baxian 1.2.57 → 1.2.59

package/dist/agent/manager.js

@@ -4,7 +4,12 @@ import { join, normalize } from 'node:path';
 import { tmpdir } from 'node:os';
 import { createSignalToken } from './phase-signal.js';
 import { tmuxInstallHint } from './preflight.js';
-import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, TASK_OWNER_ROLES, isSpecStagePhase, isGitHubRepo, parseGitRemote, repoSlug, } from '../shared/index.js';
+import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, TASK_OWNER_ROLES, isSpecStagePhase, isGitHubRepo, parseGitRemote, repoIdentityKey, repoSlug, } from '../shared/index.js';
+import { buildProjectDriver, makeDriverExec } from '../platform/driver-host.js';
+import { DriverOpError } from '../platform/git-driver.js';
+import { checkOpenPrBinding } from '../platform/pr-binding.js';
+import { collectPendingFeedback, scanCommentSourcesOnce } from '../platform/feedback.js';
+import { recheckPassProvenance } from '../platform/verdict-engine.js';
 import { AGENT_STORE_NOOP } from '../state/agent-store.js';
 import { PostApproveStore } from '../state/post-approve-store.js';
 import { SkillRegistry } from '../skill/registry.js';
@@ -13,13 +18,15 @@ import { GH_EXEC_TIMEOUT_MS, GIT_NET_ENV, execNetwork } from './net-exec.js';
 import { findForeignTaskTip } from './lineage.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
 import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, } from './tmux.js';
-import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError } from './branch.js';
+import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError, isAutoDeletableTaskBranch } from './branch.js';
 import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded } from './repo-store.js';
 import { PhaseSignalWatcher } from './phase-signal-watcher.js';
 import { ReviewTransport, resolveServerPayloads } from './review-transport.js';
 import { buildPromptInline, buildGreetingPrompt, PromptSizeError, RequiredSkillsMissingError, MAX_PROMPT_BYTES_ROUTE_LIMIT, } from './prompt.js';
 import { ApiError } from '../errors.js';
 import { prepareConfig } from '../config/loader.js';
+import { resolveProjectTool } from '../config/validator.js';
+import { SHA_HEX_SOURCE } from '../platform/types.js';
 export class EnsureSessionError extends Error {
     partial;
     constructor(partial, message) {
@@ -141,12 +148,40 @@ export function skillSubdirFor(runtime) {
 const DEFAULT_DISPATCH_ACK_TIMEOUT_MS = 30_000;
 const DEFAULT_DISPATCH_SETTLE_TIMEOUT_MS = 3_000;
 const GH_NET = { timeout: GH_EXEC_TIMEOUT_MS, retries: 1 };
+const PLATFORM_HEAD_SHA_RE = new RegExp(`^${SHA_HEX_SOURCE}$`);
+// 复核类失败（provenance/ack）与平台/瞬态失败分型：前者调用方退回 approved 重入闭环（计划 Task 8）
+export class PlatformCloseError extends Error {
+    step;
+    constructor(step, cause) {
+        super(`platform ${step} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.step = step;
+        this.name = 'PlatformCloseError';
+    }
+}
+export class PlatformMergeRecheckError extends Error {
+    reason;
+    constructor(reason) {
+        super(`merge blocked: ${reason}`);
+        this.reason = reason;
+        this.name = 'PlatformMergeRecheckError';
+    }
+}
 const MANUAL_SERVER_REVIEW_STATUSES = ['in_progress', 'review', 'fixing'];
 const IMAGE_DISPATCH_PHASES = new Set(['develop', 'research', 'code', 'fix', 'server-feedback']);
 const RUNTIME_LIVENESS_SAMPLES = 3;
 export function canDispatchWithBinding(binding) {
     return !binding?.taskId && !binding?.creationToken && binding?.status !== 'awaiting_human';
 }
+// 派发期 hold：prompt 从未注入、pane 无在途回合，重派安全；ack_unknown 一类不在此列
+export const RECOVERABLE_QA_DISPATCH_HOLD_PHASES = new Set([
+    'checkout-preparation-failed',
+    'dirty-workdir',
+]);
+export function isRecoverableQaDispatchHold(binding) {
+    return binding?.status === 'awaiting_human'
+        && binding.awaitingPhase != null
+        && RECOVERABLE_QA_DISPATCH_HOLD_PHASES.has(binding.awaitingPhase);
+}
 const TURN_COMPLETED_AWAITING_PHASES = new Set();
 const CANCEL_CLEANUP_HOLD_PHASES = new Set(['cancel-clearing', 'cancel-interrupt-failed']);
 function isCancelCleanupHold(binding) {
@@ -163,12 +198,24 @@ function cancelPhaseDowngrades(prev, next) {
     return cancelPhaseRank(next) < cancelPhaseRank(prev);
 }
 const REGREET_REQUIRED_HOLD_PHASES = new Set(['greeting_failed']);
+const CHECKOUT_HOLD_PHASES = new Set([
+    'dirty-workdir',
+    'checkout-preparation-failed',
+    'branch-cleanup-pending',
+]);
 function shouldReleaseHeldBinding(state, boundTask) {
     if (state.awaitingPhase != null && REGREET_REQUIRED_HOLD_PHASES.has(state.awaitingPhase))
         return false;
     const taskIsTerminal = !!boundTask && TERMINAL_STATUSES.includes(boundTask.status);
     const turnCompleted = state.awaitingPhase != null && TURN_COMPLETED_AWAITING_PHASES.has(state.awaitingPhase);
-    return !boundTask || taskIsTerminal || turnCompleted;
+    // 任务已退回 verdict 门禁且当前持有者不是本 agent：这次绑定是转码失败的残留
+    // （fresh-acquire 释放被脏树挡下），Resume 时补完释放，否则 dev 被永久占住
+    const staleCodeHandoff = state.awaitingPhase != null
+        && CHECKOUT_HOLD_PHASES.has(state.awaitingPhase)
+        && !!boundTask
+        && (boundTask.status === 'spec-ready' || boundTask.status === 'max_rounds')
+        && boundTask.agentId !== state.id;
+    return !boundTask || taskIsTerminal || turnCompleted || staleCodeHandoff;
 }
 export class AgentManager {
     config;
@@ -182,6 +229,8 @@ export class AgentManager {
     repoCache;
     paneStreamerManager;
     postApproveStore;
+    pluginRegistry;
+    platformDriverExec;
     phaseSignalWatcher;
     errorRecordStore;
     reviewStore;
@@ -224,6 +273,7 @@ export class AgentManager {
         this.repoStoreFactory = deps.repoStoreFactory;
         this.paneStreamerManager = deps.paneStreamerManager;
         this.postApproveStore = deps.postApproveStore ?? new PostApproveStore();
+        this.pluginRegistry = deps.pluginRegistry;
         this.errorRecordStore = deps.errorRecordStore;
         this.phaseSignalWatcher = deps.phaseSignalWatcher
             ?? (deps.paneStreamerManager
@@ -239,6 +289,7 @@ export class AgentManager {
         this.cancelInterruptGuardWaitMs = this.dispatchAckTimeoutMs + 5_000;
         this.agentIndex = buildAgentIndex(config);
         this.platformRunner = deps.platformRunner ?? new LocalRunner();
+        this.platformDriverExec = makeDriverExec(this.platformRunner);
         this.imageStagingRoot = deps.imageStagingRoot ?? join(tmpdir(), 'baxian-task-images');
         this.repoCache = createRepoStoreCache();
         this.bootstrapTimeoutsMs = {
@@ -1493,17 +1544,43 @@ export class AgentManager {
                     `(expected ${expectedTaskId}, got ${state.taskId}); skipping`);
                 return false;
             }
+            if (opts.expectedLockToken !== undefined && state.lockToken !== opts.expectedLockToken) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} lock generation changed ` +
+                    `(binding re-acquired by a successor); skipping release`);
+                return false;
+            }
             if (isCancelCleanupHold(state) && !opts.fromCancelCleanup) {
                 console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} ${state.awaitingPhase} (cancel-cleanup hold); refusing auto-release`);
                 return false;
             }
             const boundTask = await this.taskStore.get(expectedTaskId);
+            if (opts.expectedTask
+                && boundTask
+                && (boundTask.status !== opts.expectedTask.status
+                    || boundTask.phase !== opts.expectedTask.phase
+                    || boundTask.signalToken !== opts.expectedTask.signalToken)) {
+                console.warn(`[AgentManager] releaseAgentForTask: task ${expectedTaskId} moved past the captured pass; skipping ${mode} transition`);
+                return false;
+            }
             if (state.status === 'awaiting_human' && !opts.allowAwaitingHuman) {
                 if (!shouldReleaseHeldBinding(state, boundTask)) {
                     console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} is awaiting_human (${state.awaitingPhase}); refusing to release`);
                     return false;
                 }
             }
+            // expectedHold 是 hold 世代快照的严格 CAS（全 undefined 表示“期望无 hold”）：
+            // hold 消失（被并发 Resume 清掉）或换代同样意味着接管，不得继续释放
+            const matchesExpectedHold = (binding) => {
+                const held = binding.status === 'awaiting_human';
+                return (held ? binding.awaitingPhase : undefined) === opts.expectedHold.phase
+                    && (held ? binding.awaitingSince : undefined) === opts.expectedHold.since
+                    && (held ? binding.awaitingNonce : undefined) === opts.expectedHold.nonce;
+            };
+            // 世代门前置：hold 换代时任何 pane/workdir 副作用都不得发生（末尾 CAS 只兜最后窗口）
+            if (opts.expectedHold && !matchesExpectedHold(state)) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed or cleared before release; refusing`);
+                return false;
+            }
             if (mode === 'waiting' && (!boundTask || !ACTIVE_TASK_STATUSES.has(boundTask.status))) {
                 console.warn(`[AgentManager] releaseAgentForTask: task ${expectedTaskId} is not active; skipping waiting transition`);
                 return false;
@@ -1518,10 +1595,19 @@ export class AgentManager {
             }
             const now = new Date().toISOString();
             if (mode === 'waiting') {
+                let preservedNewerHold = false;
                 await this.agentStore.update(agentId, (latest) => {
                     if (!latest)
                         return AGENT_STORE_NOOP;
                     if (opts.clearAwaitingHuman && latest.status === 'awaiting_human') {
+                        // The hold-generation CAS lives inside the atomic update: a hold written after any pre-read survives.
+                        if (opts.expectedHold
+                            && (latest.awaitingPhase !== opts.expectedHold.phase
+                                || latest.awaitingSince !== opts.expectedHold.since
+                                || latest.awaitingNonce !== opts.expectedHold.nonce)) {
+                            preservedNewerHold = true;
+                            return AGENT_STORE_NOOP;
+                        }
                         const cleared = {
                             id: latest.id,
                             projectId: latest.projectId,
@@ -1540,6 +1626,10 @@ export class AgentManager {
                         updatedAt: now,
                     };
                 });
+                if (preservedNewerHold) {
+                    console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} holds a newer generation than the captured one; keeping the hold`);
+                    return false;
+                }
                 return true;
             }
             let sessionConfirmedAbsent = false;
@@ -1547,6 +1637,7 @@ export class AgentManager {
                 const releaseWorkdir = state.workdir;
                 const runner = this.createRunnerFor(cfg);
                 const tmux = new TmuxManager(runner);
+                const holdMatchesExpected = (binding) => !opts.expectedHold || matchesExpectedHold(binding);
                 const hold = async (reason) => {
                     const latest = await this.agentStore.get(agentId);
                     if (!latest
@@ -1555,18 +1646,27 @@ export class AgentManager {
                         || !await this.lockManager.isOwner(agentId, expectedTaskId, lockToken)) {
                         return false;
                     }
+                    // 释放中被写入的新 hold（如 ack_unknown）比 cleanup 失败信息更关键，不得覆盖
+                    if (!holdMatchesExpected(latest)) {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed during release; not overwriting with branch-cleanup-pending`);
+                        return false;
+                    }
                     const pendingAt = new Date().toISOString();
                     if (boundTask && cfg.role === 'dev') {
                         boundTask.branchCleanupPending = { agentId, reason, updatedAt: pendingAt };
                         boundTask.updatedAt = pendingAt;
                         await this.taskStore.set(boundTask);
                     }
-                    await this.agentStore.update(agentId, (latest) => {
-                        if (!latest || latest.taskId !== expectedTaskId || latest.lockToken !== lockToken) {
+                    let wrote = false;
+                    await this.agentStore.update(agentId, (latest2) => {
+                        if (!latest2 || latest2.taskId !== expectedTaskId || latest2.lockToken !== lockToken) {
                             return AGENT_STORE_NOOP;
                         }
+                        if (!holdMatchesExpected(latest2))
+                            return AGENT_STORE_NOOP;
+                        wrote = true;
                         return {
-                            ...latest,
+                            ...latest2,
                             status: 'awaiting_human',
                             awaitingPhase: 'branch-cleanup-pending',
                             awaitingReason: reason,
@@ -1574,6 +1674,10 @@ export class AgentManager {
                             updatedAt: pendingAt,
                         };
                     });
+                    if (!wrote) {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} branch-cleanup-pending hold not written (binding or hold changed)`);
+                        return false;
+                    }
                     await this.emitIntervention(state.projectId, agentId, expectedTaskId, {
                         phase: 'branch-cleanup-pending',
                         reason,
@@ -1608,6 +1712,14 @@ export class AgentManager {
                         sessionConfirmedAbsent = true;
                     }
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
+                    // 探测/等待期间 markAwaitingHuman 不受本锁串行；进入 checkout 变更前按当前盘面重验世代
+                    if (opts.expectedHold) {
+                        const beforeBranchOps = await this.agentStore.get(agentId);
+                        if (!beforeBranchOps || !matchesExpectedHold(beforeBranchOps)) {
+                            console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed before checkout cleanup; aborting release`);
+                            return false;
+                        }
+                    }
                     if (cfg.role === 'dev' && boundTask) {
                         const branches = new BranchManager(runner);
                         const cleanup = await branches.cleanupTaskBranch(releaseWorkdir, {
@@ -1651,6 +1763,13 @@ export class AgentManager {
                                 delete boundTask.branchCleanupSkipped;
                                 cleanupStateChanged = true;
                             }
+                            if (cleanup.remoteTipSha) {
+                                boundTask.branchLocalCleaned = {
+                                    remoteTipSha: cleanup.remoteTipSha,
+                                    updatedAt: new Date().toISOString(),
+                                };
+                                cleanupStateChanged = true;
+                            }
                         }
                         if (cleanupStateChanged) {
                             boundTask.updatedAt = new Date().toISOString();
@@ -1677,6 +1796,7 @@ export class AgentManager {
             else {
                 await this.assertTaskLockOwner(agentId, expectedTaskId, lockToken);
             }
+            let holdGenerationChanged = false;
             await this.agentStore.update(agentId, (existing) => {
                 if (!existing)
                     return AGENT_STORE_NOOP;
@@ -1685,6 +1805,11 @@ export class AgentManager {
                     || (state.workdir !== undefined && existing.workdir !== state.workdir)) {
                     return AGENT_STORE_NOOP;
                 }
+                // 世代 CAS 在原子写入内判定：预读后被重写或清除的 hold 都不得被这次释放清掉
+                if (opts.expectedHold && !matchesExpectedHold(existing)) {
+                    holdGenerationChanged = true;
+                    return AGENT_STORE_NOOP;
+                }
                 return {
                     id: existing.id,
                     projectId: existing.projectId,
@@ -1694,9 +1819,25 @@ export class AgentManager {
                     updatedAt: now,
                 };
             });
+            if (holdGenerationChanged) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed during release; keeping the hold`);
+                return false;
+            }
             return this.lockManager.releaseIfOwner(agentId, expectedTaskId, lockToken);
         });
     }
+    async clearBranchLocalCleaned(taskId) {
+        await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh?.branchLocalCleaned)
+                return;
+            delete fresh.branchLocalCleaned;
+            fresh.updatedAt = new Date().toISOString();
+            await this.taskStore.set(fresh);
+        }).catch(err => {
+            console.warn(`[AgentManager] clearing branchLocalCleaned(${taskId}) failed:`, err);
+        });
+    }
     async releaseAgentIfBound(agentId, expectedTaskId, opts) {
         const state = await this.agentStore.get(agentId);
         if (state?.taskId !== expectedTaskId)
@@ -1908,14 +2049,20 @@ export class AgentManager {
         this.phaseSignalWatcher?.rearmNeedInput(agentId);
         await this.setAgentNeedInput(agentId, false);
     }
-    async clearAwaitingHuman(agentId) {
+    async clearAwaitingHuman(agentId, opts = {}) {
         const now = new Date().toISOString();
         let cleared = false;
         await this.agentStore.update(agentId, (latest) => {
             if (!latest || latest.status !== 'awaiting_human')
                 return AGENT_STORE_NOOP;
+            if (opts.expectedHold
+                && (latest.awaitingPhase !== opts.expectedHold.phase
+                    || latest.awaitingSince !== opts.expectedHold.since
+                    || latest.awaitingNonce !== opts.expectedHold.nonce)) {
+                return AGENT_STORE_NOOP;
+            }
             cleared = true;
-            const { status: _status, awaitingPhase: _awaitingPhase, awaitingReason: _awaitingReason, awaitingSince: _awaitingSince, ...readyState } = latest;
+            const { status: _status, awaitingPhase: _awaitingPhase, awaitingReason: _awaitingReason, awaitingSince: _awaitingSince, awaitingNonce: _awaitingNonce, ...readyState } = latest;
             return {
                 ...readyState,
                 updatedAt: now,
@@ -1931,6 +2078,16 @@ export class AgentManager {
         await this.agentStore.update(agentId, (existing) => {
             if (!existing)
                 return AGENT_STORE_NOOP;
+            if (opts.expectedHold) {
+                const heldPhase = existing.status === 'awaiting_human' ? existing.awaitingPhase : undefined;
+                const heldSince = existing.status === 'awaiting_human' ? existing.awaitingSince : undefined;
+                const heldNonce = existing.status === 'awaiting_human' ? existing.awaitingNonce : undefined;
+                if (heldPhase !== opts.expectedHold.phase
+                    || heldSince !== opts.expectedHold.since
+                    || heldNonce !== opts.expectedHold.nonce) {
+                    return AGENT_STORE_NOOP;
+                }
+            }
             if (opts.expectedCreationToken !== undefined) {
                 const expected = opts.expectedCreationToken;
                 const actual = existing.creationToken ?? null;
@@ -1943,6 +2100,10 @@ export class AgentManager {
                 if (actualTask !== expectedTask)
                     return AGENT_STORE_NOOP;
             }
