@runfusion/fusion 0.77.0-beta.5 → 0.77.0-beta.6

package/dist/bin.js

@@ -269,10 +269,16 @@ function resolveEntryPointBranchAssignment(input) {
       };
   }
 }
-var isValidTaskBranchName;
+var BranchWriteProvenanceError, isValidTaskBranchName;
 var init_branch_assignment = __esm({
   "../core/src/branch/branch-assignment.ts"() {
     "use strict";
+    BranchWriteProvenanceError = class extends Error {
+      constructor() {
+        super("branchWriteOrigin is required when branch is provided");
+        this.name = "BranchWriteProvenanceError";
+      }
+    };
     isValidTaskBranchName = isValidBranchGroupBranchName;
   }
 });
@@ -4650,8 +4656,8 @@ var init_research_settings = __esm({
 function resolveResearchFindingId(finding) {
   const explicitId = typeof finding.id === "string" ? finding.id.trim() : "";
   if (explicitId) return explicitId;
-  const normalize11 = (value2) => value2.trim().replace(/\s+/g, " ").toLowerCase();
-  const canonical = [normalize11(finding.heading ?? ""), normalize11(finding.content ?? ""), ...[...finding.sources ?? []].map(normalize11).filter(Boolean).sort()].join("\n");
+  const normalize12 = (value2) => value2.trim().replace(/\s+/g, " ").toLowerCase();
+  const canonical = [normalize12(finding.heading ?? ""), normalize12(finding.content ?? ""), ...[...finding.sources ?? []].map(normalize12).filter(Boolean).sort()].join("\n");
   let hash3 = 2166136261;
   for (let index3 = 0; index3 < canonical.length; index3 += 1) {
     hash3 ^= canonical.charCodeAt(index3);
@@ -36105,17 +36111,17 @@ var init_agent_store = __esm({
        * @returns Matching agent when unambiguous; otherwise null
        */
       async resolveAgent(shortname) {
-        const normalize11 = (value2) => value2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+        const normalize12 = (value2) => value2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
         const all = await this.listAgents();
         const exact = all.find((agent) => agent.id === shortname);
         if (exact) {
           return exact;
         }
-        const normalizedTarget = normalize11(shortname);
+        const normalizedTarget = normalize12(shortname);
         if (!normalizedTarget) {
           return null;
         }
-        const matches = all.filter((agent) => normalize11(agent.name) === normalizedTarget);
+        const matches = all.filter((agent) => normalize12(agent.name) === normalizedTarget);
         return matches.length === 1 ? matches[0] : null;
       }
       // ─────────────────────────────────────────────────────────────────────────
@@ -45357,11 +45363,11 @@ function withWindowsNativeBinPath(environment, nativeRoot, platform6 = process.p
   if (platform6 !== "win32") return environment;
   const pathKey = Object.keys(environment).find((key) => key.toLowerCase() === "path") ?? "PATH";
   const bin = nativeRoot.replace(/[\\/]+$/, "") + "\\bin";
-  const normalize11 = (value2) => value2.replace(/\//g, "\\").toLowerCase();
+  const normalize12 = (value2) => value2.replace(/\//g, "\\").toLowerCase();
   const inherited = environment[pathKey] ?? "";
   const segments = inherited.split(";").filter(Boolean);
-  const normalizedBin = normalize11(bin);
-  const deduplicated = segments.filter((segment) => normalize11(segment) !== normalizedBin);
+  const normalizedBin = normalize12(bin);
+  const deduplicated = segments.filter((segment) => normalize12(segment) !== normalizedBin);
   return { ...environment, [pathKey]: [bin, ...deduplicated].join(";") };
 }
 function readPostgresPid(dataDir) {
@@ -67310,14 +67316,14 @@ function resolveGlobalDir(dir2) {
       const isFusionDirInsideRepo = basename8(dir2) === ".fusion" && existsSync15(join19(dirname12(dir2), ".git"));
       if (isFusionDirInsideRepo) {
         const homeGlobalDir = resolveGlobalDirForHome(getHomeDir2());
-        const normalize11 = (p2) => {
+        const normalize12 = (p2) => {
           try {
             return realpathSync3.native(p2);
           } catch {
             return resolve14(p2);
           }
         };
-        if (normalize11(dir2) !== normalize11(homeGlobalDir)) {
+        if (normalize12(dir2) !== normalize12(homeGlobalDir)) {
           throw new Error(
             `resolveGlobalDir(): refusing project-local '.fusion' directory '${dir2}' for the central/global store. This would create a stray per-project central database seeded with default global settings and silently reset them. Pass the resolved global dir (or omit the argument so it defaults to ~/.fusion); see TaskStore.getGlobalSettingsDir(). If this really is your intended global dir (e.g. a version-controlled dotfiles repo), set FUSION_ALLOW_PROJECT_LOCAL_GLOBAL_DIR=true to override.`
           );
@@ -88044,15 +88050,15 @@ async function appendRecall(layer, input) {
 async function mergeRecallGraphNodeIds(layer, recordId, addGraphNodeIds) {
   const pid = projectId(layer);
   const table = project_exports.memoryRecallRecords;
-  const normalize11 = (ids) => [...new Set(ids.map((id) => id.trim()).filter(Boolean))].sort();
+  const normalize12 = (ids) => [...new Set(ids.map((id) => id.trim()).filter(Boolean))].sort();
   return layer.transactionImmediate(async (tx) => {
     await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${recallGraphNodeIdsLockKey(pid, recordId)}))`);
     const rows = await tx.select().from(table).where(and(eq(table.projectId, pid), eq(table.id, recordId))).limit(1);
     await recallGraphNodeIdsTestHooks?.afterRowRead?.();
     const row = rows[0];
     if (!row) return { status: "missing" };
-    const stored = normalize11(row.graphNodeIds);
-    const next = normalize11([...stored, ...addGraphNodeIds]);
+    const stored = normalize12(row.graphNodeIds);
+    const next = normalize12([...stored, ...addGraphNodeIds]);
     if (stored.length === next.length && stored.every((value2, index3) => value2 === next[index3])) return { status: "unchanged" };
     await tx.update(table).set({ graphNodeIds: next, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq(table.projectId, pid), eq(table.id, recordId)));
     return { status: "updated" };
@@ -92455,7 +92461,7 @@ import { randomUUID as randomUUID31 } from "node:crypto";
 function normalizeCreateBranchProvenance(input) {
   if (input.branch === void 0) return input;
   if (input.branchWriteOrigin !== "operator" && input.branchWriteOrigin !== "engine") {
-    throw new Error("branchWriteOrigin is required when branch is provided");
+    throw new BranchWriteProvenanceError();
   }
   validateTaskBranchName(input.branch);
   if (input.branchWriteOrigin === "operator") {
@@ -94672,7 +94678,7 @@ async function updateTaskRepositoryScopeImpl(store, id, requestedScope) {
         ...replacement,
         repositories: nextRepositories,
         revision: Math.max((current.repositoryScope?.revision ?? 0) + 1, replacement.revision ?? 0),
-        ...scopeChanged ? { reviewEvidence: void 0 } : {}
+        ...scopeChanged ? { reviewEvidence: void 0, reviewRemediation: void 0 } : {}
       };
       const [updatedRow] = await tx.update(project_exports.tasks).set({
         repositoryScope: normalized2 ?? null,
@@ -94688,6 +94694,35 @@ async function updateTaskRepositoryScopeImpl(store, id, requestedScope) {
     return outcome;
   }));
 }
+async function updateWorkspaceReviewStateImpl(store, id, expectedScopeRevision, reviewRemediation) {
+  return store.withTaskLock(id, async () => {
+    const layer = store.asyncLayer;
+    const outcome = await layer.transactionImmediate(async (tx) => {
+      await acquireTaskAdvisoryXactLock(tx, layer.projectId, id);
+      const row = await readTaskRowInTransaction(tx, id, { includeDeleted: true }, layer.projectId);
+      if (!row) throw new TaskNotFoundError(id);
+      if (row.deletedAt) throw new TaskDeletedError(id, row.deletedAt);
+      const current = store.rowToTask(store.pgRowToTaskRow(row));
+      if (current.repositoryScope?.revision !== expectedScopeRevision) return { task: current, updated: false };
+      const repositoryScope = {
+        ...current.repositoryScope,
+        ...reviewRemediation ? { reviewRemediation } : { reviewRemediation: void 0 }
+      };
+      const [updatedRow] = await tx.update(project_exports.tasks).set({
+        repositoryScope,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }).where(and(eq(project_exports.tasks.id, id), taskProjectScope(layer))).returning();
+      if (!updatedRow) throw new TaskNotFoundError(id);
+      return { task: store.rowToTask(store.pgRowToTaskRow(updatedRow)), updated: true };
+    });
+    if (outcome.updated) {
+      await store.writeTaskJsonFile(store.taskDir(id), outcome.task);
+      if (store.isWatching) store.taskCache.set(id, { ...outcome.task });
+      store.emitTaskLifecycleEventSafely("task:updated", [outcome.task]);
+    }
+    return outcome;
+  });
+}
 async function resolveTaskWedgeNotificationEpisodeImpl(store, id, episodeId) {
   const layer = store.asyncLayer;
   const row = await resolveActiveTaskWedgeEpisodeRow(layer, id, episodeId, (/* @__PURE__ */ new Date()).toISOString());
@@ -103491,7 +103526,7 @@ async function updateTaskUnlockedImpl(store, id, updates, runContext) {
   if (updates.recommendations !== void 0) assertValidRecommendations(updates.recommendations);
