@runfusion/fusion 0.77.0-beta.5 → 0.77.0-beta.6

package/dist/extension.js

@@ -152,10 +152,16 @@ function resolveEntryPointBranchAssignment(input) {
       };
   }
 }
-var isValidTaskBranchName;
+var BranchWriteProvenanceError, isValidTaskBranchName;
 var init_branch_assignment = __esm({
   "../core/src/branch/branch-assignment.ts"() {
     "use strict";
+    BranchWriteProvenanceError = class extends Error {
+      constructor() {
+        super("branchWriteOrigin is required when branch is provided");
+        this.name = "BranchWriteProvenanceError";
+      }
+    };
     isValidTaskBranchName = isValidBranchGroupBranchName;
   }
 });
@@ -4533,8 +4539,8 @@ var init_research_settings = __esm({
 function resolveResearchFindingId(finding) {
   const explicitId = typeof finding.id === "string" ? finding.id.trim() : "";
   if (explicitId) return explicitId;
-  const normalize9 = (value) => value.trim().replace(/\s+/g, " ").toLowerCase();
-  const canonical = [normalize9(finding.heading ?? ""), normalize9(finding.content ?? ""), ...[...finding.sources ?? []].map(normalize9).filter(Boolean).sort()].join("\n");
+  const normalize10 = (value) => value.trim().replace(/\s+/g, " ").toLowerCase();
+  const canonical = [normalize10(finding.heading ?? ""), normalize10(finding.content ?? ""), ...[...finding.sources ?? []].map(normalize10).filter(Boolean).sort()].join("\n");
   let hash3 = 2166136261;
   for (let index2 = 0; index2 < canonical.length; index2 += 1) {
     hash3 ^= canonical.charCodeAt(index2);
@@ -35988,17 +35994,17 @@ var init_agent_store = __esm({
        * @returns Matching agent when unambiguous; otherwise null
        */
       async resolveAgent(shortname) {
-        const normalize9 = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+        const normalize10 = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
         const all = await this.listAgents();
         const exact = all.find((agent) => agent.id === shortname);
         if (exact) {
           return exact;
         }
-        const normalizedTarget = normalize9(shortname);
+        const normalizedTarget = normalize10(shortname);
         if (!normalizedTarget) {
           return null;
         }
-        const matches = all.filter((agent) => normalize9(agent.name) === normalizedTarget);
+        const matches = all.filter((agent) => normalize10(agent.name) === normalizedTarget);
         return matches.length === 1 ? matches[0] : null;
       }
       // ─────────────────────────────────────────────────────────────────────────
@@ -45240,11 +45246,11 @@ function withWindowsNativeBinPath(environment, nativeRoot, platform4 = process.p
   if (platform4 !== "win32") return environment;
   const pathKey = Object.keys(environment).find((key) => key.toLowerCase() === "path") ?? "PATH";
   const bin = nativeRoot.replace(/[\\/]+$/, "") + "\\bin";
-  const normalize9 = (value) => value.replace(/\//g, "\\").toLowerCase();
+  const normalize10 = (value) => value.replace(/\//g, "\\").toLowerCase();
   const inherited = environment[pathKey] ?? "";
   const segments = inherited.split(";").filter(Boolean);
-  const normalizedBin = normalize9(bin);
-  const deduplicated = segments.filter((segment) => normalize9(segment) !== normalizedBin);
+  const normalizedBin = normalize10(bin);
+  const deduplicated = segments.filter((segment) => normalize10(segment) !== normalizedBin);
   return { ...environment, [pathKey]: [bin, ...deduplicated].join(";") };
 }
 function readPostgresPid(dataDir) {
@@ -67193,14 +67199,14 @@ function resolveGlobalDir(dir) {
       const isFusionDirInsideRepo = basename8(dir) === ".fusion" && existsSync14(join19(dirname11(dir), ".git"));
       if (isFusionDirInsideRepo) {
         const homeGlobalDir = resolveGlobalDirForHome(getHomeDir2());
-        const normalize9 = (p2) => {
+        const normalize10 = (p2) => {
           try {
             return realpathSync3.native(p2);
           } catch {
             return resolve13(p2);
           }
         };
-        if (normalize9(dir) !== normalize9(homeGlobalDir)) {
+        if (normalize10(dir) !== normalize10(homeGlobalDir)) {
           throw new Error(
             `resolveGlobalDir(): refusing project-local '.fusion' directory '${dir}' for the central/global store. This would create a stray per-project central database seeded with default global settings and silently reset them. Pass the resolved global dir (or omit the argument so it defaults to ~/.fusion); see TaskStore.getGlobalSettingsDir(). If this really is your intended global dir (e.g. a version-controlled dotfiles repo), set FUSION_ALLOW_PROJECT_LOCAL_GLOBAL_DIR=true to override.`
           );
@@ -87927,15 +87933,15 @@ async function appendRecall(layer, input) {
 async function mergeRecallGraphNodeIds(layer, recordId, addGraphNodeIds) {
   const pid = projectId(layer);
   const table = project_exports.memoryRecallRecords;
-  const normalize9 = (ids) => [...new Set(ids.map((id) => id.trim()).filter(Boolean))].sort();
+  const normalize10 = (ids) => [...new Set(ids.map((id) => id.trim()).filter(Boolean))].sort();
   return layer.transactionImmediate(async (tx) => {
     await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${recallGraphNodeIdsLockKey(pid, recordId)}))`);
     const rows = await tx.select().from(table).where(and(eq(table.projectId, pid), eq(table.id, recordId))).limit(1);
     await recallGraphNodeIdsTestHooks?.afterRowRead?.();
     const row = rows[0];
     if (!row) return { status: "missing" };
-    const stored = normalize9(row.graphNodeIds);
-    const next = normalize9([...stored, ...addGraphNodeIds]);
+    const stored = normalize10(row.graphNodeIds);
+    const next = normalize10([...stored, ...addGraphNodeIds]);
     if (stored.length === next.length && stored.every((value, index2) => value === next[index2])) return { status: "unchanged" };
     await tx.update(table).set({ graphNodeIds: next, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq(table.projectId, pid), eq(table.id, recordId)));
     return { status: "updated" };
@@ -92338,7 +92344,7 @@ import { randomUUID as randomUUID31 } from "node:crypto";
 function normalizeCreateBranchProvenance(input) {
   if (input.branch === void 0) return input;
   if (input.branchWriteOrigin !== "operator" && input.branchWriteOrigin !== "engine") {
-    throw new Error("branchWriteOrigin is required when branch is provided");
+    throw new BranchWriteProvenanceError();
   }
   validateTaskBranchName(input.branch);
   if (input.branchWriteOrigin === "operator") {
@@ -94555,7 +94561,7 @@ async function updateTaskRepositoryScopeImpl(store, id, requestedScope) {
         ...replacement,
         repositories: nextRepositories,
         revision: Math.max((current.repositoryScope?.revision ?? 0) + 1, replacement.revision ?? 0),
-        ...scopeChanged ? { reviewEvidence: void 0 } : {}
+        ...scopeChanged ? { reviewEvidence: void 0, reviewRemediation: void 0 } : {}
       };
       const [updatedRow] = await tx.update(project_exports.tasks).set({
         repositoryScope: normalized2 ?? null,
@@ -94571,6 +94577,35 @@ async function updateTaskRepositoryScopeImpl(store, id, requestedScope) {
     return outcome;
   }));
 }
+async function updateWorkspaceReviewStateImpl(store, id, expectedScopeRevision, reviewRemediation) {
+  return store.withTaskLock(id, async () => {
+    const layer = store.asyncLayer;
+    const outcome = await layer.transactionImmediate(async (tx) => {
+      await acquireTaskAdvisoryXactLock(tx, layer.projectId, id);
+      const row = await readTaskRowInTransaction(tx, id, { includeDeleted: true }, layer.projectId);
+      if (!row) throw new TaskNotFoundError(id);
+      if (row.deletedAt) throw new TaskDeletedError(id, row.deletedAt);
+      const current = store.rowToTask(store.pgRowToTaskRow(row));