+            // 锁代 CAS：绑定被 successor re-acquire 后不得把工作中的 agent 挂回旧 hold
+            if (opts.expectedLockToken !== undefined && existing.lockToken !== opts.expectedLockToken) {
+                return AGENT_STORE_NOOP;
+            }
             if (isCancelCleanupHold(existing)) {
                 if (!CANCEL_CLEANUP_HOLD_PHASES.has(phase))
                     return AGENT_STORE_NOOP;
@@ -1959,15 +2120,17 @@ export class AgentManager {
                 awaitingPhase: phase,
                 awaitingReason: reason,
                 awaitingSince: now,
+                awaitingNonce: randomBytes(8).toString('hex'),
                 updatedAt: now,
             };
         });
         if (!wrote)
-            return;
+            return false;
         await this.emitIntervention(projectId, agentId, taskId, {
             phase,
             reason,
         });
+        return true;
     }
     async markAwaitingIfAckUnknown(agentId, err, expectedTaskId) {
         if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
@@ -2018,7 +2181,69 @@ export class AgentManager {
                 return { resumed: false, releasedBinding: false, reason };
             }
             if ((state.awaitingPhase === 'dirty-workdir' || state.awaitingPhase === 'checkout-preparation-failed')
-                && boundTask && ACTIVE_TASK_STATUSES.has(boundTask.status)) {
+                && boundTask && ACTIVE_TASK_STATUSES.has(boundTask.status)
+                // verdict 门禁状态没有在途派发：清掉 hold 后由 spec verdict 重新走完整转码，Resume 放行
+                && boundTask.status !== 'spec-ready' && boundTask.status !== 'max_rounds') {
+                if (state.taskId && boundTask.qaAgentId === agentId) {
+                    // 停驻的 review pass 已死（任务离开 review）：重派会伪造新 pass，只清 hold 并释放绑定；
+                    // 快照 hold/task 世代供释放路径 CAS，且不得借用 cancel-cleanup 的绕行凭据
+                    if (boundTask.status !== 'review') {
+                        return {
+                            resumed: true,
+                            releasedBinding: false,
+                            releaseHeldQa: {
+                                taskId: state.taskId,
+                                expectedHold: {
+                                    phase: state.awaitingPhase,
+                                    since: state.awaitingSince,
+                                    nonce: state.awaitingNonce,
+                                },
+                                expectedTask: {
+                                    status: boundTask.status,
+                                    phase: boundTask.phase,
+                                    signalToken: boundTask.signalToken,
+                                },
+                            },
+                            projectId: state.projectId,
+                            previousPhase: state.awaitingPhase,
+                        };
+                    }
+                    const nowQa = new Date().toISOString();
+                    let clearedHold = false;
+                    await this.agentStore.update(agentId, (existing) => {
+                        if (!existing || existing.taskId !== state.taskId)
+                            return AGENT_STORE_NOOP;
+                        if (existing.awaitingPhase !== state.awaitingPhase
+                            || existing.awaitingSince !== state.awaitingSince
+                            || existing.awaitingNonce !== state.awaitingNonce) {
+                            return AGENT_STORE_NOOP;
+                        }
+                        clearedHold = true;
+                        return {
+                            ...existing,
+                            status: 'ok',
+                            awaitingPhase: undefined,
+                            awaitingReason: undefined,
+                            awaitingSince: undefined,
+                            awaitingNonce: undefined,
+                            updatedAt: nowQa,
+                        };
+                    });
+                    if (!clearedHold) {
+                        const reason = `Agent ${agentId} hold changed while resuming; re-check the agent state and Resume again.`;
+                        console.warn(`[AgentManager] resumeAgent: ${reason}`);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    return {
+                        resumed: true,
+                        releasedBinding: false,
+                        redispatchReviewTaskId: state.taskId,
+                        reviewPassToken: boundTask.signalToken,
+                        heldLockToken: state.lockToken,
+                        projectId: state.projectId,
+                        previousPhase: state.awaitingPhase,
+                    };
+                }
                 const reason = `Task ${state.taskId} was not dispatched because its checkout could not be prepared. ` +
                     'Fix the Workdir, then cancel and redispatch the task; Resume cannot reconstruct the original dispatch safely.';
                 console.warn(`[AgentManager] resumeAgent: agent ${agentId} ${state.awaitingPhase} — ${reason}`);
@@ -2117,7 +2342,7 @@ export class AgentManager {
         if (result.redispatchCodeTaskId) {
             try {
                 const task = await this.taskStore.get(result.redispatchCodeTaskId);
-                const round = task?.specReviewRound;
+                const round = task ? (task.specReviewRound ?? 1) : undefined;
                 const stored = round === undefined
                     ? null
                     : await this.reviewStore?.getRound(result.redispatchCodeTaskId, 'spec', round);
@@ -2131,6 +2356,12 @@ export class AgentManager {
                     await this.markAwaitingHuman(agentId, 'code-dispatch-failed', reason, { expectedTaskId: result.redispatchCodeTaskId }).catch(() => undefined);
                     return { resumed: false, releasedBinding: false, reason };
                 }
+                // 重派与首派同样不经 startSession 的 post-ack finalize：残留的 bootstrap 标记
+                // 会让下一次 recover 把已送达的 code prompt 再判成未送达
+                if (!this.isResearchHandoff(task, agentId)) {
+                    const lockToken = (await this.agentStore.get(agentId))?.lockToken;
+                    await this.finalizeReplayedBootstrap(agentId, result.redispatchCodeTaskId, 'code', lockToken);
+                }
             }
             catch (err) {
                 console.error(`[AgentManager] resumeAgent code redispatch failed for ${agentId}:`, err);
@@ -2139,6 +2370,126 @@ export class AgentManager {
                 return { resumed: false, releasedBinding: false, reason };
             }
         }
+        if (result.releaseHeldQa) {
+            const { taskId: heldTaskId, expectedHold, expectedTask } = result.releaseHeldQa;
+            const released = await this.releaseAgentForTask(agentId, heldTaskId, 'idle', {
+                allowAwaitingHuman: true,
+                expectedHold,
+                expectedTask,
+            });
+            if (!released) {
+                const refreshed = await this.agentStore.get(agentId).catch((readErr) => {
+                    console.warn(`[AgentManager] resumeAgent post-release read failed for ${agentId}:`, readErr);
+                    return null;
+                });
+                return {
+                    resumed: false,
+                    releasedBinding: false,
+                    reason: refreshed?.awaitingReason
+                        ?? `Agent ${agentId} could not safely release task ${heldTaskId}; its pass or hold moved on — re-check the agent state and Resume again.`,
+                };
+            }
+            await this.emitIntervention(result.projectId, agentId, heldTaskId, {
+                phase: 'resumed',
+                previousPhase: result.previousPhase,
+                releasedBinding: true,
+            });
+            return { resumed: true, releasedBinding: true };
+        }
+        if (result.redispatchReviewTaskId) {
+            try {
+                await this.dispatchReviewToQa(result.redispatchReviewTaskId, {
+                    bumpRound: false,
+                    fromStatus: ['review'],
+                    ...(result.reviewPassToken !== undefined ? { expectSignalToken: result.reviewPassToken } : {}),
+                });
+            }
+            catch (err) {
+                console.error(`[AgentManager] resumeAgent review redispatch failed for ${agentId}:`, err);
+                const reason = `QA review redispatch on Resume failed: ${err instanceof Error ? err.message : String(err)}`;
+                const reviewTaskId = result.redispatchReviewTaskId;
+                // 锁代未变（未被 successor re-acquire）才允许补挂；markAwaitingHuman 内的 CAS 原子复核同一条件
+                const restoreHoldIfStillOurs = async (phase, holdReason) => {
+                    const after = await this.agentStore.get(agentId);
+                    if (after?.taskId === reviewTaskId
+                        && after.status !== 'awaiting_human'
+                        && after.lockToken === result.heldLockToken) {
+                        await this.markAwaitingHuman(agentId, phase, holdReason, {
+                            expectedTaskId: reviewTaskId,
+                            ...(result.heldLockToken !== undefined ? { expectedLockToken: result.heldLockToken } : {}),
+                        });
+                    }
+                };
+                // handled 只代表 startSession 已尝试落 hold；落库可能已失败，必须核实并按需补挂
+                if (err instanceof EnsureSessionError && err.partial.handled) {
+                    try {
+                        await restoreHoldIfStillOurs(result.previousPhase ?? 'checkout-preparation-failed', reason);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    catch (holdErr) {
+                        const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                        console.error(`[AgentManager] resumeAgent could not verify/restore the handled hold for ${agentId}:`, holdErr);
+                        return {
+                            resumed: false,
+                            releasedBinding: false,
+                            reason: `${reason}; verifying/restoring the hold also failed: ${holdMsg} — the agent may be missing its awaiting_human flag, inspect it manually`,
+                        };
+                    }
+                }
+                // ack_unknown：prompt 可能已在跑，必须恢复 ack hold 的可见性，而非按普通失败补挂 checkout hold
+                if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
+                    try {
+                        await restoreHoldIfStillOurs('dispatch-failed:ack_unknown', `${err.message}. Prompt may still be running in the pane; verify before resuming.`);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    catch (holdErr) {
+                        const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                        console.error(`[AgentManager] resumeAgent could not restore the ack_unknown hold for ${agentId}:`, holdErr);
+                        return {
+                            resumed: false,
+                            releasedBinding: false,
+                            reason: `${reason}; restoring the dispatch-failed:ack_unknown hold also failed: ${holdMsg} — prompt state is unknown and the agent is NOT flagged awaiting_human, inspect it manually`,
+                        };
+                    }
+                }
+                // pass 被接管（token 轮换或任务离开 review）说明该 pass 已死，补挂会把新 pass 的 QA 打成 hold
+                let passSuperseded = false;
+                let recoveryReadFailed = false;
+                try {
+                    const taskNow = await this.taskStore.get(reviewTaskId);
+                    passSuperseded = taskNow?.status !== 'review'
+                        || (result.reviewPassToken !== undefined && taskNow.signalToken !== result.reviewPassToken);
+                }
+                catch (readErr) {
+                    recoveryReadFailed = true;
+                    console.error(`[AgentManager] resumeAgent recovery task read failed for ${agentId}:`, readErr);
+                }
+                if (passSuperseded)
+                    return { resumed: false, releasedBinding: false, reason };
+                try {
+                    if (recoveryReadFailed) {
+                        // 读失败时无法证明接管，优先恢复可见性：锁代/绑定 CAS 全部由 markAwaitingHuman 原子判定
+                        await this.markAwaitingHuman(agentId, result.previousPhase ?? 'checkout-preparation-failed', reason, {
+                            expectedTaskId: reviewTaskId,
+                            ...(result.heldLockToken !== undefined ? { expectedLockToken: result.heldLockToken } : {}),
+                        });
+                    }
+                    else {
+                        await restoreHoldIfStillOurs(result.previousPhase ?? 'checkout-preparation-failed', reason);
+                    }
+                    return { resumed: false, releasedBinding: false, reason };
+                }
+                catch (holdErr) {
+                    const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                    console.error(`[AgentManager] resumeAgent could not restore the QA hold for ${agentId}:`, holdErr);
+                    return {
+                        resumed: false,
+                        releasedBinding: false,
+                        reason: `${reason}; restoring the hold also failed: ${holdMsg} — the agent is NOT flagged awaiting_human, inspect it manually`,
+                    };
+                }
+            }
+        }
         return {
             resumed: result.resumed,
             releasedBinding: result.releasedBinding,
@@ -2495,41 +2846,360 @@ export class AgentManager {
             };
         });
     }
-    async redispatchResearchAfterReplRestart(agentId, taskId) {
+    // Holds only the pass captured in the task tuple: a successor pass (rotated token/phase/status) is never overwritten.
+    async holdReplayFailureIfCurrent(agentId, taskAtEntry, holdPhase, reason, entryHold) {
+        return this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskAtEntry.id);
+            if (fresh?.agentId !== agentId
+                || fresh.status !== taskAtEntry.status
+                || fresh.phase !== taskAtEntry.phase
+                || fresh.signalToken !== taskAtEntry.signalToken)
+                return false;
+            if (await this.markAwaitingHuman(agentId, holdPhase, reason, {
+                expectedTaskId: taskAtEntry.id,
+                expectedHold: entryHold,
+            }))
+                return true;
+            // Entry hold gone (Resume raced): write over the empty generation, never over a foreign hold.
+            if (await this.markAwaitingHuman(agentId, holdPhase, reason, {
+                expectedTaskId: taskAtEntry.id,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+            }))
+                return true;
+            const now = await this.agentStore.get(agentId);
+            return now?.status === 'awaiting_human';
+        });
+    }
+    async redispatchTaskPromptAfterReplRestart(agentId, taskId) {
         const agent = this.getAgentConfig(agentId);
         const task = await this.taskStore.get(taskId);
-        if (!agent || agent.role !== 'research' || !task)
+        if (!agent || !task || !TASK_OWNER_ROLES.has(agent.role))
+            return false;
+        if (task.agentId !== agentId)
             return false;
-        if (task.researchAgentId !== agentId || task.agentId !== agentId || !task.signalToken)
+        const participantId = agent.role === 'research' ? task.researchAgentId : task.devAgentId;
+        if (participantId !== agentId)
+            return false;
+        const bindingAtEntry = await this.agentStore.get(agentId);
+        const entryHold = {
+            phase: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingPhase : undefined,
+            since: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingSince : undefined,
+            nonce: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingNonce : undefined,
+        };
+        // Concurrent passes can advance the task mid-replay; every replay gate re-checks this snapshot.
+        const taskStillCurrent = async () => {
+            const fresh = await this.taskStore.get(taskId);
+            return fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken;
+        };
+        // Hold ops share one task-mutation slot with a tuple re-check, and CAS on the entry hold generation.
+        const clearEntryHold = async () => this.withTaskLock(async () => {
+            if (!(await taskStillCurrent()))
+                return false;
+            if (entryHold.phase === undefined) {
+                const now = await this.agentStore.get(agentId);
+                return now?.status !== 'awaiting_human';
+            }
+            return this.clearAwaitingHuman(agentId, { expectedHold: entryHold });
+        });
+        const holdReplayFailure = (phase, reason) => this.holdReplayFailureIfCurrent(agentId, task, phase, reason, entryHold);
+        // skipSnapshot: stale scrollback literals belong to the aborted runtime; onlyReplaceOwnToken keeps a successor's watcher out of reach.
+        const fencedReplay = (expectedKinds, token, stillCurrent) => {
+            const abortStaleReplay = async () => {
+                if (await stillCurrent())
+                    return true;
+                this.phaseSignalWatcher?.stopIfToken(taskId, token);
+                return false;
+            };
+            return {
+                armBeforeInject: async () => {
+                    if (!(await stillCurrent()))
+                        return false;
+                    const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
+                        skipSnapshot: true,
+                        onlyReplaceOwnToken: true,
+                        // git 双 watcher 下 fence 只应比较自己的 (taskId, agentId) 条目：task 域会拿
+                        // sibling（reconciliation）的不同 token 否决本应合法的重布防
+                        ...(task.reviewMode === 'git' ? { replaceScope: 'agent' } : {}),
+                    });
+                    if (!armed) {
+                        if (!(await stillCurrent()))
+                            return false;
+                        // Own-generation arm failure: throwing routes the caller into the resumable hold.
+                        throw new Error(`replay signal watcher failed to arm for task ${taskId}; Restart REPL again or cancel the task`);
+                    }
+                    return abortStaleReplay();
+                },
+                guardBeforeInject: abortStaleReplay,
+            };
+        };
+        try {
+            if (task.status === 'approved' && agent.role === 'dev') {
+                return await this.replayApprovedHolderAfterReplRestart(agentId, task, taskStillCurrent, fencedReplay, { clearEntryHold, holdReplayFailure });
+            }
+            // reconciliation 条目不是 replay 目标：它没有对应的可重放 prompt，误选会以 QA 轮换 token
+            // 重注 dev 的 publish 提示（spec §5.3 ④ 只允许一次 actor 归位）
+            const mapped = this.mapTaskStateToExpectedWatcher(task);
+            if (!mapped || mapped.agentId !== agentId)
+                return false;
+            if (!task.signalToken) {
+                return await holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-pass but the task has no signal token to replay the prompt with; cancel the task or re-dispatch it.');
+            }
+            const signalToken = task.signalToken;
+            const replayOpts = {
+                signalToken,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                ...fencedReplay(mapped.expectedKinds, signalToken, taskStillCurrent),
+            };
+            const replayInitialBootstrap = async (phase, opts) => {
+                // This hold means the prompt WAS delivered and only the marker clear failed; replaying would run it twice.
