@runfusion/fusion 0.77.0-beta.7 → 0.77.0-beta.8

package/dist/bin.js

@@ -1099,6 +1099,8 @@ var init_execution_and_ui = __esm({
       "midnight",
       // FNXC:DashboardTheming 2026-08-18-05:45: Velvet is persisted immediately after Midnight; keep this ID and order synchronized across core, selector metadata, and both first-paint validators so saved selections survive pre-hydration validation.
       "velvet",
+      // FNXC:DashboardTheming 2026-08-23-01:51: Iceberg is persisted immediately after Velvet; keep this ID and order synchronized across core, selector metadata, both first-paint validators, token blocks, and swatch CSS so saved selections survive pre-hydration validation.
+      "iceberg",
       // FNXC:DashboardTheming 2026-07-31-20:39: Factory Dark must stay order-synchronized across core, selector metadata, and both first-paint validators so saved preferences survive pre-hydration validation.
       "factory-dark",
       // FNXC:DashboardTheming 2026-07-31-23:51: Factory Light must stay order-synchronized across core, selector metadata, and both first-paint validators so saved preferences survive pre-hydration validation.
@@ -1577,6 +1579,13 @@ function getTaskHardMergeBlocker(task, options = {}) {
     requiredPreMergeStepIds: options.requiredPreMergeStepIds
   });
 }
+function getMergeConfirmedFinalizationBlocker(task, options = {}) {
+  const hasDurableMergeRecord = task.mergeDetails?.mergeConfirmed === true && typeof task.mergeDetails.commitSha === "string" && task.mergeDetails.commitSha.length > 0;
+  return getTaskHardMergeBlocker(hasDurableMergeRecord ? { ...task, steps: [] } : task, options);
+}
+function getUnfinishedStepTitles(task) {
+  return (task.steps ?? []).filter((step) => NON_TERMINAL_STEP_STATUSES.has(step.status)).map((step, index3) => step.name?.trim() || `step ${index3 + 1}`);
+}
 function isTaskReadyForMerge(task, options = {}) {
   return getTaskMergeBlocker(task, options) === void 0;
 }
@@ -2563,12 +2572,16 @@ var init_settings_schema = __esm({
       executorEscalationProvider: void 0,
       executorEscalationModelId: void 0,
       executorEscalationNodeId: void 0,
-      reviewConvergenceEscalationEnabled: true,
-      reviewConvergenceEscalationProvider: void 0,
-      reviewConvergenceEscalationModelId: void 0,
-      reviewArbitrationEnabled: true,
-      reviewArbitrationProvider: void 0,
-      reviewArbitrationModelId: void 0,
+      /*
+      FNXC:ReviewConvergence 2026-08-23-21:05:
+      FN-149's six review-convergence/arbitration keys are declared in BUILTIN_WORKFLOW_SETTINGS, which
+      the U4 hard-move made the SINGLE source of truth for a moved key's default. Re-declaring them here
+      put them back in the legacy object the hard-move emptied, so an undeclared key on a custom workflow
+      could resolve to this literal instead of the declaration default — the exact drift
+      `workflow-settings-fallback-alignment` guards. The declaration defaults are identical (both
+      `*Enabled` default true, the provider/model lanes carry no default), and the reader uses
+      `!== false`, so removing them here preserves behaviour and restores the invariant.
+      */
       /**
        * FNXC:Merge 2026-06-26-00:00:
        * New and unconfigured projects default AI merge to sync a dirty checked-out integration branch, restoring the legacy stash → fast-forward → restore landing behavior. Explicit persisted merger.allowDirtyLocalCheckoutSync values still win, and no existing-project migration stamps this default into storage.
@@ -10729,6 +10742,35 @@ var init_workflow_ir_types = __esm({
   }
 });
 
+// ../core/src/workflows/workflow-merge-region.ts
+function isMergeRegionNode(node) {
+  return MERGE_REGION_ENTRY_NODE_KINDS.has(node.kind) || node.config?.seam === "merge";
+}
+function classifyWorkflowNodeMergeRegion(ir2, nodeId) {
+  if (ir2.version !== "v2" || !Array.isArray(ir2.nodes)) return "unknown";
+  const node = ir2.nodes.find((candidate) => candidate.id === nodeId);
+  if (!node) return "unknown";
+  return isMergeRegionNode(node) ? "merge-region" : "outside-merge-region";
+}
+var MERGE_REGION_ENTRY_NODE_KINDS;
+var init_workflow_merge_region = __esm({
+  "../core/src/workflows/workflow-merge-region.ts"() {
+    "use strict";
+    MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+      "merge-gate",
+      "merge-attempt",
+      "manual-merge-hold",
+      "retry-backoff",
+      "recovery-router",
+      "branch-group-member-integration",
+      "branch-group-promotion",
+      "pr-create",
+      "pr-respond",
+      "pr-merge"
+    ]);
+  }
+});
+
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -12468,6 +12510,7 @@ var init_workflow_ir = __esm({
   "../core/src/workflows/workflow-ir.ts"() {
     "use strict";
     init_workflow_ir_types();
+    init_workflow_merge_region();
     init_workflow_extension_registry();
     init_types();
     init_trait_registry();
@@ -12548,18 +12591,7 @@ var init_workflow_ir = __esm({
       "done",
       "archived"
     ];
-    INTERPRETER_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-      "merge-gate",
-      "merge-attempt",
-      "manual-merge-hold",
-      "retry-backoff",
-      "recovery-router",
-      "branch-group-member-integration",
-      "branch-group-promotion",
-      "pr-create",
-      "pr-respond",
-      "pr-merge"
-    ]);
+    INTERPRETER_ENTRY_NODE_KINDS = MERGE_REGION_ENTRY_NODE_KINDS;
     MERGE_CLASS_NODE_KINDS = /* @__PURE__ */ new Set([
       "merge-gate",
       "merge-attempt",
@@ -13965,6 +13997,13 @@ Lint, tests, and typecheck are also hard quality gates:
 - Keep fixing failures caused by your change until lint, impacted tests, build, and typecheck pass.
 - If the repository exposes a typecheck command, run it and fix failures caused by your change.
 - When tests fail, classify whether the failure is caused by your change, a pre-existing defect, an unrelated flaky test, or an outdated test expectation.
+
+**A behavior change owns every test that asserts the old behavior.** Targeted verification runs the tests for files you TOUCHED; the tests encoding the behavior you just changed usually live in files you did NOT touch, so a green targeted run is not evidence that none exist. Before finishing, search for them:
+- Added a guard, validation, or required field? Grep for the FIXTURES it will now refuse \u2014 they are outside your File Scope \u2014 and fix each to state its intent explicitly.
+- Removed a feature? Delete its tests. A test asserting a deliberately removed contract guards nothing, and making it pass later means re-adding removed behavior.
+- Changed an order, default, constant, or prompt string? Grep for the literal; topology lists, prompt-content assertions, and size budgets live far from the code they describe.
+- Added a public store/service method? Update the inventory/drift guards that require every public surface to be classified.
+Fix at the SHARED FIXTURE FACTORY, not per test \u2014 one helper usually explains dozens of failures. Never make a stale test pass by weakening it: update the fixture, record the new truth, or delete the test naming the change that removed its subject.
 - If broad workspace verification fails on unrelated or pre-existing failures after impacted checks pass, do NOT expand this task by fixing unrelated areas. Log the evidence, quarantine flakes per project policy, or create/link a follow-up task.
 - Do not repeatedly rerun a broad failing or hanging workspace command without a new hypothesis and a narrower confirming command.
 
@@ -14237,6 +14276,7 @@ files with assertions that run via a test runner. Typechecks and builds are NOT
 tests. Manual verification is NOT a test.
 
 - Each implementation step should include writing tests for the code being changed
+- **If the task CHANGES, GATES, or REMOVES existing behavior, include a step to find and update the tests that assert the OLD behavior.** Name the search in that step: the fixtures a new guard will now refuse, the tests of a removed feature, or the literal to grep for a changed order/default/constant/prompt string. Those tests live OUTSIDE the File Scope, so targeted verification will not surface them and the executor will not find them by accident. Measured 2026-08-24: five such changes left ~135 stale failing tests behind, every one having passed its own targeted verification; one shared fixture line accounted for 37 of them.
 - For bug fixes and UI-affordance add/remove tasks, the spec MUST include a \`## Surface Enumeration\` section. The workflow Plan Review gate validates this before execution when plan review is enabled; missing coverage is a blocking REVISE.
 - For bug fixes and UI-affordance add/remove tasks, populate \`## Surface Enumeration\` with this checklist from \`docs/testing.md\`: providers/bridges/execution paths; desktop + mobile breakpoints/platforms; empty/undefined/duplicate/populated data states; shared hooks/components/modules/helpers; every component that renders the affordance; leftover shells after removal.
