@on-par/factory-cli 0.9.5-next.1 → 0.9.5-next.11

package/dist/cli/index.js

@@ -9,11 +9,14 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:pat
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
 import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfig, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveBuildRoute, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
+import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
 import { cmdClassifierBacktest, ClassifierBacktestInputError, } from './classifier-backtest.js';
+import { findOpenPRForIssue, landIssue, waitForMerge } from './land.js';
+import { AwaitingReviewError, CiFailedError, CiUnverifiedError, getPullRequestLandState, LandConflictError, LandFailureError, MergeGatedError, } from './land-pr.js';
+import { setLandRuntime } from './land-runtime.js';
 import { runQueueClear } from './queue-clear.js';
 import { applyStateRootOption } from './state-root.js';
 import { buildCostJson } from './cost-json.js';
@@ -292,6 +295,17 @@ export function errorDetail(err) {
         return e.message;
     return String(err);
 }
+// The land flow (land.ts, land-pr.ts) reads these live, so per-call deps injection reaches it (#2784).
+setLandRuntime(() => ({
+    configLoaders,
+    gitOps,
+    internalOps,
+    shellOps,
+    getOctokit: () => getOctokit(),
+    errorDetail,
+    worktreePathFor,
+    LaneParkError,
+}));
 export function hasGitHubToken(env = process.env, tryToken) {
     if (env.GITHUB_TOKEN || env.GH_TOKEN)
         return true;
@@ -902,6 +916,7 @@ async function cmdCheck(issueRaw, opts) {
         const repoConfig = configLoaders.loadRepoConfig(repoRoot);
         const effective = resolveEffectiveConfig(repoConfig);
         const router = new coreOps.ModelRouter(applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig), configLoaders.loadRoutesConfig(), false, undefined, effective.allowExperimental, effective.localOnly);
+        router.setLocalAuthSink?.(recordLocalAuthFailure);
         runModel = createDeepModelRunner(router, repoRoot);
     }
     let report;
@@ -1005,6 +1020,7 @@ async function cmdClassifierBacktestEntry(opts) {
     const repoConfig = configLoaders.loadRepoConfig(repoRoot);
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig), configLoaders.loadRoutesConfig(), false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     try {
         await cmdClassifierBacktest({ ...opts, branchPrefix }, {
             repoRoot,
@@ -1247,6 +1263,7 @@ export async function cmdStatus(opts = {}) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     const product = readActiveProduct(paths.product) ?? '(none)';
     console.log(styleText('bold', `== ${ghRepo} ==`));
     console.log(`Product: ${product}`);
@@ -1425,6 +1442,7 @@ async function cmdTui(opts = {}, runTuiImpl = runTui) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     const effectiveConfigLines = describeEffectiveConfig({
         router,
         repo: repoConfig,
@@ -1618,6 +1636,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
             : { ...resolveEffectiveConfig(repoConfig), branchPrefix: opts.branchPrefix },
     };
     const router = new core.ModelRouter(policy.models, policy.routes, false, undefined, policy.effective.allowExperimental, policy.effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     router.skipMissingHarnessClis(core.isCommandAvailable);
     let issueSpend = 0;
     let laneSandboxRuntime = 'none';
@@ -2584,132 +2603,6 @@ export async function cmdLand(issueNum, opts = {}, deps = {}) {
         octokitFactory = previousOctokitFactory;
     }
 }
-async function landIssue(issueNum, repoRoot, ghRepo, paths, octokit, skipCI, branchPrefix, opts = {}) {
-    const [owner, repoName] = ghRepo.split('/');
-    const log = (type, msg, extra) => logEvent(paths.events, type, issueNum, msg, extra);
-    // The issue title may have been edited since the PR was opened, so a
-    // freshly-derived branch name can drift from the branch the PR actually
-    // lives on (same failure mode fixed for waitForMerge in #51). Guess the
-    // branch from the current title first, but fall back to matching the open
-    // PR that references this issue directly and use its real head branch.
-    // Legacy-prefix (LEGACY_BRANCH_PREFIX) branches are guessed too, after the resolved prefix (#1708).
-    const resolved = branchPrefix ?? resolveEffectiveConfig(configLoaders.loadRepoConfig(repoRoot)).branchPrefix;
-    const title = await getIssueTitle(ghRepo, issueNum, octokit);
-    const guesses = factoryBranchPrefixes(resolved).map((p) => branchFor(issueNum, title, p));
-    const guessedBranch = guesses[0];
-    let branch = guessedBranch;
-    let prNumber;
-    try {
-        const findByGuess = async () => {
-            for (const guess of guesses) {
-                const found = await findOpenPRNumber(octokit, owner, repoName, guess);
-                if (found) {
-                    branch = guess;
-                    return found;
-                }
-            }
-            return undefined;
-        };
-        [, prNumber] = await Promise.all([gitOps.gitFetch(repoRoot), findByGuess()]);
-        if (!prNumber) {
-            const fallback = await findOpenPRForIssue(octokit, owner, repoName, issueNum);
-            if (fallback) {
-                branch = fallback.branch;
-                prNumber = fallback.number;
-            }
-        }
-    }
-    catch (err) {
-        const failure = prLookupFailure(issueNum, guessedBranch, err);
-        log('fail', failure.message);
-        throw failure;
-    }
-    if (!prNumber) {
-        log('fail', `no open PR for ${guessedBranch}`);
-        throw new LandFailureError(`no open PR for issue #${issueNum} (${guessedBranch})`, 1);
-    }
-    const landFactoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
-    // Every merge path honors the no-auto-merge gate on the issue and on the PR; unreadable labels fail closed (#1720).
