@on-par/factory-cli 0.9.4 → 0.9.5-next.2

package/dist/cli/index.js

@@ -5,11 +5,11 @@ import { randomUUID } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { createRequire } from 'node:module';
 import { arch, hostname as osHostname, release, platform, userInfo } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
-import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createPlanReuseStore, checkBaseHealth, currentSlice, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
+import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfig, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveBuildRoute, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
+import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
@@ -29,7 +29,7 @@ import { buildUsageJson } from './usage-json.js';
 import { parseResetIssues, runReset } from './reset.js';
 import { cmdDaemonLogs, cmdDaemonStart, cmdDaemonStatus, cmdDaemonStop, createAutoUpdateDeps, DaemonCtlError, detectInstall, loadDaemonFileConfig, recoverStaleDrain, resolveFactorydConfig, runAutoUpdateLoop, } from './daemon.js';
 import { checkForUpdate, cmdSelfUpdateCheck } from './self-update.js';
-import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, declaredHarnessChecks, hasSandboxRuntime, leaseChecks, keychainPreflightError, orphanContainerChecks, modelsRegistryChecks, orphanMicroVmChecks, runDoctorChecks, sandboxAuthSkipDetail, reconcileAgentAuthChecks, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
+import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, declaredHarnessChecks, hasSandboxRuntime, leaseChecks, keychainPreflightError, orphanContainerChecks, configLintChecks, modelsRegistryChecks, orphanMicroVmChecks, runDoctorChecks, sandboxAuthSkipDetail, reconcileAgentAuthChecks, repoCommandHarnesses, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
 import { DOCS_URL, formatOverview, availableAgentClis, missingAgentCliMessage, missingTokenMessage, notInitializedMessage, } from './first-run.js';
 import { cmdHostedSmoke } from './hosted.js';
 import { cmdHostedQueue } from './hosted-queue.js';
@@ -40,6 +40,7 @@ import { ensureFactoryExcluded, writeSampleQueue } from './init-files.js';
 import { cmdLogs } from './logs.js';
 import { applyHelpGroups } from './help-groups.js';
 import { mergeScopeNotice } from './merge-scope.js';
+import { GITHUB_STUB_CALLS_FILE, recordGitPushes, resolveGitHubMode, selectOctokit } from './github-stub.js';
 import { createFactoryOctokit, formatDeprecation } from './octokit.js';
 import { DeepCheckError, createDeepModelRunner, runIssueCheck } from './ready-check.js';
 import { childRunSucceeded, formatChildRunSummary, runChildrenInOrder } from './run-children.js';
@@ -61,6 +62,11 @@ const DEFAULT_CONFIG_LOADERS = {
 /** Loaders for the current main() invocation; DEFAULT_CONFIG_LOADERS outside main(). */
 let configLoaders = DEFAULT_CONFIG_LOADERS;
 /** Per-field `??` so an explicit `undefined` override falls back instead of replacing the default. */
+/** Display path for the repo config file in preflight messages: repo-relative, or absolute when the state root lives outside the repo (#2586). */
+function repoConfigFileFor(repoRoot, absPath) {
+    const rel = relative(repoRoot, absPath);
+    return { absPath, relPath: rel === '' || rel.startsWith('..') || isAbsolute(rel) ? absPath : rel };
+}
 function resolveConfigLoaders(overrides, base = configLoaders) {
     return {
         loadModelsConfig: overrides.loadModelsConfig ?? base.loadModelsConfig,
@@ -223,13 +229,39 @@ async function getRepoRoot(shell = shellOps) {
         throw new CliExitError('factory: not inside a git repository', 2);
     }
 }
+const GH_UNAUTHENTICATED = /gh auth login|not logged in/i;
+const GH_TOKEN_REJECTED = /bad credentials|HTTP 401|401 Unauthorized/i;
+const GH_NO_GITHUB_REMOTE = /no git remotes found|point to a known GitHub host/i;
+/**
+ * CliExitError message for a failed `gh repo view`; names a rejected token and its `repo` scope when gh reports a 401 (#2593),
+ * and gh auth when gh's stderr says it is logged out (#2592). The 401 check runs first because gh's 401 output also says "gh auth login".
+ * gh's known-host remote error is checked before the auth pattern because it also names `gh auth login` (#2594).
