@nathapp/nax 0.75.3 → 0.75.4

package/dist/nax.js

@@ -17317,7 +17317,11 @@ var init_schemas_reporters = __esm(() => {
     maxBatchSize: exports_external.number().int().positive().default(64),
     flushIntervalMs: exports_external.number().int().positive().default(5000),
     maxQueueSize: exports_external.number().int().positive().default(2048),
-    phases: exports_external.array(exports_external.string()).optional()
+    phases: exports_external.array(exports_external.string()).optional(),
+    logs: exports_external.object({
+      enabled: exports_external.boolean().default(false),
+      level: exports_external.enum(["silent", "error", "warn", "info", "debug"]).default("info")
+    }).default({ enabled: false, level: "info" })
   }).default({
     enabled: false,
     headers: {},
@@ -17327,7 +17331,8 @@ var init_schemas_reporters = __esm(() => {
     heartbeatIntervalMs: 1e4,
     maxBatchSize: 64,
     flushIntervalMs: 5000,
-    maxQueueSize: 2048
+    maxQueueSize: 2048,
+    logs: { enabled: false, level: "info" }
   });
   ReportersConfigSchema = exports_external.object({
     webhook: WebhookReporterConfigSchema,
@@ -17347,7 +17352,8 @@ var init_schemas_reporters = __esm(() => {
       heartbeatIntervalMs: 1e4,
       maxBatchSize: 64,
       flushIntervalMs: 5000,
-      maxQueueSize: 2048
+      maxQueueSize: 2048,
+      logs: { enabled: false, level: "info" }
     }
   });
 });
@@ -18388,6 +18394,30 @@ var init_redact = __esm(() => {
   ];
 });
 
+// src/logger/sink-registry.ts
+class SinkRegistry {
+  sinks = [];
+  add(sink) {
+    this.sinks.push(sink);
+    return () => {
+      const idx = this.sinks.indexOf(sink);
+      if (idx !== -1) {
+        this.sinks.splice(idx, 1);
+      }
+    };
+  }
+  dispatch(entry) {
+    for (const sink of this.sinks) {
+      try {
+        sink({ ...entry });
+      } catch (error48) {
+        process.stderr.write(`[logger] Sink threw: ${error48}
+`);
+      }
+    }
+  }
+}
+
 // src/logger/logger.ts
 import { mkdirSync } from "fs";
 import { appendFile } from "fs/promises";
@@ -18400,6 +18430,7 @@ class Logger {
   suppressConsole;
   writeQueueTail = Promise.resolve();
   pendingLines = [];
+  sinkRegistry = new SinkRegistry;
   constructor(options) {
     this.level = options.level;
     this.filePath = options.filePath;
@@ -18443,10 +18474,11 @@ class Logger {
       ...sessionRole && { sessionRole },
       ...strippedData && { data: strippedData }
     };
+    const entry = redactEntry(rawEntry);
+    this.sinkRegistry.dispatch(entry);
     const consoleEnabled = this.shouldLog(level) && !this.suppressConsole;
     if (!consoleEnabled && !this.filePath)
       return;
-    const entry = redactEntry(rawEntry);
     if (consoleEnabled) {
       let consoleOutput = null;
       if (this.formatterMode) {
@@ -18530,8 +18562,19 @@ ${JSON.stringify(entry.data, null, 2)}`;
       debug: (stage, message, data) => this.log("debug", stage, message, data, storyId)
     };
   }
+  addSink(sink) {
+    return this.sinkRegistry.add(sink);
+  }
   close() {}
 }
+function addSink(sink) {
+  if (!instance) {
+    throw new NaxError("Logger not initialized. Call initLogger() before addSink().", "LOGGER_NOT_INITIALIZED", {
+      stage: "logger"
+    });
+  }
+  return instance.addSink(sink);
+}
 function initLogger(options = { level: "silent" }) {
   if (instance) {
     throw new Error("Logger already initialized. Call getLogger() to access existing instance.");
@@ -18560,6 +18603,7 @@ function resetLogger() {
 }
 var LOG_LEVEL_PRIORITY, MAX_BATCH_BYTES, instance = null, noopLogger;
 var init_logger = __esm(() => {
+  init_errors();
   init_log_format();
   init_formatters();
   init_redact();
@@ -42579,7 +42623,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.75.3",
+    version: "0.75.4",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -42683,8 +42727,8 @@ var init_version = __esm(() => {
   NAX_VERSION = package_default.version;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("ae716fd4"))
-        return "ae716fd4";
+      if (/^[0-9a-f]{6,10}$/.test("5aee16bf"))
+        return "5aee16bf";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -58554,15 +58598,7 @@ async function runNonBlockingFix(args, overrides = {}) {
   if (!exhausted) {
     const gateVerdict = args.keptTreeRegressed?.();
     if (gateVerdict?.regressed) {
-      logger?.info("non-blocking-fix", "kept tree regressed the full-suite gate \u2014 restoring (ADR-024 \xA73)", {
-        storyId: args.storyId,
-        regressedKeys: gateVerdict.regressedKeys.slice(0, MAX_LOGGED_REGRESSED_KEYS),
-        regressedKeyCount: gateVerdict.regressedKeys.length,
-        baselineKeySize: gateVerdict.baselineKeySize,
-        keyless: gateVerdict.keyless,
-        memoExcludedKeyCount: gateVerdict.memoExcludedKeys.length,
-        flakeTriageRan: false
-      });
+      logGateRegression(logger, args.storyId, "kept tree regressed the full-suite gate \u2014 restoring (ADR-024 \xA73)", gateVerdict);
       return restoreToSnapshot(args, _deps, restoreRef, phaseOutputsSnapshot, phaseCostsSnapshot, logger);
     }
     const cap = args.cfg.sourceDiffCap;
@@ -58590,8 +58626,23 @@ async function runNonBlockingFix(args, overrides = {}) {
     logger?.info("non-blocking-fix", "best-effort fix kept", { storyId: args.storyId });
     return { ran: true, kept: true, restored: false };
   }
+  const exhaustedGateVerdict = args.keptTreeRegressed?.();
+  if (exhaustedGateVerdict?.regressed) {
+    logGateRegression(logger, args.storyId, "best-effort fix exhausted with the full-suite gate red", exhaustedGateVerdict);
+  }
   return restoreToSnapshot(args, _deps, restoreRef, phaseOutputsSnapshot, phaseCostsSnapshot, logger);
 }
+function logGateRegression(logger, storyId, message, verdict) {
+  logger?.info("non-blocking-fix", message, {
+    storyId,
+    regressedKeys: verdict.regressedKeys.slice(0, MAX_LOGGED_REGRESSED_KEYS),
+    regressedKeyCount: verdict.regressedKeys.length,
+    baselineKeySize: verdict.baselineKeySize,
+    keyless: verdict.keyless,
+    memoExcludedKeyCount: verdict.memoExcludedKeys.length,
+    flakeTriageRan: false
+  });
+}
 async function restoreToSnapshot(args, _deps, restoreRef, phaseOutputsSnapshot, phaseCostsSnapshot, logger) {
   await _deps.rollbackToRef(args.workdir, restoreRef);
   for (const key of Object.keys(args.phaseOutputs))
@@ -58744,10 +58795,18 @@ function gateFailureKeys(gateOutput) {
       continue;
     if (f.category === "flaky-test")
       continue;
-    keys.add(`${f.file ?? ""}::${f.rule ?? ""}`);
+    keys.add(gateFindingKey(f));
   }
   return keys;
 }
+function gateFindingKey(finding) {
+  return `${finding.file ?? ""}::${finding.rule ?? ""}`;
+}
+function isQuarantinedFlake(finding, quarantineMemo) {
+  if (finding.source !== "test-runner")
+    return false;
+  return quarantineMemo?.has(gateFindingKey(finding)) === true;
+}
 function describeGateRegression(input) {
   const { gateOutput, baselineKeys, gateName, storyId, quarantineMemo } = input;
   const notRegressed = {
@@ -59447,9 +59506,12 @@ var init_run_phase = __esm(() => {
 });
 