-    const filingPolicy = resolveFilingPolicy(landFactoryConfig);
-    const gateLabel = filingPolicy.selfFixLabel;
-    if (opts.allowGated) {
-        console.log(`AUDIT factory land #${issueNum}: --allow-gated override — merging PR #${prNumber} past the ${gateLabel} gate`);
-        log('merge-gated-override', `--allow-gated: merging PR #${prNumber} past ${gateLabel} gate (human override)`);
-    }
-    else {
-        let where;
-        try {
-            const [issueLabels, prLabels] = await Promise.all([
-                defaultListIssueLabels(octokit, owner, repoName, issueNum),
-                defaultListIssueLabels(octokit, owner, repoName, prNumber),
-            ]);
-            if (isAutoMergeBlocked(issueLabels, filingPolicy))
-                where = `issue #${issueNum} is labelled ${gateLabel}`;
-            else if (isAutoMergeBlocked(prLabels, filingPolicy))
-                where = `PR #${prNumber} is labelled ${gateLabel}`;
-        }
-        catch (err) {
-            where = `labels could not be read (${errorDetail(err)}) — failing closed on the ${gateLabel} gate`;
-        }
-        if (where) {
-            log('merge-gated', `land refused: ${where}`);
-            throw new MergeGatedError(`not merging PR #${prNumber} for issue #${issueNum}: ${where} (human approval required). Re-run \`factory land ${issueNum} --allow-gated\` to merge it deliberately.`, issueNum, prNumber, gateLabel);
-        }
-    }
-    const worktree = worktreePathFor(repoRoot, ghRepo, issueNum, branch.startsWith(`${LEGACY_BRANCH_PREFIX}/`) ? LEGACY_BRANCH_PREFIX : resolved);
-    const landSandboxPolicy = resolveSandboxPolicy(landFactoryConfig.sandbox, {
-        worktree,
-        repoRoot,
-    });
-    const worktreeSandbox = worktreeSandboxFor(landSandboxPolicy?.runtime, {
-        allowHosts: landSandboxPolicy?.allowHosts ?? [],
-    });
-    const withLandLock = (fn) => withGitLock(repoRoot, () => withFileLock(paths.mergeLock, fn, {
-        onSteal: (pid) => log('lock-stolen', `stole ${paths.mergeLock} from dead holder pid ${pid ?? 'unknown'}`),
-    }));
-    try {
-        try {
-            await landOpenPullRequest({
-                octokit,
-                owner,
-                repoName,
-                ghRepo,
-                repoRoot,
-                issue: issueNum,
-                branch,
-                worktree,
-                prNumber: prNumber,
-                log,
-                skipCI,
-                adminMerge: resolveMergePolicy(landFactoryConfig).admin,
-                withLock: withLandLock,
-                ensureWorktree: async () => {
-                    if (!existsSync(worktree)) {
-                        await gitOps.setupWorktree(repoRoot, branch, worktree, `origin/${branch}`, worktreeSandbox, log);
-                    }
-                },
-            });
-        }
-        catch (err) {
-            if (err instanceof AwaitingReviewError || err instanceof CiFailedError) {
-                await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-            }
-            throw err;
-        }
-        log('merged', `squash-merged PR #${prNumber}`);
-        await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-    }
-    catch (err) {
-        if (err instanceof LandConflictError || err instanceof AwaitingReviewError || err instanceof CiFailedError)
-            throw err;
-        log('fail', `merge failed: ${err.message}`);
-        throw new LandFailureError(`merge failed for issue #${issueNum}: ${err.message}`, 5);
-    }
-    return { branch, prNumber };
-}
-export function prLookupFailure(issueNum, branch, err) {
-    return new LandFailureError(`PR lookup failed for issue #${issueNum} (${branch}): ${errorDetail(err)}`, 5);
-}
 async function cmdTriage(opts) {
     const repoRoot = await getRepoRoot();
     const ghRepo = await getGitHubRepo();
@@ -2723,6 +2616,7 @@ async function cmdTriage(opts) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
     router.skipMissingHarnessClis(coreOps.isCommandAvailable);
     router.setCostSink((entry) => logCost(paths.costs, { ...entry, issue: '-' }));
     let plannerError;
@@ -3272,7 +3166,10 @@ async function cmdRun(opts = {}) {
                     repo,
                     preflight: withAdmissionGuard({
                         reader: admissionStateReaderFor(paths.state),
-                        preflight: (issue) => preflightQueuedIssue(issue, createQueuePreflightOps(octokit, owner, repo)),
+                        preflight: (issue) => preflightQueuedIssue(issue, createQueuePreflightOps(octokit, owner, repo, {
+                            autoMergeStack: resolveSizeGateMode(factoryConfig) === 'stack' &&
+                                resolveMergePolicy(factoryConfig, process.env, { auto: opts.autoMerge }).auto,
+                        })),
                         onConflict: (issue, verdict) => {
                             const line = `#${issue} refused — ${verdict.reason} | repair: ${verdict.repair}`;
                             console.error(styleText('yellow', `factory: ${line}`));
@@ -3388,6 +3285,7 @@ async function cmdRun(opts = {}) {
                     ship: (issue, o, c) => shipIssue(issue, { ...o, branchPrefix, prClassifier: opts.prClassifier }, c),
                     sweepFinished: (issue) => sweepBetweenLaneIssues(issue, planned.lane, repoRoot, ghRepo, paths).then(() => { }),
