baxian 1.2.58 → 1.2.60

package/dist/agent/manager.js

@@ -4,7 +4,12 @@ import { join, normalize } from 'node:path';
 import { tmpdir } from 'node:os';
 import { createSignalToken } from './phase-signal.js';
 import { tmuxInstallHint } from './preflight.js';
-import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, TASK_OWNER_ROLES, isSpecStagePhase, isGitHubRepo, parseGitRemote, repoSlug, } from '../shared/index.js';
+import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, TASK_OWNER_ROLES, isSpecStagePhase, isGitHubRepo, parseGitRemote, repoIdentityKey, repoSlug, } from '../shared/index.js';
+import { buildProjectDriver, makeDriverExec } from '../platform/driver-host.js';
+import { DriverOpError } from '../platform/git-driver.js';
+import { checkOpenPrBinding } from '../platform/pr-binding.js';
+import { collectPendingFeedback, scanCommentSourcesOnce } from '../platform/feedback.js';
+import { recheckPassProvenance } from '../platform/verdict-engine.js';
 import { AGENT_STORE_NOOP } from '../state/agent-store.js';
 import { PostApproveStore } from '../state/post-approve-store.js';
 import { SkillRegistry } from '../skill/registry.js';
@@ -12,14 +17,16 @@ import { createRunner, LocalRunner, shellQuote, resolveAgentHost, hostGroupKey,
 import { GH_EXEC_TIMEOUT_MS, GIT_NET_ENV, execNetwork } from './net-exec.js';
 import { findForeignTaskTip } from './lineage.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
-import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, } from './tmux.js';
-import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError } from './branch.js';
-import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded } from './repo-store.js';
+import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, PaneGoneError, } from './tmux.js';
+import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError, isAutoDeletableTaskBranch } from './branch.js';
+import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded, canonicalSelfGuard } from './repo-store.js';
 import { PhaseSignalWatcher } from './phase-signal-watcher.js';
 import { ReviewTransport, resolveServerPayloads } from './review-transport.js';
 import { buildPromptInline, buildGreetingPrompt, PromptSizeError, RequiredSkillsMissingError, MAX_PROMPT_BYTES_ROUTE_LIMIT, } from './prompt.js';
 import { ApiError } from '../errors.js';
 import { prepareConfig } from '../config/loader.js';
+import { resolveProjectTool } from '../config/validator.js';
+import { SHA_HEX_SOURCE } from '../platform/types.js';
 export class EnsureSessionError extends Error {
     partial;
     constructor(partial, message) {
@@ -140,7 +147,28 @@ export function skillSubdirFor(runtime) {
 }
 const DEFAULT_DISPATCH_ACK_TIMEOUT_MS = 30_000;
 const DEFAULT_DISPATCH_SETTLE_TIMEOUT_MS = 3_000;
+// DELETE runtime cleanup runs while holding the deletion tombstone + rotated lock; an unbounded remote
+// probe/kill would block rollback/finally forever, so every tmux round-trip in it carries this deadline.
+const DELETE_CLEANUP_TIMEOUT_MS = 15_000;
 const GH_NET = { timeout: GH_EXEC_TIMEOUT_MS, retries: 1 };
+const PLATFORM_HEAD_SHA_RE = new RegExp(`^${SHA_HEX_SOURCE}$`);
+// 复核类失败（provenance/ack）与平台/瞬态失败分型：前者调用方退回 approved 重入闭环（计划 Task 8）
+export class PlatformCloseError extends Error {
+    step;
+    constructor(step, cause) {
+        super(`platform ${step} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.step = step;
+        this.name = 'PlatformCloseError';
+    }
+}
+export class PlatformMergeRecheckError extends Error {
+    reason;
+    constructor(reason) {
+        super(`merge blocked: ${reason}`);
+        this.reason = reason;
+        this.name = 'PlatformMergeRecheckError';
+    }
+}
 const MANUAL_SERVER_REVIEW_STATUSES = ['in_progress', 'review', 'fixing'];
 const IMAGE_DISPATCH_PHASES = new Set(['develop', 'research', 'code', 'fix', 'server-feedback']);
 const RUNTIME_LIVENESS_SAMPLES = 3;
@@ -204,6 +232,8 @@ export class AgentManager {
     repoCache;
     paneStreamerManager;
     postApproveStore;
+    pluginRegistry;
+    platformDriverExec;
     phaseSignalWatcher;
     errorRecordStore;
     reviewStore;
@@ -225,6 +255,9 @@ export class AgentManager {
     manualCompactWaitMs = 5_000;
     runtimeLivenessProbeMs = 700;
     cleanComposerWaitMs = 5_000;
+    readyStableSamples = 3;
+    readyStableSpacingMs = 1_000;
+    pendingDispatchRetryByTask = new Map();
     cancelInterruptGuardWaitMs = DEFAULT_DISPATCH_ACK_TIMEOUT_MS + 5_000;
     manualReviewInFlight = new Set();
     markCompleteInFlight = new Set();
@@ -233,6 +266,9 @@ export class AgentManager {
     // 引用计数：cancelTask 与 startCreatedTaskSession 的清理段可合法并存（启动期 Stop），先完成者不得清掉后者的 guard。
     cancelCleanupInFlight = new Map();
     deletionInFlight = new Set();
+    // Diverged ids live in a separate set the DELETE finally never clears: a post-commit replaceConfig throw must fail-stop for the whole process.
+    divergedAgents = new Set();
+    deletionGeneration = new Map();
     compactInFlight = new Set();
     constructor(deps) {
         const config = prepareConfig(deps.config);
@@ -246,6 +282,7 @@ export class AgentManager {
         this.repoStoreFactory = deps.repoStoreFactory;
         this.paneStreamerManager = deps.paneStreamerManager;
         this.postApproveStore = deps.postApproveStore ?? new PostApproveStore();
+        this.pluginRegistry = deps.pluginRegistry;
         this.errorRecordStore = deps.errorRecordStore;
         this.phaseSignalWatcher = deps.phaseSignalWatcher
             ?? (deps.paneStreamerManager
@@ -261,6 +298,7 @@ export class AgentManager {
         this.cancelInterruptGuardWaitMs = this.dispatchAckTimeoutMs + 5_000;
         this.agentIndex = buildAgentIndex(config);
         this.platformRunner = deps.platformRunner ?? new LocalRunner();
+        this.platformDriverExec = makeDriverExec(this.platformRunner);
         this.imageStagingRoot = deps.imageStagingRoot ?? join(tmpdir(), 'baxian-task-images');
         this.repoCache = createRepoStoreCache();
         this.bootstrapTimeoutsMs = {
@@ -426,14 +464,62 @@ export class AgentManager {
             this.deletionInFlight.add(id);
         return null;
     }
+    // Scan + claim share createTask/dispatchPendingTask's withTaskLock, so a delete can't pass an active-scan that a concurrent in_progress commit then orphans.
+    async scanActiveThenClaimDeletion(targets) {
+        return this.withTaskLock(async () => {
+            for (const id of targets) {
+                const state = await this.agentStore.get(id);
+                const task = state?.taskId ? await this.taskStore.get(state.taskId) : null;
+                if (task && ACTIVE_TASK_STATUSES.has(task.status)) {
+                    return { ok: false, code: 'active', agentId: id, taskId: task.id };
+                }
+                if (state?.status === 'awaiting_human')
+                    continue;
+                if (state?.creationToken)
+                    return { ok: false, code: 'bootstrapping', agentId: id };
+            }
+            const targetSet = new Set(targets);
+            const referencing = (await this.taskStore.list({})).find(t => ACTIVE_TASK_STATUSES.has(t.status)
+                && ((t.preferredAgentId !== '' && targetSet.has(t.preferredAgentId))
+                    || (!!t.agentId && targetSet.has(t.agentId))
+                    || (!!t.devAgentId && targetSet.has(t.devAgentId))
+                    || (!!t.qaAgentId && targetSet.has(t.qaAgentId))
+                    || (!!t.researchAgentId && targetSet.has(t.researchAgentId))));
+            if (referencing)
+                return { ok: false, code: 'referencing', taskId: referencing.id };
+            const conflict = this.tryClaimDeletion(targets);
+            if (conflict)
+                return { ok: false, code: 'already-deleting', agentId: conflict };
+            return { ok: true };
+        });
+    }
     releaseDeletionClaim(agentIds) {
         for (const id of agentIds)
             this.deletionInFlight.delete(id);
     }
+    // A completed DELETE keeps blocking this id past tombstone release; the process dies with any suspended flow, so no persistence is needed.
+    bumpDeletionGeneration(agentId) {
+        this.deletionGeneration.set(agentId, this.deletionGenerationOf(agentId) + 1);
+    }
+    deletionGenerationOf(agentId) {
+        return this.deletionGeneration.get(agentId) ?? 0;
+    }
+    // Boolean tombstone alone is ABA-prone (delete→recreate same id); commits must hold both the tombstone-clear and an unchanged generation from entry.
+    deletionGateOpen(agentId, genAtEntry) {
+        return !this.isDeletionInFlight(agentId) && this.deletionGenerationOf(agentId) === genAtEntry;
+    }
     isDeletionInFlight(agentId) {
-        return this.deletionInFlight.has(agentId);
+        return this.deletionInFlight.has(agentId) || this.divergedAgents.has(agentId);
+    }
+    // replaceConfig 抛错后的 fail-stop：进入 divergedAgents（不随 DELETE finally 释放），重建/分配持续被拒直到重启。
+    retainTombstoneForDivergence(agentId) {
+        this.divergedAgents.add(agentId);
     }
-    async ensureSession(agentId, mode) {
+    async ensureSession(agentId, mode, opts = {}) {
+        const genAtEntry = opts.expectedGeneration ?? this.deletionGenerationOf(agentId);
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `agent ${agentId} is being deleted (or was deleted and recreated); refusing session work`);
+        }
         const agent = this.getAgentConfig(agentId);
         if (!agent) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `Unknown agent: ${agentId}`);
@@ -444,48 +530,67 @@ export class AgentManager {
         }
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
+        // Side-effects run inside the lifecycle section (serialized with DELETE cleanup) behind a re-checked generation gate; the entry gate is only a fast-fail.
+        return this.runUnderSessionLifecycle(agentId, () => this.ensureSessionLocked(tmux, runner, agent, project, agentId, mode, genAtEntry));
+    }
+    async ensureSessionLocked(tmux, runner, agent, project, agentId, mode, genAtEntry) {
+        const assertGenerationOpen = () => {
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new EnsureSessionError({ createdSession: false, agentId }, `agent ${agentId} is being deleted (or was deleted and recreated); refusing session work`);
+            }
+        };
+        assertGenerationOpen();
         let workdir;
         try {
             const resolved = await this.ensureWorkdir(agent, project, runner);
             workdir = resolved.workdir;
-            await this.agentStore.update(agentId, (existing) => {
-                if (!existing)
-                    return AGENT_STORE_NOOP;
-                return {
-                    ...existing,
-                    workdir,
-                    updatedAt: new Date().toISOString(),
-                };
-            });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `ensureWorkdir failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // Gate the Workdir write too: a DELETE→recreate during the slow ensureWorkdir must not persist a stale Workdir onto the new incarnation.
