@wascartech/devbot 2.2.0 → 2.3.0

package/dist/runner.js

@@ -14,7 +14,7 @@ import { buildPrompt, formatHistory } from "./prompt.js";
 import { BUILTIN_SUBAGENTS, validateAgentNames } from "./mention.js";
 import { renderBuildWorkflow } from "./build-workflow.js";
 import { pathPolicyEnvArgs } from "./path-sandbox.js";
-import { formatConflictFixNote, formatUnresolvedNote, formatFixOnlyUnresolvedNote, formatNoConflictsNote } from "./conflict-fix.js";
+import { formatConflictFixNote, formatUnresolvedNote, formatFixOnlyUnresolvedNote, formatNoConflictsNote, formatAdoptedPushRefusedNote, formatAdoptedForceRefusedNote, formatAdoptedConflictRefusedNote } from "./conflict-fix.js";
 import { writeRunFilesToVolume, ensurePodmanStore } from "./run-files.js";
 import { startStreamedPhase, endStreamedPhase, appendChunk } from "./run-log.js";
 import { addUsage } from "./run-usage.js";
@@ -22,10 +22,11 @@ import { parseMrContent } from "./mr-content.js";
 import { buildCiFailureSection } from "./ci-failure.js";
 import { recordChangeRequest } from "./change-request-store.js";
 import { createChangeRequestWithAssignee } from "./mr-assignee.js";
+import { runCiLintGuard } from "./ci-lint-guard.js";
 import { decideChangeRequestAction, openChangeRequest } from "./change-request-lifecycle.js";
 import { recordVolume, touchVolume } from "./volume-store.js";
 import { setBaseBranchIfUnset, getBaseBranch } from "./base-branch-store.js";
-import { setWorkBranchIfUnset, getWorkBranch } from "./work-item-branch-store.js";
+import { setWorkBranchIfUnset, getWorkBranch, isWorkBranchAdopted } from "./work-item-branch-store.js";
 import { isWorkItemCancelRequested } from "./queue-store.js";
 import { emitMrEvent } from "./outbound-webhook.js";
 import { resolveStorageDriver, nestedPodmanArgs, devcontainerVolumeArgs, devcontainerEnvArgs, devcontainerPromptSection, devcontainerEnabled, hasFuseDevice, sandboxBaseArgs, } from "./devcontainer.js";
@@ -75,7 +76,7 @@ export function modelArgs(model, variant = "") {
 //   opencode.json persist across mentions yet can never be staged by the
 //   agent's `git add -A`. State + cache go to /tmp: when dev containers are
 //   enabled the nested-Podman store is mounted at
-//   /home/devbot/.local/share/containers under --userns=keep-id, which makes
+//   /home/devbot/.local/share/containers under the pinned keep-id mapping, which makes
 //   podman create the missing parents /home/devbot/.local{,/share} as root:root
 //   1755 — so opencode's Bun default (~/.local/state) cannot be created
 //   (EACCES). /tmp is always writable and off every volume, so lock/state files
@@ -96,6 +97,22 @@ export function xdgEnvArgs() {
 function failure(phase, kind, message, logs = "", exitCode = null, model = "", variant = "") {
     return { phase, kind, exitCode, message, logs: redact(logs), model, variant };
 }
+// Note for a push that failed because a repository object database refused the
+//   write. A lost push is an error, never a warning. The location distinguishes
+//   the two object databases involved: `local` is the workspace volume the push
+//   container fetches into, `server` is the forge repository receiving the push.
+//   A server-side failure is a forge storage problem (object ownership,
+//   permissions or disk), not something DevBot may paper over.
+export function lostPushNote(location, reason) {
+    const cause = location === "local"
+        ? "DevBot's workspace repository (`/workspace/.git/objects`) refused the object write (local permissions or disk)."
+        : location === "server"
+            ? "The git server's repository object database refused the write — a server-side storage problem (object ownership/permissions or disk), not a DevBot bug."