 - For bug fixes and UI-affordance add/remove tasks, regression tests must assert the invariant across all known surfaces \u2014 enumerate every provider/bridge, desktop + mobile breakpoints, empty/undefined/populated data states, and for UI-affordance changes every component rendering the affordance plus leftover shells after removal \u2014 not just the reported repro (see FN-5787/FN-5789/FN-5803, FN-5751, and FN-6115/FN-6118/FN-6123)
@@ -24561,7 +24601,16 @@ var init_project = __esm({
       "chat_rooms",
       "chat_room_members",
       "chat_room_messages",
-      "chat_token_usage"
+      "chat_token_usage",
+      /*
+      FNXC:WorkspaceCoordination 2026-08-23-20:05:
+      FN-9059 (migration 0060) added these two tables to the schema without registering them here, so
+      every registry consumer under-counted them: the PostgreSQL test harness never TRUNCATEd them
+      between tests (a held `repo:<repo>` lease leaked from one case into the next and made the next
+      land report the previous test's successor as the busy holder), and health compaction skipped them.
+      */
+      "workspace_coordination_leases",
+      "workspace_land_intents"
     ];
   }
 });
@@ -28691,10 +28740,6 @@ function resolveRequiredPreMergeStepIds(ir2, enabledWorkflowSteps) {
     resolveWorkflowOptionalSteps(ir2).filter((step) => step.phase === "pre-merge").filter((step) => isWorkflowOptionalGroupEnabled(enabledWorkflowSteps, step.templateId, step.defaultOn)).map((step) => step.templateId)
   );
 }
-function findUnrunRequiredPreMergeStepIds(ir2, task) {
-  const results = task.workflowStepResults ?? [];
-  return [...resolveRequiredPreMergeStepIds(ir2, task.enabledWorkflowSteps)].filter((workflowStepId) => !results.some((result2) => result2.workflowStepId === workflowStepId));
-}
 var init_required_pre_merge_steps = __esm({
   "../core/src/merge/required-pre-merge-steps.ts"() {
     "use strict";
@@ -28702,6 +28747,42 @@ var init_required_pre_merge_steps = __esm({
   }
 });
 
+// ../core/src/merge/merge-sweep-admission.ts
+function classifyMergeSweepAdmission(input) {
+  if (input.hasLiveSession) return { admit: false, reason: "live-session" };
+  if (input.mergeConfirmed) return { admit: true, reason: "merge-confirmed-finalization" };
+  if (!input.gatesSatisfied) return { admit: false, reason: "gates-unsatisfied" };
+  if (!input.continuationsReadable) return { admit: false, reason: "continuations-unreadable" };
+  if (input.irTrust === "unresolved-selection") {
+    return quiescentStallDecision(input, "unresolved-workflow-ir");
+  }
+  if (input.continuationPositions.length > 0) {
+    if (input.continuationPositions.includes("merge-region")) {
+      return { admit: true, reason: "at-merge-region-node" };
+    }
+    if (input.continuationPositions.includes("unknown")) {
+      return { admit: true, reason: "drifted-continuation-node" };
+    }
+    return { admit: false, reason: "not-at-merge-region-node" };
+  }
+  if (input.interruptedMergeAttempt) {
+    return { admit: true, reason: "interrupted-merge-attempt" };
+  }
+  return quiescentStallDecision(input, "quiescent-stall-recovery");
+}
+function quiescentStallDecision(input, reason) {
+  const floorMs = input.quiescenceFloorMs ?? DEFAULT_MERGE_SWEEP_QUIESCENCE_MS;
+  if (!(input.quiescentMs >= floorMs)) return { admit: false, reason: "too-recent" };
+  return { admit: true, reason };
+}
+var DEFAULT_MERGE_SWEEP_QUIESCENCE_MS;
+var init_merge_sweep_admission = __esm({
+  "../core/src/merge/merge-sweep-admission.ts"() {
+    "use strict";
+    DEFAULT_MERGE_SWEEP_QUIESCENCE_MS = 2 * 6e4;
+  }
+});
+
 // ../core/src/config/moved-settings.ts
 function isMovedSettingsKey(key) {
   return MOVED_SETTINGS_KEY_SET.has(key);
@@ -71712,6 +71793,21 @@ async function listWorkflowWorkItemsForTaskImpl(store, taskId, opts = {}) {
   const rows = opts.kinds?.length ? await layer.db.select().from(project_exports.workflowWorkItems).where(and(scope, eq(project_exports.workflowWorkItems.taskId, taskId), inArray(project_exports.workflowWorkItems.kind, opts.kinds))) : await q2;
   return rows.map((row) => store.rowToWorkflowWorkItem(row));
 }
+async function listWorkflowWorkItemsForTasksImpl(store, taskIds, opts = {}) {
+  const byTask = /* @__PURE__ */ new Map();
+  for (const taskId of taskIds) byTask.set(taskId, []);
+  if (taskIds.length === 0) return byTask;
+  const layer = store.asyncLayer;
+  const scope = projectScopeFor(project_exports.workflowWorkItems.projectId, layer.projectId);
+  const conditions = [scope, inArray(project_exports.workflowWorkItems.taskId, [...taskIds])];
+  if (opts.kinds?.length) conditions.push(inArray(project_exports.workflowWorkItems.kind, opts.kinds));
+  const rows = await layer.db.select().from(project_exports.workflowWorkItems).where(and(...conditions));
+  for (const row of rows) {
+    const item = store.rowToWorkflowWorkItem(row);
+    byTask.get(item.taskId)?.push(item);
+  }
+  return byTask;
+}
 async function listDueWorkflowWorkItemsImpl(store, filter2 = {}) {
   const layer = store.asyncLayer;
   return listDueWorkflowWorkItems(layer.db, filter2);
@@ -91030,6 +91126,17 @@ async function getMergeRequestRecordAsyncImpl(store, taskId) {
   const row = rows[0];
   return row ? store.rowToMergeRequestRecord(row) : null;
 }
+async function getMergeRequestRecordsAsyncImpl(store, taskIds) {
+  const byTask = /* @__PURE__ */ new Map();
+  if (taskIds.length === 0) return byTask;
+  const layer = store.asyncLayer;
+  const rows = await layer.db.select().from(project_exports.mergeRequests).where(inArray(project_exports.mergeRequests.taskId, [...taskIds]));
+  for (const row of rows) {
+    const record2 = store.rowToMergeRequestRecord(row);
+    byTask.set(record2.taskId, record2);
+  }
+  return byTask;
+}
 function getWorkflowWorkItemByIdentityImpl(store, runId, taskId, nodeId, kind) {
   const row = store.db.prepare("SELECT * FROM workflow_work_items WHERE runId = ? AND taskId = ? AND nodeId = ? AND kind = ?").get(runId, taskId, nodeId, kind);
   return row ? store.rowToWorkflowWorkItem(row) : null;
@@ -106989,6 +107096,10 @@ var init_store = __esm({
       async getMergeRequestRecordAsync(taskId) {
         return getMergeRequestRecordAsyncImpl(this, taskId);
       }
+      /** Batched `getMergeRequestRecordAsync` — one query for many tasks (FNXC:MergeAuthority 2026-08-23-20:05). */
+      async getMergeRequestRecordsAsync(taskIds) {
+        return getMergeRequestRecordsAsyncImpl(this, taskIds);
+      }
       async projectMergeRequestToWorkflowWorkItem(taskId, opts = {}) {
         return projectMergeRequestToWorkflowWorkItemImpl(this, taskId, opts);
       }
@@ -107031,6 +107142,10 @@ var init_store = __esm({
       async listWorkflowWorkItemsForTask(taskId, opts = {}) {
         return listWorkflowWorkItemsForTaskImpl(this, taskId, opts);
       }
+      /** Batched `listWorkflowWorkItemsForTask` — one query for many tasks (FNXC:MergeAuthority 2026-08-23-20:05). */
+      async listWorkflowWorkItemsForTasks(taskIds, opts = {}) {
+        return listWorkflowWorkItemsForTasksImpl(this, taskIds, opts);
+      }
       /**
        * FNXC:RuntimeWorkflowAsync 2026-06-24-17:12:
        */
@@ -136743,6 +136858,7 @@ __export(src_exports, {
   DEFAULT_MAX_WORKTREES: () => DEFAULT_MAX_WORKTREES,
   DEFAULT_MEMORY_BACKEND: () => DEFAULT_MEMORY_BACKEND,
   DEFAULT_MEMORY_DREAMS_SCHEDULE: () => DEFAULT_MEMORY_DREAMS_SCHEDULE,
+  DEFAULT_MERGE_SWEEP_QUIESCENCE_MS: () => DEFAULT_MERGE_SWEEP_QUIESCENCE_MS,
   DEFAULT_MIN_INTERVAL_MS: () => DEFAULT_MIN_INTERVAL_MS,
   DEFAULT_MISSION_ASSERTION_TYPE: () => DEFAULT_MISSION_ASSERTION_TYPE,