+        assertGenerationOpen();
+        await this.agentStore.update(agentId, (existing) => {
+            if (!existing || !this.deletionGateOpen(agentId, genAtEntry))
+                return AGENT_STORE_NOOP;
+            return { ...existing, workdir, updatedAt: new Date().toISOString() };
+        });
+        assertGenerationOpen();
         try {
             await this.provisionRepoSkills(runner, agent, workdir);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `skill provisioning failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        let alive;
+        assertGenerationOpen();
+        let snapshot;
         try {
-            alive = await tmux.hasSession(agentId);
+            snapshot = await tmux.getSessionSnapshot(agentId);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `tmux probe failed: ${err instanceof Error ? err.message : String(err)}; ` +
                 `if tmux is missing, ${tmuxInstallHint(agent.projectId)}`);
         }
-        if (mode === 'create' && alive) {
-            const reclaimed = await this.runUnderSessionLifecycle(agentId, () => this.reclaimHalfCreatedSession(tmux, agentId));
-            if (!reclaimed) {
-                throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
-                    `it creates itself — kill it manually or pick a different agent id`);
+        // Re-gate after the probe await: a DELETE may have tombstoned mid-probe, and build/adopt would else create a session cleanup can only reap later.
+        assertGenerationOpen();
+        if (!snapshot) {
+            return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
+        }
+        if (snapshot.claim === null) {
+            if (await this.reclaimHalfCreatedSession(tmux, agentId, snapshot)) {
+                return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
             }
+            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
+                `it creates itself — kill it manually or pick a different agent id`);
         }
-        if (alive && (mode === 'runtime' || mode === 'recover')) {
-            return this.adoptOrRestartSession(tmux, runner, agent, agentId, workdir, workdir);
+        if (mode === 'create' || snapshot.claim !== agentId) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, mode === 'create'
+                ? `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
+                    `it creates itself — kill it manually or pick a different agent id`
+                : `tmux session "${agentId}" exists but @baxian-agent-id session claim mismatch ` +
+                    `(got "${snapshot.claim}"); baxian will not adopt foreign session — operator must intervene`);
         }
-        return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
+        return this.adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, workdir, snapshot);
     }
     async provisionRepoSkills(runner, agent, workdir) {
         if (this.skillRegistry.names().length === 0)
@@ -554,9 +659,10 @@ export class AgentManager {
                     return;
                 }
                 const runner = this.createRunnerFor(cfg);
-                const outcome = await new TmuxManager(runner).killSessionRef(ref);
-                if (outcome === 'stale-server') {
-                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): tmux server generation changed — leaving session ${ref.sessionId} untouched`);
+                // Rollback may run before or after the claim write, so accept empty-or-ours.
+                const outcome = await new TmuxManager(runner).killSessionRef(ref, { kind: 'emptyOr', claim: agentId });
+                if (outcome === 'refused') {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): tmux generation/claim changed — leaving session ${ref.sessionId} untouched`);
                 }
                 else if (outcome === 'killed') {
                     console.warn(`[AgentManager] ${agentId} rollback (${reason}): killed created session ${ref.sessionId}`);
@@ -603,7 +709,9 @@ export class AgentManager {
     async ensureSkillDirSafe(runner, workdir, subdir) {
         const top = subdir.split('/')[0];
         const keep = this.skillRegistry.names().map((n) => `! -name ${shellQuote(n)}`).join(' ');
-        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+        const inner = 
+        // canonicalSelfGuard (cd+pwd -P) rejects a rebound MIDDLE ancestor, not just a symlinked leaf, so the find/rm can't escape.
+        `${canonicalSelfGuard(workdir)} && ` +
             `cd ${shellQuote(workdir)} && ` +
             `for d in ${top} ${subdir}; do if [ -L "$d" ]; then ` +
             `printf 'baxian: %s is a symlink -> %s; replace it with a real directory\\n' "$d" "$(readlink "$d")" >&2; ` +
@@ -624,14 +732,16 @@ export class AgentManager {
             ['@baxian-skills-version', this.skillRegistry.contentHash()],
         ]);
     }
-    async replSkillsStale(tmux, agentId) {
+    async replSkillsStale(tmux, agentId, ref) {
         if (this.skillRegistry.names().length === 0)
             return false;
-        const tagged = await tmux.getOption(agentId, '@baxian-skills-version');
+        const tagged = await tmux.getSessionOptionByRef(ref, agentId, '@baxian-skills-version');
         return tagged !== this.skillRegistry.contentHash();
     }
     async excludeInjectedSkills(runner, workdir, subdir) {
-        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+        const inner = 
+        // canonicalSelfGuard (cd+pwd -P) rejects a rebound MIDDLE ancestor too, so the info/exclude write can't escape.
+        `${canonicalSelfGuard(workdir)} && ` +
             `cd ${shellQuote(workdir)} && ` +
             `if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then echo BX_SKILLS_NON_GIT; exit 0; fi; ` +
             `tracked="$(git ls-files -- ${shellQuote(`${subdir}/baxian-*`)} 2>/dev/null | head -5)"; ` +
@@ -664,12 +774,26 @@ export class AgentManager {
     }
     // A name (or even a bare $id) can rebind to a same-name successor mid-flight;
     // every option write goes through the identity-checked by-ref batch.
-    async setSessionOptions(tmux, agentId, ref, entries) {
-        const outcome = await tmux.setSessionOptionsIfAlive(ref, entries);
+    async setSessionOptions(tmux, agentId, ref, entries, expectedClaim = agentId) {
+        const outcome = await tmux.setSessionOptionsIfAlive(ref, entries, { expectedClaim });
         if (outcome === 'gone') {
             throw new Error(`tmux session ${ref.sessionId} (${agentId}) vanished before its options could be applied`);
         }
     }
+    // Snapshot's claim check is a filter; the returned PaneRef re-proves generation+claim on every op.
+    async resolveClaimedPane(tmux, agentId, expectedPaneId) {
+        const snapshot = await tmux.getSessionSnapshot(agentId);
+        if (!snapshot)
+            throw new PaneGoneError(agentId, 'no tmux session');
+        if (snapshot.claim !== agentId) {
+            throw new PaneGoneError(agentId, `session claim mismatch (got "${snapshot.claim ?? 'null'}")`);
+        }
+        const pane = await tmux.getSinglePaneByRef(snapshot.ref, agentId);
+        if (expectedPaneId !== undefined && pane.paneId !== expectedPaneId) {
+            throw new PaneGoneError(agentId, `pane id changed (state ${expectedPaneId} != live ${pane.paneId})`);
+        }
+        return pane;
+    }
     async buildFreshSession(tmux, agent, agentId, workdir, sessionDir = workdir) {
         return this.runUnderSkillDirLock(this.skillDirLockKey(agent, sessionDir), () => this.buildFreshSessionLocked(tmux, agent, agentId, workdir, sessionDir));
     }
@@ -681,6 +805,7 @@ export class AgentManager {
         try {
             createdRef = await tmux.createSession(agentId, sessionDir);
             createdSession = true;
+            // First batch writes the claim itself, so it must prove the session is still unclaimed.
             await this.setSessionOptions(tmux, agentId, createdRef, [
                 ['@baxian-agent-id', agentId],
                 ['@baxian-runtime', agent.runtime],
@@ -690,20 +815,21 @@ export class AgentManager {
                 ['window-size', 'latest'],
                 ...this.runtimePinEntries(),
                 ['status-right', ''],
-            ]);
+            ], '');
             await tmux.setServerOption('extended-keys', 'on');
             await tmux.appendServerOptionIfMissing('terminal-features', 'xterm*:extkeys');
-            const paneId = await tmux.getSinglePaneIdByRef(createdRef);
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            const pane = await tmux.getSinglePaneByRef(createdRef, agentId);
+            await tmux.sendKeysLiteral(pane, launchCommandIn(sessionDir, agent));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, createdRef);
-            return { ok: true, createdSession: true, freshRuntime: true, paneId, workdir, sessionRef: createdRef };
+            return { ok: true, createdSession: true, freshRuntime: true, paneId: pane.paneId, pane, workdir, sessionRef: createdRef };
         }
         catch (err) {
             const partial = { createdSession, agentId, genAtCreate };
@@ -726,7 +852,7 @@ export class AgentManager {
         }
         try {
             const result = await this.ensureSession(agentId, 'create');
-            if (!(await this.runGreetingHandshake(agentId, cfgAtStart, result.paneId))) {
+            if (!(await this.runGreetingHandshake(agentId, cfgAtStart, result.pane))) {
                 const current = await this.agentStore.get(agentId);
                 if (current && current.creationToken !== creationToken) {
                     console.warn(`[bootstrap] ${agentId} creationToken changed during greeting — leaving the session to its successor`);
@@ -787,7 +913,7 @@ export class AgentManager {
             await this.markBootstrapFailed(agentId, creationToken, message);
         }
     }
-    async runGreetingHandshake(agentId, agent, paneId) {
+    async runGreetingHandshake(agentId, agent, pane) {
         const watcher = this.phaseSignalWatcher;
         if (!watcher)
             return true;
@@ -795,7 +921,7 @@ export class AgentManager {
         for (let attempt = 1; attempt <= this.greetingMaxAttempts; attempt++) {
             const token = createSignalToken();
             try {
-                await this.injectAndAwaitAckSteps(tmux, paneId, buildGreetingPrompt(token, agent.runtime), agentId, agent.runtime);
+                await this.injectAndAwaitAckSteps(tmux, pane, buildGreetingPrompt(token, agent.runtime), agentId, agent.runtime);
             }
             catch (err) {
                 console.warn(`[bootstrap] greeting inject failed for ${agentId} (attempt ${attempt}):`, err);
@@ -814,7 +940,7 @@ export class AgentManager {
             console.warn(`[bootstrap] greeting attempt ${attempt}/${this.greetingMaxAttempts} for ${agentId}: ${outcome}`);
             if (outcome === 'no-agent')
                 break;
-            if (attempt < this.greetingMaxAttempts && !(await this.clearComposerForReuse(tmux, paneId, agentId))) {
+            if (attempt < this.greetingMaxAttempts && !(await this.clearComposerForReuse(tmux, pane, agentId))) {
                 break;
             }
         }
@@ -856,21 +982,25 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             return false;
+        // Pin the incarnation before reading state so a DELETE→recreate reusing %0 can't route the greeting handshake to the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         if (state?.awaitingPhase !== 'greeting_failed')
             return false;
         const guardSince = state.awaitingSince;
-        let paneId = state.paneId;
-        if (!paneId) {
-            try {
-                paneId = await new TmuxManager(this.createRunnerFor(agent)).getSinglePaneId(agentId);
-            }
-            catch (err) {
-                console.warn(`[regreet] cannot resolve pane for ${agentId}:`, err);
-                return true;
-            }
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return false;
+        let pane;
+        try {
+            pane = await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(agent)), agentId, state.paneId);
+        }
+        catch (err) {
+            console.warn(`[regreet] cannot resolve pane for ${agentId}:`, err);
+            return true;
         }
-        if (!(await this.runGreetingHandshake(agentId, agent, paneId))) {
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return false;
+        if (!(await this.runGreetingHandshake(agentId, agent, pane))) {
             return true;
         }
         await this.agentStore.update(agentId, (fresh) => {
@@ -907,8 +1037,7 @@ export class AgentManager {
         let paneId = existing.paneId;
         if (cfg && !paneId) {
             try {
-                const runner = this.createRunnerFor(cfg);
-                paneId = await new TmuxManager(runner).getSinglePaneId(agentId);
+                paneId = (await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), agentId)).paneId;
             }
             catch {
             }
@@ -985,8 +1114,10 @@ export class AgentManager {
         if (!(err instanceof EnsureSessionError) || !err.partial.dialogPending) {
             return false;
         }
+        // The error belongs to the caller's incarnation; gate every side-effect so a DELETE→recreate reusing %0 can't write the stale dialog/fail onto the new agent.
