@on-par/factory-cli 0.9.5-next.10 → 0.9.5-next.12

package/dist/cli/index.js

@@ -9,11 +9,14 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:pat
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
 import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfig, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveBuildRoute, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
+import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
 import { cmdClassifierBacktest, ClassifierBacktestInputError, } from './classifier-backtest.js';
+import { findOpenPRForIssue, landIssue, waitForMerge } from './land.js';
+import { AwaitingReviewError, CiFailedError, CiUnverifiedError, getPullRequestLandState, LandConflictError, LandFailureError, MergeGatedError, } from './land-pr.js';
+import { setLandRuntime } from './land-runtime.js';
 import { runQueueClear } from './queue-clear.js';
 import { applyStateRootOption } from './state-root.js';
 import { buildCostJson } from './cost-json.js';
@@ -292,6 +295,17 @@ export function errorDetail(err) {
         return e.message;
     return String(err);
 }
+// The land flow (land.ts, land-pr.ts) reads these live, so per-call deps injection reaches it (#2784).
+setLandRuntime(() => ({
+    configLoaders,
+    gitOps,
+    internalOps,
+    shellOps,
+    getOctokit: () => getOctokit(),
+    errorDetail,
+    worktreePathFor,
+    LaneParkError,
+}));
 export function hasGitHubToken(env = process.env, tryToken) {
     if (env.GITHUB_TOKEN || env.GH_TOKEN)
         return true;
@@ -2589,135 +2603,6 @@ export async function cmdLand(issueNum, opts = {}, deps = {}) {
         octokitFactory = previousOctokitFactory;
     }
 }
-async function landIssue(issueNum, repoRoot, ghRepo, paths, octokit, skipCI, branchPrefix, opts = {}) {
-    const [owner, repoName] = ghRepo.split('/');
-    const log = (type, msg, extra) => logEvent(paths.events, type, issueNum, msg, extra);
-    // The issue title may have been edited since the PR was opened, so a
-    // freshly-derived branch name can drift from the branch the PR actually
-    // lives on (same failure mode fixed for waitForMerge in #51). Guess the
-    // branch from the current title first, but fall back to matching the open
-    // PR that references this issue directly and use its real head branch.
-    // Legacy-prefix (LEGACY_BRANCH_PREFIX) branches are guessed too, after the resolved prefix (#1708).
-    const resolved = branchPrefix ?? resolveEffectiveConfig(configLoaders.loadRepoConfig(repoRoot)).branchPrefix;
-    const title = await getIssueTitle(ghRepo, issueNum, octokit);
-    // ADR-0161: a stack layer lands by its exact branch, never by title guess or the Closes PR (the top layer).
-    const guesses = opts.branch
-        ? [opts.branch]
-        : factoryBranchPrefixes(resolved).map((p) => branchFor(issueNum, title, p));
-    const guessedBranch = guesses[0];
-    let branch = guessedBranch;
-    let prNumber;
-    try {
-        const findByGuess = async () => {
-            for (const guess of guesses) {
-                const found = await findOpenPRNumber(octokit, owner, repoName, guess);
-                if (found) {
-                    branch = guess;
-                    return found;
-                }
-            }
-            return undefined;
-        };
-        [, prNumber] = await Promise.all([gitOps.gitFetch(repoRoot), findByGuess()]);
-        if (!prNumber && !opts.branch) {
-            const fallback = await findOpenPRForIssue(octokit, owner, repoName, issueNum);
-            if (fallback) {
-                branch = fallback.branch;
-                prNumber = fallback.number;
-            }
-        }
-    }
-    catch (err) {
-        const failure = prLookupFailure(issueNum, guessedBranch, err);
-        log('fail', failure.message);
-        throw failure;
-    }
-    if (!prNumber) {
-        log('fail', `no open PR for ${guessedBranch}`);
-        throw new LandFailureError(`no open PR for issue #${issueNum} (${guessedBranch})`, 1);
-    }
-    const landFactoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
-    // Every merge path honors the no-auto-merge gate on the issue and on the PR; unreadable labels fail closed (#1720).
