => checkRoundKey({
+		kind: check.kind,
+		provider: check.provider,
+		name: check.name,
+		url: check.url,
+		sourceId: check.id
+	}, String(index)));
+}
+/**
 * 判定终态；未到终态返回 `undefined`（继续轮询）。
 *
 * 终态条件：已观测到至少一条 check，且全部 check 已完成（无 `pending`）。
+* `completed + conclusion=null` 归一为 `unknown` 结论（`isFailedConclusion` 判失败，fail-closed），
+* 与平台侧 `resolveCheckRunState` 同口径（docs/design/governance/pr-build-deploy-signals.md §3.10）。
 * - 存在失败 → `failed`（逐条归因后聚合；混合归因 → `unknown`）
 * - 无失败且有成功 → `passed`
 * - 无失败且无成功（全是 cancelled / skipped / neutral）→ `cancelled`
 */
-async function evaluateCheckTerminal(params, observed) {
+async function evaluateCheckTerminal(params, observedChecks) {
+	const observed = dedupeObservedChecksByLatestRound(observedChecks);
 	if (observed.length === 0) return;
 	if (observed.some((check) => check.conclusion === "pending")) return;
 	const failures = observed.filter((check) => isFailedConclusion(check.conclusion));
@@ -2811,8 +3248,7 @@ async function watchPullRequestChecks(params) {
 	}
 }
 
-//#endregion
-//#region src/github/repo-policy.ts
+// src/github/repo-policy.ts
 /** 单条 glob 模式长度上限（加固：防止超长模式引入匹配开销；受信配置 + 短输入） */
 const MAX_GLOB_PATTERN_LENGTH = 200;
 /**
@@ -2911,8 +3347,7 @@ function filterExplicitRepositories(policy, repositories) {
 	return repositories.filter((repo) => !matchesRepoExclude(policy, repo));
 }
 
-//#endregion
-//#region src/github/repo-selector.ts
+// src/github/repo-selector.ts
 /**
 * 从文件读取仓库列表（每行一个 `owner/repo`）。
 * 空行和 `#` 开头的注释行会被跳过。
@@ -2944,8 +3379,7 @@ function resolveRepoList(cliRepos, reposFilePath) {
 	return deduped;
 }
 
-//#endregion
-//#region src/github/repository-discovery.ts
+// src/github/repository-discovery.ts
 const DEPENDABOT_CONFIG_PATH = ".github/dependabot.yml";
 /**
 * 按 owner / org 自动发现仓库，产出稳定处理清单。
@@ -3079,8 +3513,7 @@ async function probeDependabotConfig(client, owner, repo) {
 	}
 }
 
-//#endregion
-//#region src/github/token-scope.ts
+// src/github/token-scope.ts
 const CLASSIC_REPO_SCOPE_WARNING = {
 	code: "CLASSIC_REPO_SCOPE",
 	message: "检测到 classic PAT 且包含 repo（全量仓库）权限——该 token 一旦被恶意依赖脚本窃取，即可接管所有可见仓库。建议改用 fine-grained PAT（最小权限：contents/pull-requests 写 + security-events 读，仅目标仓库），详见 quick-start 安全注意事项。"
@@ -3152,8 +3585,7 @@ async function checkTokenPermissions(client, options = {}) {
 	}
 }
 
-//#endregion
-//#region src/code-scanning/templates.ts
+// src/code-scanning/templates.ts
 const TEMPLATES = new Map([{
 	ruleId: "eol-last",
 	apply(_filePath, content) {
@@ -3176,8 +3608,7 @@ function getCodeScanningFixTemplate(ruleId) {
 	return TEMPLATES.get(ruleId);
 }
 
-//#endregion
-//#region src/fixers/install-timeouts.ts
+// src/fixers/install-timeouts.ts
 /** 安装类命令默认超时：5 分钟。 */
 const DEFAULT_INSTALL_TIMEOUT_MS = 3e5;
 /** 安装类命令超时下限（低于此值视为配置错误 → 回退默认）。 */
@@ -3201,8 +3632,7 @@ function resolveInstallTimeoutMs(env = process.env, fallback = DEFAULT_INSTALL_T
 	return Number.isInteger(value) && value >= 1e4 && value <= 18e5 ? value : fallback;
 }
 
-//#endregion
-//#region src/runners/output-sanitizer.ts
+// src/runners/output-sanitizer.ts
 /** 敏感输出匹配规则（顺序固定，后者可覆盖前者的部分结果）。 */
 const SECRET_PATTERNS$1 = [
 	[/^(GITHUB_TOKEN|NPM_TOKEN|NODE_AUTH_TOKEN|DOCKER_PASSWORD)=.+/gim, "$1=***"],
@@ -3217,8 +3647,7 @@ function sanitizeOutput(output) {
 	return result;
 }
 
-//#endregion
-//#region src/fixers/process-signals.ts
+// src/fixers/process-signals.ts
 /**
 * 进程级失败信号抽取（`execSync` / `execFileSync` 抛出错误的统一读取口径）。
 *
@@ -3270,286 +3699,67 @@ function extractProcessSignals(err) {
 	return {
 		exitCode: typeof err.status === "number" ? err.status : null,
 		signal: typeof err.signal === "string" ? err.signal : null,
-		timedOut: err.code === "ETIMEDOUT",
-		errno: typeof err.code === "string" && err.code !== "ETIMEDOUT" ? err.code : null
-	};
-}
-/**
-* 安装失败是否属于环境性问题（**单一判据**：lockfile 诊断链与依赖升级链共用）。
-*
-* 判定顺序：
-* 1. 运行级取消（`aborted`）→ false：中止是独立类别（`ABORTED`），不得伪装成
-*    「不归因目标仓库」的环境性失败。
-* 2. 信号终止 / 超时 → true：进程可能已吐出部分输出，但被杀死 / 超时本身说明执行环境异常，
-*    不足以把失败归因目标仓库。
-* 3. 有 stderr 诊断 → false：`ERR_PNPM_*` / 解析失败等可读失败归因目标仓库。
-* 4. stderr 为空 → true（静默非零退出）。
-*
-* 归因只看 stderr，**不看 stdout**：pnpm 11 把安装脚本错误（`gyp ERR!` / `prebuild-install`）
-* 写到 stdout，那类原生构建失败仍按环境性处理（stdout 作为证据保留，口径见
-* docs/design/modules/pnpm-lockfile-fixer.md §2.4）。
-*/
-function isEnvironmentalInstallError(err) {
-	if (err.aborted === true) return false;
-	const signals = extractProcessSignals(err);
-	if (signals.signal !== null || signals.timedOut) return true;
-	return getRawStderrText(err).trim().length === 0;
-}
-/** 渲染进程级信号的简短描述（用于失败详情）；无可用信号时返回空串。 */
-function describeProcessSignals(signals) {
-	const parts = [];
-	if (signals.signal !== null) parts.push(`signal ${signals.signal}`);
-	else if (signals.exitCode !== null) parts.push(`exit code ${signals.exitCode}`);
-	else if (signals.errno !== null) parts.push(`spawn error ${signals.errno}`);
-	if (signals.timedOut) parts.push("timed out");
-	return parts.join(", ");
-}
-/**
-* 把受管命令（异步 `spawn`）的结果适配为既有 `execSync` / `execFileSync` 形态的错误对象。
-*
-* 目的：安装类调用从同步 `execFileSync` 迁到 `runTrackedCommand` 后，
-* `extractProcessSignals` / `getRawStderrText` / `getRawStdoutText` / `describeInstallError`
-* 的读取口径**零漂移**——`status` / `signal` / `code` / `stderr` / `stdout` 字段与 Node 抛出的
-* 形态一致（`status` 仅在有退出码时设置，`code` 在超时时为 `ETIMEDOUT`、spawn 失败时为 `errno`）。
-*/
-function toExecLikeError(command, outcome) {
-	let message = `Command failed: ${command}`;
-	if (outcome.aborted) message = `run aborted — command terminated by cancellation: ${command}`;
-	else if (outcome.timedOut) message = `spawnSync ${command} ETIMEDOUT`;
-	else if (outcome.errno) message = `spawn ${command} ${outcome.errno}`;
-	if (outcome.terminationUnconfirmed) message += " (termination unconfirmed)";
-	const err = new Error(message);
-	if (outcome.aborted) err.aborted = true;
-	if (outcome.terminationUnconfirmed) err.terminationUnconfirmed = true;
-	if (outcome.stderr) err.stderr = outcome.stderr;
-	if (outcome.stdout) err.stdout = outcome.stdout;
-	if (outcome.exitCode !== null) err.status = outcome.exitCode;
-	if (outcome.signal !== null) err.signal = outcome.signal;
-	if (outcome.timedOut) err.code = "ETIMEDOUT";
-	else if (outcome.errno !== null) err.code = outcome.errno;
-	return err;
-}
-
-//#endregion
-//#region src/runners/process-control.ts
-/** 单流捕获上限（与 `execSync` 默认 `maxBuffer` 同量级）：超限后继续 drain 但不再累积。 */
-const MAX_STREAM_CAPTURE_BYTES = 1048576;
-/**
-* 子进程退出后等待 stdio 关闭的有界宽限期。
-*
-* `close` 事件只有在**所有**持有 stdout / stderr 写端的进程都退出后才会触发；安装脚本
-* （node-gyp / prebuild-install / postinstall）可能派生出脱离直接子进程生命周期的孙进程，
-* 即使进程组已被终止，只要孙进程仍持有管道，`close` 就永远不会到来。实测一次 5 分钟
-* 安装超时因此拖到 12 分钟才落定，直接吃掉单仓 30 分钟执行预算。
-*
-* 超时只约束"等待退出"，不改变输出语义：宽限期内正常关闭仍走 `close`；超期则主动
-* destroy 管道并用已捕获的输出落定。
-*/
-const STREAM_CLOSE_GRACE_MS = 2e3;
-/** 运行级 abort 原因（`undefined` = 未请求取消）。 */
-let abortReason;
-/** 已登记的活跃子进程 PID（超时 / abort 时按进程树终止）。 */
-const trackedPids = /* @__PURE__ */ new Set();
-/**
-* 复位运行级进程控制状态（每次构造 `DependfixApp` 时调用）。
-*
-* 只清状态、**不杀进程**：复位发生在两次运行之间，此时上一次运行的子进程应由其调用方
-* 正常收尾（`runTrackedCommand` 在 close / error 时已注销）。
-*/
-function resetProcessControlState() {
-	abortReason = void 0;
-	trackedPids.clear();
-}
-/**
-* 请求运行级取消（幂等）。
-*
-* 首次调用记录原因；**每次调用都终止当前已登记的子进程树**——这样在"平台放弃等待"之后，
-* 正在跑的 install / 验证命令会被立即杀掉，而不是继续与新仓库争抢资源。
-*/
-function requestAbort(reason) {
-	if (abortReason === void 0) abortReason = reason ?? "abort requested";
-	killAllTrackedChildProcesses();
-}
-/** 是否已请求取消（调用方在启动新命令 / 新仓库之前短路）。 */
-function isAbortRequested() {
-	return abortReason !== void 0;
-}
-/** 取消原因（未取消时为 `undefined`）。 */
-function getAbortReason() {
-	return abortReason;
-}
-/** 登记活跃子进程 PID（无 PID / 非法 PID 静默忽略——如 spawn 立即失败）。 */
-function trackChildProcess(pid) {
-	if (typeof pid === "number" && pid > 0) trackedPids.add(pid);
-}
-/** 注销活跃子进程 PID（进程已退出）。 */
-function untrackChildProcess(pid) {
-	if (typeof pid === "number" && pid > 0) trackedPids.delete(pid);
-}
-/**
-* 终止所有已登记的子进程树，返回终止数量。
-*
-* 终止后立即清空登记表：再次调用不会重复 kill（PID 可能已被系统复用）。
-*/
-function killAllTrackedChildProcesses() {
-	let killed = 0;
-	for (const pid of [...trackedPids]) {
-		killProcessTree(pid);
-		trackedPids.delete(pid);
-		killed++;
-	}
-	return killed;
-}
-/**
-* 终止进程树：POSIX 杀进程组（spawn 时 `detached` 使子进程成为进程组组长），
-* Windows 用 `taskkill /T /F`。失败时静默退化（调用方另有直接 `kill` 兜底）。
-*
-* 单一事实源：verification-runner 的超时终止与本模块的 abort 终止共用此实现。
-*/
-function killProcessTree(pid) {
-	if (pid === void 0 || pid <= 0) return;
-	if (process.platform === "win32") try {
-		spawnSync("taskkill", [
-			"/pid",
-			String(pid),
-			"/T",
-			"/F"
-		], { stdio: "ignore" });
-	} catch {}
-	else try {
-		process.kill(-pid, "SIGKILL");
-	} catch {}
-}
-/**
-* 是否经 shell 执行（Windows 需要；见模块头「平台差异」）。
-*
-* 抽成纯函数以便用例锁定平台分支：仅 `win32` 返回 true，其余平台 false
-* （POSIX 保持直接 `spawn`，与改造前行为一致）。
-*/
-function resolveShellOption(platform = process.platform) {
-	return platform === "win32";
-}
-/**
-* 异步执行命令并登记子进程（超时 / abort 时按进程树终止）。
-*
-* **取消前置守卫**：调用时若已请求取消，直接返回 `started: false`（不 spawn）——这是
-* "abort 后不再启动新工作"在安装 / 验证类命令上的**单一入口**（各调用方无需各写一遍）。
-*
-* 与旧 `execFileSync` 的差异（有意为之）：
-* - **不阻塞事件循环**——引擎与平台同进程运行，同步调用会让平台 HTTP、定时器（含执行超时）
-*   与队列全部停摆（实测：超时定时器比设定值晚约 9.5 分钟才触发）
-* - **输出限长累积**：超过 `MAX_STREAM_CAPTURE_BYTES` 后继续 drain（避免子进程写满管道阻塞）
-*   但不再累积，防大输出把内存吃掉
-* - 不抛错：退出码 / 信号 / 超时 / errno 全部经返回值暴露，由调用方决定语义
-*/
-function runTrackedCommand(params) {
-	if (isAbortRequested()) return Promise.resolve({
-		started: false,
-		exitCode: null,
-		signal: null,
-		timedOut: false,
-		aborted: true,
-		errno: null,
-		stdout: "",
-		stderr: "",
-		durationMs: 0
-	});
-	return new Promise((resolve) => {
-		const startedAt = Date.now();
-		let timedOut = false;
-		const stdoutChunks = [];
-		const stderrChunks = [];
-		let stdoutBytes = 0;
-		let stderrBytes = 0;
-		const cp = spawn(params.binary, params.args, {
-			cwd: params.cwd,
-			stdio: "pipe",
-			shell: params.shell ?? resolveShellOption(),
-			detached: process.platform !== "win32",
-			...params.env ? { env: params.env } : {}
-		});
-		trackChildProcess(cp.pid);
-		let settled = false;
-		let exited = false;
-		let closeGraceTimer;
-		const timer = setTimeout(() => {
-			timedOut = true;
-			killProcessTree(cp.pid);
-			cp.kill("SIGKILL");
-			settleAfterStreamGrace({
-				exitCode: null,
-				signal: "SIGKILL"
-			});
-		}, params.timeoutMs);
-		function finish(result) {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timer);
-			if (closeGraceTimer) clearTimeout(closeGraceTimer);
-			untrackChildProcess(cp.pid);
-			resolve({
-				started: true,
-				exitCode: result.exitCode,
-				signal: result.signal,
-				timedOut,
-				terminationUnconfirmed: timedOut && !exited ? true : void 0,
-				aborted: isAbortRequested(),
-				errno: result.errno ?? null,
-				stdout: stdoutChunks.join(""),
-				stderr: stderrChunks.join(""),
-				durationMs: Date.now() - startedAt
-			});
-		}
-		/**
-		* 直接子进程已退出（或已被主动终止）后，等待 stdio 关闭的**有界**窗口。
-		* `close` 正常到来时由 `finish` 清掉本定时器；孙进程持有管道时由本定时器兜底。
-		*/
-		function settleAfterStreamGrace(result) {
-			if (settled) return;
-			if (closeGraceTimer) clearTimeout(closeGraceTimer);
-			closeGraceTimer = setTimeout(() => {
-				killProcessTree(cp.pid);
-				cp.stdout?.destroy?.();
-				cp.stderr?.destroy?.();
-				finish(result);
-			}, STREAM_CLOSE_GRACE_MS);
-		}
-		const capture = (chunks, bytes, data) => {
-			const next = bytes + data.byteLength;
-			if (bytes < MAX_STREAM_CAPTURE_BYTES) chunks.push(data.toString("utf-8"));
-			return next;
-		};
-		cp.stdout?.on("data", (data) => {
-			stdoutBytes = capture(stdoutChunks, stdoutBytes, data);
-		});
-		cp.stderr?.on("data", (data) => {
-			stderrBytes = capture(stderrChunks, stderrBytes, data);
-		});
-		cp.on("error", (err) => {
-			finish({
-				exitCode: null,
-				signal: null,
-				errno: err.code ?? "UNKNOWN"
-			});
-		});
-		cp.on("exit", (code, signal) => {
-			exited = true;
-			settleAfterStreamGrace({
-				exitCode: code,
-				signal
-			});
-		});
-		cp.on("close", (code, signal) => {
-			finish({
-				exitCode: code,
-				signal
-			});
-		});
-	});
+		timedOut: err.code === "ETIMEDOUT",
+		errno: typeof err.code === "string" && err.code !== "ETIMEDOUT" ? err.code : null
+	};
+}
+/**
+* 安装失败是否属于环境性问题（**单一判据**：lockfile 诊断链与依赖升级链共用）。
+*
+* 判定顺序：
+* 1. 运行级取消（`aborted`）→ false：中止是独立类别（`ABORTED`），不得伪装成
+*    「不归因目标仓库」的环境性失败。
+* 2. 信号终止 / 超时 → true：进程可能已吐出部分输出，但被杀死 / 超时本身说明执行环境异常，
+*    不足以把失败归因目标仓库。
+* 3. 有 stderr 诊断 → false：`ERR_PNPM_*` / 解析失败等可读失败归因目标仓库。
+* 4. stderr 为空 → true（静默非零退出）。
+*
+* 归因只看 stderr，**不看 stdout**：pnpm 11 把安装脚本错误（`gyp ERR!` / `prebuild-install`）
+* 写到 stdout，那类原生构建失败仍按环境性处理（stdout 作为证据保留，口径见
+* docs/design/modules/pnpm-lockfile-fixer.md §2.4）。
+*/
+function isEnvironmentalInstallError(err) {
+	if (err.aborted === true) return false;
+	const signals = extractProcessSignals(err);
+	if (signals.signal !== null || signals.timedOut) return true;
+	return getRawStderrText(err).trim().length === 0;
+}
+/** 渲染进程级信号的简短描述（用于失败详情）；无可用信号时返回空串。 */
+function describeProcessSignals(signals) {
+	const parts = [];
+	if (signals.signal !== null) parts.push(`signal ${signals.signal}`);
+	else if (signals.exitCode !== null) parts.push(`exit code ${signals.exitCode}`);
+	else if (signals.errno !== null) parts.push(`spawn error ${signals.errno}`);
+	if (signals.timedOut) parts.push("timed out");
+	return parts.join(", ");
+}
+/**
+* 把受管命令（异步 `spawn`）的结果适配为既有 `execSync` / `execFileSync` 形态的错误对象。
+*
+* 目的：安装类调用从同步 `execFileSync` 迁到 `runTrackedCommand` 后，
+* `extractProcessSignals` / `getRawStderrText` / `getRawStdoutText` / `describeInstallError`
+* 的读取口径**零漂移**——`status` / `signal` / `code` / `stderr` / `stdout` 字段与 Node 抛出的
+* 形态一致（`status` 仅在有退出码时设置，`code` 在超时时为 `ETIMEDOUT`、spawn 失败时为 `errno`）。
+*/
+function toExecLikeError(command, outcome) {
+	let message = `Command failed: ${command}`;
+	if (outcome.aborted) message = `run aborted — command terminated by cancellation: ${command}`;
+	else if (outcome.timedOut) message = `spawnSync ${command} ETIMEDOUT`;
+	else if (outcome.errno) message = `spawn ${command} ${outcome.errno}`;
+	if (outcome.terminationUnconfirmed) message += " (termination unconfirmed)";
+	const err = new Error(message);
+	if (outcome.aborted) err.aborted = true;
+	if (outcome.terminationUnconfirmed) err.terminationUnconfirmed = true;
+	if (outcome.stderr) err.stderr = outcome.stderr;
+	if (outcome.stdout) err.stdout = outcome.stdout;
+	if (outcome.exitCode !== null) err.status = outcome.exitCode;
+	if (outcome.signal !== null) err.signal = outcome.signal;
+	if (outcome.timedOut) err.code = "ETIMEDOUT";
+	else if (outcome.errno !== null) err.code = outcome.errno;
+	return err;
 }
 