+            : "A repository object database refused the object write.";
+    return (`❌ push failed — the branch was NOT pushed.\n\n${cause}\n\n` +
+        "Fix the repository storage before re-running; the commit is preserved in the workspace volume.\n\n" +
+        "```\n" + reason + "\n```");
+}
 // Post a non-fatal note when some submodules could not be fetched. The run
 //   proceeds without them (best-effort by design); this just surfaces which
 //   paths are missing so the user/admin can fix access. Never throws. Exported
@@ -273,6 +290,11 @@ export async function runForcePushOnly(input) {
         workItemNumber: input.workItemNumber,
         workItemId: input.workItemId,
     });
+    if (isWorkBranchAdopted(input.workItemId)) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatAdoptedForceRefusedNote(branch))
+            .catch((e) => log.warn("adopted-force-refused note failed", e));
+        return { kind: "terminal", reason: "force-push refused on adopted branch" };
+    }
     if (config.DRY_RUN) {
         log.info("DRY_RUN — would force-push branch", { branch });
         await getPlatform().workItems
@@ -280,20 +302,28 @@ export async function runForcePushOnly(input) {
             .catch((e) => log.warn("dry-run force-push note failed", e));
         return { kind: "ok" };
     }
-    const pushed = await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+    const envVars = projectEnvVars(input.projectId);
+    const builderImage = projectBuilderImage(input.projectId);
+    const pushed = await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, envVars, builderImage, ciLintGate(input, envVars, builderImage));
     if (!pushed.ok) {
+        if (pushed.gateBlocked) {
+            return { kind: "terminal", reason: "ci/lint rejected the CI configuration", failure: failure("push", "ci-lint-invalid", pushed.reason, pushed.logs) };
+        }
         log.error("standalone force-push failed", { workItemId: input.workItemId, reason: pushed.reason });
         const reply = pushed.missingVolume
             ? `⚠️ Nothing to force-push — no workspace exists for this work item yet. Run a \`/build\` first, then \`/force-push\`.`
             : pushed.missingBranch
                 ? `⚠️ Nothing to force-push — no local branch \`${branch}\` for this work item.`
-                : `⚠️ force-push failed: ${pushed.reason}`;
+                : pushed.objectDbFailure
+                    ? lostPushNote(pushed.objectDbLocation, pushed.reason)
+                    : `⚠️ force-push failed: ${pushed.reason}`;
         await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("force-push-failure note failed", e));
-        // Missing workspace/branch are terminal (a re-run hits the same state);
-        // a push failure may be a network blip or a lease rejection the retry's
-        // fresh fetch resolves — transient.
+        // Missing workspace/branch are terminal (a re-run hits the same state); a
+        // repository object-database write failure is also terminal (retrying the
+        // same unwritable store cannot help and a lost push must be an error). Any
+        // other push failure may be a network blip — transient.
         const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "force-push-no-target" : "force-push-failed", pushed.reason, pushed.logs);
-        return pushed.missingVolume || pushed.missingBranch
+        return pushed.missingVolume || pushed.missingBranch || pushed.objectDbFailure
             ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
             : { kind: "transient", reason: pushed.reason, failure: failureDetail };
     }
@@ -309,6 +339,7 @@ export async function runForcePushOnly(input) {
 //   never race an in-flight build's push. Same error-log/retry machinery.
 export async function runPushOnly(input) {
     const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    const adopted = isWorkBranchAdopted(input.workItemId);
     log.info("push (standalone) start", {
         projectId: input.projectId,
         workItemNumber: input.workItemNumber,
@@ -321,19 +352,30 @@ export async function runPushOnly(input) {
             .catch((e) => log.warn("dry-run push note failed", e));
         return { kind: "ok" };
     }
-    const pushed = await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+    const envVars = projectEnvVars(input.projectId);
+    const builderImage = projectBuilderImage(input.projectId);
+    const pushed = await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, workBranchAdopted: adopted }, envVars, builderImage, ciLintGate(input, envVars, builderImage));
     if (!pushed.ok) {
+        if (pushed.gateBlocked) {
+            return { kind: "terminal", reason: "ci/lint rejected the CI configuration", failure: failure("push", "ci-lint-invalid", pushed.reason, pushed.logs) };
+        }
         log.error("standalone push failed", { workItemId: input.workItemId, reason: pushed.reason });
         const reply = pushed.missingVolume
             ? `⚠️ Nothing to push — no workspace exists for this work item yet. Run a \`/build\` first, then \`/push\`.`
             : pushed.missingBranch
                 ? `⚠️ Nothing to push — no local branch \`${branch}\` for this work item.`
-                : `⚠️ push failed: ${pushed.reason}`;
+                : pushed.objectDbFailure
+                    ? lostPushNote(pushed.objectDbLocation, pushed.reason)
+                    : pushed.adoptedDiverged
+                        ? formatAdoptedPushRefusedNote(branch)
+                        : `⚠️ push failed: ${pushed.reason}`;
         await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("push-failure note failed", e));
         // Missing workspace/branch are terminal (a re-run hits the same state); a
-        // push failure may be a network blip — transient.