   if (updates.branch !== void 0) {
     if (updates.branchWriteOrigin !== "operator" && updates.branchWriteOrigin !== "engine") {
-      throw new Error("branchWriteOrigin is required when branch is provided");
+      throw new BranchWriteProvenanceError();
     }
     if (updates.branch !== null) validateTaskBranchName(updates.branch);
   }
@@ -103580,7 +103615,7 @@ async function updateTaskUnlockedImpl(store, id, updates, runContext) {
       task.repositoryScope = void 0;
     } else if (updates.repositoryScope !== void 0) {
       const scopeRevisionChanged = task.repositoryScope?.revision !== updates.repositoryScope.revision;
-      task.repositoryScope = scopeRevisionChanged ? { ...updates.repositoryScope, reviewEvidence: void 0 } : updates.repositoryScope;
+      task.repositoryScope = scopeRevisionChanged ? { ...updates.repositoryScope, reviewEvidence: void 0, reviewRemediation: void 0 } : updates.repositoryScope;
       if (scopeRevisionChanged) {
         task.workflowStepResults = invalidateSupersededRepositoryScopeReviews(
           task.workflowStepResults,
@@ -106080,6 +106115,9 @@ var init_store = __esm({
       async mutateTaskRepositoryScope(id, mutation) {
         return updateTaskRepositoryScopeImpl(this, id, mutation);
       }
+      async updateWorkspaceReviewState(id, expectedScopeRevision, reviewRemediation) {
+        return updateWorkspaceReviewStateImpl(this, id, expectedScopeRevision, reviewRemediation);
+      }
       async resolveTaskWedgeNotificationEpisode(id, episodeId) {
         return resolveTaskWedgeNotificationEpisodeImpl(this, id, episodeId);
       }
@@ -136087,6 +136125,7 @@ __export(src_exports, {
   BUNDLED_PLUGIN_IDS: () => BUNDLED_PLUGIN_IDS,
   BackupManager: () => BackupManager,
   BackwardCompat: () => BackwardCompat,
+  BranchWriteProvenanceError: () => BranchWriteProvenanceError,
   CENTRAL_BACKUP_SCHEMAS: () => CENTRAL_BACKUP_SCHEMAS,
   CLAUDE_SONNET_5_MODEL_ID: () => CLAUDE_SONNET_5_MODEL_ID,
   CLEAN_COMPLETION_MARKERS: () => CLEAN_COMPLETION_MARKERS,
@@ -158737,8 +158776,8 @@ var require_resolve = __commonJS({
       }
       return count2;
     }
-    function getFullPath(resolver, id = "", normalize11) {
-      if (normalize11 !== false)
+    function getFullPath(resolver, id = "", normalize12) {
+      if (normalize12 !== false)
         id = normalizeId2(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -160078,7 +160117,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize11(uri, options) {
+    function normalize12(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         serialize(parse4(uri, options), options);
@@ -160314,7 +160353,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize11,
+      normalize: normalize12,
       resolve: resolve114,
       resolveComponent,
       equal,
@@ -175735,6 +175774,39 @@ var init_worktrunk_failure_handler = __esm({
   }
 });
 
+// ../engine/src/executor/workspace-review-remediation.ts
+function normalize8(value2) {
+  return (value2 ?? "").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function resolveWorkspaceReviewRemediationRepository(task, declaredRepositories) {
+  const scope = task.repositoryScope;
+  const remediation2 = scope?.reviewRemediation;
+  if (!remediation2) return void 0;
+  if (scope?.state !== "confirmed" || scope.revision !== remediation2.scopeRevision) {
+    throw new Error(`Workspace Code Review remediation target is stale for ${task.id}`);
+  }
+  if (!declaredRepositories.includes(remediation2.repository)) {
+    throw new Error(`Workspace Code Review remediation repository ${remediation2.repository} is not declared for ${task.id}`);
+  }
+  return remediation2.repository;
+}
+function deriveWorkspaceReviewRemediation(result2) {
+  if (typeof result2.repositoryScopeRevision !== "number") return void 0;
+  const blocking = (result2.repositoryReviewOutcomes ?? []).filter((outcome) => outcome.status === "REVIEWED" && (outcome.verdict === "REVISE" || outcome.verdict === "RETHINK")).sort((left, right) => left.repository.localeCompare(right.repository))[0];
+  if (!blocking) return void 0;
+  const findings = (blocking.findings ?? []).map((finding) => `${finding.id}:${normalize8(finding.title)}:${normalize8(finding.body)}`).sort().join("|");
+  return {
+    scopeRevision: result2.repositoryScopeRevision,
+    repository: blocking.repository,
+    inputSignature: `${result2.workflowStepId}\0${blocking.repository}\0${blocking.fingerprint ?? ""}\0${blocking.verdict}\0${findings}`
+  };
+}
+var init_workspace_review_remediation = __esm({
+  "../engine/src/executor/workspace-review-remediation.ts"() {
+    "use strict";
+  }
+});
+
 // ../engine/src/worktree/worktree-copy-files.ts
 import { constants as fsConstants3 } from "node:fs";
 import { access as access7, copyFile as copyFile2, lstat as lstat2, mkdir as mkdir26 } from "node:fs/promises";
@@ -176121,14 +176193,15 @@ function invalidateWorkspaceConfigCache(owner) {
   workspaceConfigEpochs.set(owner, (workspaceConfigEpochs.get(owner) ?? 0) + 1);
 }
 async function normalizeWorkspaceTaskRouting(store, taskId) {
-  const normalize11 = store.normalizeWorkspaceTaskWorktreeMetadata;
-  if (typeof normalize11 === "function") return normalize11.call(store, taskId);
+  const normalize12 = store.normalizeWorkspaceTaskWorktreeMetadata;
+  if (typeof normalize12 === "function") return normalize12.call(store, taskId);
   let task = await store.getTask(taskId);
   if (task.worktree || task.branch || task.executionStartBranch || task.baseCommitSha) {
     if (typeof store.updateTask !== "function") return task;
     await store.updateTask(taskId, {
       worktree: null,
       branch: null,
+      branchWriteOrigin: "engine",
       executionStartBranch: null,
       baseCommitSha: null,
       sessionFile: null
@@ -176330,11 +176403,15 @@ async function ensureWorkspaceGroupOwnership(workspaceContext, settings) {
 async function acquireTaskWorktree(opts) {
   const { task, rootDir, store, settings, pool, logger: logger3, audit, runContext, createWorktree: createWorktree2, runConfiguredCommand: runConfiguredCommand2, runInitCommand, taskEnv, secretsStore, workspaceContext } = opts;
   const persistWorktreeAssignment = async (patch) => {
+    const provenancePatch = patch.branch === void 0 ? patch : {
+      ...patch,
+      branchWriteOrigin: patch.branchWriteOrigin ?? (classifyTaskBranchOrigin(task, patch.branch ?? void 0) === "operator-supplied" ? "operator" : "engine")
+    };
     if (!opts.suppressSingularWorktreePersist) {
-      await store.updateTask(task.id, patch);
+      await store.updateTask(task.id, provenancePatch);
       return;
     }
-    const { worktree: _worktree, branch: _branch, ...nonSingularPatch } = patch;
+    const { worktree: _worktree, branch: _branch, branchWriteOrigin: _origin, ...nonSingularPatch } = provenancePatch;
     if (Object.keys(nonSingularPatch).length > 0) {
       await store.updateTask(task.id, nonSingularPatch);
     }
@@ -176571,7 +176648,22 @@ async function acquireTaskWorktree(opts) {
     }
     worktreePath = created2.path;
     branch = created2.branch;
-    await persistWorktreeAssignment({ worktree: created2.path, branch: created2.branch });
+    try {
+      await persistWorktreeAssignment({ worktree: created2.path, branch: created2.branch });
+    } catch (error3) {
+      try {
+        await removeWorktree({
+          worktreePath: created2.path,
+          rootDir,
+          settings,
+          taskId: task.id,
+          reason: RemovalReason.ExecutorDispose
+        });
+      } catch (cleanupError) {
+        logger3?.warn(`${task.id}: failed to compensate unpersisted worktree ${created2.path}: ${formatError(cleanupError)}`);
+      }
+      throw error3;
+    }
     await audit?.git({ type: "worktree:create", target: created2.path, metadata: { branch: created2.branch, source: logOrigin === "return-guard" ? "acquire-return-guard" : void 0 } });
     await audit?.git({ type: "branch:create", target: created2.branch });
     if (created2.branch !== branchName) {
@@ -176813,6 +176905,17 @@ async function acquireTaskWorktree(opts) {
   if (pinned) {
     return acquirePinnedWorktree();
   }
+  if (!workspaceContext && !task.worktree && !(pool && settings.recycleWorktrees)) {
+    const registeredMatches = (await getRegisteredWorktreeBranches(rootDir)).filter((entry) => entry.branch === branchName);
+    if (registeredMatches.length === 1) {
+      const registeredPath = registeredMatches[0].worktreePath;
+      const classification = await classifyTaskWorktree(rootDir, registeredPath);
+      if (classification.ok) {
+        await persistWorktreeAssignment({ worktree: registeredPath, branch: branchName });
+        return reuseWarmWorktree(registeredPath, branchName, "existing");
+      }
+    }
+  }
   if (task.worktree && isResume) {
     if (logger3?.debug) logger3.debug(`Reusing existing worktree: ${worktreePath}`);
     const cleanup = await removeDesktopBuildArtifacts(worktreePath, logger3);
@@ -176848,6 +176951,7 @@ async function acquireTaskWorktree(opts) {
       }
     }
     if (pooled) {
+      let poolAssignmentPersistenceStarted = false;
       try {
         const preparedRaw = await pool.prepareForTask(pooled, branchName, freshStartPoint, {