+ */
+export function ghRepoViewFailureMessage(stderr) {
+    const detail = stderr
+        ?.trim()
+        .split('\n')
+        .find((l) => l.trim())
+        ?.trim();
+    if (stderr && GH_TOKEN_REJECTED.test(stderr)) {
+        return `factory: GitHub rejected the token (GH_TOKEN/GITHUB_TOKEN); use a token with the \`repo\` scope${detail ? ` (gh repo view failed: ${detail})` : ''}`;
+    }
+    if (stderr && GH_NO_GITHUB_REMOTE.test(stderr)) {
+        return 'factory: no GitHub remote detected (gh repo view failed)';
+    }
+    if (stderr && GH_UNAUTHENTICATED.test(stderr)) {
+        return `factory: gh is not authenticated, run \`gh auth login\`${detail ? ` (gh repo view failed: ${detail})` : ''}`;
+    }
+    return 'factory: no GitHub remote detected (gh repo view failed)';
+}
 async function getGitHubRepo(shell = shellOps) {
     try {
         const { stdout } = await shell.exec('gh repo view --json nameWithOwner --jq .nameWithOwner');
         return stdout.trim();
     }
-    catch {
-        throw new CliExitError('factory: no GitHub remote detected (gh repo view failed)', 2);
+    catch (err) {
+        const stderr = err?.stderr;
+        throw new CliExitError(ghRepoViewFailureMessage(typeof stderr === 'string' ? stderr : undefined), 2);
     }
 }
 /** Env token first, then one `gh auth token` subprocess (≤5 s). `undefined` when neither yields one. */
@@ -247,7 +279,9 @@ function resolveGitHubToken(shell = shellOps) {
 /** Octokit factory for the current main() or cmdLand invocation (CliDeps.octokit); unset outside them. */
 let octokitFactory;
 function getOctokit(shell = shellOps, options) {
-    return octokitFactory ? octokitFactory() : createFactoryOctokit(resolveGitHubToken(shell), options);
+    return octokitFactory
+        ? octokitFactory()
+        : selectOctokit(process.env, () => createFactoryOctokit(resolveGitHubToken(shell), options));
 }
 export function errorDetail(err) {
     const e = err;
@@ -868,6 +902,7 @@ async function cmdCheck(issueRaw, opts) {
         const repoConfig = configLoaders.loadRepoConfig(repoRoot);
         const effective = resolveEffectiveConfig(repoConfig);
         const router = new coreOps.ModelRouter(applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig), configLoaders.loadRoutesConfig(), false, undefined, effective.allowExperimental, effective.localOnly);
+        router.setLocalAuthSink?.(recordLocalAuthFailure);
         runModel = createDeepModelRunner(router, repoRoot);
     }
     let report;
@@ -971,6 +1006,7 @@ async function cmdClassifierBacktestEntry(opts) {
     const repoConfig = configLoaders.loadRepoConfig(repoRoot);
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig), configLoaders.loadRoutesConfig(), false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     try {
         await cmdClassifierBacktest({ ...opts, branchPrefix }, {
             repoRoot,
@@ -1213,6 +1249,7 @@ export async function cmdStatus(opts = {}) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     const product = readActiveProduct(paths.product) ?? '(none)';
     console.log(styleText('bold', `== ${ghRepo} ==`));
     console.log(`Product: ${product}`);
@@ -1391,6 +1428,7 @@ async function cmdTui(opts = {}, runTuiImpl = runTui) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     const effectiveConfigLines = describeEffectiveConfig({
         router,
         repo: repoConfig,
@@ -1448,8 +1486,12 @@ export class LaneEnvironmentPauseError extends Error {
     baseSha;
     failingChecks;
     failureSignature;
+    /** BUILD output was kept for `factory resume --from check` (#2564); runLane must not reap it. */
+    buildPreserved;
     constructor(message, failure) {
         super(message);
+        if (failure.buildPreserved !== undefined)
+            this.buildPreserved = failure.buildPreserved;
         this.baseSha = failure.baseSha;
         this.failingChecks = failure.failingChecks;
         if (failure.failureSignature !== undefined)
@@ -1543,6 +1585,15 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
     const shell = resolveShellOps(deps);
     const core = resolveCoreOps(deps);
     const phases = resolvePhaseOps(deps);
+    // FACTORY_GITHUB=stub (#2652): record each `git push` ship runs in the stub's calls.jsonl.
+    let shipPhaseForMode = phases.shipPhase;
+    if (resolveGitHubMode(process.env) === 'stub') {
+        const base = phases.shipPhase;
+        const stubCalls = join(resolve(process.env.FACTORY_GITHUB_STUB_DIR ?? ''), GITHUB_STUB_CALLS_FILE);
+        const defaultShipRunner = promisify(execCb);
+        const wrapped = (o) => base({ ...o, run: recordGitPushes(o.run ?? defaultShipRunner, stubCalls, o.branch) });
+        shipPhaseForMode = wrapped;
+    }
     const repoRoot = ctx?.repoRoot ?? (await getRepoRoot(shell));
     const ghRepo = ctx?.ghRepo ?? (await getGitHubRepo(shell));
     const paths = ctx?.paths ?? getFactoryPaths(repoRoot);
@@ -1571,6 +1622,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
             : { ...resolveEffectiveConfig(repoConfig), branchPrefix: opts.branchPrefix },
     };
     const router = new core.ModelRouter(policy.models, policy.routes, false, undefined, policy.effective.allowExperimental, policy.effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     router.skipMissingHarnessClis(core.isCommandAvailable);
     let issueSpend = 0;
     let laneSandboxRuntime = 'none';
@@ -1600,7 +1652,11 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
     const maxSlices = opts.maxSlices ?? resolveSizeGateMaxSlices(factoryConfig);
     // ADR-0147: slice k >= 2 builds on its own branch, so read the slice plan before the worktree exists.
     let sliceIndex;
-    if (sizeGateMode === 'slice' && !ctx?.localOnly && work.kind === GITHUB_ISSUE_SOURCE) {
+    // ADR-0161: stack runs as slice until stacked PRs are built.
+    if ((sizeGateMode === 'slice' || sizeGateMode === 'stack') &&
+        !ctx?.localOnly &&
+        !ctx?.resumeFrom &&
+        work.kind === GITHUB_ISSUE_SOURCE) {
         try {
             const lookup = await findSlicePlanComment({ octokit, repo: ghRepo, issue: issueNum });
             if (lookup.status === 'found')
@@ -1610,10 +1666,12 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
             throw new LaneParkError(`slice plan lookup failed for #${issueNum}: ${errorDetail(err)} — parked before creating a worktree`, 'escalate');
         }
     }
-    const branch = branchFor(issueNum, issueTitle, policy.effective.branchPrefix, sliceIndex);
-    const worktree = ctx?.localOnly
-        ? ctx.localOnly.workspace
-        : worktreePathFor(repoRoot, ghRepo, issueNum, policy.effective.branchPrefix, loaders);
+    const branch = ctx?.resumeFrom?.branch ?? branchFor(issueNum, issueTitle, policy.effective.branchPrefix, sliceIndex);
+    const worktree = ctx?.resumeFrom
+        ? ctx.resumeFrom.worktree
+        : ctx?.localOnly
+            ? ctx.localOnly.workspace
+            : worktreePathFor(repoRoot, ghRepo, issueNum, policy.effective.branchPrefix, loaders);
     const specPath = resolve(paths.plans, `issue-${issueNum}.md`);
     const runStartedAt = new Date().toISOString();
     const lane = ctx?.lane;
@@ -1628,6 +1686,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
         'escalate',
         'held',
         'conflict',
+        'config',
         'ci-failed',
         'ci-infra',
         'timeout',
@@ -1710,7 +1769,11 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
     // stays a CLI concern (not called here, matching today — a worktree persists past
     // a successful run for GC/sweep commands to reclaim later).