   DEFAULT_MOBILE_NAV_PRIMARY_ITEMS: () => DEFAULT_MOBILE_NAV_PRIMARY_ITEMS,
@@ -136909,6 +137025,7 @@ __export(src_exports, {
   MERGE_AUDIT_AUTO_RECOVERY_MODES: () => MERGE_AUDIT_AUTO_RECOVERY_MODES,
   MERGE_COMMIT_SUMMARIZE_SYSTEM_PROMPT: () => MERGE_COMMIT_SUMMARIZE_SYSTEM_PROMPT,
   MERGE_CONFIRMED_TRANSIENT_STATUSES: () => MERGE_CONFIRMED_TRANSIENT_STATUSES,
+  MERGE_REGION_ENTRY_NODE_KINDS: () => MERGE_REGION_ENTRY_NODE_KINDS,
   MESH_INTENT_STATES: () => MESH_INTENT_STATES,
   MESH_RECONCILIATION_OUTCOMES: () => MESH_RECONCILIATION_OUTCOMES,
   MESH_WRITE_CLASSES: () => MESH_WRITE_CLASSES,
@@ -137277,6 +137394,7 @@ __export(src_exports, {
   classifyFileScopeFromPrompt: () => classifyFileScopeFromPrompt,
   classifyGhError: () => classifyGhError,
   classifyInsightRunError: () => classifyInsightRunError,
+  classifyMergeSweepAdmission: () => classifyMergeSweepAdmission,
   classifyPlannerActionSideEffect: () => classifyPlannerActionSideEffect,
   classifyProviderError: () => classifyProviderError,
   classifyReadStaleness: () => classifyReadStaleness,
@@ -137287,6 +137405,7 @@ __export(src_exports, {
   classifyTaskCommitAssociationConfidence: () => classifyTaskCommitAssociationConfidence,
   classifyTerminalFailureAutoRecovery: () => classifyTerminalFailureAutoRecovery,
   classifyWorkflowAgentNode: () => classifyWorkflowAgentNode,
+  classifyWorkflowNodeMergeRegion: () => classifyWorkflowNodeMergeRegion,
   cleanupOldAiSessions: () => cleanupOldAiSessions,
   cleanupStaleAiSessions: () => cleanupStaleAiSessions,
   clearActiveEmbeddedRuntimeUrl: () => clearActiveEmbeddedRuntimeUrl,
@@ -137486,7 +137605,6 @@ __export(src_exports, {
   findOrphanedSettingValues: () => findOrphanedSettingValues,
   findPendingPreMergeStep: () => findPendingPreMergeStep,
   findSameAgentDuplicates: () => findSameAgentDuplicates,
-  findUnrunRequiredPreMergeStepIds: () => findUnrunRequiredPreMergeStepIds,
   findVitestProcessIds: () => findVitestProcessIds,
   findWorkflowColumn: () => findWorkflowColumn,
   findWorkflowEventShapeViolations: () => findWorkflowEventShapeViolations,
@@ -137558,6 +137676,7 @@ __export(src_exports, {
   getMcpDiscoverySources: () => getMcpDiscoverySources,
   getMemoryBackend: () => getMemoryBackend,
   getMemoryBackendCapabilities: () => getMemoryBackendCapabilities,
+  getMergeConfirmedFinalizationBlocker: () => getMergeConfirmedFinalizationBlocker,
   getOpenIncidentByGroupingKeyAsync: () => getOpenIncidentByGroupingKeyAsync,
   getOverriddenKeys: () => getOverriddenKeys,
   getPiExtensionDiscoveryDirs: () => getPiExtensionDiscoveryDirs,
@@ -137596,6 +137715,7 @@ __export(src_exports, {
   getTotalAgentActiveMs: () => getTotalAgentActiveMs,
   getTrait: () => getTrait,
   getTraitRegistry: () => getTraitRegistry,
+  getUnfinishedStepTitles: () => getUnfinishedStepTitles,
   getValidTransitions: () => getValidTransitions,
   getWorkflowEventBus: () => getWorkflowEventBus,
   getWorkflowExtensionRegistry: () => getWorkflowExtensionRegistry,
@@ -137679,6 +137799,7 @@ __export(src_exports, {
   isManualTrigger: () => isManualTrigger,
   isMcpSecretRef: () => isMcpSecretRef,
   isMechanicalRoutableContext: () => isMechanicalRoutableContext,
+  isMergeRegionNode: () => isMergeRegionNode,
   isMergeRequestContractShadowEnabled: () => isMergeRequestContractShadowEnabled,
   isMeshIntentState: () => isMeshIntentState,
   isMeshWriteClass: () => isMeshWriteClass,
@@ -138382,6 +138503,8 @@ var init_src2 = __esm({
     init_workflow_merge_proof();
     init_workflow_optional_steps();
     init_required_pre_merge_steps();
+    init_merge_sweep_admission();
+    init_workflow_merge_region();
     init_workflow_prompt_overrides();
     init_builtin_stepwise_coding_workflow_ir();
     init_builtin_stepwise_final_review_coding_workflow_ir();
@@ -148482,39 +148605,42 @@ var init_provider_registration = __esm({
 });
 
 // ../engine/src/util/emit-bounded-run-audit.ts
-async function emitBoundedRunAudit2(host, event, options = {}) {
+function emitBoundedRunAudit2(host, event, options = {}) {
+  return emitBoundedRunAuditWithOutcome2(host, event, options).then(() => void 0);
+}
+async function emitBoundedRunAuditWithOutcome2(host, event, options = {}) {
   let defaultLog2;
   try {
     defaultLog2 = runAuditLog;
   } catch {
     defaultLog2 = void 0;
   }
-  const log44 = options.log ?? defaultLog2 ?? { warn: (message) => console.warn(message) };
+  const log44 = options.log ?? defaultLog2 ?? { warn: () => void 0 };
   const sink2 = host?.recordRunAuditEvent;
-  if (typeof sink2 !== "function") return;
+  if (typeof sink2 !== "function") return { outcome: "absent" };
   let sinkPromise;
   try {
     sinkPromise = Promise.resolve(sink2.call(host, event));
-  } catch {
+  } catch (error3) {
     log44.warn(`[run-audit] failed to record ${event.mutationType}`);
-    return;
+    return { outcome: "failed", error: error3 };
   }
   void sinkPromise.catch(() => void 0);
-  await new Promise((resolve115) => {
+  return await new Promise((resolve115) => {
     const timer2 = setTimeout(() => {
       log44.warn(`[run-audit] timed out recording ${event.mutationType}`);
-      resolve115();
+      resolve115({ outcome: "timed-out" });
     }, options.timeoutMs ?? RUN_AUDIT_EMIT_TIMEOUT_MS);
     timer2.unref?.();
     void sinkPromise.then(
       () => {
         clearTimeout(timer2);
-        resolve115();
+        resolve115({ outcome: "recorded" });
       },
-      () => {
+      (error3) => {
         clearTimeout(timer2);
         log44.warn(`[run-audit] failed to record ${event.mutationType}`);
-        resolve115();
+        resolve115({ outcome: "failed", error: error3 });
       }
     );
   });
@@ -181661,6 +181787,7 @@ function createRunAuditor(store, context2) {
       },
       database: async () => {
       },
+      databaseWithOutcome: async () => ({ outcome: "absent" }),
       filesystem: async () => {
       },
       sandbox: async () => {
@@ -181674,6 +181801,7 @@ function createRunAuditor(store, context2) {
       },
       database: async () => {
       },
+      databaseWithOutcome: async () => ({ outcome: "absent" }),
       filesystem: async () => {
       },
       sandbox: async () => {
@@ -181716,6 +181844,28 @@ function createRunAuditor(store, context2) {
       };
       await emitBoundedRunAudit2(store, eventInput);
     },
+    /*
+    FNXC:RunAudit 2026-08-23-18:30:
+    Identical write to `database`, returning whether the row landed for the emitters that gate their
+    own state on a proven write (see the interface note). Still bounded and non-throwing.
+    */
+    databaseWithOutcome: async (input) => {
+      const inferredTaskId = input.target.startsWith("FN-") || input.target.startsWith("KB-") ? input.target : context2.taskId;
+      return await emitBoundedRunAuditWithOutcome2(store, {
+        taskId: inferredTaskId,
+        agentId: context2.agentId,
+        runId: context2.runId,
+        domain: "database",
+        mutationType: input.type,
+        target: input.target,
+        metadata: {
+          phase: context2.phase,
+          ...context2.source ? { source: context2.source } : {},
+          ...context2.taskLineageId ? { taskLineageId: context2.taskLineageId } : {},
+          ...input.metadata
+        }
+      });
+    },
     filesystem: async (input) => {
       const eventInput = {
         taskId: context2.taskId,
@@ -183651,10 +183801,13 @@ var init_scheduler = __esm({
        * Validate that a task's filesystem state is intact.
        * Checks that the task directory exists and PROMPT.md is present and non-empty.