-//#endregion
-//#region src/fixers/dependency/override-key.ts
+// src/fixers/dependency/override-key.ts
 /**
 * 归一化单个 selector。
 *
@@ -3597,8 +3807,7 @@ function upsertOverride(overrides, key, value) {
 	};
 }
 
-//#endregion
-//#region src/fixers/dependency/workspace-yaml.ts
+// src/fixers/dependency/workspace-yaml.ts
 /**
 * 解析 `pnpm-workspace.yaml` 文本。
 *
@@ -3778,8 +3987,7 @@ function containsAlias(doc) {
 	return found;
 }
 
-//#endregion
-//#region src/fixers/dependency/overrides-io.ts
+// src/fixers/dependency/overrides-io.ts
 /**
 * 执行 `pnpm install --no-frozen-lockfile`。
 *
@@ -3970,8 +4178,7 @@ function formatInstallFailure(diagnostics) {
 	return hint ? `pnpm install failed: ${hint}: ${diagnostics}` : `pnpm install failed: ${diagnostics}`;
 }
 
-//#endregion
-//#region src/fixers/dependency/semver.ts
+// src/fixers/dependency/semver.ts
 /**
 * 从版本声明中提取主版本号（major）。
 * 去除前缀后匹配第一个 semver 段。
@@ -4041,8 +4248,7 @@ function isNonSemverDeclaration(version) {
 	return /^(workspace|catalog|link|file|npm|github|gitlab|bitbucket|gist|git(?:\+ssh|\+https|\+http|\+file)?|portal|patch|https?|ssh)\s*:/.test(trimmed);
 }
 
-//#endregion
-//#region src/fixers/dependency/lockfile-versions.ts
+// src/fixers/dependency/lockfile-versions.ts
 /**
 * 从 `pnpm-lock.yaml` 中读取指定包的**所有**锁定版本实例。
 *
@@ -4090,8 +4296,7 @@ function escapeRegExp(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-//#endregion
-//#region src/fixers/dependency/override-verification.ts
+// src/fixers/dependency/override-verification.ts
 /**
 * 返回仍低于目标的锁定实例（空数组 = 全部达到目标 / lockfile 中无该包）。
 *
@@ -4132,8 +4337,7 @@ function extractTargetVersion(range) {
 	return /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)/.exec(range)?.[1];
 }
 
-//#endregion
-//#region src/fixers/dependency/manifest.ts
+// src/fixers/dependency/manifest.ts
 /**
 * 在 `package.json` 的 `dependencies` / `devDependencies` / `optionalDependencies` 中按顺序查找包。
 */
@@ -4177,8 +4381,7 @@ function ensurePnpmOverrides(pkg) {
 	return pkg.pnpm.overrides;
 }
 
-//#endregion
-//#region src/fixers/dependency/manifest-upgrades.ts
+// src/fixers/dependency/manifest-upgrades.ts
 async function applyManifestUpgrades(params) {
 	const { workDir, manifestDir, requests } = params;
 	const pkgPath = join(workDir, manifestDir ?? ".", "package.json");
@@ -4307,8 +4510,7 @@ async function applyManifestUpgrades(params) {
 	};
 }
 
-//#endregion
-//#region src/fixers/dependency/index.ts
+// src/fixers/dependency/index.ts
 /**
 * 升级单个依赖到指定版本。
 *
@@ -4780,8 +4982,7 @@ function isCrossMajorFixRequired(lockfilePath, alert) {
 	return !versions.some((v) => parseMajorVersion(v) === targetMajor);
 }
 
-//#endregion
-//#region src/fixers/pnpm/index.ts
+// src/fixers/pnpm/index.ts
 /**
 * 执行 `pnpm i --frozen-lockfile` 并解析失败分类。
 * 成功时返回 `{ ok: true }`。
@@ -5266,8 +5467,7 @@ function readLockfileVersionOf(workDir) {
 	}
 }
 
-//#endregion
-//#region src/fixers/code-scanning/index.ts
+// src/fixers/code-scanning/index.ts
 /**
 * 应用单个 Code Scanning 告警的模板修复。
 *
@@ -5278,7 +5478,13 @@ function applyCodeScanningFix(params) {
 	const { workDir, alert, dryRun } = params;
 	if (alert.source !== "code-scanning" || alert.alertClass !== "auto-fixable") return null;
 	const startMs = Date.now();
-	/** 无法安全处理（陈旧告警/缺模板/歧义）→ noOp 标记，不计 failed（避免永久 exit 1/2） */
+	/**
+	* 无法安全处理（陈旧告警/缺模板/歧义）→ noOp 标记，不计 failed（避免永久 exit 1/2）。
+	*
+	* ⚠️ 与 `packages/core/src/report/alert-outcomes.ts#isAlreadyCompliant` 成对：该函数把
+	* 「`success + noOp` 且**无 `error`**」判为已收敛，因此本函数产出的每个 skip 都必须带 `error`
+	* （compliant 分支不设 `error`）。新增 skip 分支漏写 `error` 会把「无法处理」写成 `converged`。
+	*/
 	const skip = (reason) => ({
 		type: "code-scanning-fix",
 		repository: alert.repository,
@@ -5429,8 +5635,7 @@ function resolveWithinWorkDir(workDir, relativePath) {
 	}
 }
 
-//#endregion
-//#region src/multirepo/scheduler.ts
+// src/multirepo/scheduler.ts
 /** 并发上限（1-16，配置校验范围） */
 const MAX_CONCURRENCY_LIMIT = 16;
 /** 默认并发（保守：行为与现状一致，逐仓库串行） */
@@ -5461,8 +5666,7 @@ function isValidConcurrency(value) {
 	return Number.isInteger(value) && value >= 1 && value <= 16;
 }
 
-//#endregion
-//#region src/config/validation.ts
+// src/config/validation.ts
 /**
 * 运行时配置校验（从 `config/index.ts` 拆分以控制单文件行数）。
 *
@@ -5512,9 +5716,24 @@ function validateRuntimeConfig(config) {
 function validateGitHubAppConfig(config) {
 	if (!config.appId || !config.privateKey || !config.installationId) throw new AppError("CONFIG_VALIDATION_ERROR", "GitHub App config requires appId, privateKey, and installationId");
 }
+const BASELINE_RED_DELIVERIES = [
+	"skip",
+	"issue",
+	"draft"
+];
+/**
+* 解析 `DEPENDFIX_ON_BASELINE_RED`（`skip` / `issue` / `draft`）。
+*
+* 未设置 / 空串 → `undefined`（由默认值补 `skip`）；非法值 fail-fast。
+*/
+function readBaselineRedDelivery(value, fieldName) {
+	if (value === void 0 || value.trim() === "") return;
+	const normalized = value.trim().toLowerCase();
+	if (!BASELINE_RED_DELIVERIES.includes(normalized)) throw new AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be one of: ${BASELINE_RED_DELIVERIES.join(", ")}`);
+	return normalized;
+}
 