+        const gateOpen = () => opts.expectedGeneration === undefined || this.deletionGateOpen(agentId, opts.expectedGeneration);
         let state = await this.agentStore.get(agentId);
-        if (!state)
+        if (!state || !gateOpen())
             return false;
         if (state.paneId === undefined && err.partial.createdSession) {
             const cfg = this.getAgentConfig(agentId);
@@ -994,8 +1125,7 @@ export class AgentManager {
                 return false;
             let discoveredPaneId;
             try {
-                const runner = this.createRunnerFor(cfg);
-                discoveredPaneId = await new TmuxManager(runner).getSinglePaneId(agentId);
+                discoveredPaneId = (await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), agentId)).paneId;
             }
             catch (probeErr) {
                 console.warn(`[AgentManager] handleDialogPendingFromRuntime: tmux probe paneId failed for ${agentId}:`, probeErr);
@@ -1005,7 +1135,7 @@ export class AgentManager {
                 return false;
             const probeNow = new Date().toISOString();
             await this.agentStore.update(agentId, (fresh) => {
-                if (!fresh)
+                if (!fresh || !gateOpen())
                     return AGENT_STORE_NOOP;
                 if (fresh.paneId !== undefined)
                     return AGENT_STORE_NOOP;
@@ -1019,6 +1149,8 @@ export class AgentManager {
             console.warn(`[AgentManager] handleDialogPendingFromRuntime: ${agentId} has no paneId/taskId snapshot (no generation guard); refusing — caller should rollback`);
             return false;
         }
+        if (!gateOpen())
+            return false;
         await this.markDialogPending(agentId, undefined, {
             runtimePath: true,
             ...(state.paneId !== undefined ? { expectedPaneId: state.paneId } : {}),
@@ -1088,15 +1220,16 @@ export class AgentManager {
                 return;
             if (generationMismatch(state))
                 return;
-            let paneId;
+            let pane;
             try {
-                paneId = await tmux.getSinglePaneId(agentId);
+                pane = await this.resolveClaimedPane(tmux, agentId);
             }
             catch {
                 continue;
             }
+            const paneId = pane.paneId;
             try {
-                await tmux.waitReplReady(paneId, runtime, {
+                await tmux.waitReplReady(pane, runtime, {
                     timeoutMs: 1_000,
                     intervalMs: 200,
                     scrollback: 0,
@@ -1114,7 +1247,7 @@ export class AgentManager {
             let projectIdForEmit = '';
             let wrote = false;
             const isBootstrapPath = creationToken !== undefined;
-            if (isBootstrapPath && !(await this.runGreetingHandshake(agentId, cfg, paneId))) {
+            if (isBootstrapPath && !(await this.runGreetingHandshake(agentId, cfg, pane))) {
                 await this.markGreetingFailed(agentId, creationToken);
                 return;
             }
@@ -1209,7 +1342,8 @@ export class AgentManager {
                 continue;
             let stripped;
             try {
-                stripped = await tmux.capturePaneById(state.paneId, { ansi: false, scrollback: 0 });
+                const pane = await this.resolveClaimedPane(tmux, agentId, state.paneId);
+                stripped = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
             }
             catch {
                 continue;
@@ -1250,29 +1384,9 @@ export class AgentManager {
             signal.addEventListener('abort', onAbort, { once: true });
         });
     }
-    // Claim snapshot and adoption declaration share one critical section with rollbacks.
-    async adoptOrRestartSession(tmux, runner, agent, agentId, workdir, sessionDir) {
-        return this.runUnderSessionLifecycle(agentId, () => this.adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir));
-    }
-    async adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir) {
-        let snapshot;
-        try {
-            snapshot = await tmux.getSessionSnapshot(agentId);
-        }
-        catch (err) {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `session snapshot failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        if (!snapshot) {
-            return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
-        }
+    // Runs inside the caller's lifecycle section (ensureSessionLocked routed the snapshot here).
+    async adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir, snapshot) {
         const sessionRef = snapshot.ref;
-        if (snapshot.claim !== agentId) {
-            if (snapshot.claim === null && await this.reclaimHalfCreatedSession(tmux, agentId, snapshot)) {
-                return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
-            }
-            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" exists but @baxian-agent-id session claim mismatch ` +
-                `(got "${snapshot.claim ?? 'null'}"); baxian will not adopt foreign session — operator must intervene`);
-        }
         this.adoptGeneration.set(agentId, (this.adoptGeneration.get(agentId) ?? 0) + 1);
         try {
             await this.setSessionOptions(tmux, agentId, sessionRef, this.runtimePinEntries());
@@ -1280,24 +1394,25 @@ export class AgentManager {
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `pinning runtime session options failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        let paneId;
+        let pane;
         try {
-            paneId = await tmux.getSinglePaneIdByRef(sessionRef);
+            pane = await tmux.getSinglePaneByRef(sessionRef, agentId);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `getSinglePaneId failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        const paneId = pane.paneId;
         const runtime = agentRuntimeKindFor(agent);
         let state;
         try {
-            state = await tmux.classifyPaneForAdopt(paneId, runtime);
+            state = await tmux.classifyPaneForAdopt(pane, runtime);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `classifyPaneForAdopt failed: ${err instanceof Error ? err.message : String(err)}`);
         }
         let currentPath;
         try {
-            currentPath = await tmux.getPaneCurrentPath(paneId);
+            currentPath = await tmux.getPaneCurrentPath(pane);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `pane current path probe failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1312,7 +1427,7 @@ export class AgentManager {
         if (!pathMatches) {
             if (state.kind === 'live-runtime') {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, agent.runtime, this.cleanComposerWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, agent.runtime, this.cleanComposerWaitMs);
                 }
                 catch (err) {
                     throw new EnsureSessionError({ createdSession: false, agentId }, `Workdir change requires an idle runtime: ${err instanceof Error ? err.message : String(err)}`);
@@ -1329,7 +1444,7 @@ export class AgentManager {
             case 'live-runtime': {
                 let stale;
                 try {
-                    stale = await this.replSkillsStale(tmux, agentId);
+                    stale = await this.replSkillsStale(tmux, agentId, sessionRef);
                 }
                 catch (err) {
                     throw new EnsureSessionError({ createdSession: false, agentId }, `skills-version probe failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1341,11 +1456,12 @@ export class AgentManager {
                         freshRuntime: false,
                         skillsStale: true,
                         paneId,
+                        pane,
                         workdir,
                         sessionRef,
                     };
                 }
-                return { ok: true, createdSession: false, freshRuntime: false, paneId, workdir, sessionRef };
+                return { ok: true, createdSession: false, freshRuntime: false, paneId, pane, workdir, sessionRef };
             }
             case 'startup-dialog':
                 throw new EnsureSessionError({
@@ -1360,15 +1476,15 @@ export class AgentManager {
                     `must reset the pane manually`);
             case 'trust-dialog':
                 try {
-                    await tmux.handleTrustDialog(paneId, runtime, {
+                    await tmux.handleTrustDialog(pane, runtime, {
                         timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
                     });
-                    await tmux.waitReplReady(paneId, runtime, {
+                    await tmux.waitReplReady(pane, runtime, {
                         timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                         scrollback: 0,
                     });
                     await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
-                    return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
+                    return { ok: true, createdSession: false, freshRuntime: true, paneId, pane, workdir, sessionRef };
                 }
                 catch (trustErr) {
                     if (trustErr instanceof ReplNotReadyError && detectStartupDialog(trustErr.lastScreen, runtime)) {
@@ -1386,16 +1502,17 @@ export class AgentManager {
                 break;
         }
         try {
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            await tmux.sendKeysLiteral(pane, launchCommandIn(sessionDir, agent));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
-            return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
+            return { ok: true, createdSession: false, freshRuntime: true, paneId, pane, workdir, sessionRef };
         }
         catch (relErr) {
             if (relErr instanceof ReplNotReadyError && detectStartupDialog(relErr.lastScreen, runtime)) {
@@ -1435,12 +1552,12 @@ export class AgentManager {
         let outcome;
         try {
             // claim-still-empty rides the kill itself — a claim racing the probes makes the server refuse.
-            outcome = await tmux.killSessionRef(snapshot.ref, { onlyIfUnclaimed: true });
+            outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'unclaimed' });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (half-created leftover) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (outcome === 'refused' || outcome === 'stale-server') {
+        if (outcome === 'refused') {
             throw new EnsureSessionError({ createdSession: false, agentId }, `session ${snapshot.ref.sessionId} was claimed (or its server changed) while reclaiming the half-created leftover — retry to observe the new state`);
         }
         if (outcome === 'killed') {
@@ -1454,13 +1571,13 @@ export class AgentManager {
     async killAdoptTarget(tmux, agentId, sessionRef, reason) {
         let outcome;
         try {
-            outcome = await tmux.killSessionRef(sessionRef);
+            outcome = await tmux.killSessionRef(sessionRef, { kind: 'equals', claim: agentId });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (${reason}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (outcome === 'stale-server') {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux server generation changed while replacing session (${reason}); retry to observe the new state`);
+        if (outcome === 'refused') {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux generation/claim changed while replacing session (${reason}); retry to observe the new state`);
         }
         if (outcome === 'killed') {
             console.warn(`[AgentManager] ${agentId}: killed session ${sessionRef.sessionId} (${reason})`);
@@ -1469,7 +1586,17 @@ export class AgentManager {
             console.warn(`[AgentManager] ${agentId}: session ${sessionRef.sessionId} already gone (${reason})`);
         }
     }
-    async acquireAgentForTask(agentId, taskId, phase) {
+    // Create-on-null only under this predicate (evaluated inside the store's serialized commit): closes the delete→recreate ABA yet keeps lazy first-allocation for config-only agents.