           allowSiblingBranchRename,
@@ -176905,7 +177009,9 @@ async function acquireTaskWorktree(opts) {
           });
           acquiredFromPool = true;
           logger3?.log(`Acquired worktree from pool: ${worktreePath}`);
+          poolAssignmentPersistenceStarted = true;
           await persistWorktreeAssignment({ worktree: worktreePath, branch });
+          poolAssignmentPersistenceStarted = false;
           await audit?.git({ type: "worktree:reuse", target: worktreePath, metadata: { branch, reclaimed: prepared.reclaimed } });
           if (prepared.reclaimed) {
             await store.logEntry(task.id, `Acquired reclaimed worktree from pool: ${worktreePath} (${prepared.strandedCommitCount ?? 0} commits preserved)`, void 0, runContext);
@@ -176959,6 +177065,10 @@ async function acquireTaskWorktree(opts) {
           });
         }
       } catch (poolErr) {
+        if (poolAssignmentPersistenceStarted) {
+          pool.release(pooled, task.id);
+          throw poolErr;
+        }
         if (poolErr instanceof WorktreeBaseRefreshError) {
           await persistWorktreeAssignment({ worktree: null, branch: null, branchWriteOrigin: "engine", sessionFile: null });
           pool.release(pooled, task.id);
@@ -177270,7 +177380,11 @@ async function acquireWorkspaceTaskWorktrees(opts) {
     current = await opts.store.getTask(opts.task.id);
   }
   const entries2 = current.workspaceWorktrees ?? {};
-  const coordinatorWorktreePath = repoRelPaths.map((repoRelPath) => entries2[repoRelPath]?.worktreePath).find((path17) => typeof path17 === "string" && path17.length > 0);
+  const remediationRepository = resolveWorkspaceReviewRemediationRepository(current, repoRelPaths);
+  if (opts.remediationRepository !== remediationRepository) {
+    throw new Error(`Workspace Code Review remediation target changed during acquisition for ${opts.task.id}`);
+  }
+  const coordinatorWorktreePath = remediationRepository ? entries2[remediationRepository]?.worktreePath : repoRelPaths.map((repoRelPath) => entries2[repoRelPath]?.worktreePath).find((path17) => typeof path17 === "string" && path17.length > 0);
   if (!coordinatorWorktreePath) {
     throw new Error(`Workspace task ${opts.task.id} did not acquire a declared repository worktree`);
   }
@@ -177291,6 +177405,7 @@ var init_worktree_acquisition = __esm({
     init_worktree_backend();
     init_worktrunk_installer();
     init_worktrunk_failure_handler();
+    init_workspace_review_remediation();
     init_secrets_env_writer();
     init_worktree_desktop_artifacts();
     init_worktree_hooks();
@@ -192124,7 +192239,7 @@ var init_agent_memory_index = __esm({
 // ../engine/src/agents/agent-instructions.ts
 import { readFile as readFile42, writeFile as writeFile28, mkdir as mkdir29, access as access9 } from "node:fs/promises";
 import { constants as fsConstants4 } from "node:fs";
-import { isAbsolute as isAbsolute16, resolve as resolve41, relative as relative15, normalize as normalize8, sep as sep12, dirname as dirname32 } from "node:path";
+import { isAbsolute as isAbsolute16, resolve as resolve41, relative as relative15, normalize as normalize9, sep as sep12, dirname as dirname32 } from "node:path";
 function trimAndClamp(value2, maxLength, label, agentId) {
   const trimmed = value2.trim();
   if (!trimmed) {
@@ -192158,7 +192273,7 @@ function resolveValidatedMarkdownPath(rawPath, rootDir, agentId, fieldLabel) {
     log26.warn(`${fieldLabel} must be project-relative for agent ${agentId}: ${trimmed}`);
     return null;
   }
-  const normalized2 = normalize8(trimmed);
+  const normalized2 = normalize9(trimmed);
   if (isPathTraversal2(normalized2)) {
     log26.warn(`${fieldLabel} traversal is not allowed for agent ${agentId}: ${trimmed}`);
     return null;
@@ -200921,8 +201036,8 @@ async function autoRecoverWorktreeSessionStartFailure(store, task, opts) {
   }
   const workspaceTask = configuredWorkspace || isWorkspaceTask(task);
   if (workspaceTask) {
-    const normalize11 = store.normalizeWorkspaceTaskWorktreeMetadata;
-    if (typeof normalize11 === "function") task = await normalize11.call(store, task.id);
+    const normalize12 = store.normalizeWorkspaceTaskWorktreeMetadata;
+    if (typeof normalize12 === "function") task = await normalize12.call(store, task.id);
   }
   const resetRetryBudget = opts.resetRetryBudgetOnStaleMetadataClear === true;
   const staleMetadataClearRecoveryRetryCount = opts.staleMetadataClearRecoveryRetryCount;
@@ -200977,7 +201092,13 @@ async function autoRecoverWorktreeSessionStartFailure(store, task, opts) {
     worktreeSessionRetryCount: nextCount,
     ...nextStaleMetadataClearRecoveryCount === void 0 ? {} : { recoveryRetryCount: nextStaleMetadataClearRecoveryCount },
     worktree: clearWorktreeMetadata ? null : staleWorktree,
-    branch: nextBranch,
+    /*
+     * FNXC:BranchNaming 2026-08-21-09:36:
+     * Session recovery often changes only worktree/session metadata. Do not reassert an unchanged
+     * branch with engine provenance: that would erase a matching operator override and later make
+     * its branch eligible for engine cleanup. A real canonical clear remains an explicit engine write.
+     */
+    ...(task.branch ?? null) === nextBranch ? {} : { branch: nextBranch, branchWriteOrigin: "engine" },
     sessionFile: null
   });
   await opts.auditor?.database({
@@ -210706,7 +210827,8 @@ async function tryEarlyEmptyOwnDiffFinalize(input) {
     try {
       await store.updateTask(taskId, {
         worktree: worktreeRemoved ? null : task.worktree,
-        branch: branchDeleted ? null : task.branch
+        branch: branchDeleted ? null : task.branch,
+        ...branchDeleted ? { branchWriteOrigin: "engine" } : {}
       });
       if (worktreeRemoved) task.worktree = void 0;
       if (branchDeleted) task.branch = void 0;
@@ -211066,7 +211188,7 @@ async function aiMergeTask(store, rootDir, taskId, options = {}) {
             rootDir,
             integrationBranch: mergeTarget.branch
           });
-          await store.updateTask(taskId, { worktree: reusableMatch.path, branch: reusableMatch.branch });
+          await store.updateTask(taskId, { worktree: reusableMatch.path, branch: reusableMatch.branch, branchWriteOrigin: "engine" });
           await emitReuseHandoffAuditEvent(
             "merge:reuse-fallback-reused-existing-registration",
             {
@@ -218626,7 +218748,7 @@ var init_self_healing = __esm({
                 } catch {
                 }
               }
-              const patch = preservedWorktree ? { branch: selected.branch } : { branch: selected.branch, worktree: null };
+              const patch = preservedWorktree ? { branch: selected.branch, branchWriteOrigin: "engine" } : { branch: selected.branch, branchWriteOrigin: "engine", worktree: null };
               if (!task.baseCommitSha) {
                 const derivedBaseCommit = (await execAsync18(
                   `git merge-base ${shellQuote2(integrationBase)} ${shellQuote2(selected.branch)}`,
@@ -222303,6 +222425,12 @@ var init_self_healing = __esm({
                 await this.emitWorkspacePartialLandNoAction(task, "merge-pending", liveness.livePaths);
                 continue;
               }
+              const latestTask = await this.store.getTask(task.id).catch(() => null);
+              const blockerTask = latestTask?.status === "failed" && latestTask.error?.startsWith("Workspace partial land:") ? { ...latestTask, status: null, error: void 0 } : latestTask;
+              if (!blockerTask || getTaskMergeBlocker(blockerTask, { skipColumnIdentityCheck: true }) !== void 0) {
+                await this.emitWorkspacePartialLandNoAction(task, "merge-blocked", []);
+                continue;
+              }
               const workspaceWorktrees = task.workspaceWorktrees ?? {};
               const explicitScope = task.repositoryScope?.state === "confirmed" ? task.repositoryScope.repositories : void 0;
               if (!explicitScope) {
@@ -222310,8 +222438,12 @@ var init_self_healing = __esm({
                 continue;
               }
               const repoKeys = Object.keys(workspaceWorktrees).filter(
-                (repoRel) => explicitScope.includes(repoRel) && (task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`))
+                (repoRel) => explicitScope.includes(repoRel) && ((task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`)) || Boolean(workspaceWorktrees[repoRel]?.landedSha))
               );
+              if (repoKeys.length === 0) {
+                await this.emitWorkspacePartialLandNoAction(task, "empty-obligations", []);
+                continue;
+              }
               const landedRepos = [];
               const unlandedRepos = [];
               const unrecoverableRepos = [];
@@ -222368,13 +222500,12 @@ var init_self_healing = __esm({
                 phase: "reconcile-workspace-partial-land"
               });
               if (evidenceUnavailableRepos.length > 0) {
-                const defers = (this.workspacePartialLandEvidenceDefers.get(task.id) ?? 0) + 1;
-                this.workspacePartialLandEvidenceDefers.set(task.id, defers);
+                const defers = (task.mergeTransientRetryCount ?? 0) + 1;