        * 
-       * @param id - The task ID to validate
+       * @param task - The task (id + title) to validate
        * @returns Object with `valid: true` if checks pass, or `valid: false` with a `reason` string if they fail
        */
-      async validateTaskFilesystem(id) {
+      async validateTaskFilesystem(task) {
+        const id = task.id;
+        const titleRedirect = nonExecutableDuplicateRedirectReason(null, task.title);
+        if (titleRedirect) return { valid: false, reason: titleRedirect };
         if (typeof this.store.getTasksDir !== "function") {
           return { valid: true };
         }
@@ -183671,7 +183824,7 @@ var init_scheduler = __esm({
           if (!content || content.trim().length === 0) {
             return { valid: false, reason: "missing or empty PROMPT.md" };
           }
-          const duplicateOnly = nonExecutableDuplicateRedirectReason(content);
+          const duplicateOnly = nonExecutableDuplicateRedirectReason(content, task.title);
           if (duplicateOnly) {
             return { valid: false, reason: duplicateOnly };
           }
@@ -184349,7 +184502,7 @@ var init_scheduler = __esm({
                   );
                 }
               }
-              const validation = await this.validateTaskFilesystem(task.id);
+              const validation = await this.validateTaskFilesystem(task);
               if (!validation.valid) {
                 schedulerLog.warn(`Task ${task.id} filesystem validation failed: ${validation.reason}`);
                 const replanColumn = await moveTaskToReplanColumn(this.store, task);
@@ -193383,6 +193536,20 @@ var init_step_session_executor = __esm({
        * Safe to call multiple times (idempotent). Call this in a `finally` block
        * after `executeAll()`.
        */
+      /**
+       * FNXC:StepParallelWorktrees 2026-08-23-21:40:
+       * `parallelBranches` holds only branches THIS executor created in `createStepWorktree`
+       * (`fusion/step-<idx>-<worktree-name>`), so their provenance is known here rather than inferred.
+       * FN-9161's `isFusionDeletableBranch` answers by NAME and reads anything that is not
+       * `fusion/<task-id>...` as operator-supplied, so applying it here silently skipped every
+       * step branch and leaked one ref per parallel step. Protect what an operator can actually own —
+       * the task's working branch and its explicit override — and dispose of the rest.
+       */
+      isDisposableStepBranch(branchName) {
+        const task = this.options.taskDetail;
+        const operatorOwned = [task.branch, task.branchContext?.branchOverride?.branch].filter((value2) => typeof value2 === "string" && value2.trim().length > 0).map((value2) => value2.trim());
+        return !operatorOwned.includes(branchName.trim());
+      }
       async cleanup() {
         if (this.activeSessions.size > 0) {
           await this.terminateAllSessions();
@@ -193409,7 +193576,7 @@ var init_step_session_executor = __esm({
         }
         for (const [stepIdx, branchName] of this.parallelBranches) {
           try {
-            if (!isFusionDeletableBranch(this.options.taskDetail, branchName)) continue;
+            if (!this.isDisposableStepBranch(branchName)) continue;
             await execAsync18(`git branch -D "${branchName}"`, {
               cwd: this.options.rootDir
             });
@@ -193964,7 +194131,7 @@ Follow instructions precisely and avoid unrelated changes.`,
                 });
               }
               const branch = this.parallelBranches.get(stepIdx);
-              if (branch && isFusionDeletableBranch(this.options.taskDetail, branch)) {
+              if (branch && this.isDisposableStepBranch(branch)) {
                 await execAsync18(`git branch -D "${branch}"`, {
                   cwd: this.options.rootDir
                 });
@@ -201279,7 +201446,7 @@ async function finalizeProvenAutoMergeTask({
     });
     return { outcome: "blocked", task: latest, previousColumn: latest.column, reason };
   }
-  const hardBlocker = getTaskHardMergeBlocker({
+  const hardBlocker = getMergeConfirmedFinalizationBlocker({
     ...latest,
     /*
     FNXC:WorkflowMerge 2026-06-29-09:15:
@@ -201294,6 +201461,14 @@ async function finalizeProvenAutoMergeTask({
     status: clearMergeConfirmedTransientStatus(latest.status),
     error: void 0
   });
+  const unfinishedSteps = getUnfinishedStepTitles(latest);
+  if (unfinishedSteps.length > 0) {
+    await store.logEntry(
+      taskId,
+      `Finalizing proven merge with ${unfinishedSteps.length} unfinished step(s) \u2014 the branch already landed, so these did not run: ${unfinishedSteps.slice(0, 8).join("; ")}`,
+      "MergeConfirmedFinalizeUnfinishedSteps"
+    ).catch(() => void 0);
+  }
   if (hardBlocker) {
     fence?.assertOwned("finalization");
     await store.updateTask(taskId, {
@@ -221322,15 +221497,21 @@ var init_self_healing = __esm({
               const canonicalFlags = await resolveNearDuplicateCanonicalFlags(this.store, canonical);
               if (!isNearDuplicateCanonicalInactive(canonical ?? void 0, canonicalFlags)) continue;
               const promptPath = join76(this.options.rootDir, ".fusion", "tasks", task.id, "PROMPT.md");
-              if (existsSync62(promptPath)) {
+              const written = existsSync62(promptPath) ? readFileSync24(promptPath, "utf-8") : "";
+              const duplicateResolution = resolveExplicitDuplicateMarker(written, task.title);
+              const canonicalMarkerId = canonicalId.toUpperCase();
+              if (duplicateResolution.conflict || duplicateResolution.marker && duplicateResolution.marker.canonicalId !== canonicalMarkerId) {
+                continue;
+              }
+              if (duplicateResolution.source === "prompt") {
                 try {
-                  const written = readFileSync24(promptPath, "utf-8");
-                  if (parseExplicitDuplicateMarker(written)) {
-                    rmSync7(promptPath, { force: true });
-                  }
+                  rmSync7(promptPath, { force: true });
                 } catch {
                 }
               }
+              if (resolveExplicitDuplicateMarker(null, task.title).marker?.canonicalId === canonicalMarkerId) {
+                await this.store.updateTask(task.id, { title: `Duplicate redirect cleared: ${canonicalMarkerId}` });
+              }
               await this.store.updateTask(task.id, buildMarkerClearedReplanTaskPatch(canonicalId));
               if (typeof this.store.logEntry === "function") {
                 await Promise.resolve(this.store.logEntry(
@@ -224716,7 +224897,7 @@ var init_self_healing = __esm({
                 mergeTargetBranch: mergeTarget.branch,
                 mergeTargetSource: mergeTarget.source
               };
-              const hardBlocker = getTaskHardMergeBlocker({
+              const hardBlocker = getMergeConfirmedFinalizationBlocker({
                 ...task,
                 steps: task.steps ?? [],
                 workflowStepResults: task.workflowStepResults
@@ -224901,7 +225082,7 @@ var init_self_healing = __esm({
                 mergeTargetBranch: mergeTarget.branch,
                 mergeTargetSource: mergeTarget.source
               };
-              const hardBlocker = getTaskHardMergeBlocker({
+              const hardBlocker = getMergeConfirmedFinalizationBlocker({
                 ...task,
                 steps: task.steps ?? [],
                 workflowStepResults: task.workflowStepResults
@@ -227596,14 +227777,12 @@ var init_self_healing = __esm({
           for (const task of candidates) {
             try {
               const promptPath = join76(this.options.rootDir, ".fusion", "tasks", task.id, "PROMPT.md");
-              if (!existsSync62(promptPath)) {
-                continue;
-              }
-              const written = readFileSync24(promptPath, "utf-8");
-              const marker = parseExplicitDuplicateMarker(written);
-              if (!marker) {
+              const written = existsSync62(promptPath) ? readFileSync24(promptPath, "utf-8") : "";
+              const duplicateResolution = resolveExplicitDuplicateMarker(written, task.title);
+              if (!duplicateResolution.marker || duplicateResolution.conflict) {
                 continue;
               }
+              const marker = duplicateResolution.marker;
               if (processedMarkers >= 50) {
                 break;
               }
@@ -227616,7 +227795,10 @@ var init_self_healing = __esm({
               const canonicalFlags = await resolveNearDuplicateCanonicalFlags(this.store, canonicalTask);
               if (!canonicalTask || isNearDuplicateCanonicalInactive(canonicalTask, canonicalFlags)) {
                 if (canClearInactiveMarker) {
-                  rmSync7(promptPath, { force: true });
+                  if (duplicateResolution.source !== "title") rmSync7(promptPath, { force: true });
