@overdeck/desktop 0.45.23 → 0.46.0

package/server/{workflows-C9WmILql.js → workflows-D0oip4eV.js}

@@ -1,16 +1,17 @@
-import { Dt as getProjectConfigFromWorkspacePath, Ft as resolveProjectForIssue, Jn as extractPrefixSync, Lt as writeCloseOutDodGate, Ot as init_record, Vr as init_paths, Yn as init_issue_id, jt as readIssueRecord, kt as markRecordPipelineClosedOutSync, qn as extractNumberSync, wr as OVERDECK_HOME } from "./config-yaml-DvyMuOle.js";
-import { l as init_review_status, s as getReviewStatus } from "./review-status-A7quS5KJ.js";
-import { b as init_agents, i as listRunningAgents } from "./queries-6d7Cdtm7.js";
-import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-B0pmAz0a.js";
-import { f as init_config, s as getDashboardApiUrlSync } from "./config-CCvjQf27.js";
-import { i as loadCloisterConfig, r as init_config$1 } from "./config-DjLOdbgT.js";
-import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-BV1q_2EV.js";
-import { i as findWorkspacePath, o as init_archive_planning, t as archivePlanning } from "./archive-planning-DYrYojxl.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-BBNjPcqU.js";
-import { t as closeIssue } from "./close-issue-Dn_4c4G8.js";
-import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-CXIhdCYD.js";
-import { n as acceptFlagFor, t as DOD_ROWS } from "./dod-BrSfUHm0.js";
-import { t as teardownWorkspace } from "./teardown-workspace-CEgauF4U.js";
+import { Ft as markRecordPipelineClosedOutSync, Gr as OVERDECK_HOME, Lt as readIssueRecord, Nt as getProjectConfigFromWorkspacePath, Pt as init_record, Vt as resolveProjectForIssue, Wt as writeCloseOutDodGate, ci as init_paths, gr as init_issue_id, hr as extractPrefixSync, mr as extractNumberSync } from "./config-yaml-CmOPzmBb.js";
+import { C as capturePipelineStage, E as resolvePipelineTelemetryContext, T as init_pipeline, f as init_review_status, l as getReviewStatus } from "./review-status-yljtTd-q.js";
+import { b as init_agents, i as listRunningAgents } from "./queries-DHJm7bTd.js";
+import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population--YUXU999.js";
+import { f as init_config, s as getDashboardApiUrlSync } from "./config-Dr3pW6w6.js";
+import { i as loadCloisterConfig, r as init_config$1 } from "./config-B2IMcBxx.js";
+import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-CBULruzm.js";
+import { i as findWorkspacePath, t as archivePlanning } from "./archive-planning-C0lAbNB_.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-q67TYYg5.js";
+import { t as closeIssue } from "./close-issue-D5MF5GqF.js";
+import { i as gatherIssueBranchContainment, s as init_pipeline_membership_gather } from "./pipeline-membership-gather-CET40frr.js";
+import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-DHWiKxo7.js";
+import { i as canAcceptDodMisses, n as DOD_ROWS, r as acceptFlagFor, t as BRANCH_ABSENT_MERGE_ERROR } from "./dod-Dar-yheg.js";
+import { t as teardownWorkspace } from "./teardown-workspace-l2F4_zim.js";
 import { resolve } from "node:path";
 import { Effect } from "effect";
 import { existsSync } from "fs";
@@ -27,13 +28,13 @@ init_issue_id();
 init_feature_registry_population();
 init_config$1();
 init_types();
-init_archive_planning();
 /** Mechanical Definition-of-Done row checks. */
 init_agents();
 init_config();
 init_review_status();
 init_record();
 init_pull_requests();
+init_pipeline_membership_gather();
 const execFileAsync = promisify(execFile);
 const defaultMergedRowDeps = {
 	verifyMerged: async () => ({
@@ -47,6 +48,18 @@ const defaultMergedRowDeps = {
 		const response = await fetchIssuePullRequest(ctx.issueId);
 		if (response.error) throw new Error(response.error);
 		return response.pr ?? {};
+	},
+	readDurableMerges: async (ctx) => {
+		return (await readIssueRecord(resolveProjectForIssue(ctx.issueId) ?? getProjectConfigFromWorkspacePath(ctx.projectPath), ctx.issueId))?.closeOut.merges ?? [];
+	},
+	readBranchContainment: async (ctx) => {
+		const project = resolveProjectForIssue(ctx.issueId) ?? getProjectConfigFromWorkspacePath(ctx.projectPath);
+		if (!project) return {
+			unmergedRefs: [],
+			mergedWorkRefs: [],
+			pointerRefs: []
+		};
+		return gatherIssueBranchContainment(project, ctx.issueId);
 	}
 };
 const defaultPostMergeRowDeps = {
@@ -156,11 +169,13 @@ async function checkVerificationRow(issueId, deps = defaultDeps) {