                     reapWorktree: (issue) => reapParkedLaneWorktree(issue, repoRoot, ghRepo, paths, opts.branchPrefix === undefined ? undefined : branchPrefix),
+                    recordStackMerge: (issue, prNumber) => recordSliceMerged({ octokit: getOctokit(), repo: ghRepo, issue, prNumber }).then(() => { }),
                     waitMerge: (issue, branch, root, gh, p, d = {}) => waitForMerge(issue, branch, root, gh, p, { ...d, mergeOverrides: { auto: opts.autoMerge } }),
                 }));
             }
@@ -3522,8 +3420,13 @@ export function laneQueueDeps(queue, lane) {
         countRemaining: async () => (await queue.list(lane)).length,
     };
 }
-export function createQueuePreflightOps(octokit, owner, repo) {
+export function createQueuePreflightOps(octokit, owner, repo, opts = {}) {
     return {
+        autoMergeStack: opts.autoMergeStack ?? false,
+        getPullRefs: async (prNumber) => {
+            const { data } = await octokit.rest.pulls.get({ owner, repo, pull_number: prNumber });
+            return { headRef: data.head.ref, baseRef: data.base.ref, headSha: data.head.sha };
+        },
         expectedHeadRepoFullName: `${owner}/${repo}`,
         findOpenPR: (issue) => findOpenPRForIssue(octokit, owner, repo, issue),
         getLandState: (prNumber) => getPullRequestLandState(octokit, owner, repo, prNumber),
@@ -3540,8 +3443,10 @@ export function createQueuePreflightOps(octokit, owner, repo) {
         },
     };
 }
-/** ADR-0147: wait on the current slice PR, record its merge, or park when it was closed unmerged.
- *  Returns undefined to fall through to the Closes-PR preflight. */
+/** ADR-0147/ADR-0161: walk every pr-open slice PR bottom-up. Merged layers are recorded, a closed layer parks
+ *  (naming the layers above it), and the lowest open layer defers, or is adopted when stack auto-merge is on and
+ *  its base is main with green CI on the rebased head. Returns undefined to fall through to the Closes-PR
+ *  preflight only when no slice PR is still open. */
 async function preflightSlice(issue, deps) {
     let lookup;
     try {
@@ -3559,36 +3464,80 @@ async function preflightSlice(issue, deps) {
     if (lookup.status === 'not-found')
         return undefined;
     const { plan } = lookup;
-    const slice = currentSlice(plan);
-    if (slice === undefined || slice.state !== 'pr-open')
+    const n = plan.slices.length;
+    const open = plan.slices.filter((s) => s.state === 'pr-open');
+    if (open.length === 0)
         return undefined;
-    const label = `slice ${slice.index}/${plan.slices.length}`;
-    if (slice.prNumber === undefined) {
-        return { kind: 'park', reason: `${label} of #${issue} is pr-open but the slice plan records no PR number` };
-    }
-    const pr = slice.prNumber;
-    let state;
-    try {
-        state = await deps.getPullState(pr);
-    }
-    catch (err) {
-        return { kind: 'park', reason: `${label} PR #${pr} state lookup failed: ${errorDetail(err)}` };
-    }
-    if (state === 'open')
-        return { kind: 'defer' };
-    if (state === 'closed') {
-        return { kind: 'park', reason: `${label} PR #${pr} was closed without merging` };
-    }
-    try {
-        await deps.saveSlicePlan(issue, withSliceState(plan, slice.index, 'merged', pr));
-    }
-    catch (err) {
-        return {
-            kind: 'park',
-            reason: `${label} PR #${pr} merged but updating the slice plan failed: ${errorDetail(err)}`,
-        };
+    let next = plan;
+    let lastMerged;
+    const save = async () => {
+        if (lastMerged === undefined)
+            return undefined;
+        try {
+            await deps.saveSlicePlan(issue, next);
+        }
+        catch (err) {
+            return {
+                kind: 'park',
+                reason: `${lastMerged.label} PR #${lastMerged.pr} merged but updating the slice plan failed: ${errorDetail(err)}`,
+            };
+        }
+        return undefined;
+    };
+    for (const [at, slice] of open.entries()) {
+        const label = `slice ${slice.index}/${n}`;
+        if (slice.prNumber === undefined) {
+            return { kind: 'park', reason: `${label} of #${issue} is pr-open but the slice plan records no PR number` };
+        }
+        const pr = slice.prNumber;
+        let state;
+        try {
+            state = await deps.getPullState(pr);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `${label} PR #${pr} state lookup failed: ${errorDetail(err)}` };
+        }
+        if (state === 'merged') {
+            next = withSliceState(next, slice.index, 'merged', pr);
+            lastMerged = { label, pr };
+            continue;
+        }
+        if (state === 'closed') {
+            const above = open.slice(at + 1);
+            const suffix = above.length > 0
+                ? `; layers above it: ${above.map((a) => `slice ${a.index}/${n} (#${a.prNumber})`).join(', ')}`
+                : '';
+            return { kind: 'park', reason: `${label} PR #${pr} was closed without merging${suffix}` };
+        }
+        const saved = await save();
+        if (saved)
+            return saved;
+        if (!deps.autoMergeStack)
+            return { kind: 'defer' };
+        let refs;
+        try {
+            refs = await deps.getPullRefs(pr);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `${label} PR #${pr} ref lookup failed: ${errorDetail(err)}` };
+        }
+        // GitHub has not retargeted the layer to main yet: the lower layer is still unmerged.