+    bindingInitPredicate(agentId, genAtEntry) {
+        return this.deletionGateOpen(agentId, genAtEntry) && this.getAgentConfig(agentId) !== undefined;
+    }
+    async acquireAgentForTask(agentId, taskId, phase, 
+    // 锁代必须由 acquire 原子交出：事后重读 claim/binding 的窗口里并发派发方可以
+    // release + re-acquire 同一 agent/同一 task，读到的会是 successor 的代
+    opts = {}) {
+        const genAtEntry = this.deletionGenerationOf(agentId);
+        if (this.isDeletionInFlight(agentId))
+            return false;
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`Unknown agent: ${agentId}`);
@@ -1493,16 +1620,45 @@ export class AgentManager {
         const token = reuseLock ? existingToken : await this.lockManager.acquire(agentId, taskId);
         if (!token)
             return false;
+        const releaseAcquired = async (originalErr) => {
+            if (reuseLock)
+                return;
+            try {
+                await this.lockManager.releaseIfOwner(agentId, taskId, token);
+            }
+            catch (releaseErr) {
+                console.warn(`[AgentManager] acquireAgentForTask(${agentId}, ${taskId}): lock release after ` +
+                    `${originalErr === undefined ? 'refused commit' : 'commit failure'} itself failed:`, releaseErr);
+            }
+        };
         const now = new Date().toISOString();
-        await this.agentStore.update(agentId, (existing) => ({
-            ...(existing ?? { id: agentId, projectId: cfg.projectId, updatedAt: now }),
-            id: agentId,
-            projectId: cfg.projectId,
-            taskId,
-            lockToken: token,
-            ...(phase === 'code' && !sameTaskReentry ? { bootstrappingTaskId: taskId } : {}),
-            updatedAt: now,
-        }));
+        let commit;
+        try {
+            commit = await this.agentStore.update(agentId, (existing) => {
+                if (existing === null && !this.bindingInitPredicate(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
+                if (!this.deletionGateOpen(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
+                return {
+                    ...(existing ?? { id: agentId, projectId: cfg.projectId, updatedAt: now }),
+                    id: agentId,
+                    projectId: cfg.projectId,
+                    taskId,
+                    lockToken: token,
+                    ...(phase === 'code' && !sameTaskReentry ? { bootstrappingTaskId: taskId } : {}),
+                    updatedAt: now,
+                };
+            });
+        }
+        catch (err) {
+            await releaseAcquired(err);
+            throw err;
+        }
+        if (commit !== 'committed') {
+            await releaseAcquired();
+            return false;
+        }
+        opts.onAcquired?.(token);
         return true;
     }
     async releaseAgentForTask(agentId, expectedTaskId, mode, opts = {}) {
@@ -1662,7 +1818,7 @@ export class AgentManager {
                         return hold(runtime.reason);
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
                     if (runtime.kind === 'pane') {
-                        if (state.paneId !== runtime.paneId) {
+                        if (state.paneId !== runtime.pane.paneId) {
                             await this.agentStore.update(agentId, (latest) => {
                                 if (!latest
                                     || latest.taskId !== expectedTaskId
@@ -1670,14 +1826,14 @@ export class AgentManager {
                                     || latest.workdir !== releaseWorkdir) {
                                     return AGENT_STORE_NOOP;
                                 }
-                                return { ...latest, paneId: runtime.paneId, updatedAt: new Date().toISOString() };
+                                return { ...latest, paneId: runtime.pane.paneId, updatedAt: new Date().toISOString() };
                             });
                             const refreshed = await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
-                            if (refreshed.paneId !== runtime.paneId) {
+                            if (refreshed.paneId !== runtime.pane.paneId) {
                                 throw new Error(`Agent ${agentId} runtime pane changed during release; operation aborted`);
                             }
                         }
-                        await this.waitForReplPromptReady(tmux, runtime.paneId, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
+                        await this.waitForReplPromptReady(tmux, runtime.pane, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
                     }
                     else {
                         sessionConfirmedAbsent = true;
@@ -1755,6 +1911,14 @@ export class AgentManager {
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
                 }
                 catch (err) {
+                    // REPL 忙碌不是清理失败：pane 完好、绑定未动、非 dev 无分支凭据可留。落
+                    // branch-cleanup-pending（不在可恢复白名单）会把常态忙碌变成永久 hold（#558 验收 1），
+                    // 故拒绝释放而不落 hold，由调用方按「仍绑定且未 hold」判定重新排队本 pass
+                    if (opts.deferWhenBusy && err instanceof ReplNotReadyError && cfg.role !== 'dev') {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} REPL is busy; refusing release without a hold ` +
+                            `(the pass can be re-queued): ${err.message}`);
+                        return false;
+                    }
                     const reason = err instanceof DirtyWorkdirError
                         ? err.message
                         : `checkout cleanup failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -1880,6 +2044,8 @@ export class AgentManager {
             if (candidateTasks.length === 0)
                 continue;
             const candidateByBranch = new Map(candidateTasks.map(task => [task.branch, task]));
+            // Pin the incarnation before the first state/workdir/refs snapshot so a DELETE→same-id recreate (possibly a different workdir) in the read→gate window is rejected.
+            const genAtEntry = this.deletionGenerationOf(cfg.id);
             const state = await this.agentStore.get(cfg.id);
             if (!state || !canDispatchWithBinding(state))
                 continue;
@@ -1899,11 +2065,15 @@ export class AgentManager {
             }
             if (!refs.some(ref => candidateByBranch.has(ref.slice('refs/heads/'.length))))
                 continue;
+            if (this.isDeletionInFlight(cfg.id))
+                continue;
             const token = await this.lockManager.acquire(cfg.id, owner);
             if (!token)
                 continue;
             const cleanupResults = [];
             try {
+                if (!this.deletionGateOpen(cfg.id, genAtEntry))
+                    continue;
                 const lockedState = await this.agentStore.get(cfg.id);
                 if (!lockedState || !canDispatchWithBinding(lockedState))
                     continue;
@@ -1915,12 +2085,8 @@ export class AgentManager {
                     continue;
                 const tmux = new TmuxManager(runner);
                 if (await tmux.hasSession(cfg.id)) {
-                    const claim = await tmux.getOption(cfg.id, '@baxian-agent-id');
-                    if (claim !== cfg.id) {
-                        throw new Error(`tmux session claim mismatch for ${cfg.id}: ${claim ?? '<missing>'}`);
-                    }
-                    const paneId = lockedState.paneId ?? await tmux.getSinglePaneId(cfg.id);
-                    await this.waitForReplPromptReady(tmux, paneId, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
+                    const pane = await this.resolveClaimedPane(tmux, cfg.id, lockedState.paneId ?? undefined);
+                    await this.waitForReplPromptReady(tmux, pane, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
                 }
                 if (!(await this.lockManager.isOwner(cfg.id, owner, token)))
                     continue;
@@ -2369,10 +2535,18 @@ export class AgentManager {
         }
         if (result.redispatchReviewTaskId) {
             try {
+                const reviewTask = await this.taskStore.get(result.redispatchReviewTaskId);
+                const resumeEntry = this.getPendingDispatchRetry(result.redispatchReviewTaskId);
+                const resumeQaPhase = resumeEntry?.kind === 'qa-recheck'
+                    && resumeEntry.signalToken === reviewTask?.signalToken
+                    && resumeEntry.qaPhase !== undefined
+                    ? resumeEntry.qaPhase
+                    : (reviewTask?.reviewRound === 0 ? 'review' : undefined);
                 await this.dispatchReviewToQa(result.redispatchReviewTaskId, {
-                    bumpRound: false,
+                    bumpRound: reviewTask?.reviewRoundPending === true,
                     fromStatus: ['review'],
                     ...(result.reviewPassToken !== undefined ? { expectSignalToken: result.reviewPassToken } : {}),
+                    ...(resumeQaPhase !== undefined ? { qaPhase: resumeQaPhase } : {}),
                 });
             }
             catch (err) {
@@ -2467,14 +2641,12 @@ export class AgentManager {
             ...(result.reason ? { reason: result.reason } : {}),
         };
     }
-    async resolvePaneId(state, cfg) {
-        if (state.paneId)
-            return state.paneId;
+    async resolveClaimedPaneOrNull(state, cfg) {
         try {
-            return await new TmuxManager(this.createRunnerFor(cfg)).getSinglePaneId(cfg.id);
+            return await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), cfg.id, state.paneId);
         }
         catch (err) {
-            console.warn(`[AgentManager] resolvePaneId: getSinglePaneId failed for ${cfg.id}:`, err);
+            console.warn(`[AgentManager] resolveClaimedPane failed for ${cfg.id}:`, err);
             return null;
         }
     }
@@ -2492,27 +2664,16 @@ export class AgentManager {
         }
         if (!sessionAlive)
             return { kind: 'absent' };
-        let claim;
-        try {
-            claim = await tmux.getOption(agentId, '@baxian-agent-id');
-        }
-        catch (err) {
-            return {
-                kind: 'hold',
-                reason: `Runtime session claim probe failed; refusing checkout cleanup: ` +
-                    `${err instanceof Error ? err.message : String(err)}`,
-            };
-        }
-        if (claim !== agentId) {
-            return {
-                kind: 'hold',
-                reason: `Runtime session claim mismatch (got "${claim ?? 'null'}"); refusing checkout cleanup`,
-            };
-        }
         try {
-            return { kind: 'pane', paneId: await tmux.getSinglePaneId(agentId) };
+            return { kind: 'pane', pane: await this.resolveClaimedPane(tmux, agentId) };
         }
         catch (err) {
+            if (err instanceof PaneGoneError) {
+                return {
+                    kind: 'hold',
+                    reason: `Runtime session claim probe/mismatch; refusing checkout cleanup: ${err.message}`,
+                };
+            }
             return {
                 kind: 'hold',
                 reason: `Runtime pane probe failed; refusing checkout cleanup: ` +
@@ -2521,9 +2682,10 @@ export class AgentManager {
         }
     }
     async interruptPaneAndWaitReady(state, cfg) {
-        const paneId = await this.resolvePaneId(state, cfg);
-        if (!paneId)
+        const pane = await this.resolveClaimedPaneOrNull(state, cfg);
+        if (!pane)
             return false;
+        const paneId = pane.paneId;
         const tmux = new TmuxManager(this.createRunnerFor(cfg));
         const runtime = agentRuntimeKindFor(cfg);
         if (!(await this.acquireCompactGuardWithin(cfg.id, this.cancelInterruptGuardWaitMs))) {
@@ -2534,43 +2696,44 @@ export class AgentManager {
         }
         try {
             try {
-                await tmux.sendKeysToPane(paneId, 'Escape');
+                await tmux.sendKeysToPane(pane, 'Escape');
                 await new Promise(r => setTimeout(r, 200));
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: send Escape failed for pane ${paneId}:`, err);
                 return false;
             }
-            if (await this.paneReachedReplReady(tmux, paneId, runtime, 10_000))
+            if (await this.paneReachedReplReady(tmux, pane, runtime, 10_000))
                 return true;
-            if (!(await this.paneRunsRuntime(tmux, paneId, runtime)))
+            if (!(await this.paneRunsRuntime(tmux, pane, runtime)))
                 return false;
-            if (await this.paneHasLiveTurn(tmux, paneId, runtime)) {
+            if (await this.paneHasLiveTurn(tmux, pane, runtime)) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: pane ${paneId} still running a turn after ESC; holding`);
                 return false;
             }
-            if (!(await this.paneRunsRuntime(tmux, paneId, runtime)))
+            if (!(await this.paneRunsRuntime(tmux, pane, runtime)))
                 return false;
             try {
-                await tmux.sendKeysToPane(paneId, 'C-c');
+                await tmux.sendKeysToPane(pane, 'C-c');
                 await new Promise(r => setTimeout(r, 200));
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: send C-c (composer clear) failed for pane ${paneId}:`, err);
                 return false;
             }
-            return this.paneReachedReplReady(tmux, paneId, runtime, this.cleanComposerWaitMs);
+            return this.paneReachedReplReady(tmux, pane, runtime, this.cleanComposerWaitMs);
         }
         finally {
             this.compactInFlight.delete(cfg.id);
         }
     }
-    async paneHasLiveTurn(tmux, paneId, runtime) {
+    async paneHasLiveTurn(tmux, pane, runtime) {
+        const paneId = pane.paneId;
         let first;
         let firstTitle;
         try {
-            first = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
-            firstTitle = await tmux.readPaneTitle(paneId);
+            first = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+            firstTitle = await tmux.readPaneTitle(pane);
         }
         catch (err) {
             console.warn(`[AgentManager] interruptPaneAndWaitReady: liveness capture failed for pane ${paneId}:`, err);
@@ -2581,8 +2744,8 @@ export class AgentManager {
             let frame;
             let title;
             try {
-                frame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
-                title = await tmux.readPaneTitle(paneId);
+                frame = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+                title = await tmux.readPaneTitle(pane);
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: liveness re-capture failed for pane ${paneId}:`, err);
@@ -2597,10 +2760,11 @@ export class AgentManager {
         }
         return false;
     }
-    async paneRunsRuntime(tmux, paneId, runtime) {
+    async paneRunsRuntime(tmux, pane, runtime) {
+        const paneId = pane.paneId;
         let proc;
         try {
-            proc = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            proc = await tmux.displayMessage(pane, '#{pane_current_command}');
         }
         catch (err) {
             console.warn(`[AgentManager] interruptPaneAndWaitReady: proc-title read failed for pane ${paneId}:`, err);
@@ -2612,9 +2776,10 @@ export class AgentManager {
         }
         return true;
     }
-    async paneReachedReplReady(tmux, paneId, runtime, timeoutMs) {
+    async paneReachedReplReady(tmux, pane, runtime, timeoutMs) {
+        const paneId = pane.paneId;
         try {
-            await tmux.waitReplReady(paneId, runtime, { timeoutMs, scrollback: 0, titleIdleFastPath: true });
+            await tmux.waitReplReady(pane, runtime, { timeoutMs, scrollback: 0, titleIdleFastPath: true });
             return true;
         }
         catch (err) {
@@ -2745,20 +2910,25 @@ export class AgentManager {
             }
         }
     }
-    async pollPaneCommandStable(tmux, paneId, opts) {
+    async pollPaneCommandStable(tmux, pane, opts) {
         const deadline = Date.now() + opts.timeoutMs;
         const SHELL = /^(?:zsh|bash|sh|fish)$/;
         let last = '';
         while (Date.now() < deadline) {
             await new Promise(r => setTimeout(r, 100));
-            const raw = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            const raw = await tmux.displayMessage(pane, '#{pane_current_command}');
             last = raw.trim();
             if (opts.expectShell ? SHELL.test(last) : last !== '')
                 return last;
         }
         return last;
     }
-    async restartReplOnly(agentId) {
+    async restartReplOnly(agentId, opts = {}) {
+        // Re-verify the entry generation so a request that slept across a DELETE→recreate can't restart the NEW incarnation's REPL (claim check alone can't tell).
