@on-par/factory-cli 0.9.5-next.8 → 0.9.5

package/dist/cli/index.js

@@ -8,12 +8,17 @@ import { arch, hostname as osHostname, release, platform, userInfo } from 'node:
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
-import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfig, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveBuildRoute, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createCheckResumeStore, createPlanReuseStore, checkBaseHealth, currentSlice, egressHostMessage, egressSummaryMessage, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
+import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, laneHostLabel, loadFactoryConfig, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveCodexDisabled, resolveDefectWindowDays, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, SIZE_GATE_MODES, resolveEffectiveBuildRoute, resolveEffectiveModelPins, resolveLaneBreakerThreshold, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, runAutoIngest, shipPhase, formatCostTotal, validateQueue, watchUsage, writeLocalRunReport, writeProxyState, } from '@on-par/factory-core';
+import { acquirePidFile, createCheckResumeStore, findSlicePlanComment, recordSliceMerged, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveLocalOnly, resolvePrClassifierPolicy, resolveRunUsageHarness, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, slugify, sweepWorktrees, watchChecks, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, claudeStoredSessionState, localAuthFailureSinceLogin, recordLocalAuthFailure, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
 import { cmdClassifierBacktest, ClassifierBacktestInputError, } from './classifier-backtest.js';
+import { findOpenPRForIssue, landIssue, waitForMerge } from './land.js';
+import { AwaitingReviewError, CiFailedError, CiUnverifiedError, getPullRequestLandState, LandConflictError, LandFailureError, MergeGatedError, } from './land-pr.js';
+import { setLandRuntime } from './land-runtime.js';
+import { shipIssue } from './ship.js';
+import { setShipRuntime } from './ship-runtime.js';
 import { runQueueClear } from './queue-clear.js';
 import { applyStateRootOption } from './state-root.js';
 import { buildCostJson } from './cost-json.js';
@@ -40,8 +45,8 @@ import { ensureFactoryExcluded, writeSampleQueue } from './init-files.js';
 import { cmdLogs } from './logs.js';
 import { applyHelpGroups } from './help-groups.js';
 import { mergeScopeNotice } from './merge-scope.js';
-import { GITHUB_STUB_CALLS_FILE, recordGitPushes, resolveGitHubMode, selectOctokit } from './github-stub.js';
-import { createFactoryOctokit, formatDeprecation } from './octokit.js';
+import { selectOctokit } from './github-stub.js';
+import { createFactoryOctokit } from './octokit.js';
 import { DeepCheckError, createDeepModelRunner, runIssueCheck } from './ready-check.js';
 import { childRunSucceeded, formatChildRunSummary, runChildrenInOrder } from './run-children.js';
 import { createBaseHoldGate, formatBaseHoldCleared, formatBaseHoldStatus, readBaseHold, writeBaseHold, } from './base-hold.js';
@@ -292,6 +297,42 @@ export function errorDetail(err) {
         return e.message;
     return String(err);
 }
+// The land flow (land.ts, land-pr.ts) reads these live, so per-call deps injection reaches it (#2784).
+setLandRuntime(() => ({
+    configLoaders,
+    gitOps,
+    internalOps,
+    shellOps,
+    getOctokit: () => getOctokit(),
+    errorDetail,
+    worktreePathFor,
+    LaneParkError,
+}));
+// The ship flow (ship.ts, ship-steps.ts) reads these live, so per-call deps injection reaches it (#2788).
+setShipRuntime(() => ({
+    resolveConfigLoaders: (overrides) => resolveConfigLoaders(overrides),
+    resolveGitOps: (overrides) => resolveGitOps(overrides),
+    resolveShellOps: (overrides) => resolveShellOps(overrides),
+    resolveCoreOps: (overrides) => resolveCoreOps(overrides),
+    resolvePhaseOps: (overrides) => resolvePhaseOps(overrides),
+    getRepoRoot,
+    getGitHubRepo,
+    getOctokit,
+    worktreePathFor,
+    repoConfigFileFor,
+    isCommandAvailableViaShell,
+    readTextFileOrEmpty,
+    readActiveProduct,
+    errorDetail,
+    resolveEnvironmentAcquirer,
+    resolveLaneBaseUrl,
+    defaultWriteLocalRunReport: () => coreOps.writeLocalRunReport,
+    LaneParkError,
+    LaneEnvironmentPauseError,
+    IssueSkippedError,
+    IssueDecomposedError,
+}));
+export { shipIssue };
 export function hasGitHubToken(env = process.env, tryToken) {
     if (env.GITHUB_TOKEN || env.GH_TOKEN)
         return true;
@@ -1579,480 +1620,6 @@ export function resolveEnvironmentAcquirer(opts) {
         };
     };
 }
-export async function shipIssue(issueNum, opts, ctx, deps = {}) {
-    const loaders = resolveConfigLoaders(deps);
-    const git = resolveGitOps(deps);
-    const shell = resolveShellOps(deps);
-    const core = resolveCoreOps(deps);
-    const phases = resolvePhaseOps(deps);
-    // FACTORY_GITHUB=stub (#2652): record each `git push` ship runs in the stub's calls.jsonl.
-    let shipPhaseForMode = phases.shipPhase;
-    if (resolveGitHubMode(process.env) === 'stub') {
-        const base = phases.shipPhase;
-        const stubCalls = join(resolve(process.env.FACTORY_GITHUB_STUB_DIR ?? ''), GITHUB_STUB_CALLS_FILE);
-        const defaultShipRunner = promisify(execCb);
-        const wrapped = (o) => base({ ...o, run: recordGitPushes(o.run ?? defaultShipRunner, stubCalls, o.branch) });
-        shipPhaseForMode = wrapped;
-    }
-    const repoRoot = ctx?.repoRoot ?? (await getRepoRoot(shell));
-    const ghRepo = ctx?.ghRepo ?? (await getGitHubRepo(shell));
-    const paths = ctx?.paths ?? getFactoryPaths(repoRoot);
-    // GitHub REST deprecations seen on this run's client become one warn event per route (#2218).
-    const octokit = (deps.octokit ??