+        if (refs.baseRef !== 'main')
+            return { kind: 'defer' };
+        let outcome;
+        try {
+            outcome = await deps.watch(refs.headSha);
+        }
+        catch (err) {
+            return { kind: 'park', reason: `CI watch for ${label} PR #${pr} failed: ${errorDetail(err)}` };
+        }
+        if (outcome === 'failure')
+            return { kind: 'park', reason: `CI for ${label} PR #${pr} ended failure` };
+        if (outcome !== 'success')
+            return { kind: 'defer' };
+        return { kind: 'adopt', branch: refs.headRef, stackLayer: { index: slice.index, count: n, prNumber: pr } };
     }
-    return undefined;
+    return (await save()) ?? undefined;
 }
 /** Resolve queued work from GitHub evidence without consuming model or worktree resources. */
 export async function preflightQueuedIssue(issue, deps) {
@@ -3690,7 +3639,7 @@ export function renderLanePausedComment(payload) {
     ].join('\n\n');
 }
 export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {}) {
-    const { ship = shipIssue, waitMerge = waitForMerge, pathExists = existsSync, emitEvent = logEvent, claimNext = async () => null, releaseIssue = async () => { }, heartbeat, reapWorktree = async () => { }, sweepFinished = async () => { }, countRemaining, baseHoldGate, laneBreakerThreshold = 0, commentIssue = async () => { }, } = deps;
+    const { ship = shipIssue, waitMerge = waitForMerge, recordStackMerge = async () => { }, pathExists = existsSync, emitEvent = logEvent, claimNext = async () => null, releaseIssue = async () => { }, heartbeat, reapWorktree = async () => { }, sweepFinished = async () => { }, countRemaining, baseHoldGate, laneBreakerThreshold = 0, commentIssue = async () => { }, } = deps;
     let streak = null;
     let merged = 0;
     let awaitingReview = 0;
@@ -3752,6 +3701,7 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
             streak = null;
             continue;
         }
+        const layer = decision.kind === 'adopt' ? decision.stackLayer : undefined;
         try {
             const sliceOutcome = {};
             const branch = decision.kind === 'adopt'
@@ -3774,6 +3724,15 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
                 await settle(issue, 'queued');
                 continue;
             }
+            if (layer) {
+                // ADR-0161: land exactly this layer's branch, record it, and re-queue for the next layer.
+                await withHeartbeat(issue, heartbeat, () => waitMerge(issue, branch, repoRoot, ghRepo, paths, { landBranch: branch }));
+                await recordStackMerge(issue, layer.prNumber).catch((err) => emitEvent(paths.events, 'warn', issue, `slice ${layer.index}/${layer.count} merged but recording it failed: ${errorDetail(err)}`, { lane }));
+                merged++;
+                streak = null;
+                await settle(issue, layer.index < layer.count ? 'queued' : 'done');
+                continue;
+            }
             await withHeartbeat(issue, heartbeat, () => waitMerge(issue, branch, repoRoot, ghRepo, paths));
             merged++;
             streak = null;
@@ -3785,7 +3744,7 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
                 // worktree — this is a clean outcome, not a park; move to the next issue.
                 awaitingReview++;
                 streak = null;
-                await settle(issue, 'done');
+                await settle(issue, layer && layer.index < layer.count ? 'queued' : 'done');
                 continue;
             }
             if (err instanceof IssueSkippedError) {
@@ -3876,99 +3835,6 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
     }
     emitEvent(paths.events, 'lane-done', lane, `lane complete (${merged} merged, ${awaitingReview} awaiting review, ${skipped} skipped, ${decomposed} decomposed, ${parked} parked)`, { lane });
 }
-export async function isPrMerged(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'all',
-        head: `${owner}:${branch}`,
-    });
-    if (prs.length === 0)
-        return false;
-    // Ship-it branch names get reused across separate runs for the same issue
-    // (e.g. a "verify-and-close" pass recreates the exact branch name an
-    // earlier, already-merged PR used) — GitHub PR numbers only increase, so
-    // the highest-numbered PR under this head is always the current one.