+                await this.store.updateTask(task.id, { mergeTransientRetryCount: defers });
                 if (defers >= MAX_STARVATION_DROPS) {
                   const error3 = `Workspace partial-land evidence unavailable: branch state could not be read after ${MAX_STARVATION_DROPS} sweeps for sub-repo(s) ${evidenceUnavailableRepos.join(", ")} \u2014 manual intervention required.`;
                   await this.store.updateTask(task.id, { status: "failed", error: error3 });
                   await this.store.logEntry(task.id, error3);
-                  this.workspacePartialLandEvidenceDefers.delete(task.id);
                   await auditor.database({
                     type: "task:reconcile-workspace-partial-land",
                     target: task.id,
@@ -222387,7 +222518,6 @@ var init_self_healing = __esm({
                 }
                 continue;
               }
-              this.workspacePartialLandEvidenceDefers.delete(task.id);
               if (unrecoverableRepos.length > 0) {
                 const missingBranches = unrecoverableRepos.map((repoRel) => workspaceWorktrees[repoRel]?.branch ?? resolveTaskWorkingBranch(task)).join(", ");
                 const error3 = `Workspace partial-land unrecoverable: sub-repo(s) ${unrecoverableRepos.join(", ")} have no branch (${missingBranches}) and no landedSha \u2014 manual intervention required.`;
@@ -222415,7 +222545,7 @@ var init_self_healing = __esm({
                   landedRepos,
                   unlandedRepos: [],
                   reason: "all-landed-not-finalized",
-                  successLog: "Auto-recovered (workspace): all sub-repos landed but task not finalized \u2014 re-enqueued finalize-once"
+                  successLog: "Workspace merge recovery scheduled: all sub-repositories have proven landing evidence; awaiting finalize-once result"
                 });
                 recovered++;
                 continue;
@@ -222424,7 +222554,7 @@ var init_self_healing = __esm({
                 landedRepos,
                 unlandedRepos,
                 reason: landedRepos.length > 0 ? "partial-land" : "zero-land",
-                successLog: `Auto-recovered (workspace): re-enqueued partial land (${landedRepos.length} landed, ${unlandedRepos.length} pending)`
+                successLog: `Workspace merge recovery scheduled: ${landedRepos.length} landed, ${unlandedRepos.length} pending`
               });
               recovered++;
             } catch (err) {
@@ -222489,7 +222619,8 @@ var init_self_healing = __esm({
           }).catch(() => void 0);
           return false;
         }
-        const drops = (this.workspacePartialLandDrops.get(task.id) ?? 0) + 1;
+        const drops = (task.mergeTransientRetryCount ?? 0) + 1;
+        await this.store.updateTask(task.id, { mergeTransientRetryCount: drops });
         this.workspacePartialLandDrops.set(task.id, drops);
         log34.warn(`reconcileWorkspacePartialLands: enqueue dropped for ${task.id} (${drops}/${MAX_STARVATION_DROPS}); merge queue rejected re-enqueue`);
         if (drops >= MAX_STARVATION_DROPS) {
@@ -232085,7 +232216,7 @@ function recoverPassedPlanReviewFromLatestLog(task) {
     completedAt: latest.timestamp
   };
 }
-var PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE, PLAN_REVIEW_LEASE_HELD_VALUE, SESSION_CONTENTION_HOLD_VALUE, WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY, WORKFLOW_INTERRUPTED_NODE_ABORT_KIND_CONTEXT_KEY, WORKFLOW_OPTIONAL_GROUP_CONTEXT_KEY, WORKFLOW_REVIEW_KIND_CONTEXT_KEY, WORKFLOW_NODE_ENGINE_PAUSE_ABORT_KIND, WORKFLOW_DRIFT_PARK_CONTEXT_KEY, WorkflowGraphSuspended, MERGE_REGION_KINDS, WorkflowGraphExecutor;
+var PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE, BRANCH_WRITE_PROVENANCE_FAILURE_VALUE, PLAN_REVIEW_LEASE_HELD_VALUE, SESSION_CONTENTION_HOLD_VALUE, WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY, WORKFLOW_INTERRUPTED_NODE_ABORT_KIND_CONTEXT_KEY, WORKFLOW_OPTIONAL_GROUP_CONTEXT_KEY, WORKFLOW_REVIEW_KIND_CONTEXT_KEY, WORKFLOW_NODE_ENGINE_PAUSE_ABORT_KIND, WORKFLOW_DRIFT_PARK_CONTEXT_KEY, WorkflowGraphSuspended, MERGE_REGION_KINDS, WorkflowGraphExecutor;
 var init_workflow_graph_executor = __esm({
   "../engine/src/workflows/workflow-graph-executor.ts"() {
     "use strict";
@@ -232098,8 +232229,10 @@ var init_workflow_graph_executor = __esm({
     init_workflow_graph_foreach();
     init_workflow_graph_loop();
     init_workflow_node_execution_needs();
+    init_src2();
     init_worktree_acquisition();
     PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE = "plan-review-provider-failure-hold";
+    BRANCH_WRITE_PROVENANCE_FAILURE_VALUE = "branch-write-provenance-failure";
     PLAN_REVIEW_LEASE_HELD_VALUE = "plan-review-lease-held";
     SESSION_CONTENTION_HOLD_VALUE = "session-contention-hold";
     WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY = "workflow:interruptedNodeId";
@@ -233016,7 +233149,7 @@ var init_workflow_graph_executor = __esm({
         const failureResult = {
           outcome: "failure",
           // FNXC:SessionContention 2026-07-25-21:30: contention is a retryable hold, not an exception.
-          value: isSessionContentionError(lastErrorText) ? SESSION_CONTENTION_HOLD_VALUE : "exception",
+          value: lastError instanceof BranchWriteProvenanceError ? BRANCH_WRITE_PROVENANCE_FAILURE_VALUE : isSessionContentionError(lastErrorText) ? SESSION_CONTENTION_HOLD_VALUE : "exception",
           contextPatch: {
             [`node:${node.id}:error`]: lastErrorText
           }
@@ -237104,6 +237237,7 @@ async function handleBranchConflict(deps, task, error3) {
       status: "failed",
       error: conflictMessage,
       branch: error3.branchName,
+      branchWriteOrigin: "engine",
       worktree: error3.conflictingWorktreePath,
       paused: true,
       pausedReason: "branch-conflict-unrecoverable"
@@ -237159,8 +237293,8 @@ async function recoverMissingWorktreeSessionStartFailure(deps, task, worktreePat
   }
   let recoveryTask = task;
   if (workspaceTask) {
-    const normalize11 = deps.store.normalizeWorkspaceTaskWorktreeMetadata;
-    if (typeof normalize11 === "function") recoveryTask = await normalize11.call(deps.store, task.id);
+    const normalize12 = deps.store.normalizeWorkspaceTaskWorktreeMetadata;
+    if (typeof normalize12 === "function") recoveryTask = await normalize12.call(deps.store, task.id);
   }
   if (!workspaceTask && isInsideWorktreesDir(deps.rootDir, staleWorktreePath)) {
     try {
@@ -237578,8 +237712,21 @@ async function detectWorkspaceMainCheckoutWork(deps, task, repos, declaredScope)
       const { stdout } = await execAsync41("git log -n 200 --format=%H%x1f%ct%x1f%B%x1e HEAD", { ...probeOptions, cwd: checkout });
       const attributed = new RegExp(`(?:${task.id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|Fusion-Task-Id:\\s*${task.id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")})`, "i");
       for (const commit of parseCommits(stdout)) {
-        const evidence = attributed.test(commit.body) ? "task-attributed-commit" : anchor !== null && commit.committedAt >= anchor ? "post-anchor-commit" : null;
-        if (evidence) violations.push({ repo, files: [], commits: [commit.sha], evidence });
+        const entry = workspaceWorktrees[repo];
+        const recordedLanding = entry?.landedSha === commit.sha || task.mergeDetails?.workspaceLandedShas?.[repo] === commit.sha || task.mergeDetails?.commitSha === commit.sha;
+        let reachableFromBaseline = false;
+        if (entry?.baseCommitSha) {
+          try {
+            await execAsync41(`git merge-base --is-ancestor ${commit.sha} ${entry.baseCommitSha}`, { ...probeOptions, cwd: checkout });
+            reachableFromBaseline = true;
+          } catch {
+          }
+        }
+        if (attributed.test(commit.body) && !recordedLanding && !reachableFromBaseline && anchor !== null && commit.committedAt >= anchor) {
+          violations.push({ repo, files: [], commits: [commit.sha], evidence: "task-attributed-commit" });
+        } else if (!recordedLanding && !reachableFromBaseline && anchor !== null && commit.committedAt >= anchor) {
+          warnings.push({ repo, files: [], commits: [commit.sha], reason: "pre-existing-dirt" });
+        }
       }
     } catch {
       warnings.push({ repo, files: [], commits: [], reason: "commit-scan-unavailable" });
@@ -237659,7 +237806,7 @@ async function verifyWorktreeInvariants(deps, task, worktreePathOverride, allowR
         reason: "main_checkout_edit",
         repo: firstMainCheckoutViolation.repo,
         observed: `${firstMainCheckoutViolation.evidence}: ${observed}`,
-        expected: `move task work into the acquired fusion/${task.id} worktree for ${firstMainCheckoutViolation.repo} (acquire it first if needed), restore its main checkout, then retry fn_task_done; only 3 requeue attempts are available`
+        expected: `move task work into the acquired fusion/${task.id} worktree for ${firstMainCheckoutViolation.repo} (acquire it first if needed), restore its main checkout, then ask an operator to retry fn_task_done`
       };
     }
     const zeroAcquire = classifyWorkspaceZeroAcquire(task, {
@@ -239142,7 +239289,7 @@ var init_workflow_step_failure_injection = __esm({
