@stravica-ai/digital-operator-pa 0.1.43 → 0.1.44

package/dist/engineering-pa-cli/src/pa/cli.mjs

@@ -360,9 +360,11 @@ Usage:
 Bind host defaults to loopback (127.0.0.1). Use --host <addr> (or the
 WORKSPACE_HOST env var) to expose the workspace on another interface.
 
-When the workspace is supervised by launchd (~/Library/LaunchAgents/com.dave.workspace.plist)
-or systemd (~/.config/systemd/user/dave-workspace.service), \`stop\` is refused and \`restart\`
+When the workspace is supervised by launchd (~/Library/LaunchAgents/com.<paName>.workspace.plist)
+or systemd (~/.config/systemd/user/<paName>-workspace.service), \`stop\` is refused and \`restart\`
 delegates to the supervisor — this is the in-place version-pickup path after \`pnpm update\`.
+Unit labels are derived from operator/config/preferences.json:paName; the legacy
+com.dave.workspace / dave-workspace.service is still recognised for pre-0.1.44 installs.
 
 Exit codes (tooling standard §6):
   0 ok | 1 usage error | 2 operational failure | 3 transport/IO failure

package/dist/engineering-pa-core/knowledge/platform-tooling/workspace-server.md

@@ -33,7 +33,7 @@ The workspace server hosts `viewer.html` — the PA's canonical surface for long
 
 ## Supervisor-aware lifecycle
 
-When the workspace is supervised by launchd (`~/Library/LaunchAgents/com.dave.workspace.plist`) or systemd (`~/.config/systemd/user/dave-workspace.service`), `stop` is refused and `restart` delegates to the supervisor. This is the in-place version-pickup path after `pnpm update @stravica-ai/digital-operator-pa`.
+When the workspace is supervised by launchd (`~/Library/LaunchAgents/com.<paName>.workspace.plist`) or systemd (`~/.config/systemd/user/<paName>-workspace.service`), `stop` is refused and `restart` delegates to the supervisor. This is the in-place version-pickup path after `pnpm update @stravica-ai/digital-operator-pa`. Unit labels follow the scheduler's `com.{agent}.{id}` convention with `id = workspace` and `agent` resolved from `paName` in `operator/config/preferences.json`; pre-0.1.44 installs are still recognised under the legacy `com.dave.workspace` / `dave-workspace.service` name until you run `install-daemon install --migrate` to rename.
 
 ## When to use the workspace
 

package/dist/engineering-pa-library-cli/README.md

@@ -27,6 +27,31 @@ deliberately not a shim for the pre-remote library sweep.
 - `library status [--json]`
   GETs `/status` from the service, plus `git rev-list HEAD..origin/main --count`
   per tier clone.
+- `library up-merge [--repo <owner/name>]... [--pr <number>] [--dry-run] [--once] [--verbose] [--json]`
+  Scheduled auto-merger for library up-path PRs. Scans configured library
+  repos for open PRs from branch `library-sync-up/<device>` and merges each
+  one whose diff is confined to the paths `<device>` owns per
+  `operator/registry/repos.json`. Anything else is a refusal: the PR is
+  left open with a one-time comment (idempotent via an HTML marker) and no
+  merge is ever attempted. Writes one JSONL line per PR per pass to
+  `library.upMerge.eventsLog` (default `.cache/library-up-merger/events.jsonl`).
+  Runs the same in SIMPLE and REMOTE mode (GitHub-side maintenance verb,
+  no ingest touch). Config in the `library.upMerge` stanza; see below.
+
+### Scope rule (verbatim)
+
+```
+A PR is eligible when both:
+  (1) its head branch matches "library-sync-up/<device>"
+  (2) every changed file's repo-relative path falls under a path <device>
+      owns for that library repo per operator/registry/repos.json:
+        for each mount M where M.upPath === true and M.upPathOwner === <device>:
+          allowed prefix = M.from + include, for each include in M.upPathInclude
+        a file matches when its path equals a prefix (single-file include)
+        or starts with prefix + "/" (directory include).
+Any file outside the device's allowed prefixes is a refusal - the PR is
+left open, a one-time comment is posted, and no merge is ever attempted.
+```
 
 ## Configuration
 
@@ -45,6 +70,40 @@ deliberately not a shim for the pre-remote library sweep.
 