+      if (current.repositoryScope?.revision !== expectedScopeRevision) return { task: current, updated: false };
+      const repositoryScope = {
+        ...current.repositoryScope,
+        ...reviewRemediation ? { reviewRemediation } : { reviewRemediation: void 0 }
+      };
+      const [updatedRow] = await tx.update(project_exports.tasks).set({
+        repositoryScope,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }).where(and(eq(project_exports.tasks.id, id), taskProjectScope(layer))).returning();
+      if (!updatedRow) throw new TaskNotFoundError(id);
+      return { task: store.rowToTask(store.pgRowToTaskRow(updatedRow)), updated: true };
+    });
+    if (outcome.updated) {
+      await store.writeTaskJsonFile(store.taskDir(id), outcome.task);
+      if (store.isWatching) store.taskCache.set(id, { ...outcome.task });
+      store.emitTaskLifecycleEventSafely("task:updated", [outcome.task]);
+    }
+    return outcome;
+  });
+}
 async function resolveTaskWedgeNotificationEpisodeImpl(store, id, episodeId) {
   const layer = store.asyncLayer;
   const row = await resolveActiveTaskWedgeEpisodeRow(layer, id, episodeId, (/* @__PURE__ */ new Date()).toISOString());
@@ -103374,7 +103409,7 @@ async function updateTaskUnlockedImpl(store, id, updates, runContext) {
   if (updates.recommendations !== void 0) assertValidRecommendations(updates.recommendations);
   if (updates.branch !== void 0) {
     if (updates.branchWriteOrigin !== "operator" && updates.branchWriteOrigin !== "engine") {
-      throw new Error("branchWriteOrigin is required when branch is provided");
+      throw new BranchWriteProvenanceError();
     }
     if (updates.branch !== null) validateTaskBranchName(updates.branch);
   }
@@ -103463,7 +103498,7 @@ async function updateTaskUnlockedImpl(store, id, updates, runContext) {
       task.repositoryScope = void 0;
     } else if (updates.repositoryScope !== void 0) {
       const scopeRevisionChanged = task.repositoryScope?.revision !== updates.repositoryScope.revision;
-      task.repositoryScope = scopeRevisionChanged ? { ...updates.repositoryScope, reviewEvidence: void 0 } : updates.repositoryScope;
+      task.repositoryScope = scopeRevisionChanged ? { ...updates.repositoryScope, reviewEvidence: void 0, reviewRemediation: void 0 } : updates.repositoryScope;
       if (scopeRevisionChanged) {
         task.workflowStepResults = invalidateSupersededRepositoryScopeReviews(
           task.workflowStepResults,
@@ -105963,6 +105998,9 @@ var init_store = __esm({
       async mutateTaskRepositoryScope(id, mutation) {
         return updateTaskRepositoryScopeImpl(this, id, mutation);
       }
+      async updateWorkspaceReviewState(id, expectedScopeRevision, reviewRemediation) {
+        return updateWorkspaceReviewStateImpl(this, id, expectedScopeRevision, reviewRemediation);
+      }
       async resolveTaskWedgeNotificationEpisode(id, episodeId) {
         return resolveTaskWedgeNotificationEpisodeImpl(this, id, episodeId);
       }
@@ -135970,6 +136008,7 @@ __export(src_exports, {
   BUNDLED_PLUGIN_IDS: () => BUNDLED_PLUGIN_IDS,
   BackupManager: () => BackupManager,
   BackwardCompat: () => BackwardCompat,
+  BranchWriteProvenanceError: () => BranchWriteProvenanceError,
   CENTRAL_BACKUP_SCHEMAS: () => CENTRAL_BACKUP_SCHEMAS,
   CLAUDE_SONNET_5_MODEL_ID: () => CLAUDE_SONNET_5_MODEL_ID,
   CLEAN_COMPLETION_MARKERS: () => CLEAN_COMPLETION_MARKERS,
@@ -157868,8 +157907,8 @@ var require_resolve = __commonJS({
       }
       return count2;
     }
-    function getFullPath(resolver, id = "", normalize9) {
-      if (normalize9 !== false)
+    function getFullPath(resolver, id = "", normalize10) {
+      if (normalize10 !== false)
         id = normalizeId2(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -159209,7 +159248,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize9(uri, options) {
+    function normalize10(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         serialize(parse4(uri, options), options);
@@ -159445,7 +159484,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize9,
+      normalize: normalize10,
       resolve: resolve63,
       resolveComponent,
       equal,
@@ -174866,6 +174905,39 @@ var init_worktrunk_failure_handler = __esm({
   }
 });
 
+// ../engine/src/executor/workspace-review-remediation.ts
+function normalize8(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function resolveWorkspaceReviewRemediationRepository(task, declaredRepositories) {
+  const scope = task.repositoryScope;
+  const remediation = scope?.reviewRemediation;
+  if (!remediation) return void 0;
+  if (scope?.state !== "confirmed" || scope.revision !== remediation.scopeRevision) {
+    throw new Error(`Workspace Code Review remediation target is stale for ${task.id}`);
+  }
+  if (!declaredRepositories.includes(remediation.repository)) {
+    throw new Error(`Workspace Code Review remediation repository ${remediation.repository} is not declared for ${task.id}`);
+  }
+  return remediation.repository;
+}
+function deriveWorkspaceReviewRemediation(result2) {
+  if (typeof result2.repositoryScopeRevision !== "number") return void 0;
+  const blocking = (result2.repositoryReviewOutcomes ?? []).filter((outcome) => outcome.status === "REVIEWED" && (outcome.verdict === "REVISE" || outcome.verdict === "RETHINK")).sort((left, right) => left.repository.localeCompare(right.repository))[0];
+  if (!blocking) return void 0;
+  const findings = (blocking.findings ?? []).map((finding) => `${finding.id}:${normalize8(finding.title)}:${normalize8(finding.body)}`).sort().join("|");
+  return {
+    scopeRevision: result2.repositoryScopeRevision,
+    repository: blocking.repository,
+    inputSignature: `${result2.workflowStepId}\0${blocking.repository}\0${blocking.fingerprint ?? ""}\0${blocking.verdict}\0${findings}`
+  };
+}
+var init_workspace_review_remediation = __esm({
+  "../engine/src/executor/workspace-review-remediation.ts"() {
+    "use strict";
+  }
+});
+
 // ../engine/src/worktree/worktree-copy-files.ts
 import { constants as fsConstants3 } from "node:fs";
 import { access as access7, copyFile as copyFile2, lstat as lstat2, mkdir as mkdir26 } from "node:fs/promises";
@@ -175252,14 +175324,15 @@ function invalidateWorkspaceConfigCache(owner) {
   workspaceConfigEpochs.set(owner, (workspaceConfigEpochs.get(owner) ?? 0) + 1);
 }
 async function normalizeWorkspaceTaskRouting(store, taskId) {
-  const normalize9 = store.normalizeWorkspaceTaskWorktreeMetadata;
-  if (typeof normalize9 === "function") return normalize9.call(store, taskId);
+  const normalize10 = store.normalizeWorkspaceTaskWorktreeMetadata;
+  if (typeof normalize10 === "function") return normalize10.call(store, taskId);
   let task = await store.getTask(taskId);
   if (task.worktree || task.branch || task.executionStartBranch || task.baseCommitSha) {
     if (typeof store.updateTask !== "function") return task;
     await store.updateTask(taskId, {
       worktree: null,
       branch: null,
+      branchWriteOrigin: "engine",
       executionStartBranch: null,
       baseCommitSha: null,
       sessionFile: null
@@ -175461,11 +175534,15 @@ async function ensureWorkspaceGroupOwnership(workspaceContext, settings) {
 async function acquireTaskWorktree(opts) {
   const { task, rootDir, store, settings, pool, logger: logger3, audit, runContext, createWorktree: createWorktree2, runConfiguredCommand: runConfiguredCommand2, runInitCommand, taskEnv, secretsStore, workspaceContext } = opts;
   const persistWorktreeAssignment = async (patch) => {
+    const provenancePatch = patch.branch === void 0 ? patch : {
+      ...patch,
+      branchWriteOrigin: patch.branchWriteOrigin ?? (classifyTaskBranchOrigin(task, patch.branch ?? void 0) === "operator-supplied" ? "operator" : "engine")
+    };
     if (!opts.suppressSingularWorktreePersist) {
-      await store.updateTask(task.id, patch);