+        // repository object-database write failure is also terminal (retrying the
+        // same unwritable store cannot help and a lost push must be an error). Any
+        // other push failure may be a network blip — transient.
         const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "push-no-target" : "push-failed", pushed.reason, pushed.logs);
-        return pushed.missingVolume || pushed.missingBranch
+        return pushed.missingVolume || pushed.missingBranch || pushed.objectDbFailure
             ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
             : { kind: "transient", reason: pushed.reason, failure: failureDetail };
     }
@@ -350,12 +392,18 @@ export async function runPushOnly(input) {
 //   branch skips straight to the MR step.
 export async function runMrOnly(input) {
     const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    const adopted = isWorkBranchAdopted(input.workItemId);
     log.info("mr (standalone) start", {
         projectId: input.projectId,
         workItemNumber: input.workItemNumber,
         workItemId: input.workItemId,
         forcePush: input.forcePush === true,
     });
+    if (adopted && input.forcePush) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatAdoptedForceRefusedNote(branch))
+            .catch((e) => log.warn("adopted-force-refused note failed", e));
+        return { kind: "terminal", reason: "force-push refused on adopted branch" };
+    }
     if (config.DRY_RUN) {
         log.info("DRY_RUN — would push + open MR", { branch });
         await getPlatform().workItems
@@ -363,20 +411,30 @@ export async function runMrOnly(input) {
             .catch((e) => log.warn("dry-run mr note failed", e));
         return { kind: "ok" };
     }
+    const envVars = projectEnvVars(input.projectId);
+    const builderImage = projectBuilderImage(input.projectId);
+    const gate = ciLintGate(input, envVars, builderImage);
     // Publish first. A missing workspace/branch is terminal and actionable.
     const pushed = input.forcePush
-        ? await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId))
-        : await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+        ? await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, envVars, builderImage, gate)
+        : await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, workBranchAdopted: adopted }, envVars, builderImage, gate);
     if (!pushed.ok) {
+        if (pushed.gateBlocked) {
+            return { kind: "terminal", reason: "ci/lint rejected the CI configuration", failure: failure("push", "ci-lint-invalid", pushed.reason, pushed.logs) };
+        }
         log.error("standalone /mr push failed", { workItemId: input.workItemId, reason: pushed.reason });
         const reply = pushed.missingVolume
             ? `⚠️ Nothing to publish — no workspace exists for this work item yet. Run a \`/build\` first, then \`/mr\`.`
             : pushed.missingBranch
                 ? `⚠️ Nothing to publish — no local branch \`${branch}\` for this work item.`
-                : `⚠️ push failed: ${pushed.reason}`;
+                : pushed.objectDbFailure
+                    ? lostPushNote(pushed.objectDbLocation, pushed.reason)
+                    : "adoptedDiverged" in pushed && pushed.adoptedDiverged
+                        ? formatAdoptedPushRefusedNote(branch)
+                        : `⚠️ push failed: ${pushed.reason}`;
         await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("mr-push-failure note failed", e));
         const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "mr-no-target" : "mr-push-failed", pushed.reason, pushed.logs);
-        return pushed.missingVolume || pushed.missingBranch
+        return pushed.missingVolume || pushed.missingBranch || pushed.objectDbFailure
             ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
             : { kind: "transient", reason: pushed.reason, failure: failureDetail };
     }
@@ -389,7 +447,11 @@ export async function runMrOnly(input) {
     //   guarantee as the post-build path. Conflicts are checked here; only when
     //   the check actually runs do we mint an MCP context (a fresh bearer token +
     //   current providers) so the resolver build run has working forge tools.