     let workspace;
-    if (!ctx?.localOnly) {
+    if (ctx?.resumeFrom) {
+        workspace = { path: worktree, dispose: async () => { } };
+        log('worktree', `reusing kept worktree at ${worktree} (resume --from check)`);
+    }
+    else if (!ctx?.localOnly) {
         workspace = await worktreeWorkspace({
             repoRoot,
             branch,
@@ -1791,9 +1854,21 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
         sandboxPolicy: activeSandboxPolicy,
         processGroupGraceMs,
         preferredRoute: repoConfig?.route,
+        ...(ctx?.resumeFrom
+            ? {
+                resumeFrom: {
+                    phase: 'check',
+                    diffBase: ctx.resumeFrom.diffBase,
+                    route: ctx.resumeFrom.route,
+                    model: ctx.resumeFrom.model,
+                    buildMinutes: ctx.resumeFrom.buildMinutes,
+                },
+            }
+            : {}),
         eventsFile: paths.events,
         logsDir: paths.logs,
         baselineCachePath: paths.baselineCache,
+        repoConfigFile: repoConfigFileFor(repoRoot, paths.config),
         flakyLedgerPath: paths.flakyLedger,
     };
     const ports = {
@@ -1806,10 +1881,11 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
         getIssueSpend: () => issueSpend,
         breaker,
         planReuse: ctx?.localOnly ? undefined : createPlanReuseStore(specPath),
+        checkResume: ctx?.localOnly ? undefined : createCheckResumeStore(specPath),
         planPhase: phases.planPhase,
         buildPhase: phases.buildPhase,
         checkPhase: phases.checkPhase,
-        shipPhase: phases.shipPhase,
+        shipPhase: shipPhaseForMode,
         checkBaseHealth: deps.checkBaseHealth ?? checkBaseHealth,
         resolveConstitution: () => 
         // Resolved once here — runIssue calls this exactly once and reuses the value for
@@ -1884,7 +1960,8 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
     const egressProxy = proxied
         ? await startEgressProxy({
             allowHosts: proxied.allowHosts,
-            onHost: (host, allowed) => log('egress_host', `${host} (${allowed ? 'on allowlist' : 'not on allowlist'})`),
+            blockTelemetry: proxied.blockTelemetry,
+            onHost: (host, allowed) => log('egress_host', egressHostMessage(host, allowed)),
         })
         : undefined;
     let outcome;
@@ -1918,6 +1995,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
             baseSha: outcome.baseSha,
             failingChecks: outcome.failingChecks,
             failureSignature: outcome.failureSignature,
+            buildPreserved: outcome.buildPreserved,
         });
     }
     const reason = outcome.state === 'escalated' ? 'escalate' : outcome.reason;
@@ -2522,7 +2600,10 @@ async function landIssue(issueNum, repoRoot, ghRepo, paths, octokit, skipCI, bra
     // Legacy-prefix (LEGACY_BRANCH_PREFIX) branches are guessed too, after the resolved prefix (#1708).
     const resolved = branchPrefix ?? resolveEffectiveConfig(configLoaders.loadRepoConfig(repoRoot)).branchPrefix;
     const title = await getIssueTitle(ghRepo, issueNum, octokit);
-    const guesses = factoryBranchPrefixes(resolved).map((p) => branchFor(issueNum, title, p));
+    // ADR-0161: a stack layer lands by its exact branch, never by title guess or the Closes PR (the top layer).
+    const guesses = opts.branch
+        ? [opts.branch]
+        : factoryBranchPrefixes(resolved).map((p) => branchFor(issueNum, title, p));
     const guessedBranch = guesses[0];
     let branch = guessedBranch;
     let prNumber;
@@ -2538,7 +2619,7 @@ async function landIssue(issueNum, repoRoot, ghRepo, paths, octokit, skipCI, bra
             return undefined;
         };
         [, prNumber] = await Promise.all([gitOps.gitFetch(repoRoot), findByGuess()]);
-        if (!prNumber) {
+        if (!prNumber && !opts.branch) {
             const fallback = await findOpenPRForIssue(octokit, owner, repoName, issueNum);
             if (fallback) {
                 branch = fallback.branch;
@@ -2650,6 +2731,7 @@ async function cmdTriage(opts) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     router.skipMissingHarnessClis(coreOps.isCommandAvailable);
     router.setCostSink((entry) => logCost(paths.costs, { ...entry, issue: '-' }));
     let plannerError;
@@ -2667,7 +2749,7 @@ async function cmdTriage(opts) {
         model = result.model;
         const queue = normalizeTriageQueue(result.output);
         if (queue) {
-            const header = `# Triage queue (model ${model}${product ? `, constitution ${product}` : ''})\n`;
+            const header = triageQueueHeader(model, product);
             writeFileSync(paths.queueProposed, header + queue);
         }
     }
@@ -2686,6 +2768,9 @@ async function cmdTriage(opts) {
         throw triageNoProposalError(plannerError);
     }
 }
+export function triageQueueHeader(model, product) {
+    return `# Triage queue (model ${model}${product ? `, constitution ${product}` : ''})\n`;
+}
 export function triageProposalMessage(proposed, proposedPath, queuePath) {
     if (!proposed.trim())
         return null;
@@ -2695,13 +2780,13 @@ export async function cmdTriageAccept(opts) {
     const repoRoot = await getRepoRoot();
     const paths = getFactoryPaths(repoRoot);
     if (!existsSync(paths.queueProposed)) {
-        console.log(`nothing to accept — ${paths.queueProposed} not found`);
+        console.log(`nothing to accept: ${paths.queueProposed} not found`);
         return; // zero exit
     }
     const content = readFileSync(paths.queueProposed, 'utf-8');
     const result = validateQueue(content);