-//#endregion
-//#region src/config/index.ts
+// src/config/index.ts
 const RUNTIME_MODES = [
 	"report-only",
 	"fix",
@@ -5551,6 +5770,7 @@ const DEFAULT_RUNTIME_CONFIG = {
 	rollbackGranularity: "unit",
 	mirrorCiScripts: false,
 	retryFailed: false,
+	onBaselineRed: "skip",
 	waitPrChecks: false,
 	closeFailedPr: false,
 	prCheckTimeoutMs: 9e5,
@@ -5703,6 +5923,7 @@ function readEnvConfig(env = process.env) {
 		rollbackGranularity: readRollbackGranularity(readEnv(env, "ROLLBACK_GRANULARITY"), `${ENV_PREFIX}ROLLBACK_GRANULARITY`),
 		mirrorCiScripts: normalizeBoolean(readEnv(env, "MIRROR_CI_SCRIPTS"), `${ENV_PREFIX}MIRROR_CI_SCRIPTS`),
 		retryFailed: normalizeBoolean(readEnv(env, "RETRY_FAILED"), `${ENV_PREFIX}RETRY_FAILED`),
+		onBaselineRed: readBaselineRedDelivery(readEnv(env, "ON_BASELINE_RED"), `${ENV_PREFIX}ON_BASELINE_RED`),
 		waitPrChecks: normalizeBoolean(readEnv(env, "WAIT_PR_CHECKS"), `${ENV_PREFIX}WAIT_PR_CHECKS`),
 		closeFailedPr: normalizeBoolean(readEnv(env, "CLOSE_FAILED_PR"), `${ENV_PREFIX}CLOSE_FAILED_PR`),
 		prCheckTimeoutMs: normalizeInteger(readEnv(env, "PR_CHECK_TIMEOUT_MS"), `${ENV_PREFIX}PR_CHECK_TIMEOUT_MS`),
@@ -5809,6 +6030,7 @@ function resolveRuntimeConfig(options = {}) {
 		rollbackGranularity: cliOverrides.rollbackGranularity ?? envConfig.rollbackGranularity ?? DEFAULT_RUNTIME_CONFIG.rollbackGranularity,
 		mirrorCiScripts: cliOverrides.mirrorCiScripts ?? envConfig.mirrorCiScripts ?? DEFAULT_RUNTIME_CONFIG.mirrorCiScripts,
 		retryFailed: cliOverrides.retryFailed ?? envConfig.retryFailed ?? DEFAULT_RUNTIME_CONFIG.retryFailed,
+		onBaselineRed: cliOverrides.onBaselineRed ?? envConfig.onBaselineRed ?? DEFAULT_RUNTIME_CONFIG.onBaselineRed,
 		waitPrChecks: cliOverrides.waitPrChecks ?? envConfig.waitPrChecks ?? DEFAULT_RUNTIME_CONFIG.waitPrChecks,
 		closeFailedPr: cliOverrides.closeFailedPr ?? envConfig.closeFailedPr ?? DEFAULT_RUNTIME_CONFIG.closeFailedPr,
 		prCheckTimeoutMs: cliOverrides.prCheckTimeoutMs ?? envConfig.prCheckTimeoutMs ?? DEFAULT_RUNTIME_CONFIG.prCheckTimeoutMs,
@@ -5865,8 +6087,7 @@ function inferRepoFromGitRemote(workDir) {
 	}
 }
 
-//#endregion
-//#region src/report/archiver.ts
+// src/report/archiver.ts
 /**
 * 归档一次运行结果：
 * - `{outputDir}/{YYYY-MM}/{runId}/summary.json`：全局 RunResult 汇总（同字段口径）
@@ -6010,8 +6231,7 @@ function buildArchiveEntry(runResult) {
 	};
 }
 
-//#endregion
-//#region src/report/history.ts
+// src/report/history.ts
 /**
 * 将某仓库的历史运行摘要格式化为多行文本（倒序时间：最新在前）。
 *
@@ -6033,8 +6253,7 @@ function formatHistory(entries, repo) {
 	return lines.join("\n");
 }
 
-//#endregion
-//#region src/runners/network-audit.ts
+// src/runners/network-audit.ts
 const CONNECT_TIMEOUT_MS = 1e4;
 /**
 * 默认出站白名单（网络白名单治理决策：registry + 常见镜像站 + GitHub API/资产域 + 受信任构建工具文档站）。
@@ -6289,8 +6508,7 @@ function logNetworkAudit(logger, repo, entries) {
 	for (const entry of entries) logger.debug(`[network-audit] ${repo}: ${entry.source} ${entry.method} ${entry.target}`);
 }
 
-//#endregion
-//#region src/runners/registry-discovery.ts
+// src/runners/registry-discovery.ts
 /** 单次配置读取超时（只读本地配置，正常毫秒级完成；超时即 fail-open） */
 const DEFAULT_TIMEOUT_MS$2 = 5e3;
 /**
@@ -6433,8 +6651,7 @@ function discoverRegistryHostsUncached(workDir, options) {
 	};
 }
 
-//#endregion
-//#region src/runners/verification-runner.ts
+// src/runners/verification-runner.ts
 /**
 * 默认验证命令链（**唯一事实源**——app 层经此导入，消除此前的双副本漂移）。
 *
@@ -6741,8 +6958,7 @@ function truncateLines(text, maxLines) {
 	return `${lines.slice(0, maxLines).join("\n")}\n... (truncated, ${lines.length - maxLines} more lines)`;
 }
 
-//#endregion
-//#region src/helpers/index.ts
+// src/helpers/index.ts
 /**
 * 对可修复告警按包名去重（同包收敛）。
 *
@@ -7019,8 +7235,7 @@ function collectSubdirectories(dir, out) {
 	}
 }
 
-//#endregion
-//#region src/grouping/index.ts
+// src/grouping/index.ts
 /**
 * 判断包名是否匹配 dependabot pattern。
 *
@@ -7268,8 +7483,7 @@ function buildUpgradeGroups(alerts, options) {
 	};
 }
 
-//#endregion
-//#region src/alerts/pnpm-audit-fetcher.ts
+// src/alerts/pnpm-audit-fetcher.ts
 /**
 * 执行 `pnpm audit --json` 并将风险归一化为标准化告警。
 *
@@ -7540,8 +7754,7 @@ function mapAuditRiskToAlert(risk, repository) {
 	};
 }
 
-//#endregion
-//#region src/ai/secrets.ts
+// src/ai/secrets.ts
 /**
 * 对文本中的敏感值做脱敏替换（保留首 4 尾 4 字符便于定位）。
 *
@@ -7567,8 +7780,7 @@ function maskValue(secret) {
 	return `${secret.slice(0, 4)}****${secret.slice(-4)}`;
 }
 
-//#endregion
-//#region src/ai/provider.ts
+// src/ai/provider.ts
 /**
 * AI 调用失败（HTTP 非 2xx / 网络错误）。
 * message 已在本层脱敏（maskSecrets，不含 apiKey）——防御纵深，
@@ -7707,8 +7919,7 @@ function truncate(text, max) {
 	return text.length > max ? `${text.slice(0, max)}…` : text;
 }
 
-//#endregion
-//#region src/ai/schema.ts
+// src/ai/schema.ts
 const replaceBlockSchema = z.object({
 	/**
 	* 需匹配的原文（唯一性校验在应用层：同文件多块必须精确匹配且互不重叠）。
@@ -7790,8 +8001,7 @@ function extractJson(text) {
 	return block ? block[1].trim() : null;
 }
 
-//#endregion
-//#region src/ai/prompt.ts
+// src/ai/prompt.ts
 /** system prompt（硬编码常量；禁止从任何用户输入拼接） */
 const ASSESSMENT_SYSTEM_PROMPT = `你是依赖升级兼容性（breaking change）研判助手。你的任务是根据升级上下文判断依赖升级后的不兼容问题，并输出结构化修复方案。
 
@@ -7853,8 +8063,7 @@ function truncateChars(text, max) {
 	return text.length > max ? `${text.slice(0, max)}…` : text;
 }
 
-//#endregion
-//#region src/ai/usage.ts
+// src/ai/usage.ts
 /** 每百万 token 单价（USD，公开定价推算；DeepSeek 为官方价格，其余为常见模型价） */
 const MODEL_PRICE_TABLE = {
 	"gpt-4o-mini": {
@@ -7932,8 +8141,7 @@ var AiUsageTracker = class {
 	}
 };
 
-//#endregion
-//#region src/ai/index.ts
+// src/ai/index.ts
 const DEFAULT_SCHEMA_RETRIES = 1;
 /**
 * 执行一次 breaking change 研判。
@@ -8000,8 +8208,7 @@ async function assessBreakingChange(options) {
 	};
 }
 
-//#endregion
-//#region src/app/delivery.ts
+// src/app/delivery.ts
 /**
 * 安装类命令判定（与 `verify-project.ts` 的基线安装失败识别同口径）。
 *
@@ -8050,9 +8257,33 @@ function findInstallBlockedReposWithFixes(actions) {
 	const fixRepos = new Set(actions.filter(isDeliverableFix).map((action) => action.repository));
 	return [...new Set(actions.filter(isPreExistingInstallFailure).map((action) => action.repository).filter((repo) => fixRepos.has(repo)))];
 }
+/**
+* 收集给定仓库上「既有失败的安装命令」（去重，保持执行顺序）。
+*
+* 报告与交付降级 issue 正文只引用命令本身：错误文本可能含凭据 / 路径，且会让
+* 失败指纹随日志抖动漂移（见 [pr-delivery-closure.md §16]）。
+*/
+function collectFailingInstallCommands(actions, repositories) {
+	const scoped = new Set(repositories);
+	const commands = [];
+	for (const action of actions) {
+		if (!scoped.has(action.repository) || !isPreExistingInstallFailure(action)) continue;
+		if (!commands.includes(action.target)) commands.push(action.target);
+	}
+	return commands;
+}
+/**
+* 记录一次交付跳过（run 级；`summary.deliverySkipped*` 由 `computeSummary` 据此派生）。
+*
+* 入参用结构化最小面（而非 `AppContext`）以避免 `helpers.ts ↔ delivery.ts` 循环依赖；
+* 返回同一条记录引用，便于调用方创建载体后回填编号。
+*/
+function recordDeliverySkip(target, record) {
+	(target.deliverySkips ?? (target.deliverySkips = [])).push(record);
+	return record;
+}
 
-//#endregion
-//#region src/app/branch-cleanup.ts
+// src/app/branch-cleanup.ts
 /**
 * 清理单个仓库的 dependfix 分支（cleanup-branches 模式循环体）。
 * 分类：已合并（安全清理）/ 已关闭未合并（supersede 孤儿）/ open（跳过）；
@@ -8261,8 +8492,7 @@ function confirmCleanup(ctx, repo, candidates) {
 	});
 }
 
-//#endregion
-//#region src/app/result-assembly.ts
+// src/app/result-assembly.ts
 /**
 * 汇总所有动作到 summary（alertsSkipped / alertsConverged 已在 repo-fix 修复管线中累加）。
 *
@@ -8307,6 +8537,10 @@ function computeSummary(ctx) {
 	summary.lockfileRepairs = lockfileRepairs;
 	summary.verificationsPassed = verificationsPassed;
 	summary.verificationsFailed = verificationsFailed;
+	const deliverySkips = ctx.deliverySkips ?? [];
+	summary.deliverySkipped = new Set(deliverySkips.flatMap((record) => record.repositories)).size;
+	summary.deliverySkipIssues = deliverySkips.filter((record) => record.carrier.issue?.created === true).length;
+	summary.deliverySkipDraftPrs = deliverySkips.filter((record) => Boolean(record.carrier.draftPr)).length;
 }
 function buildRunResult(ctx, aiUsage, supplyChainWarnings) {
 	const reportConfig = {
@@ -8320,6 +8554,7 @@ function buildRunResult(ctx, aiUsage, supplyChainWarnings) {
 		codeScanningEnabled: ctx.config.codeScanningEnabled,
 		codeQualityEnabled: ctx.config.codeQualityEnabled
 	};
+	const alertOutcomes = buildAlertOutcomes(ctx.allAlerts, ctx.allActions, ctx.alertOutcomes);
 	return {
 		runId: ctx.runId,
 		startedAt: ctx.startedAt,
@@ -8335,7 +8570,9 @@ function buildRunResult(ctx, aiUsage, supplyChainWarnings) {
 		alertsDisabled: ctx.alertsDisabled.length > 0 ? ctx.alertsDisabled : void 0,
 		ciAlignment: ctx.ciAlignment && ctx.ciAlignment.length > 0 ? ctx.ciAlignment : void 0,
 		attemptTracking: ctx.attemptTracking && ctx.attemptTracking.length > 0 ? ctx.attemptTracking : void 0,
-		prCheckWatch: ctx.prCheckWatch && ctx.prCheckWatch.attempts.length > 0 ? ctx.prCheckWatch : void 0
+		alertOutcomes: alertOutcomes.length > 0 ? alertOutcomes : void 0,
+		prCheckWatch: ctx.prCheckWatch && ctx.prCheckWatch.attempts.length > 0 ? ctx.prCheckWatch : void 0,
+		deliverySkips: ctx.deliverySkips && ctx.deliverySkips.length > 0 ? ctx.deliverySkips : void 0
 	};
 }
 /**
@@ -8373,7 +8610,8 @@ const SKIPPED_AUDIT_CATEGORIES = /* @__PURE__ */ new Set([
 	"SCRIPT_NOT_FOUND",
 	"PRE_EXISTING_FAILURE",
 	"ENVIRONMENT_ERROR",
-	"ROLLBACK_GRANULARITY_DEGRADED"
+	"ROLLBACK_GRANULARITY_DEGRADED",
+	"BUDGET_EXHAUSTED"
 ]);
 /**
 * 计算退出码：
@@ -8400,8 +8638,7 @@ function computeExitCode(ctx) {
 	return 2;
 }
 