-    // Checking "was ANY PR ever merged under this branch name" (the old
-    // `state: 'closed'` + `.some()` behavior) matched the stale prior PR and
-    // falsely reported a brand-new, still-open PR under the same name as
-    // merged — waitForMerge then logged "landed" and skipped calling land(),
-    // leaving the real PR open forever while the lane believed it was done.
-    const latest = prs.reduce((newest, pr) => (pr.number > newest.number ? pr : newest));
-    return Boolean(latest.merged_at);
-}
-export async function findOpenPRNumber(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'open',
-        head: `${owner}:${branch}`,
-    });
-    return prs[0]?.number;
-}
-export async function findOpenPRForIssue(octokit, owner, repoName, issueNum) {
-    const perPage = 100;
-    const matches = new RegExp(`\\bcloses\\s+#${issueNum}\\b`, 'i');
-    for (let page = 1;; page++) {
-        const { data: prs } = await octokit.rest.pulls.list({
-            owner,
-            repo: repoName,
-            state: 'open',
-            per_page: perPage,
-            page,
-        });
-        const pr = prs.find((p) => matches.test(p.body ?? ''));
-        if (pr) {
-            const headRepoFullName = pr.head.repo?.full_name ?? null;
-            if (headRepoFullName !== `${owner}/${repoName}`) {
-                return {
-                    number: pr.number,
-                    branch: pr.head.ref,
-                    headSha: pr.head.sha,
-                    headRepoFullName,
-                };
-            }
-            return { number: pr.number, branch: pr.head.ref, headSha: pr.head.sha, headRepoFullName };
-        }
-        if (prs.length < perPage)
-            return undefined;
-    }
-}
-export async function squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, 
-/** `sha`: the CI-verified head commit. GitHub refuses the merge if the PR head has moved. */
-opts = {}) {
-    const { sha } = opts;
-    if (opts.admin) {
-        const run = opts.run ?? shellOps.exec;
-        const pin = sha ? ` --match-head-commit ${shellEscape(sha)}` : '';
-        await run(`gh pr merge ${prNumber} --repo ${shellEscape(`${owner}/${repoName}`)} --admin --squash --delete-branch${pin}`);
-        return;
-    }
-    await octokit.rest.pulls.merge({
-        owner,
-        repo: repoName,
-        pull_number: prNumber,
-        merge_method: 'squash',
-        ...(sha ? { sha } : {}),
-    });
-    // Best-effort branch delete: the merge is the source of truth.
-    await octokit.rest.git.deleteRef({ owner, repo: repoName, ref: `heads/${branch}` }).catch(() => { });
-}
-export class MergeGatedError extends Error {
-    issue;
-    prNumber;
-    label;
-    constructor(message, issue, prNumber, label) {
-        super(message);
-        this.issue = issue;
-        this.prNumber = prNumber;
-        this.label = label;
-        this.name = 'MergeGatedError';
-    }
-}
-export class LandConflictError extends Error {
-    parkReason = 'conflict';
-}
 /** The target issue was already resolved before the run started — a clean skip,
  *  not a park. Callers advance to the next queue entry. (#681) */
 export class IssueSkippedError extends Error {
@@ -3978,13 +3844,6 @@ export class IssueSkippedError extends Error {
         this.reason = reason;
     }
 }
-export class AwaitingReviewError extends Error {
-    prNumber;
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
 /** The target issue tripped the PLAN pre-flight size gate and was decomposed into real
  *  filed sub-issues; the queue was rewritten. Not a park — the lane continues with the
  *  children in place of the oversized issue. (#823) */
@@ -3995,191 +3854,6 @@ export class IssueDecomposedError extends Error {
         this.childIssues = childIssues;
     }
 }
-export class LandFailureError extends Error {
-    code;
-    constructor(message, code) {
-        super(message);
-        this.code = code;
-    }
-}
-/** Thrown when watchChecks reports a confirmed CI failure — a completed check run with a
- *  non-passing conclusion. A confirmed failing check must never be merged, admin override
- *  or not. See CiUnverifiedError for the no-verdict case. */
-export class CiFailedError extends Error {
-    prNumber;
-    parkReason = 'ci-failed';
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
-/** Thrown when the CI watch never reached a green verdict — a deadline timeout, no check runs ever
- *  registering, or repeated API failures. A subclass of CiFailedError so every existing guard
- *  (parkReasonFor → 'ci-failed', worktree cleanup, cmdLand's exit-0 path) treats "we don't know"
- *  exactly like "we know it's red": never merge. */
-export class CiUnverifiedError extends CiFailedError {
-}
-/** Thrown when the one infra rerun (#2365) also failed for infrastructure reasons on the same head SHA (#2366).