     if (!opts.force && !result.ok) {
-        throw new CliExitError(`factory: proposed queue is invalid — ${paths.queueProposed} left unchanged\n` +
+        throw new CliExitError(`factory: proposed queue is invalid: ${paths.queueProposed} left unchanged\n` +
             result.errors.map((e) => `  - ${e}`).join('\n'), 1);
     }
     renameSync(paths.queueProposed, paths.queue); // same dir → atomic
@@ -2714,7 +2799,7 @@ export async function cmdTriageAccept(opts) {
     }
     const suffix = opts.force ? ' (--force, validation skipped)' : '';
     logEvent(paths.events, 'triage_accepted', '-', `accepted ${result.issues.length} issue(s) [${result.issues.join(', ')}] by ${acceptedBy}${suffix}`);
-    console.log(styleText('green', `queue accepted — ${result.issues.length} issue(s) promoted to ${paths.queue}`));
+    console.log(styleText('green', `queue accepted: ${result.issues.length} issue(s) promoted to ${paths.queue}`));
 }
 export async function cmdQueueMigrate(opts = {}) {
     const repoRoot = await getRepoRoot();
@@ -3196,7 +3281,10 @@ async function cmdRun(opts = {}) {
                     repo,
                     preflight: withAdmissionGuard({
                         reader: admissionStateReaderFor(paths.state),
-                        preflight: (issue) => preflightQueuedIssue(issue, createQueuePreflightOps(octokit, owner, repo)),
+                        preflight: (issue) => preflightQueuedIssue(issue, createQueuePreflightOps(octokit, owner, repo, {
+                            autoMergeStack: resolveSizeGateMode(factoryConfig) === 'stack' &&
+                                resolveMergePolicy(factoryConfig, process.env, { auto: opts.autoMerge }).auto,
+                        })),
                         onConflict: (issue, verdict) => {
                             const line = `#${issue} refused — ${verdict.reason} | repair: ${verdict.repair}`;
                             console.error(styleText('yellow', `factory: ${line}`));
@@ -3231,6 +3319,27 @@ async function cmdRun(opts = {}) {
             console.log(`[factory] run: ${detail}`);
             logEvent(paths.events, 'watchdog', 'all', detail);
         }
+        let watchdogHarness;
+        if (knobs.watch) {
+            try {
+                const repoConfig = configLoaders.loadRepoConfig(repoRoot);
+                const registry = new coreOps.ModelRegistry(applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig));
+                const pins = configLoaders.resolveEffectiveModelPins(registry, repoConfig, process.env);
+                const build = resolveEffectiveBuildRoute(registry, repoConfig, pins);
+                watchdogHarness = resolveRunUsageHarness({
+                    buildRoute: build.route,
+                    buildRouteSource: build.source,
+                    planHarnesses: [pins.plan, pins.planFallback]
+                        .filter((m) => !!m)
+                        .map((m) => registry.getHarnessId(m)),
+                    codexDisabled: resolveCodexDisabled(repoConfig),
+                    localOnly: resolveLocalOnly(),
+                });
+            }
+            catch {
+                watchdogHarness = undefined; // unresolvable config keeps today's Claude gating
+            }
+        }
         const controller = new AbortController();
         const watchdog = knobs.watch
             ? coreOps
@@ -3242,6 +3351,7 @@ async function cmdRun(opts = {}) {
                 eventsFile: paths.events,
                 signal: controller.signal,
                 estimator: knobs.estimator,
+                ...(watchdogHarness ? { harness: watchdogHarness } : {}),
             })
                 .catch((err) => {
                 // a watchdog crash must never take down the run
@@ -3290,6 +3400,7 @@ async function cmdRun(opts = {}) {
                     ship: (issue, o, c) => shipIssue(issue, { ...o, branchPrefix, prClassifier: opts.prClassifier }, c),
                     sweepFinished: (issue) => sweepBetweenLaneIssues(issue, planned.lane, repoRoot, ghRepo, paths).then(() => { }),
                     reapWorktree: (issue) => reapParkedLaneWorktree(issue, repoRoot, ghRepo, paths, opts.branchPrefix === undefined ? undefined : branchPrefix),
+                    recordStackMerge: (issue, prNumber) => recordSliceMerged({ octokit: getOctokit(), repo: ghRepo, issue, prNumber }).then(() => { }),
                     waitMerge: (issue, branch, root, gh, p, d = {}) => waitForMerge(issue, branch, root, gh, p, { ...d, mergeOverrides: { auto: opts.autoMerge } }),
                 }));
             }
@@ -3424,8 +3535,13 @@ export function laneQueueDeps(queue, lane) {
         countRemaining: async () => (await queue.list(lane)).length,
     };
 }
-export function createQueuePreflightOps(octokit, owner, repo) {
+export function createQueuePreflightOps(octokit, owner, repo, opts = {}) {
     return {
+        autoMergeStack: opts.autoMergeStack ?? false,
+        getPullRefs: async (prNumber) => {
+            const { data } = await octokit.rest.pulls.get({ owner, repo, pull_number: prNumber });
+            return { headRef: data.head.ref, baseRef: data.base.ref, headSha: data.head.sha };
+        },
         expectedHeadRepoFullName: `${owner}/${repo}`,
         findOpenPR: (issue) => findOpenPRForIssue(octokit, owner, repo, issue),
         getLandState: (prNumber) => getPullRequestLandState(octokit, owner, repo, prNumber),
@@ -3442,8 +3558,10 @@ export function createQueuePreflightOps(octokit, owner, repo) {
         },
     };
 }
-/** ADR-0147: wait on the current slice PR, record its merge, or park when it was closed unmerged.