+                if (entryHold.phase === 'bootstrap-marker-clear-failed') {
+                    return holdReplayFailure('restart-redispatch-failed', 'REPL restarted while the initial prompt was already delivered (its bootstrap marker clear had failed); replaying would dispatch the task twice. Resume and verify the Workdir, or cancel the task.');
+                }
+                const bindingBefore = await this.agentStore.get(agentId);
+                if (!(await clearEntryHold()))
+                    return false;
+                const resumed = await this.continueSession(taskId, agentId, phase, opts);
+                if (resumed && bindingBefore?.bootstrappingTaskId === taskId) {
+                    await this.finalizeReplayedBootstrap(agentId, taskId, phase, bindingBefore.lockToken);
+                }
+                return resumed;
+            };
+            if (task.status === 'in_progress' && task.phase === 'research' && agent.role === 'research') {
+                return await replayInitialBootstrap('research', replayOpts);
+            }
+            if (task.status === 'in_progress' && task.phase === undefined && agent.role === 'dev') {
+                // An undelivered bootstrap never started work, so the fresh-dispatch clean gate still applies.
+                const delivered = (await this.agentStore.get(agentId))?.bootstrappingTaskId !== taskId;
+                return await replayInitialBootstrap('develop', {
+                    ...replayOpts,
+                    ...(delivered ? { allowDirtyWorkdir: true } : {}),
+                });
+            }
+            if (task.status === 'in_progress' && task.phase === 'code' && agent.role === 'dev') {
+                const state = await this.agentStore.get(agentId);
+                // A no-QA auto-approved spec never writes specReviewRound back; the code dispatch defaults to round 1.
+                const round = task.specReviewRound ?? 1;
+                const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
+                if (state?.bootstrappingTaskId === taskId || !stored || stored.phase !== 'spec') {
+                    return await holdReplayFailure('code-dispatch-failed', 'REPL restarted but the code-phase prompt cannot be resumed in place. Resume to replay the persisted Spec documents, or cancel the task.');
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'code', {
+                    ...replayOpts,
+                    allowDirtyWorkdir: true,
+                    specDocuments: stored.documents,
+                    ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
+                });
+            }
+            if (task.status === 'fixing' && task.phase === 'spec') {
+                const round = task.specReviewRound ?? 1;
+                const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
+                if (!stored?.findings) {
+                    return await holdReplayFailure('restart-redispatch-failed', `REPL restarted during the spec fixing round but round ${round} findings are not persisted; the feedback prompt cannot be replayed. Cancel the task or re-run the spec review.`);
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'server-feedback', {
+                    ...replayOpts,
+                    ...(agent.role === 'dev' ? { allowDirtyWorkdir: true } : {}),
+                    serverPriorFindings: JSON.stringify(stored.findings),
+                    ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
+                });
+            }
+            // A direct (no-SDD) pass never persists a phase, so fixing + undefined is the plain code-feedback round.
+            if (task.status === 'fixing'
+                && (task.phase === 'code' || task.phase === undefined)
+                && agent.role === 'dev') {
+                if (task.reviewMode === 'server') {
+                    const round = Math.max(task.reviewRound, 1);
+                    const stored = await this.reviewStore?.getRound(taskId, 'code', round);
+                    if (!stored?.findings) {
+                        return await holdReplayFailure('restart-redispatch-failed', `REPL restarted during the code fixing round but round ${round} findings are not persisted; the feedback prompt cannot be replayed. Cancel the task or re-run the code review.`);
+                    }
+                    if (!(await clearEntryHold()))
+                        return false;
+                    return await this.continueSession(taskId, agentId, 'server-feedback', {
+                        ...replayOpts,
+                        allowDirtyWorkdir: true,
+                        serverPriorFindings: JSON.stringify(stored.findings),
+                    });
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'fix', {
+                    ...replayOpts,
+                    allowDirtyWorkdir: true,
+                });
+            }
             return false;
-        let phase;
-        let expectedKind;
-        let findings;
-        if (task.phase === 'research' && task.status === 'in_progress') {
-            phase = 'research';
-            expectedKind = 'spec-done';
-        }
-        else if (task.phase === 'spec' && task.status === 'fixing') {
-            const round = task.specReviewRound ?? 1;
-            const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
-            if (!stored?.findings)
+        }
+        catch (err) {
+            // A post-entry throw may land after clearEntryHold; only a tuple-checked hold on the live generation is safe.
+            const message = err instanceof Error ? err.message : String(err);
+            if (await holdReplayFailure('restart-redispatch-failed', `REPL restarted but replaying the task prompt failed: ${message}. Resume to retry, or cancel the task.`)) {
+                return true;
+            }
+            throw err;
+        }
+    }
+    // approved hosts two live holder passes — GitHub post-approve (PostApproveStore) and server after-done (task fields); a parked pre-publish holder stays on the waiting path.
+    async replayApprovedHolderAfterReplRestart(agentId, task, taskStillCurrent, fencedReplay, holdGen) {
+        const taskId = task.id;
+        const { clearEntryHold, holdReplayFailure } = holdGen;
+        if (task.reviewMode === 'server') {
+            if (!task.publishDispatchedAt)
+                return false;
+            if (!task.signalToken) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-publish but the rotated publish token is missing; the publish prompt cannot be replayed. Cancel the task or mark-complete to re-dispatch the publish.');
+            }
+            const token = task.signalToken;
+            const afterDone = this.resolveAfterDone(task);
+            if (!afterDone) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-publish but the after-done target cannot be resolved anymore. Resume then mark-complete to retry the publish, or cancel the task.');
+            }
+            let violation;
+            try {
+                violation = await this.findLineageViolation(taskId);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                return holdReplayFailure('restart-redispatch-failed', `REPL restarted mid-publish but the branch lineage re-check failed: ${message}. Resume then Restart REPL to retry, or cancel the task.`);
+            }
+            if (violation) {
+                return holdReplayFailure('restart-redispatch-failed', `The task branch embeds another active task's commits (${violation.branch}); rebase onto origin/HEAD, then mark-complete to retry the publish.`);
+            }
+            if (!(await clearEntryHold()))
                 return false;
-            phase = 'server-feedback';
-            expectedKind = 'spec-fixed';
-            findings = JSON.stringify(stored.findings);
+            return this.continueSession(taskId, agentId, 'server-after-done', {
+                signalToken: token,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                allowDirtyWorkdir: true,
+                serverAfterDone: { kind: afterDone, branch: task.branch ?? BRANCH_PREFIX + taskId },
+                ...fencedReplay(['code-ready'], token, taskStillCurrent),
+            });
+        }
+        if (task.postApproveRevoked) {
+            return holdReplayFailure('restart-redispatch-failed', `The post-approve completion was deliberately revoked (${task.postApproveRevoked.reason}); ` +
+                'the block stays effective, so the pass is not replayed. Re-request changes to restart the review round, or cancel the task.');
+        }
+        const stored = await this.getPostApproveCompletion(taskId);
+        let completion;
+        if (stored) {
+            if (!task.postApproveHeadSha) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass but the stored completion cannot be tied to a persisted approved head; re-request the review verdict or cancel the task.');
+            }
+            if (stored.approvedHeadSha !== task.postApproveHeadSha) {
+                // Provably a dead episode's residue: retire it by token, then rebuild for the current head.
+                await this.clearPostApproveCompletionIfMatches(taskId, stored.token);
+                completion = await this.rebuildPostApproveCompletion(agentId, task, holdReplayFailure);
+            }
+            else {
+                completion = { token: stored.token, rebuilt: false };
+            }
         }
         else {
+            completion = await this.rebuildPostApproveCompletion(agentId, task, holdReplayFailure);
+        }
+        if (completion === 'held')
+            return true;
+        if (completion === 'stale')
             return false;
+        const resolvedCompletion = completion;
+        const completionStillCurrent = async () => {
+            const fresh = await this.taskStore.get(taskId);
+            return fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken
+                && fresh.postApproveRevoked === undefined
+                && fresh.postApproveHeadSha === task.postApproveHeadSha
+                && (await this.getPostApproveCompletion(taskId))?.token === resolvedCompletion.token;
+        };
+        if (!(await completionStillCurrent()))
+            return false;
+        if (!(await clearEntryHold()))
+            return false;
+        let resumed = false;
+        try {
+            resumed = await this.continueSession(taskId, agentId, 'post-approve', {
+                signalToken: completion.token,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                allowDirtyWorkdir: true,
+                ...fencedReplay(['pr-merge-ready'], completion.token, completionStillCurrent),
+            });
         }
-        await this.clearAwaitingHuman(agentId);
-        return this.continueSession(taskId, agentId, phase, {
-            bypassTaskStatusGate: true,
-            signalToken: task.signalToken,
-            preserveDispatchOutputs: true,
-            ...(findings ? { serverPriorFindings: findings } : {}),
-            ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
-            armBeforeInject: () => this.setupPhaseSignalWatcher(taskId, agentId, expectedKind, task.signalToken),
+        catch (err) {
+            if (completion.rebuilt)
+                await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
+            throw err;
+        }
+        if (resumed && task.reviewMode === 'git') {
+            await this.confirmPostApprovePromptDelivered(taskId, completion.token);
+        }
+        if (!resumed && completion.rebuilt) {
+            await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
+            const fresh = await this.taskStore.get(taskId);
+            const episodeIntact = fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken
+                && fresh.postApproveRevoked === undefined
+                && fresh.postApproveHeadSha === task.postApproveHeadSha;
+            if (!episodeIntact)
+                return false;
+            return holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass and the rebuilt prompt could not be delivered; Resume then Restart REPL to retry, or cancel the task.');
+        }
+        return resumed;
+    }
+    // A bare hold would loop (Resume clears it, the next restart misses the record again), so rebuild from the persisted approved head.
+    async rebuildPostApproveCompletion(agentId, task, holdReplayFailure) {
+        // latestHeadSha drifts with pushes/mismatch probes; only the head persisted at dispatch is provably approved.
+        const approvedHeadSha = task.postApproveHeadSha;
+        if (!approvedHeadSha) {
+            const held = await holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass but neither its completion context nor a provably approved head are persisted; cancel the task or re-request the review verdict.');
+            return held ? 'held' : 'stale';
+        }
+        const token = createSignalToken();
+        // Conditional create: the in-lock re-read rejects any revoke/dispatch landed since the snapshot.
+        const created = await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(task.id);
+            if (!fresh
+                || fresh.agentId !== agentId
+                || fresh.status !== 'approved'
+                || fresh.phase !== task.phase
+                || fresh.signalToken !== task.signalToken
+                || fresh.postApproveRevoked !== undefined
+                || fresh.postApproveHeadSha !== approvedHeadSha) {
+                return false;
+            }
+            if (fresh.reviewMode === 'git') {
+                if (fresh.postApproveToken !== undefined)
+                    return false;
+                // rebuild 与常规安装同一 installed→delivered 协议：写后崩溃由 sweep 按 pending 补派
+                await this.taskStore.set({
+                    ...fresh,
+                    postApproveToken: token,
+                    postApprovePhase: 'installed',
+                    pendingRedispatch: true,
+                    updatedAt: new Date().toISOString(),
+                });
+                return true;
+            }
+            if (await this.postApproveStore.get(task.id))
+                return false;
+            await this.postApproveStore.set(task.id, { token, approvedHeadSha });
+            return true;
         });
+        if (!created)
+            return 'stale';
+        return { token, rebuilt: true };
     }
     prepareRemoveTargets(agentId) {
         const cfg = this.getAgentConfig(agentId);
@@ -2672,6 +3342,17 @@ export class AgentManager {
     getProjectByRepo(repo) {
         return this.config.project.find(p => repoSlug(p.repo) === repo);
     }
+    getProjectByRepoIdentity(repoKey) {
+        return this.config.project.find(p => repoIdentityKey(p.repo) === repoKey);
+    }
+    platformDriverFor(projectId) {
+        if (!this.pluginRegistry)
+            return undefined;
+        const project = this.getProjectConfig(projectId);
+        if (!project)
+            return undefined;
+        return buildProjectDriver(project, this.pluginRegistry, this.platformDriverExec);
+    }
     findAgentGroup(anchorAgentId) {
         for (const project of this.config.project) {
             for (const group of project.agent) {
@@ -2707,47 +3388,598 @@ export class AgentManager {
         return this.agentStore.get(agentId);
     }
     async getPostApproveCompletion(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (task?.reviewMode === 'git')
+            return this.gitCompletionOf(task);
         return this.postApproveStore.get(taskId);
     }
-    async setPostApproveCompletion(taskId, value) {
-        await this.withTaskLock(async () => {
-            await this.postApproveStore.set(taskId, value);
-            if (!this.phaseSignalWatcher)
-                return;
-            const task = await this.taskStore.get(taskId);
-            if (!task)
-                return;
-            await this.startPhaseSignalWatch({
-                taskId,
-                projectId: task.projectId,
-                agentId: task.agentId,
-                expectedKinds: 'pr-merge-ready',
-                token: value.token,
-            });
-        });
+    // 'git' 的 completion 与效果字段同居 TaskState：consumedFeedback/pendingRedispatch 与
+    // token CAS 必须同一次持久化（spec §6 双写协议）；legacy github 沿 PostApproveStore 至 M3c。
+    gitCompletionOf(task) {
+        if (task.postApproveToken === undefined || task.postApproveHeadSha === undefined)
+            return null;
+        return {
+            token: task.postApproveToken,
+            approvedHeadSha: task.postApproveHeadSha,
+            updatedAt: task.updatedAt,
+            ...(task.redispatchCount !== undefined ? { redispatchCount: task.redispatchCount } : {}),
+            ...(task.pendingRedispatch !== undefined ? { pendingRedispatch: task.pendingRedispatch } : {}),
+        };
     }
-    async clearPostApproveCompletion(taskId) {
-        await this.withTaskLock(async () => {
-            await this.postApproveStore.clear(taskId);
-            this.phaseSignalWatcher?.stop(taskId);
-        });
+    stripGitCompletionFields(task) {
+        const { postApproveToken: _t, pendingRedispatch: _p, redispatchCount: _r, postApprovePhase: _ph, ...rest } = task;
+        return rest;
     }
-    async clearPostApproveCompletionIfMatches(taskId, token) {
+    // Install CASes on the current approved episode; only a fresh human verdict (clearRevocation) unlocks a standing marker.
+    async setPostApproveCompletion(taskId, value, opts = {}) {
         return this.withTaskLock(async () => {
-            const cleared = await this.postApproveStore.clearIfMatches(taskId, token);
+            const task = await this.taskStore.get(taskId);
+            if (task) {
+                if (task.status !== 'approved')
+                    return false;
+                if (task.postApproveRevoked && !opts.clearRevocation)
+                    return false;
+                if (task.postApproveHeadSha !== undefined && task.postApproveHeadSha !== value.approvedHeadSha)
+                    return false;
+            }
+            if (task?.reviewMode === 'git') {
+                const { postApproveRevoked: _revoked, ...rest } = task;
+                // 全量替换语义与 PostApproveStore.set 一致：未携带的 pending/redispatch 字段清空
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(opts.clearRevocation ? rest : task),
+                    postApproveToken: value.token,
+                    postApprovePhase: 'installed',
+                    ...(value.redispatchCount !== undefined ? { redispatchCount: value.redispatchCount } : {}),
+                    ...(value.pendingRedispatch !== undefined ? { pendingRedispatch: value.pendingRedispatch } : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+            }
+            else {
+                await this.postApproveStore.set(taskId, value);
+            }
+            if (!task)
+                return true;
+            if (task.postApproveRevoked && task.reviewMode !== 'git') {
+                const { postApproveRevoked: _revoked, ...rest } = task;
+                await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+            }
+            if (!this.phaseSignalWatcher)
+                return true;
+            const armed = await this.startPhaseSignalWatch({
+                taskId,
+                projectId: task.projectId,
+                agentId: task.agentId,
+                expectedKinds: 'pr-merge-ready',
+                token: value.token,
+            });
+            if (!armed) {
+                // completion 没有 consumer 就不算安装成功：撤销本次写，durable pending（若有）随原状保留
+                if (task.reviewMode === 'git') {
+                    await this.taskStore.set({ ...task, updatedAt: new Date().toISOString() });
+                }
+                else {
+                    await this.postApproveStore.clear(taskId);
+                }
+                return false;
+            }
+            return true;
+        });
+    }
+    // post-approve prompt 的至少一次投递（spec §6）：pendingRedispatch 随 completion 安装保持 true，
+    // 仅在 continueSession 确认送达后清除——安装与投递之间的崩溃由恢复扫描按 pending 补派。
+    async confirmPostApprovePromptDelivered(taskId, token) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.postApproveToken !== token)
+                return;
+            await this.taskStore.set({
+                ...task,
+                pendingRedispatch: false,
+                postApprovePhase: 'delivered',
+                updatedAt: new Date().toISOString(),
+            });
+        });
+    }
+    async markPostApproveSignalReceived(taskId, token) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.postApproveToken !== token)
+                return;
+            if (task.postApprovePhase === 'signaled')
+                return;
+            await this.taskStore.set({ ...task, postApprovePhase: 'signaled', updatedAt: new Date().toISOString() });
+        });
+    }
+    async clearPostApproveCompletion(taskId) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== undefined || task.pendingRedispatch !== undefined
+                    || task.redispatchCount !== undefined) {
+                    await this.taskStore.set({
+                        ...this.stripGitCompletionFields(task),
+                        updatedAt: new Date().toISOString(),
+                    });
+                }
+            }
+            else {
+                await this.postApproveStore.clear(taskId);
+            }
+            this.phaseSignalWatcher?.stop(taskId);
+        });
+    }
+    // CAS for an existing pass: never creates a record nor touches the marker, so it cannot resurrect a revoked completion.