- *  A CiFailedError subclass so every guard still leaves the PR open and unmerged, but it parks as
- *  'ci-infra', which the ADR-0155 steward skips. */
-export class CiInfraError extends CiFailedError {
-    parkReason = 'ci-infra';
-}
-const MAX_MERGE_ATTEMPTS = 5;
-const MERGE_RETRY_BASE_MS = 5_000;
-/** True when GitHub refused a SHA-pinned merge because the PR head moved past the verified
- *  commit (REST 409, or gh's "Head branch was modified"). Retrying as-is can never succeed. */
-export function isHeadModifiedMergeError(err) {
-    if (err?.status === 409)
-        return true;
-    const msg = `${err instanceof Error ? err.message : ''}\n${errorDetail(err)}`;
-    return /head branch was modified/i.test(msg);
-}
-export function isReviewRequiredMergeError(err, state) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/approving review/i.test(msg) || /review is required/i.test(msg))
-        return true;
-    return state.mergeStateStatus === 'BLOCKED' && state.reviewDecision === 'REVIEW_REQUIRED';
-}
-export async function getPullRequestLandState(octokit, owner, repoName, prNumber) {
-    const result = await octokit.graphql(`query PullRequestLandState($owner: String!, $repo: String!, $number: Int!) {
-      repository(owner: $owner, name: $repo) {
-        pullRequest(number: $number) {
-          id
-          isDraft
-          mergeStateStatus
-          reviewDecision
-        }
-      }
-    }`, { owner, repo: repoName, number: prNumber });
-    return result.repository?.pullRequest ?? {};
-}
-export async function markPullRequestReady(octokit, pullRequestId) {
-    await octokit.graphql(`mutation MarkPullRequestReady($id: ID!) {
-      markPullRequestReadyForReview(input: { pullRequestId: $id }) {
-        pullRequest { isDraft }
-      }
-    }`, { id: pullRequestId });
-}
-export async function rebaseDirtyPullRequest(opts) {
-    const { issue, branch, worktree, prNumber, log, run = shellOps.exec, pathExists = existsSync } = opts;
-    if (!pathExists(worktree)) {
-        const msg = `PR #${prNumber} DIRTY on ${branch} and worktree gone`;
-        log('conflict', msg);
-        throw new LandConflictError(msg);
-    }
-    try {
-        await run('git rebase origin/main', { cwd: worktree });
-        await run(`git push --force-with-lease origin ${shellEscape(branch)}`, { cwd: worktree });
-    }
-    catch {
-        // Best-effort cleanup: the conflict logged below is the error we surface.
-        await run('git rebase --abort', { cwd: worktree }).catch(() => { });
-        const msg = `rebase conflict on ${branch} — parked`;
-        log('conflict', msg);
-        throw new LandConflictError(`issue #${issue}: ${msg}`);
-    }
-}
-export async function landOpenPullRequest(opts) {
-    const { octokit, owner, repoName, issue, branch, worktree, prNumber, log, run, pathExists, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), skipCI = false, adminMerge = process.env.FACTORY_MERGE_ADMIN === '1', watch = internalOps.watchChecks, rerun, withLock = (fn) => fn(), ensureWorktree, } = opts;
-    /** Watches CI on the PR's current head commit and returns that SHA once it is green, so the
-     *  merge can be pinned to exactly the commit CI verified. */
-    const watchCi = async () => {
-        let headSha;
-        let outcome;
-        try {
-            const { data: pr } = await octokit.rest.pulls.get({ owner, repo: repoName, pull_number: prNumber });
-            headSha = pr.head.sha;
-            outcome = await watchChecksWithInfraRerun({
-                octokit,
-                owner,
-                repo: repoName,
-                ref: headSha,
-                watch,
-                rerun,
-                onRescued: ({ runIds }) => log('ci-rescued', `CI rescued for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch is green`),
-                onRescueFailed: ({ runIds, outcome: failedOutcome }) => log('ci-rescue-failed', `CI rescue failed for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch ended ${failedOutcome}`),
-            });
-        }
-        catch (err) {
-            const msg = `CI watch for ${branch} failed: ${errorDetail(err)} — refusing to merge without a green verdict`;
-            log('ci-failed', msg);
-            throw new CiUnverifiedError(msg, prNumber);
-        }
-        if (outcome === 'success')
-            return headSha;
-        if (outcome === 'infra-failure') {
-            const msg = `CI failed again for infrastructure reasons for PR #${prNumber} on ${branch} after one rerun — parked as ci-infra, not merged`;
-            log('ci-infra', msg);
-            throw new CiInfraError(msg, prNumber);
-        }
-        if (outcome === 'failure') {
-            const msg = `CI failed for PR #${prNumber} on ${branch} — refusing to merge with a failing check`;
-            log('ci-failed', msg);
-            throw new CiFailedError(msg, prNumber);
-        }
-        const msg = `CI watch for ${branch} ended ${outcome} — refusing to merge without a green verdict`;
-        log('ci-failed', msg);
-        throw new CiUnverifiedError(msg, prNumber);
-    };
-    // The CI watch is a 10-20 minute wait, not a mutation: it must never run under the land
-    // locks, or every other lane's setupWorktree serializes behind it (#645).