- *  Returns undefined to fall through to the Closes-PR preflight. */
+/** ADR-0147/ADR-0161: walk every pr-open slice PR bottom-up. Merged layers are recorded, a closed layer parks
+ *  (naming the layers above it), and the lowest open layer defers, or is adopted when stack auto-merge is on and
+ *  its base is main with green CI on the rebased head. Returns undefined to fall through to the Closes-PR
+ *  preflight only when no slice PR is still open. */
 async function preflightSlice(issue, deps) {
     let lookup;
     try {
@@ -3461,36 +3579,80 @@ async function preflightSlice(issue, deps) {
     if (lookup.status === 'not-found')
         return undefined;
     const { plan } = lookup;
-    const slice = currentSlice(plan);
-    if (slice === undefined || slice.state !== 'pr-open')
+    const n = plan.slices.length;
+    const open = plan.slices.filter((s) => s.state === 'pr-open');
+    if (open.length === 0)
         return undefined;
-    const label = `slice ${slice.index}/${plan.slices.length}`;
-    if (slice.prNumber === undefined) {
-        return { kind: 'park', reason: `${label} of #${issue} is pr-open but the slice plan records no PR number` };
-    }
-    const pr = slice.prNumber;
-    let state;
-    try {
-        state = await deps.getPullState(pr);
-    }
-    catch (err) {
-        return { kind: 'park', reason: `${label} PR #${pr} state lookup failed: ${errorDetail(err)}` };
-    }
-    if (state === 'open')
-        return { kind: 'defer' };
-    if (state === 'closed') {
-        return { kind: 'park', reason: `${label} PR #${pr} was closed without merging` };
-    }
-    try {
-        await deps.saveSlicePlan(issue, withSliceState(plan, slice.index, 'merged', pr));
-    }
-    catch (err) {
-        return {
-            kind: 'park',
-            reason: `${label} PR #${pr} merged but updating the slice plan failed: ${errorDetail(err)}`,
-        };
+    let next = plan;
+    let lastMerged;
+    const save = async () => {
+        if (lastMerged === undefined)
+            return undefined;
+        try {
+            await deps.saveSlicePlan(issue, next);
+        }
+        catch (err) {
+            return {
+                kind: 'park',
+                reason: `${lastMerged.label} PR #${lastMerged.pr} merged but updating the slice plan failed: ${errorDetail(err)}`,
+            };
+        }
+        return undefined;
+    };
+    for (const [at, slice] of open.entries()) {
+        const label = `slice ${slice.index}/${n}`;
+        if (slice.prNumber === undefined) {
+            return { kind: 'park', reason: `${label} of #${issue} is pr-open but the slice plan records no PR number` };
+        }
+        const pr = slice.prNumber;
+        let state;
+        try {
+            state = await deps.getPullState(pr);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `${label} PR #${pr} state lookup failed: ${errorDetail(err)}` };
+        }
+        if (state === 'merged') {
+            next = withSliceState(next, slice.index, 'merged', pr);
+            lastMerged = { label, pr };
+            continue;
+        }
+        if (state === 'closed') {
+            const above = open.slice(at + 1);
+            const suffix = above.length > 0
+                ? `; layers above it: ${above.map((a) => `slice ${a.index}/${n} (#${a.prNumber})`).join(', ')}`
+                : '';
+            return { kind: 'park', reason: `${label} PR #${pr} was closed without merging${suffix}` };
+        }
+        const saved = await save();
+        if (saved)
+            return saved;
+        if (!deps.autoMergeStack)
+            return { kind: 'defer' };
+        let refs;
+        try {
+            refs = await deps.getPullRefs(pr);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `${label} PR #${pr} ref lookup failed: ${errorDetail(err)}` };
+        }
+        // GitHub has not retargeted the layer to main yet: the lower layer is still unmerged.
+        if (refs.baseRef !== 'main')
+            return { kind: 'defer' };
+        let outcome;
+        try {
+            outcome = await deps.watch(refs.headSha);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `CI watch for ${label} PR #${pr} failed: ${errorDetail(err)}` };
+        }
+        if (outcome === 'failure')
+            return { kind: 'park', reason: `CI for ${label} PR #${pr} ended failure` };
+        if (outcome !== 'success')
+            return { kind: 'defer' };
+        return { kind: 'adopt', branch: refs.headRef, stackLayer: { index: slice.index, count: n, prNumber: pr } };
     }
-    return undefined;
+    return (await save()) ?? undefined;
 }
 /** Resolve queued work from GitHub evidence without consuming model or worktree resources. */
 export async function preflightQueuedIssue(issue, deps) {
@@ -3592,7 +3754,7 @@ export function renderLanePausedComment(payload) {
     ].join('\n\n');
 }
 export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {}) {
-    const { ship = shipIssue, waitMerge = waitForMerge, pathExists = existsSync, emitEvent = logEvent, claimNext = async () => null, releaseIssue = async () => { }, heartbeat, reapWorktree = async () => { }, sweepFinished = async () => { }, countRemaining, baseHoldGate, laneBreakerThreshold = 0, commentIssue = async () => { }, } = deps;
+    const { ship = shipIssue, waitMerge = waitForMerge, recordStackMerge = async () => { }, pathExists = existsSync, emitEvent = logEvent, claimNext = async () => null, releaseIssue = async () => { }, heartbeat, reapWorktree = async () => { }, sweepFinished = async () => { }, countRemaining, baseHoldGate, laneBreakerThreshold = 0, commentIssue = async () => { }, } = deps;
     let streak = null;
     let merged = 0;
     let awaitingReview = 0;
@@ -3654,6 +3816,7 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
             streak = null;
             continue;
         }
+        const layer = decision.kind === 'adopt' ? decision.stackLayer : undefined;
         try {
             const sliceOutcome = {};
             const branch = decision.kind === 'adopt'
@@ -3676,6 +3839,15 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
                 await settle(issue, 'queued');
                 continue;
             }
+            if (layer) {
+                // ADR-0161: land exactly this layer's branch, record it, and re-queue for the next layer.