+    async updatePostApproveCompletionIfToken(taskId, expectedToken, patch, opts = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (task?.postApproveRevoked)
+                return false;
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== expectedToken)
+                    return false;
+                await this.taskStore.set({
+                    ...task,
+                    ...patch,
+                    ...(opts.consumeRevision
+                        ? { consumedFeedback: { ...task.consumedFeedback, [opts.consumeRevision.key]: opts.consumeRevision.versionTime } }
+                        : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+                return true;
+            }
+            const current = await this.postApproveStore.get(taskId);
+            if (!current || current.token !== expectedToken)
+                return false;
+            await this.postApproveStore.set(taskId, { ...current, ...patch });
+            return true;
+        });
+    }
+    // Deliberate clear: the persisted marker keeps a restart replay from rebuilding the completion and bypassing the block.
+    async revokePostApproveCompletion(taskId, reason, opts = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== 'approved')
+                return false;
+            // Head binds the revoke to one approved episode; an unpersisted head cannot disprove it, so blocking stays fail closed.
+            if (opts.expectedHeadSha !== undefined
+                && task.postApproveHeadSha !== undefined
+                && task.postApproveHeadSha !== opts.expectedHeadSha)
+                return false;
+            if (opts.expectedToken !== undefined) {
+                if (task.reviewMode === 'git') {
+                    if (task.postApproveToken !== opts.expectedToken)
+                        return false;
+                }
+                else {
+                    const current = await this.postApproveStore.get(taskId);
+                    if (current?.token !== opts.expectedToken)
+                        return false;
+                }
+            }
+            if (task.reviewMode === 'git') {
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(task),
+                    postApproveRevoked: { reason, at: new Date().toISOString() },
+                    updatedAt: new Date().toISOString(),
+                });
+                this.phaseSignalWatcher?.stop(taskId);
+                return true;
+            }
+            // Marker lands first: a crash before the clear leaves marker+completion, which every consumer fences on.
+            await this.taskStore.set({
+                ...task,
+                postApproveRevoked: { reason, at: new Date().toISOString() },
+                updatedAt: new Date().toISOString(),
+            });
+            await this.postApproveStore.clear(taskId);
+            this.phaseSignalWatcher?.stop(taskId);
+            return true;
+        });
+    }
+    async clearPostApproveCompletionIfMatches(taskId, token) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== token)
+                    return false;
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(task),
+                    updatedAt: new Date().toISOString(),
+                });
+                this.phaseSignalWatcher?.stop(taskId);
+                return true;
+            }
+            const cleared = await this.postApproveStore.clearIfMatches(taskId, token);
             if (cleared)
                 this.phaseSignalWatcher?.stop(taskId);
             return cleared;
         });
     }
-    async setupRecoveredPostApproveSignals() {
-        if (!this.phaseSignalWatcher)
+    // Marker/token/head/pending are re-checked inside the committing critical section, so a concurrent revoke never loses.
+    async completeApprovedPassToMergeReady(taskId, expectedToken) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== 'approved' || task.postApproveRevoked) {
+                return { refused: 'stale' };
+            }
+            const completion = task.reviewMode === 'git'
+                ? this.gitCompletionOf(task)
+                : await this.postApproveStore.get(taskId);
+            if (!completion
+                || completion.token !== expectedToken
+                || task.postApproveHeadSha === undefined
+                || completion.approvedHeadSha !== task.postApproveHeadSha) {
+                return { refused: 'stale' };
+            }
+            if (completion.pendingRedispatch)
+                return { refused: 'pending' };
+            const next = task.reviewMode === 'git' ? this.stripGitCompletionFields(task) : task;
+            delete next.postApproveHeadSha;
+            Object.assign(next, {
+                status: 'merge-ready',
+                latestHeadSha: completion.approvedHeadSha,
+                updatedAt: new Date().toISOString(),
+            });
+            await this.taskStore.set(next);
+            if (task.reviewMode !== 'git')
+                await this.postApproveStore.clear(taskId);
+            this.phaseSignalWatcher?.stop(taskId);
+            return { task: next };
+        });
+    }
+    // 修剪顺序单向（spec §6）：仅在对应源 cursor durable 落盘后调用；水位停滞的源不修剪，
+    // 有界性由水位前进保证，禁止按容量淘汰未覆盖键。
+    async pruneConsumedFeedback(taskId, sourceKey, watermarkTime) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task?.consumedFeedback)
+                return;
+            const prefix = `${sourceKey}:`;
+            const kept = Object.entries(task.consumedFeedback)
+                .filter(([key, time]) => !key.startsWith(prefix) || time >= watermarkTime);
+            if (kept.length === Object.keys(task.consumedFeedback).length)
+                return;
+            await this.taskStore.set({
+                ...task,
+                consumedFeedback: Object.fromEntries(kept),
+                updatedAt: new Date().toISOString(),
+            });
+        });
+    }
+    // TaskState 效果+outbox 先 durable、投递成功再清（spec §6 双写协议）：崩溃于任一侧，
+    // 重启从未清 outbox 重投，事件携确定性 key 供展示端去重——效果恰一次、通知至少一次。
+    async recordClosedUnmergedAnchor(taskId, prNumber) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || TERMINAL_STATUSES.includes(task.status))
+                return false;
+            const anchor = task.closedUnmergedAnchor;
+            if (anchor?.prNumber === prNumber && anchor.cleared !== true)
+                return false;
+            const generation = (anchor?.generation ?? 0) + 1;
+            const eventKey = `${taskId}:${prNumber}:mr-closed-unmerged:${generation}`;
+            await this.taskStore.set({
+                ...task,
+                closedUnmergedAnchor: { prNumber, generation },
+                outbox: [...(task.outbox ?? []), {
+                        key: eventKey,
+                        type: 'human.intervention',
+                        data: { phase: 'mr-closed-unmerged', prNumber, eventKey },
+                    }],
+                updatedAt: new Date().toISOString(),
+            });
+            return true;
+        });
+    }
+    async clearClosedUnmergedAnchor(taskId, prNumber) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            const anchor = task?.closedUnmergedAnchor;
+            if (!task || anchor?.prNumber !== prNumber || anchor.cleared === true)
+                return false;
+            const generation = anchor.generation;
+            const eventKey = `${taskId}:${prNumber}:mr-reopened:${generation}`;
+            await this.taskStore.set({
+                ...task,
+                closedUnmergedAnchor: { ...anchor, cleared: true },
+                outbox: [...(task.outbox ?? []), {
+                        key: eventKey,
+                        type: 'human.intervention',
+                        data: { phase: 'mr-reopened', prNumber, eventKey },
+                    }],
+                updatedAt: new Date().toISOString(),
+            });
+            return true;
+        });
+    }
+    async deliverTaskOutbox(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (!task?.outbox?.length)
             return;
+        for (const entry of task.outbox) {
+            try {
+                await this.eventBus.emit({
+                    // 确定性 id（spec §6 outbox）：重投/并发 flush 的重复条目同 id，消费/展示端可去重
+                    id: `outbox:${entry.key}`,
+                    type: entry.type,
+                    timestamp: new Date().toISOString(),
+                    projectId: task.projectId,
+                    agentId: task.agentId,
+                    taskId: task.id,
+                    data: entry.data,
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] outbox delivery failed for task=${taskId} key=${entry.key}:`, err);
+                continue;
+            }
+            await this.withTaskLock(async () => {
+                const fresh = await this.taskStore.get(taskId);
+                if (!fresh?.outbox?.some(e => e.key === entry.key))
+                    return;
+                const remaining = fresh.outbox.filter(e => e.key !== entry.key);
+                const { outbox: _outbox, ...rest } = fresh;
+                await this.taskStore.set({
+                    ...rest,
+                    ...(remaining.length > 0 ? { outbox: remaining } : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+            });
+        }
+    }
+    // merge-ready 信号是单发消费：git 分支在消费点引入网络复核，失败时必须重 arm（skipSnapshot
+    // false 让仍在面板上的信号立即重放），否则一次瞬态失败吞掉整轮完成信号。
+    async rearmPostApproveSignal(taskId, opts = {}) {
+        const task = await this.taskStore.get(taskId);
+        if (!task || task.status !== 'approved')
+            return false;
+        const completion = task.reviewMode === 'git'
+            ? this.gitCompletionOf(task)
+            : await this.postApproveStore.get(taskId);
+        if (!completion)
+            return false;
+        if (!this.phaseSignalWatcher)
+            return true;
+        return this.startPhaseSignalWatch({
+            taskId,
+            projectId: task.projectId,
+            agentId: task.agentId,
+            expectedKinds: 'pr-merge-ready',
+            token: completion.token,
+            // 刚消费的信号仍在滚动区：扫描失败路径必须 live-only，否则与持续失败叠加成无退避热循环
+            ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+        });
+    }
+    // 配置身份切换与任务创建共栅栏（TOCTOU）：blocker 扫描与提交在 withTaskLock 内执行，
+    // createTask 的「读配置快照+落任务」同经该锁，扫描时不可见的并发新任务不存在。
+    async guardGitConfigCommit(current, next, scan, commit) {
+        return this.withTaskLock(async () => {
+            const blockers = await scan(this, current, next);
+            if (blockers.length > 0)
+                return { ok: false, blockers };
+            await commit();
+            return { ok: true };
+        });
+    }
+    async flushGitOutbox() {
+        const tasks = await this.taskStore.list();
+        for (const task of tasks) {
+            if (task.reviewMode !== 'git' || !task.outbox?.length)
+                continue;
+            try {
+                await this.deliverTaskOutbox(task.id);
+            }
+            catch (err) {
+                // 单任务失败不得饿死其后的 durable outbox（至少一次的重启保证）
+                console.warn(`[AgentManager] flushGitOutbox: task=${task.id} failed, continuing:`, err);
+            }
+        }
+    }
+    // cancel 清理的部分成功可重试（spec §6 close 条 + 破坏性清理不静默失败）：close 已成而
+    // deleteBranch 瞬态失败时任务已终态，重启在守卫成立的前提下幂等补删（REF_NOT_FOUND 即成功）。
+    // 只清本代 pending：A 的 start 晚于 B 的失败返回时，无条件清除会吞掉 B 留下的重试锚
+    async clearReviewDispatchPending(taskId, expectedToken) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewDispatchPending !== true)
+                return;
+            if (task.status !== 'review' || task.signalToken !== expectedToken)
+                return;
+            const { reviewDispatchPending: _p, ...rest } = task;
+            await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+        });
+    }
+    // 评审派发的至少一次（sweep 消费）：transition 落 pending、QA session 启动成功才清——
+    // QA 缺失/忙/arm/start 失败的每条早退路径都由此在 60s 内自愈，无需依赖事件重放。
+    async retryPendingGitReviewDispatches() {
+        const tasks = await this.listActiveGitTasks();
+        for (const task of tasks) {
+            if (task.reviewDispatchPending !== true)
+                continue;
+            // arm/start 失败回滚会退到 in_progress/fixing 且无第二触发源（poller 已记 pushSha、
+            // watcher 已消费）：pending 在场即重新拉入 review
+            if (!['review', 'in_progress', 'fixing'].includes(task.status))
+                continue;
+            try {
+                await this.dispatchReviewToQa(task.id, { bumpRound: false });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] retryPendingGitReviewDispatches: task=${task.id} still failing:`, err);
+            }
+        }
+    }
+    async retryGitRemoteBranchCleanup() {
+        const tasks = await this.taskStore.list({ status: 'cancelled' });
+        for (const task of tasks) {
+            const reason = task.branchCleanupPending?.reason;
+            if (task.reviewMode !== 'git'
+                || (reason !== 'remote-delete-failed' && reason !== 'remote-close-failed'))
+                continue;
+            try {
+                const driver = this.platformDriverFor(task.projectId);
+                const branch = task.branch;
+                if (!driver || branch === undefined)
+                    continue;
+                // close 先补（幂等：closed PR 再 PATCH state=closed 为 no-op），再按守卫补删分支
+                if (reason === 'remote-close-failed' && task.prNumber !== undefined) {
+                    await driver.runOp('close', { prNumber: task.prNumber });
+                }
+                if (!isAutoDeletableTaskBranch({
+                    taskId: task.id,
+                    taskBranch: branch,
+                    branchCreatedByBaxian: task.branchCreatedByBaxian,
+                    actualRef: `refs/heads/${branch}`,
+                })) {
+                    if (reason !== 'remote-close-failed')
+                        continue;
+                }
+                else {
+                    await driver.runOp('deleteBranch', { branch });
+                }
+                await this.withTaskLock(async () => {
+                    const fresh = await this.taskStore.get(task.id);
+                    const freshReason = fresh?.branchCleanupPending?.reason;
+                    if (freshReason !== 'remote-delete-failed' && freshReason !== 'remote-close-failed')
+                        return;
+                    const { branchCleanupPending: _pending, ...rest } = fresh;
+                    await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] retryGitRemoteBranchCleanup: task=${task.id} still failing:`, err);
+            }
+        }
+    }
+    // 反馈消费的唯一状态机（spec §6 双写协议 + merge 条）：锁内按实时状态决定效果，效果字段
+    // 与消费键同一次持久化——入口快照与提交之间的并发状态迁移不再能让 revision 落空。
+    async consumeGitFeedbackRevision(taskId, consume, opts = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git')
+                return { kind: 'gone' };
+            if (task.consumedFeedback?.[consume.key] !== undefined)
+                return { kind: 'duplicate' };
+            const consumed = { ...task.consumedFeedback, [consume.key]: consume.versionTime };
+            const stamp = { updatedAt: new Date().toISOString() };
+            if (TERMINAL_STATUSES.includes(task.status)) {
+                await this.taskStore.set({ ...task, consumedFeedback: consumed, ...stamp });
+                return { kind: 'consumed' };
+            }
+            if (task.status === 'merge-ready') {
+                const approvedHead = typeof task.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(task.latestHeadSha)
+                    ? task.latestHeadSha
+                    : undefined;
+                if (approvedHead !== undefined) {
+                    const next = {
+                        ...task,
+                        status: 'approved',
+                        postApproveHeadSha: approvedHead,
+                        pendingRedispatch: true,
+                        consumedFeedback: consumed,
+                        ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                        ...stamp,
+                    };
+                    await this.taskStore.set(next);
+                    return { kind: 'returned', task: next };
+                }
+            }
+            if (task.status === 'approved' && task.postApproveRevoked === undefined) {
+                const next = {
+                    ...task,
+                    pendingRedispatch: true,
+                    consumedFeedback: consumed,
+                    ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                    ...stamp,
+                };
+                await this.taskStore.set(next);
+                return { kind: 'pending', task: next };
+            }
+            await this.taskStore.set({
+                ...task,
+                consumedFeedback: consumed,
+                ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                ...stamp,
+            });
+            return { kind: 'consumed' };
+        });
+    }
+    // merge-ready 不是评论面的冻结点（spec §6 merge 条）：新反馈单写退回 approved + 消费键，
+    // 与 push 使 merge-ready 失效的既有语义对称。
+    async returnMergeReadyToApproved(taskId, consume) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.status !== 'merge-ready')
+                return null;
+            const approvedHead = typeof task.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(task.latestHeadSha)
+                ? task.latestHeadSha
+                : undefined;
+            if (!approvedHead)
+                return null;
+            // pendingRedispatch 与状态翻转/消费键同写：崩溃于派发前，恢复扫描凭它补派（spec §6 至少一次）
+            const next = {
+                ...task,
+                status: 'approved',
+                postApproveHeadSha: approvedHead,
+                pendingRedispatch: true,
+                consumedFeedback: { ...task.consumedFeedback, [consume.key]: consume.versionTime },
+                updatedAt: new Date().toISOString(),
+            };
+            await this.taskStore.set(next);
+            return next;
+        });
+    }
+    async setupRecoveredPostApproveSignals() {
         const tasks = await this.taskStore.list({ status: 'approved' });
         for (const task of tasks) {
-            const completion = await this.postApproveStore.get(task.id);
+            if (task.postApproveRevoked) {
+                // Finish an interrupted revoke: the marker is authoritative, the leftover record must not re-arm.
+                try {
+                    if (task.reviewMode === 'git') {
+                        if (task.postApproveToken !== undefined) {
+                            await this.taskStore.set({
+                                ...this.stripGitCompletionFields(task),
+                                updatedAt: new Date().toISOString(),
+                            });
+                        }
+                    }
+                    else {
+                        await this.postApproveStore.clear(task.id);
+                    }
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: revoked completion cleanup failed for task=${task.id}:`, err);
+                }
+                continue;
+            }
+            const completion = task.reviewMode === 'git'
+                ? this.gitCompletionOf(task)
+                : await this.postApproveStore.get(task.id);
             if (!completion)
                 continue;
+            if (task.postApproveHeadSha === undefined) {
+                // A completion the task head cannot vouch for is another episode's residue until proven otherwise.