 });
 
 // ../engine/src/executor/send-task-back-for-fix.ts
-async function sendTaskBackForFix(deps, task, worktreePath, failureFeedback, stepName, reason, preserveResumeState = true, mergeVerificationFailure = false, retryPresentation, findings) {
+async function sendTaskBackForFix(deps, task, worktreePath, failureFeedback, stepName, reason, preserveResumeState = true, mergeVerificationFailure = false, retryPresentation, findings, persistWorktreePath) {
   const taskId = task.id;
   deps.clearCompletedTaskWatchdog(taskId);
   const { task: authoritativeRemediationTask, route: externalExecutionRoute } = await resolveAuthoritativeExternalExecutionRoute(deps.store, task);
@@ -239185,7 +239332,7 @@ Please fix the issues so the verification can pass on the next attempt.`,
     remediationWorktreePath,
     `${taskId}: sent back to in-progress for remediation`,
     preserveResumeState,
-    !externalExecutionRoute.configured
+    persistWorktreePath ?? !externalExecutionRoute.configured
   );
 }
 var init_send_task_back_for_fix = __esm({
@@ -244281,6 +244428,7 @@ async function ensureGraphCustomNodeWorktree(deps, task, settings, nodeId, refre
       deps.getRunContextFor(task.id)
     );
     if (workspaceConfig) {
+      const remediationRepository = resolveWorkspaceReviewRemediationRepository(task, workspaceConfig.repos);
       const workspace = await acquireWorkspaceTaskWorktrees({
         workspaceConfig,
         workspaceRootDir: deps.rootDir,
@@ -244305,7 +244453,8 @@ async function ensureGraphCustomNodeWorktree(deps, task, settings, nodeId, refre
           return result2;
         }),
         taskEnv: process.env,
-        addActiveWorktree: deps.addActiveWorktree
+        addActiveWorktree: deps.addActiveWorktree,
+        remediationRepository
       });
       deps.onStart?.(workspace.task, workspace.coordinatorWorktreePath);
       executorLog.debug(`${task.id}: workflow node '${nodeId}' using workspace coordinator ${workspace.coordinatorWorktreePath}`);
@@ -244369,6 +244518,7 @@ var init_ensure_graph_custom_node_worktree = __esm({
     init_worktree_git_refs();
     init_task_predicates();
     init_workspace_config_resolver();
+    init_workspace_review_remediation();
   }
 });
 
@@ -244957,7 +245107,22 @@ ${info.feedback}`,
     return false;
   }
   const revisionKey = optionalStepRevisionKey2(info.nodeId, info.stepName);
-  if (hasRepeatedUnchangedCodeReview(liveTask, info)) {
+  const reviewResult = (liveTask.workflowStepResults ?? []).find(
+    (result2) => (result2.workflowStepId === info.nodeId || result2.workflowStepName === info.stepName) && result2.verdict === "REVISE"
+  );
+  const derivedRemediation = reviewResult ? deriveWorkspaceReviewRemediation(reviewResult) : void 0;
+  const remediation2 = derivedRemediation && liveTask.workspaceWorktrees ? derivedRemediation : void 0;
+  const priorRemediation = liveTask.repositoryScope?.reviewRemediation;
+  const hasDurableRepeatedWorkspaceReview = remediation2 !== void 0 && priorRemediation?.scopeRevision === remediation2.scopeRevision && priorRemediation.repository === remediation2.repository && priorRemediation.inputSignature === remediation2.inputSignature;
+  const updateWorkspaceReviewState = deps.store.updateWorkspaceReviewState;
+  if (remediation2 && !hasDurableRepeatedWorkspaceReview && updateWorkspaceReviewState) {
+    const persisted = await updateWorkspaceReviewState.call(deps.store, taskId, remediation2.scopeRevision, remediation2);
+    if (!persisted.updated) {
+      executorLog.warn(`${taskId}: workspace Code Review remediation was superseded by a repository scope change.`);
+      return false;
+    }
+  }
+  if (hasDurableRepeatedWorkspaceReview || (!remediation2 || !updateWorkspaceReviewState) && hasRepeatedUnchangedCodeReview(liveTask, info)) {
     const runContext = deps.getRunContextFor(taskId);
     await deps.store.logEntry(
       taskId,
@@ -245005,9 +245170,18 @@ Feedback:
 ${info.feedback}`, revisionKey),
     deps.getRunContextFor(taskId)
   );
-  await deps.sendTaskBackForFix(
+  const remediationWorktreePath = remediation2 ? liveTask.workspaceWorktrees?.[remediation2.repository]?.worktreePath : liveTask.worktree;
+  if (remediation2 && !remediationWorktreePath) {
+    await deps.store.updateTask(taskId, {
+      status: "awaiting-approval",
+      awaitingApprovalReason: "code-review-non-convergence",
+      error: `Workspace Code Review remediation target ${remediation2.repository} has no acquired worktree.`
+    });
+    return false;
+  }
+  const sendArgs = [
     liveTask,
-    liveTask.worktree ?? "",
+    remediationWorktreePath ?? "",
     info.feedback,
     info.stepName,
     `Pre-merge optional workflow step "${info.stepName}" requested revision`,
@@ -245015,7 +245189,12 @@ ${info.feedback}`, revisionKey),
     false,
     { attempt: nextCount, max: budget.unbounded ? void 0 : budget.max },
     info.findings
-  );
+  ];
+  if (remediation2) {
+    await deps.sendTaskBackForFix(...sendArgs, false);
+  } else {
+    await deps.sendTaskBackForFix(...sendArgs);
+  }
   return true;
 }
 var init_request_pre_merge_optional_step_fix = __esm({
@@ -245030,6 +245209,7 @@ var init_request_pre_merge_optional_step_fix = __esm({
     init_plan_review_feedback_history();
     init_logger3();
     init_emit_bounded_run_audit3();
+    init_workspace_review_remediation();
   }
 });
 
@@ -245918,6 +246098,14 @@ function createTaskDoneTool(deps, taskId, worktreePath, promptContent, codeRevie
         const refusalMessage = `fn_task_done refused: ${invariantCheck.reason} \u2014 observed=${invariantCheck.observed}, expected=${invariantCheck.expected}`;
         await store.logEntry(taskId, refusalMessage, void 0, deps.getRunContextFor(task.id));
         executorLog.error(`${taskId}: fn_task_done refused (${invariantCheck.reason}) \u2014 observed=${invariantCheck.observed}, expected=${invariantCheck.expected}`);
+        if (invariantCheck.reason === "main_checkout_edit") {
+          await store.updateTask(taskId, { status: "failed", error: refusalMessage });
+          await store.logEntry(taskId, `${refusalMessage} \u2014 operator cleanup and Retry are required; executor retry budget preserved`, void 0, deps.getRunContextFor(task.id));
+          return {
+            content: [{ type: "text", text: refusalMessage }],
+            details: { error: refusalMessage }
+          };
+        }
         const priorRequeues = task.taskDoneRetryCount ?? 0;
         const nextRequeueCount = priorRequeues + 1;
         if (priorRequeues < MAX_TASK_DONE_REQUEUE_RETRIES) {
@@ -247750,7 +247938,9 @@ Repository scope (task-level; review this plan once): ${detail.repositoryScope?.
           return {
             repositoryScope: {
               ...currentScope,
-              reviewEvidence: Object.fromEntries(Object.entries(review.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }]))
+              reviewEvidence: Object.fromEntries(Object.entries(review.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }])),
+              // FNXC:WorkspaceFinalization 2026-08-21-09:50: An APPROVE for this fenced scope ends its REVISE episode; retaining its target would misroute later acquisition.
+              ...currentScope.reviewRemediation?.scopeRevision === review.repositoryScopeRevision ? { reviewRemediation: void 0 } : {}
             }
           };
         });
@@ -249155,7 +249345,8 @@ async function runGraphCustomNode(deps, node, nodeTask, settings, columnBinding,
       executionTarget = await deps.ensureGraphCustomNodeWorktree(acquisitionTask, settings, node.id);
     }
   }
-  const workspaceCoordinator = workspaceConfig ? Object.keys(executionTarget.workspaceWorktrees ?? {}).filter((repoRelPath) => workspaceConfig.repos.includes(repoRelPath)).sort().map((repoRelPath) => executionTarget.workspaceWorktrees?.[repoRelPath]?.worktreePath).find((path17) => typeof path17 === "string" && path17.length > 0) : void 0;
+  const remediationRepository = workspaceConfig ? resolveWorkspaceReviewRemediationRepository(executionTarget, workspaceConfig.repos) : void 0;
+  const workspaceCoordinator = workspaceConfig ? remediationRepository ? executionTarget.workspaceWorktrees?.[remediationRepository]?.worktreePath : Object.keys(executionTarget.workspaceWorktrees ?? {}).filter((repoRelPath) => workspaceConfig.repos.includes(repoRelPath)).sort().map((repoRelPath) => executionTarget.workspaceWorktrees?.[repoRelPath]?.worktreePath).find((path17) => typeof path17 === "string" && path17.length > 0) : void 0;
   if (!executionTarget.worktree && !workspaceCoordinator) {
     return { outcome: "failure", value: "no-worktree-for-write-node" };
   }
@@ -249315,7 +249506,9 @@ ${prompt}`;
           return {
             repositoryScope: {
               ...currentScope,
-              reviewEvidence: Object.fromEntries(Object.entries(aggregate.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }]))
+              reviewEvidence: Object.fromEntries(Object.entries(aggregate.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }])),
+              // FNXC:WorkspaceFinalization 2026-08-21-09:50: A current-scope APPROVE clears the durable REVISE coordinator before graph completion can schedule another run.