-//#endregion
-//#region src/app/helpers.ts
+// src/app/helpers.ts
 /** 匹配 `pnpm <singleWord>` 模式的命令（可能是 package.json script 引用） */
 /**
 * 解析本次运行要处理的仓库列表。
@@ -8726,7 +8963,7 @@ async function tryLockfileRepair(ctx, repo) {
 * - 提交集合由白名单 + fixer 声明路径决定（`stageAndCommit`）；含未声明的已跟踪改动时抛
 *   `CommitScopeError('UNEXPECTED_CHANGES')`，仅供生成物 / 未跟踪文件时抛 `NO_CHANGES`
 */
-function commitLocalChanges(ctx) {
+async function commitLocalChanges(ctx) {
 	const { logger, workDir, allActions, authProvider } = ctx;
 	if (!isGitRepository(workDir)) {
 		logger.warn(`工作目录不是 git 仓库 — 跳过本地提交（${workDir}）`);
@@ -8738,6 +8975,11 @@ function commitLocalChanges(ctx) {
 	}
 	const installBlockedRepos = findInstallBlockedReposWithFixes(allActions);
 	if (installBlockedRepos.length > 0) {
+		recordDeliverySkip(ctx, {
+			repositories: installBlockedRepos,
+			failingCommands: collectFailingInstallCommands(allActions, installBlockedRepos),
+			carrier: { mode: "skip" }
+		});
 		logger.warn(`Install verification is still failing (pre-existing) after the fix for ${installBlockedRepos.join(", ")} — skipping local commit; fix the execution environment or target repository lockfile first`);
 		return;
 	}
@@ -8748,7 +8990,7 @@ function commitLocalChanges(ctx) {
 	ensureGitignore(workDir);
 	const commitMessage = buildCommitMessage(allActions);
 	const author = authProvider?.getCommitAuthor();
-	const scope = stageAndCommit(commitMessage, workDir, author, { declaredPaths: collectDeclaredPaths(allActions) });
+	const scope = await stageAndCommit(commitMessage, workDir, author, { declaredPaths: collectDeclaredPaths(allActions) });
 	if (scope.ignored.length > 0) logger.info(`Not committing ${scope.ignored.length} generated / undeclared path(s): ${scope.ignored.join(", ")}`);
 	if (scope.missing.length > 0) logger.warn(`Declared path(s) had no changes in the worktree: ${scope.missing.join(", ")}`);
 	logger.info(`Committed fix changes to current branch: ${commitMessage.split("\n")[0]}`);
@@ -8866,8 +9108,7 @@ function buildPrTitle(summary, actions) {
 	return parts.length > 0 ? `chore(deps): automated security fix — ${parts.join(", ")}` : "chore(deps): automated security fix";
 }
 
-//#endregion
-//#region src/runners/verification-gate.ts
+// src/runners/verification-gate.ts
 /**
 * 单仓库是否被「本次改动引入的验证失败」阻断。
 *
@@ -8894,10 +9135,14 @@ function findVerificationFailedRepos(repoResults) {
 * - 仅限验证失败且尚未提交的场景；不清理未跟踪文件（避免误删用户文件；
 *   node_modules 等未跟踪目录保留，下次 install 自愈）
 */
-function rollbackChanges(workDir) {
-	execSync("git reset --hard HEAD", {
+async function rollbackChanges(workDir) {
+	await runGitOrThrow([
+		"reset",
+		"--hard",
+		"HEAD"
+	], {
 		cwd: workDir,
-		stdio: "pipe"
+		what: "rollback worktree"
 	});
 }
 /**
@@ -8917,10 +9162,14 @@ function rollbackChanges(workDir) {
 * - 多仓库共享 workDir 时文件级改动无法按仓拆分；选择性回滚按当前仓库最近 checkpoint 处理，
 *   失败时显式记录 `ROLLBACK_GRANULARITY_DEGRADED` 后退回整仓回滚
 */
-function enforceVerificationGate(ctx, options) {
+async function enforceVerificationGate(ctx, options) {
 	const failedRepos = findVerificationFailedRepos(ctx.repoResults);
 	if (failedRepos.length === 0) return false;
 	const { logger, workDir, allErrors } = ctx;
+	if (failedRepos.every((repo) => ctx.repoResults.find((result) => result.repository === repo)?.verificationSkipped === "budget")) {
+		logger.warn(`Verification skipped by run budget for: ${failedRepos.join(", ")} — delivery skipped (worktree preserved; no changes were rolled back)`);
+		return true;
+	}
 	const actionLabel = options.action === "pr" ? "PR creation" : "local commit";
 	const repoList = failedRepos.join(", ");
 	logger.error(`Verification failed for: ${repoList} — skipping ${actionLabel}`);
@@ -8939,9 +9188,13 @@ function enforceVerificationGate(ctx, options) {
 		return true;
 	}
 	try {
-		rollbackChanges(workDir);
+		await rollbackChanges(workDir);
 		logger.info("Changes rolled back");
 	} catch (error) {
+		if (error instanceof GitCommandError && error.aborted && !error.started) {
+			logger.warn("Run aborted before rollback started — worktree left as-is (caller cleans up)");
+			return true;
+		}
 		const message = toErrorMessage(error);
 		logger.error(`Rollback failed: ${message}`);
 		allErrors.push({
@@ -8954,8 +9207,7 @@ function enforceVerificationGate(ctx, options) {
 	return true;
 }
 
-//#endregion
-//#region src/supply-chain/index.ts
+// src/supply-chain/index.ts
 /**
 * 供应链信号披露（安全治理：路径 A"合法包被投毒"合入前人工确认的关键依据）。
 *
@@ -9128,8 +9380,7 @@ function unquote(value) {
 	return value;
 }
 
-//#endregion
-//#region src/app/github-client.ts
+// src/app/github-client.ts
 /** 构造主 token client（429 / 限流按配置指数退避）。 */
 function createConfiguredGitHubClient(config) {
 	return createGitHubClient({ auth: fromPat(config.githubToken, { retry: {
@@ -9142,8 +9393,7 @@ function createConfiguredGitHubClientOrNull(config) {
 	return config.alertSource === "pnpm-audit" ? null : createConfiguredGitHubClient(config);
 }
 
-//#endregion
-//#region src/app/build-info.ts
+// src/app/build-info.ts
 /**
 * 运行构建版本回执：回答「本次运行由哪个构建版本 / commit 执行」。
 *
@@ -9210,8 +9460,7 @@ const resolveRunBuildInfo = (config = {}, deps = {}) => {
 */
 const formatEngineBuildLine = (info) => `[build] dependfix version=${info.version} commit=${info.commit} source=${info.source}`;
 
-//#endregion
-//#region src/app/token-hints.ts
+// src/app/token-hints.ts
 /**
 * PR 创建失败的用户指引。
 * 识别 GITHUB_TOKEN 创建 PR 被仓库设置禁用的 403（"GitHub Actions is not
@@ -9309,8 +9558,7 @@ function alertsFetchTokenHint(error) {
 	return dependabotAlertsTokenHint(error) ?? codeScanningAlertsTokenHint(error) ?? codeQualityAlertsTokenHint(error);
 }
 
-//#endregion
-//#region src/app/repo-alerts.ts
+// src/app/repo-alerts.ts
 /**
 * 告警数据源统一入口：
 * - `github-dependabot`：Octokit 拉取 Dependabot alerts（alertsToken 优先）；
@@ -9453,8 +9701,7 @@ function truncatedWarning(config, truncatedCount) {
 	return config.codeScanningEnabled ? `${base}; code-scanning alerts rank after fixable dependabot alerts` : base;
 }
 
-//#endregion
-//#region src/app/abort.ts
+// src/app/abort.ts
 /**
 * 记录一次运行级中止（幂等：同一运行的重复调用不再重复留痕）。
 *
@@ -9502,8 +9749,7 @@ function abortBlocksDelivery(ctx, action) {
 	return true;
 }
 
-//#endregion
-//#region src/app/repo-report.ts
+// src/app/repo-report.ts
 /**
 * 处理单个仓库的 report-only 抓取，把告警与仓库结果写入上下文。
 *
@@ -9558,8 +9804,7 @@ async function processRepoForReport(ctx, client, repo) {
 	}
 }
 
-//#endregion
-//#region src/app/override-protect.ts
+// src/app/override-protect.ts
 /**
 * 判定 overrides 保护名单；命中则记审计并返回 noOp 动作，未命中返回 null。
 *
@@ -9594,8 +9839,7 @@ function handleOverrideProtection(ctx, params) {
 	};
 }
 
-//#endregion
-//#region src/fixers/dependency/families.ts
+// src/fixers/dependency/families.ts
 /**
 * 首批家族清单（2026-10-24 巡检驱动）。
 *
@@ -9873,8 +10117,7 @@ function rangeAllows(version, range) {
 	}
 }
 
-//#endregion
-//#region src/fixers/dependency/family-versions.ts
+// src/fixers/dependency/family-versions.ts
 const DEFAULT_REGISTRY_BASE_URL = "https://registry.npmjs.org";
 const DEFAULT_TIMEOUT_MS = 1e4;
 /** 单个 resolver 缓存上限（包数量级，超限整体清空，防长驻进程无界增长） */
@@ -10033,8 +10276,43 @@ function redactBaseUrl(message, baseUrl, host) {
 	return baseUrl ? message.split(baseUrl).join(host) : message;
 }
 
-//#endregion
-//#region src/app/environmental-failure.ts
+// src/app/alert-outcomes.ts
+/**
+* 写入单条告警的处置结果。
+*
+* 缺 `upstreamId` 的告警无法与平台 `ScanResult` 对齐（唯一索引依赖它），只 warn 不写入。
+*/
+function record(sink, alert, status, reason) {
+	const outcomeSink = sink.alertOutcomes;
+	if (!outcomeSink) return;
+	if (!alert.upstreamId) {
+		sink.logger?.warn(`[alert-outcome] ${alert.repository}: ${alert.packageName} has no upstreamId — result not recorded`);
+		return;
+	}
+	outcomeSink.set(alertOutcomeKey(alert), {
+		repository: alert.repository,
+		source: alert.source,
+		upstreamId: alert.upstreamId,
+		manifestPath: alert.manifestPath,
+		status,
+		reason
+	});
+}
+/**
+* 记录「已收敛」告警。
+*
+* 调用方必须用**同一数组**同时累加 `RunSummary.alertsConverged` 与调用本函数，
+* 才能保证明细与计数逐条对齐（平台据此剔除「未修复」明细）。
+*/
+function recordConvergedAlerts(sink, alerts, reason) {
+	for (const alert of alerts) record(sink, alert, "converged", reason);
+}
+/** 记录「主动跳过」告警；原因取 `SKIP_REASONS` 标识，便于消费方按原因聚合。 */
+function recordSkippedAlerts(sink, alerts, reason) {
+	for (const alert of alerts) record(sink, alert, "skipped", reason);
+}
+
+// src/app/environmental-failure.ts
 /**
 * 记一条 `ENVIRONMENT_ERROR` 审计条目并返回动作标记。
 *
@@ -10057,8 +10335,7 @@ function markEnvironmentalInstallFailure(ctx, params) {
 	return { environmentalFailure: true };
 }
 
-//#endregion
-//#region src/app/family-upgrade.ts
+// src/app/family-upgrade.ts
 /**
 * 尝试按家族锁步升级告警对应的直接依赖。
 *
@@ -10248,6 +10525,7 @@ function blockedAttempt(ctx, alert, plan, startedAt, triggerFromVersion) {
 		message: reason
 	});
 	addSkipped(ctx.summary, "override-protected");
+	recordSkippedAlerts(ctx, [alert], "override-protected");
 	return {
 		status: "blocked",
 		plan,
@@ -10328,8 +10606,7 @@ function buildAction(alert, versions, startedAt, outcome, family) {
 	};
 }
 
-//#endregion
-//#region src/app/upgrade-alert.ts
+// src/app/upgrade-alert.ts
 /**
 * 升级单个告警对应的依赖（dry-run 仅记录）。
 * 优先家族锁步（同生态成员同版本线），其次直接升级，失败且为间接依赖时回退到 pnpm overrides。
@@ -10373,7 +10650,10 @@ async function upgradeAlert(ctx, alert, options = {}) {
 				toVersion: alert.recommendedVersion,
 				scope: "override"
 			});
-			if (protectedAction) return protectedAction;
+			if (protectedAction) {
+				recordSkippedAlerts(ctx, [alert], "override-protected");
+				return protectedAction;
+			}
 			strategy = "override";
 			result = await overrideTransitiveDependency({
 				packageName: alert.packageName,
@@ -10439,8 +10719,59 @@ async function upgradeAlert(ctx, alert, options = {}) {
 	}
 }
 