 // src/execution/story-orchestrator/rectification.ts
-function shouldSkipPhaseForRectification(phase, state, phaseOutputs) {
+function shouldSkipPhaseForRectification(input) {
+  const { phase, state, phaseOutputs, nbfPath } = input;
   if (phase.kind !== "full-suite-gate")
     return false;
+  if (nbfPath)
+    return false;
   const verifierName = state.verifier?.slot.op.name;
   if (!verifierName)
     return false;
@@ -59458,7 +59520,7 @@ function shouldSkipPhaseForRectification(phase, state, phaseOutputs) {
 function gatherRectificationFindings(phaseOutputs, phases, state) {
   const findings = [];
   for (const phase of phases) {
-    if (shouldSkipPhaseForRectification(phase, state, phaseOutputs))
+    if (shouldSkipPhaseForRectification({ phase, state, phaseOutputs }))
       continue;
     for (const f of extractPhaseFindings(phaseOutputs[phase.slot.op.name])) {
       if (f.category === "flaky-test")
@@ -59539,7 +59601,9 @@ async function runRectification(ctx, state, phaseCosts, phaseOutputs, overrides)
     return {};
   }
   let initialFindings;
+  let nbfPath = false;
   if (overrides?.initialFindings) {
+    nbfPath = true;
     initialFindings = [...overrides.initialFindings];
   } else {
     const gateName = state.fullSuiteGate?.slot.op.name;
@@ -59589,10 +59653,11 @@ async function runRectification(ctx, state, phaseCosts, phaseOutputs, overrides)
       let shortCircuited = false;
       for (const phase of phases) {
         await runPhase(ctx, phase.slot, phaseCosts, phaseOutputs);
-        if (shouldSkipPhaseForRectification(phase, state, phaseOutputs))
+        if (shouldSkipPhaseForRectification({ phase, state, phaseOutputs, nbfPath }))
           continue;
         const output = phaseOutputs[phase.slot.op.name];
-        findings.push(...extractPhaseFindings(output));
+        const phaseFindings = extractPhaseFindings(output);
+        findings.push(...nbfPath ? phaseFindings.filter((f) => !isQuarantinedFlake(f, ctx.runtime.quarantineMemo)) : phaseFindings);
         if (!phasePassed(phase.slot.op.name, output, ctx.storyId)) {
           getSafeLogger()?.warn("story-orchestrator", "Short-circuiting revalidation on phase failure", {
             storyId: ctx.storyId,
@@ -64807,15 +64872,36 @@ var init_config2 = __esm(() => {
 });
 
 // src/plugins/builtin/nax-finish/telegram.ts
+function buildEscalationMessage(feature, reason, findings) {
+  const head = `nax-finish escalated ${feature}: ${reason}`;
+  if (findings.length === 0)
+    return head;
+  const footerReserve = `
+\u2026and ${findings.length} more`.length;
+  const lines = [];
+  let used = head.length;
+  for (const f of findings) {
+    const title = f.title.length > MAX_FINDING_TITLE_CHARS ? `${f.title.slice(0, MAX_FINDING_TITLE_CHARS)}\u2026` : f.title;
+    const line = `
+- [${f.severity}] ${title}`;
+    if (used + line.length + footerReserve > TELEGRAM_MAX_MESSAGE_CHARS)
+      break;
+    lines.push(line);
+    used += line.length;
+  }
+  const omitted = findings.length - lines.length;
+  return `${head}${lines.join("")}${omitted > 0 ? `
+\u2026and ${omitted} more` : ""}`;
+}
 async function sendTelegramNotify(cfg, text) {
   const res = await _telegramDeps.fetch(`https://api.telegram.org/bot${cfg.token}/sendMessage`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ chat_id: cfg.chatId, text, parse_mode: "Markdown" })
+    body: JSON.stringify({ chat_id: cfg.chatId, text })
   });
   return res.ok;
 }
-var _telegramDeps;
+var TELEGRAM_MAX_MESSAGE_CHARS = 4096, MAX_FINDING_TITLE_CHARS = 120, _telegramDeps;
 var init_telegram2 = __esm(() => {
   _telegramDeps = { fetch: (...a) => fetch(...a) };
 });
@@ -64970,8 +65056,32 @@ var init_nax_finish = __esm(() => {
             message: `nax-finish flow exited ${res.exitCode} (no result file)${tail ? `: ${tail}` : ""}`
           };
         }
-        if (result.status === "escalated" && escalateTelegram && creds) {
-          await _naxFinishDeps.notify(creds, `nax-finish escalated *${result.feature}*: ${result.escalationReason ?? ""}`);
+        if (result.status === "escalated") {
+          const problems = [];
+          let delivered = !escalateTelegram && !result.deliveryError;
+          if (escalateTelegram && creds) {
+            const sent = await _naxFinishDeps.notify(creds, buildEscalationMessage(result.feature, result.escalationReason ?? "", result.findings ?? []));
+            if (sent)
+              delivered = true;
+            else
+              problems.push("Telegram rejected the message");
+          }
+          if (!delivered) {
+            if (result.deliveryError)
+              problems.push(`the flow could not post it: ${result.deliveryError}`);
+            if (problems.length === 0)
+              problems.push("no escalation channel was reachable");
+            ctx.logger.warn("nax-finish escalation was not delivered", {
+              feature: result.feature,
+              reasons: problems,
+              escalationReason: result.escalationReason
+            });
+            return {
+              success: false,
+              message: `nax-finish: escalated but undelivered \u2014 ${problems.join("; ")}`,
+              url: result.url
+            };
+          }
         }
         return { success: true, message: `nax-finish: ${result.status}`, url: result.url };
       } catch (err) {
@@ -65114,6 +65224,7 @@ var init_batch_queue = __esm(() => {
 });
 