+              ...currentScope.reviewRemediation?.scopeRevision === aggregate.repositoryScopeRevision ? { reviewRemediation: void 0 } : {}
             }
           };
         });
@@ -249413,6 +249606,7 @@ var init_run_graph_custom_node = __esm({
     "use strict";
     init_src2();
     init_logger3();
+    init_workspace_review_remediation();
     init_workflow_graph_executor();
     init_workflow_node_execution_needs();
     init_workflow_step_verdict();
@@ -249468,6 +249662,13 @@ async function handleGraphFailure(deps, task, result2) {
       await deps.persistTokenUsage(task.id);
       return;
     }
+    if (graphFailureValue(result2) === BRANCH_WRITE_PROVENANCE_FAILURE_VALUE) {
+      const diagnostic = graphFailureErrorTexts(result2).find((message2) => message2.includes("branchWriteOrigin is required when branch is provided")) ?? "branchWriteOrigin is required when branch is provided";
+      await deps.store.logEntry(task.id, diagnostic, void 0, deps.getRunContextFor(task.id));
+      await deps.store.updateTask(task.id, { status: "failed", error: diagnostic }, deps.getRunContextFor(task.id));
+      await deps.persistTokenUsage(task.id);
+      return;
+    }
     if (isSessionContentionGraphFailure(result2)) {
       await deps.holdForSessionContention(task, live, result2);
       await deps.persistTokenUsage(task.id);
@@ -252205,6 +252406,7 @@ async function runImplementation(deps, task, graphCompletion, reportImplementati
     deps.registerConfiguredCommandController(task.id, taskCommandAbortController);
     let workspaceCoordinatorWorktree;
     if (hasWorkspaceRepos && deps.workspaceConfig) {
+      const remediationRepository = resolveWorkspaceReviewRemediationRepository(task, deps.workspaceConfig.repos);
       const workspace = await acquireWorkspaceTaskWorktrees({
         workspaceConfig: deps.workspaceConfig,
         workspaceRootDir: deps.rootDir,
@@ -252229,7 +252431,8 @@ async function runImplementation(deps, task, graphCompletion, reportImplementati
           return result2;
         }),
         taskEnv,
-        addActiveWorktree: deps.addActiveWorktree
+        addActiveWorktree: deps.addActiveWorktree,
+        remediationRepository
       });
       task = workspace.task;
       workspaceCoordinatorWorktree = workspace.coordinatorWorktreePath;
@@ -254789,6 +254992,7 @@ var init_run_implementation = __esm({
     init_run_audit();
     init_emit_bounded_run_audit3();
     init_worktree_acquisition();
+    init_workspace_review_remediation();
     init_worktree_paths();
     init_worktree_pool();
     execAsync52 = promisify75(exec56);
@@ -263696,6 +263900,40 @@ var init_overseer_noop_finalize_veto = __esm({
   }
 });
 
+// ../engine/src/merge/workspace-merge-readiness.ts
+function resolveWorkspaceMergeReadiness(task, freshModifiedRepositories, netZeroBranchRepositories) {
+  const scope = task.repositoryScope;
+  if (scope?.state !== "confirmed") {
+    return { kind: "blocked", reason: `Workspace repository scope is unresolved for ${task.id}; operator confirmation is required before landing` };
+  }
+  const entries2 = task.workspaceWorktrees ?? {};
+  const declaredRepositories = scope.repositories.map((repository) => repository.trim());
+  if (declaredRepositories.some((repository) => !repository) || new Set(declaredRepositories).size !== declaredRepositories.length) {
+    return { kind: "blocked", reason: `Workspace repository scope has duplicate or invalid declarations for ${task.id}; operator repair is required` };
+  }
+  const worktreePaths = Object.values(entries2).map((entry) => entry.worktreePath?.trim()).filter((path17) => Boolean(path17));
+  if (new Set(worktreePaths).size !== worktreePaths.length) {
+    return { kind: "blocked", reason: `Workspace merge has duplicate worktree paths for ${task.id}; operator repair is required` };
+  }
+  const repositories = declaredRepositories.filter((repo) => Boolean(entries2[repo])).filter((repo) => freshModifiedRepositories.has(repo) || netZeroBranchRepositories.has(repo) || Boolean(entries2[repo]?.landedSha)).sort();
+  const preservedFiles = [...new Set(task.modifiedFiles ?? [])].sort();
+  if (repositories.length > 0) return { kind: "ready", repositories, preservedFiles };
+  if (task.noCommitsExpected === true && scope.repositories.length === 0) {
+    return { kind: "no-op", repositories: [], preservedFiles: [] };
+  }
+  const declared = [...declaredRepositories].sort();
+  const knownEntries = declared.filter((repo) => entries2[repo] !== void 0);
+  if (knownEntries.length === 0) {
+    return { kind: "blocked", reason: `Workspace merge has no acquired repositories matching confirmed scope for ${task.id}; operator repair is required` };
+  }
+  return { kind: "blocked", reason: `Workspace merge has no evidenced landing obligations for ${task.id}; operator repair is required` };
+}
+var init_workspace_merge_readiness = __esm({
+  "../engine/src/merge/workspace-merge-readiness.ts"() {
+    "use strict";
+  }
+});
+
 // ../engine/src/merge/workspace-fence-ref.ts
 import { execFile as execFile32 } from "node:child_process";
 import { createHash as createHash33 } from "node:crypto";
@@ -265460,8 +265698,21 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
   const taskTitle = task.title?.trim() ? task.title.split("\n")[0] : void 0;
   const liveMergeBoundaryTask = await store.getTask(taskId).catch(() => void 0);
   const mergeBoundaryTask = liveMergeBoundaryTask?.workspaceWorktrees ? liveMergeBoundaryTask : task;
+  const reviewColumns = /* @__PURE__ */ new Set(["in-review"]);
+  const workflowIr = await resolveWorkflowIrForTask(store, taskId).catch(() => void 0);
+  if (workflowIr) for (const column of resolveReviewColumns(workflowIr)) reviewColumns.add(column);
+  const completeColumns = /* @__PURE__ */ new Set(["done"]);
+  if (workflowIr) for (const column of resolveTerminalColumns(workflowIr)) completeColumns.add(column);
+  if (!completeColumns.has(mergeBoundaryTask.column)) {
+    const mergeBlocker = getTaskMergeBlocker(mergeBoundaryTask, {
+      manual: options.manual === true,
+      reviewColumns
+    });
+    if (mergeBlocker) throw new WorkspaceFinalizeBlockedError(taskId, mergeBlocker);
+  }
   const confirmedScope = mergeBoundaryTask.repositoryScope?.state === "confirmed" ? new Set(mergeBoundaryTask.repositoryScope.repositories) : void 0;
   const mergeBoundaryModifiedFiles = [];
+  const mergeBoundaryModifiedRepositories = /* @__PURE__ */ new Set();
   const mergeBoundaryFingerprints = {};
   const modifiedOutOfScopeRepositories = /* @__PURE__ */ new Set();
   const netZeroBranchRepositories = /* @__PURE__ */ new Set();
@@ -265478,6 +265729,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       if (files.length > 0 && !confirmedScope?.has(repoRel)) {
         modifiedOutOfScopeRepositories.add(repoRel);
       } else if (confirmedScope?.has(repoRel)) {
+        if (files.length > 0) mergeBoundaryModifiedRepositories.add(repoRel);
         mergeBoundaryModifiedFiles.push(...files.map((file) => `${repoRel}/${file}`));
         if (files.length === 0) {
           const { stdout: aheadCount } = await execFileAsync28("git", ["rev-list", "--count", `HEAD..${entry.branch}`], { cwd: entry.worktreePath, encoding: "utf8" });
@@ -265493,19 +265745,26 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
   }
   const normalizedMergeBoundaryFiles = [...new Set(mergeBoundaryModifiedFiles)].sort();
   const persistedReviewFiles = [...new Set(mergeBoundaryTask.modifiedFiles ?? [])].sort();
-  const approvedReviewEvidence = mergeBoundaryTask.repositoryScope?.reviewEvidence ?? {};
-  const missingOrStaleReviewApproval = Object.entries(mergeBoundaryFingerprints).some(([repoRel, fingerprint]) => approvedReviewEvidence[repoRel]?.fingerprint !== fingerprint);
-  if (normalizedMergeBoundaryFiles.some((file) => !persistedReviewFiles.includes(file)) || missingOrStaleReviewApproval) {
+  const approvedReviewEvidence = mergeBoundaryTask.repositoryScope?.reviewEvidence;
+  const requiresRepositoryReviewEvidence = approvedReviewEvidence !== void 0 || (mergeBoundaryTask.enabledWorkflowSteps ?? []).some((step) => /review/i.test(step));
+  const missingOrStaleReviewApproval = requiresRepositoryReviewEvidence && Object.entries(mergeBoundaryFingerprints).some(([repoRel, fingerprint]) => approvedReviewEvidence?.[repoRel]?.fingerprint !== fingerprint);
+  if (requiresRepositoryReviewEvidence && normalizedMergeBoundaryFiles.some((file) => !persistedReviewFiles.includes(file)) || missingOrStaleReviewApproval) {
     throw new Error(`Workspace merge evidence changed after review for ${taskId}; return the task to Code Review before landing`);
   }
-  await store.updateTask(taskId, { modifiedFiles: normalizedMergeBoundaryFiles });
-  task = { ...mergeBoundaryTask, modifiedFiles: normalizedMergeBoundaryFiles };
-  const workspaceWorktrees = task.workspaceWorktrees ?? {};
-  const explicitScope = task.repositoryScope?.state === "confirmed" ? task.repositoryScope.repositories : void 0;
-  if (!explicitScope) {
-    throw new Error(`Workspace repository scope is unresolved for ${taskId}; operator confirmation is required before landing`);
+  const readiness = resolveWorkspaceMergeReadiness(
+    mergeBoundaryTask,
+    mergeBoundaryModifiedRepositories,
+    netZeroBranchRepositories
+  );
+  if (readiness.kind === "blocked") throw new Error(readiness.reason);
+  if (readiness.kind === "no-op") {
+    throw new Error(`Workspace task ${taskId} has explicit no-commits policy and cannot enter repository landing`);
   }
-  const repoKeys = Object.keys(workspaceWorktrees).filter((repoRel) => explicitScope.includes(repoRel) && ((task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`)) || netZeroBranchRepositories.has(repoRel))).sort();
+  const retainedModifiedFiles = [.../* @__PURE__ */ new Set([...normalizedMergeBoundaryFiles, ...readiness.preservedFiles])].sort();
+  await store.updateTask(taskId, { modifiedFiles: retainedModifiedFiles });
+  task = { ...mergeBoundaryTask, modifiedFiles: retainedModifiedFiles };
+  const workspaceWorktrees = task.workspaceWorktrees ?? {};
+  const repoKeys = readiness.repositories;
   const repos = [];
   let allLanded = true;
   await setStatus("merging");
@@ -265534,7 +265793,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
         };
       } catch (error3) {
         if (error3 instanceof WorkspaceFenceRefError) {
-          throw new WorkspaceRepoLandBusyError(repoKeys[0] ?? "workspace", "workspace-merge-dispatch-fence", taskId);
+          throw new WorkspaceMergeTechnicalError("dispatch-fence-publication", `Workspace merge dispatch fence publication failed for ${taskId}: ${error3.message}`);
         }
         throw error3;
       }
@@ -265623,7 +265882,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       } catch (error3) {
         if (durableLandLease) await store.releaseWorkspaceLease(durableLandLease).catch(() => void 0);
         if (error3 instanceof WorkspaceRepoLandBusyError) throw error3;
-        throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease unavailable for ${repoRel}: ${getErrorMessage4(error3)}`);