-//#endregion
-//#region src/app/verification-checkpoint.ts
+// src/app/budget.ts
+/**
+* 启动新步骤所需的最小剩余预算。
+*
+* 取 1 分钟：低于该值时，一次安装 / 验证几乎必然被平台超时打断，只会产出
+* 「执行中被杀」的失败噪声；停止启动新工作更符合「已完成的修复仍交付」的取舍。
+*/
+const MIN_STEP_BUDGET_MS = 6e4;
+/** 剩余预算（毫秒）；未设置截止时间时返回 `undefined`。 */
+function remainingBudgetMs(deadlineAt, now = Date.now()) {
+	if (deadlineAt === void 0) return;
+	return deadlineAt - now;
+}
+/** 是否还有足够预算启动下一个步骤（未设置截止时间 → `true`）。 */
+function hasBudgetForNextStep(deadlineAt, now = Date.now()) {
+	const remaining = remainingBudgetMs(deadlineAt, now);
+	return remaining === void 0 || remaining >= 6e4;
+}
+/**
+* 记录一次「预算不足 → 跳过启动新工作」。
+*
+* 审计条目进入 `allErrors`（报告 Errors 表可见），但 `BUDGET_EXHAUSTED` 在跳过类白名单内，
+* 不影响 exit code / 仓库成功判定。同一 `repository:stage:work` 只记一次（循环里逐包命中不刷屏；
+* 多仓运行时每个仓库各自留痕）。
+*/
+function recordBudgetExhausted(target, input) {
+	const key = `${input.repository}:${input.stage}:${input.work}`;
+	const seen = target.budgetSkips;
+	if (seen?.has(key)) return;
+	seen?.add(key);
+	const remaining = remainingBudgetMs(target.deadlineAt);
+	const remainingText = remaining === void 0 ? "unknown" : `${Math.max(0, remaining)}ms`;
+	target.logger.warn(`[budget] ${input.repository}: run budget exhausted (remaining ${remainingText}, minimum ${MIN_STEP_BUDGET_MS}ms) — skipping ${input.work}`);
+	target.allErrors.push({
+		repository: input.repository,
+		stage: input.stage,
+		category: "BUDGET_EXHAUSTED",
+		message: `Run budget exhausted before ${input.work} (remaining ${remainingText}); no new work was started. Already-verified units are still delivered.`
+	});
+}
+/**
+* 预算检查 + 留痕的组合入口：返回 `false` 表示调用方应停止启动新工作。
+*
+* 典型用法（每包 / 每组 / 每次验证前）：
+* `if (!budgetAllows(ctx, { repository: repo, stage: 'fix', work: 'package upgrade' })) break`。
+*/
+function budgetAllows(target, input, now = Date.now()) {
+	if (hasBudgetForNextStep(target.deadlineAt, now)) return true;
+	recordBudgetExhausted(target, input);
+	return false;
+}
+
+// src/app/verification-checkpoint.ts
 /** 当前仓库最近一个 checkpoint（按记录顺序）。 */
 const findLatestVerificationCheckpoint = (ctx, repository) => {
 	const checkpoints = ctx.verificationCheckpoints ?? [];
@@ -10451,32 +10782,25 @@ const findLatestVerificationCheckpoint = (ctx, repository) => {
 * `git stash create` 只捕获已跟踪文件；未跟踪文件（如 AI 新建源码）不在本批范围。
 * 工作区干净时回退到 HEAD，保证首个单元也有可回退基线。
 */
-const recordVerificationCheckpoint = (ctx, repo, progress, label) => {
+const recordVerificationCheckpoint = async (ctx, repo, progress, label) => {
 	if (ctx.config.dryRun || (ctx.config.rollbackGranularity ?? "unit") !== "unit" || !ctx.verificationCheckpoints) return;
 	if (!isGitRepository(ctx.workDir)) return;
 	try {
-		let id = execFileSync("git", [
+		const stash = await runGit([
 			"stash",
 			"create",
 			`dependfix:${repo}:${label}`
-		], {
-			cwd: ctx.workDir,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		}).trim();
-		if (!id) id = execFileSync("git", ["rev-parse", "HEAD"], {
+		], { cwd: ctx.workDir });
+		if (!stash.started) return;
+		let id = stash.stdout.trim();
+		if (!id && stash.code !== 0) {
+			ctx.logger.warn(`[rollback] failed to create verification checkpoint for ${repo} (${label}): git stash create exited with code ${stash.code}${stash.stderr.trim() ? ` — ${stash.stderr.trim().slice(-200)}` : ""}`);
+			return;
+		}
+		if (!id) id = (await runGitOrThrow(["rev-parse", "HEAD"], {
 			cwd: ctx.workDir,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		}).trim();
+			what: "resolve checkpoint HEAD"
+		})).trim();
 		if (!id) return;
 		const checkpoint = {
 			id,
@@ -10499,15 +10823,15 @@ const recordVerificationCheckpoint = (ctx, repo, progress, label) => {
 	}
 };
 /** 恢复 checkpoint：工作树 / 暂存区回到 checkpoint，HEAD 不变。 */
-const restoreCheckpoint = (ctx, checkpoint) => {
-	execFileSync("git", [
+const restoreCheckpoint = async (ctx, checkpoint) => {
+	await runGitOrThrow([
 		"read-tree",
 		"--reset",
 		"-u",
 		checkpoint.id
 	], {
 		cwd: ctx.workDir,
-		stdio: "pipe"
+		what: "restore verification checkpoint"
 	});
 };
 const restoreProgressAndActions = (ctx, progress, checkpoint) => {
@@ -10563,7 +10887,7 @@ const attemptSelectiveUnitRollback = async (ctx, repo, progress, verify, options
 		};
 	}
 	try {
-		restoreCheckpoint(ctx, checkpoint);
+		await restoreCheckpoint(ctx, checkpoint);
 		restoreProgressAndActions(ctx, progress, checkpoint);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -10607,8 +10931,7 @@ const attemptSelectiveUnitRollback = async (ctx, repo, progress, verify, options
 	};
 };
 
-//#endregion
-//#region src/app/upgrade-failure.ts
+// src/app/upgrade-failure.ts
 /**
 * 记一次升级失败：失败计数自增 + 日志留痕。
 *
@@ -10623,8 +10946,7 @@ function recordUpgradeFailure(ctx, counter, scope, name, error) {
 	ctx.logger.warn(`[${scope}] ${name}: upgrade failed — ${error || "no error detail"}`);
 }
 
-//#endregion
-//#region src/app/repo-fix-member.ts
+// src/app/repo-fix-member.ts
 /**
 * 步骤 3：成员级升级（workspace 成员 manifest 直接依赖；member 桶准入已保证：
 * 成员白名单 + 直接声明 + fixable + 单版本 + 非跨线）。按「包名 + manifestDir」
@@ -10657,6 +10979,11 @@ async function applyMemberUpgrades(ctx, repo, sets, progress) {
 	}
 	for (const item of [...memberByPackageAndDir.values()]) {
 		const { alert, manifestDir } = item;
+		if (!budgetAllows(ctx, {
+			repository: repo,
+			stage: "fix",
+			work: `member upgrade ${alert.packageName}`
+		})) return false;
 		const memberManifestPath = `${manifestDir}/package.json`;
 		if (ctx.config.dryRun) {
 			ctx.logger.info(`[dry-run] Would upgrade ${alert.packageName} in ${memberManifestPath} → ${alert.recommendedVersion}`);
@@ -10676,7 +11003,7 @@ async function applyMemberUpgrades(ctx, repo, sets, progress) {
 			continue;
 		}
 		const memberSnapshot = snapshotTrackedFiles(ctx.workDir, [memberManifestPath]);
-		recordVerificationCheckpoint(ctx, repo, progress, `member-upgrade:${alert.packageName}`);
+		await recordVerificationCheckpoint(ctx, repo, progress, `member-upgrade:${alert.packageName}`);
 		ctx.logger.warn(`[member-upgrade] ${alert.packageName}: upgrading member declaration in ${memberManifestPath} → ${alert.recommendedVersion}`);
 		const familyAttempt = await attemptFamilyUpgrade(ctx, {
 			alert,
@@ -10783,8 +11110,7 @@ async function applyMemberUpgrades(ctx, repo, sets, progress) {
 	return false;
 }
 
-//#endregion
-//#region src/app/repo-fix-batch.ts
+// src/app/repo-fix-batch.ts
 /**
 * 尝试合批应用版本化 overrides（调用方仅在条目数 ≥ 2 时调用）。
 *
@@ -10793,9 +11119,18 @@ async function applyMemberUpgrades(ctx, repo, sets, progress) {
 *          `skipSequential: true` = 环境性失败（信号 / 超时 / 无 stderr 诊断），逐包重试无归因价值且会耗尽预算
 */
 async function tryBatchVersionedOverrides(ctx, repo, progress, items) {
+	if (!budgetAllows(ctx, {
+		repository: repo,
+		stage: "fix",
+		work: `batched versioned overrides (${items.length} packages)`
+	})) return {
+		applied: false,
+		budgetStop: true,
+		reason: "run budget exhausted"
+	};
 	const snapshot = snapshotTrackedFiles(ctx.workDir);
 	const packages = items.map((item) => item.alert.packageName);
-	recordVerificationCheckpoint(ctx, repo, progress, `versioned-override-batch:${packages.join(",")}`);
+	await recordVerificationCheckpoint(ctx, repo, progress, `versioned-override-batch:${packages.join(",")}`);
 	ctx.logger.info(`[multi-version] 合批 ${items.length} 个包：${packages.join(", ")}（一次安装 + 组级验证）`);
 	const result = await applyVersionedOverridesBatch({
 		workDir: ctx.workDir,
@@ -10855,8 +11190,7 @@ async function tryBatchVersionedOverrides(ctx, repo, progress, items) {
 	return { applied: true };
 }
 
-//#endregion
-//#region src/app/verify-project.ts
+// src/app/verify-project.ts
 /** 日志中的外部可控文本（YAML 解析原因等）单行夹取，避免多行片段污染日志。 */
 function clipLogText(text, maxLength = 200) {
 	const safe = text.replace(/\s+/g, " ").trim();
@@ -11045,6 +11379,14 @@ async function verifyProject(ctx, repo, options = {}) {
 		logger.info(`No verification commands to run for ${repo}`);
 		return [];
 	}
+	if (!budgetAllows(ctx, {
+		repository: repo,
+		stage: "verify",
+		work: "post-fix verification"
+	})) {
+		options.onSkip?.("budget");
+		return [];
+	}
 	const baselineFailedCommands = new Set((options.baseline ?? []).filter((cr) => cr.exitCode !== 0).map((cr) => cr.command));
 	try {
 		const result = await runVerification({
@@ -11109,8 +11451,7 @@ async function verifyProject(ctx, repo, options = {}) {
 	}
 }
 
-//#endregion
-//#region src/app/repo-fix-finalize.ts
+// src/app/repo-fix-finalize.ts
 /**
 * 惰性取得本次运行修复前的验证基线（每运行一次），并返回本仓库的归因豁免判定。
 * dry-run 不做验证，因此也不需要基线。
@@ -11123,6 +11464,11 @@ async function verifyProject(ctx, repo, options = {}) {
 */
 async function ensureVerificationBaseline(ctx, repo, options) {
 	if (ctx.config.dryRun || !ctx.verificationBaseline) return { exemptAttribution: false };
+	if (!budgetAllows(ctx, {
+		repository: repo,
+		stage: "verify",
+		work: "pre-fix baseline sampling"
+	})) return { exemptAttribution: false };
 	if (ctx.verificationBaseline.value) return {
 		exemptAttribution: false,
 		baseline: ctx.verificationBaseline.repo === repo ? ctx.verificationBaseline.value : void 0
@@ -11174,7 +11520,11 @@ function recordInstallBaselineFailure(ctx, repo, baseline) {
 */
 async function finalizeRepoFix(ctx, repo, progress, options = {}) {
 	let lockfileRepairFailed = false;
-	if (progress.alertsCount > 0 && options.exemptAttribution !== true) {
+	if (progress.alertsCount > 0 && options.exemptAttribution !== true && budgetAllows(ctx, {
+		repository: repo,
+		stage: "repair",
+		work: "lockfile repair"
+	})) {
 		const repairAction = await tryLockfileRepair(ctx, repo);
 		ctx.allActions.push(repairAction);
 		lockfileRepairFailed = !repairAction.success && !repairAction.noOp;
@@ -11183,32 +11533,50 @@ async function finalizeRepoFix(ctx, repo, progress, options = {}) {
 	else ctx.logger.info(`[skip] No effective work for ${repo} — skipping lockfile repair (workspace stays pristine for attribution)`);
 	const lockfileRepairChanged = progress.lockfileRepaired;
 	if (!ctx.config.dryRun) {
+		let budgetSkipped = false;
 		const verifyOptions = {
 			baseline: currentBaseline(ctx),
 			noChanges: options.exemptAttribution === true,
 			ciAlignment: {
 				client: options.client ?? null,
 				defaultBranch: progress.defaultBranch
+			},
+			onSkip: (reason) => {
+				if (reason === "budget") budgetSkipped = true;
 			}
 		};
 		let verifyActions = await verifyProject(ctx, repo, verifyOptions);
 		let blocking = verifyActions.some((a) => !a.success && !a.preExisting);
-		if (blocking && (ctx.config.rollbackGranularity ?? "unit") === "unit" && !options.exemptAttribution && !ctx.preExistingDirty && !lockfileRepairFailed) {
+		const firstVerificationSkipped = budgetSkipped;
+		if (!firstVerificationSkipped && blocking && (ctx.config.rollbackGranularity ?? "unit") === "unit" && !options.exemptAttribution && !ctx.preExistingDirty && !lockfileRepairFailed) {
 			const outcome = await attemptSelectiveUnitRollback(ctx, repo, progress, () => verifyProject(ctx, repo, verifyOptions), { beforeVerify: async () => {
-				if (lockfileRepairChanged && progress.alertsCount > 0) {
+				if (lockfileRepairChanged && progress.alertsCount > 0 && budgetAllows(ctx, {
+					repository: repo,
+					stage: "repair",
+					work: "lockfile repair after selective rollback"
+				})) {
 					const repairAction = await tryLockfileRepair(ctx, repo);
 					ctx.allActions.push(repairAction);
 					if (repairAction.success && !repairAction.noOp) progress.lockfileRepaired = true;
 				}
 			} });
 			if (outcome.applied) {
-				verifyActions = outcome.verifyActions;
-				blocking = outcome.blocking;
+				if (budgetSkipped) blocking = true;
+				else {
+					verifyActions = outcome.verifyActions;
+					blocking = outcome.blocking;
+				}
 			}
 		}
 		ctx.allActions.push(...verifyActions);
-		progress.verificationPassed = verifyActions.every((a) => a.success);
-		progress.verificationBlocking = blocking;
+		if (firstVerificationSkipped) {
+			progress.verificationPassed = void 0;
+			progress.verificationBlocking = true;
+			progress.verificationSkipped = "budget";
+		} else {
+			progress.verificationPassed = verifyActions.every((a) => a.success);
+			progress.verificationBlocking = blocking;
+		}
 	} else {
 		ctx.logger.info(`[dry-run] Skipping verification for ${repo}`);
 		progress.verificationPassed = void 0;
@@ -11216,8 +11584,7 @@ async function finalizeRepoFix(ctx, repo, progress, options = {}) {
 	}
 }
 
-//#endregion
-//#region src/ai/changelog-fetcher.ts
+// src/ai/changelog-fetcher.ts
 /** breaking 段落标题启发式（标题行命中任一关键词即进入收集模式；词边界防子串误匹配） */
 const BREAKING_HEADING_RE = /\bbreaking\s*changes?\b|\bbreaking-changes\b|\bmigration\b|⚠️|🚨/i;
 /** 收集模式的列表项行（`- ` / `* ` / `+ ` / `1. `，允许缩进） */
@@ -11370,8 +11737,7 @@ function extractBreakingChanges(markdown) {
 	return entries;
 }
 
-//#endregion
-//#region src/ai/patch-applier.ts
+// src/ai/patch-applier.ts
 /**
 * 应用 AI 结构化修改到工作区。
 *
@@ -11540,8 +11906,7 @@ function failure(error, appliedFiles, rollback) {
 	};
 }
 