 // src/plugins/builtin/otel-reporter/otlp.ts
+import { hostname as hostname3 } from "os";
 function attr(key, value) {
   return typeof value === "number" ? { key, value: { doubleValue: value } } : { key, value: { stringValue: value } };
 }
@@ -65133,8 +65244,25 @@ function buildHistogramPoint(values, bounds, attributes, timeUnixNano) {
 function buildCounterPoint(count, attributes, timeUnixNano) {
   return { attributes, timeUnixNano, asInt: String(count) };
 }
-function buildResourceAttributes(serviceName, runId) {
-  return [attr("service.name", serviceName), attr("nax.run_id", runId)];
+function buildResourceAttributes(input) {
+  const attrs = [
+    attr("service.name", input.serviceName),
+    attr("nax.run_id", input.runId),
+    attr("nax.version", NAX_VERSION),
+    attr("process.pid", process.pid)
+  ];
+  try {
+    attrs.push(attr("host.name", hostname3()));
+  } catch {}
+  if (input.feature !== undefined)
+    attrs.push(attr("nax.feature", input.feature));
+  if (input.project !== undefined)
+    attrs.push(attr("nax.project", input.project));
+  if (input.git?.branch !== undefined)
+    attrs.push(attr("nax.git.branch", input.git.branch));
+  if (input.git?.sha !== undefined)
+    attrs.push(attr("nax.git.sha", input.git.sha));
+  return attrs;
 }
 function buildTracesPayload(p) {
   const span = {
@@ -65160,7 +65288,18 @@ function buildTracesPayload(p) {
   return {
     resourceSpans: [
       {
-        resource: { attributes: [attr("service.name", p.serviceName)] },
+        resource: {
+          attributes: buildResourceAttributes({
+            serviceName: p.serviceName,
+            runId: p.runId,
+            feature: p.feature,
+            project: p.project,
+            git: {
+              branch: p.gitBranch,
+              sha: p.gitSha
+            }
+          })
+        },
         scopeSpans: [{ scope: { name: "nax" }, spans: [span, ...p.extraSpans ?? []] }]
       }
     ]
@@ -65187,7 +65326,18 @@ function buildMetricsPayload(p) {
   return {
     resourceMetrics: [
       {
-        resource: { attributes: [attr("service.name", p.serviceName)] },
+        resource: {
+          attributes: buildResourceAttributes({
+            serviceName: p.serviceName,
+            runId: p.runId,
+            feature: p.feature,
+            project: p.project,
+            git: {
+              branch: p.gitBranch,
+              sha: p.gitSha
+            }
+          })
+        },
         scopeMetrics: [
           {
             scope: { name: "nax" },
@@ -65198,6 +65348,9 @@ function buildMetricsPayload(p) {
     ]
   };
 }
+var init_otlp = __esm(() => {
+  init_version();
+});
 
 // src/plugins/builtin/otel-reporter/heartbeat.ts
 function startHeartbeat(opts) {
@@ -65250,7 +65403,12 @@ function buildHeartbeatMetricsPayload(p) {
   return {
     resourceMetrics: [
       {
-        resource: { attributes: [attr("service.name", p.serviceName)] },
+        resource: {
+          attributes: buildResourceAttributes({
+            serviceName: p.serviceName,
+            runId: p.snapshot.attributes.runId
+          })
+        },
         scopeMetrics: [
           {
             scope: { name: "nax" },
@@ -65268,6 +65426,7 @@ function buildHeartbeatMetricsPayload(p) {
 var STAGE2 = "otel-reporter-heartbeat";
 var init_heartbeat = __esm(() => {
   init_logger2();
+  init_otlp();
 });
 
 // src/plugins/builtin/otel-reporter/ids.ts
@@ -65281,6 +65440,78 @@ function randomHex(bytes) {
 }
 var newTraceId = () => randomHex(16), newSpanId = () => randomHex(8);
 