-    const filingPolicy = resolveFilingPolicy(landFactoryConfig);
-    const gateLabel = filingPolicy.selfFixLabel;
-    if (opts.allowGated) {
-        console.log(`AUDIT factory land #${issueNum}: --allow-gated override — merging PR #${prNumber} past the ${gateLabel} gate`);
-        log('merge-gated-override', `--allow-gated: merging PR #${prNumber} past ${gateLabel} gate (human override)`);
-    }
-    else {
-        let where;
-        try {
-            const [issueLabels, prLabels] = await Promise.all([
-                defaultListIssueLabels(octokit, owner, repoName, issueNum),
-                defaultListIssueLabels(octokit, owner, repoName, prNumber),
-            ]);
-            if (isAutoMergeBlocked(issueLabels, filingPolicy))
-                where = `issue #${issueNum} is labelled ${gateLabel}`;
-            else if (isAutoMergeBlocked(prLabels, filingPolicy))
-                where = `PR #${prNumber} is labelled ${gateLabel}`;
-        }
-        catch (err) {
-            where = `labels could not be read (${errorDetail(err)}) — failing closed on the ${gateLabel} gate`;
-        }
-        if (where) {
-            log('merge-gated', `land refused: ${where}`);
-            throw new MergeGatedError(`not merging PR #${prNumber} for issue #${issueNum}: ${where} (human approval required). Re-run \`factory land ${issueNum} --allow-gated\` to merge it deliberately.`, issueNum, prNumber, gateLabel);
-        }
-    }
-    const worktree = worktreePathFor(repoRoot, ghRepo, issueNum, branch.startsWith(`${LEGACY_BRANCH_PREFIX}/`) ? LEGACY_BRANCH_PREFIX : resolved);
-    const landSandboxPolicy = resolveSandboxPolicy(landFactoryConfig.sandbox, {
-        worktree,
-        repoRoot,
-    });
-    const worktreeSandbox = worktreeSandboxFor(landSandboxPolicy?.runtime, {
-        allowHosts: landSandboxPolicy?.allowHosts ?? [],
-    });
-    const withLandLock = (fn) => withGitLock(repoRoot, () => withFileLock(paths.mergeLock, fn, {
-        onSteal: (pid) => log('lock-stolen', `stole ${paths.mergeLock} from dead holder pid ${pid ?? 'unknown'}`),
-    }));
-    try {
-        try {
-            await landOpenPullRequest({
-                octokit,
-                owner,
-                repoName,
-                ghRepo,
-                repoRoot,
-                issue: issueNum,
-                branch,
-                worktree,
-                prNumber: prNumber,
-                log,
-                skipCI,
-                adminMerge: resolveMergePolicy(landFactoryConfig).admin,
-                withLock: withLandLock,
-                ensureWorktree: async () => {
-                    if (!existsSync(worktree)) {
-                        await gitOps.setupWorktree(repoRoot, branch, worktree, `origin/${branch}`, worktreeSandbox, log);
-                    }
-                },
-            });
-        }
-        catch (err) {
-            if (err instanceof AwaitingReviewError || err instanceof CiFailedError) {
-                await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-            }
-            throw err;
-        }
-        log('merged', `squash-merged PR #${prNumber}`);
-        await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-    }
-    catch (err) {
-        if (err instanceof LandConflictError || err instanceof AwaitingReviewError || err instanceof CiFailedError)
-            throw err;
-        log('fail', `merge failed: ${err.message}`);
-        throw new LandFailureError(`merge failed for issue #${issueNum}: ${err.message}`, 5);
-    }
-    return { branch, prNumber };
-}
-export function prLookupFailure(issueNum, branch, err) {
-    return new LandFailureError(`PR lookup failed for issue #${issueNum} (${branch}): ${errorDetail(err)}`, 5);
-}
 async function cmdTriage(opts) {
     const repoRoot = await getRepoRoot();
     const ghRepo = await getGitHubRepo();
@@ -3950,99 +3835,6 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
     }
     emitEvent(paths.events, 'lane-done', lane, `lane complete (${merged} merged, ${awaitingReview} awaiting review, ${skipped} skipped, ${decomposed} decomposed, ${parked} parked)`, { lane });
 }
-export async function isPrMerged(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'all',
-        head: `${owner}:${branch}`,
-    });
-    if (prs.length === 0)
-        return false;
-    // Ship-it branch names get reused across separate runs for the same issue
-    // (e.g. a "verify-and-close" pass recreates the exact branch name an
-    // earlier, already-merged PR used) — GitHub PR numbers only increase, so
-    // the highest-numbered PR under this head is always the current one.