 	if (!loaded) return result("verification", "miss", "no review status or journal record found");
 	const value = loaded.status.verificationStatus;
 	const commit = loaded.status.lastVerifiedCommit;
-	const source = loaded.source === "journal" ? " from pipeline journal" : "";
-	const policy = value === "skipped" ? " (skipped per issue policy)" : "";
-	const commitNote = commit ? ` at ${commit}` : "";
-	const observed = `verificationStatus: ${value ?? "missing"}${commitNote}${source}${policy}`;
-	return result("verification", (value === "passed" || value === "skipped") && Boolean(commit) ? "pass" : "miss", observed);
+	const accepted = value === "passed" || value === "skipped";
+	const notes = [];
+	if (loaded.source === "journal") notes.push("from pipeline journal");
+	if (value === "skipped") notes.push("skipped per issue policy");
+	if (accepted && !commit) notes.push("no lastVerifiedCommit recorded");
+	const observed = `verificationStatus: ${value ?? "missing"}${commit ? ` at ${commit}` : ""}${notes.length > 0 ? ` (${notes.join("; ")})` : ""}`;
+	return result("verification", accepted ? "pass" : "miss", observed);
 }
 async function checkMergedRow(ctx, deps = defaultMergedRowDeps) {
 	const verified = await deps.verifyMerged(ctx).catch((error) => ({
@@ -171,10 +186,19 @@ async function checkMergedRow(ctx, deps = defaultMergedRowDeps) {
 	}));
 	const observed = verified.details?.join("; ") || verified.error || (verified.skipped ? "issue already closed on forge" : "merge not verified");
 	const merged = result("merged", verified.success || verified.skipped ? "pass" : "miss", observed);
-	if (!ctx.github) return merged;
-	try {
+	const branchAbsent = verified.error === BRANCH_ABSENT_MERGE_ERROR;
+	let durableMerges = [];
+	if (branchAbsent) try {
+		durableMerges = await (deps.readDurableMerges ?? defaultMergedRowDeps.readDurableMerges)(ctx);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		merged.observed = `${merged.observed}; durable merge evidence unavailable: ${message}`;
+	}
+	let pullRequestState;
+	if (ctx.github) try {
 		const branchName = `feature/${ctx.issueId.toLowerCase()}`;
 		const pullRequest = await deps.readPullRequest(ctx, branchName);
+		pullRequestState = pullRequest.state;
 		merged.mergedAt = pullRequest.mergedAt;
 		merged.mergeCommit = typeof pullRequest.mergeCommit === "string" ? pullRequest.mergeCommit : pullRequest.mergeCommit?.oid;
 		const number = pullRequest.number ? `PR #${pullRequest.number}` : "PR";
@@ -185,9 +209,27 @@ async function checkMergedRow(ctx, deps = defaultMergedRowDeps) {
 		const message = error instanceof Error ? error.message : String(error);
 		merged.observed = `${merged.observed}; forge metadata unavailable: ${message}`;
 	}
+	if (branchAbsent) {
+		const forgeMerged = pullRequestState?.toUpperCase() === "MERGED";
+		if (durableMerges.length > 0 || forgeMerged) {
+			merged.status = "pass";
+			if (durableMerges.length > 0) merged.observed = `${merged.observed}; durable close-out record contains ${durableMerges.length} merge artifact(s)`;
+		} else merged.observed = `${merged.observed}; no merged forge artifact or durable close-out merge record found`;
+	}
+	if (merged.status === "miss") try {
+		const containment = await (deps.readBranchContainment ?? defaultMergedRowDeps.readBranchContainment)(ctx);
+		if (containment.mergedWorkRefs.length > 0 && containment.unmergedRefs.length === 0) {
+			merged.status = "pass";
+			merged.evidence = "branch-containment";
+			merged.observed = `${merged.observed}; branch work contained in default branch with no merged PR — non-PR landing (membership L2-work lens): ${containment.mergedWorkRefs.join(", ")}`;
+		}
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		merged.observed = `${merged.observed}; branch containment evidence unavailable: ${message}`;
+	}
 	return merged;
 }
-async function checkPostMergeRow(ctx, deps = defaultPostMergeRowDeps) {
+async function checkPostMergeRow(ctx, merged, deps = defaultPostMergeRowDeps) {
 	try {
 		const canonicalState = await deps.readCanonicalState(ctx);
 		const mergeStatus = await deps.readMergeStatus(ctx.issueId);
@@ -195,7 +237,9 @@ async function checkPostMergeRow(ctx, deps = defaultPostMergeRowDeps) {