-        (() => getOctokit(shell, {
-            log: (d) => logEvent(paths.events, 'github_api_deprecated', issueNum, formatDeprecation(d), { lane: ctx?.lane }),
-        })))();
-    const [ghOwner, ghName] = ghRepo.split('/');
-    const repoConfig = loaders.loadRepoConfig(repoRoot, paths.root);
-    const factoryConfig = loaders.loadFactoryConfigForRepo(paths.config);
-    const classifierPolicy = resolvePrClassifierPolicy(factoryConfig, process.env, { classifier: opts.prClassifier });
-    const timeouts = loaders.resolveTimeouts(factoryConfig);
-    const failoverSettings = resolveAutoFailover(factoryConfig);
-    const breaker = new ProviderBreaker(paths.breaker);
-    const reworkHistory = new ReworkHistory(paths.reworkHistory);
-    const laneFileGuard = new LaneFileGuard(paths.laneFiles);
-    const efficiency = resolveEfficiencyPolicy(repoConfig);
-    const policy = {
-        models: applyRepoConfig(loaders.loadModelsConfig(), repoConfig),
-        routes: loaders.loadRoutesConfig(),
-        sandbox: factoryConfig.sandbox,
-        budget: { perIssueCapUsd: efficiency.perIssueCapUsd },
-        effective: opts.branchPrefix === undefined
-            ? resolveEffectiveConfig(repoConfig)
-            : { ...resolveEffectiveConfig(repoConfig), branchPrefix: opts.branchPrefix },
-    };
-    const router = new core.ModelRouter(policy.models, policy.routes, false, undefined, policy.effective.allowExperimental, policy.effective.localOnly);
-    router.setLocalAuthSink?.(recordLocalAuthFailure);
-    router.skipMissingHarnessClis(core.isCommandAvailable);
-    let issueSpend = 0;
-    let laneSandboxRuntime = 'none';
-    const laneWorkspaceBackend = factoryConfig.workspace?.backend === 'disposable-docker' ? 'disposable-docker' : 'worktree';
-    router.setCostSink((entry) => {
-        issueSpend += entry.cost ?? 0;
-        logCost(paths.costs, {
-            ...entry,
-            issue: String(issueNum),
-            sandboxRuntime: laneSandboxRuntime,
-            reworkRoundCount: laneReworkRounds,
-            workspaceBackend: laneWorkspaceBackend,
-        });
-    });
-    const modelPins = loaders.resolveEffectiveModelPins(router.registryRef, repoConfig);
-    const codexOff = resolveCodexDisabled(repoConfig);
-    const constitutionLoader = new core.ConstitutionLoader();
-    const product = opts.product ?? readActiveProduct(paths.product);
-    const autoRework = opts.autoRework ?? true;
-    const work = ctx?.workRequest ??
-        (await createDefaultWorkSourceRegistry({ octokit }).resolve(GITHUB_ISSUE_SOURCE, {
-            repo: ghRepo,
-            issue: issueNum,
-        }));
-    const issueTitle = work.title;
-    const sizeGateMode = opts.sizeGate ?? resolveSizeGateMode(factoryConfig);
-    const maxSlices = opts.maxSlices ?? resolveSizeGateMaxSlices(factoryConfig);
-    // ADR-0147: slice k >= 2 builds on its own branch, so read the slice plan before the worktree exists.
-    let sliceIndex;
-    // ADR-0161: stack runs as slice until stacked PRs are built.
-    if ((sizeGateMode === 'slice' || sizeGateMode === 'stack') &&
-        !ctx?.localOnly &&
-        !ctx?.resumeFrom &&
-        work.kind === GITHUB_ISSUE_SOURCE) {
-        try {
-            const lookup = await findSlicePlanComment({ octokit, repo: ghRepo, issue: issueNum });
-            if (lookup.status === 'found')
-                sliceIndex = currentSlice(lookup.plan)?.index;
-        }
-        catch (err) {
-            throw new LaneParkError(`slice plan lookup failed for #${issueNum}: ${errorDetail(err)} — parked before creating a worktree`, 'escalate');
-        }
-    }
-    const branch = ctx?.resumeFrom?.branch ?? branchFor(issueNum, issueTitle, policy.effective.branchPrefix, sliceIndex);
-    const worktree = ctx?.resumeFrom
-        ? ctx.resumeFrom.worktree
-        : ctx?.localOnly
-            ? ctx.localOnly.workspace
-            : worktreePathFor(repoRoot, ghRepo, issueNum, policy.effective.branchPrefix, loaders);
-    const specPath = resolve(paths.plans, `issue-${issueNum}.md`);
-    const runStartedAt = new Date().toISOString();
-    const lane = ctx?.lane;
-    // Captures the message of the last terminal event runIssue emits (ready/fail/
-    // escalate/held/conflict/ci-failed/timeout) so the LaneParkError this adapter
-    // raises below carries the same diagnostic text shipIssue used to throw with —
-    // RunOutcome's parked variant carries only the ParkReason enum, not free text.
-    const TERMINAL_EVENT_KINDS = new Set([
-        'ready',
-        'environment-released',
-        'fail',
-        'escalate',
-        'held',
-        'conflict',
-        'config',
-        'ci-failed',
-        'ci-infra',
-        'timeout',
-    ]);
-    let terminalMessage;
-    let laneReworkRounds = 0;
-    const mkLog = (phase) => (type, msg, extra) => {
-        if (TERMINAL_EVENT_KINDS.has(type))
-            terminalMessage = msg;
-        if (type === 'rework')
-            laneReworkRounds++;
-        // checkPhase logs each skipped checker as a 'check' event prefixed "SKIPPED: " —
-        // echo it to the terminal the way shipIssue used to print it directly.
-        if (type === 'check' && msg.startsWith('SKIPPED: ')) {
-            console.error(styleText('yellow', `  SKIP: ${msg.slice('SKIPPED: '.length)}`));
-        }
-        // Likewise for each failing checker, so a parked run still names which checker
-        // failed and why — the parked RunOutcome carries only an aggregate count (#675).
-        if (type === 'check' && msg.startsWith('FAILED: ')) {
-            console.error(styleText('red', `  FAIL: ${msg.slice('FAILED: '.length)}`));
-        }
-        logEvent(paths.events, type, issueNum, msg, { ...extra, lane, phase });
-        // Best-effort lastEvent summary (#1327) for factory.run.snapshot — an
-        // observability side channel, so a write failure is swallowed, not logged (that
-        // would re-enter this same function for every event this chokepoint fires on).
-        touchLastEvent(phaseSnapshotFile(paths.runs, issueNum), summarizeEvent(type, msg)).catch(() => { });
-    };
-    const log = mkLog();
-    log('issue-title', issueTitle);
-    if (modelPins.plan) {
-        const source = modelPins.sources.plan === 'repo' ? '.factory/config.json' : 'FACTORY_PLAN_MODEL';
-        log('model-override', `plan model pinned to ${modelPins.plan} (${source})`);
-    }
-    if (modelPins.build) {
-        const source = modelPins.sources.build === 'repo' ? '.factory/config.json' : 'FACTORY_BUILD_MODEL';
-        log('model-override', `build model pinned to ${modelPins.build} (${source})`);
-    }
-    const skipReason = closedWorkSkipReason(work);
-    if (skipReason) {
-        log('skipped-already-closed', skipReason);
-        console.log(styleText('yellow', `skipped: ${skipReason}`));
-        throw new IssueSkippedError(skipReason, 'already-closed');
-    }
-    const sandboxPolicy = resolveSandboxPolicy(policy.sandbox, {
-        worktree,
-        repoRoot,
-        cliDisabled: opts.sandbox === false,
-        laneId: lane,
-        isAvailable: (cmd) => isCommandAvailableViaShell(shell, cmd),
-    });
-    laneSandboxRuntime = sandboxPolicy?.runtime ?? 'none';
-    const worktreeSandbox = worktreeSandboxFor(sandboxPolicy?.runtime, {
-        allowHosts: sandboxPolicy?.allowHosts ?? [],
-    });
-    let activeSandboxPolicy;
-    if (opts.sandbox === false) {
-        console.error(styleText('yellow', 'factory: sandbox disabled by --no-sandbox — agent runs are UNCONTAINED'));
-        log('sandbox-disabled', 'sandbox disabled by --no-sandbox');
-    }
-    else if (!sandboxPolicy) {
-        log('sandbox-disabled', 'sandbox disabled by config/FACTORY_SANDBOX');
-    }
-    else if (sandboxPolicy.runtime === 'none') {
-        log('sandbox-unavailable', 'no sandbox runtime found (sandbox-exec/firejail) — running uncontained');
-    }
-    else if (sandboxPolicy.runtime === 'docker-sandbox') {
-        // docker-sandbox's containment is the microVM created by worktreeWorkspace below
-        // (#653), not a command-prefix wrap — activeSandboxPolicy stays undefined because
-        // wrapCommandInSandbox remains a no-op for this runtime. createMicroVm logs the
-        // actual outcome ('sandbox' on success, 'sandbox-unavailable' on fallback), so no
-        // speculative log is emitted here.