+      await store.updateTask(task.id, provenancePatch);
       return;
     }
-    const { worktree: _worktree, branch: _branch, ...nonSingularPatch } = patch;
+    const { worktree: _worktree, branch: _branch, branchWriteOrigin: _origin, ...nonSingularPatch } = provenancePatch;
     if (Object.keys(nonSingularPatch).length > 0) {
       await store.updateTask(task.id, nonSingularPatch);
     }
@@ -175702,7 +175779,22 @@ async function acquireTaskWorktree(opts) {
     }
     worktreePath = created2.path;
     branch = created2.branch;
-    await persistWorktreeAssignment({ worktree: created2.path, branch: created2.branch });
+    try {
+      await persistWorktreeAssignment({ worktree: created2.path, branch: created2.branch });
+    } catch (error3) {
+      try {
+        await removeWorktree({
+          worktreePath: created2.path,
+          rootDir,
+          settings,
+          taskId: task.id,
+          reason: RemovalReason.ExecutorDispose
+        });
+      } catch (cleanupError) {
+        logger3?.warn(`${task.id}: failed to compensate unpersisted worktree ${created2.path}: ${formatError(cleanupError)}`);
+      }
+      throw error3;
+    }
     await audit?.git({ type: "worktree:create", target: created2.path, metadata: { branch: created2.branch, source: logOrigin === "return-guard" ? "acquire-return-guard" : void 0 } });
     await audit?.git({ type: "branch:create", target: created2.branch });
     if (created2.branch !== branchName) {
@@ -175944,6 +176036,17 @@ async function acquireTaskWorktree(opts) {
   if (pinned) {
     return acquirePinnedWorktree();
   }
+  if (!workspaceContext && !task.worktree && !(pool && settings.recycleWorktrees)) {
+    const registeredMatches = (await getRegisteredWorktreeBranches(rootDir)).filter((entry) => entry.branch === branchName);
+    if (registeredMatches.length === 1) {
+      const registeredPath = registeredMatches[0].worktreePath;
+      const classification = await classifyTaskWorktree(rootDir, registeredPath);
+      if (classification.ok) {
+        await persistWorktreeAssignment({ worktree: registeredPath, branch: branchName });
+        return reuseWarmWorktree(registeredPath, branchName, "existing");
+      }
+    }
+  }
   if (task.worktree && isResume) {
     if (logger3?.debug) logger3.debug(`Reusing existing worktree: ${worktreePath}`);
     const cleanup = await removeDesktopBuildArtifacts(worktreePath, logger3);
@@ -175979,6 +176082,7 @@ async function acquireTaskWorktree(opts) {
       }
     }
     if (pooled) {
+      let poolAssignmentPersistenceStarted = false;
       try {
         const preparedRaw = await pool.prepareForTask(pooled, branchName, freshStartPoint, {
           allowSiblingBranchRename,
@@ -176036,7 +176140,9 @@ async function acquireTaskWorktree(opts) {
           });
           acquiredFromPool = true;
           logger3?.log(`Acquired worktree from pool: ${worktreePath}`);
+          poolAssignmentPersistenceStarted = true;
           await persistWorktreeAssignment({ worktree: worktreePath, branch });
+          poolAssignmentPersistenceStarted = false;
           await audit?.git({ type: "worktree:reuse", target: worktreePath, metadata: { branch, reclaimed: prepared.reclaimed } });
           if (prepared.reclaimed) {
             await store.logEntry(task.id, `Acquired reclaimed worktree from pool: ${worktreePath} (${prepared.strandedCommitCount ?? 0} commits preserved)`, void 0, runContext);
@@ -176090,6 +176196,10 @@ async function acquireTaskWorktree(opts) {
           });
         }
       } catch (poolErr) {
+        if (poolAssignmentPersistenceStarted) {
+          pool.release(pooled, task.id);
+          throw poolErr;
+        }
         if (poolErr instanceof WorktreeBaseRefreshError) {
           await persistWorktreeAssignment({ worktree: null, branch: null, branchWriteOrigin: "engine", sessionFile: null });
           pool.release(pooled, task.id);
@@ -176401,7 +176511,11 @@ async function acquireWorkspaceTaskWorktrees(opts) {
     current = await opts.store.getTask(opts.task.id);
   }
   const entries = current.workspaceWorktrees ?? {};
-  const coordinatorWorktreePath = repoRelPaths.map((repoRelPath) => entries[repoRelPath]?.worktreePath).find((path13) => typeof path13 === "string" && path13.length > 0);
+  const remediationRepository = resolveWorkspaceReviewRemediationRepository(current, repoRelPaths);
+  if (opts.remediationRepository !== remediationRepository) {
+    throw new Error(`Workspace Code Review remediation target changed during acquisition for ${opts.task.id}`);
+  }
+  const coordinatorWorktreePath = remediationRepository ? entries[remediationRepository]?.worktreePath : repoRelPaths.map((repoRelPath) => entries[repoRelPath]?.worktreePath).find((path13) => typeof path13 === "string" && path13.length > 0);
   if (!coordinatorWorktreePath) {
     throw new Error(`Workspace task ${opts.task.id} did not acquire a declared repository worktree`);
   }
@@ -176422,6 +176536,7 @@ var init_worktree_acquisition = __esm({
     init_worktree_backend();
     init_worktrunk_installer();
     init_worktrunk_failure_handler();
+    init_workspace_review_remediation();
     init_secrets_env_writer();
     init_worktree_desktop_artifacts();
     init_worktree_hooks();
@@ -191255,7 +191370,7 @@ var init_agent_memory_index = __esm({
 // ../engine/src/agents/agent-instructions.ts
 import { readFile as readFile42, writeFile as writeFile28, mkdir as mkdir29, access as access9 } from "node:fs/promises";
 import { constants as fsConstants4 } from "node:fs";
-import { isAbsolute as isAbsolute16, resolve as resolve40, relative as relative15, normalize as normalize8, sep as sep12, dirname as dirname31 } from "node:path";
+import { isAbsolute as isAbsolute16, resolve as resolve40, relative as relative15, normalize as normalize9, sep as sep12, dirname as dirname31 } from "node:path";
 function trimAndClamp(value, maxLength, label, agentId) {
   const trimmed = value.trim();
   if (!trimmed) {
@@ -191289,7 +191404,7 @@ function resolveValidatedMarkdownPath(rawPath, rootDir, agentId, fieldLabel) {
     log26.warn(`${fieldLabel} must be project-relative for agent ${agentId}: ${trimmed}`);
     return null;
   }
-  const normalized2 = normalize8(trimmed);
+  const normalized2 = normalize9(trimmed);
   if (isPathTraversal2(normalized2)) {
     log26.warn(`${fieldLabel} traversal is not allowed for agent ${agentId}: ${trimmed}`);
     return null;
@@ -200052,8 +200167,8 @@ async function autoRecoverWorktreeSessionStartFailure(store, task, opts) {
   }
   const workspaceTask = configuredWorkspace || isWorkspaceTask(task);
   if (workspaceTask) {
-    const normalize9 = store.normalizeWorkspaceTaskWorktreeMetadata;
-    if (typeof normalize9 === "function") task = await normalize9.call(store, task.id);
+    const normalize10 = store.normalizeWorkspaceTaskWorktreeMetadata;
+    if (typeof normalize10 === "function") task = await normalize10.call(store, task.id);
   }
   const resetRetryBudget = opts.resetRetryBudgetOnStaleMetadataClear === true;
   const staleMetadataClearRecoveryRetryCount = opts.staleMetadataClearRecoveryRetryCount;
@@ -200108,7 +200223,13 @@ async function autoRecoverWorktreeSessionStartFailure(store, task, opts) {
     worktreeSessionRetryCount: nextCount,
     ...nextStaleMetadataClearRecoveryCount === void 0 ? {} : { recoveryRetryCount: nextStaleMetadataClearRecoveryCount },
     worktree: clearWorktreeMetadata ? null : staleWorktree,
-    branch: nextBranch,
+    /*
+     * FNXC:BranchNaming 2026-08-21-09:36:
+     * Session recovery often changes only worktree/session metadata. Do not reassert an unchanged
+     * branch with engine provenance: that would erase a matching operator override and later make
+     * its branch eligible for engine cleanup. A real canonical clear remains an explicit engine write.