+                console.warn(`[AgentManager] setupRecoveredPostApproveSignals: task=${task.id} has a stored completion but no persisted approved head; not re-arming`);
+                continue;
+            }
+            if (completion.approvedHeadSha !== task.postApproveHeadSha) {
+                try {
+                    if (task.reviewMode === 'git') {
+                        await this.taskStore.set({
+                            ...this.stripGitCompletionFields(task),
+                            updatedAt: new Date().toISOString(),
+                        });
+                    }
+                    else
+                        await this.postApproveStore.clear(task.id);
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: task=${task.id} retired a completion bound to head ${completion.approvedHeadSha} (persisted approved head ${task.postApproveHeadSha})`);
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: stale completion cleanup failed for task=${task.id}:`, err);
+                }
+                continue;
+            }
+            if (!this.phaseSignalWatcher)
+                continue;
             try {
                 await this.startPhaseSignalWatch({
                     taskId: task.id,
@@ -2771,9 +4003,16 @@ export class AgentManager {
         for (const task of tasks) {
             if (!task.signalToken)
                 continue;
-            const mapped = this.mapTaskStateToExpectedWatcher(task);
-            if (!mapped)
+            const mappings = this.mapTaskStateToExpectedWatchers(task);
+            if (mappings.length === 0)
                 continue;
+            for (const mapped of mappings) {
+                await this.setupRecoveredWatcherForMapping(task, mapped.token ?? task.signalToken, mapped, mappings.length > 1);
+            }
+        }
+    }
+    async setupRecoveredWatcherForMapping(task, signalToken, mapped, hasSiblings) {
+        {
             const { expectedKinds, agentId } = mapped;
             const specStage = isSpecStagePhase(task.phase);
             const interventionKindLabel = specStage && task.status === 'review' ? 'spec-reviewed'
@@ -2795,9 +4034,10 @@ export class AgentManager {
                     projectId: task.projectId,
                     agentId,
                     expectedKinds,
-                    token: task.signalToken,
+                    token: signalToken,
                     skipSnapshot: !scanSnapshotOnRecover,
                     recovered: true,
+                    ...(hasSiblings ? { replaceScope: 'agent' } : {}),
                     ...(allowRecoveredReadFile
                         ? { onReadFile: (req) => { void this.handleReadFileRequest(task.id, agentId, req); } }
                         : {}),
@@ -2891,16 +4131,259 @@ export class AgentManager {
                 return undefined;
             throw new Error(`gh pr view exited ${result.exitCode} for PR #${prNumber}: ${stderr.slice(0, 200)}`);
         }
-        const parts = result.stdout.trim().split('\t');
-        const [headRefName, headSha, state, isCross] = parts;
-        const body = parts.slice(4).join('\t');
-        if (!headRefName || !/^[0-9a-f]{40}$/i.test(headSha))
-            return undefined;
-        if (state !== 'OPEN')
-            return undefined;
-        if (isCross === 'true')
-            return undefined;
-        return { headRefName, headSha, body };
+        const parts = result.stdout.trim().split('\t');
+        const [headRefName, headSha, state, isCross] = parts;
+        const body = parts.slice(4).join('\t');
+        if (!headRefName || !/^[0-9a-f]{40}$/i.test(headSha))
+            return undefined;
+        if (state !== 'OPEN')
+            return undefined;
+        if (isCross === 'true')
+            return undefined;
+        return { headRefName, headSha, body };
+    }
+    platformBindingFields(projectId) {
+        if (this.effectiveReviewMode(projectId) !== 'git')
+            return {};
+        const project = this.getProjectConfig(projectId);
+        if (!project)
+            return {};
+        const tool = resolveProjectTool(project);
+        if (tool === undefined)
+            return {};
+        return { platformBinding: { mode: 'git', repoKey: repoIdentityKey(project.repo), tool } };
+    }
+    // 指纹为纯身份三元组（spec §4）：binary/env/skill 文本 live 解析可演进，身份失配即拒绝
+    assertPlatformBinding(task) {
+        const binding = task.platformBinding;
+        if (!binding) {
+            if (task.reviewMode !== 'git')
+                return;
+            // D11 无兼容负担：不存在合法的无快照 git 任务，缺失即损坏/手工恢复，按失配同级拒绝
+            void this.emitIntervention(task.projectId, task.agentId || undefined, task.id, {
+                phase: 'platform-binding-mismatch',
+                reason: 'missing-binding-snapshot',
+            });
+            throw new Error(`platform binding missing for git task ${task.id}; refusing platform operations`);
+        }
+        const project = this.getProjectConfig(task.projectId);
+        const live = project === undefined ? undefined : {
+            mode: this.effectiveReviewMode(task.projectId),
+            repoKey: repoIdentityKey(project.repo),
+            tool: resolveProjectTool(project),
+        };
+        if (live !== undefined && live.mode === binding.mode
+            && live.repoKey === binding.repoKey && live.tool === binding.tool)
+            return;
+        void this.emitIntervention(task.projectId, task.agentId || undefined, task.id, {
+            phase: 'platform-binding-mismatch',
+            binding,
+            ...(live !== undefined ? { live: { mode: live.mode, repoKey: live.repoKey, tool: live.tool ?? '' } } : {}),
+        });
+        throw new Error(`platform binding mismatch for task ${task.id}: snapshot ${binding.mode}/${binding.repoKey}/${binding.tool} no longer matches the live config`);
+    }
+    async platformTaskAndDriver(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (!task)
+            throw new Error(`task ${taskId} not found`);
+        this.assertPlatformBinding(task);
+        const driver = this.platformDriverFor(task.projectId);
+        if (!driver)
+            throw new Error(`no git driver resolvable for project ${task.projectId}`);
+        return { task, driver };
+    }
+    async listActiveGitTasks(projectId) {
+        const tasks = await this.taskStore.list(projectId !== undefined ? { projectId } : undefined);
+        return tasks.filter(t => t.reviewMode === 'git' && !TERMINAL_STATUSES.includes(t.status));
+    }
+    async platformFetchPrView(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const [row] = await driver.runOp('prView', { prNumber: task.prNumber });
+        return row;
+    }
+    async platformVerifyPrBinding(taskId, prNumber, opts = {}) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        const [row] = await driver.runOp('prView', { prNumber });
+        let expectedBase = task.baseBranch;
+        if (expectedBase === undefined) {
+            try {
+                const [project] = await driver.runOp('projectView');
+                if (typeof project?.defaultBranch === 'string')
+                    expectedBase = project.defaultBranch;
+            }
+            catch {
+                // 快照与实时默认分支都拿不到 → unverifiable：核验失败不是核验通过（fail closed）
+            }
+        }
+        const check = checkOpenPrBinding(row, { branch: opts.branchOverride ?? task.branch, expectedBase });
+        if (!check.ok) {
+            return {
+                ...check,
+                ...(check.reason === 'branch' && typeof row.branch === 'string' ? { prBranch: row.branch } : {}),
+            };
+        }
+        return {
+            ok: true,
+            headSha: String(row.headSha),
+            branch: String(row.branch),
+            targetBranch: String(row.targetBranch),
+        };
+    }
+    stopPhaseSignalWatcherAgent(taskId, agentId) {
+        this.phaseSignalWatcher?.stopAgent(taskId, agentId);
+    }
+    async platformClosePr(taskId, opts) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        try {
+            await driver.runOp('close', { prNumber: task.prNumber });
+        }
+        catch (err) {
+            throw new PlatformCloseError('close', err);
+        }
+        const branch = task.branch;
+        const deletable = opts.deleteBranch && branch !== undefined && isAutoDeletableTaskBranch({
+            taskId: task.id,
+            taskBranch: branch,
+            branchCreatedByBaxian: task.branchCreatedByBaxian,
+            actualRef: `refs/heads/${branch}`,
+        });
+        if (deletable) {
+            try {
+                await driver.runOp('deleteBranch', { branch });
+            }
+            catch (err) {
+                throw new PlatformCloseError('deleteBranch', err);
+            }
+        }
+    }
+    async platformScanComments(driver, prNumber) {
+        return scanCommentSourcesOnce(driver, prNumber, () => Date.now());
+    }
+    // merge-ready 迁移与 merge confirm 的 provenance/ack 双复核共用一次全源扫描（spec §6/§10）
+    async platformVerifyAcceptedPass(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            return { ok: false, reason: 'no bound PR' };
+        const provenance = task.passProvenance;
+        if (!provenance)
+            return { ok: false, reason: 'no accepted pass provenance' };
+        const scans = await this.platformScanComments(driver, task.prNumber);
+        const recheck = recheckPassProvenance({
+            token: provenance.token,
+            failToken: provenance.failToken,
+            anchorSha: provenance.anchorSha,
+            carrier: { sourceKey: provenance.sourceKey, id: provenance.id, bodyDigest: provenance.bodyDigest },
+        }, scans);
+        if (!recheck.ok)
+            return { ok: false, reason: `provenance ${recheck.reason}` };
+        const pending = collectPendingFeedback(scans, {
+            replyActorId: task.replyActorId,
+            replyActorStatus: task.replyActorStatus,
+        });
+        if (!pending.allSourcesOk)
+            return { ok: false, reason: 'source scan incomplete' };
+        return { ok: true, pendingCount: pending.pending.size };
+    }
+    async platformPendingFeedback(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const scans = await this.platformScanComments(driver, task.prNumber);
+        const failed = scans.filter(s => !s.ok).map(s => s.key);
+        if (failed.length > 0) {
+            throw new Error(`pending-feedback scan incomplete; failed sources: ${failed.join(', ')}`);
+        }
+        return collectPendingFeedback(scans, {
+            replyActorId: task.replyActorId,
+            replyActorStatus: task.replyActorStatus,
+        });
+    }
+    async platformConfirmMerge(taskId, opts) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const prNumber = task.prNumber;
+        const [row] = await driver.runOp('prView', { prNumber });
+        const binding = checkOpenPrBinding(row, { branch: task.branch, expectedBase: task.baseBranch });
+        if (!binding.ok)
+            throw new Error(`merge blocked: binding ${binding.reason}`);
+        if (String(row.headSha) !== opts.expectedHeadSha) {
+            throw new Error(`merge blocked: head moved (expected ${opts.expectedHeadSha}, saw ${String(row.headSha)})`);
+        }
+        // 人工兜底（max_rounds Mark complete）绕过 QA 授权复核（该路径本就无 pass），
+        // binding/head/REST sha 的安全检查保留（spec §7 威胁模型：merge 有人工 confirm）
+        if (opts.humanOverride !== true) {
+            const provenance = task.passProvenance;
+            if (!provenance)
+                throw new PlatformMergeRecheckError('no accepted pass provenance on task');
+            if (provenance.anchorSha.toLowerCase() !== opts.expectedHeadSha.toLowerCase()) {
+                throw new PlatformMergeRecheckError(`pass provenance anchors ${provenance.anchorSha}, not the merge head ${opts.expectedHeadSha}`);
+            }
+            const scans = await this.platformScanComments(driver, prNumber);
+            const recheck = recheckPassProvenance({
+                token: provenance.token,
+                failToken: provenance.failToken,
+                anchorSha: provenance.anchorSha,
+                carrier: { sourceKey: provenance.sourceKey, id: provenance.id, bodyDigest: provenance.bodyDigest },
+            }, scans);
+            if (!recheck.ok) {
+                // 瞬态扫描不完整留在 gate 可重试；只有确定性失效（撤销/编辑/缺失）才退回 approved
+                if (recheck.reason === 'source-scan-incomplete') {
+                    throw new Error('merge blocked: provenance source-scan-incomplete');
+                }
+                throw new PlatformMergeRecheckError(`provenance ${recheck.reason}`);
+            }
+            const pending = collectPendingFeedback(scans, {
+                replyActorId: task.replyActorId,
+                replyActorStatus: task.replyActorStatus,
+            });
+            if (!pending.allSourcesOk)
+                throw new Error('merge blocked: pending-feedback scan incomplete');
+            if (pending.pending.size > 0) {
+                throw new PlatformMergeRecheckError(`${pending.pending.size} pending feedback revision(s) without ack`);
+            }
+        }
+        // 临门 CAS：扫描期间 durable 退回（approved/pendingRedispatch/fixing）必须使本次 Confirm 失效；
+        // REST sha 只保护 source head，保护不了评论面与 TaskState（残余网络窗口按 spec §6 如实声明）
+        const fresh = await this.taskStore.get(taskId);
+        if (!fresh
+            || (opts.humanOverride === true
+                // override 只绕过 provenance/ack，不绕过本次认领的 gate 代际：并发 RC 转 fixing 即失效
+                ? fresh.status !== 'merge-ready'
+                : (fresh.status !== 'merge-ready' && fresh.status !== 'ready'))
+            || fresh.latestHeadSha !== opts.expectedHeadSha
+            || fresh.pendingRedispatch === true) {
+            throw new Error(`merge blocked: task left its merge gate (status=${fresh?.status ?? 'gone'})`);
+        }
+        try {
+            await driver.runOp('merge', { prNumber, expectedHeadSha: opts.expectedHeadSha });
+        }
+        catch (err) {
+            if (err instanceof DriverOpError && err.info.errorClass === 'MERGE_BLOCKED') {
+                let mergeStatus;
+                try {
+                    const [fresh] = await driver.runOp('prView', { prNumber });
+                    if (typeof fresh?.detailedMergeStatus === 'string')
+                        mergeStatus = fresh.detailedMergeStatus;
+                }
+                catch {
+                    // 归因查询失败不遮蔽原始错误
+                }
+                throw new Error(`merge blocked by platform${mergeStatus ? ` (${mergeStatus})` : ''}: ${err.message}`);
+            }
+            throw err;
+        }
+    }
+    mintReviewTokenPair() {
+        const passToken = createSignalToken();
+        let failToken = createSignalToken();
+        while (failToken === passToken)
+            failToken = createSignalToken();
+        return { passToken, failToken };
     }
     async listTasksByProject(projectId) {
         return this.taskStore.list({ projectId });
@@ -2924,6 +4407,20 @@ export class AgentManager {
         task.updatedAt = new Date().toISOString();
         await this.taskStore.set(task);
     }
+    async updateTaskIfStatus(taskId, expectedStatus, updates, alsoExpect = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== expectedStatus)
+                return false;
+            if ('signalToken' in alsoExpect && task.signalToken !== alsoExpect.signalToken)
+                return false;
+            if ('reviewRound' in alsoExpect && task.reviewRound !== alsoExpect.reviewRound)
+                return false;
+            Object.assign(task, updates, { updatedAt: new Date().toISOString() });
+            await this.taskStore.set(task);
+            return true;
+        });
+    }
     async updateTask(taskId, updates) {
         await this.withTaskLock(async () => {
             const task = await this.taskStore.get(taskId);
@@ -2943,11 +4440,19 @@ export class AgentManager {
                 return null;
             if (!guard.fromStatus.includes(previousStatus))
                 return null;
+            // 代际 CAS（spec §7）：校验后提交前的并发换代（push/重派轮换 token+pair）使旧 verdict 失效
+            if (guard.expectSignalToken !== undefined && task.signalToken !== guard.expectSignalToken)
+                return null;
             if (patch?.branch && patch.branch !== task.branch) {
                 const existing = await this.findTaskByBranch(patch.branch, task.projectId);
                 if (existing && existing.id !== taskId)
                     return null;
             }
+            // The revocation marker and approved head scope to the approved episode they were created in.
+            if (previousStatus === 'approved' && toStatus !== 'approved') {
+                delete task.postApproveRevoked;
+                delete task.postApproveHeadSha;
+            }
             Object.assign(task, patch ?? {}, {
                 status: toStatus,
                 updatedAt: new Date().toISOString(),
@@ -3123,6 +4628,7 @@ export class AgentManager {
                 branch: taskBranch,
                 branchCreatedByBaxian,
                 reviewMode: this.effectiveReviewMode(projectId),
+                ...this.platformBindingFields(projectId),
                 createdAt: now,
                 updatedAt: now,
                 ...(imageFilenames ? { images: imageFilenames } : {}),
@@ -3198,7 +4704,7 @@ export class AgentManager {
         const task = await this.createTask(projectId, input);
         if (task.status === 'in_progress' && task.agentId) {
             const signalToken = createSignalToken();
-            await this.updateTask(task.id, { signalToken });
+            await this.updateTask(task.id, this.dispatchTokenFields(task, signalToken));
             const dispatchLockToken = (await this.agentStore.get(task.agentId))?.lockToken;
             const start = this.startCreatedTaskSession(task.id, task.agentId, signalToken, dispatchLockToken);
             if (opts.background) {
@@ -3558,7 +5064,7 @@ export class AgentManager {
             return claim;
         const claimed = claim.task;
         const signalToken = createSignalToken();
-        await this.updateTask(claimed.id, { signalToken });
+        await this.updateTask(claimed.id, this.dispatchTokenFields(claimed, signalToken));
         let started = false;
         let dispatchErr = null;
         const initialDispatch = this.resolveInitialDispatch(claimed);
@@ -3752,7 +5258,11 @@ export class AgentManager {
             else {
                 if (!task.branch)
                     throw new Error(`Task ${taskId} has no task branch`);
-                await branchManager.switchToTaskBranch(workdir, taskId, task.branch, task.branchCreatedByBaxian === true);
+                await branchManager.switchToTaskBranch(workdir, taskId, task.branch, task.branchCreatedByBaxian === true, task.branchLocalCleaned
+                    ? { restorableRemoteTip: task.branchLocalCleaned.remoteTipSha }
+                    : {});
+                if (task.branchLocalCleaned)
+                    await this.clearBranchLocalCleaned(taskId);
             }
             await assertOwner();
             if (!ensure.freshRuntime) {
@@ -3997,7 +5507,7 @@ export class AgentManager {
             throw err;
         }
     }
-    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime) {
+    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime, guardBeforePaste) {
         const before = await this.agentStore.get(agentId);
         const beforeLockToken = before?.taskId
             ? await this.resolveTaskLockToken(before, before.taskId)
@@ -4046,13 +5556,16 @@ export class AgentManager {
                 }
                 : undefined;
             await revalidate?.();
-            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate);
+            if (guardBeforePaste && !(await guardBeforePaste())) {
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste);
         }
         finally {
             this.compactInFlight.delete(agentId);
         }
     }
-    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate) {
+    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste) {
         // 静态忙信号（文本忙样式/working title）可能是残稿或 stale title 冒充，一律由帧活性仲裁；ready 视图覆盖 stale title。
         const preTitle = await tmux.readPaneTitle(paneId);
         const preFrame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
@@ -4062,15 +5575,87 @@ export class AgentManager {
         if (staticBusy && await this.paneHasLiveTurn(tmux, paneId, runtime)) {
             throw new Error(`pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
         }
-        await tmux.clearComposerDraft(paneId);
         await revalidate?.();
-        await tmux.injectPrompt(paneId, prompt, agentId);
+        if (guardBeforePaste) {
+            // A stale replay must not touch the pane at all: the guard runs before the first composer scrub.