+// src/plugins/builtin/otel-reporter/logs.ts
+function entryTimestampMs(entry) {
+  return new Date(entry.timestamp).getTime();
+}
+function toLogRecord(entry) {
+  const timeUnixNano = msToUnixNano(entryTimestampMs(entry));
+  const { number: severityNumber, text: severityText } = SEVERITY[entry.level];
+  const attributes = [attr("nax.stage", entry.stage)];
+  if (entry.storyId !== undefined)
+    attributes.push(attr("nax.story_id", entry.storyId));
+  if (entry.sessionRole !== undefined)
+    attributes.push(attr("nax.session_role", entry.sessionRole));
+  const data = entry.data ?? {};
+  const nonScalars = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (typeof value === "string") {
+      attributes.push(attr(`nax.data.${key}`, truncate3(value)));
+    } else if (typeof value === "number") {
+      if (Number.isFinite(value)) {
+        attributes.push(attr(`nax.data.${key}`, value));
+      } else {
+        nonScalars[key] = value;
+      }
+    } else if (typeof value === "boolean") {
+      attributes.push(attr(`nax.data.${key}`, String(value)));
+    } else {
+      nonScalars[key] = value;
+    }
+  }
+  if (Object.keys(nonScalars).length > 0) {
+    attributes.push(attr("nax.data_json", truncate3(JSON.stringify(nonScalars))));
+  }
+  return {
+    body: { stringValue: entry.message },
+    timeUnixNano,
+    severityNumber,
+    severityText,
+    attributes
+  };
+}
+function buildLogsPayload(entries, resource) {
+  const logRecords = entries.map(toLogRecord);
+  return {
+    resourceLogs: [
+      {
+        resource: {
+          attributes: buildResourceAttributes(resource)
+        },
+        scopeLogs: [{ scope: { name: "nax" }, logRecords }]
+      }
+    ]
+  };
+}
+function truncate3(value) {
+  if (value.length <= DATA_JSON_MAX)
+    return value;
+  const marker = TRUNCATION_MARKER;
+  const keep = DATA_JSON_MAX - marker.length;
+  return `${value.slice(0, keep)}${marker}`;
+}
+var SEVERITY, DATA_JSON_MAX = 2048, TRUNCATION_MARKER = "...[truncated]";
+var init_logs = __esm(() => {
+  init_otlp();
+  SEVERITY = {
+    silent: { number: 0, text: "SILENT" },
+    error: { number: 17, text: "ERROR" },
+    warn: { number: 13, text: "WARN" },
+    info: { number: 9, text: "INFO" },
+    debug: { number: 5, text: "DEBUG" }
+  };
+});
+
 // src/plugins/builtin/otel-reporter/span-tree.ts
 function createSpanTree(traceId, runSpanId) {
   const storySpanIds = new Map;
@@ -65364,7 +65595,8 @@ function createPhaseMetricsAggregator() {
   function recordEscalation(toTier, count) {
     bumpCounter(escalations, [attr("to_tier", toTier)], count);
   }
-  function buildMetricsPayload2(serviceName, runId, timeUnixNano) {
+  function buildMetricsPayload2(input) {
+    const { serviceName, runId, timeUnixNano, feature, project, gitBranch, gitSha } = input;
     const groups = [...phaseGroups.values()];
     const counterMetric = (name, source) => ({
       name,
@@ -65400,7 +65632,15 @@ function createPhaseMetricsAggregator() {
     return {
       resourceMetrics: [
         {
-          resource: { attributes: buildResourceAttributes(serviceName, runId) },
+          resource: {
+            attributes: buildResourceAttributes({
+              serviceName,
+              runId,
+              feature,
+              project,
+              git: { branch: gitBranch, sha: gitSha }
+            })
+          },
           scopeMetrics: [{ scope: { name: "nax" }, metrics }]
         }
       ]
@@ -65410,6 +65650,7 @@ function createPhaseMetricsAggregator() {
 }
 var PHASE_DURATION_BOUNDS, PHASE_COST_BOUNDS;
 var init_span_tree = __esm(() => {
+  init_otlp();
   PHASE_DURATION_BOUNDS = [100, 500, 1000, 5000, 15000, 60000, 300000, 900000];
   PHASE_COST_BOUNDS = [0.001, 0.01, 0.05, 0.1, 0.5, 1, 5];
 });
@@ -65484,11 +65725,11 @@ function reviewSpanEvents(details, timeUnixNano, verbose) {
     return { timeUnixNano, name: "review.finding", attributes };
   });
 }
-function createOtelReporterPlugin(cfg, deps) {
+function createOtelReporterPlugin(cfg, deps, workdir) {
   const states = new Map;
   const base = cfg.endpoint?.replace(/\/$/, "");
   let tornDown = false;
-  const sendSpanBatch = async (batch) => {
+  const makeSendSpanBatch = (resourceAttrs) => async (batch) => {
     if (!base || batch.length === 0)
       return true;
     const { resolved, missing } = interpolateHeaders(cfg.headers);
@@ -65499,21 +65740,55 @@ function createOtelReporterPlugin(cfg, deps) {
     const payload = {
       resourceSpans: [
         {
-          resource: { attributes: [attr("service.name", cfg.serviceName)] },
+          resource: { attributes: resourceAttrs },
           scopeSpans: [{ scope: { name: "nax" }, spans: batch }]
         }
       ]
     };
-    return postJson(`${base}/v1/traces`, payload, { headers: resolved, timeoutMs: cfg.timeoutMs, stage: STAGE3, deps });
+    return postJson(`${base}/v1/traces`, payload, {
+      headers: resolved,
+      timeoutMs: cfg.timeoutMs,
+      stage: STAGE3,
+      deps
+    });
+  };
+  const makeSpanQueue = (resourceAttrs) => createBatchQueue({
+    maxBatchSize: cfg.maxBatchSize ?? DEFAULT_MAX_BATCH_SIZE,
+    flushIntervalMs: cfg.flushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS,
+    maxQueueSize: cfg.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE,
+    send: makeSendSpanBatch(resourceAttrs)
+  });
+  const makeSendLogsBatch = (resource) => async (batch) => {
+    if (!base || batch.length === 0)
+      return true;
+    const { resolved, missing } = interpolateHeaders(cfg.headers);
+    if (missing.length > 0) {
+      getSafeLogger()?.warn(STAGE3, "Skipping OTLP export \u2014 unresolved env vars", { missing });
+      return true;
+    }
+    const payload = buildLogsPayload(batch, {
+      serviceName: resource.serviceName,
+      runId: resource.runId,
+      feature: resource.feature,
+      project: resource.project,
+      git: { branch: resource.gitBranch, sha: resource.gitSha }
+    });
+    return postJson(`${base}/v1/logs`, payload, {
+      headers: resolved,
+      timeoutMs: cfg.timeoutMs,
+      stage: STAGE3,
+      deps
+    });
   };
-  const makeSpanQueue = () => createBatchQueue({
+  const makeLogsQueue = (resource) => createBatchQueue({
     maxBatchSize: cfg.maxBatchSize ?? DEFAULT_MAX_BATCH_SIZE,
     flushIntervalMs: cfg.flushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS,
     maxQueueSize: cfg.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE,
-    send: sendSpanBatch
+    send: makeSendLogsBatch(resource)
   });
   const buildOrphanState = (startMs) => {
     const identity = rootSpanIdentity();
+    const orphanAttrs = buildResourceAttributes({ serviceName: cfg.serviceName, runId: "orphan" });
     return {
       ...identity,
       startMs,
@@ -65521,7 +65796,7 @@ function createOtelReporterPlugin(cfg, deps) {
       project: "",
       events: [],
       spanTree: createSpanTree(identity.traceId, identity.spanId),
-      spanQueue: makeSpanQueue(),
+      spanQueue: makeSpanQueue(orphanAttrs),
       metrics: createPhaseMetricsAggregator(),
       storyBounds: new Map,
       costUsd: 0,
@@ -65561,6 +65836,9 @@ function createOtelReporterPlugin(cfg, deps) {
       startUnixNano,
       endUnixNano,
       feature: st.feature,
+      project: st.project,
+      gitBranch: st.gitBranch,
+      gitSha: st.gitSha,
       runId: e.runId,
       storySummary: e.storySummary,
       totalCost: e.totalCost,
@@ -65570,11 +65848,23 @@ function createOtelReporterPlugin(cfg, deps) {
       serviceName: cfg.serviceName,
       runId: e.runId,
       timeUnixNano: endUnixNano,
+      feature: st.feature,
+      project: st.project,
+      gitBranch: st.gitBranch,
+      gitSha: st.gitSha,
       storySummary: e.storySummary,
       totalCost: e.totalCost,
       totalDurationMs: e.totalDurationMs
     });
-    const aggMetrics = st.metrics.buildMetricsPayload(cfg.serviceName, e.runId, endUnixNano);
+    const aggMetrics = st.metrics.buildMetricsPayload({
+      serviceName: cfg.serviceName,
+      runId: e.runId,
+      timeUnixNano: endUnixNano,
+      feature: st.feature,
+      project: st.project,
+      gitBranch: st.gitBranch,
+      gitSha: st.gitSha
+    });
     metrics.resourceMetrics[0].scopeMetrics[0].metrics.push(...aggMetrics.resourceMetrics[0].scopeMetrics[0].metrics);
     const opts = { headers: resolved, timeoutMs: cfg.timeoutMs, stage: STAGE3, deps };
     await postJson(`${base}/v1/traces`, traces, opts);
@@ -65585,14 +65875,41 @@ function createOtelReporterPlugin(cfg, deps) {
     async onRunStart(event) {
       const identity = rootSpanIdentity();
       const runId = event.runId;
+      let gitBranch;
+      let gitSha;
+      if (base && workdir) {
+        const [branchResult, shaResult] = await Promise.all([
+          gitWithTimeout(["rev-parse", "--abbrev-ref", "HEAD"], workdir).catch(() => null),
+          gitWithTimeout(["rev-parse", "HEAD"], workdir).catch(() => null)
+        ]);
+        if (branchResult?.exitCode === 0) {
+          const branch = branchResult.stdout.trim();
+          if (branch && branch !== "HEAD")
+            gitBranch = branch;
+        }
+        if (shaResult?.exitCode === 0) {
+          const sha = shaResult.stdout.trim();
+          if (sha)
+            gitSha = sha;
+        }
+      }
+      const resourceAttrs = buildResourceAttributes({
+        serviceName: cfg.serviceName,
+        runId,
+        feature: event.feature,
+        project: event.project,
+        git: { branch: gitBranch, sha: gitSha }
+      });
       const state = {
         ...identity,
         startMs: Date.parse(event.startTime),
         feature: event.feature,
         project: event.project ?? "",
+        gitBranch,
+        gitSha,
         events: [],
         spanTree: createSpanTree(identity.traceId, identity.spanId),
-        spanQueue: makeSpanQueue(),
+        spanQueue: makeSpanQueue(resourceAttrs),
         metrics: createPhaseMetricsAggregator(),
         storyBounds: new Map,
         costUsd: 0,
@@ -65603,6 +65920,27 @@ function createOtelReporterPlugin(cfg, deps) {
         })
       };
       states.set(runId, state);
+      if (cfg.logs?.enabled) {
+        const logsQueue = makeLogsQueue({
+          serviceName: cfg.serviceName,
+          runId,
+          feature: event.feature,
+          project: event.project ?? "",
+          gitBranch,
+          gitSha
+        });
+        const floorKey = cfg.logs.level;
+        const sank = (entry) => {
+          if (REENTRY_STAGES.has(entry.stage))
+            return;
+          if (LOG_PRIORITY[entry.level] > LOG_PRIORITY[floorKey])
+            return;
+          logsQueue.enqueue(entry);
+        };
+        const addSinkFn = deps?.addSink ?? addSink;
+        state.logsQueue = logsQueue;
+        state.logUnsubscribe = addSinkFn(sank);
+      }
     },
     async onStoryComplete(event) {
       const st = states.get(event.runId);
@@ -65674,6 +66012,11 @@ function createOtelReporterPlugin(cfg, deps) {
       states.delete(event.runId);
       await st.spanQueue.flushNow();
       st.spanQueue.teardown();
+      if (st.logsQueue) {
+        await st.logsQueue.flushNow();
+        st.logsQueue.teardown();
+        st.logUnsubscribe?.();
+      }
       await flush(st, startMs + event.totalDurationMs, event);
     }
   };
@@ -65691,6 +66034,11 @@ function createOtelReporterPlugin(cfg, deps) {
         st.heartbeat.stop();
         await st.spanQueue.flushNow();
         st.spanQueue.teardown();
+        if (st.logsQueue) {
+          await st.logsQueue.flushNow();
+          st.logsQueue.teardown();
+          st.logUnsubscribe?.();
+        }
         const endMs = Date.now();
         await flush(st, endMs, {
           runId,
@@ -65703,14 +66051,25 @@ function createOtelReporterPlugin(cfg, deps) {
     extensions: { reporter }
   };
 }
-var STAGE3 = "otel-reporter", DEFAULT_MAX_BATCH_SIZE = 64, DEFAULT_FLUSH_INTERVAL_MS = 5000, DEFAULT_MAX_QUEUE_SIZE = 2048;
+var STAGE3 = "otel-reporter", REENTRY_STAGE = "otel-batch-queue", REENTRY_STAGES, DEFAULT_MAX_BATCH_SIZE = 64, DEFAULT_FLUSH_INTERVAL_MS = 5000, DEFAULT_MAX_QUEUE_SIZE = 2048, LOG_PRIORITY;
 var init_otel_reporter = __esm(() => {
   init_logger2();
+  init_git();
   init_reporter_shared();
   init_batch_queue();
   init_heartbeat();
+  init_logs();
+  init_otlp();
   init_span_tree();
   init_traceparent();
+  REENTRY_STAGES = new Set([STAGE3, REENTRY_STAGE]);
+  LOG_PRIORITY = {
+    silent: -1,
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3
+  };
 });
 