+                  if (resolveExplicitDuplicateMarker(null, task.title).marker?.canonicalId === marker.canonicalId) {
+                    await this.store.updateTask(task.id, { title: `Duplicate redirect cleared: ${marker.canonicalId}` });
+                  }
                   const priorClearCount = typeof task.sourceMetadata?.duplicateMarkerClearCount === "number" ? task.sourceMetadata.duplicateMarkerClearCount : 0;
                   const patch = buildMarkerClearedReplanTaskPatch(marker.canonicalId, priorClearCount);
                   await this.store.updateTask(task.id, patch);
@@ -227635,7 +227817,10 @@ var init_self_healing = __esm({
               const resolution = settings.triageDuplicateResolution ?? "prompt";
               if (resolution === "prompt" && isTriageDuplicateKeepAcknowledged(task.sourceMetadata, canonicalTask.id)) {
                 if (canClearInactiveMarker) {
-                  rmSync7(promptPath, { force: true });
+                  if (duplicateResolution.source !== "title") rmSync7(promptPath, { force: true });
+                  if (resolveExplicitDuplicateMarker(null, task.title).marker?.canonicalId === marker.canonicalId) {
+                    await this.store.updateTask(task.id, { title: `Duplicate redirect cleared: ${marker.canonicalId}` });
+                  }
                   const priorKeepClears = typeof task.sourceMetadata?.duplicateMarkerClearCount === "number" ? task.sourceMetadata.duplicateMarkerClearCount : 0;
                   const keepExhausted = priorKeepClears >= 1;
                   await this.store.updateTask(
@@ -227660,7 +227845,10 @@ var init_self_healing = __esm({
                 await flagTriageDuplicate(this.store, task.id, canonicalTask.id);
                 await this.store.updateTask(task.id, { paused: true, pausedReason: "duplicate-decision-required", status: null });
               } else {
-                rmSync7(promptPath, { force: true });
+                if (duplicateResolution.source !== "title") rmSync7(promptPath, { force: true });
+                if (resolveExplicitDuplicateMarker(null, task.title).marker?.canonicalId === marker.canonicalId) {
+                  await this.store.updateTask(task.id, { title: `Duplicate redirect cleared: ${marker.canonicalId}` });
+                }
                 await this.store.updateTask(task.id, buildMarkerClearedReplanTaskPatch(canonicalTask.id));
                 if (typeof this.store.logEntry === "function") {
                   await Promise.resolve(this.store.logEntry(
@@ -229697,7 +229885,7 @@ var init_triage = __esm({
           planLog.warn(`${task.id} planning recovery skipped \u2014 PROMPT.md failed deterministic validation (${deterministicSpecFailure})`);
           return false;
         }
-        const isExplicitDuplicateRedirect = Boolean(parseExplicitDuplicateMarker(written));
+        const isExplicitDuplicateRedirect = Boolean(resolveExplicitDuplicateMarker(written, task.title).marker);
         const workflow = await resolveWorkflowIrForTask(this.store, task.id).catch(() => void 0);
         const requiresPromptImplementationSteps = workflow?.nodes.some(
           (node) => node.kind === "parse-steps" && (node.config?.artifact === void 0 || node.config.artifact === "PROMPT.md") && node.config?.parser === "step-headings" && node.config?.requireStepsUnlessNoCommits === true
@@ -230119,7 +230307,7 @@ var init_triage = __esm({
                 phase: "triage",
                 source: "triage"
               });
-              void throttleAuditor.database({
+              void (throttleAuditor.databaseWithOutcome ?? throttleAuditor.database)({
                 type: "task:plan-admission-throttled",
                 target: eligibleIds[0] ?? this.rootDir,
                 metadata: {
@@ -230132,7 +230320,9 @@ var init_triage = __esm({
                   processingCount: this.processing.size,
                   processingTaskIds: processingIds
                 }
-              }).then(() => {
+              }).then((result2) => {
+                const outcome = result2?.outcome;
+                if (outcome !== "recorded" && outcome !== "absent") return;
                 this.lastPlanThrottleSignature = throttleSignature;
                 void Promise.all(eligibleIds.map((taskId) => this.store.logEntry(taskId, capacityReason))).catch((logErr) => {
                   planLog.warn(`Failed to write planning capacity reason: ${logErr instanceof Error ? logErr.message : String(logErr)}`);
@@ -230276,6 +230466,44 @@ var init_triage = __esm({
           return false;
         }
       }
+      /**
+       * Resolves an exact prompt/title redirect before this task claims any planning capacity.
+       *
+       * FNXC:DuplicateIntake 2026-08-09-01:31:
+       * FN-8840 requires title redirects to take the same duplicate-decision route as prompt
+       * redirects before `specifyTask()` can start a planner session. Reading the prompt here is
+       * required only to detect a conflicting exact marker; a missing or unreadable prompt leaves
+       * a title-only redirect actionable and never lets it consume an implementation session.
+      *
+       * FNXC:DuplicateIntake 2026-08-23-18:30:
+       * This whole title-aware path (plus the `source: "prompt" | "title"` plumbing in
+       * `clearExplicitDuplicateMarker` and the conflict guard in `finalizeApprovedTaskBody`) was
+       * removed by accident in 1cf86baa1c ("refactor: package code organization wave 18"), which
+       * reverted FN-8840 in triage.ts only — every other FN-8840 surface (dashboard task routes,
+       * `handle-graph-failure.ts`, core `resolveExplicitDuplicateMarker`) kept it. A title-only
+       * `DUPLICATE: <id>` card therefore consumed a full planner session again instead of taking the
+       * duplicate-decision route. Restored here; do not "simplify" back to prompt-only parsing.
+       */
+      async finalizeExplicitDuplicateBeforePlanning(task) {
+        try {
+          const liveTask = await this.store.getTask(task.id).catch(() => null);
+          if (!liveTask || liveTask.paused === true || liveTask.userPaused === true) return false;
+          const promptPath = join77(this.rootDir, ".fusion", "tasks", liveTask.id, "PROMPT.md");
+          const written = await readFile45(promptPath, "utf-8").catch(() => "");
+          const duplicateResolution = resolveExplicitDuplicateMarker(written, liveTask.title);
+          if (!duplicateResolution.marker && !duplicateResolution.conflict) return false;
+          const settings = await mergeEffectiveSettings(this.store, liveTask, await this.store.getSettings());
+          if (duplicateResolution.conflict) {
+            await this.finalizeApprovedTask(liveTask, written, settings);
+            return true;
+          }
+          return await this.tryFinalizeExplicitDuplicateMarker(liveTask, written, settings);
+        } catch (error3) {
+          const message = error3 instanceof Error ? error3.message : String(error3);
+          planLog.warn(`${task.id}: pre-planning duplicate resolution failed open: ${message}`);
+          return false;
+        }
+      }
       async specifyTask(task) {
         if (this.resetFence.isResetHoldActive(task.id)) {
           if (dropPreHeldExecutorSlot(task.id)) this.options.semaphore?.release();
@@ -230288,6 +230516,11 @@ var init_triage = __esm({
           this.coordinatorAdmittedTaskIds.delete(task.id);
           return;
         }
+        if (await this.finalizeExplicitDuplicateBeforePlanning(task)) {
+          if (dropPreHeldExecutorSlot(task.id)) this.options.semaphore?.release();
+          this.coordinatorAdmittedTaskIds.delete(task.id);
+          return;
+        }
         if (await this.flagImportNearDuplicateBeforePlanning(task)) {
           if (dropPreHeldExecutorSlot(task.id)) this.options.semaphore?.release();
           return;
@@ -230821,12 +231054,28 @@ This is a multi-repository workspace task. Your final PROMPT.md MUST include a n
                   content,
                   false
                 ),
+                /*
+                FNXC:PlanArtifactPersistence 2026-08-23-19:24:
+                The project-database mirror is BEST-EFFORT — the comment above says so and validation below
+                owns the verdict. FN-151 (c1818ea819) routed it through the reset-fenced writer, which does
+                not swallow, so an infrastructure failure inside the lifecycle lock (e.g. a
+                PlanningLifecycleLockTransportError) aborted a planning attempt whose authoritative PROMPT.md
+                had already been written, and pre-empted both the unchanged-PROMPT verdict and FN-8911's
+                marker-consuming path. Degrade the mirror the way `mirrorPlanToProjectDb` always did; the
+                authoritative `writeAuthoritativePrompt` half deliberately still throws, and only a
+                lifecycle-lock TRANSPORT rejection is degraded here — every other mirror failure keeps
+                aborting the attempt exactly as before.