+        const genAtEntry = opts.expectedGeneration ?? this.deletionGenerationOf(agentId);
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`Unknown agent: ${agentId}`);
@@ -2771,14 +2941,17 @@ export class AgentManager {
         if (snapshot.claim !== agentId) {
             throw new Error(`restart-repl: session claim mismatch (got "${snapshot.claim ?? 'null'}"); refusing to touch foreign session`);
         }
-        const paneId = await tmux.getSinglePaneIdByRef(snapshot.ref);
-        await tmux.sendKeysToPane(paneId, 'C-c');
-        const cmd = await this.pollPaneCommandStable(tmux, paneId, { timeoutMs: 2_000 });
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
+        const pane = await tmux.getSinglePaneByRef(snapshot.ref, agentId);
+        await tmux.sendKeysToPane(pane, 'C-c');
+        const cmd = await this.pollPaneCommandStable(tmux, pane, { timeoutMs: 2_000 });
         const RUNTIME = /^(?:claude|codex|node|opencode|qodercli(?:-[\d.]+)?|\d+\.\d+\.\d+)$/;
         const SHELL = /^(?:zsh|bash|sh|fish)$/;
         if (RUNTIME.test(cmd)) {
-            await tmux.sendKeysToPane(paneId, REPL_EXIT_COMMAND[cfg.runtime], 'Enter');
-            await this.pollPaneCommandStable(tmux, paneId, { timeoutMs: 2_000, expectShell: true });
+            await tmux.sendKeysToPane(pane, REPL_EXIT_COMMAND[cfg.runtime], 'Enter');
+            await this.pollPaneCommandStable(tmux, pane, { timeoutMs: 2_000, expectShell: true });
         }
         else if (!SHELL.test(cmd)) {
             throw new Error(`restart-repl precondition failed: unexpected pane state "${cmd}"`);
@@ -2786,33 +2959,42 @@ export class AgentManager {
         const project = this.getProjectConfig(cfg.projectId);
         if (!project)
             throw new Error(`restart-repl: project ${cfg.projectId} does not exist`);
+        // Re-verify before Workdir/skill/session-option side-effects: pane writes fail-closed on a stale PaneRef, but ensureWorkdir/skills would write old-cfg files under a recreated id.
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         const workdir = (await this.ensureWorkdir(cfg, project, runner)).workdir;
-        const paneWorkdir = await tmux.getPaneCurrentPath(paneId);
+        const paneWorkdir = await tmux.getPaneCurrentPath(pane);
         if (!await sameDirOnHost(runner, paneWorkdir, workdir)) {
             throw new Error(`restart-repl: pane Workdir ${paneWorkdir} does not match agent Workdir ${workdir}; ` +
                 'use retry to rebuild the session safely');
         }
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         await this.provisionRepoSkills(runner, cfg, workdir);
         await this.setSessionOptions(tmux, agentId, snapshot.ref, [[WORKDIR_SESSION_OPTION, workdir]]);
         const runtime = agentRuntimeKindFor(cfg);
         const relaunch = async () => {
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(workdir, cfg)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            await tmux.sendKeysLiteral(pane, launchCommandIn(workdir, cfg));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, snapshot.ref);
         };
         await this.runUnderSkillDirLock(this.skillDirLockKey(cfg, workdir), relaunch);
+        // Final writeback is generation-gated too, so a DELETE→recreate reusing %0 can't persist the old incarnation's paneId onto the new agent.
         await this.agentStore.update(agentId, (state) => {
-            if (!state)
+            if (!state || !this.deletionGateOpen(agentId, genAtEntry))
                 return AGENT_STORE_NOOP;
             return {
                 ...state,
-                paneId,
+                paneId: pane.paneId,
                 updatedAt: new Date().toISOString(),
             };
         });
@@ -2891,6 +3073,9 @@ export class AgentManager {
                     const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
                         skipSnapshot: true,
                         onlyReplaceOwnToken: true,
+                        // git 双 watcher 下 fence 只应比较自己的 (taskId, agentId) 条目：task 域会拿
+                        // sibling（reconciliation）的不同 token 否决本应合法的重布防
+                        ...(task.reviewMode === 'git' ? { replaceScope: 'agent' } : {}),
                     });
                     if (!armed) {
                         if (!(await stillCurrent()))
@@ -2907,6 +3092,8 @@ export class AgentManager {
             if (task.status === 'approved' && agent.role === 'dev') {
                 return await this.replayApprovedHolderAfterReplRestart(agentId, task, taskStillCurrent, fencedReplay, { clearEntryHold, holdReplayFailure });
             }
+            // reconciliation 条目不是 replay 目标：它没有对应的可重放 prompt，误选会以 QA 轮换 token
+            // 重注 dev 的 publish 提示（spec §5.3 ④ 只允许一次 actor 归位）
             const mapped = this.mapTaskStateToExpectedWatcher(task);
             if (!mapped || mapped.agentId !== agentId)
                 return false;
@@ -3106,6 +3293,9 @@ export class AgentManager {
                 await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
             throw err;
         }
+        if (resumed && task.reviewMode === 'git') {
+            await this.confirmPostApprovePromptDelivered(taskId, completion.token);
+        }
         if (!resumed && completion.rebuilt) {
             await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
             const fresh = await this.taskStore.get(taskId);
@@ -3142,6 +3332,19 @@ export class AgentManager {
                 || fresh.postApproveHeadSha !== approvedHeadSha) {
                 return false;
             }
+            if (fresh.reviewMode === 'git') {
+                if (fresh.postApproveToken !== undefined)
+                    return false;
+                // rebuild 与常规安装同一 installed→delivered 协议：写后崩溃由 sweep 按 pending 补派
+                await this.taskStore.set({
+                    ...fresh,
+                    postApproveToken: token,
+                    postApprovePhase: 'installed',
+                    pendingRedispatch: true,
+                    updatedAt: new Date().toISOString(),
+                });
+                return true;
+            }
             if (await this.postApproveStore.get(task.id))
                 return false;
             await this.postApproveStore.set(task.id, { token, approvedHeadSha });
@@ -3171,21 +3374,7 @@ export class AgentManager {
                 continue;
             const runner = this.createRunnerFor(cfg);
             const tmux = new TmuxManager(runner);
-            const boundState = await this.agentStore.get(id);
-            if (boundState?.taskId) {
-                try {
-                    const released = await this.releaseAgentForTask(id, boundState.taskId, 'idle', {
-                        allowAwaitingHuman: true,
-                    });
-                    if (!released) {
-                        throw new Error(`could not safely release task ${boundState.taskId}`);
-                    }
-                }
-                catch (err) {
-                    failures.push({ agentId: id, step: 'binding.release', error: err });
-                    continue;
-                }
-            }
+            // No releaseAgentForTask: the binding dies with the state file in phase 3, and deletability was already enforced by the phase-1 API gates — so cleanup only stops watchers and kills the session.
             this.stopRuntimeMenuWatch(id);
             if (this.paneStreamerManager) {
                 try {
@@ -3197,21 +3386,45 @@ export class AgentManager {
             }
             try {
                 await this.runUnderSessionLifecycle(id, async () => {
-                    const snapshot = await tmux.getSessionSnapshot(id);
+                    const cleanupOpts = { timeout: DELETE_CLEANUP_TIMEOUT_MS };
+                    const snapshot = await tmux.getSessionSnapshot(id, cleanupOpts);
                     if (!snapshot)
                         return;
-                    if (snapshot.claim !== id) {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping kill for ${id} ` +
-                            `(claim=${snapshot.claim ?? 'null'}; not baxian-managed)`);
+                    if (snapshot.claim === id) {
+                        const outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'equals', claim: id }, cleanupOpts);
+                        if (outcome === 'refused') {
+                            throw new Error(`tmux generation/claim changed for ${id} before kill; retry DELETE to observe new state`);
+                        }
+                        if (outcome === 'killed') {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed session ${snapshot.ref.sessionId} for removed agent ${id}`);
+                        }
                         return;
                     }
-                    const outcome = await tmux.killSessionRef(snapshot.ref);
-                    if (outcome === 'stale-server') {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: tmux server generation changed for ${id} — leaving session untouched`);
-                    }
-                    else if (outcome === 'killed') {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed session ${snapshot.ref.sessionId} for removed agent ${id}`);
+                    if (snapshot.claim === null) {
+                        // A nonce-owned unclaimed session is this project's own half-created leftover — reclaim it.
+                        let nonceOwned;
+                        try {
+                            nonceOwned = await tmux.hasCreationNonce(id, cleanupOpts);
+                        }
+                        catch (err) {
+                            throw new Error(`creation-nonce probe failed for ${id}; retry DELETE: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        if (!nonceOwned) {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping ${id} ` +
+                                `(unclaimed, no baxian creation nonce; foreign session)`);
+                            return;
+                        }
+                        const outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'unclaimed' }, cleanupOpts);
+                        if (outcome === 'refused') {
+                            throw new Error(`half-created session for ${id} was claimed or its server changed before kill; retry DELETE`);
+                        }
+                        if (outcome === 'killed') {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed half-created leftover ${snapshot.ref.sessionId} for removed agent ${id}`);
+                        }
+                        return;
                     }
+                    console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping kill for ${id} ` +
+                        `(claim=${snapshot.claim}; not baxian-managed)`);
                 });
             }
             catch (err) {
@@ -3292,6 +3505,17 @@ export class AgentManager {
     getProjectByRepo(repo) {
         return this.config.project.find(p => repoSlug(p.repo) === repo);
     }
+    getProjectByRepoIdentity(repoKey) {
+        return this.config.project.find(p => repoIdentityKey(p.repo) === repoKey);
+    }
+    platformDriverFor(projectId) {
+        if (!this.pluginRegistry)
+            return undefined;
+        const project = this.getProjectConfig(projectId);
+        if (!project)
+            return undefined;
+        return buildProjectDriver(project, this.pluginRegistry, this.platformDriverExec);
+    }
     findAgentGroup(anchorAgentId) {
         for (const project of this.config.project) {
             for (const group of project.agent) {
@@ -3327,8 +3551,28 @@ export class AgentManager {
         return this.agentStore.get(agentId);
     }
     async getPostApproveCompletion(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (task?.reviewMode === 'git')
+            return this.gitCompletionOf(task);
         return this.postApproveStore.get(taskId);
     }
+    // 'git' 的 completion 与效果字段同居 TaskState：consumedFeedback/pendingRedispatch 与
+    // token CAS 必须同一次持久化（spec §6 双写协议）；legacy github 沿 PostApproveStore 至 M3c。
+    gitCompletionOf(task) {
+        if (task.postApproveToken === undefined || task.postApproveHeadSha === undefined)
+            return null;
+        return {
+            token: task.postApproveToken,
+            approvedHeadSha: task.postApproveHeadSha,
+            updatedAt: task.updatedAt,
+            ...(task.redispatchCount !== undefined ? { redispatchCount: task.redispatchCount } : {}),
+            ...(task.pendingRedispatch !== undefined ? { pendingRedispatch: task.pendingRedispatch } : {}),
+        };
+    }
+    stripGitCompletionFields(task) {
+        const { postApproveToken: _t, pendingRedispatch: _p, redispatchCount: _r, postApprovePhase: _ph, ...rest } = task;
+        return rest;
+    }
     // Install CASes on the current approved episode; only a fresh human verdict (clearRevocation) unlocks a standing marker.