-    // Checking "was ANY PR ever merged under this branch name" (the old
-    // `state: 'closed'` + `.some()` behavior) matched the stale prior PR and
-    // falsely reported a brand-new, still-open PR under the same name as
-    // merged — waitForMerge then logged "landed" and skipped calling land(),
-    // leaving the real PR open forever while the lane believed it was done.
-    const latest = prs.reduce((newest, pr) => (pr.number > newest.number ? pr : newest));
-    return Boolean(latest.merged_at);
-}
-export async function findOpenPRNumber(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'open',
-        head: `${owner}:${branch}`,
-    });
-    return prs[0]?.number;
-}
-export async function findOpenPRForIssue(octokit, owner, repoName, issueNum) {
-    const perPage = 100;
-    const matches = new RegExp(`\\bcloses\\s+#${issueNum}\\b`, 'i');
-    for (let page = 1;; page++) {
-        const { data: prs } = await octokit.rest.pulls.list({
-            owner,
-            repo: repoName,
-            state: 'open',
-            per_page: perPage,
-            page,
-        });
-        const pr = prs.find((p) => matches.test(p.body ?? ''));
-        if (pr) {
-            const headRepoFullName = pr.head.repo?.full_name ?? null;
-            if (headRepoFullName !== `${owner}/${repoName}`) {
-                return {
-                    number: pr.number,
-                    branch: pr.head.ref,
-                    headSha: pr.head.sha,
-                    headRepoFullName,
-                };
-            }
-            return { number: pr.number, branch: pr.head.ref, headSha: pr.head.sha, headRepoFullName };
-        }
-        if (prs.length < perPage)
-            return undefined;
-    }
-}
-export async function squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, 
-/** `sha`: the CI-verified head commit. GitHub refuses the merge if the PR head has moved. */
-opts = {}) {
-    const { sha } = opts;
-    if (opts.admin) {
-        const run = opts.run ?? shellOps.exec;
-        const pin = sha ? ` --match-head-commit ${shellEscape(sha)}` : '';
-        await run(`gh pr merge ${prNumber} --repo ${shellEscape(`${owner}/${repoName}`)} --admin --squash --delete-branch${pin}`);
-        return;
-    }
-    await octokit.rest.pulls.merge({
-        owner,
-        repo: repoName,
-        pull_number: prNumber,
-        merge_method: 'squash',
-        ...(sha ? { sha } : {}),
-    });
-    // Best-effort branch delete: the merge is the source of truth.