-    }
-    else {
-        activeSandboxPolicy = sandboxPolicy;
-        if (sandboxPolicy.allowHosts.length > 0) {
-            log('sandbox-degraded', `host-level egress filtering unavailable in v1; intended allowlist: ${sandboxPolicy.allowHosts.join(', ')}`);
-        }
-    }
-    // Setup worktree FIRST — PLAN needs cwd=worktree to run claude. Worktree cleanup
-    // stays a CLI concern (not called here, matching today — a worktree persists past
-    // a successful run for GC/sweep commands to reclaim later).
-    let workspace;
-    if (ctx?.resumeFrom) {
-        workspace = { path: worktree, dispose: async () => { } };
-        log('worktree', `reusing kept worktree at ${worktree} (resume --from check)`);
-    }
-    else if (!ctx?.localOnly) {
-        workspace = await worktreeWorkspace({
-            repoRoot,
-            branch,
-            worktreePath: worktree,
-            log,
-            sandbox: worktreeSandbox,
-            findOpenPr: (br) => findOpenPR(octokit, ghOwner, ghName, br),
-            setup: (root, br, wt, sp, sandbox, setupLog, setupOpts) => withGitLock(root, () => withFileLock(paths.gitLock, 
-            // setupWorktree fetches origin itself before creating the worktree (#1167),
-            // so no explicit gitFetch here — still under the git + file locks.
-            () => git.setupWorktree(root, br, wt, sp, sandbox, setupLog, setupOpts), { onSteal: (pid) => log('lock-stolen', `stole ${paths.gitLock} from dead holder pid ${pid ?? 'unknown'}`) })),
-        });
-        log('worktree', `Worktree ready at ${worktree}`);
-    }
-    else {
-        workspace = localOnlyWorkspace(ctx.localOnly);
-        log('workspace', `local-only: using caller-provided workspace ${worktree} (no factory worktree created)`);
-    }
-    const planApprovalEnabled = opts.approvePlan ?? resolvePlanApproval(factoryConfig);
-    const processGroupGraceMs = resolveProcessGroupGraceMs(factoryConfig);
-    const portsSettings = resolveEnvironmentPorts(factoryConfig);
-    if (!portsSettings.enabled) {
-        log('environment_lease', 'port leasing disabled (environment.ports.enabled=false or FACTORY_ENV_PORTS=0)');
-    }
-    // acquireEnvironment.recordPgid/release only persist/deallocate the lease — process-
-    // group tracking and killing is runIssue's own unconditional tracker (Invariant 3),
-    // so a lease-disabled/failed run still tears down every spawned agent process.
-    const acquireEnvironment = portsSettings.enabled
-        ? resolveEnvironmentAcquirer({
-            laneSandboxRuntime: sandboxPolicy?.runtime ?? 'none',
-            paths,
-            worktree,
-            branch,
-            range: portsSettings.range,
-            processGroupGraceMs,
-            log,
-            findPortListeners: core.defaultFindPortListeners,
-            reapOrphanProcesses: core.reapOrphanProcesses,
-        })
-        : undefined;
-    const proxySettings = resolveEnvironmentProxy(factoryConfig);
-    const resolveBaseUrl = (appPort) => resolveLaneBaseUrl(paths, proxySettings, worktree, appPort);
-    const request = {
-        issue: issueNum,
-        repo: ghRepo,
-        branch,
-        specPath,
-        work,
-        workSource: ctx?.workSource,
-        product,
-        startedAt: runStartedAt,
-        lane,
-        options: {
-            interactive: Boolean(opts.interactive),
-            autoRework,
-            approvePlan: planApprovalEnabled,
-            sandboxDisabled: opts.sandbox === false,
-        },
-        localOnly: Boolean(ctx?.localOnly),
-        blockUnresolvedRegressions: resolveDesignRegressionBlock(factoryConfig),
-        readinessUpdateIssueBody: resolveReadinessUpdateIssueBody(factoryConfig),
-        publishFromBuild: resolveBuildPublish(factoryConfig),
-        sizeGateMode,
-        maxSlices,
-        prClassifier: classifierPolicy.enabled
-            ? {
-                rules: resolveReviewFloorRules(repoConfig),
-                gateLabel: resolveFilingPolicy(factoryConfig).selfFixLabel,
-                modelPin: repoConfig?.models?.pins?.classifier,
-            }
-            : undefined,
-        timeouts,
-        modelPins,
-        codexDisabled: codexOff,
-        skipCI: loaders.resolveSkipCI(factoryConfig),
-        failover: failoverSettings,
-        efficiency: { maxReworkRounds: efficiency.maxReworkRounds, fastPath: efficiency.fastPath },
-        sandboxPolicy: activeSandboxPolicy,
-        processGroupGraceMs,
-        preferredRoute: repoConfig?.route,
-        ...(ctx?.resumeFrom
-            ? {
-                resumeFrom: {
-                    phase: 'check',
-                    diffBase: ctx.resumeFrom.diffBase,
-                    route: ctx.resumeFrom.route,
-                    model: ctx.resumeFrom.model,
-                    buildMinutes: ctx.resumeFrom.buildMinutes,
-                },
-            }
-            : {}),
-        eventsFile: paths.events,
-        logsDir: paths.logs,
-        baselineCachePath: paths.baselineCache,
-        repoConfigFile: repoConfigFileFor(repoRoot, paths.config),
-        flakyLedgerPath: paths.flakyLedger,
-    };
-    const ports = {
-        router,
-        octokit,
-        workspace,
-        events: mkLog,
-        acquireEnvironment,
-        resolveBaseUrl,
-        getIssueSpend: () => issueSpend,
-        breaker,
-        planReuse: ctx?.localOnly ? undefined : createPlanReuseStore(specPath),
-        checkResume: ctx?.localOnly ? undefined : createCheckResumeStore(specPath),
-        planPhase: phases.planPhase,
-        buildPhase: phases.buildPhase,
-        checkPhase: phases.checkPhase,
-        shipPhase: shipPhaseForMode,
-        checkBaseHealth: deps.checkBaseHealth ?? checkBaseHealth,
-        resolveConstitution: () => 
-        // Resolved once here — runIssue calls this exactly once and reuses the value for
-        // every phase, so the build worker can never author the standards it is graded by.