       }
       try {
         activeSessionRegistry.registerPath(repoRootDir, {
@@ -265660,7 +265919,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       renewalTimer?.unref?.();
       const landSignal = options.signal ? AbortSignal.any([options.signal, leaseAbort.signal]) : leaseAbort.signal;
       const assertLeaseLive = () => {
-        if (leaseLost || leaseAbort.signal.aborted) throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        if (leaseLost || leaseAbort.signal.aborted) throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease renewal was lost for ${repoRel}`);
       };
       try {
         const landResult = await landOneRepo(repoRootDir, entry.branch, integrationBranch, {
@@ -265745,11 +266004,11 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
           repos.push({ repo: repoRel, repoRootDir, integrationBranch, branch: entry.branch, status: "empty" });
         }
       } catch (err) {
-        if (leaseLost) throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        if (leaseLost) throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease renewal was lost for ${repoRel}`);
         if (isMergeAbortedError(err)) throw err;
         if (err instanceof WorkspacePartialLandError) throw err;
         if (err instanceof WorkspaceFenceRefError) {
-          throw new WorkspaceRepoLandBusyError(repoRel, "workspace-merge-dispatch-fence", taskId);
+          throw new WorkspaceMergeTechnicalError("repository-fence-publication", `Workspace repository fence publication failed for ${repoRel}: ${err.message}`);
         }
         const message = getErrorMessage4(err);
         await log44(`AI merge (workspace): sub-repo ${repoRel} land failed: ${message}`);
@@ -266308,7 +266567,7 @@ async function finalizeTask(store, taskId, result2, audit, log44, rootDir, fence
 function throwIfAborted2(signal, taskId) {
   assertMergeGenerationOwned(signal, taskId);
 }
-var execFileAsync28, aiMergeLog, MAX_CONCURRENT_ADVANCE_RETRIES, MAX_BLOCKING_REVIEW_REASONS, AiMergeBlockedError, AiMergeReviewReconciliationInvalidatedError, LEGACY_COMPLETE_COLUMN, LEGACY_ARCHIVED_COLUMN, LEGACY_TERMINAL_COLUMNS3, LEGACY_REBOUND_COLUMN2, STRONG_LANDED_STRATEGIES, WORKSPACE_REPO_LAND_OWNER_KEY, WorkspaceRepoLandBusyError, WorkspacePartialLandError, WorkspaceFinalizeBlockedError, WorkspaceMergeDispatchSupersededError;
+var execFileAsync28, aiMergeLog, MAX_CONCURRENT_ADVANCE_RETRIES, MAX_BLOCKING_REVIEW_REASONS, AiMergeBlockedError, AiMergeReviewReconciliationInvalidatedError, LEGACY_COMPLETE_COLUMN, LEGACY_ARCHIVED_COLUMN, LEGACY_TERMINAL_COLUMNS3, LEGACY_REBOUND_COLUMN2, STRONG_LANDED_STRATEGIES, WORKSPACE_REPO_LAND_OWNER_KEY, WorkspaceRepoLandBusyError, WorkspaceMergeTechnicalError, WorkspacePartialLandError, WorkspaceFinalizeBlockedError, WorkspaceMergeDispatchSupersededError;
 var init_merger_ai = __esm({
   "../engine/src/merge/merger-ai.ts"() {
     "use strict";
@@ -266340,6 +266599,7 @@ var init_merger_ai = __esm({
     init_active_session_registry();
     init_mcp_resolution();
     init_workspace_land_predicate();
+    init_workspace_merge_readiness();
     init_workspace_land_failure();
     init_workspace_fence_ref();
     init_auto_merge_finalization();
@@ -266385,6 +266645,14 @@ var init_merger_ai = __esm({
       }
       retryable = true;
     };
+    WorkspaceMergeTechnicalError = class extends Error {
+      constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = "WorkspaceMergeTechnicalError";
+      }
+      retryable = true;
+    };
     WorkspacePartialLandError = class extends Error {
       constructor(landedCount, failedRepos, message) {
         super(message);
@@ -285578,6 +285846,15 @@ ${detail}`);
                 }
                 continue;
               }
+              if (err instanceof WorkspaceMergeTechnicalError) {
+                await store.logEntry(taskId, `Workspace merge technical failure (${err.kind}): ${err.message}`, "WorkspaceMergeTechnicalFailure").catch(() => void 0);
+                if (hasManualResolver) {
+                  this.rejectMergeResolvers(taskId, err);
+                } else if (!await this.maybeRetryTransientMerge(store, taskId, await store.getTask(taskId).catch(() => null), err.message, true)) {
+                  await store.updateTask(taskId, { status: "failed", error: err.message }).catch(() => void 0);
+                }
+                continue;
+              }
               const isWorkspaceBusyError = err instanceof WorkspaceRepoLandBusyError || err instanceof WorkspaceMergeDispatchBusyError || err instanceof WorkspaceMergeDispatchSupersededError;
               if (isWorkspaceBusyError && hasManualResolver) {
                 await store.logEntry(taskId, `Workspace sub-repo land busy (contention): ${errorMsg}`, "WorkspaceRepoLandBusy").catch(() => void 0);
@@ -285585,18 +285862,18 @@ ${detail}`);
                 continue;
               }
               if (isWorkspaceBusyError && !hasManualResolver) {
-                const busyCount = this.workspaceBusyReenqueues.get(taskId) ?? 0;
+                const liveTask = await store.getTask(taskId).catch(() => null);
+                const busyCount = liveTask?.mergeTransientRetryCount ?? 0;
                 await store.logEntry(taskId, `Workspace sub-repo land busy (contention): ${errorMsg}`, "WorkspaceRepoLandBusy").catch(() => void 0);
                 if (busyCount < _ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES) {
-                  this.workspaceBusyReenqueues.set(taskId, busyCount + 1);
+                  const nextCount = busyCount + 1;
                   const delayMs = Math.min(5e3 * Math.pow(2, busyCount), 6e4);
-                  await store.updateTask(taskId, { status: null }).catch(() => void 0);
+                  await store.updateTask(taskId, { status: null, mergeTransientRetryCount: nextCount }).catch(() => void 0);
                   runtimeLog.log(
-                    `Workspace land busy re-enqueue ${busyCount + 1}/${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} for ${taskId} in ${delayMs / 1e3}s (no mergeRetry consumed \u2014 pure lease contention)`
+                    `Workspace land busy re-enqueue ${nextCount}/${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} for ${taskId} in ${delayMs / 1e3}s (durable transient retry)`
                   );
                   this.scheduleWorkspaceBusyReenqueue(taskId, delayMs);
                 } else {
-                  this.workspaceBusyReenqueues.delete(taskId);
                   await store.updateTask(taskId, { status: "failed", error: errorMsg }).catch(() => void 0);
                   runtimeLog.error(
                     `Auto-merge: ${taskId} workspace land busy ${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} times \u2014 parked as failed (sustained sub-repo lease contention)`
@@ -286925,7 +287202,7 @@ var init_engine_singleton_lock = __esm({
 import { realpathSync as realpathSync16 } from "node:fs";
 import { resolve as pathResolve } from "node:path";
 function sameProjectRoot(a, b3) {
-  const normalize11 = (p2) => {
+  const normalize12 = (p2) => {
     const resolved = pathResolve(p2);
     try {
       return realpathSync16(resolved);
@@ -286933,7 +287210,7 @@ function sameProjectRoot(a, b3) {
       return resolved;
     }
   };
-  return normalize11(a) === normalize11(b3);
+  return normalize12(a) === normalize12(b3);
 }
 var DEFAULT_RECONCILIATION_INTERVAL_MS, ProjectEngineManager;
 var init_project_engine_manager = __esm({
@@ -303626,7 +303903,7 @@ var init_gitlab = __esm({
         if (response.status === 204) return void 0;
         return await response.json();
       }
-      async listPaginated(path17, options, normalize11) {
+      async listPaginated(path17, options, normalize12) {
         const limit2 = clampLimit(options.limit);
         const out = [];
         let page = 1;
@@ -303637,7 +303914,7 @@ var init_gitlab = __esm({
           appendListParams(params, options);
           const rows = await this.request(`${path17}?${params.toString()}`);
           if (!Array.isArray(rows) || rows.length === 0) break;
-          out.push(...rows.map(normalize11));
+          out.push(...rows.map(normalize12));
           if (rows.length < Number(params.get("per_page"))) break;
           page += 1;
         }
@@ -319584,6 +319861,7 @@ function registerPlanningSubtaskRoutes(ctx, deps) {
         priority: isTaskPriority3(summary.priority) ? summary.priority : DEFAULT_TASK_PRIORITY,
         ...sourceContext ? { sourceIssue: sourceContext.sourceIssue, source: { sourceType: "github_import", sourceMetadata: sourceContext.sourceMetadata }, ...trackingDecision?.githubTracking ? { githubTracking: trackingDecision.githubTracking } : {} } : { source: { sourceType: "api" } },
         branch: resolvedBranch,
+        ...resolvedBranch !== void 0 ? { branchWriteOrigin: "operator" } : {},
         baseBranch: resolvedBaseBranch,
         /*
         FNXC:WorkflowSelection 2026-06-20-16:48:
@@ -351306,7 +351584,7 @@ var require_commonjs4 = __commonJS({
     var TYPEMASK = 1023;
     var entToType = (s3) => s3.isFile() ? IFREG : s3.isDirectory() ? IFDIR : s3.isSymbolicLink() ? IFLNK : s3.isCharacterDevice() ? IFCHR : s3.isBlockDevice() ? IFBLK : s3.isSocket() ? IFSOCK : s3.isFIFO() ? IFIFO : UNKNOWN;
     var normalizeCache = /* @__PURE__ */ new Map();
-    var normalize11 = (s3) => {
+    var normalize12 = (s3) => {
       const c = normalizeCache.get(s3);
       if (c)
         return c;
@@ -351319,7 +351597,7 @@ var require_commonjs4 = __commonJS({
       const c = normalizeNocaseCache.get(s3);
       if (c)
         return c;
-      const n = normalize11(s3.toLowerCase());
+      const n = normalize12(s3.toLowerCase());
       normalizeNocaseCache.set(s3, n);
       return n;
     };
@@ -351488,7 +351766,7 @@ var require_commonjs4 = __commonJS({
        */
       constructor(name2, type = UNKNOWN, root, roots, nocase, children, opts) {
         this.name = name2;
-        this.#matchName = nocase ? normalizeNocase(name2) : normalize11(name2);
+        this.#matchName = nocase ? normalizeNocase(name2) : normalize12(name2);
         this.#type = type & TYPEMASK;
         this.nocase = nocase;
         this.roots = roots;
@@ -351581,7 +351859,7 @@ var require_commonjs4 = __commonJS({
           return this.parent || this;
         }
         const children = this.children();
-        const name2 = this.nocase ? normalizeNocase(pathPart) : normalize11(pathPart);
+        const name2 = this.nocase ? normalizeNocase(pathPart) : normalize12(pathPart);
         for (const p2 of children) {
           if (p2.#matchName === name2) {
             return p2;
@@ -351826,7 +352104,7 @@ var require_commonjs4 = __commonJS({
        * directly.
        */
       isNamed(n) {
-        return !this.nocase ? this.#matchName === normalize11(n) : this.#matchName === normalizeNocase(n);
+        return !this.nocase ? this.#matchName === normalize12(n) : this.#matchName === normalizeNocase(n);
       }
       /**
        * Return the Path object corresponding to the target of a symbolic link.