+                */
                 mirrorAuthoritativePlan: async (content) => await this.persistResetFencedPlanningArtifact(
                   task,
                   planningGeneration,
                   content,
                   true
-                )
+                ).catch((error3) => {
+                  if (!isPlanningLifecycleLockTransportError(error3)) throw error3;
+                  planLog.warn(`${task.id}: lifecycle-lock transport failure while mirroring the authoritative plan into the project database: ${error3.message}`);
+                  return false;
+                })
               });
               if (planPersistence.outcome === "recovery-fenced") return;
               if (planPersistence.outcome === "recovered") {
@@ -231490,11 +231739,11 @@ ${lines.join("\n")}` }],
       }
       async tryFinalizeExplicitDuplicateMarker(task, written, settings, options = {}, report2 = { outcome: "parked" }) {
         try {
-          const explicitDuplicateMarker = parseExplicitDuplicateMarker(written);
-          if (!explicitDuplicateMarker) {
+          const duplicateResolution = resolveExplicitDuplicateMarker(written, task.title);
+          if (!duplicateResolution.marker || duplicateResolution.conflict) {
             return false;
           }
-          const canonicalId = explicitDuplicateMarker.canonicalId;
+          const canonicalId = duplicateResolution.marker.canonicalId;
           const canonicalTask = await this.store.getTask(canonicalId);
           if (canonicalTask?.id.toLowerCase() === task.id.toLowerCase()) {
             return false;
@@ -231609,7 +231858,12 @@ ${lines.join("\n")}` }],
         */
       async clearDuplicateMarkerForReplan(task, canonicalId, feedback, options) {
         if (!await this.runIfStillPlanningUnderTaskLock(task, async () => {
-          await rm11(join77(this.rootDir, ".fusion", "tasks", task.id, "PROMPT.md"), { force: true });
+          if (options?.source !== "title") {
+            await rm11(join77(this.rootDir, ".fusion", "tasks", task.id, "PROMPT.md"), { force: true });
+          }
+          if (resolveExplicitDuplicateMarker(null, task.title).marker?.canonicalId === canonicalId) {
+            await this.store.updateTask(task.id, { title: `Duplicate redirect cleared: ${canonicalId}` });
+          }
         })) return false;
         const priorClearCount = options?.priorClearCount ?? 0;
         if (options?.exhausted) {
@@ -231639,8 +231893,14 @@ ${lines.join("\n")}` }],
       }
       async finalizeApprovedTaskBody(task, writtenInput, settings, options = {}, report2 = { outcome: "parked" }) {
         let written = writtenInput;
-        if (await this.recoverMissingPromptBeforeRelease(task)) return;
-        const explicitDuplicateMarker = parseExplicitDuplicateMarker(written);
+        const duplicateResolution = resolveExplicitDuplicateMarker(written, task.title);
+        if (duplicateResolution.conflict) {
+          await this.updatePlanningStateIfStillCurrent(task, { status: "needs-replan", error: null });
+          await this.store.logEntry(task.id, "Duplicate redirect sources conflict", "PROMPT.md and task title name different canonical tasks; correct one exact redirect before planning.");
+          return;
+        }
+        if (!duplicateResolution.marker && await this.recoverMissingPromptBeforeRelease(task)) return;
+        const explicitDuplicateMarker = duplicateResolution.marker;
         if (explicitDuplicateMarker) {
           await this.updatePlanningStateIfStillCurrent(task, (live) => {
             const customFields = { ...live.customFields ?? {} };
@@ -231648,6 +231908,7 @@ ${lines.join("\n")}` }],
             return { customFields };
           });
           const canonicalId = explicitDuplicateMarker.canonicalId;
+          const duplicateSource = duplicateResolution.source ?? "prompt";
           const canonicalTask = await this.store.getTask(canonicalId).catch(() => null);
           const canClearInactiveMarker = task.userPaused !== true && (task.paused !== true || task.pausedReason === "duplicate-decision-required") && (task.pausedReason == null || task.pausedReason === "duplicate-decision-required");
           const canonicalFlags = await resolveNearDuplicateCanonicalFlags(this.store, canonicalTask);
@@ -231659,7 +231920,7 @@ ${lines.join("\n")}` }],
                 task,
                 canonicalId,
                 buildInactiveDuplicateClearFeedback(canonicalId),
-                { exhausted: false, priorClearCount }
+                { exhausted: false, priorClearCount, source: duplicateSource }
               );
             }
             return;
@@ -231672,7 +231933,7 @@ ${lines.join("\n")}` }],
                 task,
                 canonicalId,
                 buildKeepDuplicateClearFeedback(canonicalId),
-                { exhausted: priorClearCount >= 1, priorClearCount }
+                { exhausted: priorClearCount >= 1, priorClearCount, source: duplicateSource }
               );
             }
             return;
@@ -231710,7 +231971,8 @@ ${lines.join("\n")}` }],
           await this.clearDuplicateMarkerForReplan(
             task,
             canonicalId,
-            buildKeepDuplicateClearFeedback(canonicalId)
+            buildKeepDuplicateClearFeedback(canonicalId),
+            { source: duplicateSource }
           );
           return;
         }
@@ -243346,6 +243608,7 @@ function buildActionGateContext(deps, taskId, agent, projectDefaultPolicy) {
           executorLog.warn(`${taskId}: failed to suspend in-flight session while awaiting approval: ${error3 instanceof Error ? error3.message : String(error3)}`);
         });
       }
+      void emitApprovalMail({ messageStore: deps.messageStore ?? void 0, approvalRequestId, toolName: decision.toolName, taskId, agentId: actorId, agentName: actorName });
       if (agent && deps.agentStore) {
         await deps.agentStore.updateAgentState(agent.id, "paused");
         await deps.agentStore.updateAgent(agent.id, { pauseReason: "awaiting-approval" });
@@ -243364,6 +243627,7 @@ var init_build_action_gate_context = __esm({
   "../engine/src/executor/build-action-gate-context.ts"() {
     "use strict";
     init_src2();
+    init_approval_mail();
     init_workflow_agent_router();
     init_logger3();
   }
@@ -243423,6 +243687,7 @@ function buildPermanentAgentGatingContext(deps, taskId, agent, projectDefaultPol
         deps.approvalSuspended.delete(taskId);
         throw error3;
       }
+      void emitApprovalMail({ messageStore: deps.messageStore ?? void 0, approvalRequestId, toolName, taskId, agentId: actorId, agentName: actorName });
     }
   };
 }
@@ -243430,6 +243695,7 @@ var init_build_permanent_agent_gating_context = __esm({
   "../engine/src/executor/build-permanent-agent-gating-context.ts"() {
     "use strict";
     init_src2();
+    init_approval_mail();
     init_permanent_agent_gating();
   }
 });
@@ -258743,6 +259009,7 @@ function buildBuildActionGateContextDeps(host) {
     get approvalRequestStore() {
       return host.approvalRequestStore;
     },
+    messageStore: host.options.messageStore,
     activeWorkflowAuthorities: host.activeWorkflowAuthorities,
     activeWorkflowGraphAbortControllers: host.activeWorkflowGraphAbortControllers
   };
@@ -258899,7 +259166,8 @@ function buildBuildPermanentAgentGatingContextDeps(host) {
     approvalSuspended: host.approvalSuspended,
     get approvalRequestStore() {
       return host.approvalRequestStore;
-    }
+    },
+    messageStore: host.options.messageStore
   };
 }
 function buildPersistTokenUsageDeps(host) {
@@ -265679,6 +265947,10 @@ async function enforceAiMergeSquashGates(params) {
     if (!(error3 instanceof FileScopeViolationError)) throw error3;
     await execFileAsync26("git", ["reset", "--hard", params.tipSha], { cwd: params.mergeRoot });
     await execFileAsync26("git", ["clean", "-fd"], { cwd: params.mergeRoot });
+    try {
+      await params.store.updateTask(params.taskId, { aiMergeReviewReconciliation: null });
+    } catch {
+    }
     throw error3;
   }
 }
@@ -266552,11 +266824,12 @@ async function cleanupAiMergeWorktree(input) {
   }
   const removalTargets = canonicalRoot === mergeRoot ? [mergeRoot] : [canonicalRoot, mergeRoot];
   const cleanupMetadata = { taskId, mergeRoot: canonicalRoot, requestedMergeRoot: mergeRoot };
-  let alreadyAbsent = false;
+  let alreadyAbsent = removalTargets.every((target) => !existsSync84(target));
   if (worktreeAdded) {
     try {
       await gitRunner(["worktree", "remove", "--force", canonicalRoot], projectRootDir);
-      await audit.git({ type: "merge:ai-worktree-cleanup", target: canonicalRoot, metadata: { ...cleanupMetadata, phase: "git-remove", success: true } });
+      if (alreadyAbsent) await log44(`AI merge cleanup: worktree ${canonicalRoot} was already absent before git removal; treating cleanup as idempotent`);
+      await audit.git({ type: "merge:ai-worktree-cleanup", target: canonicalRoot, metadata: { ...cleanupMetadata, phase: "git-remove", success: true, ...alreadyAbsent ? { alreadyAbsent: true, idempotent: true } : {} } });
     } catch (err) {
       const error3 = describeCleanupError(err);
       const code = getErrorStringProperty(err, "code");
@@ -268096,7 +268369,7 @@ async function landWorkspaceTask(store, task, workspaceRootDir, options = {}, de
   const requiresRepositoryReviewEvidence = approvedReviewEvidence !== void 0 || (mergeBoundaryTask.enabledWorkflowSteps ?? []).some((step) => /review/i.test(step));
   const approvalMissingRepositories = Object.entries(mergeBoundaryFingerprints).filter(([repoRel]) => requiresRepositoryReviewEvidence && !approvedReviewEvidence?.[repoRel]).map(([repoRel]) => repoRel).sort();
   const contentChangedRepositories = Object.entries(mergeBoundaryFingerprints).filter(([repoRel, fingerprint]) => requiresRepositoryReviewEvidence && Boolean(approvedReviewEvidence?.[repoRel]) && approvedReviewEvidence?.[repoRel]?.fingerprint !== fingerprint).map(([repoRel]) => repoRel).sort();
-  const changedFiles = normalizedMergeBoundaryFiles.filter((file) => !persistedReviewFiles.includes(file)).sort();