 - `LIBRARY_PULL_CLONES_ROOT` env — overrides the pull-clones root at runtime.
 
+- `library.upMerge` stanza in preferences (used by `library up-merge` only):
+
+  ```json
+  {
+    "library": {
+      "upMerge": {
+        "repos": ["Stravica/stravica-library-wsd"],
+        "registryPath": "operator/registry/repos.json",
+        "eventsLog": ".cache/library-up-merger/events.jsonl",
+        "mergeMethod": "merge",
+        "branchPrefix": "library-sync-up/",
+        "deleteBranchOnMerge": true,
+        "ghBin": "gh"
+      }
+    }
+  }
+  ```
+
+  Every field has a safe default; `repos` defaults to `[]` (no repos scanned)
+  and can be overridden per invocation with `--repo <owner/name>` (repeatable).
+
+### Migrating from the HQ `library-up-merger` tool
+
+`library up-merge` is a behaviour-identical promotion of the HQ tool at
+`operator/extensions/tools/library-up-merger/`. The scheduled command
+changes from
+`node operator/extensions/tools/library-up-merger/bin/library-up-merger`
+to `pnpm exec library up-merge`. The scope rule, refusal marker, events
+log path, and default merge method are unchanged; the HQ tool's
+`config.json` maps 1:1 to the `library.upMerge` stanza above (`repos`,
+`registryPath`, `eventsLog`, `mergeMethod`, `branchPrefix`,
+`deleteBranchOnMerge`). Repoint the schedule at the new command and
+retire the HQ tool.
+
 Ingest authenticates by subkey alone (spec §3.4, main ruling 2026-08-20 option b);
 no install-key header is sent. The former `REMOTE_LIBRARY_INSTALL_KEY` env
 interim was removed in the same pass.

package/dist/engineering-pa-library-cli/src/cli.mjs

@@ -22,6 +22,7 @@ import { runGet } from './verbs/get.mjs';
 import { runSearch } from './verbs/search.mjs';
 import { runStatus } from './verbs/status.mjs';
 import { runRefreshClones } from './verbs/refresh-clones.mjs';
+import { runUpMerge } from './verbs/up-merge.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -52,13 +53,15 @@ Usage:
   library search <query> [--files-only]
   library status [--json]
   library refresh-clones [--json] [--timeout-ms <n>] [--tier <name>]...
+  library up-merge [--repo <owner/name>]... [--pr <number>] [--dry-run] [--once] [--verbose] [--json]
   library -h | --help
   library -v | --version
 
 Reads config from operator/config/preferences.json (+ preferences.local.json overlay).
 Verbs are only active in REMOTE mode. SIMPLE mode 'library status' prints a
 one-line mode summary and exits 0; every other verb exits 1 in SIMPLE mode
-with a clean not-applicable message.
+with a clean not-applicable message. 'library up-merge' is a GitHub-side
+maintenance verb and runs in both SIMPLE and REMOTE mode.
 
 --help and --version never touch config or the vault, so they always work
 from a directory with no operator config and no vault installed.
@@ -102,6 +105,18 @@ export async function main(argv, seams = {}) {
   }
 