+     */
+    ...(task.branch ?? null) === nextBranch ? {} : { branch: nextBranch, branchWriteOrigin: "engine" },
     sessionFile: null
   });
   await opts.auditor?.database({
@@ -209837,7 +209958,8 @@ async function tryEarlyEmptyOwnDiffFinalize(input) {
     try {
       await store.updateTask(taskId, {
         worktree: worktreeRemoved ? null : task.worktree,
-        branch: branchDeleted ? null : task.branch
+        branch: branchDeleted ? null : task.branch,
+        ...branchDeleted ? { branchWriteOrigin: "engine" } : {}
       });
       if (worktreeRemoved) task.worktree = void 0;
       if (branchDeleted) task.branch = void 0;
@@ -210197,7 +210319,7 @@ async function aiMergeTask(store, rootDir, taskId, options = {}) {
             rootDir,
             integrationBranch: mergeTarget.branch
           });
-          await store.updateTask(taskId, { worktree: reusableMatch.path, branch: reusableMatch.branch });
+          await store.updateTask(taskId, { worktree: reusableMatch.path, branch: reusableMatch.branch, branchWriteOrigin: "engine" });
           await emitReuseHandoffAuditEvent(
             "merge:reuse-fallback-reused-existing-registration",
             {
@@ -217757,7 +217879,7 @@ var init_self_healing = __esm({
                 } catch {
                 }
               }
-              const patch = preservedWorktree ? { branch: selected.branch } : { branch: selected.branch, worktree: null };
+              const patch = preservedWorktree ? { branch: selected.branch, branchWriteOrigin: "engine" } : { branch: selected.branch, branchWriteOrigin: "engine", worktree: null };
               if (!task.baseCommitSha) {
                 const derivedBaseCommit = (await execAsync18(
                   `git merge-base ${shellQuote2(integrationBase)} ${shellQuote2(selected.branch)}`,
@@ -221434,6 +221556,12 @@ var init_self_healing = __esm({
                 await this.emitWorkspacePartialLandNoAction(task, "merge-pending", liveness.livePaths);
                 continue;
               }
+              const latestTask = await this.store.getTask(task.id).catch(() => null);
+              const blockerTask = latestTask?.status === "failed" && latestTask.error?.startsWith("Workspace partial land:") ? { ...latestTask, status: null, error: void 0 } : latestTask;
+              if (!blockerTask || getTaskMergeBlocker(blockerTask, { skipColumnIdentityCheck: true }) !== void 0) {
+                await this.emitWorkspacePartialLandNoAction(task, "merge-blocked", []);
+                continue;
+              }
               const workspaceWorktrees = task.workspaceWorktrees ?? {};
               const explicitScope = task.repositoryScope?.state === "confirmed" ? task.repositoryScope.repositories : void 0;
               if (!explicitScope) {
@@ -221441,8 +221569,12 @@ var init_self_healing = __esm({
                 continue;
               }
               const repoKeys = Object.keys(workspaceWorktrees).filter(
-                (repoRel) => explicitScope.includes(repoRel) && (task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`))
+                (repoRel) => explicitScope.includes(repoRel) && ((task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`)) || Boolean(workspaceWorktrees[repoRel]?.landedSha))
               );
+              if (repoKeys.length === 0) {
+                await this.emitWorkspacePartialLandNoAction(task, "empty-obligations", []);
+                continue;
+              }
               const landedRepos = [];
               const unlandedRepos = [];
               const unrecoverableRepos = [];
@@ -221499,13 +221631,12 @@ var init_self_healing = __esm({
                 phase: "reconcile-workspace-partial-land"
               });
               if (evidenceUnavailableRepos.length > 0) {
-                const defers = (this.workspacePartialLandEvidenceDefers.get(task.id) ?? 0) + 1;
-                this.workspacePartialLandEvidenceDefers.set(task.id, defers);
+                const defers = (task.mergeTransientRetryCount ?? 0) + 1;
+                await this.store.updateTask(task.id, { mergeTransientRetryCount: defers });
                 if (defers >= MAX_STARVATION_DROPS) {
                   const error3 = `Workspace partial-land evidence unavailable: branch state could not be read after ${MAX_STARVATION_DROPS} sweeps for sub-repo(s) ${evidenceUnavailableRepos.join(", ")} \u2014 manual intervention required.`;
                   await this.store.updateTask(task.id, { status: "failed", error: error3 });
                   await this.store.logEntry(task.id, error3);
-                  this.workspacePartialLandEvidenceDefers.delete(task.id);
                   await auditor.database({
                     type: "task:reconcile-workspace-partial-land",
                     target: task.id,
@@ -221518,7 +221649,6 @@ var init_self_healing = __esm({
                 }
                 continue;
               }
-              this.workspacePartialLandEvidenceDefers.delete(task.id);
               if (unrecoverableRepos.length > 0) {
                 const missingBranches = unrecoverableRepos.map((repoRel) => workspaceWorktrees[repoRel]?.branch ?? resolveTaskWorkingBranch(task)).join(", ");
                 const error3 = `Workspace partial-land unrecoverable: sub-repo(s) ${unrecoverableRepos.join(", ")} have no branch (${missingBranches}) and no landedSha \u2014 manual intervention required.`;
@@ -221546,7 +221676,7 @@ var init_self_healing = __esm({
                   landedRepos,
                   unlandedRepos: [],
                   reason: "all-landed-not-finalized",
-                  successLog: "Auto-recovered (workspace): all sub-repos landed but task not finalized \u2014 re-enqueued finalize-once"
+                  successLog: "Workspace merge recovery scheduled: all sub-repositories have proven landing evidence; awaiting finalize-once result"
                 });
                 recovered++;
                 continue;
@@ -221555,7 +221685,7 @@ var init_self_healing = __esm({
                 landedRepos,
                 unlandedRepos,
                 reason: landedRepos.length > 0 ? "partial-land" : "zero-land",
-                successLog: `Auto-recovered (workspace): re-enqueued partial land (${landedRepos.length} landed, ${unlandedRepos.length} pending)`
+                successLog: `Workspace merge recovery scheduled: ${landedRepos.length} landed, ${unlandedRepos.length} pending`
               });
               recovered++;
             } catch (err) {
@@ -221620,7 +221750,8 @@ var init_self_healing = __esm({
           }).catch(() => void 0);
           return false;
         }
-        const drops = (this.workspacePartialLandDrops.get(task.id) ?? 0) + 1;
+        const drops = (task.mergeTransientRetryCount ?? 0) + 1;
+        await this.store.updateTask(task.id, { mergeTransientRetryCount: drops });
         this.workspacePartialLandDrops.set(task.id, drops);
         log34.warn(`reconcileWorkspacePartialLands: enqueue dropped for ${task.id} (${drops}/${MAX_STARVATION_DROPS}); merge queue rejected re-enqueue`);
         if (drops >= MAX_STARVATION_DROPS) {
@@ -231216,7 +231347,7 @@ function recoverPassedPlanReviewFromLatestLog(task) {
     completedAt: latest.timestamp
   };
 }
-var PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE, PLAN_REVIEW_LEASE_HELD_VALUE, SESSION_CONTENTION_HOLD_VALUE, WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY, WORKFLOW_INTERRUPTED_NODE_ABORT_KIND_CONTEXT_KEY, WORKFLOW_OPTIONAL_GROUP_CONTEXT_KEY, WORKFLOW_REVIEW_KIND_CONTEXT_KEY, WORKFLOW_NODE_ENGINE_PAUSE_ABORT_KIND, WORKFLOW_DRIFT_PARK_CONTEXT_KEY, WorkflowGraphSuspended, MERGE_REGION_KINDS, WorkflowGraphExecutor;
+var PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE, BRANCH_WRITE_PROVENANCE_FAILURE_VALUE, PLAN_REVIEW_LEASE_HELD_VALUE, SESSION_CONTENTION_HOLD_VALUE, WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY, WORKFLOW_INTERRUPTED_NODE_ABORT_KIND_CONTEXT_KEY, WORKFLOW_OPTIONAL_GROUP_CONTEXT_KEY, WORKFLOW_REVIEW_KIND_CONTEXT_KEY, WORKFLOW_NODE_ENGINE_PAUSE_ABORT_KIND, WORKFLOW_DRIFT_PARK_CONTEXT_KEY, WorkflowGraphSuspended, MERGE_REGION_KINDS, WorkflowGraphExecutor;
 var init_workflow_graph_executor = __esm({
   "../engine/src/workflows/workflow-graph-executor.ts"() {
     "use strict";
@@ -231229,8 +231360,10 @@ var init_workflow_graph_executor = __esm({
     init_workflow_graph_foreach();
     init_workflow_graph_loop();
     init_workflow_node_execution_needs();
+    init_src2();
     init_worktree_acquisition();
     PLAN_REVIEW_PROVIDER_FAILURE_HOLD_VALUE = "plan-review-provider-failure-hold";
+    BRANCH_WRITE_PROVENANCE_FAILURE_VALUE = "branch-write-provenance-failure";
     PLAN_REVIEW_LEASE_HELD_VALUE = "plan-review-lease-held";
     SESSION_CONTENTION_HOLD_VALUE = "session-contention-hold";
     WORKFLOW_INTERRUPTED_NODE_ID_CONTEXT_KEY = "workflow:interruptedNodeId";
@@ -232147,7 +232280,7 @@ var init_workflow_graph_executor = __esm({
         const failureResult = {
           outcome: "failure",
           // FNXC:SessionContention 2026-07-25-21:30: contention is a retryable hold, not an exception.