-        // A local-only workspace is caller-provided, not a checkout of repoRoot, so it keeps its own constitution.
-        constitutionLoader.resolve(worktree, product, factoryConfig.paths?.constitution, ctx?.localOnly ? undefined : repoRoot),
-        createApprovalGate: () => createFileApprovalGate({ dir: paths.approvals, timeoutMs: timeouts.approval * 1000 }),
-        drainSteering: () => drainSteering(paths.steering, issueNum, worktree),
-        reworkHistory,
-        laneFileGuard,
-        recordPhase: (phase) => {
-            const now = new Date().toISOString();
-            return writePhaseSnapshot(phaseSnapshotFile(paths.runs, issueNum), {
-                issue: issueNum,
-                phase,
-                updatedAt: now,
-                lastActivityAt: now,
-            });
-        },
-        onActivity: () => touchRunActivity(phaseSnapshotFile(paths.runs, issueNum), new Date().toISOString()),
-        onDecomposed: (childIssues) => {
-            const childList = childIssues.map((n) => `#${n}`).join(', ');
-            const planLog = mkLog('plan');
-            try {
-                const before = readTextFileOrEmpty(paths.queue);
-                const rewrite = rewriteQueueForDecomposition(before, { issue: issueNum, childIssues });
-                if (rewrite.changed) {
-                    writeFileSync(paths.queue, rewrite.content);
-                    planLog('decompose_filed', `queue entry for #${issueNum} replaced with ${childList}`);
-                }
-                else {
-                    planLog('decompose_filed', `#${issueNum} had no queue entry to replace — continuing the lane with ${childList}`);
-                }
-            }
-            catch (err) {
-                planLog('decompose_file_failed', `queue rewrite for #${issueNum} failed: ${errorDetail(err)}`);
-            }
-            throw new IssueDecomposedError(`issue #${issueNum} decomposed into ${childList}`, childIssues);
-        },
-        writeLocalRunReport: (info) => maybeWriteLocalRunReport({
-            issueNum,
-            paths,
-            startedAt: runStartedAt,
-            outcome: info.outcome,
-            branch: info.branch,
-            worktree,
-            specPath,
-            route: info.route,
-            reason: info.reason,
-            writeLocalRunReport: core.writeLocalRunReport,
-        }),
-        writeBenchmarkArtifacts: (info) => maybeWriteBenchmarkArtifacts({
-            issueNum,
-            paths,
-            ctx,
-            startedAt: runStartedAt,
-            outcome: info.outcome === 'parked' ? 'failed' : info.outcome,
-            branch: info.branch,
-            specPath,
-            route: info.route,
-            checkSummary: info.checkSummary,
-            reworkRounds: info.reworkRounds,
-            failure: info.failure,
-            reportPath: info.reportPath,
-            diffBase: info.diffBase,
-            log,
-        }),
-    };
-    // #2214: report-only per-lane egress proxy for sandbox-exec. Started here, after worktree setup,
-    // so the finally below is the single place that stops it on every exit path.
-    const proxied = shouldProxyEgress(request.sandboxPolicy) ? request.sandboxPolicy : undefined;
-    const egressProxy = proxied
-        ? await startEgressProxy({
-            allowHosts: proxied.allowHosts,
-            blockTelemetry: proxied.blockTelemetry,
-            onHost: (host, allowed) => log('egress_host', egressHostMessage(host, allowed)),
-        })
-        : undefined;
-    let outcome;
-    try {
-        outcome = await runIssue(proxied && egressProxy ? { ...request, sandboxPolicy: { ...proxied, proxyUrl: egressProxy.url } } : request, policy, ports);
-    }
-    finally {
-        if (proxied && egressProxy) {
-            log('egress_summary', egressSummaryMessage(egressProxy.hosts(), proxied.allowHosts));
-            await egressProxy.close();
-        }
-    }
-    ctx?.onOutcome?.(outcome);
-    if (opts.interactive && !ctx?.localOnly && (outcome.state === 'ready' || outcome.state === 'shipped')) {
-        const leftover = listQueuedSteering(paths.steering, issueNum);
-        if (leftover.length > 0) {
-            log('steering_unconsumed', `${leftover.length} steering message(s) not consumed (no worker phase remained)`);
-        }
-    }
-    if (outcome.state === 'ready' || outcome.state === 'shipped') {
-        if (ctx?.localOnly) {
-            console.log(styleText('green', `✅ Local-only run complete in ${worktree} (no PR — publishing disabled)`));
-        }
-        else {
-            console.log(styleText('green', `✅ Issue #${issueNum} → ${terminalMessage ?? 'ready'}`));
-        }
-        return outcome.branch;
-    }
-    if (outcome.state === 'released') {
-        throw new LaneEnvironmentPauseError(terminalMessage ?? 'environment failure on base', {
-            baseSha: outcome.baseSha,
-            failingChecks: outcome.failingChecks,
-            failureSignature: outcome.failureSignature,
-            buildPreserved: outcome.buildPreserved,
-        });
-    }
-    const reason = outcome.state === 'escalated' ? 'escalate' : outcome.reason;
-    const message = outcome.state === 'escalated' ? outcome.reason : (terminalMessage ?? `run parked: ${outcome.reason}`);
-    throw new LaneParkError(message, reason, outcome.state === 'parked'
-        ? { failureSignature: outcome.failureSignature, failingChecks: outcome.failingChecks }
-        : undefined);
-}
-async function maybeWriteLocalRunReport(opts) {
-    if (process.env.FACTORY_LOCAL_ONLY !== '1')
-        return undefined;
-    const report = await (opts.writeLocalRunReport ?? coreOps.writeLocalRunReport)({
-        issue: opts.issueNum,
-        eventsFile: opts.paths.events,
-        reportsDir: opts.paths.reports,
-        startedAt: opts.startedAt,
-        outcome: opts.outcome,
-        profile: 'local-only',
-        branch: opts.branch,
-        worktree: opts.worktree,
-        specPath: opts.specPath,
-        route: opts.route,
-        reason: opts.reason,
-    });
-    console.log(styleText('cyan', `local-only report: ${report.path}`));
-    return report.path;
-}
-async function maybeWriteBenchmarkArtifacts(opts) {
-    if (!opts.ctx?.localOnly || !opts.ctx.artifactsDir)
-        return;
-    try {
-        const { manifestPath } = await writeBenchmarkArtifacts({
-            issue: opts.issueNum,
-            artifactsDir: opts.ctx.artifactsDir,
-            eventsFile: opts.paths.events,
-            costsFile: opts.paths.costs,
-            startedAt: opts.startedAt,
-            outcome: opts.outcome,
-            workspace: opts.ctx.localOnly.workspace,
-            branch: opts.branch,
-            specPath: opts.specPath,
-            route: opts.route,
-            request: opts.ctx.workRequest,
-            checkSummary: opts.checkSummary,
-            reworkRounds: opts.reworkRounds,
-            failure: opts.failure,
-            reportPath: opts.reportPath,
-            diffBase: opts.diffBase,
-        });
-        opts.log('benchmark-artifacts', `manifest written to ${manifestPath}`);
-        console.log(styleText('cyan', `benchmark artifacts: ${manifestPath}`));
-    }
-    catch (err) {
-        // Never let artifact emission mask the run outcome.