 		const runningAgents = (await deps.listAgents()).filter((agent) => agent.issueId.toUpperCase() === issueId && (agent.role === "work" || agent.role === "plan") && (agent.status === "starting" || agent.status === "running"));
 		const stateObserved = canonicalState ? `canonical state: ${canonicalState}` : `canonical state unavailable; mergeStatus: ${mergeStatus ?? "missing"}`;
 		const agentsObserved = runningAgents.length > 0 ? `running agents: ${runningAgents.map((agent) => agent.id).join(", ")}` : "no running work/planning agents";
-		return result("post-merge", (canonicalState === "verifying_on_main" || mergeStatus === "merged") && runningAgents.length === 0 ? "pass" : "miss", `${stateObserved}; ${agentsObserved}`);
+		const lifecycleObserved = canonicalState === "verifying_on_main" || mergeStatus === "merged";
+		if (!lifecycleObserved && merged?.evidence === "branch-containment") return result("post-merge", runningAgents.length === 0 ? "pass" : "miss", `non-PR landing (branch-containment evidence) — post-merge lifecycle not applicable; ${agentsObserved}`);
+		return result("post-merge", lifecycleObserved && runningAgents.length === 0 ? "pass" : "miss", `${stateObserved}; ${agentsObserved}`);
 	} catch (error) {
 		return result("post-merge", "miss", `post-merge evidence unavailable: ${error instanceof Error ? error.message : String(error)}`);
 	}
@@ -212,6 +256,10 @@ async function checkMainVerifyRow(ctx, mergeCommit, deps = defaultMainVerifyRowD
 	}
 }
 async function checkDeployRow(ctx, merge, deps = defaultDeployRowDeps) {
+	if (!merge.mergeCommit) {
+		if (merge.mergedRowStatus === "miss") return result("deploy", "skip", "no merge commit resolved because the merged row missed — deploy ancestry depends on row 4; build ancestry unchecked");
+		return result("deploy", "miss", "merged row passed without a resolvable merge commit; build ancestry cannot be checked");
+	}
 	const baseUrl = deps.dashboardUrl().replace(/\/$/, "");
 	let health;
 	try {
@@ -224,8 +272,9 @@ async function checkDeployRow(ctx, merge, deps = defaultDeployRowDeps) {
 	if (resolve(repoRoot) !== resolve(ctx.projectPath)) return result("deploy", "skip", `live dashboard serves ${repoRoot}, not this project — deploy semantics undefined for ${ctx.projectPath}`);
 	const buildCommit = typeof health.buildCommit === "string" && health.buildCommit.trim() ? health.buildCommit : void 0;
 	if (!buildCommit) return result("deploy", "miss", `dashboard at ${baseUrl} did not report buildCommit; live deployment cannot be proven`);
-	if (!merge.mergeCommit) return result("deploy", "miss", "cannot resolve merge commit; live deployment cannot be proven");
 	try {
+		if (health.buildDirty === true) return result("deploy", "miss", `live build ${buildCommit.slice(0, 8)} was built from a dirty working tree — uncommitted changes may be serving; redeploy canonically with \`pan reload\``);
+		if (!await deps.commitContains(repoRoot, buildCommit, "origin/main")) return result("deploy", "miss", `live build commit ${buildCommit.slice(0, 8)} is not an ancestor of origin/main — the server is running a build of local-only commits; redeploy with \`pan reload\``);
 		const contains = await deps.commitContains(repoRoot, merge.mergeCommit, buildCommit);
 		const observed = `build commit ${buildCommit.slice(0, 8)} ${contains ? "contains" : "does not contain"} merge ${merge.mergeCommit.slice(0, 8)}`;
 		return result("deploy", contains ? "pass" : "miss", observed);
@@ -237,6 +286,8 @@ async function evaluateDodGate(ctx, opts = {}, deps = defaultEvaluateDodGateDeps
 	const acceptedRows = new Set(opts.acceptedRows ?? []);
 	const overridable = new Set(DOD_ROWS.filter((row) => row.overridable).map((row) => row.id));
 	for (const id of acceptedRows) if (!overridable.has(id)) throw new TypeError(`DoD row "${id}" cannot be accepted; valid rows: ${[...overridable].join(", ")}`);
+	const by = opts.acceptedBy ?? process.env.OVERDECK_AGENT_ID ?? userInfo().username;
+	if (acceptedRows.size > 0 && !canAcceptDodMisses(by)) throw new TypeError("The flywheel orchestrator cannot accept missed Definition-of-Done rows; an operator must apply --accept-<row> overrides.");
 	const merged = opts.verifyMerged ? await checkMergedRow(ctx, {
 		...defaultMergedRowDeps,
 		verifyMerged: opts.verifyMerged
@@ -246,14 +297,14 @@ async function evaluateDodGate(ctx, opts = {}, deps = defaultEvaluateDodGateDeps