-          value: isSessionContentionError(lastErrorText) ? SESSION_CONTENTION_HOLD_VALUE : "exception",
+          value: lastError instanceof BranchWriteProvenanceError ? BRANCH_WRITE_PROVENANCE_FAILURE_VALUE : isSessionContentionError(lastErrorText) ? SESSION_CONTENTION_HOLD_VALUE : "exception",
           contextPatch: {
             [`node:${node.id}:error`]: lastErrorText
           }
@@ -236235,6 +236368,7 @@ async function handleBranchConflict(deps, task, error3) {
       status: "failed",
       error: conflictMessage,
       branch: error3.branchName,
+      branchWriteOrigin: "engine",
       worktree: error3.conflictingWorktreePath,
       paused: true,
       pausedReason: "branch-conflict-unrecoverable"
@@ -236290,8 +236424,8 @@ async function recoverMissingWorktreeSessionStartFailure(deps, task, worktreePat
   }
   let recoveryTask = task;
   if (workspaceTask) {
-    const normalize9 = deps.store.normalizeWorkspaceTaskWorktreeMetadata;
-    if (typeof normalize9 === "function") recoveryTask = await normalize9.call(deps.store, task.id);
+    const normalize10 = deps.store.normalizeWorkspaceTaskWorktreeMetadata;
+    if (typeof normalize10 === "function") recoveryTask = await normalize10.call(deps.store, task.id);
   }
   if (!workspaceTask && isInsideWorktreesDir(deps.rootDir, staleWorktreePath)) {
     try {
@@ -236709,8 +236843,21 @@ async function detectWorkspaceMainCheckoutWork(deps, task, repos, declaredScope)
       const { stdout } = await execAsync41("git log -n 200 --format=%H%x1f%ct%x1f%B%x1e HEAD", { ...probeOptions, cwd: checkout });
       const attributed = new RegExp(`(?:${task.id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|Fusion-Task-Id:\\s*${task.id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")})`, "i");
       for (const commit of parseCommits(stdout)) {
-        const evidence = attributed.test(commit.body) ? "task-attributed-commit" : anchor !== null && commit.committedAt >= anchor ? "post-anchor-commit" : null;
-        if (evidence) violations.push({ repo, files: [], commits: [commit.sha], evidence });
+        const entry = workspaceWorktrees[repo];
+        const recordedLanding = entry?.landedSha === commit.sha || task.mergeDetails?.workspaceLandedShas?.[repo] === commit.sha || task.mergeDetails?.commitSha === commit.sha;
+        let reachableFromBaseline = false;
+        if (entry?.baseCommitSha) {
+          try {
+            await execAsync41(`git merge-base --is-ancestor ${commit.sha} ${entry.baseCommitSha}`, { ...probeOptions, cwd: checkout });
+            reachableFromBaseline = true;
+          } catch {
+          }
+        }
+        if (attributed.test(commit.body) && !recordedLanding && !reachableFromBaseline && anchor !== null && commit.committedAt >= anchor) {
+          violations.push({ repo, files: [], commits: [commit.sha], evidence: "task-attributed-commit" });
+        } else if (!recordedLanding && !reachableFromBaseline && anchor !== null && commit.committedAt >= anchor) {
+          warnings.push({ repo, files: [], commits: [commit.sha], reason: "pre-existing-dirt" });
+        }
       }
     } catch {
       warnings.push({ repo, files: [], commits: [], reason: "commit-scan-unavailable" });
@@ -236790,7 +236937,7 @@ async function verifyWorktreeInvariants(deps, task, worktreePathOverride, allowR
         reason: "main_checkout_edit",
         repo: firstMainCheckoutViolation.repo,
         observed: `${firstMainCheckoutViolation.evidence}: ${observed}`,
-        expected: `move task work into the acquired fusion/${task.id} worktree for ${firstMainCheckoutViolation.repo} (acquire it first if needed), restore its main checkout, then retry fn_task_done; only 3 requeue attempts are available`
+        expected: `move task work into the acquired fusion/${task.id} worktree for ${firstMainCheckoutViolation.repo} (acquire it first if needed), restore its main checkout, then ask an operator to retry fn_task_done`
       };
     }
     const zeroAcquire = classifyWorkspaceZeroAcquire(task, {
@@ -238273,7 +238420,7 @@ var init_workflow_step_failure_injection = __esm({
 });
 
 // ../engine/src/executor/send-task-back-for-fix.ts
-async function sendTaskBackForFix(deps, task, worktreePath, failureFeedback, stepName, reason, preserveResumeState = true, mergeVerificationFailure = false, retryPresentation, findings) {
+async function sendTaskBackForFix(deps, task, worktreePath, failureFeedback, stepName, reason, preserveResumeState = true, mergeVerificationFailure = false, retryPresentation, findings, persistWorktreePath) {
   const taskId = task.id;
   deps.clearCompletedTaskWatchdog(taskId);
   const { task: authoritativeRemediationTask, route: externalExecutionRoute } = await resolveAuthoritativeExternalExecutionRoute(deps.store, task);
@@ -238316,7 +238463,7 @@ Please fix the issues so the verification can pass on the next attempt.`,
     remediationWorktreePath,
     `${taskId}: sent back to in-progress for remediation`,
     preserveResumeState,
-    !externalExecutionRoute.configured
+    persistWorktreePath ?? !externalExecutionRoute.configured
   );
 }
 var init_send_task_back_for_fix = __esm({
@@ -243412,6 +243559,7 @@ async function ensureGraphCustomNodeWorktree(deps, task, settings, nodeId, refre
       deps.getRunContextFor(task.id)
     );
     if (workspaceConfig) {
+      const remediationRepository = resolveWorkspaceReviewRemediationRepository(task, workspaceConfig.repos);
       const workspace = await acquireWorkspaceTaskWorktrees({
         workspaceConfig,
         workspaceRootDir: deps.rootDir,
@@ -243436,7 +243584,8 @@ async function ensureGraphCustomNodeWorktree(deps, task, settings, nodeId, refre
           return result2;
         }),
         taskEnv: process.env,
-        addActiveWorktree: deps.addActiveWorktree
+        addActiveWorktree: deps.addActiveWorktree,
+        remediationRepository
       });
       deps.onStart?.(workspace.task, workspace.coordinatorWorktreePath);
       executorLog.debug(`${task.id}: workflow node '${nodeId}' using workspace coordinator ${workspace.coordinatorWorktreePath}`);
@@ -243500,6 +243649,7 @@ var init_ensure_graph_custom_node_worktree = __esm({
     init_worktree_git_refs();
     init_task_predicates();
     init_workspace_config_resolver();
+    init_workspace_review_remediation();
   }
 });
 
@@ -244088,7 +244238,22 @@ ${info.feedback}`,
     return false;
   }
   const revisionKey = optionalStepRevisionKey2(info.nodeId, info.stepName);
-  if (hasRepeatedUnchangedCodeReview(liveTask, info)) {
+  const reviewResult = (liveTask.workflowStepResults ?? []).find(
+    (result2) => (result2.workflowStepId === info.nodeId || result2.workflowStepName === info.stepName) && result2.verdict === "REVISE"
+  );
+  const derivedRemediation = reviewResult ? deriveWorkspaceReviewRemediation(reviewResult) : void 0;
+  const remediation = derivedRemediation && liveTask.workspaceWorktrees ? derivedRemediation : void 0;
+  const priorRemediation = liveTask.repositoryScope?.reviewRemediation;
+  const hasDurableRepeatedWorkspaceReview = remediation !== void 0 && priorRemediation?.scopeRevision === remediation.scopeRevision && priorRemediation.repository === remediation.repository && priorRemediation.inputSignature === remediation.inputSignature;
+  const updateWorkspaceReviewState = deps.store.updateWorkspaceReviewState;
+  if (remediation && !hasDurableRepeatedWorkspaceReview && updateWorkspaceReviewState) {
+    const persisted = await updateWorkspaceReviewState.call(deps.store, taskId, remediation.scopeRevision, remediation);
+    if (!persisted.updated) {
+      executorLog.warn(`${taskId}: workspace Code Review remediation was superseded by a repository scope change.`);
+      return false;
+    }
+  }
+  if (hasDurableRepeatedWorkspaceReview || (!remediation || !updateWorkspaceReviewState) && hasRepeatedUnchangedCodeReview(liveTask, info)) {
     const runContext = deps.getRunContextFor(taskId);
     await deps.store.logEntry(
       taskId,
@@ -244136,9 +244301,18 @@ Feedback:
 ${info.feedback}`, revisionKey),
     deps.getRunContextFor(taskId)
   );
-  await deps.sendTaskBackForFix(
+  const remediationWorktreePath = remediation ? liveTask.workspaceWorktrees?.[remediation.repository]?.worktreePath : liveTask.worktree;
+  if (remediation && !remediationWorktreePath) {
+    await deps.store.updateTask(taskId, {
+      status: "awaiting-approval",
+      awaitingApprovalReason: "code-review-non-convergence",
+      error: `Workspace Code Review remediation target ${remediation.repository} has no acquired worktree.`
+    });
+    return false;
+  }
+  const sendArgs = [
     liveTask,
-    liveTask.worktree ?? "",
+    remediationWorktreePath ?? "",
     info.feedback,
     info.stepName,
     `Pre-merge optional workflow step "${info.stepName}" requested revision`,
@@ -244146,7 +244320,12 @@ ${info.feedback}`, revisionKey),
     false,
     { attempt: nextCount, max: budget.unbounded ? void 0 : budget.max },
     info.findings
-  );
+  ];
+  if (remediation) {
+    await deps.sendTaskBackForFix(...sendArgs, false);
+  } else {
+    await deps.sendTaskBackForFix(...sendArgs);
+  }
   return true;
 }
 var init_request_pre_merge_optional_step_fix = __esm({
@@ -244161,6 +244340,7 @@ var init_request_pre_merge_optional_step_fix = __esm({
     init_plan_review_feedback_history();
     init_logger3();
     init_emit_bounded_run_audit3();
+    init_workspace_review_remediation();
   }
 });
 
@@ -245049,6 +245229,14 @@ function createTaskDoneTool(deps, taskId, worktreePath, promptContent, codeRevie
         const refusalMessage = `fn_task_done refused: ${invariantCheck.reason} \u2014 observed=${invariantCheck.observed}, expected=${invariantCheck.expected}`;
         await store.logEntry(taskId, refusalMessage, void 0, deps.getRunContextFor(task.id));
         executorLog.error(`${taskId}: fn_task_done refused (${invariantCheck.reason}) \u2014 observed=${invariantCheck.observed}, expected=${invariantCheck.expected}`);
+        if (invariantCheck.reason === "main_checkout_edit") {
+          await store.updateTask(taskId, { status: "failed", error: refusalMessage });
+          await store.logEntry(taskId, `${refusalMessage} \u2014 operator cleanup and Retry are required; executor retry budget preserved`, void 0, deps.getRunContextFor(task.id));
+          return {
+            content: [{ type: "text", text: refusalMessage }],
+            details: { error: refusalMessage }
+          };
+        }
         const priorRequeues = task.taskDoneRetryCount ?? 0;
         const nextRequeueCount = priorRequeues + 1;
         if (priorRequeues < MAX_TASK_DONE_REQUEUE_RETRIES) {
@@ -246881,7 +247069,9 @@ Repository scope (task-level; review this plan once): ${detail.repositoryScope?.