+                await withHeartbeat(issue, heartbeat, () => waitMerge(issue, branch, repoRoot, ghRepo, paths, { landBranch: branch }));
+                await recordStackMerge(issue, layer.prNumber).catch((err) => emitEvent(paths.events, 'warn', issue, `slice ${layer.index}/${layer.count} merged but recording it failed: ${errorDetail(err)}`, { lane }));
+                merged++;
+                streak = null;
+                await settle(issue, layer.index < layer.count ? 'queued' : 'done');
+                continue;
+            }
             await withHeartbeat(issue, heartbeat, () => waitMerge(issue, branch, repoRoot, ghRepo, paths));
             merged++;
             streak = null;
@@ -3687,7 +3859,7 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
                 // worktree — this is a clean outcome, not a park; move to the next issue.
                 awaitingReview++;
                 streak = null;
-                await settle(issue, 'done');
+                await settle(issue, layer && layer.index < layer.count ? 'queued' : 'done');
                 continue;
             }
             if (err instanceof IssueSkippedError) {
@@ -3712,7 +3884,9 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
                 // The base is broken, not the issue (#1928): release to queued (never parked),
                 // pause the lane whatever laneBreakerThreshold is, and stop claiming.
                 streak = null;
-                await reapWorktree(issue).catch(() => { });
+                // A preserved build is kept for `factory resume --from check` (#2564).
+                if (!err.buildPreserved)
+                    await reapWorktree(issue).catch(() => { });
                 await settle(issue, 'queued');
                 // Persist the hold so a restarted supervisor remembers the broken base (#2348);
                 // best-effort, never allowed to change lane flow.
@@ -4195,7 +4369,7 @@ async function defaultListIssueLabels(octokit, owner, repo, issue) {
     return data.map((label) => label.name);
 }
 export async function waitForMerge(issue, branch, repoRoot, ghRepo, paths, deps = {}) {
-    const { createOctokit = getOctokit, pathExists = existsSync, checkMerged = isPrMerged, loadConfig = configLoaders.loadFactoryConfigForRepo, land = landIssue, listIssueLabels = defaultListIssueLabels, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, mergeEnabled, writeLine = (line) => console.log(line), now = () => Date.now(), mergeOverrides, } = deps;
+    const { createOctokit = getOctokit, pathExists = existsSync, checkMerged = isPrMerged, loadConfig = configLoaders.loadFactoryConfigForRepo, land = landIssue, listIssueLabels = defaultListIssueLabels, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, mergeEnabled, writeLine = (line) => console.log(line), now = () => Date.now(), mergeOverrides, landBranch, } = deps;
     const factoryConfig = loadConfig(paths.config);
     const isMergeEnabled = mergeEnabled ?? (() => resolveMergePolicy(factoryConfig, process.env, mergeOverrides).auto);
     const skipCI = configLoaders.resolveSkipCI(factoryConfig);
@@ -4253,7 +4427,10 @@ export async function waitForMerge(issue, branch, repoRoot, ghRepo, paths, deps
                 await sleep(120_000);
                 continue;
             }
-            await land(issue, repoRoot, ghRepo, paths, octokit, skipCI);
+            if (landBranch)
+                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI, undefined, { branch: landBranch });
+            else
+                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI);
             return;
         }
         writeLine(`[factory] #${issue} awaiting human merge (poll 120s)`);
@@ -4383,6 +4560,18 @@ function probeClaudeKeychain() {
     }
 }
 async function cmdDoctor(opts = {}) {
+    let repoRoot;
+    try {
+        repoRoot = shellOps
+            .execSync('git rev-parse --show-toplevel', {
+            timeout: 10_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        })
+            .trim();
+    }
+    catch {
+        repoRoot = null;
+    }
     const checks = runDoctorChecks({
         commandAvailable: coreOps.isCommandAvailable,
         envPresent: (key) => !!process.env[key],
@@ -4409,20 +4598,13 @@ async function cmdDoctor(opts = {}) {
             },
             fileExists: existsSync,
         }),
+        claudeSessionState: () => claudeStoredSessionState(),
+        localAuthFailure: (agent) => localAuthFailureSinceLogin(agent),
         opencodeLoggedIn: () => hasOpencodeLoginEvidence(),
+        commandHarnesses: () => repoRoot === null
+            ? []
+            : repoCommandHarnesses(configLoaders.loadModelsConfig().harnesses, configLoaders.loadRepoConfig(repoRoot)?.models?.registry),
     });
-    let repoRoot;
-    try {
-        repoRoot = shellOps
-            .execSync('git rev-parse --show-toplevel', {
-            timeout: 10_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        })
-            .trim();
-    }
-    catch {
-        repoRoot = null;
-    }
     // Only with --probe-inference: these send a real prompt (uses quota). Plain doctor makes no inference call.