-//#endregion
-//#region src/ai/safety-gate.ts
+// src/ai/safety-gate.ts
 const DEFAULT_MAX_FILES = 5;
 /** 敏感信息模式（凭据/token/私钥）——命中即拒绝（防泄露进 PR/报告） */
 const SECRET_PATTERNS = [
@@ -11615,8 +11980,7 @@ function validateAiChanges(workDir, changes, options = {}) {
 	};
 }
 
-//#endregion
-//#region src/ai/app-integration.ts
+// src/ai/app-integration.ts
 /**
 * 执行一次 AI 研判集成（changelog 采集 → 研判 → 分流）。
 *
@@ -11776,8 +12140,7 @@ function logUsage(logger, packageName, model, usage) {
 	logger.info(`[ai] ${packageName} 研判消耗: ${usage.calls} 次调用, ${usage.inputTokens} in / ${usage.outputTokens} out tokens${costText} (${model})`);
 }
 
-//#endregion
-//#region src/app/repo-fix-major.ts
+// src/app/repo-fix-major.ts
 async function applyAutoMajorUpgrades(ctx, params) {
 	const { client, repo, lockfilePath, alerts: autoMajorAlerts, progress } = params;
 	let stopReason;
@@ -11793,6 +12156,11 @@ async function applyAutoMajorUpgrades(ctx, params) {
 	const majorFamilyTargets = {};
 	for (const alert of autoMajorRepresentatives) if (alert.recommendedVersion) majorFamilyTargets[alert.packageName] = alert.recommendedVersion;
 	for (const alert of autoMajorRepresentatives) {
+		if (!budgetAllows(ctx, {
+			repository: repo,
+			stage: "fix",
+			work: `major upgrade ${alert.packageName}`
+		})) return;
 		if (ctx.config.dryRun) {
 			ctx.logger.info(`[dry-run] Would apply major upgrade for ${alert.packageName} → ${alert.recommendedVersion}`);
 			ctx.allActions.push({
@@ -11810,7 +12178,7 @@ async function applyAutoMajorUpgrades(ctx, params) {
 			continue;
 		}
 		const majorSnapshot = snapshotTrackedFiles(ctx.workDir);
-		recordVerificationCheckpoint(ctx, repo, progress, `major-upgrade:${alert.packageName}`);
+		await recordVerificationCheckpoint(ctx, repo, progress, `major-upgrade:${alert.packageName}`);
 		ctx.logger.warn(`[major-upgrade] ${alert.packageName}: applying cross-major upgrade → ${alert.recommendedVersion} (explicit --allow-major-upgrade; full verification required)`);
 		const familyAttempt = await attemptFamilyUpgrade(ctx, {
 			alert,
@@ -11941,8 +12309,7 @@ async function applyAutoMajorUpgrades(ctx, params) {
 	return stopReason;
 }
 
-//#endregion
-//#region src/app/repeated-failure.ts
+// src/app/repeated-failure.ts
 /** 同键允许的已关闭尝试次数：第 1 / 2 次执行，第 3 次起跳过。 */
 const REPEATED_FAILURE_ATTEMPT_LIMIT = 2;
 /**
@@ -12001,6 +12368,7 @@ async function applyRepeatedFailureSkips(options) {
 			skippedIds.add(alert.id);
 			ctx.allActions.push(createSkippedAction(alert));
 			addSkipped(ctx.summary, "repeated-failure");
+			recordSkippedAlerts(ctx, [alert], "repeated-failure");
 			ctx.logger.warn(`[repeated-failure] ${alert.repository}: ${alert.packageName} → ${alert.recommendedVersion} already failed ${attempt - 1} time(s) (attempt ${attempt}/${2}) — skipped; use --retry-failed to force another attempt`);
 		} else if (forced) ctx.logger.warn(`[repeated-failure] ${alert.repository}: ${alert.packageName} → ${alert.recommendedVersion} attempt ${attempt}/${2} exceeded — forced retry (--retry-failed)`);
 		ctx.attemptTracking?.push({
@@ -12045,8 +12413,7 @@ function createSkippedAction(alert) {
 	};
 }
 
-//#endregion
-//#region src/app/repo-fix.ts
+// src/app/repo-fix.ts
 /**
 * 单仓库修复管线编排器（原 processRepoForFix）：
 * 抓取 → 模板修复 → lockfile 脆弱实例（版本化 overrides / 跨线 / 成员）→
@@ -12103,6 +12470,7 @@ async function processRepoFix(ctx, client, repo) {
 		lockfileRepaired: progress.lockfileRepaired,
 		verificationPassed: progress.verificationPassed,
 		verificationBlocking: progress.verificationBlocking,
+		verificationSkipped: progress.verificationSkipped,
 		durationMs: Date.now() - startTime
 	});
 }
@@ -12170,9 +12538,11 @@ async function prepareRepoFixSets(ctx, repo, planned, limited, progress) {
 	if (submanifestAlerts.length > 0) {
 		ctx.logger.warn(`[alerts] ${submanifestAlerts.length} alert(s) from sub-directory / root-direct-dep manifest(s) skipped — manual review required: ${submanifestAlerts.map((a) => `${a.packageName} (${a.manifestPath})`).join(", ")}`);
 		addSkipped(ctx.summary, "subdirectory-manifest", submanifestAlerts.length);
+		recordSkippedAlerts(ctx, submanifestAlerts, "subdirectory-manifest");
 	}
-	const notFixableCount = rootManifestAlerts.filter((alert) => !alert.fixable || !alert.recommendedVersion).length;
-	addSkipped(ctx.summary, "not-fixable", notFixableCount);
+	const notFixableAlerts = rootManifestAlerts.filter((alert) => !alert.fixable || !alert.recommendedVersion);
+	addSkipped(ctx.summary, "not-fixable", notFixableAlerts.length);
+	recordSkippedAlerts(ctx, notFixableAlerts.filter((alert) => !alert.fixable), "not-fixable");
 	return {
 		rootManifestAlerts,
 		memberManifestAlerts,
@@ -12197,6 +12567,7 @@ async function applyLockfileFixes(ctx, client, repo, sets, progress) {
 	if (manualCrossMajorAlerts.length > 0) {
 		ctx.logger.warn(`[alerts] ${manualCrossMajorAlerts.length} alert(s) require a cross-major upgrade (no fix within the installed major line) — manual review required: ${manualCrossMajorAlerts.map((a) => `${a.packageName} → ${a.recommendedVersion}`).join(", ")}`);
 		addSkipped(ctx.summary, "cross-major", manualCrossMajorAlerts.length);
+		recordSkippedAlerts(ctx, manualCrossMajorAlerts, "cross-major");
 	}
 	const autoMajorAlerts = lockfileManifestAlerts.filter((a) => autoMajorAlertIds.has(a.id));
 	const fixableLockfileAlerts = lockfileManifestAlerts.filter((a) => !crossMajorAlertIds.has(a.id) && !autoMajorAlertIds.has(a.id));
@@ -12224,6 +12595,7 @@ async function applyLockfileFixes(ctx, client, repo, sets, progress) {
 		});
 		if (protectedAction) {
 			ctx.allActions.push(protectedAction);
+			recordSkippedAlerts(ctx, [alert], "override-protected");
 			continue;
 		}
 		const versionedOverrides = versionedOverridesByPackage.get(alert.packageName) ?? {};
@@ -12247,7 +12619,9 @@ async function applyLockfileFixes(ctx, client, repo, sets, progress) {
 		}
 		if (Object.keys(versionedOverrides).length === 0) {
 			ctx.logger.info(`Skipping ${alert.packageName}: no vulnerable instances below targets`);
-			ctx.summary.alertsConverged += multiVersionAlerts.filter((a) => a.packageName === alert.packageName).length;
+			const convergedAlerts = multiVersionAlerts.filter((a) => a.packageName === alert.packageName);
+			ctx.summary.alertsConverged += convergedAlerts.length;
+			recordConvergedAlerts(ctx, convergedAlerts, "no vulnerable instances below targets");
 			continue;
 		}
 		batchItems.push({
@@ -12258,6 +12632,13 @@ async function applyLockfileFixes(ctx, client, repo, sets, progress) {
 	}
 	const batchOutcome = batchItems.length > 1 ? await tryBatchVersionedOverrides(ctx, repo, progress, batchItems) : { applied: false };
 	const itemsToRetry = batchOutcome.applied || batchOutcome.skipSequential ? [] : batchItems;
+	if (batchOutcome.budgetStop) {
+		stopReason = "budget";
+		return {
+			singleVersionAlerts,
+			stopReason
+		};
+	}
 	if (batchOutcome.skipSequential) {
 		stopReason = isAbortRequested() ? "aborted" : "environmental";
 		return {
@@ -12270,8 +12651,16 @@ async function applyLockfileFixes(ctx, client, repo, sets, progress) {
 			stopReason = "aborted";
 			break;
 		}
+		if (!budgetAllows(ctx, {
+			repository: repo,
+			stage: "fix",
+			work: `versioned override for ${alert.packageName}`
+		})) {
+			stopReason = "budget";
+			break;
+		}
 		const snapshot = snapshotTrackedFiles(ctx.workDir);
-		recordVerificationCheckpoint(ctx, repo, progress, `versioned-override:${alert.packageName}`);
+		await recordVerificationCheckpoint(ctx, repo, progress, `versioned-override:${alert.packageName}`);
 		ctx.logger.info(`[multi-version] ${alert.packageName}: applying versioned overrides`, { overrides: versionedOverrides });
 		const result = await applyVersionedOverrides({
 			packageName: alert.packageName,
@@ -12358,12 +12747,22 @@ async function applyGroupUpgrades(ctx, repo, sets, singleVersionAlerts, progress
 	for (const alert of fixableAlerts) if (alert.recommendedVersion) familyTargets[alert.packageName] = alert.recommendedVersion;
 	let snapshot;
 	for (const group of groups) {
+		if (!budgetAllows(ctx, {
+			repository: repo,
+			stage: "fix",
+			work: `group upgrade "${group.name}"`
+		})) return;
 		snapshot = snapshotTrackedFiles(ctx.workDir);
-		recordVerificationCheckpoint(ctx, repo, progress, `group:${group.name}`);
+		await recordVerificationCheckpoint(ctx, repo, progress, `group:${group.name}`);
 		const pendingActions = [];
 		const upgradedInGroup = [];
 		let environmentalStop = false;
 		for (const packageName of group.packages) {
+			if (!budgetAllows(ctx, {
+				repository: repo,
+				stage: "fix",
+				work: `package upgrade (group "${group.name}")`
+			})) break;
 			const alert = alertByPackage.get(packageName);
 			if (!alert) continue;
 			const lockedVersions = readLockfileVersions(lockfilePath, alert.packageName);
@@ -12372,11 +12771,14 @@ async function applyGroupUpgrades(ctx, repo, sets, singleVersionAlerts, progress
 				const belowTarget = lockedVersions.filter((version) => compareSemver(version, alert.recommendedVersion) < 0);
 				if (belowTarget.length === 0) {
 					ctx.logger.info(`Skipping ${alert.packageName}: all locked versions ${lockedVersions.join(", ")} >= target ${alert.recommendedVersion} (no upgrade needed)`);
-					ctx.summary.alertsConverged += singleVersionAlerts.filter((a) => a.packageName === alert.packageName && a.fixable && a.recommendedVersion).length;
+					const convergedAlerts = singleVersionAlerts.filter((a) => a.packageName === alert.packageName && a.fixable && a.recommendedVersion);
+					ctx.summary.alertsConverged += convergedAlerts.length;
+					recordConvergedAlerts(ctx, convergedAlerts, "all locked versions >= target");
 					continue;
 				}
 				ctx.logger.warn(`Skipping ${alert.packageName}: locked instance(s) ${belowTarget.join(", ")} remain below target ${alert.recommendedVersion} (lower-major / different manifest instance; cross-major upgrade or manual review required)`);
 				addSkipped(ctx.summary, "cross-major");
+				recordSkippedAlerts(ctx, singleVersionAlerts.filter((a) => a.packageName === alert.packageName && a.fixable && a.recommendedVersion), "cross-major");
 				continue;
 			}
 			if (lockedVersions.length === 0) ctx.logger.warn(`Could not resolve current version of ${alert.packageName} from lockfile — no-downgrade protection inactive`);
@@ -12434,7 +12836,12 @@ async function applyGroupUpgrades(ctx, repo, sets, singleVersionAlerts, progress
 			return;
 		}
 		for (const alert of upgradedInGroup) {
-			recordVerificationCheckpoint(ctx, repo, progress, `group:${group.name}:${alert.packageName}`);
+			if (!budgetAllows(ctx, {
+				repository: repo,
+				stage: "fix",
+				work: `package upgrade ${alert.packageName} (group "${group.name}")`
+			})) return;
+			await recordVerificationCheckpoint(ctx, repo, progress, `group:${group.name}:${alert.packageName}`);
 			const action = await upgradeAlert(ctx, alert, { familyTargets });
 			ctx.allActions.push(action);
 			if (!action.success) {
@@ -12461,8 +12868,7 @@ async function applyGroupUpgrades(ctx, repo, sets, singleVersionAlerts, progress
 	}
 }
 
-//#endregion
-//#region src/app/repo-config.ts
+// src/app/repo-config.ts
 /**
 * 目标仓库专属配置路径（相对工作区根）。工作区即目标仓库检出：
 * 平台在 clone 之后才构造 `DependfixApp`，CLI 则直接在工作区内运行。
@@ -12605,8 +13011,7 @@ function applyRepoConfig(config, workDir, logger) {
 	return config;
 }
 
-//#endregion
-//#region src/app/git-exclude.ts
+// src/app/git-exclude.ts
 /** 交付提交必须排除的安装产物（目录形态，任意层级）。 */
 const GIT_EXCLUDE_ENTRIES = [".pnpm-store/", "node_modules/"];
 /** 追加条目时写入的分组注释（便于用户识别来源）。 */
@@ -12688,8 +13093,7 @@ function prepareDeliveryHygiene(workDir, options, logger) {
 	else if (result.added.length > 0) logger.info(`[git] 已排除安装产物：${result.added.join(", ")}（.git/info/exclude）`);
 }
 
-//#endregion
-//#region src/app/pr-check-watch-run.ts
+// src/app/pr-check-watch-run.ts
 /**
 * 等待本次创建 PR 的 check 终态并按归因处置。
 *
@@ -12786,10 +13190,9 @@ async function runPrCheckWatch(params) {
 	}
 }
 