+  const changedFiles = requiresRepositoryReviewEvidence ? normalizedMergeBoundaryFiles.filter((file) => !persistedReviewFiles.includes(file)).sort() : [];
   if (approvalMissingRepositories.length > 0) {
     throw new WorkspaceReviewRequiredError(taskId, {
       kind: "approval-missing",
@@ -285097,6 +285370,9 @@ function emitMergeRequestShadowDequeueParityAudit(store, legacyTaskId, shadowTas
     metadata: { legacyTaskId, shadowTaskId, agree }
   }, { log: runtimeLog });
 }
+function isActiveMergeRequestState(state) {
+  return state === "running" || state === "retrying";
+}
 function getPrMergeRetryNotBefore(task) {
   const retries = task.mergeRetries ?? 0;
   const updatedAt = task.updatedAt ? Date.parse(task.updatedAt) : NaN;
@@ -285178,6 +285454,7 @@ var init_project_engine = __esm({
     init_overseer_advisor_service();
     init_overseer_advise_tool();
     init_agent_session_helpers();
+    init_active_session_registry();
     init_pr_reconcile();
     init_pr_comment_handler();
     init_notifier();
@@ -285378,6 +285655,12 @@ var init_project_engine = __esm({
       };
       // ── Auto-merge state ──
       mergeQueue = [];
+      /* FNXC:MergeAuthority 2026-08-23-18:05: last logged sweep-hold reason per task, so a held card is
+         reported once per reason change instead of every 15s poll. In-memory by design — it is a log
+         de-duplicator, not state anything reads back. Pruned each sweep to the current candidate set
+         (review finding #11), so a card that leaves review by ANY route drops out; admission and
+         soft-delete also clear their entry directly. */
+      mergeSweepHoldReasons = /* @__PURE__ */ new Map();
       mergeActive = /* @__PURE__ */ new Set();
       /** Capacity-deferred ids stay out of the runnable queue until their retry timer fires. */
       capacityDeferredMergeTaskIds = /* @__PURE__ */ new Set();
@@ -287559,25 +287842,174 @@ ${detail}`);
           );
         });
         const allowFlags = await Promise.all(candidates.map((t) => this.allowInReviewMergeProcessing(t, settings, this.runtime.getTaskStore())));
-        const unrunGateFlags = await Promise.all(
-          candidates.map(async (t) => {
-            try {
-              const ir2 = await resolveWorkflowIrForTask(this.runtime.getTaskStore(), t.id, reviewLaneIrCache);
-              if (!ir2) return false;
-              return findUnrunRequiredPreMergeStepIds(ir2, t).length > 0;
-            } catch {
+        const sweepBatch = await this.loadMergeSweepBatch(candidates);
+        const admissions = await Promise.all(
+          candidates.map((t) => this.classifyMergeSweepCandidate(t, reviewLaneIrCache, sweepBatch))
+        );
+        const candidateIds = new Set(candidates.map((t) => t.id));
+        for (const heldTaskId of [...this.mergeSweepHoldReasons.keys()]) {
+          if (!candidateIds.has(heldTaskId)) this.mergeSweepHoldReasons.delete(heldTaskId);
+        }
+        const eligible = sortTasksByPriorityThenAgeAndId(
+          candidates.filter((t, i) => {
+            if (!allowFlags[i]) return false;
+            const admission = admissions[i];
+            if (!admission.admit) {
+              const previous = this.mergeSweepHoldReasons.get(t.id);
+              if (previous !== admission.reason) {
+                this.mergeSweepHoldReasons.set(t.id, admission.reason);
+                runtimeLog.log(`Auto-merge sweep holding ${t.id}: ${admission.reason} (graph owns the merge decision)`);
+              }
               return false;
             }
+            this.mergeSweepHoldReasons.delete(t.id);
+            return true;
           })
         );
-        const eligible = sortTasksByPriorityThenAgeAndId(
-          candidates.filter((_3, i) => allowFlags[i] && !unrunGateFlags[i])
-        );
         for (const t of eligible) {
           this.internalEnqueueMerge(t.id);
         }
         return eligible.length;
       }
+      /*
+        FNXC:MergeAuthority 2026-08-23-18:05 (FN-9191 + FN-9193 wedges):
+        Gather the sweep-admission inputs for one candidate. Probes are best-effort, but they do NOT all
+        degrade in the same direction — the direction is chosen per probe by what a wrong answer costs:
+      
+          - liveness, continuations: a throw must not wedge the whole lane, and the classifier's other
+            fences still hold, so they degrade toward "not live" / "unreadable" (the latter refuses
+            initiation on its own — see `continuationsReadable`).
+          - `gatesSatisfied`: the ONE deliberate fail-CLOSED probe (review finding #8). If we cannot prove
+            the pre-merge gates are satisfied we must not start a merge; withholding costs a delay, while
+            admitting costs an unreviewed branch on the target. The real door re-checks authoritatively.
+      
+        MULTI-REPO / WORKSPACE (and shared-branch groups) resolve through the SAME rules, deliberately:
+          - `branch-group-member-integration` and `branch-group-promotion` are merge-region kinds, so a
+            shared-branch member parked at either is admitted like any other merge-region card.
+          - A workspace sub-repo land registers `workspace-repo-land` / `workspace-repo-acquire` paths in
+            `activeSessionRegistry`, so a task mid-land reads as live and is held — this is what stops a
+            second dispatch racing a partial land.
+          - A workspace partial land re-enqueues through `internalEnqueueMerge` directly (the error path
+            below), which never consults this gate; the merging status it leaves also satisfies
+            `interruptedMergeAttempt` so a restarted engine re-drives the same land.
+          - `isMergePending` covers the cross-node case: another engine holding a durable merge-dispatch
+            lease reads as live here, so two nodes on one central DB cannot both dispatch the same land.
+            NOTE it answers `true` from its OWN catch on an unreadable lease probe (see its FNXC note), so
+            a persistently broken lease read holds every card in this lane rather than racing another
+            node. That is the intended conservative direction; it is not a silent no-op.
+      
+        `batch` carries the sweep-wide batched reads (review finding #10) so this runs at O(1) queries per
+        poll instead of O(cards). It is optional: single-card callers (the column-entry handoff, the
+        unpause re-enqueue, the pre-dispatch re-check) pass nothing and fall back to per-task reads.
+        */
+      async classifyMergeSweepCandidate(task, irCache, batch, opts = {}) {
+        const store = this.runtime.getTaskStore();
+        let irTrust = "unresolved-selection";
+        let ir2 = null;
+        try {
+          const resolved = await resolveWorkflowIrForTaskWithProvenance(store, task.id, irCache);
+          ir2 = resolved.ir;
+          irTrust = resolved.source === "selection" ? "cards-own" : resolved.selectionAbsent === true ? "effective-default" : "unresolved-selection";
+        } catch {
+          ir2 = null;
+          irTrust = "unresolved-selection";
+        }
+        let hasLiveSession = false;
+        try {
+          hasLiveSession = executingTaskLock.has(task.id) || activeSessionRegistry.pathsForTask(task.id).length > 0 || !opts.ignoreOwnMergePipeline && (this.activeMergeTaskId === task.id || await this.isMergePending(task.id));
+        } catch {
+          hasLiveSession = false;
+        }
+        let continuationPositions = [];
+        let continuationsReadable = true;
+        try {
+          const readContinuations = store.listWorkflowWorkItemsForTask;
+          const items = batch?.continuations ? batch.continuations.get(task.id) ?? [] : typeof readContinuations === "function" ? await readContinuations.call(store, task.id, { kinds: ["task"] }) : [];
+          continuationPositions = items.filter((item) => ACTIVE_WORKFLOW_WORK_ITEM_STATES.includes(item.state)).map((item) => ir2 ? classifyWorkflowNodeMergeRegion(ir2, item.nodeId) : "unknown");
+        } catch {
+          continuationsReadable = false;
+          continuationPositions = [];
+        }
+        if (batch && !batch.continuationsReadable) continuationsReadable = false;
+        let mergeRequestActive = false;
+        if (!isActiveMergeStatus(task.status)) {
+          try {
+            mergeRequestActive = batch?.mergeRequests ? isActiveMergeRequestState(batch.mergeRequests.get(task.id)?.state) : isActiveMergeRequestState((await store.getMergeRequestRecordAsync?.(task.id))?.state);
+          } catch {
+            mergeRequestActive = false;
+          }
+        }
+        let gatesSatisfied = true;
+        try {
+          const reviewColumns = /* @__PURE__ */ new Set([task.column]);
+          gatesSatisfied = !getTaskMergeBlocker({ ...task, steps: task.steps ?? [] }, {
+            reviewColumns,
+            requiredPreMergeStepIds: ir2 ? resolveRequiredPreMergeStepIds(ir2, task.enabledWorkflowSteps) : void 0
+          });
+        } catch {
+          gatesSatisfied = false;
+        }
+        const updatedAtMs = Date.parse(task.updatedAt ?? "");
+        const quiescentMs = Number.isFinite(updatedAtMs) ? Math.max(0, Date.now() - updatedAtMs) : Number.POSITIVE_INFINITY;
+        return classifyMergeSweepAdmission({
+          irTrust,
+          continuationPositions,
+          continuationsReadable,
+          mergeConfirmed: task.mergeDetails?.mergeConfirmed === true,
+          hasLiveSession,
+          interruptedMergeAttempt: isActiveMergeStatus(task.status) || mergeRequestActive,
+          quiescentMs,
+          gatesSatisfied
+        });
+      }
+      /*
+      FNXC:MergeAuthority 2026-08-23-20:05 (review finding #10):
+      One batched read per sweep instead of one per card. The sweep asks the same two questions of every
+      review-lane card on every 15s poll; per-task reads made that 2N queries. A failed batch read is
+      reported as unreadable rather than as empty, so it refuses initiation exactly like the per-task
+      failure path does.