 		deps.tests(ctx.issueId),
 		deps.verification(ctx.issueId),
 		Promise.resolve(merged),
-		deps.postMerge(ctx),
+		deps.postMerge(ctx, merged),
 		deps.mainVerify(ctx, merged.mergeCommit),
 		deps.deploy(ctx, {
 			mergedAt: merged.mergedAt,
-			mergeCommit: merged.mergeCommit
+			mergeCommit: merged.mergeCommit,
+			mergedRowStatus: merged.status
 		})
 	]);
-	const by = opts.acceptedBy ?? process.env.OVERDECK_AGENT_ID ?? userInfo().username;
 	for (const row of rows) if (row.status === "miss" && acceptedRows.has(row.id)) row.acceptedBy = {
 		flag: acceptFlagFor(rowDefinition(row.id)),
 		by,
@@ -277,6 +328,7 @@ async function evaluateDodGate(ctx, opts = {}, deps = defaultEvaluateDodGateDeps
 * deepWipe() — Destructive: teardown(deleteBranches) + delete agent state + reset issue
 */
 init_record();
+init_pipeline();
 const execAsync = promisify$1(exec$1);
 function trackerName(ctx, fallback) {
 	const name = ctx.tracker?.name ?? fallback;
@@ -363,6 +415,17 @@ function closeOut(ctx, opts = {}) {
 	return Effect.gen(function* () {
 		const start = Date.now();
 		const allSteps = [];
+		const uatEvidenceStep = yield* Effect.promise(async () => {
+			try {
+				const { healUatPromotionVerification } = await import("./uat-promote-verification-CKB9ZrKC.js");
+				const evidence = await healUatPromotionVerification(ctx.issueId);
+				if (!evidence) return stepSkipped("dod:uat-promotion-evidence", ["No missing UAT-promotion verification evidence found"]);
+				return stepOk("dod:uat-promotion-evidence", [`Recorded verification from ${evidence.generation}`, ...evidence.mergeSha ? [`Promoted to main at ${evidence.mergeSha.slice(0, 9)}`] : []]);
+			} catch (err) {
+				return stepSkipped("dod:uat-promotion-evidence", [`Evidence recovery unavailable: ${err instanceof Error ? err.message : String(err)}`]);
+			}
+		});
+		allSteps.push(uatEvidenceStep);
 		const dodGate = yield* Effect.promise(() => evaluateDodGate(ctx, {
 			acceptedRows: opts.dodAcceptedRows,
 			acceptedBy: opts.dodAcceptedBy,
@@ -392,6 +455,13 @@ function closeOut(ctx, opts = {}) {
 			allSteps.push(stepFailed("close-out:abort", "Stopped — xBRIEF completion failed, workspace preserved"));
 			return buildResult("close-out", ctx.issueId, allSteps, start, dodGate);
 		}
+		const telemetryContext = yield* Effect.promise(async () => {
+			try {
+				return await resolvePipelineTelemetryContext(ctx.issueId);
+			} catch {
+				return null;
+			}
+		});
 		const closeOutConfig = (yield* Effect.promise(() => Effect.runPromise(loadCloisterConfig()))).close_out;
 		const teardownSteps = yield* teardownWorkspace(ctx, {
 			deleteWorkspace: closeOutConfig?.remove_workspace ?? false,
@@ -437,7 +507,9 @@ function closeOut(ctx, opts = {}) {
 			issueId: ctx.issueId,
 			status: "archived"
 		}));
-		return buildResult("close-out", ctx.issueId, allSteps, start, dodGate);
+		const result = buildResult("close-out", ctx.issueId, allSteps, start, dodGate);
+		if (result.success && !markTerminal.skipped) capturePipelineStage("closed_out", telemetryContext);
+		return result;
 	});
 }
 function markPipelineClosedOutStep(ctx) {
@@ -542,7 +614,7 @@ function cancelIssueWorkflow(ctx, opts = {}) {
 async function completeXBriefStep(ctx) {
 	const step = "close-out:vbrief-completed";
 	try {
-		const { transitionXBriefOnMain } = await import("./lifecycle-io-Bsnr2K4F.js");
+		const { transitionXBriefOnMain } = await import("./lifecycle-io-D_zTLvP1.js");
 		const result = await Effect.runPromise(transitionXBriefOnMain(ctx.projectPath, ctx.issueId, "completed", "completed", `scope: complete ${ctx.issueId.toUpperCase()} xBRIEF`));
 		const details = [result.moved ? "Updated xBRIEF lifecycle to completed" : "xBRIEF lifecycle already completed", result.statusUpdated ? "Updated plan.status to completed" : "plan.status already completed"];
 		if (result.committed) details.push("Committed xBRIEF completion on main");
@@ -556,70 +628,81 @@ async function completeXBriefStep(ctx) {
 }
 async function verifyBranchMergedImpl(ctx) {
 	const step = "close-out:verify-merged";
-	const branchName = `feature/${ctx.issueId.toLowerCase()}`;
+	const issueLower = ctx.issueId.toLowerCase();
+	const featureBranchName = `feature/${issueLower}`;
+	const strikeBranchName = `strike/${issueLower}`;
 	try {