-        opts.log('benchmark-artifacts-failed', `could not write benchmark artifacts: ${err.message}`);
-    }
-}
 /** The autoGcOnRun-gated worktree sweep every pipeline entry point runs before shipping
  *  (`factory run`, and since #1756 the one-shot `factory ship` / `factory run-issue`). Never
  *  throws — a GC failure is a warn, never a reason to abort the command. */
@@ -2589,135 +2156,6 @@ export async function cmdLand(issueNum, opts = {}, deps = {}) {
         octokitFactory = previousOctokitFactory;
     }
 }
-async function landIssue(issueNum, repoRoot, ghRepo, paths, octokit, skipCI, branchPrefix, opts = {}) {
-    const [owner, repoName] = ghRepo.split('/');
-    const log = (type, msg, extra) => logEvent(paths.events, type, issueNum, msg, extra);
-    // The issue title may have been edited since the PR was opened, so a
-    // freshly-derived branch name can drift from the branch the PR actually
-    // lives on (same failure mode fixed for waitForMerge in #51). Guess the
-    // branch from the current title first, but fall back to matching the open
-    // PR that references this issue directly and use its real head branch.
-    // Legacy-prefix (LEGACY_BRANCH_PREFIX) branches are guessed too, after the resolved prefix (#1708).
-    const resolved = branchPrefix ?? resolveEffectiveConfig(configLoaders.loadRepoConfig(repoRoot)).branchPrefix;
-    const title = await getIssueTitle(ghRepo, issueNum, octokit);
-    // ADR-0161: a stack layer lands by its exact branch, never by title guess or the Closes PR (the top layer).
-    const guesses = opts.branch
-        ? [opts.branch]
-        : factoryBranchPrefixes(resolved).map((p) => branchFor(issueNum, title, p));
-    const guessedBranch = guesses[0];
-    let branch = guessedBranch;
-    let prNumber;
-    try {
-        const findByGuess = async () => {
-            for (const guess of guesses) {
-                const found = await findOpenPRNumber(octokit, owner, repoName, guess);
-                if (found) {
-                    branch = guess;
-                    return found;
-                }
-            }
-            return undefined;
-        };
-        [, prNumber] = await Promise.all([gitOps.gitFetch(repoRoot), findByGuess()]);
-        if (!prNumber && !opts.branch) {
-            const fallback = await findOpenPRForIssue(octokit, owner, repoName, issueNum);
-            if (fallback) {
-                branch = fallback.branch;
-                prNumber = fallback.number;
-            }
-        }
-    }
-    catch (err) {
-        const failure = prLookupFailure(issueNum, guessedBranch, err);
-        log('fail', failure.message);
-        throw failure;
-    }
-    if (!prNumber) {
-        log('fail', `no open PR for ${guessedBranch}`);
-        throw new LandFailureError(`no open PR for issue #${issueNum} (${guessedBranch})`, 1);
-    }
-    const landFactoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
-    // Every merge path honors the no-auto-merge gate on the issue and on the PR; unreadable labels fail closed (#1720).
-    const filingPolicy = resolveFilingPolicy(landFactoryConfig);
-    const gateLabel = filingPolicy.selfFixLabel;
-    if (opts.allowGated) {
-        console.log(`AUDIT factory land #${issueNum}: --allow-gated override — merging PR #${prNumber} past the ${gateLabel} gate`);
-        log('merge-gated-override', `--allow-gated: merging PR #${prNumber} past ${gateLabel} gate (human override)`);
-    }
-    else {
-        let where;
-        try {
-            const [issueLabels, prLabels] = await Promise.all([
-                defaultListIssueLabels(octokit, owner, repoName, issueNum),
-                defaultListIssueLabels(octokit, owner, repoName, prNumber),
-            ]);
-            if (isAutoMergeBlocked(issueLabels, filingPolicy))
-                where = `issue #${issueNum} is labelled ${gateLabel}`;
-            else if (isAutoMergeBlocked(prLabels, filingPolicy))
-                where = `PR #${prNumber} is labelled ${gateLabel}`;
-        }
-        catch (err) {
-            where = `labels could not be read (${errorDetail(err)}) — failing closed on the ${gateLabel} gate`;
-        }
-        if (where) {
-            log('merge-gated', `land refused: ${where}`);
-            throw new MergeGatedError(`not merging PR #${prNumber} for issue #${issueNum}: ${where} (human approval required). Re-run \`factory land ${issueNum} --allow-gated\` to merge it deliberately.`, issueNum, prNumber, gateLabel);
-        }
-    }
-    const worktree = worktreePathFor(repoRoot, ghRepo, issueNum, branch.startsWith(`${LEGACY_BRANCH_PREFIX}/`) ? LEGACY_BRANCH_PREFIX : resolved);
-    const landSandboxPolicy = resolveSandboxPolicy(landFactoryConfig.sandbox, {
-        worktree,
-        repoRoot,
-    });
-    const worktreeSandbox = worktreeSandboxFor(landSandboxPolicy?.runtime, {
-        allowHosts: landSandboxPolicy?.allowHosts ?? [],
-    });
-    const withLandLock = (fn) => withGitLock(repoRoot, () => withFileLock(paths.mergeLock, fn, {
-        onSteal: (pid) => log('lock-stolen', `stole ${paths.mergeLock} from dead holder pid ${pid ?? 'unknown'}`),
-    }));
-    try {
-        try {
-            await landOpenPullRequest({
-                octokit,
-                owner,
-                repoName,
-                ghRepo,
-                repoRoot,
-                issue: issueNum,
-                branch,
-                worktree,
-                prNumber: prNumber,
-                log,
-                skipCI,
-                adminMerge: resolveMergePolicy(landFactoryConfig).admin,
-                withLock: withLandLock,
-                ensureWorktree: async () => {
-                    if (!existsSync(worktree)) {
-                        await gitOps.setupWorktree(repoRoot, branch, worktree, `origin/${branch}`, worktreeSandbox, log);
-                    }
-                },
-            });
-        }
-        catch (err) {
-            if (err instanceof AwaitingReviewError || err instanceof CiFailedError) {
-                await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-            }
-            throw err;
-        }
-        log('merged', `squash-merged PR #${prNumber}`);
-        await withLandLock(() => gitOps.cleanupWorktree(repoRoot, worktree, log, worktreeSandbox));
-    }
-    catch (err) {
-        if (err instanceof LandConflictError || err instanceof AwaitingReviewError || err instanceof CiFailedError)
-            throw err;
-        log('fail', `merge failed: ${err.message}`);
-        throw new LandFailureError(`merge failed for issue #${issueNum}: ${err.message}`, 5);
-    }
-    return { branch, prNumber };
-}
-export function prLookupFailure(issueNum, branch, err) {
-    return new LandFailureError(`PR lookup failed for issue #${issueNum} (${branch}): ${errorDetail(err)}`, 5);
-}
 async function cmdTriage(opts) {
     const repoRoot = await getRepoRoot();
     const ghRepo = await getGitHubRepo();
@@ -3950,99 +3388,6 @@ export async function runLane(lane, issues, repoRoot, ghRepo, paths, deps = {})
     }
     emitEvent(paths.events, 'lane-done', lane, `lane complete (${merged} merged, ${awaitingReview} awaiting review, ${skipped} skipped, ${decomposed} decomposed, ${parked} parked)`, { lane });
 }
-export async function isPrMerged(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'all',
-        head: `${owner}:${branch}`,
-    });
-    if (prs.length === 0)
-        return false;
-    // Ship-it branch names get reused across separate runs for the same issue
-    // (e.g. a "verify-and-close" pass recreates the exact branch name an
-    // earlier, already-merged PR used) — GitHub PR numbers only increase, so
-    // the highest-numbered PR under this head is always the current one.