+            if (!(await guardBeforePaste())) {
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+            const staged = await tmux.stagePromptBuffer(paneId, prompt, agentId);
+            // Fence + scrub + paste share one task-mutation-queue slot, so a rotation lands before or after, never between.
+            let pasted = false;
+            try {
+                pasted = await this.withTaskLock(async () => {
+                    if (!(await guardBeforePaste()))
+                        return false;
+                    await tmux.clearComposerDraft(paneId);
+                    await tmux.pasteStagedBuffer(paneId, staged.buf);
+                    return true;
+                });
+            }
+            catch (pasteErr) {
+                // Buffer still present proves the paste never landed; missing/unprobeable fails closed to a composer scrub.
+                let bufferConsumed = true;
+                try {
+                    await tmux.dropStagedBuffer(staged.buf);
+                    bufferConsumed = false;
+                }
+                catch (dropErr) {
+                    console.warn(`[AgentManager] staged buffer ${staged.buf} not confirmed dropped after failed paste (missing or unprobeable); failing closed to a composer scrub:`, dropErr);
+                }
+                if (bufferConsumed) {
+                    try {
+                        await tmux.clearComposerDraft(paneId);
+                    }
+                    catch (clearErr) {
+                        console.warn(`[AgentManager] composer scrub after unknown paste outcome failed for pane ${paneId}:`, clearErr);
+                    }
+                }
+                throw pasteErr;
+            }
+            if (!pasted) {
+                try {
+                    await tmux.dropStagedBuffer(staged.buf);
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] staged buffer ${staged.buf} cleanup failed:`, err);
+                }
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+        }
+        else {
+            await tmux.clearComposerDraft(paneId);
+            await revalidate?.();
+            await tmux.injectPrompt(paneId, prompt, agentId);
+        }
         let baseline;
         let baselineTitle = '';
         try {
             baseline = await tmux.captureSettledSnapshot(paneId, { timeoutMs: this.dispatchSettleTimeoutMs });
             baselineTitle = await tmux.readPaneTitle(paneId);
-            await tmux.sendEnter(paneId);
+            if (guardBeforePaste) {
+                // The Enter is the actual submission; it takes the same fenced queue slot.
+                const submitted = await this.withTaskLock(async () => {
+                    if (!(await guardBeforePaste()))
+                        return false;
+                    await tmux.sendEnter(paneId);
+                    return true;
+                });
+                if (!submitted) {
+                    try {
+                        await tmux.clearComposerDraft(paneId);
+                    }
+                    catch (err) {
+                        // Fail closed: a submit-ready stale prompt could not be confirmed gone.
+                        const message = err instanceof Error ? err.message : String(err);
+                        throw new Error(`fence-rejected prompt could not be scrubbed from the composer of pane ${paneId}; verify the pane before reuse: ${message}`);
+                    }
+                    return { acked: false, composerDelivered: false, aborted: true };
+                }
+            }
+            else {
+                await tmux.sendEnter(paneId);
+            }
         }
         catch (preAckErr) {
             if (await this.clearComposerForReuse(tmux, paneId, agentId))
@@ -4078,11 +5663,24 @@ export class AgentManager {
             const message = preAckErr instanceof Error ? preAckErr.message : String(preAckErr);
             throw new DispatchTerminalError('ack_unknown', `pre-ack failure left an unconfirmed composer on live pane ${paneId}: ${message}`);
         }
+        let staleDuringResend = false;
         try {
             await tmux.waitSubmitAck(paneId, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
-                resend: () => tmux.sendEnter(paneId),
+                resend: guardBeforePaste
+                    ? async () => {
+                        // A resend is a fresh submission of whatever sits in the composer; it takes the same fence.
+                        const resent = await this.withTaskLock(async () => {
+                            if (!(await guardBeforePaste()))
+                                return false;
+                            await tmux.sendEnter(paneId);
+                            return true;
+                        });
+                        if (!resent)
+                            staleDuringResend = true;
+                    }
+                    : () => tmux.sendEnter(paneId),
                 resendIntervalMs: this.dispatchAckResendIntervalMs,
             });
             return { acked: true, composerDelivered: true };
@@ -4092,6 +5690,16 @@ export class AgentManager {
             if (!(err instanceof Error && /runtime ack timeout/.test(err.message))) {
                 throw new DispatchTerminalError('ack_unknown', `ack_unknown for pane ${paneId}: ${message}`);
             }
+            if (staleDuringResend) {
+                try {
+                    await tmux.clearComposerDraft(paneId);
+                }
+                catch (scrubErr) {
+                    const scrubMessage = scrubErr instanceof Error ? scrubErr.message : String(scrubErr);
+                    throw new Error(`fence-rejected resend left an unverified composer on pane ${paneId}; verify the pane before reuse: ${scrubMessage}`);
+                }
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
             console.warn(`[AgentManager] dispatch ack timeout for pane ${paneId} agent ${agentId}: ${message}`);
             const state = await this.agentStore.get(agentId).catch(() => null);
             await this.emitIntervention(state?.projectId ?? '', agentId, state?.taskId, {
@@ -4201,7 +5809,7 @@ export class AgentManager {
             const reason = `Workdir changed during continueSession: ` +
                 `before=${taskWorkdir}, ensure=${ensure.workdir}, state=${verifiedWorkdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         const expectedStatuses = PHASE_EXPECTED_STATUS[phase] ?? [];
@@ -4217,11 +5825,22 @@ export class AgentManager {
         }
         if (agent.role === 'dev' && task.branch) {
             const branches = new BranchManager(runner);
-            await branches.assertClean(verifiedWorkdir);
+            if (!opts.allowDirtyWorkdir)
+                await branches.assertClean(verifiedWorkdir);
             const actualRef = await branches.currentRef(verifiedWorkdir);
             if (actualRef !== `refs/heads/${task.branch}`) {
-                throw new Error(`Agent ${agentId} checkout mismatch for task ${taskId}: ` +
-                    `expected refs/heads/${task.branch}, got ${actualRef ?? 'detached HEAD'}`);
+                // dev 可能已被释放过（如 spec max_rounds 停驻默认分支）；switchToTaskBranch 自带
+                // assertClean，脏树时抛 DirtyWorkdirError fail-closed，不会覆盖未提交的改动
+                await this.assertTaskGeneration(agentId, taskId, lockToken, verifiedWorkdir);
+                await branches.switchToTaskBranch(verifiedWorkdir, taskId, task.branch, task.branchCreatedByBaxian === true, {
+                    requireExistingWork: true,
+                    ...(task.branchLocalCleaned
+                        ? { restorableRemoteTip: task.branchLocalCleaned.remoteTipSha }
+                        : {}),
+                });
+                await this.assertTaskGeneration(agentId, taskId, lockToken, verifiedWorkdir);
+                if (task.branchLocalCleaned)
+                    await this.clearBranchLocalCleaned(taskId);
             }
         }
         else if (agent.role === 'research') {
@@ -4264,6 +5883,7 @@ export class AgentManager {
                 agent,
                 workdir: verifiedWorkdir,
                 skillRegistry: this.skillRegistry,
+                hasQaPartner: task.qaAgentId !== undefined,
                 ...(signalToken ? { signalToken } : {}),
                 ...(useIncrementalNudge
                     ? { postApproveRedispatchCount: opts.postApproveRedispatchCount }
@@ -4315,17 +5935,29 @@ export class AgentManager {
             const reason = `Workdir changed before prompt injection: ` +
                 `verified=${verifiedWorkdir}, current=${agentFresh.workdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         await this.assertTaskLockOwner(agentId, taskId, lockToken);
-        if (phase === 'post-approve') {
-            const completionFresh = await this.getPostApproveCompletion(taskId);
-            if (!completionFresh || completionFresh.token !== signalToken) {
-                console.warn(`[AgentManager] continueSession[post-approve]: token changed before paste for task ${taskId}; skipping`);
-                return false;
-            }
+        // A revoke marks before clearing and a push transitions before clearing; every half-window must abort the paste.
+        const postApprovePassStillLive = async () => {
+            const [taskFresh, completionFresh] = await Promise.all([
+                this.taskStore.get(taskId),
+                this.getPostApproveCompletion(taskId),
+            ]);
+            return taskFresh?.agentId === agentId
+                && taskFresh.status === 'approved'
+                && taskFresh.postApproveRevoked === undefined
+                && taskFresh.postApproveHeadSha !== undefined
+                && completionFresh !== null
+                && completionFresh.token === signalToken
+                && completionFresh.approvedHeadSha === taskFresh.postApproveHeadSha;
+        };
+        if (phase === 'post-approve' && !(await postApprovePassStillLive())) {
+            console.warn(`[AgentManager] continueSession[post-approve]: pass revoked or rotated before paste for task ${taskId}; skipping`);
+            return false;
         }
+        const guardBeforeInject = opts.guardBeforeInject ?? (phase === 'post-approve' ? postApprovePassStillLive : undefined);
         if (opts.armBeforeInject && !(await opts.armBeforeInject({}))) {
             return false;
         }
@@ -4356,11 +5988,19 @@ export class AgentManager {
             const reason = `Workdir changed before prompt injection: ` +
                 `verified=${verifiedWorkdir}, current=${stateBeforeInject.workdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         await this.assertTaskLockOwner(agentId, taskId, lockToken);
-        await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime);
+        if (guardBeforeInject && !(await guardBeforeInject())) {
+            console.warn(`[AgentManager] continueSession[${phase}]: pre-inject guard rejected the paste for task ${taskId}; skipping`);
+            return false;
+        }
+        const delivery = await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime, guardBeforeInject);
+        if (delivery.aborted) {
+            console.warn(`[AgentManager] continueSession[${phase}]: pre-paste guard rejected the inject for task ${taskId}; skipping`);
+            return false;
+        }
         return true;
     }
     async rollbackUndeliveredBootstrap(state) {
@@ -4445,6 +6085,49 @@ export class AgentManager {
             return { ...rest, updatedAt: new Date().toISOString() };
         });
     }
+    // continueSession never runs startSession's post-ack finalization; a surviving marker would make recover() roll the running task back to pending.
+    async finalizeReplayedBootstrap(agentId, taskId, phase, expectedLockToken) {
+        let cleared = false;
+        let deliveredWorkdir;
+        try {
+            await this.agentStore.update(agentId, (latest) => {
+                if (!latest
+                    || latest.taskId !== taskId
+                    || latest.bootstrappingTaskId !== taskId
+                    || latest.lockToken !== expectedLockToken) {
+                    return AGENT_STORE_NOOP;
+                }
+                cleared = true;
+                deliveredWorkdir = latest.workdir;
+                const { bootstrappingTaskId: _delivered, ...rest } = latest;
+                return { ...rest, updatedAt: new Date().toISOString() };
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] replay: clearing bootstrap marker for task=${taskId} failed:`, err);
+            await this.markAwaitingHuman(agentId, 'bootstrap-marker-clear-failed', 'Prompt was replayed but clearing the in-flight bootstrap marker failed; held so recovery does ' +
+                'not roll back an already-running task. Verify the agent via web terminal, then Resume.', { expectedTaskId: taskId }).catch((holdErr) => {
+                console.warn(`[AgentManager] replay: hold after marker-clear failure for task=${taskId} failed:`, holdErr);
+            });
+            return;
+        }
+        if (!cleared)
+            return;
+        try {
+            await this.eventBus.emit({
+                id: '',
+                type: 'session.started',
+                timestamp: new Date().toISOString(),
+                projectId: this.getAgentConfig(agentId)?.projectId ?? '',
+                agentId,
+                taskId,
+                data: { phase, ...(deliveredWorkdir !== undefined ? { workdir: deliveredWorkdir } : {}) },
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] replay: session.started emit failed for task=${taskId}:`, err);
+        }
+    }
     async releaseOrphanedLocks(states) {
         const bindings = new Map(states.map(state => [state.id, state]));
         const claims = await this.lockManager.listClaims();
@@ -4460,6 +6143,13 @@ export class AgentManager {
         }
     }
     async recover() {
+        // 'git' outbox 重投先行：崩溃于「效果已写、通知未达」的窗口由此闭合（spec §6），legacy 任务零涉
+        await this.flushGitOutbox().catch(err => {
+            console.warn('[AgentManager] recover: git outbox flush failed:', err);
+        });
+        await this.retryGitRemoteBranchCleanup().catch(err => {
+            console.warn('[AgentManager] recover: git remote branch cleanup retry failed:', err);
+        });
         const states = await this.agentStore.list();
         await this.releaseOrphanedLocks(states);
         const deferredCleanups = [];
@@ -4850,7 +6540,11 @@ export class AgentManager {
             }
             const project = this.getProjectConfig(result.projectId);
             try {
-                if (project) {
+                if (project && result.reviewMode === 'git') {
+                    // close 不附评论（spec §10 有意差异）；deleteBranch 由 isAutoDeletableTaskBranch 守卫
+                    await this.platformClosePr(taskId, { deleteBranch: true });
+                }
+                else if (project) {
                     const close = await execNetwork(this.platformRunner, `gh pr close ${publishedCleanup.prNumber} --repo ${shellQuote(repoSlug(project.repo))} ` +
                         `--comment ${shellQuote('Task cancelled in baxian; closing the published PR.')}`, GH_NET);
                     if (close.exitCode !== 0)
@@ -4859,6 +6553,26 @@ export class AgentManager {
             }
             catch (err) {
                 console.warn(`[AgentManager] cancelTask remote retirement failed for ${taskId}:`, err);
+                if (result.reviewMode === 'git') {
+                    await this.withTaskLock(async () => {
+                        const fresh = await this.taskStore.get(taskId);
+                        if (!fresh)
+                            return;
+                        await this.taskStore.set({
+                            ...fresh,
+                            branchCleanupPending: {
+                                agentId: fresh.devAgentId,
+                                reason: err instanceof PlatformCloseError && err.step === 'close'
+                                    ? 'remote-close-failed'
+                                    : 'remote-delete-failed',
+                                updatedAt: new Date().toISOString(),
+                            },
+                            updatedAt: new Date().toISOString(),
+                        });
+                    }).catch(persistErr => {
+                        console.warn(`[AgentManager] cancelTask cleanup marker persist failed for ${taskId}:`, persistErr);
+                    });
+                }
                 await this.emitIntervention(result.projectId, undefined, taskId, {
                     phase: 'cancel-published-artifact-cleanup-failed',
                     afterDone: publishedCleanup.afterDone,
@@ -4966,13 +6680,38 @@ export class AgentManager {
                 ? 'review'
                 : 'recheck';
             const prevQa = await this.agentStore.get(qaId);
+            const resumingHeldDispatch = prevQa?.taskId === taskId && prevQa.status === 'awaiting_human';
             if (prevQa?.taskId === taskId) {
-                await this.releaseAgentForTask(qaId, taskId, 'idle');
+                if (prevQa.status === 'awaiting_human' && !isRecoverableQaDispatchHold(prevQa)) {
+                    throw new ApiError(409, `QA agent ${qaId} is awaiting human (${prevQa.awaitingPhase ?? 'unknown phase'}); resolve that hold before redispatching review`);
+                }
+                const released = await this.releaseAgentIfBound(qaId, taskId, prevQa.status === 'awaiting_human'
+                    ? {
+                        allowAwaitingHuman: true,
+                        expectedHold: {
+                            phase: prevQa.awaitingPhase,
+                            since: prevQa.awaitingSince,
+                            nonce: prevQa.awaitingNonce,
+                        },
+                    }
+                    : undefined);
+                if (!released) {
+                    const after = await this.agentStore.get(qaId);
+                    const holdNote = after?.status === 'awaiting_human'
+                        ? ` (awaiting_human: ${after.awaitingPhase ?? 'unknown phase'})`
+                        : '';
+                    throw new ApiError(409, `QA agent ${qaId} could not be released from task ${taskId}${holdNote}; review dispatch aborted`);
+                }
             }
             const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase);
             if (!acquired) {
                 throw new ApiError(409, `QA agent ${qaId} is busy or unavailable`);
             }
+            const acquiredClaim = await this.lockManager.claimOf(qaId);
+            const acquiredLockToken = acquiredClaim?.taskId === taskId ? acquiredClaim.token : undefined;
+            const releaseOwnAcquire = acquiredLockToken !== undefined
+                ? { expectedLockToken: acquiredLockToken }
+                : {};
             let devParked = false;
             if (!isTerminal && devAgentId) {
                 const devState = await this.agentStore.get(devAgentId);
@@ -4983,7 +6722,7 @@ export class AgentManager {
                         return false;
                     });
                     if (!devOk) {
-                        await this.releaseAgentForTask(qaId, taskId, 'idle')
+                        await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire)
                             .catch(() => undefined);
                         throw new ApiError(500, `Cannot park dev ${devAgentId} into waiting for manual QA review (task status=${taskStatusAtClaim}); QA released`);