 		try {
-			const { loadReviewStatuses } = await import("./review-status-C6n6-9f_.js");
+			const { loadReviewStatuses } = await import("./review-status-BZH8h-6W.js");
 			if (loadReviewStatuses()[ctx.issueId.toUpperCase()]?.mergeStatus === "merged") return stepOk(step, ["Merge specialist confirmed merge completed"]);
 		} catch {}
-		const { stdout: branchExists } = await execAsync(`git branch --list "${branchName}" 2>/dev/null || true`, {
+		const featureResult = await verifyConventionBranchMerged(ctx, featureBranchName);
+		if (featureResult?.success) return featureResult;
+		const strikeResult = await verifyConventionBranchMerged(ctx, strikeBranchName);
+		if (strikeResult?.success && !strikeResult.skipped) return stepOk(step, [...strikeResult.details ?? [], `Superseded ${featureBranchName} residual: ${featureResult?.error ?? "Feature branch is absent; positive merge evidence is required"}`]);
+		if (featureResult) return featureResult;
+		return stepFailed(step, BRANCH_ABSENT_MERGE_ERROR);
+	} catch (err) {
+		return stepFailed(step, `Could not verify merge: ${err.message}`);
+	}
+}
+async function verifyConventionBranchMerged(ctx, branchName) {
+	const step = "close-out:verify-merged";
+	const { stdout: branchExists } = await execAsync(`git branch --list "${branchName}" 2>/dev/null || true`, {
+		cwd: ctx.projectPath,
+		encoding: "utf-8"
+	});
+	if (branchExists.trim()) try {
+		await execAsync(`git merge-base --is-ancestor ${branchName} main`, {
 			cwd: ctx.projectPath,
 			encoding: "utf-8"
 		});
-		if (branchExists.trim()) try {
-			await execAsync(`git merge-base --is-ancestor ${branchName} main`, {
+		const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
+		if (remoteCheck && !remoteCheck.success) return remoteCheck;
+		return stepOk(step, ["All commits merged to main", ...remoteCheck?.details ?? []]);
+	} catch {
+		try {
+			const { stdout: codeDiff } = await execAsync(`git diff main...${branchName} -- ':!.planning' ':!docs/prds' ':!.overdeck/prompts' 2>/dev/null || true`, {
 				cwd: ctx.projectPath,
 				encoding: "utf-8"
 			});
-			const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
-			if (remoteCheck && !remoteCheck.success) return remoteCheck;
-			return stepOk(step, ["All commits merged to main", ...remoteCheck?.details ?? []]);
-		} catch {
-			try {
-				const { stdout: codeDiff } = await execAsync(`git diff main...${branchName} -- ':!.planning' ':!docs/prds' ':!.overdeck/prompts' 2>/dev/null || true`, {
-					cwd: ctx.projectPath,
-					encoding: "utf-8"
-				});
-				if (!codeDiff.trim()) {
-					const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
-					if (remoteCheck && !remoteCheck.success) return remoteCheck;
-					return stepOk(step, ["Code changes squash-merged to main (only planning artifacts remain on branch)", ...remoteCheck?.details ?? []]);
-				}
-			} catch {}
-			const githubMerged = await verifySquashMergedPrByBranch(ctx, branchName, branchName);
-			if (githubMerged?.success) {
+			if (!codeDiff.trim()) {
 				const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
 				if (remoteCheck && !remoteCheck.success) return remoteCheck;
-				return stepOk(step, [...githubMerged.details ?? [], ...remoteCheck?.details ?? []]);
+				return stepOk(step, ["Code changes squash-merged to main (only planning artifacts remain on branch)", ...remoteCheck?.details ?? []]);
 			}
-			if (githubMerged) return githubMerged;
-			const { stdout: unmerged } = await execAsync(`git log main..${branchName} --oneline 2>/dev/null || true`, {
-				cwd: ctx.projectPath,
-				encoding: "utf-8"
-			});
-			const count = unmerged.trim() ? unmerged.trim().split("\n").length : 0;
-			if (ctx.github) try {
-				const { stdout: issueState } = await execAsync(`gh issue view ${ctx.github.number} --repo ${ctx.github.owner}/${ctx.github.repo} --json state --jq '.state'`, {
-					cwd: ctx.projectPath,
-					encoding: "utf-8"
-				});
-				if (issueState.trim().toUpperCase() === "CLOSED") return stepSkipped(step, [`Issue already closed on GitHub; ${count} unmerged commit(s) remain on ${branchName}`]);
-			} catch {}
-			return stepFailed(step, `${count} unmerged commit(s) on ${branchName}. Merge before closing out.`);
+		} catch {}
+		const githubMerged = await verifySquashMergedPrByBranch(ctx, branchName, branchName);