   if (config.mode === 'simple') {
+    // `library up-merge` is a GitHub-side maintenance verb: it reads
+    // library.upMerge from preferences and hits gh, never the ingest
+    // service. It runs the same in SIMPLE and REMOTE mode.
+    if (verb === 'up-merge') {
+      const ctxUp = { config, log, err };
+      try {
+        return await runUpMerge({ ...ctxUp, args: parseUpMerge(rest) });
+      } catch (e) {
+        err(`[library up-merge] ${e.message ?? e}`);
+        return typeof e.exitCode === 'number' ? e.exitCode : 2;
+      }
+    }
     // `library status` is the one verb useful in SIMPLE mode too: a plain
     // one-line mode summary that tells the operator the CLI is installed
     // and the remote path is intentionally not wired. No vault touch,
@@ -141,6 +156,7 @@ export async function main(argv, seams = {}) {
       case 'search':   return await runSearch({ ...ctx, args: parseSearch(rest) });
       case 'status':   return await runStatus({ ...ctx, args: parseStatus(rest) });
       case 'refresh-clones': return await runRefreshClones({ ...ctx, args: parseRefreshClones(rest) });
+      case 'up-merge': return await runUpMerge({ ...ctx, args: parseUpMerge(rest) });
       default:
         err(`[library] unknown verb: ${verb}`);
         log(USAGE);
@@ -195,6 +211,30 @@ function parseStatus(argv) {
   });
   return { json: values.json };
 }
+function parseUpMerge(argv) {
+  const { values } = parseArgs({
+    args: argv,
+    strict: true,
+    allowPositionals: false,
+    options: {
+      repo:      { type: 'string', multiple: true },
+      pr:        { type: 'string' },
+      'dry-run': { type: 'boolean', default: false },
+      once:      { type: 'boolean', default: false },
+      verbose:   { type: 'boolean', default: false },
+      json:      { type: 'boolean', default: false },
+    },
+  });
+  const pr = values.pr ? parseInt(values.pr, 10) : undefined;
+  return {
+    repos: values.repo,
+    pr,
+    dryRun: values['dry-run'],
+    once: values.once,
+    verbose: values.verbose,
+    json: values.json,
+  };
+}
 function parseRefreshClones(argv) {
   const { values } = parseArgs({
     args: argv,

package/dist/engineering-pa-library-cli/src/up-merge/github.mjs

@@ -0,0 +1,103 @@
+// Thin wrappers around the gh CLI, factored so tests can inject a runner
+// and never spawn a real gh. Auth is handled by gh from the host's own
+// login (TheFoot on smarthome01 for the scheduled path today).
+//
+// The runner signature is deliberately narrow: (cmd, args, { input }) ->
+// Promise<{ code, stdout, stderr }>. Every wrapper takes an optional
+// `runner` seam that defaults to the module-local `defaultRunner`, which
+// is a plain spawn. Tests build a runner that inspects args and returns
+// canned stdout/stderr, so no gh process is ever invoked.
+//
+// Ported from operator/extensions/tools/library-up-merger/src/github.mjs
+// and factored for injection (w-2026-09-16-dave-014, d-2026-09-17-013).
+
+import { spawn } from 'node:child_process';
+
+/**
+ * @typedef {(cmd: string, args: string[], opts?: { input?: string }) => Promise<{ code: number, stdout: string, stderr: string }>} Runner
+ */
+
+/** @type {Runner} */
+export function defaultRunner(cmd, args, { input } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      resolve({ code, stdout, stderr });
+    });
+    if (input != null) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+
+async function ghJson(args, { runner = defaultRunner, ghBin = 'gh' } = {}) {
+  const res = await runner(ghBin, args);
+  if (res.code !== 0) {
+    const err = new Error(`gh ${args.join(' ')} exited ${res.code}: ${res.stderr.trim()}`);
+    err.stderr = res.stderr;
+    err.stdout = res.stdout;
+    throw err;
+  }
+  const text = res.stdout.trim();
+  if (!text) return null;
+  return JSON.parse(text);
+}
+
+export async function listOpenPrs(repoSlug, opts = {}) {
+  const data = await ghJson([
+    'pr', 'list', '--repo', repoSlug, '--state', 'open',
+    '--json', 'number,headRefName,author,title,url,isDraft',
+    '--limit', '100',
+  ], opts);
+  return data || [];
+}
+
+export async function listChangedFiles(repoSlug, number, opts = {}) {
+  const data = await ghJson([
+    'pr', 'view', String(number), '--repo', repoSlug,
+    '--json', 'files',
+  ], opts);
+  return (data && Array.isArray(data.files) ? data.files : []).map((f) => f.path);
+}
+
+export async function mergePr(repoSlug, number, {
+  method = 'merge', deleteBranch = true, runner = defaultRunner, ghBin = 'gh',
+} = {}) {
+  const args = ['pr', 'merge', String(number), '--repo', repoSlug, `--${method}`];
+  if (deleteBranch) args.push('--delete-branch');
+  const res = await runner(ghBin, args);
+  return {
+    ok: res.code === 0,
+    code: res.code,
+    stdout: res.stdout.trim(),
+    stderr: res.stderr.trim(),
+  };
+}
+
+export async function commentOnPr(repoSlug, number, body, {
+  runner = defaultRunner, ghBin = 'gh',
+} = {}) {
+  const res = await runner(
+    ghBin,
+    ['pr', 'comment', String(number), '--repo', repoSlug, '--body-file', '-'],
+    { input: body },
+  );
+  return {
+    ok: res.code === 0,
+    code: res.code,
+    stdout: res.stdout.trim(),
+    stderr: res.stderr.trim(),
+  };
+}
+
+export async function listExistingComments(repoSlug, number, opts = {}) {
+  const data = await ghJson(
+    ['pr', 'view', String(number), '--repo', repoSlug, '--json', 'comments'],
+    opts,
+  );
+  return (data && Array.isArray(data.comments) ? data.comments : []).map((c) => c.body || '');
+}