-    if (projectAutoResolveConflicts(input.projectId, input.workItemId)) {
+    if (projectAutoResolveConflicts(input.projectId, input.workItemId) && adopted) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatAdoptedConflictRefusedNote(branch))
+            .catch((e) => log.warn("adopted-conflict-refused note failed", e));
+    }
+    else if (projectAutoResolveConflicts(input.projectId, input.workItemId)) {
         const envVars = projectEnvVars(input.projectId);
         const builderImage = projectBuilderImage(input.projectId);
         const cancelledPreCheck = cancelledOutcome(input.workItemId, "pre-conflict-check");
@@ -427,7 +489,7 @@ export async function runMrOnly(input) {
                 if (rechecked && rechecked.conflictFree) {
                     const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, envVars, builderImage);
                     if (!repushed.ok) {
-                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrResolved.branch, checked.files))
+                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, repushed.objectDbFailure ? lostPushNote(repushed.objectDbLocation, repushed.reason) : formatUnresolvedNote(mrResolved.branch, checked.files))
                             .catch((e) => log.warn("conflict-repush-failure note failed", e));
                         return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
                     }
@@ -508,6 +570,11 @@ export async function runFixConflictsOnly(input) {
         workItemNumber: input.workItemNumber,
         workItemId: input.workItemId,
     });
+    if (isWorkBranchAdopted(input.workItemId)) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatAdoptedConflictRefusedNote(branch))
+            .catch((e) => log.warn("adopted-conflict-refused note failed", e));
+        return { kind: "terminal", reason: "conflict resolution refused on adopted branch" };
+    }
     if (config.DRY_RUN) {
         log.info("DRY_RUN — would fix merge conflicts", { branch });
         await getPlatform().workItems
@@ -588,9 +655,20 @@ export async function runFixConflictsOnly(input) {
             ? await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, target }, envVars, builderImage)
             : null;
         if (rechecked && rechecked.conflictFree) {
+            const ciLint = await runCiLintGuard({
+                projectId: input.projectId,
+                workItemId: input.workItemId,
+                workItemNumber: input.workItemNumber,
+                baseBranch: target,
+                envVars,
+                builderImage,
+            });
+            if (ciLint.status === "invalid") {
+                return { kind: "terminal", reason: "ci/lint rejected the CI configuration", failure: failure("conflict", "ci-lint-invalid", ciLint.errors.join("\n") || "invalid CI configuration", "", null, runModel.model, runModel.variant) };
+            }
             const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, envVars, builderImage);
             if (!repushed.ok) {
-                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatFixOnlyUnresolvedNote(target, checked.files))
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, repushed.objectDbFailure ? lostPushNote(repushed.objectDbLocation, repushed.reason) : formatFixOnlyUnresolvedNote(target, checked.files))
                     .catch((e) => log.warn("fix-conflicts-repush-failure note failed", e));
                 return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
             }
@@ -643,6 +721,39 @@ async function resolveMrTarget(projectId, workItemId, branches, model, variant)
     }
     return { ok: true, branch: hit };
 }
+// The base branch used to resolve lint includes. The stored /base value wins;
+// otherwise the configured base-branch list is probed. A lookup failure leaves
+// the guard skipped rather than blocking a publish the run was about to make.
+async function resolveCiLintBaseBranch(projectId, workItemId) {
+    const stored = getBaseBranch(workItemId);
+    if (stored)
+        return stored;
+    try {
+        return await getPlatform().repository.firstExistingBranch(projectId, projectBaseBranches(projectId));
+    }
+    catch (e) {
+        log.warn("ci/lint base branch lookup failed", { workItemId, err: e });
+        return null;
+    }
+}
+// The publish gate handed to pushStandalone/forcePushStandalone: it runs the
+// lint after the workspace existence check (so a missing workspace still stops
+// on that inspect) and blocks only on an invalid verdict.
+function ciLintGate(input, envVars, builderImage) {
+    return async () => {
+        const result = await runCiLintGuard({
+            projectId: input.projectId,
+            workItemId: input.workItemId,
+            workItemNumber: input.workItemNumber,
+            baseBranch: await resolveCiLintBaseBranch(input.projectId, input.workItemId),
+            envVars,
+            builderImage,
+        });
+        return result.status === "invalid"
+            ? { ok: false, reason: result.errors.join("\n") || "invalid CI configuration" }
+            : { ok: true };
+    };
+}
 export async function run(input) {
     log.info("run start", {
         projectId: input.projectId,
@@ -690,7 +801,7 @@ export async function run(input) {
         //   with a note; the stored value stays authoritative.
         const storedWorkBranch = getWorkBranch(input.workItemId);
         if (input.workBranch && !storedWorkBranch) {
-            setWorkBranchIfUnset(input.workItemId, input.workBranch);
+            setWorkBranchIfUnset(input.workItemId, input.workBranch, input.workBranchAdopted === true);
         }
         else if (input.workBranch && storedWorkBranch && input.workBranch !== storedWorkBranch) {
             await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ /branch '${input.workBranch}' ignored — this work item already uses branch '${storedWorkBranch}'.`)
@@ -700,7 +811,8 @@ export async function run(input) {
         //   (storedWorkBranch is null on that run, so resolving it directly would
         //   wrongly fall back to wi-<number>).
         const workBranch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
-        const prepared = await ensureVolumeAndWorkspace({ ...input, workBranch }, input.mode, mcpCtx.envVars, mcpCtx.baseBranches, mcpCtx.builderImage);
+        const workBranchAdopted = isWorkBranchAdopted(input.workItemId);
+        const prepared = await ensureVolumeAndWorkspace({ ...input, workBranch, workBranchAdopted }, input.mode, mcpCtx.envVars, mcpCtx.baseBranches, mcpCtx.builderImage);
         // Cancellation checkpoint: a stop during clone/sync kills that container;
         // treat the resulting prepare failure as an intentional stop, not an error.