+      */
+      /*
+      FNXC:MergeAuthority 2026-08-23-20:05 (review finding #2):
+      Position-only dispatch guard. Answers ONE question — "do this card's active continuations still
+      place it inside its workflow's merge region?" — and fails OPEN on every uncertainty (unreadable
+      continuations, an unresolvable workflow, no continuation at all), because the merge door behind it
+      is the authority on everything else. A card with NO active continuation is authorized here by
+      design: that is the shape of the interrupted-merge and quiescent-stall recoveries.
+      */
+      async isDispatchStillGraphAuthorized(task) {
+        const store = this.runtime.getTaskStore();
+        try {
+          const readContinuations = store.listWorkflowWorkItemsForTask;
+          if (typeof readContinuations !== "function") return true;
+          const items = await readContinuations.call(this.runtime.getTaskStore(), task.id, { kinds: ["task"] });
+          const active2 = items.filter((item) => ACTIVE_WORKFLOW_WORK_ITEM_STATES.includes(item.state));
+          if (active2.length === 0) return true;
+          const resolved = await resolveWorkflowIrForTaskWithProvenance(this.runtime.getTaskStore(), task.id);
+          if (resolved.source !== "selection" && resolved.selectionAbsent !== true) return true;
+          return active2.some((item) => classifyWorkflowNodeMergeRegion(resolved.ir, item.nodeId) !== "outside-merge-region");
+        } catch {
+          return true;
+        }
+      }
+      async loadMergeSweepBatch(candidates) {
+        const store = this.runtime.getTaskStore();
+        const ids = candidates.map((t) => t.id);
+        const batch = { continuationsReadable: true };
+        if (ids.length === 0) return batch;
+        try {
+          batch.continuations = typeof store.listWorkflowWorkItemsForTasks === "function" ? await store.listWorkflowWorkItemsForTasks.call(this.runtime.getTaskStore(), ids, { kinds: ["task"] }) : void 0;
+        } catch {
+          batch.continuations = void 0;
+          batch.continuationsReadable = false;
+        }
+        try {
+          batch.mergeRequests = typeof store.getMergeRequestRecordsAsync === "function" ? await store.getMergeRequestRecordsAsync.call(this.runtime.getTaskStore(), ids) : void 0;
+        } catch {
+          batch.mergeRequests = void 0;
+        }
+        return batch;
+      }
       reconcileStaleMergeActive() {
         let cleared = 0;
         for (const taskId of [...this.mergeActive]) {
@@ -287896,6 +288328,11 @@ ${detail}`);
                   }
                   continue;
                 }
+                if (!task.mergeDetails?.mergeConfirmed && !await this.isDispatchStillGraphAuthorized(task)) {
+                  runtimeLog.log(`Auto-merge dispatch skipped for ${taskId}: graph moved the card out of its merge region while it was queued`);
+                  this.clearMergeActive(taskId);
+                  continue;
+                }
                 if (task.mergeDetails?.mergeConfirmed) {
                   const branchGroupForFastPathCandidate = isSharedBranchGroupMemberIntegration(task) ? store.getBranchGroup?.(task.branchContext?.groupId) : null;
                   const fastPathDefaultBranch = await resolveIntegrationBranch(this.config.workingDirectory, settings2);
@@ -288015,7 +288452,7 @@ ${detail}`);
                       continue;
                     }
                   }
-                  const blockerReason = getTaskHardMergeBlocker({
+                  const blockerReason = getMergeConfirmedFinalizationBlocker({
                     ...task,
                     /*
                                     FNXC:WorkflowResolvedColumns 2026-07-30-18:05 (this parked ALREADY-MERGED work as failed):
@@ -288029,7 +288466,13 @@ ${detail}`);
                                     and for the reason recorded there: `"in-review"` is the review-eligible SENTINEL for this
                                     helper, not a lifecycle column, so a merge-confirmed card evaluates the same blocker set
                                     on a custom workflow as on the builtin one. The column identity of an already-landed card
-                                    is not what this check is for — paused / error / incomplete steps still apply.
+                                    is not what this check is for.
+                    
+                                    FNXC:MergeConfirmedFinalization 2026-08-23-21:40 (FN-9193): incomplete steps NO LONGER
+                                    apply here. The fast path above already proved this merge landed, and holding a landed
+                                    card out of `done` for unfinished steps is what left FN-9193 permanently unfinalizable —
+                                    a restart then replanned fresh pending steps and re-created the very block it was meant
+                                    to clear. Paused/error/pre-merge-step blockers still apply.
                                     */
                     column: REVIEW_ELIGIBLE_SENTINEL_COLUMN,
                     // Merge-confirmed tasks have already landed. Treat stale merge
@@ -288039,6 +288482,14 @@ ${detail}`);
                     status: clearMergeConfirmedTransientStatus(task.status),
                     error: void 0
                   });
+                  const unfinishedFastPathSteps = getUnfinishedStepTitles(task);
+                  if (unfinishedFastPathSteps.length > 0) {
+                    await store.logEntry(
+                      taskId,
+                      `Finalizing proven merge with ${unfinishedFastPathSteps.length} unfinished step(s) \u2014 the branch already landed, so these did not run: ${unfinishedFastPathSteps.slice(0, 8).join("; ")}`,
+                      "MergeConfirmedFinalizeUnfinishedSteps"
+                    ).catch(() => void 0);
+                  }
                   if (blockerReason) {
                     await store.updateTask(taskId, {
                       status: "failed",
@@ -289190,6 +289641,11 @@ ${detail}`);
                 runtimeLog.warn(`Auto-merge handoff (${task.id}): clearing stale mergeActive before enqueue`);
                 this.clearMergeActive(task.id);
               }
+              const handoffAdmission = await this.classifyMergeSweepCandidate(latestTask, /* @__PURE__ */ new Map(), void 0, { ignoreOwnMergePipeline: true });
+              if (!handoffAdmission.admit) {
+                runtimeLog.log(`Auto-merge handoff (${task.id}) skipped: ${handoffAdmission.reason} (graph owns the merge decision)`);
+                return;
+              }
               this.internalEnqueueMerge(task.id);
             } catch (err) {
               runtimeLog.warn(
@@ -289277,6 +289733,11 @@ ${detail}`);
             if (this.options.getTaskMergeBlocker?.(task)) {
               return;
             }
+            const unpauseAdmission = await this.classifyMergeSweepCandidate(task, /* @__PURE__ */ new Map(), void 0, { ignoreOwnMergePipeline: true });
+            if (!unpauseAdmission.admit) {
+              runtimeLog.log(`In-review unpause: ${task.id} not re-enqueued: ${unpauseAdmission.reason} (graph owns the merge decision)`);
+              return;
+            }
             runtimeLog.log(`Unpaused in-review task re-enqueued for auto-merge: ${task.id}`);
             this.internalEnqueueMerge(task.id);
           } catch (err) {
@@ -289287,6 +289748,7 @@ ${detail}`);
         };
         this.taskDeletedHandler = (task) => {
           this.pausedReviewTaskIds.delete(task.id);
+          this.mergeSweepHoldReasons.delete(task.id);
           const queueLengthBefore = this.mergeQueue.length;
           this.mergeQueue = this.mergeQueue.filter((queuedTaskId) => queuedTaskId !== task.id);
           const removedFromQueue = this.mergeQueue.length !== queueLengthBefore;