     if (opts.probeInference) {
         const CLAUDE_AUTH_PROBE = 'claude -p "reply with exactly: ok"';
@@ -4435,13 +4617,13 @@ async function cmdDoctor(opts = {}) {
             }
         };
         let host = 'skipped';
-        let hostDetail = 'skipped — claude CLI not on PATH';
+        let hostDetail = 'skipped: claude CLI not on PATH';
         if (coreOps.isCommandAvailable('claude')) {
             host = probeExec(CLAUDE_AUTH_PROBE) === null ? 'failed' : 'ok';
             hostDetail = host === 'ok' ? 'claude -p succeeded on the host' : 'claude -p failed on the host';
         }
         let sandboxed = 'skipped';
-        let sandboxDetail = 'skipped — host claude auth was not verified';
+        let sandboxDetail = 'skipped: host claude auth was not verified';
         const runtimeAvailable = hasSandboxRuntime(process.platform, (cmd) => isCommandAvailableViaShell(shellOps, cmd));
         const skip = sandboxAuthSkipDetail({ runtimeAvailable, hostOk: host === 'ok', inRepo: repoRoot !== null });
         if (skip !== null) {
@@ -4454,13 +4636,13 @@ async function cmdDoctor(opts = {}) {
                 isAvailable: (cmd) => isCommandAvailableViaShell(shellOps, cmd),
             });
             if (!policy) {
-                sandboxDetail = 'skipped — sandbox disabled by config or FACTORY_SANDBOX';
+                sandboxDetail = 'skipped: sandbox disabled by config or FACTORY_SANDBOX';
             }
             else if (policy.runtime === 'none') {
-                sandboxDetail = 'skipped — no sandbox runtime (sandbox-exec/firejail) on this host';
+                sandboxDetail = 'skipped: no sandbox runtime (sandbox-exec/firejail) on this host';
             }
             else if (policy.runtime === 'docker-sandbox') {
-                sandboxDetail = 'skipped — docker-sandbox containment is the microVM, not command wrapping (#653)';
+                sandboxDetail = 'skipped: docker-sandbox containment is the microVM, not command wrapping (#653)';
             }
             else {
                 sandboxed = probeExec(wrapCommandInSandbox(CLAUDE_AUTH_PROBE, policy)) === null ? 'failed' : 'ok';
@@ -4476,7 +4658,13 @@ async function cmdDoctor(opts = {}) {
     checks.splice(0, checks.length, ...reconcileAgentAuthChecks(checks));
     if (repoRoot !== null) {
         const paths = getFactoryPaths(repoRoot);
-        const factoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
+        let factoryConfig;
+        try {
+            factoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
+        }
+        catch {
+            factoryConfig = loadFactoryConfig(); // schema errors are reported by the config row (#2611)
+        }
         const health = await inspectPortLeases({ registryFile: paths.ports });
         checks.push(...leaseChecks(health.map(toLeaseRow)));
         const dockerAvailable = coreOps.isCommandAvailable('docker');
@@ -4493,6 +4681,15 @@ async function cmdDoctor(opts = {}) {
         checks.push(stopSentinelCheck(readStopFileStatus(paths)));
         const eventsContent = existsSync(paths.events) ? readFileSync(paths.events, 'utf-8') : null;
         checks.push(eventLogCheck(eventsContent === null ? null : analyzeEventLog(eventsContent)));
+        let constitution = null;
+        let loadError;
+        try {
+            constitution = new ConstitutionLoader().loadRepoConstitution(repoRoot, factoryConfig.paths?.constitution);
+        }
+        catch (err) {
+            loadError = `cannot parse constitution: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        checks.push(...configLintChecks({ constitution, configFile: repoConfigFileFor(repoRoot, paths.config) }, loadError));
         try {
             const declared = Object.keys(configLoaders.loadModelsConfig().harnesses ?? {});
             checks.push(...modelsRegistryChecks(paths.config, configLoaders.loadRepoConfig(repoRoot)?.models?.registry, [
@@ -4534,7 +4731,7 @@ async function cmdDoctor(opts = {}) {
                 const graceMs = resolveProcessGroupGraceMs(factoryConfig);
                 const orphanEvents = await coreOps.reapOrphanProcesses({ reaped, graceMs });
                 for (const e of orphanEvents) {
-                    console.log(`reconcile: ${e.action === 'killed' ? 'killed' : 'found'} pid ${e.pid} (pgid ${e.pgid}, ${e.command}) squatting port ${e.port} of dead lane ${e.worktreeId}${e.action === 'reported' ? ' — not factory-started, left running' : ''}`);
+                    console.log(`reconcile: ${e.action === 'killed' ? 'killed' : 'found'} pid ${e.pid} (pgid ${e.pgid}, ${e.command}) squatting port ${e.port} of dead lane ${e.worktreeId}${e.action === 'reported' ? '; not factory-started, left running' : ''}`);
                 }
             }
             try {
@@ -4549,7 +4746,7 @@ async function cmdDoctor(opts = {}) {
                 console.log(formatWorktreeReconcileReport(report.removed));
             }
             catch (err) {
-                console.log(`reconcile: worktree sweep failed — ${err?.message ?? String(err)}`);
+                console.log(`reconcile: worktree sweep failed: ${err?.message ?? String(err)}`);
             }
             // Stale claim reap (#999): factory:in-progress claims naming a dead local pid go back to
             // factory:queued so the next run can claim them with no manual label surgery.
@@ -4564,11 +4761,11 @@ async function cmdDoctor(opts = {}) {
                     console.log(formatClaimReconcileReport(released));
                 }
                 else {
-                    console.log('reconcile: skipping stale claims — no GitHub repo or token');
+                    console.log('reconcile: skipping stale claims: no GitHub repo or token');
                 }
             }
             catch (err) {
-                console.log(`reconcile: stale claim release failed — ${err?.message ?? String(err)}`);
+                console.log(`reconcile: stale claim release failed: ${err?.message ?? String(err)}`);
             }
         }
     }
@@ -4618,7 +4815,17 @@ export async function cmdStop(opts = {}) {
     }
     console.log('STOP set — lanes halt between issues');
 }
-export async function cmdResume(opts = {}) {
+export async function cmdResume(issue, opts = {}) {
+    if (issue === undefined && opts.from !== undefined) {
+        throw new CliExitError('factory: resume --from needs an issue number: factory resume <issue> --from check', 2);
+    }
+    if (issue !== undefined) {
+        if (opts.from !== 'check') {
+            throw new CliExitError('factory: resume <issue> only supports --from check (BUILD resume is #2320)', 2);
+        }
+        await resumeFromCheck(parseIssueArg(issue));
+        return;
+    }
     const repoRoot = await getRepoRoot();
     const paths = getFactoryPaths(repoRoot);
     const json = opts.json ? { repo: await getGitHubRepo() } : undefined;
@@ -4633,6 +4840,47 @@ export async function cmdResume(opts = {}) {
     }
     console.log('STOP cleared');
 }
+/** `factory resume <issue> --from check` (#2564): re-run CHECK and later phases on the kept worktree.