-    // Checking "was ANY PR ever merged under this branch name" (the old
-    // `state: 'closed'` + `.some()` behavior) matched the stale prior PR and
-    // falsely reported a brand-new, still-open PR under the same name as
-    // merged — waitForMerge then logged "landed" and skipped calling land(),
-    // leaving the real PR open forever while the lane believed it was done.
-    const latest = prs.reduce((newest, pr) => (pr.number > newest.number ? pr : newest));
-    return Boolean(latest.merged_at);
-}
-export async function findOpenPRNumber(octokit, owner, repoName, branch) {
-    const { data: prs } = await octokit.rest.pulls.list({
-        owner,
-        repo: repoName,
-        state: 'open',
-        head: `${owner}:${branch}`,
-    });
-    return prs[0]?.number;
-}
-export async function findOpenPRForIssue(octokit, owner, repoName, issueNum) {
-    const perPage = 100;
-    const matches = new RegExp(`\\bcloses\\s+#${issueNum}\\b`, 'i');
-    for (let page = 1;; page++) {
-        const { data: prs } = await octokit.rest.pulls.list({
-            owner,
-            repo: repoName,
-            state: 'open',
-            per_page: perPage,
-            page,
-        });
-        const pr = prs.find((p) => matches.test(p.body ?? ''));
-        if (pr) {
-            const headRepoFullName = pr.head.repo?.full_name ?? null;
-            if (headRepoFullName !== `${owner}/${repoName}`) {
-                return {
-                    number: pr.number,
-                    branch: pr.head.ref,
-                    headSha: pr.head.sha,
-                    headRepoFullName,
-                };
-            }
-            return { number: pr.number, branch: pr.head.ref, headSha: pr.head.sha, headRepoFullName };
-        }
-        if (prs.length < perPage)
-            return undefined;
-    }
-}
-export async function squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, 
-/** `sha`: the CI-verified head commit. GitHub refuses the merge if the PR head has moved. */
-opts = {}) {
-    const { sha } = opts;
-    if (opts.admin) {
-        const run = opts.run ?? shellOps.exec;
-        const pin = sha ? ` --match-head-commit ${shellEscape(sha)}` : '';
-        await run(`gh pr merge ${prNumber} --repo ${shellEscape(`${owner}/${repoName}`)} --admin --squash --delete-branch${pin}`);
-        return;
-    }
-    await octokit.rest.pulls.merge({
-        owner,
-        repo: repoName,
-        pull_number: prNumber,
-        merge_method: 'squash',
-        ...(sha ? { sha } : {}),
-    });
-    // Best-effort branch delete: the merge is the source of truth.
-    await octokit.rest.git.deleteRef({ owner, repo: repoName, ref: `heads/${branch}` }).catch(() => { });
-}
-export class MergeGatedError extends Error {
-    issue;
-    prNumber;
-    label;
-    constructor(message, issue, prNumber, label) {
-        super(message);
-        this.issue = issue;
-        this.prNumber = prNumber;
-        this.label = label;
-        this.name = 'MergeGatedError';
-    }
-}
-export class LandConflictError extends Error {
-    parkReason = 'conflict';
-}
 /** The target issue was already resolved before the run started — a clean skip,
  *  not a park. Callers advance to the next queue entry. (#681) */
 export class IssueSkippedError extends Error {
@@ -4052,13 +3397,6 @@ export class IssueSkippedError extends Error {
         this.reason = reason;
     }
 }
-export class AwaitingReviewError extends Error {
-    prNumber;
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
 /** The target issue tripped the PLAN pre-flight size gate and was decomposed into real
  *  filed sub-issues; the queue was rewritten. Not a park — the lane continues with the
  *  children in place of the oversized issue. (#823) */
@@ -4069,191 +3407,6 @@ export class IssueDecomposedError extends Error {
         this.childIssues = childIssues;
     }
 }
-export class LandFailureError extends Error {
-    code;
-    constructor(message, code) {
-        super(message);
-        this.code = code;
-    }
-}
-/** Thrown when watchChecks reports a confirmed CI failure — a completed check run with a
- *  non-passing conclusion. A confirmed failing check must never be merged, admin override
- *  or not. See CiUnverifiedError for the no-verdict case. */
-export class CiFailedError extends Error {
-    prNumber;
-    parkReason = 'ci-failed';
-    constructor(message, prNumber) {
-        super(message);
-        this.prNumber = prNumber;
-    }
-}
-/** Thrown when the CI watch never reached a green verdict — a deadline timeout, no check runs ever
- *  registering, or repeated API failures. A subclass of CiFailedError so every existing guard
- *  (parkReasonFor → 'ci-failed', worktree cleanup, cmdLand's exit-0 path) treats "we don't know"
- *  exactly like "we know it's red": never merge. */
-export class CiUnverifiedError extends CiFailedError {
-}
-/** Thrown when the one infra rerun (#2365) also failed for infrastructure reasons on the same head SHA (#2366).