           return {
             repositoryScope: {
               ...currentScope,
-              reviewEvidence: Object.fromEntries(Object.entries(review.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }]))
+              reviewEvidence: Object.fromEntries(Object.entries(review.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }])),
+              // FNXC:WorkspaceFinalization 2026-08-21-09:50: An APPROVE for this fenced scope ends its REVISE episode; retaining its target would misroute later acquisition.
+              ...currentScope.reviewRemediation?.scopeRevision === review.repositoryScopeRevision ? { reviewRemediation: void 0 } : {}
             }
           };
         });
@@ -248286,7 +248476,8 @@ async function runGraphCustomNode(deps, node, nodeTask, settings, columnBinding,
       executionTarget = await deps.ensureGraphCustomNodeWorktree(acquisitionTask, settings, node.id);
     }
   }
-  const workspaceCoordinator = workspaceConfig ? Object.keys(executionTarget.workspaceWorktrees ?? {}).filter((repoRelPath) => workspaceConfig.repos.includes(repoRelPath)).sort().map((repoRelPath) => executionTarget.workspaceWorktrees?.[repoRelPath]?.worktreePath).find((path13) => typeof path13 === "string" && path13.length > 0) : void 0;
+  const remediationRepository = workspaceConfig ? resolveWorkspaceReviewRemediationRepository(executionTarget, workspaceConfig.repos) : void 0;
+  const workspaceCoordinator = workspaceConfig ? remediationRepository ? executionTarget.workspaceWorktrees?.[remediationRepository]?.worktreePath : Object.keys(executionTarget.workspaceWorktrees ?? {}).filter((repoRelPath) => workspaceConfig.repos.includes(repoRelPath)).sort().map((repoRelPath) => executionTarget.workspaceWorktrees?.[repoRelPath]?.worktreePath).find((path13) => typeof path13 === "string" && path13.length > 0) : void 0;
   if (!executionTarget.worktree && !workspaceCoordinator) {
     return { outcome: "failure", value: "no-worktree-for-write-node" };
   }
@@ -248446,7 +248637,9 @@ ${prompt}`;
           return {
             repositoryScope: {
               ...currentScope,
-              reviewEvidence: Object.fromEntries(Object.entries(aggregate.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }]))
+              reviewEvidence: Object.fromEntries(Object.entries(aggregate.repositoryDiffFingerprints).map(([repo, fingerprint]) => [repo, { fingerprint, approvedAt }])),
+              // FNXC:WorkspaceFinalization 2026-08-21-09:50: A current-scope APPROVE clears the durable REVISE coordinator before graph completion can schedule another run.
+              ...currentScope.reviewRemediation?.scopeRevision === aggregate.repositoryScopeRevision ? { reviewRemediation: void 0 } : {}
             }
           };
         });
@@ -248544,6 +248737,7 @@ var init_run_graph_custom_node = __esm({
     "use strict";
     init_src2();
     init_logger3();
+    init_workspace_review_remediation();
     init_workflow_graph_executor();
     init_workflow_node_execution_needs();
     init_workflow_step_verdict();
@@ -248599,6 +248793,13 @@ async function handleGraphFailure(deps, task, result2) {
       await deps.persistTokenUsage(task.id);
       return;
     }
+    if (graphFailureValue(result2) === BRANCH_WRITE_PROVENANCE_FAILURE_VALUE) {
+      const diagnostic = graphFailureErrorTexts(result2).find((message2) => message2.includes("branchWriteOrigin is required when branch is provided")) ?? "branchWriteOrigin is required when branch is provided";
+      await deps.store.logEntry(task.id, diagnostic, void 0, deps.getRunContextFor(task.id));
+      await deps.store.updateTask(task.id, { status: "failed", error: diagnostic }, deps.getRunContextFor(task.id));
+      await deps.persistTokenUsage(task.id);
+      return;
+    }
     if (isSessionContentionGraphFailure(result2)) {
       await deps.holdForSessionContention(task, live, result2);
       await deps.persistTokenUsage(task.id);
@@ -251336,6 +251537,7 @@ async function runImplementation(deps, task, graphCompletion, reportImplementati
     deps.registerConfiguredCommandController(task.id, taskCommandAbortController);
     let workspaceCoordinatorWorktree;
     if (hasWorkspaceRepos && deps.workspaceConfig) {
+      const remediationRepository = resolveWorkspaceReviewRemediationRepository(task, deps.workspaceConfig.repos);
       const workspace = await acquireWorkspaceTaskWorktrees({
         workspaceConfig: deps.workspaceConfig,
         workspaceRootDir: deps.rootDir,
@@ -251360,7 +251562,8 @@ async function runImplementation(deps, task, graphCompletion, reportImplementati
           return result2;
         }),
         taskEnv,
-        addActiveWorktree: deps.addActiveWorktree
+        addActiveWorktree: deps.addActiveWorktree,
+        remediationRepository
       });
       task = workspace.task;
       workspaceCoordinatorWorktree = workspace.coordinatorWorktreePath;
@@ -253920,6 +254123,7 @@ var init_run_implementation = __esm({
     init_run_audit();
     init_emit_bounded_run_audit3();
     init_worktree_acquisition();
+    init_workspace_review_remediation();
     init_worktree_paths();
     init_worktree_pool();
     execAsync52 = promisify75(exec56);
@@ -262827,6 +263031,40 @@ var init_overseer_noop_finalize_veto = __esm({
   }
 });
 
+// ../engine/src/merge/workspace-merge-readiness.ts
+function resolveWorkspaceMergeReadiness(task, freshModifiedRepositories, netZeroBranchRepositories) {
+  const scope = task.repositoryScope;
+  if (scope?.state !== "confirmed") {
+    return { kind: "blocked", reason: `Workspace repository scope is unresolved for ${task.id}; operator confirmation is required before landing` };
+  }
+  const entries = task.workspaceWorktrees ?? {};
+  const declaredRepositories = scope.repositories.map((repository) => repository.trim());
+  if (declaredRepositories.some((repository) => !repository) || new Set(declaredRepositories).size !== declaredRepositories.length) {
+    return { kind: "blocked", reason: `Workspace repository scope has duplicate or invalid declarations for ${task.id}; operator repair is required` };
+  }
+  const worktreePaths = Object.values(entries).map((entry) => entry.worktreePath?.trim()).filter((path13) => Boolean(path13));
+  if (new Set(worktreePaths).size !== worktreePaths.length) {
+    return { kind: "blocked", reason: `Workspace merge has duplicate worktree paths for ${task.id}; operator repair is required` };
+  }
+  const repositories = declaredRepositories.filter((repo) => Boolean(entries[repo])).filter((repo) => freshModifiedRepositories.has(repo) || netZeroBranchRepositories.has(repo) || Boolean(entries[repo]?.landedSha)).sort();
+  const preservedFiles = [...new Set(task.modifiedFiles ?? [])].sort();
+  if (repositories.length > 0) return { kind: "ready", repositories, preservedFiles };
+  if (task.noCommitsExpected === true && scope.repositories.length === 0) {
+    return { kind: "no-op", repositories: [], preservedFiles: [] };
+  }
+  const declared = [...declaredRepositories].sort();
+  const knownEntries = declared.filter((repo) => entries[repo] !== void 0);
+  if (knownEntries.length === 0) {
+    return { kind: "blocked", reason: `Workspace merge has no acquired repositories matching confirmed scope for ${task.id}; operator repair is required` };
+  }
+  return { kind: "blocked", reason: `Workspace merge has no evidenced landing obligations for ${task.id}; operator repair is required` };
+}
+var init_workspace_merge_readiness = __esm({
+  "../engine/src/merge/workspace-merge-readiness.ts"() {
+    "use strict";
+  }
+});
+
 // ../engine/src/merge/workspace-fence-ref.ts
 import { execFile as execFile32 } from "node:child_process";
 import { createHash as createHash33 } from "node:crypto";
@@ -264591,8 +264829,21 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