+ *  `--json` only applies to the STOP form and is ignored here. */
+async function resumeFromCheck(issueNum) {
+    if (availableAgentClis(coreOps.isCommandAvailable).length === 0) {
+        throw new CliExitError(`factory: ${missingAgentCliMessage()}`, 2);
+    }
+    const repoRoot = await getRepoRoot();
+    const paths = getFactoryPaths(repoRoot);
+    if (!existsSync(paths.root)) {
+        throw new CliExitError(`factory: ${notInitializedMessage()}`, 2);
+    }
+    const record = await createCheckResumeStore(resolve(paths.plans, `issue-${issueNum}.md`)).load();
+    if (!record || !existsSync(record.worktree)) {
+        throw new CliExitError(`factory: no preserved build for #${issueNum} — nothing to resume; run factory run-issue ${issueNum}`, 2);
+    }
+    await withRepoRunLock(paths, 'factory resume', async () => {
+        const ghRepo = await getGitHubRepo();
+        const workSources = createDefaultWorkSourceRegistry({ octokit: getOctokit() });
+        let work;
+        try {
+            work = await workSources.resolve(GITHUB_ISSUE_SOURCE, {
+                repo: ghRepo,
+                issue: issueNum,
+            });
+        }
+        catch (err) {
+            if (err instanceof InvalidWorkRequestInputError) {
+                throw new CliExitError(`factory: ${err.message}`, 2);
+            }
+            throw new CliExitError(`factory: could not resolve issue #${issueNum} in ${ghRepo} (${errorDetail(err)}) — nothing was resumed`, 2);
+        }
+        try {
+            await shipIssue(issueNum, {}, { repoRoot, ghRepo, workRequest: work, resumeFrom: record });
+        }
+        catch (err) {
+            if (err instanceof IssueSkippedError)
+                return;
+            throw new CliExitError(`Resume failed for issue #${issueNum}: ${err.message}`, 1);
+        }
+    });
+}
 // ---------- main ----------
 export async function main(argv = process.argv, deps = {}) {
     if (argv.slice(2).length === 0) {
@@ -4793,13 +5041,13 @@ export async function main(argv = process.argv, deps = {}) {
         .action((runId, opts) => cmdFilingPreview(runId, opts));
     const triage = program
         .command('triage')
-        .description('Have a model propose a queue from open issues into .factory/queue.proposed')
+        .description('Have a model propose a queue from open issues into .factory/state/queue.proposed')
         .option('--product <name>', 'Product constitution to scope triage')
         .option('--model <id>', 'Model to triage with (any registered model, Claude or Codex)')
         .action(cmdTriage);
     triage
         .command('accept')
-        .description('Validate and atomically promote .factory/queue.proposed to .factory/queue')
+        .description('Validate and atomically promote .factory/state/queue.proposed to .factory/state/queue')
         .option('--force', 'Skip validation and promote as-is')
         .action(async (opts) => {
         await cmdTriageAccept(opts);
@@ -4919,7 +5167,7 @@ export async function main(argv = process.argv, deps = {}) {
         .option('--no-sandbox', 'Disable the containment sandbox for agent runs (dangerous)')
         .option('--branch-prefix <prefix>', BRANCH_PREFIX_OPTION_DESCRIPTION)
         .option('--run-children', 'File mode only: when the size gate files child issues, run them (slice mode never files issues)')
-        .option('--size-gate <mode>', 'Size gate mode for this run: file (file child issues / park), slice (ship as sequential slice PRs under the same issue; never files issues) or off (skip both gates); beats sizeGate.mode in the config')
+        .option('--size-gate <mode>', 'Size gate mode for this run: file (file child issues / park), slice (ship as sequential slice PRs under the same issue; never files issues), off (skip both gates) or stack (stacked PR set, ADR-0161; runs as slice until stacks are built); beats sizeGate.mode in the config')
         .option('--max-slices <count>', 'Slice mode: most slices a not-yet-started slice plan may have (1-20); an over-cap plan is recorded and parks; beats sizeGate.maxSlices (default 10)')
         .action(async (issueNum, opts) => {
         await cmdRunIssue(parseIssueArg(issueNum), opts);
@@ -5069,10 +5317,11 @@ export async function main(argv = process.argv, deps = {}) {
         .option('--json', 'Print one JSON object (schemaVersion 1): action, repo, stopFlag before/after')
         .action((opts) => cmdStop(opts));
     program
-        .command('resume')
-        .description('Clear a stop so lanes pick up new issues again')
+        .command('resume [issue]')
+        .description('Clear a stop so lanes pick up new issues again; with <issue> --from check, re-run CHECK on a build kept after an environment failure')
         .option('--json', 'Print one JSON object (schemaVersion 1): action, repo, stopFlag before/after')
-        .action((opts) => cmdResume(opts));
+        .option('--from <phase>', 'Resume a kept build at this phase (only: check)')
+        .action((issue, opts) => cmdResume(issue, opts));
     applyHelpGroups(program);
     const previousLoaders = configLoaders;
     const previousGitOps = gitOps;