     async setPostApproveCompletion(taskId, value, opts = {}) {
         return this.withTaskLock(async () => {
@@ -3341,37 +3585,111 @@ export class AgentManager {
                 if (task.postApproveHeadSha !== undefined && task.postApproveHeadSha !== value.approvedHeadSha)
                     return false;
             }
-            await this.postApproveStore.set(taskId, value);
+            if (task?.reviewMode === 'git') {
+                const { postApproveRevoked: _revoked, ...rest } = task;
+                // 全量替换语义与 PostApproveStore.set 一致：未携带的 pending/redispatch 字段清空
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(opts.clearRevocation ? rest : task),
+                    postApproveToken: value.token,
+                    postApprovePhase: 'installed',
+                    ...(value.redispatchCount !== undefined ? { redispatchCount: value.redispatchCount } : {}),
+                    ...(value.pendingRedispatch !== undefined ? { pendingRedispatch: value.pendingRedispatch } : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+            }
+            else {
+                await this.postApproveStore.set(taskId, value);
+            }
             if (!task)
                 return true;
-            if (task.postApproveRevoked) {
+            if (task.postApproveRevoked && task.reviewMode !== 'git') {
                 const { postApproveRevoked: _revoked, ...rest } = task;
                 await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
             }
             if (!this.phaseSignalWatcher)
                 return true;
-            await this.startPhaseSignalWatch({
+            const armed = await this.startPhaseSignalWatch({
                 taskId,
                 projectId: task.projectId,
                 agentId: task.agentId,
                 expectedKinds: 'pr-merge-ready',
                 token: value.token,
             });
+            if (!armed) {
+                // completion 没有 consumer 就不算安装成功：撤销本次写，durable pending（若有）随原状保留
+                if (task.reviewMode === 'git') {
+                    await this.taskStore.set({ ...task, updatedAt: new Date().toISOString() });
+                }
+                else {
+                    await this.postApproveStore.clear(taskId);
+                }
+                return false;
+            }
             return true;
         });
     }
+    // post-approve prompt 的至少一次投递（spec §6）：pendingRedispatch 随 completion 安装保持 true，
+    // 仅在 continueSession 确认送达后清除——安装与投递之间的崩溃由恢复扫描按 pending 补派。
+    async confirmPostApprovePromptDelivered(taskId, token) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.postApproveToken !== token)
+                return;
+            await this.taskStore.set({
+                ...task,
+                pendingRedispatch: false,
+                postApprovePhase: 'delivered',
+                updatedAt: new Date().toISOString(),
+            });
+        });
+    }
+    async markPostApproveSignalReceived(taskId, token) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.postApproveToken !== token)
+                return;
+            if (task.postApprovePhase === 'signaled')
+                return;
+            await this.taskStore.set({ ...task, postApprovePhase: 'signaled', updatedAt: new Date().toISOString() });
+        });
+    }
     async clearPostApproveCompletion(taskId) {
         await this.withTaskLock(async () => {
-            await this.postApproveStore.clear(taskId);
+            const task = await this.taskStore.get(taskId);
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== undefined || task.pendingRedispatch !== undefined
+                    || task.redispatchCount !== undefined) {
+                    await this.taskStore.set({
+                        ...this.stripGitCompletionFields(task),
+                        updatedAt: new Date().toISOString(),
+                    });
+                }
+            }
+            else {
+                await this.postApproveStore.clear(taskId);
+            }
             this.phaseSignalWatcher?.stop(taskId);
         });
     }
     // CAS for an existing pass: never creates a record nor touches the marker, so it cannot resurrect a revoked completion.
-    async updatePostApproveCompletionIfToken(taskId, expectedToken, patch) {
+    async updatePostApproveCompletionIfToken(taskId, expectedToken, patch, opts = {}) {
         return this.withTaskLock(async () => {
             const task = await this.taskStore.get(taskId);
             if (task?.postApproveRevoked)
                 return false;
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== expectedToken)
+                    return false;
+                await this.taskStore.set({
+                    ...task,
+                    ...patch,
+                    ...(opts.consumeRevision
+                        ? { consumedFeedback: { ...task.consumedFeedback, [opts.consumeRevision.key]: opts.consumeRevision.versionTime } }
+                        : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+                return true;
+            }
             const current = await this.postApproveStore.get(taskId);
             if (!current || current.token !== expectedToken)
                 return false;
@@ -3391,9 +3709,24 @@ export class AgentManager {
                 && task.postApproveHeadSha !== opts.expectedHeadSha)
                 return false;
             if (opts.expectedToken !== undefined) {
-                const current = await this.postApproveStore.get(taskId);
-                if (current?.token !== opts.expectedToken)
-                    return false;
+                if (task.reviewMode === 'git') {
+                    if (task.postApproveToken !== opts.expectedToken)
+                        return false;
+                }
+                else {
+                    const current = await this.postApproveStore.get(taskId);
+                    if (current?.token !== opts.expectedToken)
+                        return false;
+                }
+            }
+            if (task.reviewMode === 'git') {
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(task),
+                    postApproveRevoked: { reason, at: new Date().toISOString() },
+                    updatedAt: new Date().toISOString(),
+                });
+                this.phaseSignalWatcher?.stop(taskId);
+                return true;
             }
             // Marker lands first: a crash before the clear leaves marker+completion, which every consumer fences on.
             await this.taskStore.set({
@@ -3408,6 +3741,17 @@ export class AgentManager {
     }
     async clearPostApproveCompletionIfMatches(taskId, token) {
         return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (task?.reviewMode === 'git') {
+                if (task.postApproveToken !== token)
+                    return false;
+                await this.taskStore.set({
+                    ...this.stripGitCompletionFields(task),
+                    updatedAt: new Date().toISOString(),
+                });
+                this.phaseSignalWatcher?.stop(taskId);
+                return true;
+            }
             const cleared = await this.postApproveStore.clearIfMatches(taskId, token);
             if (cleared)
                 this.phaseSignalWatcher?.stop(taskId);
@@ -3421,7 +3765,9 @@ export class AgentManager {
             if (!task || task.status !== 'approved' || task.postApproveRevoked) {
                 return { refused: 'stale' };
             }
-            const completion = await this.postApproveStore.get(taskId);
+            const completion = task.reviewMode === 'git'
+                ? this.gitCompletionOf(task)
+                : await this.postApproveStore.get(taskId);
             if (!completion
                 || completion.token !== expectedToken
                 || task.postApproveHeadSha === undefined
@@ -3430,16 +3776,339 @@ export class AgentManager {
             }
             if (completion.pendingRedispatch)
                 return { refused: 'pending' };
-            delete task.postApproveHeadSha;
-            Object.assign(task, {
+            const next = task.reviewMode === 'git' ? this.stripGitCompletionFields(task) : task;
+            delete next.postApproveHeadSha;
+            Object.assign(next, {
                 status: 'merge-ready',
                 latestHeadSha: completion.approvedHeadSha,
                 updatedAt: new Date().toISOString(),
             });
-            await this.taskStore.set(task);
-            await this.postApproveStore.clear(taskId);
+            await this.taskStore.set(next);
+            if (task.reviewMode !== 'git')
+                await this.postApproveStore.clear(taskId);
             this.phaseSignalWatcher?.stop(taskId);
-            return { task };
+            return { task: next };
+        });
+    }
+    // 修剪顺序单向（spec §6）：仅在对应源 cursor durable 落盘后调用；水位停滞的源不修剪，
+    // 有界性由水位前进保证，禁止按容量淘汰未覆盖键。
+    async pruneConsumedFeedback(taskId, sourceKey, watermarkTime) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task?.consumedFeedback)
+                return;
+            const prefix = `${sourceKey}:`;
+            const kept = Object.entries(task.consumedFeedback)
+                .filter(([key, time]) => !key.startsWith(prefix) || time >= watermarkTime);
+            if (kept.length === Object.keys(task.consumedFeedback).length)
+                return;
+            await this.taskStore.set({
+                ...task,
+                consumedFeedback: Object.fromEntries(kept),
+                updatedAt: new Date().toISOString(),
+            });
+        });
+    }
+    // TaskState 效果+outbox 先 durable、投递成功再清（spec §6 双写协议）：崩溃于任一侧，
+    // 重启从未清 outbox 重投，事件携确定性 key 供展示端去重——效果恰一次、通知至少一次。
+    async recordClosedUnmergedAnchor(taskId, prNumber) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || TERMINAL_STATUSES.includes(task.status))
+                return false;
+            const anchor = task.closedUnmergedAnchor;
+            if (anchor?.prNumber === prNumber && anchor.cleared !== true)
+                return false;
+            const generation = (anchor?.generation ?? 0) + 1;
+            const eventKey = `${taskId}:${prNumber}:mr-closed-unmerged:${generation}`;
+            await this.taskStore.set({
+                ...task,
+                closedUnmergedAnchor: { prNumber, generation },
+                outbox: [...(task.outbox ?? []), {
+                        key: eventKey,
+                        type: 'human.intervention',
+                        data: { phase: 'mr-closed-unmerged', prNumber, eventKey },
+                    }],
+                updatedAt: new Date().toISOString(),
+            });
+            return true;
+        });
+    }
+    async clearClosedUnmergedAnchor(taskId, prNumber) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            const anchor = task?.closedUnmergedAnchor;
+            if (!task || anchor?.prNumber !== prNumber || anchor.cleared === true)
+                return false;
+            const generation = anchor.generation;
+            const eventKey = `${taskId}:${prNumber}:mr-reopened:${generation}`;
+            await this.taskStore.set({
+                ...task,
+                closedUnmergedAnchor: { ...anchor, cleared: true },
+                outbox: [...(task.outbox ?? []), {
+                        key: eventKey,
+                        type: 'human.intervention',
+                        data: { phase: 'mr-reopened', prNumber, eventKey },
+                    }],
+                updatedAt: new Date().toISOString(),
+            });
+            return true;
+        });
+    }