         const cancelledAfterPrep = cancelledOutcome(input.workItemId, "post-prepare");
@@ -940,7 +1052,25 @@ export async function run(input) {
             const cancelledBeforePush = cancelledOutcome(input.workItemId, "pre-push");
             if (cancelledBeforePush)
                 return cancelledBeforePush;
-            const pushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, ...(input.forcePush ? { forcePush: true } : {}), ...(prepared.branchTip ? { preRunTip: prepared.branchTip } : {}) }, mcpCtx.envVars, mcpCtx.builderImage);
+            // CI guard (#116): the last commit is in the working tree now, so lint the
+            // entry file once before the branch becomes visible. Invalid config never
+            // reaches the forge; an unavailable linter only adds a report line.
+            const ciLint = await runCiLintGuard({
+                projectId: input.projectId,
+                workItemId: input.workItemId,
+                workItemNumber: input.workItemNumber,
+                baseBranch: mrTarget,
+                envVars: mcpCtx.envVars,
+                builderImage: mcpCtx.builderImage,
+            });
+            if (ciLint.status === "invalid") {
+                return {
+                    kind: "terminal",
+                    reason: "ci/lint rejected the CI configuration",
+                    failure: failure("push", "ci-lint-invalid", ciLint.errors.join("\n") || "invalid CI configuration", "", null, runModel.model, runModel.variant),
+                };
+            }
+            const pushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, workBranchAdopted, ...(input.forcePush ? { forcePush: true } : {}), ...(prepared.branchTip ? { preRunTip: prepared.branchTip } : {}) }, mcpCtx.envVars, mcpCtx.builderImage);
             if (pushed.ok && pushed.fallbackCommitted) {
                 log.warn("agent forgot to commit; devbot authored fallback commit", {
                     workItemId: input.workItemId,
@@ -948,8 +1078,13 @@ export async function run(input) {
                 });
             }
             if (!pushed.ok) {
-                log.error("push failed", { workItemId: input.workItemId, stderr: pushed.reason });
-                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ push failed: ${pushed.reason}`)
+                log.error("push failed", { workItemId: input.workItemId, stderr: pushed.reason, objectDbFailure: pushed.objectDbFailure, objectDbLocation: pushed.objectDbLocation });
+                const pushNote = pushed.objectDbFailure
+                    ? lostPushNote(pushed.objectDbLocation, pushed.reason)
+                    : pushed.adoptedDiverged
+                        ? formatAdoptedPushRefusedNote(workBranch)
+                        : `❌ push failed — the branch was NOT pushed: ${pushed.reason}`;
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, pushNote)
                     .catch((e) => log.warn("push-failure note failed", e));
                 return { kind: "terminal", reason: `push failed: ${pushed.reason}`, failure: failure("push", "push-failed", pushed.reason, pushed.logs, null, runModel.model, runModel.variant) };
             }
@@ -972,7 +1107,11 @@ export async function run(input) {
             //   found, a direct build run resolves them, then the branch is re-pushed
             //   (rewrite-aware lease) before the MR. On failure the branch stays
             //   published, the MR is skipped, and an actionable note is posted.
-            if (shouldFixConflicts(input, mcpCtx.autoResolveConflicts)) {
+            if (shouldFixConflicts(input, mcpCtx.autoResolveConflicts) && workBranchAdopted) {
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatAdoptedConflictRefusedNote(branch))
+                    .catch((e) => log.warn("adopted-conflict-refused note failed", e));
+            }
+            else if (shouldFixConflicts(input, mcpCtx.autoResolveConflicts)) {
                 const cancelledPreCheck = cancelledOutcome(input.workItemId, "pre-conflict-check");
                 if (cancelledPreCheck)
                     return cancelledPreCheck;
@@ -1003,7 +1142,7 @@ export async function run(input) {
                         const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, mcpCtx.envVars, mcpCtx.builderImage);
                         if (!repushed.ok) {
                             log.error("conflict-fix re-push failed", { workItemId: input.workItemId, reason: repushed.reason });
-                            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrTarget, checked.files))
+                            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, repushed.objectDbFailure ? lostPushNote(repushed.objectDbLocation, repushed.reason) : formatUnresolvedNote(mrTarget, checked.files))
                                 .catch((e) => log.warn("conflict-repush-failure note failed", e));
                             return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
                         }