-    await octokit.rest.git.deleteRef({ owner, repo: repoName, ref: `heads/${branch}` }).catch(() => { });
-}
-export class MergeGatedError extends Error {
-    issue;
-    prNumber;
-    label;
-    constructor(message, issue, prNumber, label) {
-        super(message);
-        this.issue = issue;
-        this.prNumber = prNumber;
-        this.label = label;
-        this.name = 'MergeGatedError';
-    }
-}
-export class LandConflictError extends Error {
-    parkReason = 'conflict';
-}
 /** The target issue was already resolved before the run started — a clean skip,
  *  not a park. Callers advance to the next queue entry. (#681) */
 export class IssueSkippedError extends Error {
@@ -4052,13 +3844,6 @@ export class IssueSkippedError extends Error {
         this.reason = reason;
     }
 }
-export class AwaitingReviewError extends Error {
-    prNumber;
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
 /** The target issue tripped the PLAN pre-flight size gate and was decomposed into real
  *  filed sub-issues; the queue was rewritten. Not a park — the lane continues with the
  *  children in place of the oversized issue. (#823) */
@@ -4069,191 +3854,6 @@ export class IssueDecomposedError extends Error {
         this.childIssues = childIssues;
     }
 }
-export class LandFailureError extends Error {
-    code;
-    constructor(message, code) {
-        super(message);
-        this.code = code;
-    }
-}
-/** Thrown when watchChecks reports a confirmed CI failure — a completed check run with a
- *  non-passing conclusion. A confirmed failing check must never be merged, admin override
- *  or not. See CiUnverifiedError for the no-verdict case. */
-export class CiFailedError extends Error {
-    prNumber;
-    parkReason = 'ci-failed';
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
-/** Thrown when the CI watch never reached a green verdict — a deadline timeout, no check runs ever
- *  registering, or repeated API failures. A subclass of CiFailedError so every existing guard
- *  (parkReasonFor → 'ci-failed', worktree cleanup, cmdLand's exit-0 path) treats "we don't know"
- *  exactly like "we know it's red": never merge. */
-export class CiUnverifiedError extends CiFailedError {
-}
-/** Thrown when the one infra rerun (#2365) also failed for infrastructure reasons on the same head SHA (#2366).
- *  A CiFailedError subclass so every guard still leaves the PR open and unmerged, but it parks as
- *  'ci-infra', which the ADR-0155 steward skips. */
-export class CiInfraError extends CiFailedError {
-    parkReason = 'ci-infra';
-}
-const MAX_MERGE_ATTEMPTS = 5;
-const MERGE_RETRY_BASE_MS = 5_000;
-/** True when GitHub refused a SHA-pinned merge because the PR head moved past the verified
- *  commit (REST 409, or gh's "Head branch was modified"). Retrying as-is can never succeed. */
-export function isHeadModifiedMergeError(err) {
-    if (err?.status === 409)
-        return true;
-    const msg = `${err instanceof Error ? err.message : ''}\n${errorDetail(err)}`;
-    return /head branch was modified/i.test(msg);
-}
-export function isReviewRequiredMergeError(err, state) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/approving review/i.test(msg) || /review is required/i.test(msg))
-        return true;
-    return state.mergeStateStatus === 'BLOCKED' && state.reviewDecision === 'REVIEW_REQUIRED';
-}
-export async function getPullRequestLandState(octokit, owner, repoName, prNumber) {
-    const result = await octokit.graphql(`query PullRequestLandState($owner: String!, $repo: String!, $number: Int!) {
-      repository(owner: $owner, name: $repo) {
-        pullRequest(number: $number) {
-          id
-          isDraft
-          mergeStateStatus
-          reviewDecision
-        }
-      }
-    }`, { owner, repo: repoName, number: prNumber });
-    return result.repository?.pullRequest ?? {};
-}
-export async function markPullRequestReady(octokit, pullRequestId) {
-    await octokit.graphql(`mutation MarkPullRequestReady($id: ID!) {
-      markPullRequestReadyForReview(input: { pullRequestId: $id }) {
-        pullRequest { isDraft }
-      }
-    }`, { id: pullRequestId });
-}
-export async function rebaseDirtyPullRequest(opts) {
-    const { issue, branch, worktree, prNumber, log, run = shellOps.exec, pathExists = existsSync } = opts;
-    if (!pathExists(worktree)) {
-        const msg = `PR #${prNumber} DIRTY on ${branch} and worktree gone`;
-        log('conflict', msg);
-        throw new LandConflictError(msg);
-    }
-    try {
-        await run('git rebase origin/main', { cwd: worktree });
-        await run(`git push --force-with-lease origin ${shellEscape(branch)}`, { cwd: worktree });
-    }
-    catch {
-        // Best-effort cleanup: the conflict logged below is the error we surface.