@@ -351965,7 +352243,7 @@ var require_commonjs4 = __commonJS({
       #readdirMaybePromoteChild(e, c) {
         for (let p2 = c.provisional; p2 < c.length; p2++) {
           const pchild = c[p2];
-          const name2 = this.nocase ? normalizeNocase(e.name) : normalize11(e.name);
+          const name2 = this.nocase ? normalizeNocase(e.name) : normalize12(e.name);
           if (name2 !== pchild.#matchName) {
             continue;
           }
@@ -394484,6 +394762,22 @@ var init_update_install_coordinator = __esm({
       pendingVersion;
       pendingResult;
       restartRequested = false;
+      /**
+       * FNXC:PendingUpdateInstall 2026-08-21-05:58:
+       * A completed install belongs to the still-running old process, not a mounted
+       * Settings dialog. Expose its target until process replacement so every route
+       * can reject a second install and every dashboard remount can offer restart.
+       */
+      getPendingInstall() {
+        if (!this.pendingVersion || !this.pendingResult) return void 0;
+        return {
+          ...this.pendingResult,
+          latestVersion: this.pendingVersion,
+          restartAttempted: this.restartRequested,
+          restartScheduled: this.restartRequested,
+          priorPid: this.restartRequested ? process.pid : void 0
+        };
+      }
       async install(targetVersion, operation) {
         if (this.pendingVersion && this.pendingResult) return this.pendingResult;
         if (!this.inFlight) {
@@ -394523,8 +394817,25 @@ var init_register_update_check_routes = __esm({
       const { router, store, rethrowAsApiError: rethrowAsApiError8 } = ctx;
       const cliPackageVersion = getCliPackageVersion(import.meta.url);
       const coordinator = ctx.options?.systemControl ? processUpdateInstallCoordinator : new UpdateInstallCoordinator();
+      const pendingResponse = () => {
+        const pendingInstall = coordinator.getPendingInstall();
+        if (!pendingInstall) return void 0;
+        return {
+          currentVersion: pendingInstall.currentVersion,
+          latestVersion: pendingInstall.latestVersion,
+          // Keep the old version's availability signal compatible for legacy readers.
+          updateAvailable: true,
+          pendingInstall,
+          lastChecked: Date.now()
+        };
+      };
       router.get("/update-check", async (_req, res) => {
         try {
+          const pending = pendingResponse();
+          if (pending) {
+            res.json(pending);
+            return;
+          }
           const globalSettings = await store.getGlobalSettingsStore().getSettings();
           if (globalSettings.updateCheckEnabled === false) {
             res.json({
@@ -394547,6 +394858,11 @@ var init_register_update_check_routes = __esm({
       });
       router.post("/update-check/refresh", async (_req, res) => {
         try {
+          const pending = pendingResponse();
+          if (pending) {
+            res.json(pending);
+            return;
+          }
           const globalSettings = await store.getGlobalSettingsStore().getSettings();
           const fusionDir = resolveGlobalDir();
           await clearUpdateCheckCache(fusionDir);
@@ -394561,6 +394877,11 @@ var init_register_update_check_routes = __esm({
       });
       router.post("/update-check/install", async (_req, res) => {
         try {
+          const pending = coordinator.getPendingInstall();
+          if (pending) {
+            res.json(pending);
+            return;
+          }
           const globalSettings = await store.getGlobalSettingsStore().getSettings();
           const fusionDir = resolveGlobalDir();
           const updateCheck = await performUpdateCheck(fusionDir, cliPackageVersion, {
@@ -394593,7 +394914,7 @@ var init_register_update_check_routes = __esm({
           }
           const restartAttempted = result2.updated && result2.outcome === "installed" && resolveUpdateAutomationSettings(latestSettings).autoRestartAfterUpdate;
           const restartScheduled = restartAttempted ? coordinator.requestRestart(() => ctx.options?.systemControl?.requestRestart("update-install") === true) : false;
-          res.json({ ...result2, restartAttempted, restartScheduled, priorPid: restartAttempted ? process.pid : void 0 });
+          res.json(coordinator.getPendingInstall() ?? { ...result2, restartAttempted, restartScheduled, priorPid: restartAttempted ? process.pid : void 0 });
         } catch (error3) {
           rethrowAsApiError8(error3, "Failed to install update");
         }
@@ -405763,7 +406084,7 @@ var init_badge_pubsub = __esm({
 });
 
 // ../dashboard/src/terminal-websocket-diagnostics.ts
-import { basename as basename37, normalize as normalize9, sep as sep25 } from "node:path";
+import { basename as basename37, normalize as normalize10, sep as sep25 } from "node:path";
 function toSessionTag(sessionId) {
   const normalized2 = sessionId.trim();
   if (normalized2.length <= 8) {
@@ -405772,7 +406093,7 @@ function toSessionTag(sessionId) {
   return `${normalized2.slice(0, 4)}\u2026${normalized2.slice(-4)}#${normalized2.length}`;
 }
 function toRedactedPathHint(pathValue) {
-  const normalized2 = normalize9(pathValue);
+  const normalized2 = normalize10(pathValue);
   const segments = normalized2.split(sep25).filter(Boolean);
   if (segments.length === 0) {
     return "<empty>";
@@ -406712,6 +407033,8 @@ async function runAutoUpdateCycle(deps) {
     });
     return "unsupervised";
   }
+  const coordinator = deps.coordinator ?? new UpdateInstallCoordinator();
+  if (coordinator.getPendingInstall()) return "restart-waiting";
   const fusionDir = deps.fusionDir ?? resolveGlobalDir();
   const check3 = deps.checkForUpdate ?? performUpdateCheck;
   const install = deps.installUpdate ?? performUpdateInstall;
@@ -406737,7 +407060,6 @@ async function runAutoUpdateCycle(deps) {
   });
   let installed;
   try {
-    const coordinator = deps.coordinator ?? new UpdateInstallCoordinator();
     installed = await coordinator.install(result2.latestVersion, () => install(result2.currentVersion, result2.latestVersion, {
       fusionDir,
       installMethod: { sourceWorkspaceRoot: deps.sourceWorkspaceRoot }
@@ -406762,7 +407084,7 @@ async function runAutoUpdateCycle(deps) {
     latestSettings = {};
   }
   if (!resolveUpdateAutomationSettings(latestSettings).autoRestartAfterUpdate) return "up-to-date";
-  const scheduled = (deps.coordinator ?? new UpdateInstallCoordinator()).requestRestart(() => deps.requestRestart("auto-update"));
+  const scheduled = coordinator.requestRestart(() => deps.requestRestart("auto-update"));
   if (!scheduled) {
     deps.log.warn("Auto-update installed but restart was not scheduled", {
       message: `v${installed.latestVersion} is installed; restart Fusion manually to run it.`
@@ -408596,9 +408918,17 @@ function createServer6(store, options) {
   };
   const jsonParser = express3.json({ verify: preserveRawBody });
   const planningImageCaptureParser = express3.json({ limit: "5mb", verify: preserveRawBody });
+  const chatMessageParser = express3.json({ limit: 2 * 1024 * 1024, verify: preserveRawBody });
+  const fileSaveParser = express3.json({ limit: 6 * MAX_FILE_SIZE + 1024, verify: preserveRawBody });
+  const isChatMessagePath = (path17) => /^\/api\/chat\/(?:sessions|rooms)\/[^/]+\/messages\/?$/.test(path17);
+  const isTaskFileSavePath = (path17) => /^\/api\/tasks\/[^/]+\/files\/.+\/?$/.test(path17);
+  const isWorkspaceFileSavePath = (path17) => {
+    if (!/^\/api\/files\/.+/.test(path17) || /^\/api\/files\/mkdir\/?$/.test(path17)) return false;
+    return !/^\/api\/files\/.+\/(?:copy|move|delete|rename)\/?$/.test(path17);
+  };
   app.use((req, res, next) => {
     if (req.path === "/api/voice/transcribe" || req.path === "/api/voice/transcribe/") return next();
-    const parser = req.path === "/api/planning/start-streaming" || req.path === "/api/planning/start-streaming/" ? planningImageCaptureParser : jsonParser;
+    const parser = req.path === "/api/planning/start-streaming" || req.path === "/api/planning/start-streaming/" ? planningImageCaptureParser : req.method === "POST" && isChatMessagePath(req.path) ? chatMessageParser : req.method === "POST" && (isTaskFileSavePath(req.path) || isWorkspaceFileSavePath(req.path)) ? fileSaveParser : jsonParser;
     return parser(req, res, (error3) => {
       if (error3?.type === "entity.too.large") return res.status(413).json({ error: "payload-too-large" });
       return next(error3);
@@ -410014,6 +410344,7 @@ var init_server2 = __esm({
     init_api_error();
     init_project_store_resolver();
     init_chat_project_services();
+    init_file_service();
     init_terminal_viewport();
     init_terminal_service();
     init_terminal();
@@ -431037,7 +431368,7 @@ var init_mcp_memory_server = __esm({
 
 // src/project-resolver.ts
 import { existsSync as existsSync126, statSync as statSync21 } from "node:fs";
-import { basename as basename43, dirname as dirname77, join as join153, normalize as normalize10, resolve as resolve97 } from "node:path";
+import { basename as basename43, dirname as dirname77, join as join153, normalize as normalize11, resolve as resolve97 } from "node:path";
 import { createInterface as createInterface5 } from "node:readline/promises";
 async function getCentralCore() {
   if (!centralCoreInstance) {
@@ -431134,8 +431465,8 @@ Run \`fn project remove ` + match.name + "` to clean up the registry entry.",
   const fusionDir = findKbDir(cwd);
   if (fusionDir) {
     const allProjects2 = await central.listProjects();
-    const normalizedKbDir = normalize10(fusionDir);
-    const match = allProjects2.find((p2) => normalize10(p2.path) === normalizedKbDir);
+    const normalizedKbDir = normalize11(fusionDir);
+    const match = allProjects2.find((p2) => normalize11(p2.path) === normalizedKbDir);
     if (match) {
       if (!existsSync126(match.path)) {
         throw new ProjectResolutionError(