 // src/plugins/builtin/webhook-reporter/index.ts
@@ -66166,7 +66525,7 @@ async function loadPlugins(globalDir, projectDir, configPlugins, projectRoot, di
     {
       name: "otel-reporter",
       enabled: reporters.otel.enabled,
-      make: () => createOtelReporterPlugin(reporters.otel)
+      make: () => createOtelReporterPlugin(reporters.otel, undefined, effectiveProjectRoot)
     }
   ] : [];
   for (const { name, enabled: reporterEnabled, make } of reporterFactories) {

package/flows/nax-finish/nax-finish.flow.ts

@@ -17,11 +17,20 @@
  * - `load_ctx` is an `action`, not a `compute`: it shells git + `nax features
  *   resolve` once, and its output feeds both the review prompts (specPath) and
  *   the acceptance gate (groups), so nothing resolves the feature twice.
- * - Review fixes loop: `review_* → route_* → fix_* → (re-run acceptance |
- *   re-review) → review_*` until the reviewer comes back clean or the fix cap
- *   trips. A single-shot fix left the fixed diff unverified.
+ * - Review fixes loop: `review_* → route_* → fix_* → commit_* → (re-run
+ *   acceptance | re-review) → review_*` until the reviewer comes back clean or
+ *   the fix cap trips. A single-shot fix left the fixed diff unverified.
+ * - Every `fix_*` node is followed by a `commit_*` node. The reviewers read
+ *   `git diff <base>...HEAD`, so an uncommitted fix is invisible to the
+ *   re-review: the loop re-reported findings that were already fixed and always
+ *   escalated at the cap (issue #1397).
  * - `route_*` compute nodes hold the escalate/clean/fix decision so the cap is
  *   enforced deterministically rather than trusting the model's own route.
+ * - `quality_gates` re-runs the feature's acceptance tests before the repo's
+ *   own commands. The quality-review and gate fix loops both edit code after
+ *   the `acceptance` node last passed, and the repo-root `test` command does
+ *   not cover per-feature acceptance tests — so without this a fix could break
+ *   the contract the first gate proved and still ship.
  */
 import { defineFlow, extractJsonObject } from "acpx/flows";
 import { buildReviewPrompt, fixPrompt } from "./review-prompts";
@@ -29,6 +38,7 @@ import {
   _contextDeps,
   buildEscalationComment,
   commitAndPush,
+  commitFixes,
   detectBaseBranch,
   loadQualityCommands,
   openOrPromotePr,
@@ -39,7 +49,7 @@ import {
   runQualityGates,
   writeResult,
 } from "./steps";
-import type { AcceptanceGroup, FinishInput, ReviewVerdict } from "./types";
+import type { AcceptanceGroup, FinishInput, FinishResult, ReviewVerdict } from "./types";
 
 const inputOf = (ctx: { input: unknown }) => ctx.input as FinishInput;
 
@@ -55,6 +65,8 @@ interface LoadCtxOutput {
   base?: string;
   specPath?: string;
   groups?: AcceptanceGroup[];
+  /** `nax features resolve`'s acceptance status: "ok" | "disabled" | "no-prd". */
+  acceptanceStatus?: string;
   route?: string;
 }
 
@@ -66,16 +78,48 @@ function loadCtxOf(ctx: { outputs: unknown }): LoadCtxOutput {
   return ((ctx.outputs as Record<string, LoadCtxOutput | undefined>).load_ctx ?? {}) as LoadCtxOutput;
 }
 