-        await run('git rebase --abort', { cwd: worktree }).catch(() => { });
-        const msg = `rebase conflict on ${branch} — parked`;
-        log('conflict', msg);
-        throw new LandConflictError(`issue #${issue}: ${msg}`);
-    }
-}
-export async function landOpenPullRequest(opts) {
-    const { octokit, owner, repoName, issue, branch, worktree, prNumber, log, run, pathExists, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), skipCI = false, adminMerge = process.env.FACTORY_MERGE_ADMIN === '1', watch = internalOps.watchChecks, rerun, withLock = (fn) => fn(), ensureWorktree, } = opts;
-    /** Watches CI on the PR's current head commit and returns that SHA once it is green, so the
-     *  merge can be pinned to exactly the commit CI verified. */
-    const watchCi = async () => {
-        let headSha;
-        let outcome;
-        try {
-            const { data: pr } = await octokit.rest.pulls.get({ owner, repo: repoName, pull_number: prNumber });
-            headSha = pr.head.sha;
-            outcome = await watchChecksWithInfraRerun({
-                octokit,
-                owner,
-                repo: repoName,
-                ref: headSha,
-                watch,
-                rerun,
-                onRescued: ({ runIds }) => log('ci-rescued', `CI rescued for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch is green`),
-                onRescueFailed: ({ runIds, outcome: failedOutcome }) => log('ci-rescue-failed', `CI rescue failed for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch ended ${failedOutcome}`),
-            });
-        }
-        catch (err) {
-            const msg = `CI watch for ${branch} failed: ${errorDetail(err)} — refusing to merge without a green verdict`;
-            log('ci-failed', msg);
-            throw new CiUnverifiedError(msg, prNumber);
-        }
-        if (outcome === 'success')
-            return headSha;
-        if (outcome === 'infra-failure') {
-            const msg = `CI failed again for infrastructure reasons for PR #${prNumber} on ${branch} after one rerun — parked as ci-infra, not merged`;
-            log('ci-infra', msg);
-            throw new CiInfraError(msg, prNumber);
-        }
-        if (outcome === 'failure') {
-            const msg = `CI failed for PR #${prNumber} on ${branch} — refusing to merge with a failing check`;
-            log('ci-failed', msg);
-            throw new CiFailedError(msg, prNumber);
-        }
-        const msg = `CI watch for ${branch} ended ${outcome} — refusing to merge without a green verdict`;
-        log('ci-failed', msg);
-        throw new CiUnverifiedError(msg, prNumber);
-    };
-    // The CI watch is a 10-20 minute wait, not a mutation: it must never run under the land
-    // locks, or every other lane's setupWorktree serializes behind it (#645).
-    let verifiedSha = skipCI ? undefined : await watchCi();
-    let state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-    if (state.mergeStateStatus === 'DIRTY') {
-        const rebased = await withLock(async () => {
-            // Re-check under the lock: a sibling lane may have landed (or rebased this branch)
-            // while we waited for it, so the DIRTY verdict read above can be stale.
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-            if (state.mergeStateStatus !== 'DIRTY')
-                return false;
-            await ensureWorktree?.();
-            await rebaseDirtyPullRequest({ issue, branch, worktree, prNumber, log, run, pathExists });
-            return true;
-        });
-        if (rebased) {
-            if (!skipCI) {
-                verifiedSha = await watchCi();
-            }
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-        }
-    }
-    for (let attempt = 1;; attempt++) {
-        try {
-            await withLock(async () => {
-                // Same rule as the rebase section: whatever we read before taking the lock (or before
-                // the backoff sleep) may be stale, so the attempt decides from a fresh read.