-//#endregion
-//#region src/app/skipped-delivery.ts
+// src/app/skipped-delivery.ts
 /** 交付因「修复后安装仍既有失败」被跳过时的统一处置（日志 + 审计 + 回滚）。 */
-function skipDeliveryForInstallFailure(args) {
+async function skipDeliveryForInstallFailure(args) {
 	const { logger, workDir, preExistingDirty, allErrors, repos } = args;
 	const repoList = repos.join(", ");
 	logger.warn(`Install verification is still failing (pre-existing) after the fix for ${repoList} — skipping delivery; fix the execution environment or target repository lockfile first`);
@@ -12799,7 +13202,7 @@ function skipDeliveryForInstallFailure(args) {
 		category: "PRE_EXISTING_FAILURE",
 		message: `Delivery skipped: install verification still failing (pre-existing) for ${repoList}`
 	});
-	rollbackForSkippedDelivery({
+	await rollbackForSkippedDelivery({
 		logger,
 		workDir,
 		preExistingDirty,
@@ -12807,56 +13210,124 @@ function skipDeliveryForInstallFailure(args) {
 	});
 }
 /** 交付被跳过时回滚本次运行产生的改动（非 git / 无改动 / 运行前脏工作区时跳过）。 */
-function rollbackForSkippedDelivery(args) {
+async function rollbackForSkippedDelivery(args) {
 	const { logger, workDir, preExistingDirty, reason } = args;
 	if (preExistingDirty || !hasGitChanges(workDir)) return;
 	try {
-		rollbackChanges(workDir);
+		await rollbackChanges(workDir);
 		logger.info(`Changes rolled back (delivery skipped: ${reason})`);
 	} catch (error) {
+		if (error instanceof GitCommandError && error.aborted && !error.started) {
+			logger.warn(`Rollback skipped (run aborted before it started): ${reason}`);
+			return;
+		}
 		logger.warn(`Rollback after skipped delivery failed: ${toErrorMessage(error)}`);
 	}
 }
-
-//#endregion
-//#region src/app/duplicate-prs.ts
 /**
-* 重复 PR 处理：在新 PR 上添加评论指向被取代的旧 PR + 添加 `duplicate` label。
+* `issue` 档：按失败指纹在落点仓库开 issue（同一指纹只开一次，关闭后不重开）。
 *
-* @param logger 调用方 logger（warning 输出；不抛错）
+* 载体创建失败只 warn：交付跳过与 exit code 语义不受影响（`PRE_EXISTING_FAILURE` 仍在
+* 跳过类白名单内）。调用方负责此前的回滚；本函数只登记记录 + 产出载体。
 */
-async function handleDuplicatePRs(params) {
-	const { client, owner, repo, newPRNumber, supersededPRs, logger } = params;
-	if (supersededPRs.length === 0) return;
-	const commentBody = [
-		"## ⚠️ Duplicate PR Notice",
-		"",
-		"This PR supersedes the following dependfix PR(s) with different content:",
-		"",
-		supersededPRs.map((pr) => `- [#${pr.number}](${pr.htmlUrl})`).join("\n"),
-		"",
-		"The superseded PR(s) have been closed. Please review this PR as the new canonical fix."
-	].join("\n");
+async function deliverSkipIssue(params) {
+	const { target, octokit, owner, repo, repositories, failingCommands } = params;
+	const fingerprint = computeDeliverySkipFingerprint({
+		repositories,
+		failingCommands
+	});
+	const record = recordDeliverySkip(target, {
+		repositories: [...repositories],
+		failingCommands: [...failingCommands],
+		carrier: { mode: "issue" }
+	});
 	try {
-		await commentOnPullRequest(client, owner, repo, newPRNumber, commentBody);
-		logger.info(`Added duplicate notice comment to PR #${newPRNumber}`);
+		const existing = await findDeliverySkipIssue(octokit, owner, repo, fingerprint);
+		if (existing) {
+			record.carrier.issue = {
+				...existing,
+				created: false,
+				fingerprint
+			};
+			target.logger.info(`Delivery-skip issue already exists for the same failure fingerprint: ${existing.htmlUrl}`);
+			return record;
+		}
+		const issue = await createDeliverySkipIssue(octokit, owner, repo, {
+			title: buildDeliverySkipIssueTitle(repositories),
+			body: buildDeliverySkipIssueBody({
+				fingerprint,
+				runId: target.runId,
+				repositories,
+				failingCommands
+			}),
+			labels: [DELIVERY_SKIP_LABEL]
+		});
+		record.carrier.issue = {
+			...issue,
+			created: true,
+			fingerprint
+		};
+		target.logger.info(`Delivery-skip issue created: ${issue.htmlUrl}`);
 	} catch (error) {
-		const message = toErrorMessage(error);
-		logger.warn(`Failed to add duplicate notice comment to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+		target.logger.warn(`Delivery-skip issue creation failed (delivery stays skipped, exit code unchanged): ${toErrorMessage(error)}`);
 	}
-	try {
-		await addLabelToPullRequest(client, owner, repo, newPRNumber, ["duplicate"]);
-		logger.info(`Added 'duplicate' label to PR #${newPRNumber}`);
-	} catch (error) {
-		const message = toErrorMessage(error);
-		logger.warn(`Failed to add 'duplicate' label to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+	return record;
+}
+/**
+* 修复后安装仍为既有失败时的交付降级（`DEPENDFIX_ON_BASELINE_RED`）。
+*
+* - `skip`（默认）：审计记录 + 回滚，返回 `continueAsDraft: false`（行为与引入前逐字一致）
+* - `issue`：先按「仓库集 + 失败命令集」指纹开 issue（去重、关闭后不重开），随后仍回滚
+* - `draft`：不回滚，返回 `continueAsDraft: true`——调用方继续 commit / push，PR 以**草稿**创建
+*
+* dry-run / 无落点仓库时一律按 `skip` 处理：dry-run 无交付面可降级，且必须回滚。
+*/
+async function handleBaselineRedDelivery(args) {
+	const { ctx, config, client, repositories, installBlockedRepos, workDir, preExistingDirty } = args;
+	const mode = config.onBaselineRed ?? "skip";
+	const failingCommands = collectFailingInstallCommands(ctx.allActions ?? [], installBlockedRepos);
+	const firstRepo = repositories[0];
+	const issueRepo = installBlockedRepos[0];
+	if (mode === "draft" && !config.dryRun && firstRepo) {
+		const record = recordDeliverySkip(ctx, {
+			repositories: installBlockedRepos,
+			failingCommands,
+			carrier: { mode: "draft" }
+		});
+		ctx.logger.warn(`Install verification is still failing (pre-existing) after the fix for ${installBlockedRepos.join(", ")} — continuing with a draft PR (DEPENDFIX_ON_BASELINE_RED=draft); CI will fail with the same pre-existing error`);
+		return {
+			continueAsDraft: true,
+			record
+		};
 	}
+	if (mode === "issue" && !config.dryRun && client && issueRepo) {
+		const [owner, repo] = issueRepo.split("/");
+		await deliverSkipIssue({
+			target: ctx,
+			octokit: client,
+			owner,
+			repo,
+			repositories: installBlockedRepos,
+			failingCommands
+		});
+	} else recordDeliverySkip(ctx, {
+		repositories: installBlockedRepos,
+		failingCommands,
+		carrier: { mode: "skip" }
+	});
+	await skipDeliveryForInstallFailure({
+		logger: ctx.logger,
+		workDir,
+		preExistingDirty,
+		allErrors: ctx.allErrors,
+		repos: installBlockedRepos
+	});
+	return { continueAsDraft: false };
 }
 
-//#endregion
-//#region src/app/index.ts
+// src/app/source-failure-summary.ts
 /**
-* 输出"部分源拉取失败"汇总（todo.md §M19.5 C8 per-source 错误隔离）。
+* 输出「部分源拉取失败」汇总（per-source 错误隔离：单源失败不阻断其余源的结果）。
 *
 * 触发条件（必须全部满足，避免与"仓库失败"（无任何成功源）语义重叠）：
 * 1. allErrors 至少包含一个 `stage='fetch' + category='FETCH_FAILED'` 错误（per-source 失败）
@@ -12882,8 +13353,44 @@ function logPartialSourceFailureSummary(allErrors, logger, isAnyRepoSuccessful)
 		});
 	}
 	const summary = [...bySource.entries()].map(([source, { repos, sampleMessage }]) => `${source}（${repos.size} 个仓库: ${[...repos].slice(0, 3).join(", ")}${repos.size > 3 ? "..." : ""}）: ${sampleMessage}`).join("\n  - ");
-	logger.warn(`[alerts] 部分源拉取失败（M19.5 per-source 错误隔离）— 成功源已保留继续处理，详细如下：\n  - ${summary}`);
+	logger.warn(`[alerts] 部分源拉取失败（per-source 错误隔离）— 成功源已保留继续处理，详细如下：\n  - ${summary}`);
+}
+
+// src/app/duplicate-prs.ts
+/**
+* 重复 PR 处理：在新 PR 上添加评论指向被取代的旧 PR + 添加 `duplicate` label。
+*
+* @param logger 调用方 logger（warning 输出；不抛错）
+*/
+async function handleDuplicatePRs(params) {
+	const { client, owner, repo, newPRNumber, supersededPRs, logger } = params;
+	if (supersededPRs.length === 0) return;
+	const commentBody = [
+		"## ⚠️ Duplicate PR Notice",
+		"",
+		"This PR supersedes the following dependfix PR(s) with different content:",
+		"",
+		supersededPRs.map((pr) => `- [#${pr.number}](${pr.htmlUrl})`).join("\n"),
+		"",
+		"The superseded PR(s) have been closed. Please review this PR as the new canonical fix."
+	].join("\n");
+	try {
+		await commentOnPullRequest(client, owner, repo, newPRNumber, commentBody);
+		logger.info(`Added duplicate notice comment to PR #${newPRNumber}`);
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.warn(`Failed to add duplicate notice comment to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+	}
+	try {
+		await addLabelToPullRequest(client, owner, repo, newPRNumber, ["duplicate"]);
+		logger.info(`Added 'duplicate' label to PR #${newPRNumber}`);
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.warn(`Failed to add 'duplicate' label to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+	}
 }
+
+// src/app/index.ts
 var DependfixApp = class {
 	/** 运行时配置；构造期按「中央配置优先」合并目标仓库专属配置后单次赋值（见 applyRepoConfig） */
 	config;
@@ -12928,6 +13435,13 @@ var DependfixApp = class {
 		attempts: [],
 		runBudgetExhausted: false
 	};
+	/** 交付跳过记录（基线红；`computeSummary` 据此派生 summary 计数） */
+	deliverySkips = [];
+	/** 已记录的预算跳过（`stage:work`；逐包命中不刷审计） */
+	budgetSkips = /* @__PURE__ */ new Set();
+	/** `draft` 档的跳过记录（sanity: PR 创建后回填载体编号） */
+	baselineRedDraft;
+	alertOutcomes = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.workDir = options.workDir ?? process.cwd();
 		this.reportOutputDir = options.reportOutputDir ?? "./dependfix-reports";
@@ -12986,7 +13500,11 @@ var DependfixApp = class {
 			attemptTracking: this.attemptTracking,
 			attemptIndex: this.attemptIndex,
 			attemptRepo: this.attemptRepo,
-			prCheckWatch: this.prCheckWatchReport
+			prCheckWatch: this.prCheckWatchReport,
+			alertOutcomes: this.alertOutcomes,
+			deliverySkips: this.deliverySkips,
+			deadlineAt: this.config.deadlineAt,
+			budgetSkips: this.budgetSkips
 		};
 	}
 	/** 执行完整的编排流程，返回结构化结果和退出码。 */
@@ -13081,12 +13599,12 @@ var DependfixApp = class {
 		await this.runRepoPipeline(repositories, (repo) => this.processRepoForFix(client, repo));
 		if (this.config.commit) {
 			if (abortBlocksDelivery(this.ctx, "local commit")) return;
-			if (enforceVerificationGate(this.ctx, {
+			if (await enforceVerificationGate(this.ctx, {
 				preExistingDirty: this.preExistingDirty,
 				action: "commit"
 			})) return;
 			try {
-				commitLocalChanges(this.ctx);
+				await commitLocalChanges(this.ctx);
 			} catch (error) {
 				const message = toErrorMessage(error);
 				this.logger.error(`Local commit failed: ${message}`);
@@ -13125,24 +13643,27 @@ var DependfixApp = class {
 		if (this.config.cleanupBranches && !this.config.cleanupBranchesAuto) await reportCleanupCandidates(this.ctx, client);
 		if (this.config.cleanupBranchesAuto) for (const repo of repositories) await autoCleanupMergedBranches(this.ctx, client, repo);
 		if (abortBlocksDelivery(this.ctx, "PR creation")) return;
-		if (enforceVerificationGate(this.ctx, {
+		if (await enforceVerificationGate(this.ctx, {
 			preExistingDirty: this.preExistingDirty,
 			action: "pr"
 		})) return;
 		const installBlockedRepos = findInstallBlockedReposWithFixes(this.allActions);
 		if (installBlockedRepos.length > 0) {
-			skipDeliveryForInstallFailure({
-				logger: this.logger,
+			const outcome = await handleBaselineRedDelivery({
+				ctx: this.ctx,
+				config: this.config,
+				client,
+				repositories,
+				installBlockedRepos,
 				workDir: this.workDir,
-				preExistingDirty: this.preExistingDirty,
-				allErrors: this.allErrors,
-				repos: installBlockedRepos
+				preExistingDirty: this.preExistingDirty
 			});
-			return;
+			if (!outcome.continueAsDraft) return;
+			this.baselineRedDraft = outcome.record;
 		}
 		if (!hasDeliverableFixes(this.allActions)) {
 			this.logger.info("No deliverable fixes produced — skipping PR creation");
-			rollbackForSkippedDelivery({
+			await rollbackForSkippedDelivery({
 				logger: this.logger,
 				workDir: this.workDir,
 				preExistingDirty: this.preExistingDirty,
@@ -13184,12 +13705,12 @@ var DependfixApp = class {
 			}
 			if (plan.supersedePRs.length > 0) this.logger.info(`Existing PR(s) with different content will be superseded: ${plan.supersedePRs.map((pr) => `#${pr.number}`).join(", ")}`);
 			const branchName = `dependfix/auto-fix-${fingerprint}`;
-			createFixBranch(branchName, this.workDir);
+			await createFixBranch(branchName, this.workDir);
 			this.logger.info(`Creating fix branch: ${branchName}`);
 			this.logger.info("Staging and committing changes");
 			const author = this.githubAppAuth?.getCommitAuthor();
 			try {
-				const scope = stageAndCommit(buildCommitMessage(this.allActions), this.workDir, author, { declaredPaths: collectDeclaredPaths(this.allActions) });
+				const scope = await stageAndCommit(buildCommitMessage(this.allActions), this.workDir, author, { declaredPaths: collectDeclaredPaths(this.allActions) });
 				if (scope.ignored.length > 0) this.logger.info(`Not committing ${scope.ignored.length} generated / undeclared path(s): ${scope.ignored.join(", ")}`);
 				if (scope.missing.length > 0) this.logger.warn(`Declared path(s) had no changes in the worktree: ${scope.missing.join(", ")}`);
 			} catch (error) {
@@ -13206,7 +13727,7 @@ var DependfixApp = class {
 				throw error;
 			}
 			this.logger.info(`Pushing branch: ${branchName}`);
-			pushBranch(branchName, this.workDir);
+			await pushBranch(branchName, this.workDir);
 			const defaultBranch = await fetchDefaultBranch(client, owner, repo);
 			computeSummary(this.ctx);
 			const supplyChainWarnings = collectSupplyChainWarnings(this.workDir, this.allActions);
@@ -13220,10 +13741,18 @@ var DependfixApp = class {
 				headBranch: branchName,
 				baseBranch: defaultBranch,
 				title: prTitle,
-				body: prBody
+				body: prBody,
+				draft: this.baselineRedDraft !== void 0
 			});
 			this.logger.info(`PR created: ${pr.htmlUrl}`);
 			this.summary.prsOpened += 1;
+			if (this.baselineRedDraft) {
+				this.baselineRedDraft.carrier.draftPr = {
+					number: pr.number,
+					htmlUrl: pr.htmlUrl
+				};
+				this.logger.warn(`Draft PR created for pre-existing install failure: ${pr.htmlUrl} — fix the repository install chain, then mark it ready for review`);
+			}
 			this.allActions.push({
 				type: "dependency-upgrade",
 				repository: firstRepo,
@@ -13243,7 +13772,8 @@ var DependfixApp = class {
 				logger: this.logger
 			});
 			await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
-			if (this.config.waitPrChecks) await runPrCheckWatch({
+			if (this.config.waitPrChecks && this.baselineRedDraft) this.logger.info("Skipping PR check watch: draft delivery is expected to fail on the pre-existing install failure");
+			else if (this.config.waitPrChecks) await runPrCheckWatch({
 				ctx: this.ctx,
 				octokit: client,
 				owner,
@@ -13360,6 +13890,5 @@ var DependfixApp = class {
 	}
 };
 