+		if (githubMerged?.success) {
+			const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
+			if (remoteCheck && !remoteCheck.success) return remoteCheck;
+			return stepOk(step, [...githubMerged.details ?? [], ...remoteCheck?.details ?? []]);
 		}
-		const { stdout: remoteBranch } = await execAsync(`git ls-remote --heads origin "${branchName}" 2>/dev/null || true`, {
+		if (githubMerged) return githubMerged;
+		const { stdout: unmerged } = await execAsync(`git log main..${branchName} --oneline 2>/dev/null || true`, {
 			cwd: ctx.projectPath,
 			encoding: "utf-8"
 		});
-		if (remoteBranch.trim()) {
-			await execAsync(`git fetch origin ${branchName}`, { cwd: ctx.projectPath }).catch(() => {});
-			const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
-			if (remoteCheck) return remoteCheck;
-		}
-		return stepOk(step, ["Branch already cleaned up (squash-merged)"]);
-	} catch (err) {
-		return stepFailed(step, `Could not verify merge: ${err.message}`);
+		const count = unmerged.trim() ? unmerged.trim().split("\n").length : 0;
+		if (ctx.github) try {
+			const { stdout: issueState } = await execAsync(`gh issue view ${ctx.github.number} --repo ${ctx.github.owner}/${ctx.github.repo} --json state --jq '.state'`, {
+				cwd: ctx.projectPath,
+				encoding: "utf-8"
+			});
+			if (issueState.trim().toUpperCase() === "CLOSED") return stepSkipped(step, [`Issue already closed on GitHub; ${count} unmerged commit(s) remain on ${branchName}`]);
+		} catch {}
+		return stepFailed(step, `${count} unmerged commit(s) on ${branchName}. Merge before closing out.`);
+	}
+	const { stdout: remoteBranch } = await execAsync(`git ls-remote --heads origin "${branchName}" 2>/dev/null || true`, {
+		cwd: ctx.projectPath,
+		encoding: "utf-8"
+	});
+	if (remoteBranch.trim()) {
+		await execAsync(`git fetch origin ${branchName}`, { cwd: ctx.projectPath }).catch(() => {});
+		const remoteCheck = await verifyRemoteBranchIfPresent(ctx, branchName);
+		if (remoteCheck) return remoteCheck;
 	}
+	return null;
 }
 async function verifyRemoteBranchIfPresent(ctx, branchName) {
 	const step = "close-out:verify-merged";
@@ -783,7 +866,7 @@ async function resetIssueToTodoImpl(ctx) {
 */
 async function resetPostMergeStateForIssue(issueId) {
 	try {
-		const { resetPostMergeState } = await import("./merge-agent-BQM3a8z5.js");
+		const { resetPostMergeState } = await import("./merge-agent-DrXa1CpW.js");
 		resetPostMergeState(issueId);
 		resetPostMergeState(issueId.toUpperCase());
 	} catch {
@@ -799,7 +882,7 @@ function clearReviewStatusStep(issueId) {
 async function clearReviewStatusStepImpl(issueId) {
 	const step = "clear-review-status";
 	try {
-		const { clearReviewStatus } = await import("./review-status-C6n6-9f_.js");
+		const { clearReviewStatus } = await import("./review-status-BZH8h-6W.js");
 		clearReviewStatus(issueId.toUpperCase());
 		return stepOk(step, ["Review status cleared"]);
 	} catch {
@@ -866,4 +949,4 @@ async function resetIssueToCanceledImpl(ctx) {
 //#endregion
 export { deepWipe as a, closeOut as i, cancelIssueWorkflow as n, resetToTodo as o, close as r, verifyBranchMergedImpl as s, approve as t };
 
-//# sourceMappingURL=workflows-C9WmILql.js.map
+//# sourceMappingURL=workflows-D0oip4eV.js.map

package/server/{workspace-DuUdndHe.js → workspace-BqFg__wH.js}

@@ -1,3 +1,3 @@
-import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-BVl4rihN.js";
+import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-C0fH3aek.js";
 init_workspace();
 export { determineCavemanVariant, injectCavemanSettings, injectMemoryHookSettings };

package/server/{workspace-BVl4rihN.js → workspace-C0fH3aek.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ir as FsError, mr as init_errors } from "./config-yaml-DvyMuOle.js";
-import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-BZ5m1UCl.js";
+import { Fr as init_errors, Tr as FsError } from "./config-yaml-CmOPzmBb.js";
+import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-Bse1Pdcj.js";
 import { Effect } from "effect";
 import { existsSync } from "fs";
 import { join } from "path";
@@ -238,4 +238,4 @@ var init_workspace = __esmMin((() => {
 //#endregion
 export { readCavemanVariant as a, injectMemoryHookSettings as i, init_workspace as n, injectCavemanSettings as r, determineCavemanVariant as t };
 