   const taskTitle = task.title?.trim() ? task.title.split("\n")[0] : void 0;
   const liveMergeBoundaryTask = await store.getTask(taskId).catch(() => void 0);
   const mergeBoundaryTask = liveMergeBoundaryTask?.workspaceWorktrees ? liveMergeBoundaryTask : task;
+  const reviewColumns = /* @__PURE__ */ new Set(["in-review"]);
+  const workflowIr = await resolveWorkflowIrForTask(store, taskId).catch(() => void 0);
+  if (workflowIr) for (const column of resolveReviewColumns(workflowIr)) reviewColumns.add(column);
+  const completeColumns = /* @__PURE__ */ new Set(["done"]);
+  if (workflowIr) for (const column of resolveTerminalColumns(workflowIr)) completeColumns.add(column);
+  if (!completeColumns.has(mergeBoundaryTask.column)) {
+    const mergeBlocker = getTaskMergeBlocker(mergeBoundaryTask, {
+      manual: options.manual === true,
+      reviewColumns
+    });
+    if (mergeBlocker) throw new WorkspaceFinalizeBlockedError(taskId, mergeBlocker);
+  }
   const confirmedScope = mergeBoundaryTask.repositoryScope?.state === "confirmed" ? new Set(mergeBoundaryTask.repositoryScope.repositories) : void 0;
   const mergeBoundaryModifiedFiles = [];
+  const mergeBoundaryModifiedRepositories = /* @__PURE__ */ new Set();
   const mergeBoundaryFingerprints = {};
   const modifiedOutOfScopeRepositories = /* @__PURE__ */ new Set();
   const netZeroBranchRepositories = /* @__PURE__ */ new Set();
@@ -264609,6 +264860,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       if (files.length > 0 && !confirmedScope?.has(repoRel)) {
         modifiedOutOfScopeRepositories.add(repoRel);
       } else if (confirmedScope?.has(repoRel)) {
+        if (files.length > 0) mergeBoundaryModifiedRepositories.add(repoRel);
         mergeBoundaryModifiedFiles.push(...files.map((file) => `${repoRel}/${file}`));
         if (files.length === 0) {
           const { stdout: aheadCount } = await execFileAsync28("git", ["rev-list", "--count", `HEAD..${entry.branch}`], { cwd: entry.worktreePath, encoding: "utf8" });
@@ -264624,19 +264876,26 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
   }
   const normalizedMergeBoundaryFiles = [...new Set(mergeBoundaryModifiedFiles)].sort();
   const persistedReviewFiles = [...new Set(mergeBoundaryTask.modifiedFiles ?? [])].sort();
-  const approvedReviewEvidence = mergeBoundaryTask.repositoryScope?.reviewEvidence ?? {};
-  const missingOrStaleReviewApproval = Object.entries(mergeBoundaryFingerprints).some(([repoRel, fingerprint]) => approvedReviewEvidence[repoRel]?.fingerprint !== fingerprint);
-  if (normalizedMergeBoundaryFiles.some((file) => !persistedReviewFiles.includes(file)) || missingOrStaleReviewApproval) {
+  const approvedReviewEvidence = mergeBoundaryTask.repositoryScope?.reviewEvidence;
+  const requiresRepositoryReviewEvidence = approvedReviewEvidence !== void 0 || (mergeBoundaryTask.enabledWorkflowSteps ?? []).some((step) => /review/i.test(step));
+  const missingOrStaleReviewApproval = requiresRepositoryReviewEvidence && Object.entries(mergeBoundaryFingerprints).some(([repoRel, fingerprint]) => approvedReviewEvidence?.[repoRel]?.fingerprint !== fingerprint);
+  if (requiresRepositoryReviewEvidence && normalizedMergeBoundaryFiles.some((file) => !persistedReviewFiles.includes(file)) || missingOrStaleReviewApproval) {
     throw new Error(`Workspace merge evidence changed after review for ${taskId}; return the task to Code Review before landing`);
   }
-  await store.updateTask(taskId, { modifiedFiles: normalizedMergeBoundaryFiles });
-  task = { ...mergeBoundaryTask, modifiedFiles: normalizedMergeBoundaryFiles };
-  const workspaceWorktrees = task.workspaceWorktrees ?? {};
-  const explicitScope = task.repositoryScope?.state === "confirmed" ? task.repositoryScope.repositories : void 0;
-  if (!explicitScope) {
-    throw new Error(`Workspace repository scope is unresolved for ${taskId}; operator confirmation is required before landing`);
+  const readiness = resolveWorkspaceMergeReadiness(
+    mergeBoundaryTask,
+    mergeBoundaryModifiedRepositories,
+    netZeroBranchRepositories
+  );
+  if (readiness.kind === "blocked") throw new Error(readiness.reason);
+  if (readiness.kind === "no-op") {
+    throw new Error(`Workspace task ${taskId} has explicit no-commits policy and cannot enter repository landing`);
   }
-  const repoKeys = Object.keys(workspaceWorktrees).filter((repoRel) => explicitScope.includes(repoRel) && ((task.modifiedFiles ?? []).some((file) => file.startsWith(`${repoRel}/`)) || netZeroBranchRepositories.has(repoRel))).sort();
+  const retainedModifiedFiles = [.../* @__PURE__ */ new Set([...normalizedMergeBoundaryFiles, ...readiness.preservedFiles])].sort();
+  await store.updateTask(taskId, { modifiedFiles: retainedModifiedFiles });
+  task = { ...mergeBoundaryTask, modifiedFiles: retainedModifiedFiles };
+  const workspaceWorktrees = task.workspaceWorktrees ?? {};
+  const repoKeys = readiness.repositories;
   const repos = [];
   let allLanded = true;
   await setStatus("merging");
@@ -264665,7 +264924,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
         };
       } catch (error3) {
         if (error3 instanceof WorkspaceFenceRefError) {
-          throw new WorkspaceRepoLandBusyError(repoKeys[0] ?? "workspace", "workspace-merge-dispatch-fence", taskId);
+          throw new WorkspaceMergeTechnicalError("dispatch-fence-publication", `Workspace merge dispatch fence publication failed for ${taskId}: ${error3.message}`);
         }
         throw error3;
       }
@@ -264754,7 +265013,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       } catch (error3) {
         if (durableLandLease) await store.releaseWorkspaceLease(durableLandLease).catch(() => void 0);
         if (error3 instanceof WorkspaceRepoLandBusyError) throw error3;
-        throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease unavailable for ${repoRel}: ${getErrorMessage4(error3)}`);
       }
       try {
         activeSessionRegistry.registerPath(repoRootDir, {
@@ -264791,7 +265050,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
       renewalTimer?.unref?.();
       const landSignal = options.signal ? AbortSignal.any([options.signal, leaseAbort.signal]) : leaseAbort.signal;
       const assertLeaseLive = () => {
-        if (leaseLost || leaseAbort.signal.aborted) throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        if (leaseLost || leaseAbort.signal.aborted) throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease renewal was lost for ${repoRel}`);
       };
       try {
         const landResult = await landOneRepo(repoRootDir, entry.branch, integrationBranch, {
@@ -264876,11 +265135,11 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
           repos.push({ repo: repoRel, repoRootDir, integrationBranch, branch: entry.branch, status: "empty" });
         }
       } catch (err) {
-        if (leaseLost) throw new WorkspaceRepoLandBusyError(repoRel, "durable-workspace-lease", taskId);
+        if (leaseLost) throw new WorkspaceMergeTechnicalError("durable-lease", `Workspace repository lease renewal was lost for ${repoRel}`);
         if (isMergeAbortedError(err)) throw err;
         if (err instanceof WorkspacePartialLandError) throw err;
         if (err instanceof WorkspaceFenceRefError) {
-          throw new WorkspaceRepoLandBusyError(repoRel, "workspace-merge-dispatch-fence", taskId);
+          throw new WorkspaceMergeTechnicalError("repository-fence-publication", `Workspace repository fence publication failed for ${repoRel}: ${err.message}`);
         }
         const message = getErrorMessage4(err);
         await log42(`AI merge (workspace): sub-repo ${repoRel} land failed: ${message}`);
@@ -265439,7 +265698,7 @@ async function finalizeTask(store, taskId, result2, audit, log42, rootDir, fence