package/dist/engineering-pa-library-cli/src/up-merge/scope.mjs

@@ -0,0 +1,95 @@
+// Scope-rule computation for library up-path PRs.
+//
+// A PR from head branch `<branchPrefix><device>` on library repo <repoSlug> may be merged
+// when and only when EVERY changed file's repo-relative path falls under one of the
+// device's owned up-paths for that library repo, computed from operator/registry/repos.json:
+//
+//   For each mount M in repos[<library repo id>].mounts where M.upPath === true
+//   and M.upPathOwner === <device>:
+//     allowedPrefix = M.from + include, for each include in (M.upPathInclude || [])
+//     A file matches when its path === allowedPrefix (single-file include)
+//     or starts with allowedPrefix + "/" (directory include).
+//
+// A device with no owned up-paths on the repo, or a file matching none of its allowed
+// prefixes, is a refusal. Refusals never merge.
+//
+// Ported verbatim (behaviour) from operator/extensions/tools/library-up-merger/src/scope.mjs
+// on the promotion to core (w-2026-09-16-dave-014, d-2026-09-17-013). The HQ tool was the
+// reference implementation; this module is the canonical home from 0.1.44 onward.
+
+/**
+ * @param {object} registry  parsed operator/registry/repos.json
+ * @param {string} repoSlug  e.g. "Stravica/stravica-library-wsd"
+ * @returns {string|null}    matching registry key, or null
+ */
+export function repoIdForSlug(registry, repoSlug) {
+  const wanted = repoSlug.toLowerCase();
+  for (const [id, cfg] of Object.entries(registry.repos || {})) {
+    const remote = (cfg.gitRemote || '').toLowerCase();
+    // git@github.com:Owner/name.git  -> Owner/name
+    const m = remote.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
+    if (m && m[1] === wanted) return id;
+  }
+  return null;
+}
+
+/**
+ * Compute the sorted, de-duplicated list of allowed repo-relative path prefixes for a
+ * device on a library repo. Each entry is either an exact file path or a directory path
+ * (no trailing slash) - the matcher below appends "/" for directory matching.
+ */
+export function allowedPathsForDevice(registry, repoId, device) {
+  const repo = (registry.repos || {})[repoId];
+  if (!repo || !Array.isArray(repo.mounts)) return [];
+  const out = new Set();
+  for (const mount of repo.mounts) {
+    if (!mount || mount.upPath !== true) continue;
+    if (mount.upPathOwner !== device) continue;
+    const fromPrefix = String(mount.from || '').replace(/\/+$/, '');
+    const includes = Array.isArray(mount.upPathInclude) ? mount.upPathInclude : [];
+    for (const inc of includes) {
+      const clean = String(inc).replace(/\/+$/, '');
+      if (!clean) continue;
+      out.add(fromPrefix ? `${fromPrefix}/${clean}` : clean);
+    }
+  }
+  return [...out].sort();
+}
+
+/**
+ * Does `filePath` (repo-relative) fall under one of the `allowed` entries?
+ * An entry matches when the path equals it, or starts with `entry + "/"`.
+ */
+export function fileAllowed(filePath, allowed) {
+  const f = String(filePath || '').replace(/^\/+/, '');
+  for (const entry of allowed) {
+    if (f === entry) return true;
+    if (f.startsWith(`${entry}/`)) return true;
+  }
+  return false;
+}
+
+/**
+ * Classify a PR's file list against a device's allowed prefixes.
+ * @returns {{ ok: boolean, refused: string[], allowed: string[] }}
+ */
+export function classifyFiles(files, allowed) {
+  const refused = [];
+  const allowedFiles = [];
+  for (const f of files) {
+    if (fileAllowed(f, allowed)) allowedFiles.push(f);
+    else refused.push(f);
+  }
+  return { ok: refused.length === 0, refused, allowed: allowedFiles };
+}
+
+/**
+ * Parse a device out of a head-ref of the form `<branchPrefix><device>`.
+ * Returns null if the branch does not match.
+ */
+export function deviceFromBranch(branch, branchPrefix) {
+  if (!branch || !branch.startsWith(branchPrefix)) return null;
+  const rest = branch.slice(branchPrefix.length);
+  if (!rest || rest.includes('/')) return null;
+  return rest;
+}