-    let verifiedSha = skipCI ? undefined : await watchCi();
-    let state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-    if (state.mergeStateStatus === 'DIRTY') {
-        const rebased = await withLock(async () => {
-            // Re-check under the lock: a sibling lane may have landed (or rebased this branch)
-            // while we waited for it, so the DIRTY verdict read above can be stale.
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-            if (state.mergeStateStatus !== 'DIRTY')
-                return false;
-            await ensureWorktree?.();
-            await rebaseDirtyPullRequest({ issue, branch, worktree, prNumber, log, run, pathExists });
-            return true;
-        });
-        if (rebased) {
-            if (!skipCI) {
-                verifiedSha = await watchCi();
-            }
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-        }
-    }
-    for (let attempt = 1;; attempt++) {
-        try {
-            await withLock(async () => {
-                // Same rule as the rebase section: whatever we read before taking the lock (or before
-                // the backoff sleep) may be stale, so the attempt decides from a fresh read.
-                state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-                if (state.isDraft && state.id) {
-                    log('land', `PR #${prNumber} still a draft — re-issuing ready-for-review (attempt ${attempt})`);
-                    await markPullRequestReady(octokit, state.id).catch((err) => log('warn', `ready-for-review flip failed for PR #${prNumber}: ${errorDetail(err)}`));
-                }
-                await squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, {
-                    admin: adminMerge,
-                    run,
-                    sha: verifiedSha,
-                });
-            });
-            return;
-        }
-        catch (err) {
-            if (verifiedSha && isHeadModifiedMergeError(err)) {
-                const msg = `PR #${prNumber} head moved past CI-verified commit ${verifiedSha} — refusing to merge an unverified head`;
-                log('ci-failed', msg);
-                throw new CiUnverifiedError(msg, prNumber);
-            }
-            if (isReviewRequiredMergeError(err, state)) {
-                log('awaiting-review', `PR #${prNumber} blocked on human review — leaving open for approval`);
-                throw new AwaitingReviewError(`PR #${prNumber} awaiting review: ${err.message}`, prNumber);
-            }
-            if (attempt >= MAX_MERGE_ATTEMPTS)
-                throw err;
-            log('land', `merge attempt ${attempt}/${MAX_MERGE_ATTEMPTS} failed (${err.message}); mergeStateStatus=${state.mergeStateStatus ?? 'unknown'} — retrying with backoff`);
-            // Backoff outside the lock: waiting is not a mutation (#645).
-            await sleep(MERGE_RETRY_BASE_MS * 2 ** (attempt - 1));
-        }
-    }
-}
 export function issueFromFactoryBranch(branch, prefix) {
     return factoryBranchIssue(branch, prefix) ?? undefined;
 }
@@ -4261,105 +3935,6 @@ export async function cmdResumeApproved(opts = {}) {
         throw new CliExitError(`factory: resume-approved: ${result.failed.length} PR(s) failed to land`, 5);
     }
 }
-/** Consecutive merged-state check failures tolerated before waitForMerge parks the lane.
- *  At the shipped 120s poll that is ~20 minutes of 100% failure (ADR: sustained-failure park). */
-export const MERGE_CHECK_MAX_CONSECUTIVE_FAILURES = 10;
-/** Wall-clock backstop: continuous merged-state check failure for this long parks the lane even
- *  if fewer than MERGE_CHECK_MAX_CONSECUTIVE_FAILURES attempts were made (slower poll cadence). */
-export const MERGE_CHECK_FAILURE_BUDGET_MS = 2 * 60 * 60 * 1000;
-/** GitHub signals both primary and secondary rate limits with 403 — the same status it uses for a
- *  token that genuinely lacks the scope. Only a 403 with no rate-limit evidence is permanent. */
-function looksRateLimited(err) {
-    const headers = err?.response?.headers ?? {};
-    const remaining = headers['x-ratelimit-remaining'];
-    if (typeof remaining === 'string' && remaining.trim() === '0')
-        return true;
-    if (typeof remaining === 'number' && remaining === 0)
-        return true;
-    if (headers['retry-after'] !== undefined)
-        return true;
-    return /rate limit|secondary rate|abuse detection/i.test(errorDetail(err));
-}
-/** True when a merged-state check failure cannot recover by retrying: an expired/revoked token
- *  (401) or a token missing `pulls:read` (403 with no rate-limit evidence). */
-export function isPermanentMergeCheckError(err) {
-    const status = err?.status;
-    if (status === 401)
-        return true;
-    if (status !== 403)
-        return false;
-    return !looksRateLimited(err);
-}
-async function defaultListIssueLabels(octokit, owner, repo, issue) {
-    const { data } = await octokit.rest.issues.listLabelsOnIssue({ owner, repo, issue_number: issue });
-    return data.map((label) => label.name);
-}
-export async function waitForMerge(issue, branch, repoRoot, ghRepo, paths, deps = {}) {
-    const { createOctokit = getOctokit, pathExists = existsSync, checkMerged = isPrMerged, loadConfig = configLoaders.loadFactoryConfigForRepo, land = landIssue, listIssueLabels = defaultListIssueLabels, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, mergeEnabled, writeLine = (line) => console.log(line), now = () => Date.now(), mergeOverrides, } = deps;
-    const factoryConfig = loadConfig(paths.config);
-    const isMergeEnabled = mergeEnabled ?? (() => resolveMergePolicy(factoryConfig, process.env, mergeOverrides).auto);
-    const skipCI = configLoaders.resolveSkipCI(factoryConfig);
-    const filingPolicy = resolveFilingPolicy(factoryConfig);
-    const octokit = createOctokit();
-    const [owner, repoName] = ghRepo.split('/');
-    emitEvent(paths.events, 'await-merge', issue, `waiting to merge ${branch}`);
-    let consecutiveFailures = 0;
-    let firstFailureAt = null;
-    while (!pathExists(paths.stop)) {
-        // The merge wait logs nothing on its happy path, so each poll bumps the per-issue heartbeat:
-        // status/TUI staleness rules (ADR-0086, ADR-0093) otherwise read a live wait as a dead run.