-                state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-                if (state.isDraft && state.id) {
-                    log('land', `PR #${prNumber} still a draft — re-issuing ready-for-review (attempt ${attempt})`);
-                    await markPullRequestReady(octokit, state.id).catch((err) => log('warn', `ready-for-review flip failed for PR #${prNumber}: ${errorDetail(err)}`));
-                }
-                await squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, {
-                    admin: adminMerge,
-                    run,
-                    sha: verifiedSha,
-                });
-            });
-            return;
-        }
-        catch (err) {
-            if (verifiedSha && isHeadModifiedMergeError(err)) {
-                const msg = `PR #${prNumber} head moved past CI-verified commit ${verifiedSha} — refusing to merge an unverified head`;
-                log('ci-failed', msg);
-                throw new CiUnverifiedError(msg, prNumber);
-            }
-            if (isReviewRequiredMergeError(err, state)) {
-                log('awaiting-review', `PR #${prNumber} blocked on human review — leaving open for approval`);
-                throw new AwaitingReviewError(`PR #${prNumber} awaiting review: ${err.message}`, prNumber);
-            }
-            if (attempt >= MAX_MERGE_ATTEMPTS)
-                throw err;
-            log('land', `merge attempt ${attempt}/${MAX_MERGE_ATTEMPTS} failed (${err.message}); mergeStateStatus=${state.mergeStateStatus ?? 'unknown'} — retrying with backoff`);
-            // Backoff outside the lock: waiting is not a mutation (#645).
-            await sleep(MERGE_RETRY_BASE_MS * 2 ** (attempt - 1));
-        }
-    }
-}
 export function issueFromFactoryBranch(branch, prefix) {
     return factoryBranchIssue(branch, prefix) ?? undefined;
 }
@@ -4335,108 +3935,6 @@ export async function cmdResumeApproved(opts = {}) {
         throw new CliExitError(`factory: resume-approved: ${result.failed.length} PR(s) failed to land`, 5);
     }
 }
-/** Consecutive merged-state check failures tolerated before waitForMerge parks the lane.
- *  At the shipped 120s poll that is ~20 minutes of 100% failure (ADR: sustained-failure park). */
-export const MERGE_CHECK_MAX_CONSECUTIVE_FAILURES = 10;
-/** Wall-clock backstop: continuous merged-state check failure for this long parks the lane even
- *  if fewer than MERGE_CHECK_MAX_CONSECUTIVE_FAILURES attempts were made (slower poll cadence). */
-export const MERGE_CHECK_FAILURE_BUDGET_MS = 2 * 60 * 60 * 1000;
-/** GitHub signals both primary and secondary rate limits with 403 — the same status it uses for a
- *  token that genuinely lacks the scope. Only a 403 with no rate-limit evidence is permanent. */
-function looksRateLimited(err) {
-    const headers = err?.response?.headers ?? {};
-    const remaining = headers['x-ratelimit-remaining'];
-    if (typeof remaining === 'string' && remaining.trim() === '0')
-        return true;
-    if (typeof remaining === 'number' && remaining === 0)
-        return true;
-    if (headers['retry-after'] !== undefined)
-        return true;
-    return /rate limit|secondary rate|abuse detection/i.test(errorDetail(err));
-}
-/** True when a merged-state check failure cannot recover by retrying: an expired/revoked token
- *  (401) or a token missing `pulls:read` (403 with no rate-limit evidence). */
-export function isPermanentMergeCheckError(err) {
-    const status = err?.status;
-    if (status === 401)
-        return true;
-    if (status !== 403)
-        return false;
-    return !looksRateLimited(err);
-}
-async function defaultListIssueLabels(octokit, owner, repo, issue) {
-    const { data } = await octokit.rest.issues.listLabelsOnIssue({ owner, repo, issue_number: issue });
-    return data.map((label) => label.name);
-}
-export async function waitForMerge(issue, branch, repoRoot, ghRepo, paths, deps = {}) {
-    const { createOctokit = getOctokit, pathExists = existsSync, checkMerged = isPrMerged, loadConfig = configLoaders.loadFactoryConfigForRepo, land = landIssue, listIssueLabels = defaultListIssueLabels, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, mergeEnabled, writeLine = (line) => console.log(line), now = () => Date.now(), mergeOverrides, landBranch, } = deps;
-    const factoryConfig = loadConfig(paths.config);
-    const isMergeEnabled = mergeEnabled ?? (() => resolveMergePolicy(factoryConfig, process.env, mergeOverrides).auto);
-    const skipCI = configLoaders.resolveSkipCI(factoryConfig);
-    const filingPolicy = resolveFilingPolicy(factoryConfig);
-    const octokit = createOctokit();
-    const [owner, repoName] = ghRepo.split('/');
-    emitEvent(paths.events, 'await-merge', issue, `waiting to merge ${branch}`);
-    let consecutiveFailures = 0;
-    let firstFailureAt = null;
-    while (!pathExists(paths.stop)) {
-        // The merge wait logs nothing on its happy path, so each poll bumps the per-issue heartbeat:
-        // status/TUI staleness rules (ADR-0086, ADR-0093) otherwise read a live wait as a dead run.