-/** Re-run the acceptance gate, routing on the shared fix-cap rules. */
+/**
+ * Re-run the acceptance gate, routing on the shared fix-cap rules.
+ *
+ * "Nothing ran" is not a pass — the same rule `quality_gates` applies to an
+ * unconfigured repo. `nax features resolve` reports `groups: []` for BOTH
+ * `no-prd` and `disabled`, and reports `exists: false` for a group whose test
+ * was expected at its canonical path but never generated. Treating all of those
+ * as green let the flow open a ready PR having verified nothing about the
+ * feature's own contract (#1398). Only `disabled` — the repo's explicit opt-out
+ * — skips cleanly.
+ */
 async function acceptanceGateNode(ctx: {
   input: unknown;
   outputs: unknown;
   state: { steps: { nodeId: string }[] };
 }): Promise<{ route: string; reason?: string; output: string }> {
   const i = inputOf(ctx);
-  const groups = loadCtxOf(ctx).groups ?? [];
+  const { groups = [], acceptanceStatus } = loadCtxOf(ctx);
+  if (acceptanceStatus === "disabled") {
+    return { route: "proceed", output: "[acceptance] disabled in .nax/config.json — skipping" };
+  }
+  if (acceptanceStatus === "no-prd") {
+    return {
+      route: "escalate",
+      reason: `Acceptance targets could not be computed (status: no-prd) — nothing was verified for "${i.feature}".`,
+      output: "[acceptance] no prd.json resolved — acceptance targets unknown",
+    };
+  }
+
   const r = await runAcceptanceGate(i.workdir, groups, { timeoutMs: i.timeouts?.acceptanceMs });
-  if (r.passed) return { route: "proceed", output: r.output };
+  if (r.passed) {
+    // A real failure below routes to the fix loop, which is more actionable;
+    // the coverage hole is only reported once the runnable groups are green.
+    if (r.missing.length > 0) {
+      return {
+        route: "escalate",
+        reason: `Acceptance test never generated for: ${r.missing.join(", ")} — that package's contract is unverified.`,
+        output: r.output,
+      };
+    }
+    return { route: "proceed", output: r.output };
+  }
   const attempts = fixAttemptCount(ctx, "fix_acceptance");
   if (attempts >= MAX_FIX_ATTEMPTS) {
     return {
@@ -119,6 +163,26 @@ function routeReview(
   return { route: "fix", findings };
 }
 
+/**
+ * Build the `commit_<phase>` node that follows `fix_<phase>`.
+ *
+ * One node per phase rather than a single shared one because each returns to a
+ * different successor, and acpx routes on the node id — a shared node would
+ * need a switch reconstructing which fix ran from the step history.
+ */
+function commitFixNode(phase: "acceptance" | "spec" | "quality" | "gate") {
+  return {
+    nodeType: "action" as const,
+    async run(ctx: { input: unknown }): Promise<{ committed: boolean }> {
+      const i = inputOf(ctx);
+      // skipHooks: an intermediate checkpoint must not be rejected by a repo's
+      // pre-commit hook — quality_gates runs the repo's real gates before any
+      // PR opens, and a hook failure here would kill the flow mid-loop.
+      return commitFixes(i.workdir, `fix(${i.feature}): nax-finish ${phase} fixes`, { skipHooks: true });
+    },
+  };
+}
+
 /** Normalise a reviewer's JSON, rewriting a findings-free `proceed` to `clean`. */
 function parseVerdict(text: string): ReviewVerdict {
   const raw = extractJsonObject(text) as Partial<ReviewVerdict>;
@@ -162,6 +226,7 @@ export default defineFlow({
       prompt: (ctx) => fixPrompt("acceptance", ctx),
       parse: parseVerdict,
     },
+    commit_acceptance: commitFixNode("acceptance"),
     review_spec: {
       nodeType: "acp",
       session: { isolated: true },
@@ -181,6 +246,7 @@ export default defineFlow({
       prompt: (ctx) => fixPrompt("spec", ctx),
       parse: parseVerdict,
     },
+    commit_spec: commitFixNode("spec"),
     review_quality: {
       nodeType: "acp",
       session: { isolated: true },
@@ -200,15 +266,57 @@ export default defineFlow({
       prompt: (ctx) => fixPrompt("quality", ctx),
       parse: parseVerdict,
     },
+    commit_quality: commitFixNode("quality"),
     fix_gate: {
       nodeType: "acp",
       prompt: (ctx) => fixPrompt("gate", ctx),
       parse: parseVerdict,
     },
+    commit_gate: commitFixNode("gate"),
     quality_gates: {
       nodeType: "action",
       async run(ctx) {
         const i = inputOf(ctx);
+
+        // Acceptance is gate zero here, not just at the `acceptance` node.
+        // Both fix loops that run after it — quality review and this gate —
+        // edit code, and the repo-root `test` command does not cover the
+        // feature's acceptance tests: they live under `<pkg>/.nax/features/<f>/`
+        // and usually need their own runner config. Re-running them here is what
+        // makes "nothing reaches open_pr without the feature's own contract
+        // passing against the tree as it will ship" true on every path (#1398).
+        //
+        // Unconditional, though the common green path re-runs a gate that
+        // already passed: acceptance is the cheapest gate in the pipeline, and a
+        // conditional skip derived from step history would be a check that can
+        // be *wrong* — a silent false green, the failure mode this exists to
+        // prevent.
+        //
+        // `missing` is deliberately ignored: groups are resolved once at
+        // load_ctx, so a coverage hole was already escalated by the acceptance
+        // node and cannot appear here.
+        const acc = await runAcceptanceGate(i.workdir, loadCtxOf(ctx).groups ?? [], {
+          timeoutMs: i.timeouts?.acceptanceMs,
+        });
+        if (!acc.passed) {
+          // Short-circuit: the repo gates are re-run next round anyway, and
+          // skipping them keeps this out of the "nothing configured" branch
+          // below, which would otherwise misreport configured-but-skipped
+          // commands as absent.
+          const accAttempts = fixAttemptCount(ctx, "fix_gate");
+          const failing = ["acceptance"];
+          if (accAttempts >= MAX_FIX_ATTEMPTS) {
+            return {
+              route: "escalate",
+              reason: `A later fix broke the feature's own contract: acceptance still failing after ${accAttempts} fix attempts.`,
+              ran: [],
+              failing,
+              output: acc.output,
+            };
+          }
+          return { route: "fix", ran: [], failing, output: acc.output };
+        }
+
         const cmds = await loadQualityCommands(i.workdir);
         const r = await runQualityGates(i.workdir, cmds, { timeoutMs: i.timeouts?.gateMs });
         if (r.passed) return { route: "green", ran: r.ran, failing: r.failing, output: r.output };
@@ -289,12 +397,36 @@ export default defineFlow({
           syncNote = `\n\n> Note: nax-finish could not push its partial fixes — ${String(err)}`;
         }
 