- *  A CiFailedError subclass so every guard still leaves the PR open and unmerged, but it parks as
- *  'ci-infra', which the ADR-0155 steward skips. */
-export class CiInfraError extends CiFailedError {
-    parkReason = 'ci-infra';
-}
-const MAX_MERGE_ATTEMPTS = 5;
-const MERGE_RETRY_BASE_MS = 5_000;
-/** True when GitHub refused a SHA-pinned merge because the PR head moved past the verified
- *  commit (REST 409, or gh's "Head branch was modified"). Retrying as-is can never succeed. */
-export function isHeadModifiedMergeError(err) {
-    if (err?.status === 409)
-        return true;
-    const msg = `${err instanceof Error ? err.message : ''}\n${errorDetail(err)}`;
-    return /head branch was modified/i.test(msg);
-}
-export function isReviewRequiredMergeError(err, state) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/approving review/i.test(msg) || /review is required/i.test(msg))
-        return true;
-    return state.mergeStateStatus === 'BLOCKED' && state.reviewDecision === 'REVIEW_REQUIRED';
-}
-export async function getPullRequestLandState(octokit, owner, repoName, prNumber) {
-    const result = await octokit.graphql(`query PullRequestLandState($owner: String!, $repo: String!, $number: Int!) {
-      repository(owner: $owner, name: $repo) {
-        pullRequest(number: $number) {
-          id
-          isDraft
-          mergeStateStatus
-          reviewDecision
-        }
-      }
-    }`, { owner, repo: repoName, number: prNumber });
-    return result.repository?.pullRequest ?? {};
-}
-export async function markPullRequestReady(octokit, pullRequestId) {
-    await octokit.graphql(`mutation MarkPullRequestReady($id: ID!) {
-      markPullRequestReadyForReview(input: { pullRequestId: $id }) {
-        pullRequest { isDraft }
-      }
-    }`, { id: pullRequestId });
-}
-export async function rebaseDirtyPullRequest(opts) {
-    const { issue, branch, worktree, prNumber, log, run = shellOps.exec, pathExists = existsSync } = opts;
-    if (!pathExists(worktree)) {
-        const msg = `PR #${prNumber} DIRTY on ${branch} and worktree gone`;
-        log('conflict', msg);
-        throw new LandConflictError(msg);
-    }
-    try {
-        await run('git rebase origin/main', { cwd: worktree });
-        await run(`git push --force-with-lease origin ${shellEscape(branch)}`, { cwd: worktree });
-    }
-    catch {
-        // Best-effort cleanup: the conflict logged below is the error we surface.
-        await run('git rebase --abort', { cwd: worktree }).catch(() => { });
-        const msg = `rebase conflict on ${branch} — parked`;
-        log('conflict', msg);
-        throw new LandConflictError(`issue #${issue}: ${msg}`);
-    }
-}
-export async function landOpenPullRequest(opts) {
-    const { octokit, owner, repoName, issue, branch, worktree, prNumber, log, run, pathExists, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), skipCI = false, adminMerge = process.env.FACTORY_MERGE_ADMIN === '1', watch = internalOps.watchChecks, rerun, withLock = (fn) => fn(), ensureWorktree, } = opts;
-    /** Watches CI on the PR's current head commit and returns that SHA once it is green, so the
-     *  merge can be pinned to exactly the commit CI verified. */
-    const watchCi = async () => {
-        let headSha;
-        let outcome;
-        try {
-            const { data: pr } = await octokit.rest.pulls.get({ owner, repo: repoName, pull_number: prNumber });
-            headSha = pr.head.sha;
-            outcome = await watchChecksWithInfraRerun({
-                octokit,
-                owner,
-                repo: repoName,
-                ref: headSha,
-                watch,
-                rerun,
-                onRescued: ({ runIds }) => log('ci-rescued', `CI rescued for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch is green`),
-                onRescueFailed: ({ runIds, outcome: failedOutcome }) => log('ci-rescue-failed', `CI rescue failed for PR #${prNumber} on ${branch}: reran infra-failed run(s) ${runIds.join(', ')} once and the re-watch ended ${failedOutcome}`),
-            });
-        }
-        catch (err) {
-            const msg = `CI watch for ${branch} failed: ${errorDetail(err)} — refusing to merge without a green verdict`;
-            log('ci-failed', msg);
-            throw new CiUnverifiedError(msg, prNumber);
-        }
-        if (outcome === 'success')
-            return headSha;
-        if (outcome === 'infra-failure') {
-            const msg = `CI failed again for infrastructure reasons for PR #${prNumber} on ${branch} after one rerun — parked as ci-infra, not merged`;
-            log('ci-infra', msg);
-            throw new CiInfraError(msg, prNumber);
-        }
-        if (outcome === 'failure') {
-            const msg = `CI failed for PR #${prNumber} on ${branch} — refusing to merge with a failing check`;
-            log('ci-failed', msg);
-            throw new CiFailedError(msg, prNumber);
-        }
-        const msg = `CI watch for ${branch} ended ${outcome} — refusing to merge without a green verdict`;
-        log('ci-failed', msg);
-        throw new CiUnverifiedError(msg, prNumber);
-    };
-    // The CI watch is a 10-20 minute wait, not a mutation: it must never run under the land
-    // locks, or every other lane's setupWorktree serializes behind it (#645).
-    let verifiedSha = skipCI ? undefined : await watchCi();
-    let state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-    if (state.mergeStateStatus === 'DIRTY') {
-        const rebased = await withLock(async () => {
-            // Re-check under the lock: a sibling lane may have landed (or rebased this branch)
-            // while we waited for it, so the DIRTY verdict read above can be stale.
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-            if (state.mergeStateStatus !== 'DIRTY')
-                return false;
-            await ensureWorktree?.();
-            await rebaseDirtyPullRequest({ issue, branch, worktree, prNumber, log, run, pathExists });
-            return true;
-        });
-        if (rebased) {
-            if (!skipCI) {
-                verifiedSha = await watchCi();
-            }
-            state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-        }
-    }
-    for (let attempt = 1;; attempt++) {
-        try {
-            await withLock(async () => {
-                // Same rule as the rebase section: whatever we read before taking the lock (or before
-                // the backoff sleep) may be stale, so the attempt decides from a fresh read.
-                state = await getPullRequestLandState(octokit, owner, repoName, prNumber);
-                if (state.isDraft && state.id) {
-                    log('land', `PR #${prNumber} still a draft — re-issuing ready-for-review (attempt ${attempt})`);
-                    await markPullRequestReady(octokit, state.id).catch((err) => log('warn', `ready-for-review flip failed for PR #${prNumber}: ${errorDetail(err)}`));
-                }
-                await squashMergeAndDelete(octokit, owner, repoName, branch, prNumber, {
-                    admin: adminMerge,
-                    run,
-                    sha: verifiedSha,
-                });
-            });
-            return;
-        }
-        catch (err) {
-            if (verifiedSha && isHeadModifiedMergeError(err)) {
-                const msg = `PR #${prNumber} head moved past CI-verified commit ${verifiedSha} — refusing to merge an unverified head`;
-                log('ci-failed', msg);
-                throw new CiUnverifiedError(msg, prNumber);
-            }
-            if (isReviewRequiredMergeError(err, state)) {
-                log('awaiting-review', `PR #${prNumber} blocked on human review — leaving open for approval`);
-                throw new AwaitingReviewError(`PR #${prNumber} awaiting review: ${err.message}`, prNumber);
-            }
-            if (attempt >= MAX_MERGE_ATTEMPTS)
-                throw err;
-            log('land', `merge attempt ${attempt}/${MAX_MERGE_ATTEMPTS} failed (${err.message}); mergeStateStatus=${state.mergeStateStatus ?? 'unknown'} — retrying with backoff`);
-            // Backoff outside the lock: waiting is not a mutation (#645).