+    async deliverTaskOutbox(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (!task?.outbox?.length)
+            return;
+        for (const entry of task.outbox) {
+            try {
+                await this.eventBus.emit({
+                    // 确定性 id（spec §6 outbox）：重投/并发 flush 的重复条目同 id，消费/展示端可去重
+                    id: `outbox:${entry.key}`,
+                    type: entry.type,
+                    timestamp: new Date().toISOString(),
+                    projectId: task.projectId,
+                    agentId: task.agentId,
+                    taskId: task.id,
+                    data: entry.data,
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] outbox delivery failed for task=${taskId} key=${entry.key}:`, err);
+                continue;
+            }
+            await this.withTaskLock(async () => {
+                const fresh = await this.taskStore.get(taskId);
+                if (!fresh?.outbox?.some(e => e.key === entry.key))
+                    return;
+                const remaining = fresh.outbox.filter(e => e.key !== entry.key);
+                const { outbox: _outbox, ...rest } = fresh;
+                await this.taskStore.set({
+                    ...rest,
+                    ...(remaining.length > 0 ? { outbox: remaining } : {}),
+                    updatedAt: new Date().toISOString(),
+                });
+            });
+        }
+    }
+    // merge-ready 信号是单发消费：git 分支在消费点引入网络复核，失败时必须重 arm（skipSnapshot
+    // false 让仍在面板上的信号立即重放），否则一次瞬态失败吞掉整轮完成信号。
+    async rearmPostApproveSignal(taskId, opts = {}) {
+        const task = await this.taskStore.get(taskId);
+        if (!task || task.status !== 'approved')
+            return false;
+        const completion = task.reviewMode === 'git'
+            ? this.gitCompletionOf(task)
+            : await this.postApproveStore.get(taskId);
+        if (!completion)
+            return false;
+        if (!this.phaseSignalWatcher)
+            return true;
+        return this.startPhaseSignalWatch({
+            taskId,
+            projectId: task.projectId,
+            agentId: task.agentId,
+            expectedKinds: 'pr-merge-ready',
+            token: completion.token,
+            // 刚消费的信号仍在滚动区：扫描失败路径必须 live-only，否则与持续失败叠加成无退避热循环
+            ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+        });
+    }
+    // 配置身份切换与任务创建共栅栏（TOCTOU）：blocker 扫描与提交在 withTaskLock 内执行，
+    // createTask 的「读配置快照+落任务」同经该锁，扫描时不可见的并发新任务不存在。
+    async guardGitConfigCommit(current, next, scan, commit) {
+        return this.withTaskLock(async () => {
+            const blockers = await scan(this, current, next);
+            if (blockers.length > 0)
+                return { ok: false, blockers };
+            await commit();
+            return { ok: true };
+        });
+    }
+    async flushGitOutbox() {
+        const tasks = await this.taskStore.list();
+        for (const task of tasks) {
+            if (task.reviewMode !== 'git' || !task.outbox?.length)
+                continue;
+            try {
+                await this.deliverTaskOutbox(task.id);
+            }
+            catch (err) {
+                // 单任务失败不得饿死其后的 durable outbox（至少一次的重启保证）
+                console.warn(`[AgentManager] flushGitOutbox: task=${task.id} failed, continuing:`, err);
+            }
+        }
+    }
+    // cancel 清理的部分成功可重试（spec §6 close 条 + 破坏性清理不静默失败）：close 已成而
+    // deleteBranch 瞬态失败时任务已终态，重启在守卫成立的前提下幂等补删（REF_NOT_FOUND 即成功）。
+    // 只清本代 pending：A 的 start 晚于 B 的失败返回时，无条件清除会吞掉 B 留下的重试锚
+    async clearReviewDispatchPending(taskId, expectedToken) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewDispatchPending !== true)
+                return;
+            if (task.status !== 'review' || task.signalToken !== expectedToken)
+                return;
+            const { reviewDispatchPending: _p, ...rest } = task;
+            await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+        });
+    }
+    // 评审派发的至少一次（sweep 消费）：transition 落 pending、QA session 启动成功才清——
+    // QA 缺失/忙/arm/start 失败的每条早退路径都由此在 60s 内自愈，无需依赖事件重放。
+    async retryPendingGitReviewDispatches() {
+        const tasks = await this.listActiveGitTasks();
+        for (const task of tasks) {
+            if (task.reviewDispatchPending !== true)
+                continue;
+            // arm/start 失败回滚会退到 in_progress/fixing 且无第二触发源（poller 已记 pushSha、
+            // watcher 已消费）：pending 在场即重新拉入 review
+            if (!['review', 'in_progress', 'fixing'].includes(task.status))
+                continue;
+            try {
+                // 列表是旧快照：消费谓词按实时值复核（pending 仍在 + 状态允许），并把代际
+                // CAS（expectSignalToken + expectReviewDispatchPending）压进 dispatch 锁内
+                const live = await this.taskStore.get(task.id);
+                if (!live || live.reviewDispatchPending !== true)
+                    continue;
+                if (!['review', 'in_progress', 'fixing'].includes(live.status))
+                    continue;
+                const entry = this.getPendingDispatchRetry(live.id);
+                if (entry?.kind === 'qa-recheck' && entry.signalToken === live.signalToken) {
+                    // 同代 busy pending 在场：QA 已知忙碌，重派只会空转 release/acquire 并重置预算；
+                    // 交给对账的观测门在空闲后消费
+                    continue;
+                }
+                const qaPhase = live.reviewRound === 0 ? 'review' : undefined;
+                await this.dispatchReviewToQa(live.id, {
+                    bumpRound: live.reviewRoundPending === true,
+                    ...(qaPhase !== undefined ? { qaPhase } : {}),
+                    ...(live.signalToken !== undefined ? { expectSignalToken: live.signalToken } : {}),
+                    expectReviewDispatchPending: true,
+                    fromStatus: ['review', 'in_progress', 'fixing'],
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] retryPendingGitReviewDispatches: task=${task.id} still failing:`, err);
+            }
+        }
+    }
+    async retryGitRemoteBranchCleanup() {
+        const tasks = await this.taskStore.list({ status: 'cancelled' });
+        for (const task of tasks) {
+            const reason = task.branchCleanupPending?.reason;
+            if (task.reviewMode !== 'git'
+                || (reason !== 'remote-delete-failed' && reason !== 'remote-close-failed'))
+                continue;
+            try {
+                const driver = this.platformDriverFor(task.projectId);
+                const branch = task.branch;
+                if (!driver || branch === undefined)
+                    continue;
+                // close 先补（幂等：closed PR 再 PATCH state=closed 为 no-op），再按守卫补删分支
+                if (reason === 'remote-close-failed' && task.prNumber !== undefined) {
+                    await driver.runOp('close', { prNumber: task.prNumber });
+                }
+                if (!isAutoDeletableTaskBranch({
+                    taskId: task.id,
+                    taskBranch: branch,
+                    branchCreatedByBaxian: task.branchCreatedByBaxian,
+                    actualRef: `refs/heads/${branch}`,
+                })) {
+                    if (reason !== 'remote-close-failed')
+                        continue;
+                }
+                else {
+                    await driver.runOp('deleteBranch', { branch });
+                }
+                await this.withTaskLock(async () => {
+                    const fresh = await this.taskStore.get(task.id);
+                    const freshReason = fresh?.branchCleanupPending?.reason;
+                    if (freshReason !== 'remote-delete-failed' && freshReason !== 'remote-close-failed')
+                        return;
+                    const { branchCleanupPending: _pending, ...rest } = fresh;
+                    await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] retryGitRemoteBranchCleanup: task=${task.id} still failing:`, err);
+            }
+        }
+    }
+    // 反馈消费的唯一状态机（spec §6 双写协议 + merge 条）：锁内按实时状态决定效果，效果字段
+    // 与消费键同一次持久化——入口快照与提交之间的并发状态迁移不再能让 revision 落空。
+    async consumeGitFeedbackRevision(taskId, consume, opts = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git')
+                return { kind: 'gone' };
+            if (task.consumedFeedback?.[consume.key] !== undefined)
+                return { kind: 'duplicate' };
+            const consumed = { ...task.consumedFeedback, [consume.key]: consume.versionTime };
+            const stamp = { updatedAt: new Date().toISOString() };
+            if (TERMINAL_STATUSES.includes(task.status)) {
+                await this.taskStore.set({ ...task, consumedFeedback: consumed, ...stamp });
+                return { kind: 'consumed' };
+            }
+            if (task.status === 'merge-ready') {
+                const approvedHead = typeof task.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(task.latestHeadSha)
+                    ? task.latestHeadSha
+                    : undefined;
+                if (approvedHead !== undefined) {
+                    const next = {
+                        ...task,
+                        status: 'approved',
+                        postApproveHeadSha: approvedHead,
+                        pendingRedispatch: true,
+                        consumedFeedback: consumed,
+                        ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                        ...stamp,
+                    };
+                    await this.taskStore.set(next);
+                    return { kind: 'returned', task: next };
+                }
+            }
+            if (task.status === 'approved' && task.postApproveRevoked === undefined) {
+                const next = {
+                    ...task,
+                    pendingRedispatch: true,
+                    consumedFeedback: consumed,
+                    ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                    ...stamp,
+                };
+                await this.taskStore.set(next);
+                return { kind: 'pending', task: next };
+            }
+            await this.taskStore.set({
+                ...task,
+                consumedFeedback: consumed,
+                ...(opts.feedbackAt !== undefined ? { prFeedbackReceivedAt: opts.feedbackAt } : {}),
+                ...stamp,
+            });
+            return { kind: 'consumed' };
+        });
+    }
+    // merge-ready 不是评论面的冻结点（spec §6 merge 条）：新反馈单写退回 approved + 消费键，
+    // 与 push 使 merge-ready 失效的既有语义对称。
+    async returnMergeReadyToApproved(taskId, consume) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.reviewMode !== 'git' || task.status !== 'merge-ready')
+                return null;
+            const approvedHead = typeof task.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(task.latestHeadSha)
+                ? task.latestHeadSha
+                : undefined;
+            if (!approvedHead)
+                return null;
+            // pendingRedispatch 与状态翻转/消费键同写：崩溃于派发前，恢复扫描凭它补派（spec §6 至少一次）
+            const next = {
+                ...task,
+                status: 'approved',
+                postApproveHeadSha: approvedHead,
+                pendingRedispatch: true,
+                consumedFeedback: { ...task.consumedFeedback, [consume.key]: consume.versionTime },
+                updatedAt: new Date().toISOString(),
+            };
+            await this.taskStore.set(next);
+            return next;
         });
     }
     async setupRecoveredPostApproveSignals() {
@@ -3448,14 +4117,26 @@ export class AgentManager {
             if (task.postApproveRevoked) {
                 // Finish an interrupted revoke: the marker is authoritative, the leftover record must not re-arm.