 function throwIfAborted2(signal, taskId) {
   assertMergeGenerationOwned(signal, taskId);
 }
-var execFileAsync28, aiMergeLog, MAX_CONCURRENT_ADVANCE_RETRIES, MAX_BLOCKING_REVIEW_REASONS, AiMergeBlockedError, AiMergeReviewReconciliationInvalidatedError, LEGACY_COMPLETE_COLUMN, LEGACY_ARCHIVED_COLUMN, LEGACY_TERMINAL_COLUMNS3, LEGACY_REBOUND_COLUMN2, STRONG_LANDED_STRATEGIES, WORKSPACE_REPO_LAND_OWNER_KEY, WorkspaceRepoLandBusyError, WorkspacePartialLandError, WorkspaceFinalizeBlockedError, WorkspaceMergeDispatchSupersededError;
+var execFileAsync28, aiMergeLog, MAX_CONCURRENT_ADVANCE_RETRIES, MAX_BLOCKING_REVIEW_REASONS, AiMergeBlockedError, AiMergeReviewReconciliationInvalidatedError, LEGACY_COMPLETE_COLUMN, LEGACY_ARCHIVED_COLUMN, LEGACY_TERMINAL_COLUMNS3, LEGACY_REBOUND_COLUMN2, STRONG_LANDED_STRATEGIES, WORKSPACE_REPO_LAND_OWNER_KEY, WorkspaceRepoLandBusyError, WorkspaceMergeTechnicalError, WorkspacePartialLandError, WorkspaceFinalizeBlockedError, WorkspaceMergeDispatchSupersededError;
 var init_merger_ai = __esm({
   "../engine/src/merge/merger-ai.ts"() {
     "use strict";
@@ -265471,6 +265730,7 @@ var init_merger_ai = __esm({
     init_active_session_registry();
     init_mcp_resolution();
     init_workspace_land_predicate();
+    init_workspace_merge_readiness();
     init_workspace_land_failure();
     init_workspace_fence_ref();
     init_auto_merge_finalization();
@@ -265516,6 +265776,14 @@ var init_merger_ai = __esm({
       }
       retryable = true;
     };
+    WorkspaceMergeTechnicalError = class extends Error {
+      constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = "WorkspaceMergeTechnicalError";
+      }
+      retryable = true;
+    };
     WorkspacePartialLandError = class extends Error {
       constructor(landedCount, failedRepos, message) {
         super(message);
@@ -284709,6 +284977,15 @@ ${detail}`);
                 }
                 continue;
               }
+              if (err instanceof WorkspaceMergeTechnicalError) {
+                await store.logEntry(taskId, `Workspace merge technical failure (${err.kind}): ${err.message}`, "WorkspaceMergeTechnicalFailure").catch(() => void 0);
+                if (hasManualResolver) {
+                  this.rejectMergeResolvers(taskId, err);
+                } else if (!await this.maybeRetryTransientMerge(store, taskId, await store.getTask(taskId).catch(() => null), err.message, true)) {
+                  await store.updateTask(taskId, { status: "failed", error: err.message }).catch(() => void 0);
+                }
+                continue;
+              }
               const isWorkspaceBusyError = err instanceof WorkspaceRepoLandBusyError || err instanceof WorkspaceMergeDispatchBusyError || err instanceof WorkspaceMergeDispatchSupersededError;
               if (isWorkspaceBusyError && hasManualResolver) {
                 await store.logEntry(taskId, `Workspace sub-repo land busy (contention): ${errorMsg}`, "WorkspaceRepoLandBusy").catch(() => void 0);
@@ -284716,18 +284993,18 @@ ${detail}`);
                 continue;
               }
               if (isWorkspaceBusyError && !hasManualResolver) {
-                const busyCount = this.workspaceBusyReenqueues.get(taskId) ?? 0;
+                const liveTask = await store.getTask(taskId).catch(() => null);
+                const busyCount = liveTask?.mergeTransientRetryCount ?? 0;
                 await store.logEntry(taskId, `Workspace sub-repo land busy (contention): ${errorMsg}`, "WorkspaceRepoLandBusy").catch(() => void 0);
                 if (busyCount < _ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES) {
-                  this.workspaceBusyReenqueues.set(taskId, busyCount + 1);
+                  const nextCount = busyCount + 1;
                   const delayMs = Math.min(5e3 * Math.pow(2, busyCount), 6e4);
-                  await store.updateTask(taskId, { status: null }).catch(() => void 0);
+                  await store.updateTask(taskId, { status: null, mergeTransientRetryCount: nextCount }).catch(() => void 0);
                   runtimeLog.log(
-                    `Workspace land busy re-enqueue ${busyCount + 1}/${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} for ${taskId} in ${delayMs / 1e3}s (no mergeRetry consumed \u2014 pure lease contention)`
+                    `Workspace land busy re-enqueue ${nextCount}/${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} for ${taskId} in ${delayMs / 1e3}s (durable transient retry)`
                   );
                   this.scheduleWorkspaceBusyReenqueue(taskId, delayMs);
                 } else {
-                  this.workspaceBusyReenqueues.delete(taskId);
                   await store.updateTask(taskId, { status: "failed", error: errorMsg }).catch(() => void 0);
                   runtimeLog.error(
                     `Auto-merge: ${taskId} workspace land busy ${_ProjectEngine.WORKSPACE_BUSY_MAX_REENQUEUES} times \u2014 parked as failed (sustained sub-repo lease contention)`
@@ -286056,7 +286333,7 @@ var init_engine_singleton_lock = __esm({
 import { realpathSync as realpathSync16 } from "node:fs";
 import { resolve as pathResolve } from "node:path";
 function sameProjectRoot(a, b3) {
-  const normalize9 = (p2) => {
+  const normalize10 = (p2) => {
     const resolved = pathResolve(p2);
     try {
       return realpathSync16(resolved);
@@ -286064,7 +286341,7 @@ function sameProjectRoot(a, b3) {
       return resolved;
     }
   };
-  return normalize9(a) === normalize9(b3);
+  return normalize10(a) === normalize10(b3);
 }
 var DEFAULT_RECONCILIATION_INTERVAL_MS, ProjectEngineManager;
 var init_project_engine_manager = __esm({
@@ -296872,7 +297149,7 @@ var init_gitlab = __esm({
         if (response.status === 204) return void 0;
         return await response.json();
       }
-      async listPaginated(path13, options, normalize9) {
+      async listPaginated(path13, options, normalize10) {
         const limit = clampLimit(options.limit);
         const out = [];
         let page = 1;
@@ -296883,7 +297160,7 @@ var init_gitlab = __esm({
           appendListParams(params, options);
           const rows = await this.request(`${path13}?${params.toString()}`);
           if (!Array.isArray(rows) || rows.length === 0) break;
-          out.push(...rows.map(normalize9));
+          out.push(...rows.map(normalize10));
           if (rows.length < Number(params.get("per_page"))) break;
           page += 1;
         }
@@ -315714,6 +315991,22 @@ var init_update_install_coordinator = __esm({
       pendingVersion;
       pendingResult;
       restartRequested = false;
+      /**
+       * FNXC:PendingUpdateInstall 2026-08-21-05:58:
+       * A completed install belongs to the still-running old process, not a mounted
+       * Settings dialog. Expose its target until process replacement so every route
+       * can reject a second install and every dashboard remount can offer restart.
+       */
+      getPendingInstall() {
+        if (!this.pendingVersion || !this.pendingResult) return void 0;
+        return {
+          ...this.pendingResult,
+          latestVersion: this.pendingVersion,
+          restartAttempted: this.restartRequested,
+          restartScheduled: this.restartRequested,
+          priorPid: this.restartRequested ? process.pid : void 0
+        };
+      }
       async install(targetVersion, operation) {
         if (this.pendingVersion && this.pendingResult) return this.pendingResult;
         if (!this.inFlight) {
@@ -316932,6 +317225,7 @@ var init_server2 = __esm({
     init_api_error();
     init_project_store_resolver();
     init_chat_project_services();
+    init_file_service();
     init_terminal_viewport();
     init_terminal_service();
     init_terminal();