package/dist/engineering-pa-library-cli/src/verbs/up-merge.mjs

@@ -0,0 +1,290 @@
+// verbs/up-merge.mjs — `library up-merge`
+//
+// Scheduled auto-merger for library up-path PRs.
+//
+// Scans configured library repos for open PRs from branch
+// `library-sync-up/<device>`, and merges each one whose diff is confined
+// to the paths <device> owns per operator/registry/repos.json. Anything
+// else is a refusal, never a merge, and gets a one-time comment carrying
+// the REFUSAL_MARKER (idempotent).
+//
+// Promoted from operator/extensions/tools/library-up-merger/src/cli.mjs
+// (HQ tool, w-2026-09-16-dave-014, d-2026-09-17-013). Config now lives
+// in the merged operator preferences under `library.upMerge`; defaults
+// mirror the HQ tool's config.json.
+//
+// Mode note: `up-merge` is a GitHub-side maintenance verb and runs the
+// same way regardless of `library.mode`. It reads `library.upMerge`
+// from the merged preferences and does not touch the remote-library
+// ingest surface. The main cli.mjs short-circuits the SIMPLE-mode
+// refusal for this verb.
+
+import { readFile, mkdir, appendFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+
+import {
+  repoIdForSlug,
+  allowedPathsForDevice,
+  classifyFiles,
+  deviceFromBranch,
+} from '../up-merge/scope.mjs';
+import {
+  listOpenPrs,
+  listChangedFiles,
+  mergePr,
+  commentOnPr,
+  listExistingComments,
+  defaultRunner,
+} from '../up-merge/github.mjs';
+
+/**
+ * Default `library.upMerge` stanza. Mirrors the HQ tool's config.json so
+ * the estate keeps its current behaviour with no preferences change.
+ */
+export const DEFAULT_UP_MERGE_CONFIG = Object.freeze({
+  repos: [],
+  registryPath: 'operator/registry/repos.json',
+  eventsLog: '.cache/library-up-merger/events.jsonl',
+  mergeMethod: 'merge',
+  branchPrefix: 'library-sync-up/',
+  deleteBranchOnMerge: true,
+  ghBin: 'gh',
+});
+
+const REFUSAL_MARKER = '<!-- library-up-merger:refusal -->';
+
+/**
+ * Resolve the `library.upMerge` stanza from merged preferences, layering
+ * on top of {@link DEFAULT_UP_MERGE_CONFIG}. Missing block → all defaults.
+ *
+ * @param {object} preferences  merged preferences object
+ * @returns {typeof DEFAULT_UP_MERGE_CONFIG}
+ */
+export function resolveUpMergeConfig(preferences) {
+  const raw = preferences && typeof preferences === 'object'
+    ? preferences.library && preferences.library.upMerge
+    : null;
+  const block = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+  return {
+    ...DEFAULT_UP_MERGE_CONFIG,
+    ...block,
+    repos: Array.isArray(block.repos) ? block.repos : DEFAULT_UP_MERGE_CONFIG.repos,
+  };
+}
+
+function refusalBody(device, allowed, refused) {
+  const allowedList = allowed.length
+    ? allowed.map((p) => `  - ${p}`).join('\n')
+    : '  (none - device has no owned up-paths on this repo)';
+  const refusedList = refused.map((p) => `  - ${p}`).join('\n');
+  return [
+    REFUSAL_MARKER,
+    'library up-merge refuses to merge this PR: it touches paths outside the up-path scope for the device on its head branch.',
+    '',
+    `Device (from branch): \`${device}\``,
+    '',
+    'Allowed prefixes for this device on this repo (from operator/registry/repos.json):',
+    allowedList,
+    '',
+    'Refused files:',
+    refusedList,
+    '',
+    'Split the out-of-scope files into a separate PR owned by whichever device owns them, or narrow this PR to the allowed prefixes.',
+  ].join('\n');
+}
+