-        if (paths.runs)
-            touchRunActivity(phaseSnapshotFile(paths.runs, issue), new Date().toISOString()).catch(() => { });
-        let merged = false;
-        try {
-            merged = await checkMerged(octokit, owner, repoName, branch);
-            consecutiveFailures = 0;
-            firstFailureAt = null;
-        }
-        catch (err) {
-            consecutiveFailures++;
-            firstFailureAt ??= now();
-            const detail = errorDetail(err);
-            emitEvent(paths.events, 'warn', issue, `merged-state check failed (treating as not merged): ${detail}`);
-            const permanent = isPermanentMergeCheckError(err);
-            const elapsedMs = now() - firstFailureAt;
-            const budgetSpent = elapsedMs >= MERGE_CHECK_FAILURE_BUDGET_MS;
-            const streakSpent = consecutiveFailures >= MERGE_CHECK_MAX_CONSECUTIVE_FAILURES;
-            if (permanent || streakSpent || budgetSpent) {
-                const trigger = permanent
-                    ? 'permanent error (auth/scope — retrying cannot help)'
-                    : `${consecutiveFailures} consecutive failures over ${Math.round(elapsedMs / 1000)}s`;
-                const msg = `merged-state check for ${branch} is not recovering — parking lane after ${trigger}: ${detail}`;
-                emitEvent(paths.events, 'escalate', issue, msg);
-                throw new LaneParkError(msg, 'escalate');
-            }
-        }
-        if (merged) {
-            emitEvent(paths.events, 'landed', issue, 'PR merged');
-            return;
-        }
-        if (isMergeEnabled()) {
-            let labels = [];
-            try {
-                labels = await listIssueLabels(octokit, owner, repoName, issue);
-            }
-            catch (err) {
-                emitEvent(paths.events, 'warn', issue, `label check failed (treating as blocked): ${errorDetail(err)}`);
-                labels = [filingPolicy.selfFixLabel];
-            }
-            if (isAutoMergeBlocked(labels, filingPolicy)) {
-                emitEvent(paths.events, 'merge-gated', issue, `auto-merge blocked by ${filingPolicy.selfFixLabel} — awaiting human approval`);
-                writeLine(`[factory] #${issue} auto-merge gated (${filingPolicy.selfFixLabel}); awaiting human merge (poll 120s)`);
-                await sleep(120_000);
-                continue;
-            }
-            await land(issue, repoRoot, ghRepo, paths, octokit, skipCI);
-            return;
-        }
-        writeLine(`[factory] #${issue} awaiting human merge (poll 120s)`);
-        await sleep(120_000);
-    }
-}
 const USAGE_UNAVAILABLE_LINE = '[factory] supervise: usage signal unavailable — proceeding without resume gate (set FACTORY_USAGE_ESTIMATOR=1 to gate on the heuristic)';
 export async function superviseLoop(deps) {
     const { cap, resumeAt, pollMs, watch = true, watchSource = 'default', resumeAtSource = 'default', pollSource = 'default', estimator = false, stopFile, eventsFile, now, runQueue, readUsageFn = () => readUsage({ cap, estimator }), pathExists = existsSync, clearStop = (path) => rmSync(path, { force: true }), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, writeLine = (line) => console.log(line), ingest, } = deps;
@@ -4521,6 +4096,8 @@ async function cmdDoctor(opts = {}) {
             },
             fileExists: existsSync,
         }),
+        claudeSessionState: () => claudeStoredSessionState(),
+        localAuthFailure: (agent) => localAuthFailureSinceLogin(agent),
         opencodeLoggedIn: () => hasOpencodeLoginEvidence(),
         commandHarnesses: () => repoRoot === null
             ? []