-//#endregion
-export { ALERT_SOURCES, ATTEMPT_KEY_LENGTH, AUTO_FIXABLE_RULES, AiUsageTracker, CI_HEALTH_MAX_WORKFLOWS, CI_HEALTH_TIMEOUT_MS, CLOSED_ATTEMPT_QUERY_LIMIT, ClosedAttemptIndex, CommitScopeError, DEFAULT_COMMAND_TIMEOUT_MS, DEFAULT_CONCURRENCY, DEFAULT_JOB_BUDGET_MS, DEFAULT_PR_CHECK_RUN_BUDGET_MS, DEFAULT_PR_CHECK_TIMEOUT_MS, DEFAULT_RULES_CONFIG, DEFAULT_RUNTIME_CONFIG, DEFAULT_VERIFY_COMMANDS, DEPENDFIX_BRANCH_PREFIX, DependfixApp, ENV_PREFIX, FAILED_CHECK_SUMMARY_LIMIT, FAILURE_SIGNATURE_INPUT_LIMIT, GIT_COMMIT_HOOKS_ISOLATION_ARGS, GIT_COMMIT_SIGNING_ISOLATION_ARGS, GIT_PUSH_HOOKS_ISOLATION_ARGS, GIT_PUSH_SIGNING_ISOLATION_ARGS, JOB_BUDGET_MAX_SHARE, MAX_COMMAND_TIMEOUT_MS, MAX_CONCURRENCY_LIMIT, MAX_GLOB_PATTERN_LENGTH, MAX_MIRROR_COMMANDS, MAX_RUN_FRAGMENTS, MAX_WORKFLOW_BYTES, MAX_WORKFLOW_FILES, MIN_COMMAND_TIMEOUT_MS, PR_CHECK_GRACE_MS, PR_CHECK_MAX_POLLS, PR_CHECK_POLL_INITIAL_MS, PR_CHECK_POLL_MAX_MS, RULE_CONFIG_ENV, RUNTIME_MODES, SEVERITY_THRESHOLDS, SUGGESTED_RULES, VERIFY_TIMEOUT_ENV, addLabelToPullRequest, analyzeTokenScope, applyCodeScanningFix, applyVersionedOverrides, applyVersionedOverridesBatch, assessBreakingChange, buildCheckFailureComment, buildCiAlignmentRecord, buildPrTitle, buildUpgradeGroups, checkTokenPermissions, chunkPaths, classifyCommandFragment, classifyLockfileFailure, classifyRule, closePullRequest, closeSupersededPRs, collectAttemptMarkers, collectDeclaredPaths, commentOnPullRequest, commitStaged, compareSemver, compareVerificationChains, computeAttemptKey, computeCommitScope, computeFailureSignature, computeFixAndPrPlan, computeFixFingerprint, computeLockfileDiff, computeRetryDelayMs, createFixBranch, createGitHubClient, createPullRequest, dedupeFixableAlerts, deleteRemoteBranch, detectPnpmMajor, discoverRepositories, ensurePnpmOverrides, estimateCostUsd, evaluateCheckTerminal, extractFingerprintFromBranch, extractLockfileVersion, extractMainPackage, extractPrefix, fetchCodeQualityFindings, fetchCodeScanningAlerts, fetchDefaultBranch, fetchDefaultBranchWorkflowHealth, fetchDependabotAlerts, fetchPnpmAuditAlerts, filterExplicitRepositories, findDependencyVersion, findDependfixOpenPR, formatAttemptMarker, formatHistory, formatVerificationError, generatePRBody, getActiveRulesConfig, getBranchPrStatus, getCodeScanningFixTemplate, hashAdvisoryId, inferRepoFromGitRemote, isCommitWhitelisted, isConfirmAnswer, isCrossMajorFixRequired, isGeneratedPath, isMainPackagePresent, isNonSemverDeclaration, isRootDirectDependency, isSafePrototypeKey, isValidConcurrency, isValidPnpmVersion, listChangedPaths, listDependfixBranches, loadRulesConfigFromEnv, loadRulesConfigFromFile, logPartialSourceFailureSummary, mapCodeQualitySeverity, mapGitHubError, maskSecrets, matchesOverrideProtect, matchesPattern, matchesRepoExclude, matchesRepoGlob, matchesRepoInclude, matchesTopicsExclude, mergeRepositories, normalizeCheckRunConclusion, normalizeCommitPath, normalizeCommitStatusConclusion, normalizeOverrideKey, normalizeOverrideSelector, overrideTransitiveDependency, parseAttemptMarkers, parseAuditReport, parseDependabotGroups, parseMajorVersion, parseOverrideProtectEntries, parseRulesConfig, parseWorkflowCommands, partitionSubmanifestAlerts, planCiMirrorCommands, pushBranch, queryRepoHistory, quickVerifyProject, readArchiveIndex, readEnv, readEnvConfig, readExistingOverrides, readLockfileVersion, readLockfileVersions, readReposFile, readWorkflowSources, repairLockfile, repoGlobToRegExp, resetActiveRulesConfig, resolveCommandTimeoutMs, resolveEffectiveTimeout, resolvePnpmVersion, resolveRepoList, resolveRuntimeConfig, resolveWithinWorkDir, restoreSourceFile, restoreTrackedFiles, runVerification, runWithConcurrency, sanitizeCheckName, sanitizeCheckUrl, sanitizeOutput, setActiveRulesConfig, snapshotSourceFile, snapshotTrackedFiles, stageAndCommit, stageScopedChanges, suggestionFor, summarizeVerificationOutput, upgradeDependency, upgradeFamilyDependencies, upsertOverride, watchPullRequestChecks, writeArchive };
+export { ALERT_SOURCES, ATTEMPT_KEY_LENGTH, AUTO_FIXABLE_RULES, AiUsageTracker, CI_HEALTH_MAX_WORKFLOWS, CI_HEALTH_TIMEOUT_MS, CLOSED_ATTEMPT_QUERY_LIMIT, ClosedAttemptIndex, CommitScopeError, DEFAULT_COMMAND_TIMEOUT_MS, DEFAULT_CONCURRENCY, DEFAULT_JOB_BUDGET_MS, DEFAULT_PR_CHECK_RUN_BUDGET_MS, DEFAULT_PR_CHECK_TIMEOUT_MS, DEFAULT_RULES_CONFIG, DEFAULT_RUNTIME_CONFIG, DEFAULT_VERIFY_COMMANDS, DEPENDFIX_BRANCH_PREFIX, DependfixApp, ENV_PREFIX, FAILED_CHECK_SUMMARY_LIMIT, FAILURE_SIGNATURE_INPUT_LIMIT, GIT_COMMIT_HOOKS_ISOLATION_ARGS, GIT_COMMIT_SIGNING_ISOLATION_ARGS, GIT_PUSH_HOOKS_ISOLATION_ARGS, GIT_PUSH_SIGNING_ISOLATION_ARGS, JOB_BUDGET_MAX_SHARE, MAX_COMMAND_TIMEOUT_MS, MAX_CONCURRENCY_LIMIT, MAX_GLOB_PATTERN_LENGTH, MAX_MIRROR_COMMANDS, MAX_RUN_FRAGMENTS, MAX_WORKFLOW_BYTES, MAX_WORKFLOW_FILES, MIN_COMMAND_TIMEOUT_MS, PR_CHECK_GRACE_MS, PR_CHECK_MAX_POLLS, PR_CHECK_POLL_INITIAL_MS, PR_CHECK_POLL_MAX_MS, RULE_CONFIG_ENV, RUNTIME_MODES, SEVERITY_THRESHOLDS, SUGGESTED_RULES, VERIFY_TIMEOUT_ENV, addLabelToPullRequest, analyzeTokenScope, applyCodeScanningFix, applyVersionedOverrides, applyVersionedOverridesBatch, assessBreakingChange, buildCheckFailureComment, buildCiAlignmentRecord, buildPrTitle, buildUpgradeGroups, checkTokenPermissions, chunkPaths, classifyCommandFragment, classifyLockfileFailure, classifyRule, closePullRequest, closeSupersededPRs, collectAttemptMarkers, collectDeclaredPaths, commentOnPullRequest, commitStaged, compareSemver, compareVerificationChains, computeAttemptKey, computeCommitScope, computeFailureSignature, computeFixAndPrPlan, computeFixFingerprint, computeLockfileDiff, computeRetryDelayMs, createFixBranch, createGitHubClient, createPullRequest, dedupeFixableAlerts, dedupeObservedChecksByLatestRound, deleteRemoteBranch, detectPnpmMajor, discoverRepositories, ensurePnpmOverrides, estimateCostUsd, evaluateCheckTerminal, extractFingerprintFromBranch, extractLockfileVersion, extractMainPackage, extractPrefix, fetchCodeQualityFindings, fetchCodeScanningAlerts, fetchDefaultBranch, fetchDefaultBranchWorkflowHealth, fetchDependabotAlerts, fetchPnpmAuditAlerts, filterExplicitRepositories, findDependencyVersion, findDependfixOpenPR, formatAttemptMarker, formatHistory, formatVerificationError, generatePRBody, getActiveRulesConfig, getBranchPrStatus, getCodeScanningFixTemplate, hashAdvisoryId, inferRepoFromGitRemote, isCommitWhitelisted, isConfirmAnswer, isCrossMajorFixRequired, isGeneratedPath, isMainPackagePresent, isNonSemverDeclaration, isRootDirectDependency, isSafePrototypeKey, isValidConcurrency, isValidPnpmVersion, listChangedPaths, listDependfixBranches, loadRulesConfigFromEnv, loadRulesConfigFromFile, logPartialSourceFailureSummary, mapCodeQualitySeverity, mapGitHubError, maskSecrets, matchesOverrideProtect, matchesPattern, matchesRepoExclude, matchesRepoGlob, matchesRepoInclude, matchesTopicsExclude, mergeRepositories, normalizeCheckRunConclusion, normalizeCommitPath, normalizeCommitStatusConclusion, normalizeOverrideKey, normalizeOverrideSelector, overrideTransitiveDependency, parseAttemptMarkers, parseAuditReport, parseDependabotGroups, parseMajorVersion, parseOverrideProtectEntries, parseRulesConfig, parseWorkflowCommands, partitionSubmanifestAlerts, planCiMirrorCommands, pushBranch, queryRepoHistory, quickVerifyProject, readArchiveIndex, readEnv, readEnvConfig, readExistingOverrides, readLockfileVersion, readLockfileVersions, readReposFile, readWorkflowSources, repairLockfile, repoGlobToRegExp, resetActiveRulesConfig, resolveCommandTimeoutMs, resolveEffectiveTimeout, resolvePnpmVersion, resolveRepoList, resolveRuntimeConfig, resolveWithinWorkDir, restoreSourceFile, restoreTrackedFiles, runVerification, runWithConcurrency, sanitizeCheckName, sanitizeCheckUrl, sanitizeOutput, setActiveRulesConfig, snapshotSourceFile, snapshotTrackedFiles, stageAndCommit, stageScopedChanges, suggestionFor, summarizeVerificationOutput, upgradeDependency, upgradeFamilyDependencies, upsertOverride, watchPullRequestChecks, writeArchive };
 //# sourceMappingURL=index.mjs.map