                     }
@@ -4996,9 +6735,12 @@ export class AgentManager {
                 signalToken: pre?.signalToken,
                 reviewHeadAnchorSha: pre?.reviewHeadAnchorSha,
                 reviewDispatchedAt: pre?.reviewDispatchedAt,
+                passToken: pre?.passToken,
+                failToken: pre?.failToken,
             };
             const isTerminalAtClaim = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            const bumpRound = opts.bumpRound !== false;
+            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮
+            const bumpRound = opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review');
             // 回滚在锁内判定 pass 是否已被并发接管并返回；仅未被接管时才释放本次 acquire 的 QA，
             // 否则会误清接管方 re-acquire 的同一 QA 绑定（同 task 同 agent，绕过 release 的 mismatch 保护）
             const abortDispatch = async (dispatchToken) => {
@@ -5009,15 +6751,59 @@ export class AgentManager {
                     await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
             };
             let transitionToken;
+            let reviewAnchor;
             if (!isTerminalAtClaim) {
-                const reviewAnchor = await this.fetchPrHeadSha(taskId).catch(() => undefined);
-                const preDispatched = await this.transitionTaskStatus(taskId, 'review', { fromStatus: [taskStatusAtClaim] }, {
+                let gitDispatchBlocked;
+                const anchorViaDriver = async () => {
+                    const preTask = await this.taskStore.get(taskId);
+                    if (preTask?.prNumber === undefined) {
+                        gitDispatchBlocked = 'no bound PR';
+                        return undefined;
+                    }
+                    // 与收编/pr-fixed/merge 同一完整谓词：closed/draft/retarget 的 PR 派出去只会造出
+                    // 不可裁决的评审轮（spec §6 统一谓词）
+                    const verify = await this.platformVerifyPrBinding(taskId, preTask.prNumber);
+                    if (!verify.ok) {
+                        gitDispatchBlocked = `binding ${verify.reason}`;
+                        return undefined;
+                    }
+                    return PLATFORM_HEAD_SHA_RE.test(verify.headSha) ? verify.headSha : undefined;
+                };
+                const isGitDispatch = (await this.taskStore.get(taskId))?.reviewMode === 'git';
+                reviewAnchor = await (isGitDispatch ? anchorViaDriver() : this.fetchPrHeadSha(taskId))
+                    .catch(() => undefined);
+                if (isGitDispatch && reviewAnchor === undefined) {
+                    // 无锚评审轮不可裁决（verdictEligible 要求 anchorSha 且 pane verdict 已退役）：
+                    // 派出去只会卡死在 review，fail loud 让调用方看到确定性原因或重试瞬态失败
+                    const released = await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => false);
+                    if (!released) {
+                        // 预检失败叠加释放失败：QA 仍绑定会让下一次派发报 busy，必须显式暴露
+                        const blockedTask = await this.taskStore.get(taskId);
+                        await this.emitIntervention(blockedTask?.projectId ?? '', qaId, taskId, {
+                            phase: 'qa-release-failed-after-precheck',
+                            qaAgentId: qaId,
+                        }).catch(() => undefined);
+                    }
+                    if (devParked)
+                        await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
+                    throw gitDispatchBlocked !== undefined
+                        ? new ApiError(409, `Cannot dispatch git review for ${taskId}: ${gitDispatchBlocked}`)
+                        : new ApiError(502, `Cannot anchor the review round for ${taskId}: platform prView failed`);
+                }
+                const preDispatched = await this.transitionTaskStatus(taskId, 'review', {
+                    fromStatus: [taskStatusAtClaim],
+                    // 入口 claim 到此处之间 pass 可能被并发轮换；expect token 必须与写入同一原子段复核
+                    ...(opts.expectSignalToken !== undefined ? { expectSignalToken: opts.expectSignalToken } : {}),
+                }, {
                     reviewHeadAnchorSha: reviewAnchor,
                     reviewDispatchedAt: new Date().toISOString(),
                     signalToken: createSignalToken(),
+                    // pair/pending 与新轮锚点同一原子写可见（spec §7）：两写之间崩溃不得留下无 pending 的新轮
+                    ...(isGitDispatch ? { ...this.mintReviewTokenPair(), reviewDispatchPending: true } : {}),
                 });
                 if (!preDispatched) {
-                    await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => undefined);
+                    // fence 拒绝可能源于 successor 已换代并 re-acquire 同一 QA；释放必须钉在本次 acquire 的锁代上
+                    await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                     if (devParked)
                         await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
                     throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`);
@@ -5034,10 +6820,16 @@ export class AgentManager {
                 if (!isTerminalAtClaim && (fresh.status !== 'review' || fresh.signalToken !== transitionToken)) {
                     return { ok: false, reason: fresh.status !== 'review' ? `status=${fresh.status}` : 'pass superseded' };
                 }
+                // 并发 push 在 prView 读取与本提交之间前进 head 时，本次手动锚点已陈旧（TOCTOU）
+                if (fresh.reviewMode === 'git' && fresh.latestHeadSha !== undefined
+                    && reviewAnchor !== undefined && fresh.latestHeadSha !== reviewAnchor) {
+                    return { ok: false, reason: 'head advanced past the manual anchor' };
+                }
                 await this.taskStore.set({
                     ...fresh,
                     reviewRound: bumpRound ? fresh.reviewRound + 1 : fresh.reviewRound,
                     signalToken: armedToken,
+                    ...(fresh.reviewMode === 'git' ? { reviewDispatchPending: true } : {}),
                     updatedAt: new Date().toISOString(),
                 });
                 return { ok: true };
@@ -5047,7 +6839,11 @@ export class AgentManager {
                 await abortDispatch(transitionToken);
                 throw new ApiError(409, `Task ${taskId} left its review pass during dispatch (${claim2.reason})`);
             }
-            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken);
+            const dispatchTaskAfterClaim = await this.taskStore.get(taskId);
+            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken, dispatchTaskAfterClaim?.reviewMode === 'git' ? { replaceScope: 'agent' } : {});
+            if (armed && dispatchTaskAfterClaim?.reviewMode === 'git') {
+                await this.rearmGitReconciliationWatcher(taskId);
+            }
             if (!armed) {
                 await abortDispatch(armedToken);
                 throw new ApiError(500, `Failed to arm review verdict watcher for ${taskId}`);
@@ -5068,11 +6864,17 @@ export class AgentManager {
                 });
             }
             catch (err) {
-                if (await this.markAwaitingIfAckUnknown(qaId, err, taskId)) {
-                }
-                else if (err instanceof EnsureSessionError && err.partial.handled) {
+                if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
+                    // prompt 可能已注入：不回滚 armed pass、不释放 QA；hold 持久化失败也不得吞掉 ack_unknown 分类
+                    try {
+                        await this.markAwaitingIfAckUnknown(qaId, err, taskId);
+                    }
+                    catch (holdErr) {
+                        console.error(`[AgentManager] dispatchReviewToQa could not persist the ack_unknown hold for ${qaId}:`, holdErr);
+                    }
+                    throw err;
                 }
-                else {
+                if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                     await abortDispatch(armedToken);
                 }
                 throw err;
@@ -5081,6 +6883,7 @@ export class AgentManager {
                 await abortDispatch(armedToken);
                 throw new ApiError(500, `Failed to start QA review session for ${taskId}`);
             }
+            await this.clearReviewDispatchPending(taskId, armedToken);
             const final = await this.taskStore.get(taskId);
             return final;
         }
@@ -5245,6 +7048,9 @@ export class AgentManager {
                     qaAgentId: snapshot.qaAgentId,
                     signalToken: snapshot.signalToken,
                     reviewDispatchedAt: snapshot.reviewDispatchedAt,
+                    // 本代新铸的 pair 从未交付 QA：不随快照恢复会让旧 QA 的在途 verdict 被拒、新 pair 无人知
+                    passToken: snapshot.passToken,
+                    failToken: snapshot.failToken,
                     updatedAt: new Date().toISOString(),
                 };
             if (!isTerminalAtClaim && !drifted) {
@@ -5262,8 +7068,10 @@ export class AgentManager {
             return qaTakenOverInReview;
         }
         if (afterRollback?.status === 'approved') {
-            const completion = await this.postApproveStore.get(taskId);
-            const task = await this.taskStore.get(taskId);
+            const completion = afterRollback.reviewMode === 'git'
+                ? this.gitCompletionOf(afterRollback)
+                : await this.postApproveStore.get(taskId);
+            const task = afterRollback;
             if (completion && task) {
                 try {
                     await this.startPhaseSignalWatch({
@@ -5284,21 +7092,30 @@ export class AgentManager {
         const restored = await this.taskStore.get(taskId);
         if (!restored || !restored.signalToken)
             return qaTakenOverInReview;
-        const mapped = this.mapTaskStateToExpectedWatcher(restored);
-        if (!mapped)
+        const mappings = this.mapTaskStateToExpectedWatchers(restored);
+        if (mappings.length === 0)
             return qaTakenOverInReview;
+        for (const mapped of mappings) {
+            try {
+                await this.startPhaseSignalWatch({
+                    taskId,
+                    projectId: restored.projectId,
+                    agentId: mapped.agentId,
+                    expectedKinds: mapped.expectedKinds,
+                    token: mapped.token ?? restored.signalToken,
+                    ...(mappings.length > 1 ? { replaceScope: 'agent' } : {}),
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] rollback: re-establish ${mapped.expectedKinds.join(',')} failed for task=${taskId}:`, err);
+            }
+        }
+        // 回滚路径不得因 tearDown 探测失败上抛：那会顶替调用方本应抛出的 ApiError 并跳过 QA 释放
         try {
-            await this.startPhaseSignalWatch({
-                taskId,
-                projectId: restored.projectId,
-                agentId: mapped.agentId,
-                expectedKinds: mapped.expectedKinds,
-                token: restored.signalToken,
-            });
             await this.tearDownWatcherIfTaskTerminal(taskId);
         }
         catch (err) {
-            console.warn(`[AgentManager] rollback: re-establish ${mapped.expectedKinds.join(',')} failed for task=${taskId}:`, err);
+            console.warn(`[AgentManager] rollback: terminal watcher teardown failed for task=${taskId}:`, err);
         }
         return qaTakenOverInReview;
     }
@@ -5320,6 +7137,22 @@ export class AgentManager {
             return { phase: 'research', kinds: ['spec-done'] };
         return { phase: 'develop', kinds: this.devInitialSignalKinds(task.reviewMode) };
     }
+    mapTaskStateToExpectedWatchers(task) {
+        const single = this.mapTaskStateToExpectedWatcher(task);
+        const mappings = single ? [single] : [];
+        // review 窗口内 dev/QA 双条目并存：review 之外 dev 侧另有 pr-fixed/pr-merge-ready 同 agent
+        // 期望，(taskId, agentId) 基数无法同 agent 双 token 并存——错过窗口按 fail-closed 交人工（spec §5.3 ④）
+        if (task.reviewMode === 'git' && task.status === 'review'
+            && task.replyActorStatus !== 'verified' && task.pendingPrSignalToken !== undefined
+            && task.devAgentId && task.prNumber !== undefined) {
+            mappings.push({
+                expectedKinds: ['pr-created'],
+                agentId: task.devAgentId,
+                token: task.pendingPrSignalToken,
+            });
+        }
+        return mappings;
+    }
     mapTaskStateToExpectedWatcher(task) {
         if (task.reviewMode === 'server')
             return this.mapServerTaskToExpectedWatcher(task);
@@ -5372,7 +7205,10 @@ export class AgentManager {
         const task = await this.taskStore.get(taskId);
         if (!task?.signalToken)
             return false;
-        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, task.signalToken, opts.skipSnapshot);
+        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, opts.tokenOverride ?? task.signalToken, {
+            skipSnapshot: opts.skipSnapshot ?? false,
+            ...(opts.replaceScope ? { replaceScope: opts.replaceScope } : {}),
+        });
     }
     async emitManualReviewDevParkedQaFailedIntervention(agentId, expectedTaskId) {
         if (!agentId)
@@ -5479,6 +7315,17 @@ export class AgentManager {
         if (!project) {
             throw new Error(`mergePr: unknown project ${task.projectId}`);
         }
+        if (task.reviewMode === 'git') {
+            const expectedHeadSha = opts.matchHeadSha ?? task.latestHeadSha;
+            if (!expectedHeadSha)
+                throw new Error(`mergePr: no expected head sha for git task ${taskId}`);
+            // max_rounds 的 Mark complete 在调用前已被转成 merge-ready：override 必须显式随调用链传入
+            await this.platformConfirmMerge(taskId, {
+                expectedHeadSha,
+                ...(opts.humanOverride === true || task.status === 'max_rounds' ? { humanOverride: true } : {}),
+            });
+            return;
+        }
         const matchHead = opts.matchHeadSha
             ? ` --match-head-commit ${shellQuote(opts.matchHeadSha)}`
             : '';
@@ -5553,7 +7400,8 @@ export class AgentManager {
                 throw new ApiError(409, `Task ${taskId} changed status during mark-complete; aborted`);
             }
             try {
-                await this.mergePr(taskId);
+                // 从 max_rounds 认领而来：人工兜底 override 必须显式随调用链传入（此刻 status 已是 merge-ready）
+                await this.mergePr(taskId, { humanOverride: true });
             }
             catch (err) {
                 await this.transitionTaskStatus(taskId, 'max_rounds', { fromStatus: ['merge-ready'] })
@@ -5868,7 +7716,7 @@ export class AgentManager {
         }
         return publishDispatchedAt ? 'delivered' : false;
     }
-    async setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, skipSnapshot = false, onReadFile) {
+    async setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, opts = {}) {
         if (!this.phaseSignalWatcher)
             return true;
         const task = await this.taskStore.get(taskId);
@@ -5881,8 +7729,10 @@ export class AgentManager {
                 agentId,
                 expectedKinds,
                 token,
-                skipSnapshot,
-                ...(onReadFile ? { onReadFile } : {}),
+                skipSnapshot: opts.skipSnapshot ?? false,
+                ...(opts.onlyReplaceOwnToken ? { onlyReplaceOwnToken: true } : {}),
+                ...(opts.replaceScope ? { replaceScope: opts.replaceScope } : {}),
+                ...(opts.onReadFile ? { onReadFile: opts.onReadFile } : {}),
             });
         }
         catch (err) {
@@ -5891,7 +7741,10 @@ export class AgentManager {
         }
     }
     async armPostDispatchSignalOrHold(taskId, agentId, expectedKinds, token, skipSnapshot = false, onReadFile) {
-        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, skipSnapshot, onReadFile);
+        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
+            skipSnapshot,
+            ...(onReadFile ? { onReadFile } : {}),
+        });
         if (!armed)
             await this.holdAgentForUnarmedSignal(taskId, agentId, expectedKinds);
     }
@@ -5899,10 +7752,40 @@ export class AgentManager {
         const label = (Array.isArray(expectedKinds) ? [...expectedKinds] : [expectedKinds]).join(',');
         await this.markAwaitingHuman(agentId, `signal-arm-failed:${label}`, 'Pane-signal watcher failed to arm after dispatch; the prompt expects a signal with no consumer. Cancel the task or delete the agent to retry.', { expectedTaskId: taskId });
     }
+    // git 任务的初始 dev 派发把 pr-created 期望 token 独立持久化：评审轮轮换不得使 late
+    // publish 信号失去 reconciliation 凭据（spec §5.3 ④）。
+    dispatchTokenFields(task, signalToken) {
+        const wantsPrCreated = task.reviewMode === 'git'
+            && this.devInitialSignalKinds(task.reviewMode).includes('pr-created');
+        return { signalToken, ...(wantsPrCreated ? { pendingPrSignalToken: signalToken } : {}) };
+    }
+    // review 窗口内 QA verdict arm 之后重建 dev reconciliation 条目（spec §5.3 ④）：approval 路径的
+    // stop(taskId) 与 fix 轮的同键替换都会拆掉它，重入 review 时在此恢复；skipSnapshot=false 让仍在
+    // 面板滚动区的迟到信号立即重放。
+    async rearmGitReconciliationWatcher(taskId, opts = {}) {
+        const task = await this.taskStore.get(taskId);
+        if (!task || task.reviewMode !== 'git' || task.status !== 'review')
+            return;
+        if (task.replyActorStatus === 'verified' || task.pendingPrSignalToken === undefined)
+            return;
+        if (!task.devAgentId || task.prNumber === undefined)
+            return;
+        await this.setupPhaseSignalWatcher(taskId, task.devAgentId, ['pr-created'], task.pendingPrSignalToken, {
+            replaceScope: 'agent',
+            ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+        }).catch(() => false);
+    }
     async rotateAndSetupPhaseSignal(taskId, agentId, expectedKinds) {
         const newToken = createSignalToken();
+        const task = await this.taskStore.get(taskId);
+        const kinds = typeof expectedKinds === 'string' ? [expectedKinds] : [...expectedKinds];
+        const isGit = task?.reviewMode === 'git';
+        // pair 的重铸已随「进入 review 的 transition」单写落盘（spec §7 与新轮可见性原子）；
+        // 这里只轮换 signal token 并布防
         await this.updateTask(taskId, { signalToken: newToken });
-        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken);
+        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken, isGit ? { replaceScope: 'agent' } : {});
+        if (armed && isGit && kinds.includes('pr-approved'))
+            await this.rearmGitReconciliationWatcher(taskId);
         return { token: newToken, armed };
     }
     async rollbackVerdictArmFailure(taskId, restore, opts = {}) {
@@ -5922,6 +7805,9 @@ export class AgentManager {
                 signalToken: restore.signalToken,
                 reviewHeadAnchorSha: restore.reviewHeadAnchorSha,
                 reviewDispatchedAt: restore.reviewDispatchedAt,
+                ...(restore.restorePair === true
+                    ? { passToken: restore.passToken, failToken: restore.failToken }
+                    : {}),
                 updatedAt: new Date().toISOString(),
             });
             return true;
@@ -5939,10 +7825,16 @@ export class AgentManager {
             return;
         if (TERMINAL_STATUSES.includes(task.status))
             return;
-        const mapped = this.mapTaskStateToExpectedWatcher(task);
-        if (!mapped)
+        const mappings = this.mapTaskStateToExpectedWatchers(task);
+        if (mappings.length === 0)
             return;
-        await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds, opts.skipSnapshot ? { skipSnapshot: true } : undefined);