+        // Write the result BEFORE attempting delivery. Delivery touches the
+        // network and the forge — a rate limit, an expired token, a locked PR
+        // or an unrecognised remote used to throw here, killing the node before
+        // any result existed. The plugin then had nothing to report and, on the
+        // Telegram channel, nothing to notify from: the one path whose job is
+        // to say "a human is needed" was the one path with no fallback (#1399).
+        const result: FinishResult = {
+          feature: i.feature,
+          status: "escalated",
+          escalationReason: reason,
+          findings: verdict?.findings ?? [],
+        };
+        await writeResult(i.workdir, result);
+
         const comment = buildEscalationComment(i.feature, reason, verdict?.findings ?? []) + syncNote;
-        const { url, channel } = await postEscalation(i.workdir, i.branch, comment, {
-          preferTelegram: i.escalateTelegram,
-        });
-        await writeResult(i.workdir, { feature: i.feature, status: "escalated", url, escalationReason: reason });
-        return { route: "done", url, channel, escalationReason: reason };
+        let url: string | undefined;
+        let channel: string | undefined;
+        let deliveryError: string | undefined;
+        try {
+          const posted = await postEscalation(i.workdir, i.branch, comment, {
+            preferTelegram: i.escalateTelegram,
+          });
+          url = posted.url;
+          channel = posted.channel;
+        } catch (err) {
+          deliveryError = String(err);
+        }
+        await writeResult(i.workdir, { ...result, url, deliveryError });
+
+        return { route: "done", url, channel, deliveryError, escalationReason: reason };
       },
     },
   },
@@ -304,7 +436,11 @@ export default defineFlow({
       from: "acceptance",
       switch: { on: "$.route", cases: { proceed: "review_spec", fix: "fix_acceptance", escalate: "escalate" } },
     },
-    { from: "fix_acceptance", to: "acceptance" },
+    // Each fix commits before anything re-reads the diff: the reviewers see
+    // `git diff <base>...HEAD` only, so an uncommitted fix would be re-reported
+    // verbatim until the cap escalated it (#1397).
+    { from: "fix_acceptance", to: "commit_acceptance" },
+    { from: "commit_acceptance", to: "acceptance" },
     { from: "review_spec", to: "route_spec" },
     {
       from: "route_spec",
@@ -312,7 +448,8 @@ export default defineFlow({
     },
     // Spec fixes re-run the acceptance gate first (they can break it), and the
     // acceptance node's `proceed` edge leads back into review_spec for re-review.
-    { from: "fix_spec", to: "acceptance" },
+    { from: "fix_spec", to: "commit_spec" },
+    { from: "commit_spec", to: "acceptance" },
     { from: "review_quality", to: "route_quality" },
     {
       from: "route_quality",
@@ -320,11 +457,13 @@ export default defineFlow({
     },
     // Quality fixes are re-reviewed by the same lens; the repo-root gates that
     // follow catch anything the fix broke mechanically.
-    { from: "fix_quality", to: "review_quality" },
+    { from: "fix_quality", to: "commit_quality" },
+    { from: "commit_quality", to: "review_quality" },
     {
       from: "quality_gates",
       switch: { on: "$.route", cases: { green: "open_pr", fix: "fix_gate", escalate: "escalate" } },
     },
-    { from: "fix_gate", to: "quality_gates" },
+    { from: "fix_gate", to: "commit_gate" },
+    { from: "commit_gate", to: "quality_gates" },
   ],
 });

package/flows/nax-finish/steps/acceptance.ts

@@ -21,24 +21,47 @@ export function buildAcceptanceCommand(repoRoot: string, group: AcceptanceGroup)
   return template.replace(/\{\{FILE\}\}|\{\{file\}\}|\{\{files\}\}/g, absFile);
 }
 
+export interface AcceptanceGateOutcome {
+  /** Every group that ran exited 0. Says nothing about groups that could not run. */
+  passed: boolean;
+  ran: number;
+  /**
+   * Package names whose acceptance test the resolver expected at its canonical
+   * path but which is absent on disk — never generated, or generation failed.
+   * The caller must treat a non-empty list as a coverage hole rather than a
+   * pass: skipping these silently is how a feature reached a "ready" PR with
+   * nothing verified.
+   */
+  missing: string[];
+  output: string;
+}
+
 export async function runAcceptanceGate(
   repoRoot: string,
   groups: AcceptanceGroup[],
   opts: { timeoutMs?: number } = {},
-): Promise<{ passed: boolean; ran: number; output: string }> {
+): Promise<AcceptanceGateOutcome> {
   const chunks: string[] = [];
   const timeoutMs = opts.timeoutMs ?? DEFAULT_ACCEPTANCE_TIMEOUT_MS;
+  const missing: string[] = [];
   let ran = 0;
   for (const g of groups) {
-    if (!g.exists) continue;
+    const name = g.packageDir || "root";
+    if (!g.exists) {
+      missing.push(name);
+      continue;
+    }
     const cwd = g.packageDir ? `${repoRoot}/${g.packageDir}` : repoRoot;
     ran += 1;
     const res = await _acceptanceDeps.runShell(buildAcceptanceCommand(repoRoot, g), { cwd, timeoutMs });
-    chunks.push(`[${g.packageDir || "root"}] exit=${res.exitCode}\n${res.stdout}\n${res.stderr}`);
-    if (res.exitCode !== 0) return { passed: false, ran, output: chunks.join("\n\n") };
+    chunks.push(`[${name}] exit=${res.exitCode}\n${res.stdout}\n${res.stderr}`);
+    if (res.exitCode !== 0) return { passed: false, ran, missing, output: chunks.join("\n\n") };
+  }
+  if (missing.length > 0) {
+    chunks.push(`[acceptance] no acceptance test file on disk for: ${missing.join(", ")}`);
   }
   if (ran === 0) chunks.push("[acceptance] no acceptance test files present — nothing to run");
-  return { passed: true, ran, output: chunks.join("\n\n") };
+  return { passed: true, ran, missing, output: chunks.join("\n\n") };
 }
 
 function languageRunner(language: string): string {

package/flows/nax-finish/steps/forge.ts

@@ -12,15 +12,64 @@ const URL_REGEX = /https?:\/\/\S+/;
 
 export type Forge = "github" | "gitlab";
 
+/**
+ * Host of a git remote, for both URL forms git accepts:
+ * `git@host:path` (scp-like) and `scheme://[user@]host[:port]/path`.
+ */
+export function remoteHost(remoteUrl: string): string {
+  const scp = remoteUrl.match(/^[^/]*@([^:/]+):/);
+  if (scp?.[1]) return scp[1].toLowerCase();
+  const url = remoteUrl.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]*@)?([^:/]+)/i);
+  return url?.[1]?.toLowerCase() ?? "";
+}
+
+/**
+ * Classify by host name.
+ *
+ * Matching the host (not a substring of the whole URL) is what makes
+ * self-hosted instances work: `"gitlab.mycorp.com".includes("gitlab.com")` is
+ * false, so the previous check rejected every self-hosted forge. GitHub is
+ * tested first purely for determinism on an absurd host naming both.
+ */
+function forgeFromHost(host: string): Forge | null {
+  if (host.includes("github")) return "github";
+  if (host.includes("gitlab")) return "gitlab";
+  return null;
+}
+
+/**
+ * Last resort for an enterprise host that names neither forge (`git.corp.com`):
+ * ask which CLI is installed. Only decisive when exactly one is — with both or
+ * neither present a guess would send `gh` at a GitLab remote.
+ */
+async function forgeFromCli(run: RunFn, repoRoot: string): Promise<Forge | null> {
+  const [gh, glab] = await Promise.all([
+    run(["gh", "--version"], { cwd: repoRoot }),
+    run(["glab", "--version"], { cwd: repoRoot }),
+  ]);
+  const hasGh = gh.exitCode === 0;
+  const hasGlab = glab.exitCode === 0;
+  if (hasGh && !hasGlab) return "github";
+  if (hasGlab && !hasGh) return "gitlab";
+  return null;
+}
+
 export async function detectForge(run: RunFn, repoRoot: string, stage: string): Promise<Forge> {
   const remote = await run(["git", "remote", "get-url", "origin"], { cwd: repoRoot });
   const remoteUrl = remote.stdout.trim();
-  if (remoteUrl.includes("github.com")) return "github";
-  if (remoteUrl.includes("gitlab.com")) return "gitlab";
-  throw new FinishError(`Unable to determine forge from remote URL "${remoteUrl}"`, "FINISH_UNKNOWN_FORGE", {
-    stage,
-    remoteUrl,
-  });
+  const host = remoteHost(remoteUrl);
+
+  const byHost = forgeFromHost(host);
+  if (byHost) return byHost;
+
+  const byCli = await forgeFromCli(run, repoRoot);
+  if (byCli) return byCli;
+
+  throw new FinishError(
+    `Unable to determine forge for remote host "${host || remoteUrl}" — its name matches neither github nor gitlab, and the gh/glab probe was inconclusive`,
+    "FINISH_UNKNOWN_FORGE",
+    { stage, remoteUrl, host },
+  );
 }
 