-            await sleep(MERGE_RETRY_BASE_MS * 2 ** (attempt - 1));
-        }
-    }
-}
 export function issueFromFactoryBranch(branch, prefix) {
     return factoryBranchIssue(branch, prefix) ?? undefined;
 }
@@ -4335,108 +3488,6 @@ export async function cmdResumeApproved(opts = {}) {
         throw new CliExitError(`factory: resume-approved: ${result.failed.length} PR(s) failed to land`, 5);
     }
 }
-/** Consecutive merged-state check failures tolerated before waitForMerge parks the lane.
- *  At the shipped 120s poll that is ~20 minutes of 100% failure (ADR: sustained-failure park). */
-export const MERGE_CHECK_MAX_CONSECUTIVE_FAILURES = 10;
-/** Wall-clock backstop: continuous merged-state check failure for this long parks the lane even
- *  if fewer than MERGE_CHECK_MAX_CONSECUTIVE_FAILURES attempts were made (slower poll cadence). */
-export const MERGE_CHECK_FAILURE_BUDGET_MS = 2 * 60 * 60 * 1000;
-/** GitHub signals both primary and secondary rate limits with 403 — the same status it uses for a
- *  token that genuinely lacks the scope. Only a 403 with no rate-limit evidence is permanent. */
-function looksRateLimited(err) {
-    const headers = err?.response?.headers ?? {};
-    const remaining = headers['x-ratelimit-remaining'];
-    if (typeof remaining === 'string' && remaining.trim() === '0')
-        return true;
-    if (typeof remaining === 'number' && remaining === 0)
-        return true;
-    if (headers['retry-after'] !== undefined)
-        return true;
-    return /rate limit|secondary rate|abuse detection/i.test(errorDetail(err));
-}
-/** True when a merged-state check failure cannot recover by retrying: an expired/revoked token
- *  (401) or a token missing `pulls:read` (403 with no rate-limit evidence). */
-export function isPermanentMergeCheckError(err) {
-    const status = err?.status;
-    if (status === 401)
-        return true;
-    if (status !== 403)
-        return false;
-    return !looksRateLimited(err);
-}
-async function defaultListIssueLabels(octokit, owner, repo, issue) {
-    const { data } = await octokit.rest.issues.listLabelsOnIssue({ owner, repo, issue_number: issue });
-    return data.map((label) => label.name);
-}
-export async function waitForMerge(issue, branch, repoRoot, ghRepo, paths, deps = {}) {
-    const { createOctokit = getOctokit, pathExists = existsSync, checkMerged = isPrMerged, loadConfig = configLoaders.loadFactoryConfigForRepo, land = landIssue, listIssueLabels = defaultListIssueLabels, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, mergeEnabled, writeLine = (line) => console.log(line), now = () => Date.now(), mergeOverrides, landBranch, } = deps;
-    const factoryConfig = loadConfig(paths.config);
-    const isMergeEnabled = mergeEnabled ?? (() => resolveMergePolicy(factoryConfig, process.env, mergeOverrides).auto);
-    const skipCI = configLoaders.resolveSkipCI(factoryConfig);
-    const filingPolicy = resolveFilingPolicy(factoryConfig);
-    const octokit = createOctokit();
-    const [owner, repoName] = ghRepo.split('/');
-    emitEvent(paths.events, 'await-merge', issue, `waiting to merge ${branch}`);
-    let consecutiveFailures = 0;
-    let firstFailureAt = null;
-    while (!pathExists(paths.stop)) {
-        // The merge wait logs nothing on its happy path, so each poll bumps the per-issue heartbeat:
-        // status/TUI staleness rules (ADR-0086, ADR-0093) otherwise read a live wait as a dead run.
-        if (paths.runs)
-            touchRunActivity(phaseSnapshotFile(paths.runs, issue), new Date().toISOString()).catch(() => { });
-        let merged = false;
-        try {
-            merged = await checkMerged(octokit, owner, repoName, branch);
-            consecutiveFailures = 0;
-            firstFailureAt = null;
-        }
-        catch (err) {
-            consecutiveFailures++;
-            firstFailureAt ??= now();
-            const detail = errorDetail(err);
-            emitEvent(paths.events, 'warn', issue, `merged-state check failed (treating as not merged): ${detail}`);
-            const permanent = isPermanentMergeCheckError(err);
-            const elapsedMs = now() - firstFailureAt;
-            const budgetSpent = elapsedMs >= MERGE_CHECK_FAILURE_BUDGET_MS;
-            const streakSpent = consecutiveFailures >= MERGE_CHECK_MAX_CONSECUTIVE_FAILURES;
-            if (permanent || streakSpent || budgetSpent) {
-                const trigger = permanent
-                    ? 'permanent error (auth/scope — retrying cannot help)'
-                    : `${consecutiveFailures} consecutive failures over ${Math.round(elapsedMs / 1000)}s`;
-                const msg = `merged-state check for ${branch} is not recovering — parking lane after ${trigger}: ${detail}`;
-                emitEvent(paths.events, 'escalate', issue, msg);
-                throw new LaneParkError(msg, 'escalate');
-            }
-        }
-        if (merged) {
-            emitEvent(paths.events, 'landed', issue, 'PR merged');
-            return;
-        }
-        if (isMergeEnabled()) {
-            let labels = [];
-            try {
-                labels = await listIssueLabels(octokit, owner, repoName, issue);
-            }
-            catch (err) {
-                emitEvent(paths.events, 'warn', issue, `label check failed (treating as blocked): ${errorDetail(err)}`);
-                labels = [filingPolicy.selfFixLabel];
-            }
-            if (isAutoMergeBlocked(labels, filingPolicy)) {
-                emitEvent(paths.events, 'merge-gated', issue, `auto-merge blocked by ${filingPolicy.selfFixLabel} — awaiting human approval`);
-                writeLine(`[factory] #${issue} auto-merge gated (${filingPolicy.selfFixLabel}); awaiting human merge (poll 120s)`);
-                await sleep(120_000);
-                continue;
-            }
-            if (landBranch)
-                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI, undefined, { branch: landBranch });
-            else
-                await land(issue, repoRoot, ghRepo, paths, octokit, skipCI);
-            return;
-        }
-        writeLine(`[factory] #${issue} awaiting human merge (poll 120s)`);
-        await sleep(120_000);
-    }
-}
 const USAGE_UNAVAILABLE_LINE = '[factory] supervise: usage signal unavailable — proceeding without resume gate (set FACTORY_USAGE_ESTIMATOR=1 to gate on the heuristic)';
 export async function superviseLoop(deps) {
     const { cap, resumeAt, pollMs, watch = true, watchSource = 'default', resumeAtSource = 'default', pollSource = 'default', estimator = false, stopFile, eventsFile, now, runQueue, readUsageFn = () => readUsage({ cap, estimator }), pathExists = existsSync, clearStop = (path) => rmSync(path, { force: true }), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), emitEvent = logEvent, writeLine = (line) => console.log(line), ingest, } = deps;