-//# sourceMappingURL=workspace-BVl4rihN.js.map
+//# sourceMappingURL=workspace-C0fH3aek.js.map

package/server/workspace-anchor-drift-B4gMRHl4.js

@@ -0,0 +1,3 @@
+import { n as init_workspace_anchor_drift, t as evaluateWorkspaceAnchorDrift } from "./workspace-anchor-drift-CZKofakh.js";
+init_workspace_anchor_drift();
+export { evaluateWorkspaceAnchorDrift };

package/server/workspace-anchor-drift-CZKofakh.js

@@ -0,0 +1,224 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { _n as isStatePlanePath, hn as init_state_plane, pn as STATE_PLANE_PATHS } from "./config-yaml-CmOPzmBb.js";
+import { a as init_git_utils, o as parseCompositeSnapshot, u as snapshotWorkspaceHeadsPromise } from "./git-utils-ameCgDdy.js";
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
+//#region ../../lib/pipeline-state-paths.ts
+function isPipelineStatePath(relativePath) {
+	return isStatePlanePath(relativePath);
+}
+async function getEffectiveCodeCommit(workspacePath, headCommit = "HEAD") {
+	let current = (await gitStdout(workspacePath, ["rev-parse", headCommit])).trim();
+	const seen = /* @__PURE__ */ new Set();
+	while (current && !seen.has(current)) {
+		seen.add(current);
+		let parent;
+		try {
+			parent = (await gitStdout(workspacePath, ["rev-parse", `${current}^`])).trim();
+		} catch {
+			return current;
+		}
+		const changedPaths = await changedPathsBetween(workspacePath, parent, current);
+		if (changedPaths.length > 0 && changedPaths.every(isPipelineStatePath)) {
+			current = parent;
+			continue;
+		}
+		return current;
+	}
+	return current;
+}
+async function haveSameEffectiveCodeCommit(workspacePath, leftCommit, rightCommit) {
+	const [leftEffective, rightEffective] = await Promise.all([getEffectiveCodeCommit(workspacePath, leftCommit), getEffectiveCodeCommit(workspacePath, rightCommit)]);
+	return leftEffective === rightEffective;
+}
+/**
+* True when `leftCommit` and `rightCommit` introduce the same non-state-plane
+* contribution relative to their own merge-base with `baseRef`.
+*
+* A rebase onto a newer base rewrites every commit SHA on the branch, so the
+* SHA-based `haveSameEffectiveCodeCommit` reports a change even though the patch
+* the branch applies is byte-for-byte identical. Comparing the merge-base-
+* relative diff by git patch-id — content, not SHA — recognises such a rebase as
+* benign, so a passed review is not needlessly invalidated (PAN-2468). Returns
+* false if either contribution cannot be computed.
+*/
+async function haveSameCodeContribution(workspacePath, leftCommit, rightCommit, baseRef = "origin/main") {
+	const [left, right] = await Promise.all([codeContributionPatchId(workspacePath, leftCommit, baseRef), codeContributionPatchId(workspacePath, rightCommit, baseRef)]);
+	return left !== null && right !== null && left === right;
+}
+/**
+* git patch-id of the non-state-plane diff `commit` introduces relative to its
+* merge-base with `baseRef`. Returns a stable sentinel when the contribution has
+* no code changes, or null when it cannot be computed (missing base, git error).
+*/
+async function codeContributionPatchId(workspacePath, commit, baseRef) {
+	let base;
+	try {
+		base = (await gitStdout(workspacePath, [
+			"merge-base",
+			baseRef,
+			commit
+		])).trim();
+	} catch {
+		return null;
+	}
+	if (!base) return null;
+	let diff;
+	try {
+		diff = await gitStdout(workspacePath, [
+			"diff",
+			`${base}..${commit}`,
+			"--",
+			".",
+			...STATE_PLANE_DIFF_EXCLUDES
+		]);
+	} catch {
+		return null;
+	}
+	if (!diff.trim()) return "no-code-contribution";
+	return patchIdOfDiff(workspacePath, diff);
+}
+/** Reduce a unified diff to a stable git patch-id (content hash of the patch). */
+function patchIdOfDiff(workspacePath, diff) {
+	return new Promise((resolve) => {
+		const child = spawn("git", ["patch-id", "--stable"], { cwd: workspacePath });
+		let out = "";
+		child.stdout.on("data", (chunk) => out += chunk);
+		child.on("error", () => resolve(null));
+		child.on("close", () => {
+			resolve((out.trim().split(/\s+/)[0] ?? "") || null);
+		});
+		child.stdin.on("error", () => resolve(null));
+		child.stdin.end(diff);
+	});
+}
+async function changedPathsBetween(workspacePath, baseCommit, headCommit) {
+	return (await gitStdout(workspacePath, [
+		"diff",
+		"--name-only",
+		baseCommit,
+		headCommit