 /** Best-effort URL extraction: try `{url}` JSON first, fall back to a raw URL regex. */

package/flows/nax-finish/steps/git.ts

@@ -1,11 +1,17 @@
 /**
  * Branch synchronisation for the nax-finish flow.
  *
- * Every fix node edits the working tree in place. Without this step those edits
- * stay local and uncommitted: `gh pr create --head <branch>` then opens a PR
- * from the *remote* branch, which is missing every fix the flow just made (and
- * an escalation comment would describe state nobody else can see). Both
- * terminal nodes call `commitAndPush` before touching the forge.
+ * Every fix node edits the working tree in place, which two different consumers
+ * would otherwise miss:
+ *
+ * - The **reviewers** read `git diff <base>...HEAD` — committed history only.
+ *   With the fixes uncommitted, every re-review re-read the pre-fix code and
+ *   re-reported findings the fix node had already resolved, so the loop could
+ *   never converge and always escalated at the fix cap (issue #1397). Each
+ *   `commit_*` node calls `commitFixes` for this reason.
+ * - The **forge**: `gh pr create --head <branch>` opens a PR from the *remote*
+ *   branch, and an escalation comment would describe state nobody else can see.
+ *   Both terminal nodes call `commitAndPush` before touching the forge.
  */
 import { FinishError } from "../errors";
 import { runArgv } from "../exec";
@@ -32,34 +38,62 @@ async function isDirty(repoRoot: string): Promise<boolean> {
   return status.stdout.trim().length > 0;
 }
 
+/**
+ * Commit the working tree, if it has anything in it, without pushing.
+ *
+ * Called by the `commit_*` nodes after every fix node so the next reviewer's
+ * `git diff <base>...HEAD` contains the fix. `git add -A` (not `-u`) because a
+ * fix routinely adds a *new* test file, and an untracked file is invisible to
+ * that diff — which is also why committing beats widening the reviewer's diff
+ * to include the working tree.
+ *
+ * `skipHooks` (used by every mid-loop `commit_*` node) adds `--no-verify`. Those
+ * commits are internal checkpoints, not shipped history: a repo whose
+ * pre-commit hook runs lint or typecheck would otherwise reject an intermediate
+ * state — a lint error the gate loop was about to fix — and take the whole flow
+ * down with it, with no result file. Nothing is lost by skipping them, because
+ * `quality_gates` runs the repo's own build/typecheck/lint/test and no PR opens
+ * unless they are green. The terminal `commitAndPush` leaves hooks enabled.
+ *
+ * A failing commit still throws: the fix is then unreviewable, and continuing
+ * would silently reproduce the stale-diff bug this exists to fix.
+ */
+export async function commitFixes(
+  repoRoot: string,
+  message: string,
+  opts: { skipHooks?: boolean } = {},
+): Promise<{ committed: boolean }> {
+  if (!(await isDirty(repoRoot))) return { committed: false };
+
+  const add = await _gitDeps.run(["git", "add", "-A"], { cwd: repoRoot });
+  if (add.exitCode !== 0) {
+    throw new FinishError(
+      `git add failed in "${repoRoot}": ${add.stderr.trim() || `exit ${add.exitCode}`}`,
+      "FINISH_GIT_ADD_FAILED",
+      { stage: "finish-git", repoRoot },
+    );
+  }
+  const commitArgv = ["git", "commit", "-m", message, ...(opts.skipHooks ? ["--no-verify"] : [])];
+  const commit = await _gitDeps.run(commitArgv, { cwd: repoRoot });
+  if (commit.exitCode !== 0) {
+    throw new FinishError(
+      `git commit failed in "${repoRoot}": ${commit.stderr.trim() || commit.stdout.trim() || `exit ${commit.exitCode}`}`,
+      "FINISH_GIT_COMMIT_FAILED",
+      { stage: "finish-git", repoRoot },
+    );
+  }
+  return { committed: true };
+}
+
 /**
  * Commit any outstanding fixes and push the branch to `origin`.
  *
  * The push is unconditional — even with nothing new to commit the local branch
- * may be ahead of its remote (nax's own run commits, or a previous partial
- * finish), and the PR must reflect HEAD.
+ * may be ahead of its remote (nax's own run commits, or the `commit_*` nodes'
+ * per-round commits), and the PR must reflect HEAD.
  */
 export async function commitAndPush(repoRoot: string, branch: string, message: string): Promise<SyncOutcome> {
-  let committed = false;
-  if (await isDirty(repoRoot)) {
-    const add = await _gitDeps.run(["git", "add", "-A"], { cwd: repoRoot });
-    if (add.exitCode !== 0) {
-      throw new FinishError(
-        `git add failed in "${repoRoot}": ${add.stderr.trim() || `exit ${add.exitCode}`}`,
-        "FINISH_GIT_ADD_FAILED",
-        { stage: "finish-git", repoRoot },
-      );
-    }
-    const commit = await _gitDeps.run(["git", "commit", "-m", message], { cwd: repoRoot });
-    if (commit.exitCode !== 0) {
-      throw new FinishError(
-        `git commit failed in "${repoRoot}": ${commit.stderr.trim() || commit.stdout.trim() || `exit ${commit.exitCode}`}`,
-        "FINISH_GIT_COMMIT_FAILED",
-        { stage: "finish-git", repoRoot, branch },
-      );
-    }
-    committed = true;
-  }
+  const { committed } = await commitFixes(repoRoot, message);
 
   const push = await _gitDeps.run(["git", "push", "--set-upstream", "origin", branch], { cwd: repoRoot });
   if (push.exitCode !== 0) {

package/flows/nax-finish/types.ts

@@ -48,6 +48,20 @@ export interface FinishResult {
   status: "opened" | "promoted" | "already-ready" | "escalated" | "nothing-to-finish";
   url?: string;
   escalationReason?: string;
+  /**
+   * The findings behind an escalation. Persisted because the reason alone is a
+   * bare count ("3 finding(s) after 3 fix attempts"), and on the Telegram
+   * channel the composed PR comment — the only other thing carrying them — is
+   * never posted. Without this the findings survived only in acpx's run bundle.
+   */
+  findings?: Finding[];
+  /**
+   * Set when the escalation could not be delivered to its channel (forge
+   * comment failed, remote unrecognised). The result file is written before
+   * delivery is attempted, so an undelivered escalation is still reported
+   * rather than lost.
+   */
+  deliveryError?: string;
 }
 export interface RunResult {
   exitCode: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax",
-  "version": "0.75.3",
+  "version": "0.75.4",
   "description": "AI Coding Agent Orchestrator — loops until done",
   "type": "module",
   "bin": {