+        for (const mapped of mappings) {
+            await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds, {
+                ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+                ...(mappings.length > 1 ? { replaceScope: 'agent' } : {}),
+                ...(mapped.token !== undefined ? { tokenOverride: mapped.token } : {}),
+            });
+        }
         await this.tearDownWatcherIfTaskTerminal(taskId);
     }
     async parkTaskAtSpecReady(taskId, opts = {}) {
@@ -5980,8 +7872,9 @@ export class AgentManager {
             const fresh = await this.taskStore.get(taskId);
             if (!fresh)
                 throw new ApiError(404, `Task ${taskId} not found`);
-            if (fresh.status !== 'spec-ready') {
-                throw new ApiError(409, `Task ${taskId} is ${fresh.status}; spec verdict requires spec-ready`);
+            const specMaxRounds = fresh.status === 'max_rounds' && isSpecStagePhase(fresh.phase);
+            if (fresh.status !== 'spec-ready' && !specMaxRounds) {
+                throw new ApiError(409, `Task ${taskId} is ${fresh.status}; spec verdict requires spec-ready or spec-phase max_rounds`);
             }
             if (verdict === 'archive' && !fresh.researchAgentId) {
                 throw new ApiError(409, `Task ${taskId} is not a Research task; only Research specs can be archived`);
@@ -6016,7 +7909,7 @@ export class AgentManager {
                 ...base,
                 userDecision: { verdict, ...(trimmed ? { comments: trimmed } : {}), at },
             });
-            const transition = await this.transitionTaskStatus(taskId, 'done', { fromStatus: ['spec-ready'] });
+            const transition = await this.transitionTaskStatus(taskId, 'done', { fromStatus: ['spec-ready', 'max_rounds'] });
             if (!transition)
                 throw new ApiError(409, `Task ${taskId} changed while archiving`);
             this.stopPhaseSignalWatcher(taskId);
@@ -6042,18 +7935,40 @@ export class AgentManager {
         }
         if (verdict === 'approve') {
             await store.putRound(taskId, 'spec', { ...base, userDecision: { verdict, at } });
-            const result = await this.transitionToCodePhase(taskId);
+            let result;
+            try {
+                result = await this.transitionToCodePhase(taskId);
+            }
+            catch (err) {
+                if (err instanceof ApiError)
+                    throw err;
+                const message = err instanceof Error ? err.message : String(err);
+                const after = await this.taskStore.get(taskId);
+                if (after?.status === 'failed') {
+                    const reason = err instanceof DispatchTerminalError ? ` (${err.reason})` : '';
+                    throw new ApiError(500, `Code-phase dispatch failed terminally for task ${taskId}${reason}: ${message}. `
+                        + 'The task has been marked failed; use Retry to run it as a fresh task.');
+                }
+                if (after?.phase === 'code' && after.status === 'in_progress') {
+                    throw new ApiError(500, `Code-phase dispatch failed for task ${taskId}: ${message}. `
+                        + 'The task already moved to the code phase and the dev is held; '
+                        + 'Resume the dev agent to redeliver the prompt.');
+                }
+                throw new ApiError(500, `Code-phase dispatch failed for task ${taskId}: ${message}. `
+                    + 'The task was rolled back to await the verdict; fix the dev Workdir '
+                    + '(Resume the dev first if it is still held), then retry the verdict.');
+            }
             if (!result) {
+                const after = await this.taskStore.get(taskId);
+                if (after?.phase === 'code' && after.status === 'in_progress') {
+                    throw new ApiError(500, `Code-phase prompt was not delivered for task ${taskId}; the task already moved to the `
+                        + 'code phase and the dev is held. Resume the dev agent to redeliver the prompt '
+                        + '(retrying the verdict will be rejected).');
+                }
                 throw new ApiError(409, `Dev is unavailable for task ${taskId}; approval was recorded and can be retried`);
             }
             return result;
         }
-        // 打回消耗一轮修订；到达上限时拒绝而非派发注定进 max_rounds 的修订，让用户当场决策
-        const cap = this.getConfig().review.rounds + (task.maxRoundsContinues ?? 0);
-        if (round >= cap) {
-            throw new ApiError(409, `Task ${taskId} has reached the spec review round cap (${cap}); `
-                + 'approve the spec, or cancel the task and retry with a refined description');
-        }
         if (!trimmed)
             throw new ApiError(400, 'comments is required for request-changes');
         const priorFindings = base.findings?.findings ?? [];
@@ -6063,16 +7978,106 @@ export class AgentManager {
             verdict: 'request-changes',
             findings: [...priorFindings, { id: nextUserId, severity: 'major', message: trimmed }],
         };
-        await store.putRound(taskId, 'spec', {
+        const rejectedRound = {
             ...base,
             findings: mergedFindings,
             userDecision: { verdict, comments: trimmed, at },
-        });
-        const dispatched = await this.dispatchServerFixToDev(taskId, JSON.stringify(mergedFindings));
+        };
+        // 到达上限后用户仍显式打回 = 对「再评一轮」的当场决策：扩 cap 而非拒绝。
+        // holder 恢复与扩 cap 正交：max_rounds 入态时 holder 已被释放清空，即便 cap
+        // 因配置热更新出现余量，打回前也必须先恢复 holder
+        const cap = this.getConfig().review.rounds + (task.maxRoundsContinues ?? 0);
+        const claim = task.status === 'max_rounds' || round >= cap
+            ? await this.claimSpecFixDispatch(taskId, { extendCapToFit: round >= cap ? round : null })
+            : null;
+        let dispatched = null;
+        try {
+            await store.putRound(taskId, 'spec', rejectedRound);
+            dispatched = await this.dispatchServerFixToDev(taskId, JSON.stringify(mergedFindings));
+        }
+        catch (err) {
+            if (err instanceof ApiError)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            const after = await this.taskStore.get(taskId);
+            if (after?.status === 'failed') {
+                const reason = err instanceof DispatchTerminalError ? ` (${err.reason})` : '';
+                throw new ApiError(500, `Spec fix dispatch failed terminally for task ${taskId}${reason}: ${message}. `
+                    + 'The task has been marked failed with the rejection kept on record; '
+                    + 'use Retry to run it as a fresh task.');
+            }
+            if (after?.status === 'fixing') {
+                throw new ApiError(500, `Spec fix dispatch was interrupted for task ${taskId}: ${message}. `
+                    + 'The task moved to fixing with the rejection recorded; resume the holder agent to redeliver it.');
+            }
+            throw new ApiError(500, `Spec fix dispatch failed for task ${taskId}: ${message}. `
+                + 'The rejection was rolled back; fix the agent runtime or configuration, then retry.');
+        }
+        finally {
+            if (!dispatched)
+                await this.recoverSpecRejectionState(taskId, claim, base);
+        }
         if (!dispatched)
             throw new ApiError(500, `Failed to dispatch spec fix for task ${taskId}`);
         return dispatched;
     }
+    async claimSpecFixDispatch(taskId, opts) {
+        return await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh)
+                throw new ApiError(404, `Task ${taskId} not found`);
+            if (fresh.status !== 'spec-ready' && fresh.status !== 'max_rounds') {
+                throw new ApiError(409, `Task ${taskId} changed status during the spec verdict; aborted`);
+            }
+            const holder = fresh.agentId || fresh.researchAgentId || fresh.devAgentId;
+            if (!holder || !this.getAgentConfig(holder)) {
+                throw new ApiError(409, `Task ${taskId} spec holder agent ${holder || '(none)'} is not in the current config; `
+                    + 'restore the agent config or cancel the task');
+            }
+            const originalAgentId = fresh.agentId;
+            const originalCounter = fresh.maxRoundsContinues ?? 0;
+            let counterAfter = originalCounter;
+            if (opts.extendCapToFit !== null) {
+                // cap 必须容下下一轮（round+1）；rounds 被调低时一次 +1 可能不够
+                counterAfter = Math.max(originalCounter + 1, opts.extendCapToFit + 1 - this.getConfig().review.rounds);
+                fresh.maxRoundsContinues = counterAfter;
+            }
+            fresh.agentId = holder;
+            fresh.updatedAt = new Date().toISOString();
+            await this.taskStore.set(fresh);
+            return { originalAgentId, originalCounter, holderWritten: holder, counterAfter };
+        });
+    }
+    // 补偿以 claim 时的 status+counter+holder 为代际证明：任务已被推进（fixing/cancelled/新扩轮）
+    // 就放弃恢复——尤其派发把任务带进 held fixing 时，打回 round 必须保留给后续 Resume 重派
+    async recoverSpecRejectionState(taskId, claim, baseRound) {
+        const store = this.getReviewStore();
+        await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh)
+                return;
+            if (fresh.status !== 'spec-ready' && fresh.status !== 'max_rounds') {
+                console.warn(`[AgentManager] spec rejection recovery(${taskId}) skipped: task moved to ${fresh.status}`);
+                return;
+            }
+            if (claim) {
+                if ((fresh.maxRoundsContinues ?? 0) !== claim.counterAfter
+                    || fresh.agentId !== claim.holderWritten) {
+                    console.warn(`[AgentManager] spec rejection recovery(${taskId}) skipped: `
+                        + `continues=${fresh.maxRoundsContinues ?? 0} agentId=${fresh.agentId} `
+                        + `(expected ${claim.counterAfter}/${claim.holderWritten})`);
+                    return;
+                }
+                fresh.maxRoundsContinues = claim.originalCounter;
+                fresh.agentId = claim.originalAgentId;
+                fresh.updatedAt = new Date().toISOString();
+                await this.taskStore.set(fresh);
+            }
+            await store?.putRound(taskId, 'spec', baseRound);
+        }).catch(err => {
+            console.error(`[AgentManager] spec rejection recovery(${taskId}) failed:`, err);
+        });
+    }
     async submitCodeVerdict(taskId, comments) {
         const trimmed = comments?.trim();
         if (!trimmed) {
@@ -6235,6 +8240,7 @@ export class AgentManager {
         if (task.qaAgentId && !await releaseParticipant(task.qaAgentId, 'code-phase-qa-release-failed')) {
             return null;
         }
+        const devBoundBefore = (await this.agentStore.get(devAgentId))?.taskId === taskId;
         const acquired = await this.acquireAgentForTask(devAgentId, taskId, 'code');
         if (!acquired) {
             await this.emitIntervention(task.projectId, devAgentId, taskId, {
@@ -6243,8 +8249,10 @@ export class AgentManager {
             });
             return null;
         }
+        const acquiredLockToken = (await this.agentStore.get(devAgentId))?.lockToken;
         const newToken = createSignalToken();
-        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready'] }, { agentId: devAgentId, phase: 'code', signalToken: newToken });
+        // spec 阶段的扩轮决策不延续到 code 评审：cap 共享字段，进入编码时归零
+        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready', 'max_rounds'] }, { agentId: devAgentId, phase: 'code', maxRoundsContinues: 0, ...this.dispatchTokenFields({ ...task, phase: 'code' }, newToken) });
         if (!transition) {
             await this.releaseAgentForTask(devAgentId, taskId, 'idle', { allowAwaitingHuman: true })
                 .catch(() => undefined);
@@ -6259,6 +8267,33 @@ export class AgentManager {
             if (err instanceof DispatchTerminalError) {
                 await this.failTaskForDispatchError(taskId, 'code', devAgentId, err);
             }
+            else if (err instanceof EnsureSessionError && err.partial.handled
+                && (task.status === 'spec-ready' || task.status === 'max_rounds')) {
+                // dev 已被 checkout/dialog hold 且 prompt 未送达；resumeAgent 不重派这些 hold，
+                // 任务停在 in_progress 会同时封死 Resume 与 verdict——退回 verdict 门禁状态
+                const rolledBack = await this.transitionTaskStatus(taskId, task.status, { fromStatus: ['in_progress'] }, {
+                    ...(task.phase !== undefined ? { phase: task.phase } : {}),
+                    agentId: task.agentId,
+                    ...(task.signalToken ? { signalToken: task.signalToken } : {}),
+                    maxRoundsContinues: task.maxRoundsContinues ?? 0,
+                });
+                if (!rolledBack) {
+                    console.warn(`[AgentManager] transitionToCodePhase(${taskId}): handled dispatch failure but the task `
+                        + 'moved on; leaving its status as-is');
+                }
+                else if (!devBoundBefore) {
+                    // 转码前 dev 未持有本任务（如 research handoff / max_rounds 重占用）：任务已退回
+                    // verdict 门禁，释放本次新占用，否则 dev 会被回退后的任务永久占住
+                    const released = await this.releaseAgentForTask(devAgentId, taskId, 'idle', { allowAwaitingHuman: true })
+                        .catch(() => false);
+                    if (!released) {
+                        await this.emitIntervention(task.projectId, devAgentId, taskId, {
+                            phase: 'code-rollback-dev-release-failed',
+                            devAgentId,
+                        });
+                    }
+                }
+            }
             else if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                 await this.markAwaitingHuman(devAgentId, 'code-dispatch-failed', 'Code-phase prompt was not delivered after spec approval; the task looks in_progress but the dev never received it. Resume/restart the agent or cancel the task.', { expectedTaskId: taskId }).catch(() => undefined);
             }
@@ -6273,6 +8308,11 @@ export class AgentManager {
             });
             return null;
         }
+        // 重占用（released dev）的 acquire 会写 bootstrappingTaskId，而 continueSession 不做
+        // startSession 的 post-ack finalize；残留标记会让 recover 把已运行的任务按未送达回滚
+        if (!researchHandoff) {
+            await this.finalizeReplayedBootstrap(devAgentId, taskId, 'code', acquiredLockToken);
+        }
         return await this.taskStore.get(taskId);
     }
     async dispatchServerReviewToQa(taskId, opts) {
@@ -6415,7 +8455,11 @@ export class AgentManager {
             armBeforeInject: (ctx) => {
                 dispatchedCheckoutMode = ctx.serverReviewCheckout;
                 const allowReadFile = opts.phase === 'spec' || opts.continuation || ctx.serverReviewCheckout === 'base';
-                return this.setupPhaseSignalWatcher(taskId, qaId, expectedKind, newToken, false, allowReadFile ? (req) => { void this.handleReadFileRequest(taskId, qaId, req); } : undefined);
+                return this.setupPhaseSignalWatcher(taskId, qaId, expectedKind, newToken, {
+                    ...(allowReadFile
+                        ? { onReadFile: (req) => { void this.handleReadFileRequest(taskId, qaId, req); } }
+                        : {}),
+                });
             },
         };
         const rearmConsumedSignal = async () => {
@@ -6509,6 +8553,16 @@ export class AgentManager {
             const reviewedKind = taskPhase === 'spec' ? 'spec-reviewed' : 'code-reviewed';
             await this.setupPhaseSignal(taskId, qaAgentId, reviewedKind, { skipSnapshot: true });
         };
+        const devBoundBefore = (await this.agentStore.get(devAgentId))?.taskId === taskId;
+        const releaseFreshAcquire = async () => {
+            if (devBoundBefore)
+                return;
+            const released = await this.releaseAgentForTask(devAgentId, taskId, 'idle')
+                .catch(() => false);
+            if (!released) {
+                console.error(`[AgentManager] dispatchServerFixToDev: releasing freshly acquired dev ${devAgentId} for ${taskId} failed`);
+            }
+        };
         const acquired = await this.acquireAgentForTask(devAgentId, taskId, 'server-feedback');
         if (!acquired) {
             await rearmReviewedSignal();
@@ -6519,6 +8573,7 @@ export class AgentManager {
             const released = await this.releaseAgentIfBound(qaAgentId, taskId)
                 .catch(() => false);
             if (!released) {
+                await releaseFreshAcquire();
                 await rearmReviewedSignal();
                 await this.emitIntervention(projectId, qaAgentId, taskId, { phase: 'server-fix-qa-release-failed', qaAgentId });
                 return null;
@@ -6526,6 +8581,7 @@ export class AgentManager {
         }
         const transition = await this.transitionTaskStatus(taskId, 'fixing', { fromStatus: ['review', 'max_rounds', 'spec-ready', 'ready'] }, { signalToken: newToken, fixDispatchedAt: new Date().toISOString() });
         if (!transition) {
+            await releaseFreshAcquire();
             await this.emitIntervention(projectId, devAgentId, taskId, { phase: 'server-fix-transition-failed', devAgentId });
             return null;
         }
@@ -6875,6 +8931,38 @@ export class AgentManager {
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
+            if (err instanceof PlatformMergeRecheckError && task.reviewMode === 'git' && task.status === 'merge-ready') {
+                // 复核类失效（provenance 撤销/未 ack 反馈）没有「再 Confirm」的出路：退回 approved 置
+                // durable pending 重入 post-approve 闭环（计划 Task 8），把失效授权留在 gate 只剩 Cancel
+                const retreated = await this.withTaskLock(async () => {
+                    const fresh = await this.taskStore.get(task.id);
+                    if (!fresh || fresh.status !== 'merge-ready')
+                        return false;
+                    const approvedHead = typeof fresh.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(fresh.latestHeadSha)
+                        ? fresh.latestHeadSha
+                        : undefined;
+                    if (approvedHead === undefined)
+                        return false;
+                    await this.taskStore.set({
+                        ...fresh,
+                        status: 'approved',
+                        postApproveHeadSha: approvedHead,
+                        pendingRedispatch: true,
+                        updatedAt: new Date().toISOString(),
+                    });
+                    return true;
+                });
+                await this.emitIntervention(task.projectId, undefined, task.id, {
+                    phase: 'confirm-merge-recheck-failed',
+                    gate: task.status,
+                    error: message,
+                    retreated,
+                    note: retreated
+                        ? 'Accepted pass no longer verifies; task returned to approved for the post-approve loop to re-settle.'
+                        : 'Accepted pass no longer verifies and the task could not be returned automatically; inspect and re-dispatch.',
+                });
+                throw new ApiError(409, `Merge blocked for task ${task.id}: ${message}`);
+            }
             await this.emitIntervention(task.projectId, undefined, task.id, {
                 phase: 'confirm-merge-failed',
                 gate: task.status,