+	])).split("\n").map((line) => line.trim()).filter(Boolean);
+}
+async function gitStdout(workspacePath, args) {
+	const result = await execFileAsync$1("git", args, {
+		cwd: workspacePath,
+		encoding: "utf-8",
+		maxBuffer: 64 * 1024 * 1024
+	});
+	if (typeof result === "string") return result;
+	return String(result.stdout ?? "");
+}
+var execFileAsync$1, STATE_PLANE_DIFF_EXCLUDES;
+var init_pipeline_state_paths = __esmMin((() => {
+	init_state_plane();
+	execFileAsync$1 = promisify(execFile);
+	STATE_PLANE_DIFF_EXCLUDES = STATE_PLANE_PATHS.map((path) => `:(exclude)${path.replace(/\/$/, "")}`);
+}));
+//#endregion
+//#region ../../lib/workspace-anchor-drift.ts
+async function haveSameTree(repoPath, leftCommit, rightCommit) {
+	const [left, right] = await Promise.all([execFileAsync("git", ["rev-parse", `${leftCommit}^{tree}`], {
+		cwd: repoPath,
+		encoding: "utf-8"
+	}), execFileAsync("git", ["rev-parse", `${rightCommit}^{tree}`], {
+		cwd: repoPath,
+		encoding: "utf-8"
+	})]);
+	return left.stdout.trim() === right.stdout.trim();
+}
+async function isBenignMove(repoPath, leftCommit, rightCommit, baseRef, checks) {
+	try {
+		if (await checks.sameTree(repoPath, leftCommit, rightCommit)) return true;
+	} catch {}
+	try {
+		if (await checks.sameEffectiveCode(repoPath, leftCommit, rightCommit)) return true;
+	} catch {}
+	try {
+		return await checks.sameCodeContribution(repoPath, leftCommit, rightCommit, baseRef);
+	} catch {
+		return false;
+	}
+}
+/** Compare a persisted workspace anchor with a fresh producer-issued snapshot. */
+async function evaluateWorkspaceAnchorDrift(issueId, workspacePath, storedAnchor, checks = DEFAULT_CHECKS) {
+	const currentAnchor = await snapshotWorkspaceHeadsPromise(issueId, workspacePath);
+	if (!currentAnchor) return { kind: "unreadable" };
+	if (storedAnchor === currentAnchor) return {
+		kind: "current",
+		currentAnchor
+	};
+	const storedHeads = parseCompositeSnapshot(storedAnchor);
+	const currentHeads = parseCompositeSnapshot(currentAnchor);
+	const storedIsComposite = storedHeads.size > 0;
+	if (storedIsComposite !== currentHeads.size > 0) return {
+		kind: "drifted",
+		currentAnchor
+	};
+	try {
+		const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-CRE6Ykow.js");
+		const roots = resolveWorkspaceRepoRootsSync(issueId, workspacePath);
+		if (!storedIsComposite) {
+			const root = roots[0];
+			if (!root) return {
+				kind: "drifted",
+				currentAnchor
+			};
+			return await isBenignMove(root.dir, storedAnchor, currentAnchor, `origin/${root.targetBranch}`, checks) ? {
+				kind: "benign",
+				currentAnchor
+			} : {
+				kind: "drifted",
+				currentAnchor
+			};
+		}
+		const allRepoKeys = new Set([...storedHeads.keys(), ...currentHeads.keys()]);
+		if (storedHeads.size !== currentHeads.size || [...allRepoKeys].some((repoKey) => !storedHeads.has(repoKey) || !currentHeads.has(repoKey))) return {
+			kind: "drifted",
+			currentAnchor,
+			changedRepos: [...allRepoKeys].sort()
+		};
+		const changedRepos = [...allRepoKeys].filter((repoKey) => storedHeads.get(repoKey) !== currentHeads.get(repoKey)).sort();
+		const rootsByKey = new Map(roots.map((root) => [root.repoKey, root]));
+		for (const repoKey of changedRepos) {
+			const root = rootsByKey.get(repoKey);
+			const storedHead = storedHeads.get(repoKey);
+			const currentHead = currentHeads.get(repoKey);
+			if (!root || !storedHead || !currentHead) return {
+				kind: "drifted",
+				currentAnchor,
+				changedRepos
+			};
+			if (!await isBenignMove(root.dir, storedHead, currentHead, `origin/${root.targetBranch}`, checks)) return {
+				kind: "drifted",
+				currentAnchor,
+				changedRepos
+			};
+		}
+		return {
+			kind: "benign",
+			currentAnchor,
+			changedRepos
+		};
+	} catch {
+		return {
+			kind: "drifted",
+			currentAnchor
+		};
+	}
+}
+var execFileAsync, DEFAULT_CHECKS;
+var init_workspace_anchor_drift = __esmMin((() => {
+	init_git_utils();
+	init_pipeline_state_paths();
+	execFileAsync = promisify(execFile);
+	DEFAULT_CHECKS = {
+		sameTree: haveSameTree,
+		sameEffectiveCode: haveSameEffectiveCodeCommit,
+		sameCodeContribution: haveSameCodeContribution
+	};
+}));
+//#endregion
+export { init_workspace_anchor_drift as n, evaluateWorkspaceAnchorDrift as t };
+
+//# sourceMappingURL=workspace-anchor-drift-CZKofakh.js.map