+async function appendEvent(logPath, event) {
+  await mkdir(dirname(logPath), { recursive: true });
+  await appendFile(logPath, `${JSON.stringify(event)}\n`);
+}
+
+async function loadJson(path) {
+  const raw = await readFile(path, 'utf8');
+  return JSON.parse(raw);
+}
+
+/**
+ * @param {object} ctx
+ * @param {object} ctx.config      loaded library config (carries repoRoot + preferences)
+ * @param {object} [ctx.args]      { repos?: string[], pr?: number, dryRun?: boolean, once?: boolean, verbose?: boolean, json?: boolean }
+ * @param {(...m:unknown[])=>void} [ctx.log]
+ * @param {(...m:unknown[])=>void} [ctx.err]
+ * @param {import('../up-merge/github.mjs').Runner} [ctx.ghRunner]  gh spawn seam (tests inject)
+ * @returns {Promise<number>}      exit code (0 ok, 2 errors)
+ */
+export async function runUpMerge({
+  config,
+  args = {},
+  log = defaultLog,
+  err = defaultErr,
+  ghRunner = defaultRunner,
+}) {
+  const upMerge = resolveUpMergeConfig(config.preferences);
+  const estateRoot = config.repoRoot;
+
+  const registryPath = resolve(estateRoot, upMerge.registryPath);
+  let registry;
+  try {
+    registry = await loadJson(registryPath);
+  } catch (e) {
+    err(`[library up-merge] failed to read registry ${registryPath}: ${e.message ?? e}`);
+    return 2;
+  }
+
+  const repos = args.repos && args.repos.length ? args.repos : upMerge.repos;
+  if (!repos.length) {
+    err('[library up-merge] no repos configured; set library.upMerge.repos in preferences or pass --repo');
+    return 1;
+  }
+  if (args.pr && (!args.repos || args.repos.length === 0)) {
+    err('[library up-merge] --pr requires --repo');
+    return 1;
+  }
+
+  const eventsLog = resolve(estateRoot, upMerge.eventsLog);
+  const runAt = new Date().toISOString();
+  const ghOpts = { runner: ghRunner, ghBin: upMerge.ghBin };
+
+  const summary = {
+    runAt,
+    dryRun: !!args.dryRun,
+    repos: [],
+    merged: 0,
+    refused: 0,
+    skipped: 0,
+    errors: 0,
+  };
+
+  for (const repoSlug of repos) {
+    const repoId = repoIdForSlug(registry, repoSlug);
+    if (!repoId) {
+      const line = { runAt, repo: repoSlug, verdict: 'error', reason: 'repo-not-in-registry' };
+      await appendEvent(eventsLog, line);
+      log(`error ${repoSlug}: not in registry`);
+      summary.errors += 1;
+      continue;
+    }
+
+    let prs;
+    try {
+      prs = await listOpenPrs(repoSlug, ghOpts);
+    } catch (e) {
+      const line = {
+        runAt, repo: repoSlug, verdict: 'error',
+        reason: 'list-prs-failed', detail: String(e.message ?? e),
+      };
+      await appendEvent(eventsLog, line);
+      log(`error ${repoSlug}: list PRs failed - ${e.message ?? e}`);
+      summary.errors += 1;
+      continue;
+    }
+
+    const repoStats = { repo: repoSlug, considered: prs.length, merged: 0, refused: 0, skipped: 0 };
+
+    for (const pr of prs) {
+      if (args.pr && pr.number !== args.pr) continue;
+      const device = deviceFromBranch(pr.headRefName, upMerge.branchPrefix);
+      if (!device) {
+        if (args.verbose) log(`skip ${repoSlug}#${pr.number}: head ${pr.headRefName} not an up-path branch`);
+        repoStats.skipped += 1;
+        summary.skipped += 1;
+        continue;
+      }
+      if (pr.isDraft) {
+        if (args.verbose) log(`skip ${repoSlug}#${pr.number}: draft`);
+        repoStats.skipped += 1;
+        summary.skipped += 1;
+        continue;
+      }
+
+      const allowed = allowedPathsForDevice(registry, repoId, device);