-        if (paths.runs)
-            touchRunActivity(phaseSnapshotFile(paths.runs, issue), new Date().toISOString()).catch(() => { });
-        let merged = false;
-        try {
-            merged = await checkMerged(octokit, owner, repoName, branch);
-            consecutiveFailures = 0;
-            firstFailureAt = null;
-        }
-        catch (err) {
-            consecutiveFailures++;
-            firstFailureAt ??= now();
-            const detail = errorDetail(err);
-            emitEvent(paths.events, 'warn', issue, `merged-state check failed (treating as not merged): ${detail}`);
-            const permanent = isPermanentMergeCheckError(err);
-            const elapsedMs = now() - firstFailureAt;
-            const budgetSpent = elapsedMs >= MERGE_CHECK_FAILURE_BUDGET_MS;
-            const streakSpent = consecutiveFailures >= MERGE_CHECK_MAX_CONSECUTIVE_FAILURES;
-            if (permanent || streakSpent || budgetSpent) {
-                const trigger = permanent
-                    ? 'permanent error (auth/scope — retrying cannot help)'
-                    : `${consecutiveFailures} consecutive failures over ${Math.round(elapsedMs / 1000)}s`;
-                const msg = `merged-state check for ${branch} is not recovering — parking lane after ${trigger}: ${detail}`;
-                emitEvent(paths.events, 'escalate', issue, msg);
-                throw new LaneParkError(msg, 'escalate');
-            }
-        }
-        if (merged) {
-            emitEvent(paths.events, 'landed', issue, 'PR merged');
-            return;
-        }
-        if (isMergeEnabled()) {
-            let labels = [];
-            try {
-                labels = await listIssueLabels(octokit, owner, repoName, issue);
-            }
-            catch (err) {
-                emitEvent(paths.events, 'warn', issue, `label check failed (treating as blocked): ${errorDetail(err)}`);
-                labels = [filingPolicy.selfFixLabel];
-            }
-            if (isAutoMergeBlocked(labels, filingPolicy)) {
-                emitEvent(paths.events, 'merge-gated', issue, `auto-merge blocked by ${filingPolicy.selfFixLabel} — awaiting human approval`);
-                writeLine(`[factory] #${issue} auto-merge gated (${filingPolicy.selfFixLabel}); awaiting human merge (poll 120s)`);
-                await sleep(120_000);
-                continue;
-            }
-            if (landBranch)
-                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI, undefined, { branch: landBranch });
-            else
-                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI);
-            return;
-        }
-        writeLine(`[factory] #${issue} awaiting human merge (poll 120s)`);
-        await sleep(120_000);
-    }
-}
 const USAGE_UNAVAILABLE_LINE = '[factory] supervise: usage signal unavailable — proceeding without resume gate (set FACTORY_USAGE_ESTIMATOR=1 to gate on the heuristic)';
 export async function superviseLoop(deps) {
     const { cap, resumeAt, pollMs, watch = true, watchSource = 'default', resumeAtSource = 'default', pollSource = 'default', estimator = false, stopFile, eventsFile, now, runQueue, readUsageFn = () => readUsage({ cap, estimator }), pathExists = existsSync, clearStop = (path) => rmSync(path, { force: true }), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, writeLine = (line) => console.log(line), ingest, } = deps;