+      let files;
+      try {
+        files = await listChangedFiles(repoSlug, pr.number, ghOpts);
+      } catch (e) {
+        await appendEvent(eventsLog, {
+          runAt, repo: repoSlug, pr: pr.number, device, verdict: 'error',
+          reason: 'list-files-failed', detail: String(e.message ?? e),
+        });
+        log(`error ${repoSlug}#${pr.number}: list files failed - ${e.message ?? e}`);
+        summary.errors += 1;
+        continue;
+      }
+      const cls = classifyFiles(files, allowed);
+
+      if (!cls.ok) {
+        let commented = false;
+        if (!args.dryRun) {
+          try {
+            const existing = await listExistingComments(repoSlug, pr.number, ghOpts);
+            const alreadyComplained = existing.some((body) => (body || '').includes(REFUSAL_MARKER));
+            if (!alreadyComplained) {
+              const res = await commentOnPr(
+                repoSlug, pr.number, refusalBody(device, allowed, cls.refused), ghOpts,
+              );
+              commented = res.ok;
+            }
+          } catch (e) {
+            err(`comment ${repoSlug}#${pr.number} failed: ${e.message ?? e}`);
+          }
+        }
+        await appendEvent(eventsLog, {
+          runAt, repo: repoSlug, pr: pr.number, device, verdict: 'refused',
+          refusedFiles: cls.refused, allowedFiles: cls.allowed, allowedPrefixes: allowed,
+          commented, dryRun: !!args.dryRun,
+        });
+        log(`refused ${repoSlug}#${pr.number} (${device}): ${cls.refused.length} out-of-scope file(s) - ${cls.refused.slice(0, 3).join(', ')}${cls.refused.length > 3 ? ', ...' : ''}`);
+        repoStats.refused += 1;
+        summary.refused += 1;
+        continue;
+      }
+
+      if (args.dryRun) {
+        await appendEvent(eventsLog, {
+          runAt, repo: repoSlug, pr: pr.number, device, verdict: 'would-merge',
+          files, allowedPrefixes: allowed, dryRun: true,
+        });
+        log(`would-merge ${repoSlug}#${pr.number} (${device}): ${files.length} file(s) in scope`);
+        repoStats.merged += 1;
+        summary.merged += 1;
+        continue;
+      }
+
+      const mergeRes = await mergePr(repoSlug, pr.number, {
+        method: upMerge.mergeMethod,
+        deleteBranch: upMerge.deleteBranchOnMerge !== false,
+        ...ghOpts,
+      });
+      if (mergeRes.ok) {
+        await appendEvent(eventsLog, {
+          runAt, repo: repoSlug, pr: pr.number, device, verdict: 'merged',
+          files, allowedPrefixes: allowed,
+        });
+        log(`merged ${repoSlug}#${pr.number} (${device}): ${files.length} file(s) in scope`);
+        repoStats.merged += 1;
+        summary.merged += 1;
+      } else {
+        await appendEvent(eventsLog, {
+          runAt, repo: repoSlug, pr: pr.number, device, verdict: 'merge-failed',
+          exitCode: mergeRes.code, stderr: mergeRes.stderr, files,
+        });
+        log(`merge-failed ${repoSlug}#${pr.number} (${device}): exit ${mergeRes.code} - ${(mergeRes.stderr || '').split('\n')[0]}`);
+        summary.errors += 1;
+      }
+    }
+
+    summary.repos.push(repoStats);
+  }
+
+  if (args.json) {
+    log(JSON.stringify(summary, null, 2));
+  } else {
+    log(`summary ${JSON.stringify(summary)}`);
+  }
+  return 0;
+}
+
+function defaultLog(...m) { process.stdout.write(m.join(' ') + '\n'); }
+function defaultErr(...m) { process.stderr.write(m.join(' ') + '\n'); }
+
+export { REFUSAL_MARKER };