                 try {
-                    await this.postApproveStore.clear(task.id);
+                    if (task.reviewMode === 'git') {
+                        if (task.postApproveToken !== undefined) {
+                            await this.taskStore.set({
+                                ...this.stripGitCompletionFields(task),
+                                updatedAt: new Date().toISOString(),
+                            });
+                        }
+                    }
+                    else {
+                        await this.postApproveStore.clear(task.id);
+                    }
                 }
                 catch (err) {
                     console.warn(`[AgentManager] setupRecoveredPostApproveSignals: revoked completion cleanup failed for task=${task.id}:`, err);
                 }
                 continue;
             }
-            const completion = await this.postApproveStore.get(task.id);
+            const completion = task.reviewMode === 'git'
+                ? this.gitCompletionOf(task)
+                : await this.postApproveStore.get(task.id);
             if (!completion)
                 continue;
             if (task.postApproveHeadSha === undefined) {
@@ -3465,7 +4146,14 @@ export class AgentManager {
             }
             if (completion.approvedHeadSha !== task.postApproveHeadSha) {
                 try {
-                    await this.postApproveStore.clear(task.id);
+                    if (task.reviewMode === 'git') {
+                        await this.taskStore.set({
+                            ...this.stripGitCompletionFields(task),
+                            updatedAt: new Date().toISOString(),
+                        });
+                    }
+                    else
+                        await this.postApproveStore.clear(task.id);
                     console.warn(`[AgentManager] setupRecoveredPostApproveSignals: task=${task.id} retired a completion bound to head ${completion.approvedHeadSha} (persisted approved head ${task.postApproveHeadSha})`);
                 }
                 catch (err) {
@@ -3498,9 +4186,16 @@ export class AgentManager {
         for (const task of tasks) {
             if (!task.signalToken)
                 continue;
-            const mapped = this.mapTaskStateToExpectedWatcher(task);
-            if (!mapped)
+            const mappings = this.mapTaskStateToExpectedWatchers(task);
+            if (mappings.length === 0)
                 continue;
+            for (const mapped of mappings) {
+                await this.setupRecoveredWatcherForMapping(task, mapped.token ?? task.signalToken, mapped, mappings.length > 1);
+            }
+        }
+    }
+    async setupRecoveredWatcherForMapping(task, signalToken, mapped, hasSiblings) {
+        {
             const { expectedKinds, agentId } = mapped;
             const specStage = isSpecStagePhase(task.phase);
             const interventionKindLabel = specStage && task.status === 'review' ? 'spec-reviewed'
@@ -3522,9 +4217,10 @@ export class AgentManager {
                     projectId: task.projectId,
                     agentId,
                     expectedKinds,
-                    token: task.signalToken,
+                    token: signalToken,
                     skipSnapshot: !scanSnapshotOnRecover,
                     recovered: true,
+                    ...(hasSiblings ? { replaceScope: 'agent' } : {}),
                     ...(allowRecoveredReadFile
                         ? { onReadFile: (req) => { void this.handleReadFileRequest(task.id, agentId, req); } }
                         : {}),
@@ -3618,16 +4314,259 @@ export class AgentManager {
                 return undefined;
             throw new Error(`gh pr view exited ${result.exitCode} for PR #${prNumber}: ${stderr.slice(0, 200)}`);
         }
-        const parts = result.stdout.trim().split('\t');
-        const [headRefName, headSha, state, isCross] = parts;
-        const body = parts.slice(4).join('\t');
-        if (!headRefName || !/^[0-9a-f]{40}$/i.test(headSha))
-            return undefined;
-        if (state !== 'OPEN')
-            return undefined;
-        if (isCross === 'true')
-            return undefined;
-        return { headRefName, headSha, body };
+        const parts = result.stdout.trim().split('\t');
+        const [headRefName, headSha, state, isCross] = parts;
+        const body = parts.slice(4).join('\t');
+        if (!headRefName || !/^[0-9a-f]{40}$/i.test(headSha))
+            return undefined;
+        if (state !== 'OPEN')
+            return undefined;
+        if (isCross === 'true')
+            return undefined;
+        return { headRefName, headSha, body };
+    }
+    platformBindingFields(projectId) {
+        if (this.effectiveReviewMode(projectId) !== 'git')
+            return {};
+        const project = this.getProjectConfig(projectId);
+        if (!project)
+            return {};
+        const tool = resolveProjectTool(project);
+        if (tool === undefined)
+            return {};
+        return { platformBinding: { mode: 'git', repoKey: repoIdentityKey(project.repo), tool } };
+    }
+    // 指纹为纯身份三元组（spec §4）：binary/env/skill 文本 live 解析可演进，身份失配即拒绝
+    assertPlatformBinding(task) {
+        const binding = task.platformBinding;
+        if (!binding) {
+            if (task.reviewMode !== 'git')
+                return;
+            // D11 无兼容负担：不存在合法的无快照 git 任务，缺失即损坏/手工恢复，按失配同级拒绝
+            void this.emitIntervention(task.projectId, task.agentId || undefined, task.id, {
+                phase: 'platform-binding-mismatch',
+                reason: 'missing-binding-snapshot',
+            });
+            throw new Error(`platform binding missing for git task ${task.id}; refusing platform operations`);
+        }
+        const project = this.getProjectConfig(task.projectId);
+        const live = project === undefined ? undefined : {
+            mode: this.effectiveReviewMode(task.projectId),
+            repoKey: repoIdentityKey(project.repo),
+            tool: resolveProjectTool(project),
+        };
+        if (live !== undefined && live.mode === binding.mode
+            && live.repoKey === binding.repoKey && live.tool === binding.tool)
+            return;
+        void this.emitIntervention(task.projectId, task.agentId || undefined, task.id, {
+            phase: 'platform-binding-mismatch',
+            binding,
+            ...(live !== undefined ? { live: { mode: live.mode, repoKey: live.repoKey, tool: live.tool ?? '' } } : {}),
+        });
+        throw new Error(`platform binding mismatch for task ${task.id}: snapshot ${binding.mode}/${binding.repoKey}/${binding.tool} no longer matches the live config`);
+    }
+    async platformTaskAndDriver(taskId) {
+        const task = await this.taskStore.get(taskId);
+        if (!task)
+            throw new Error(`task ${taskId} not found`);
+        this.assertPlatformBinding(task);
+        const driver = this.platformDriverFor(task.projectId);
+        if (!driver)
+            throw new Error(`no git driver resolvable for project ${task.projectId}`);
+        return { task, driver };
+    }
+    async listActiveGitTasks(projectId) {
+        const tasks = await this.taskStore.list(projectId !== undefined ? { projectId } : undefined);
+        return tasks.filter(t => t.reviewMode === 'git' && !TERMINAL_STATUSES.includes(t.status));
+    }
+    async platformFetchPrView(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const [row] = await driver.runOp('prView', { prNumber: task.prNumber });
+        return row;
+    }
+    async platformVerifyPrBinding(taskId, prNumber, opts = {}) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        const [row] = await driver.runOp('prView', { prNumber });
+        let expectedBase = task.baseBranch;
+        if (expectedBase === undefined) {
+            try {
+                const [project] = await driver.runOp('projectView');
+                if (typeof project?.defaultBranch === 'string')
+                    expectedBase = project.defaultBranch;
+            }
+            catch {
+                // 快照与实时默认分支都拿不到 → unverifiable：核验失败不是核验通过（fail closed）
+            }
+        }
+        const check = checkOpenPrBinding(row, { branch: opts.branchOverride ?? task.branch, expectedBase });
+        if (!check.ok) {
+            return {
+                ...check,
+                ...(check.reason === 'branch' && typeof row.branch === 'string' ? { prBranch: row.branch } : {}),
+            };
+        }
+        return {
+            ok: true,
+            headSha: String(row.headSha),
+            branch: String(row.branch),
+            targetBranch: String(row.targetBranch),
+        };
+    }
+    stopPhaseSignalWatcherAgent(taskId, agentId) {
+        this.phaseSignalWatcher?.stopAgent(taskId, agentId);
+    }
+    async platformClosePr(taskId, opts) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        try {
+            await driver.runOp('close', { prNumber: task.prNumber });
+        }
+        catch (err) {
+            throw new PlatformCloseError('close', err);
+        }
+        const branch = task.branch;
+        const deletable = opts.deleteBranch && branch !== undefined && isAutoDeletableTaskBranch({
+            taskId: task.id,
+            taskBranch: branch,
+            branchCreatedByBaxian: task.branchCreatedByBaxian,
+            actualRef: `refs/heads/${branch}`,
+        });
+        if (deletable) {
+            try {
+                await driver.runOp('deleteBranch', { branch });
+            }
+            catch (err) {
+                throw new PlatformCloseError('deleteBranch', err);
+            }
+        }
+    }
+    async platformScanComments(driver, prNumber) {
+        return scanCommentSourcesOnce(driver, prNumber, () => Date.now());
+    }
+    // merge-ready 迁移与 merge confirm 的 provenance/ack 双复核共用一次全源扫描（spec §6/§10）
+    async platformVerifyAcceptedPass(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            return { ok: false, reason: 'no bound PR' };
+        const provenance = task.passProvenance;
+        if (!provenance)
+            return { ok: false, reason: 'no accepted pass provenance' };
+        const scans = await this.platformScanComments(driver, task.prNumber);
+        const recheck = recheckPassProvenance({
+            token: provenance.token,
+            failToken: provenance.failToken,
+            anchorSha: provenance.anchorSha,
+            carrier: { sourceKey: provenance.sourceKey, id: provenance.id, bodyDigest: provenance.bodyDigest },
+        }, scans);
+        if (!recheck.ok)
+            return { ok: false, reason: `provenance ${recheck.reason}` };
+        const pending = collectPendingFeedback(scans, {
+            replyActorId: task.replyActorId,
+            replyActorStatus: task.replyActorStatus,
+        });
+        if (!pending.allSourcesOk)
+            return { ok: false, reason: 'source scan incomplete' };
+        return { ok: true, pendingCount: pending.pending.size };
+    }
+    async platformPendingFeedback(taskId) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const scans = await this.platformScanComments(driver, task.prNumber);
+        const failed = scans.filter(s => !s.ok).map(s => s.key);
+        if (failed.length > 0) {
+            throw new Error(`pending-feedback scan incomplete; failed sources: ${failed.join(', ')}`);
+        }
+        return collectPendingFeedback(scans, {
+            replyActorId: task.replyActorId,
+            replyActorStatus: task.replyActorStatus,
+        });
+    }
+    async platformConfirmMerge(taskId, opts) {
+        const { task, driver } = await this.platformTaskAndDriver(taskId);
+        if (task.prNumber === undefined)
+            throw new Error(`task ${taskId} has no bound PR`);
+        const prNumber = task.prNumber;
+        const [row] = await driver.runOp('prView', { prNumber });
+        const binding = checkOpenPrBinding(row, { branch: task.branch, expectedBase: task.baseBranch });
+        if (!binding.ok)
+            throw new Error(`merge blocked: binding ${binding.reason}`);
+        if (String(row.headSha) !== opts.expectedHeadSha) {
+            throw new Error(`merge blocked: head moved (expected ${opts.expectedHeadSha}, saw ${String(row.headSha)})`);
+        }
+        // 人工兜底（max_rounds Mark complete）绕过 QA 授权复核（该路径本就无 pass），
+        // binding/head/REST sha 的安全检查保留（spec §7 威胁模型：merge 有人工 confirm）
+        if (opts.humanOverride !== true) {
+            const provenance = task.passProvenance;
+            if (!provenance)
+                throw new PlatformMergeRecheckError('no accepted pass provenance on task');
+            if (provenance.anchorSha.toLowerCase() !== opts.expectedHeadSha.toLowerCase()) {
+                throw new PlatformMergeRecheckError(`pass provenance anchors ${provenance.anchorSha}, not the merge head ${opts.expectedHeadSha}`);
+            }
+            const scans = await this.platformScanComments(driver, prNumber);
+            const recheck = recheckPassProvenance({
+                token: provenance.token,
+                failToken: provenance.failToken,
+                anchorSha: provenance.anchorSha,
+                carrier: { sourceKey: provenance.sourceKey, id: provenance.id, bodyDigest: provenance.bodyDigest },
+            }, scans);
+            if (!recheck.ok) {
+                // 瞬态扫描不完整留在 gate 可重试；只有确定性失效（撤销/编辑/缺失）才退回 approved
+                if (recheck.reason === 'source-scan-incomplete') {
+                    throw new Error('merge blocked: provenance source-scan-incomplete');
+                }
+                throw new PlatformMergeRecheckError(`provenance ${recheck.reason}`);
+            }
+            const pending = collectPendingFeedback(scans, {
+                replyActorId: task.replyActorId,
+                replyActorStatus: task.replyActorStatus,
+            });
+            if (!pending.allSourcesOk)
+                throw new Error('merge blocked: pending-feedback scan incomplete');
+            if (pending.pending.size > 0) {
+                throw new PlatformMergeRecheckError(`${pending.pending.size} pending feedback revision(s) without ack`);
+            }
+        }
+        // 临门 CAS：扫描期间 durable 退回（approved/pendingRedispatch/fixing）必须使本次 Confirm 失效；
+        // REST sha 只保护 source head，保护不了评论面与 TaskState（残余网络窗口按 spec §6 如实声明）
+        const fresh = await this.taskStore.get(taskId);
+        if (!fresh
+            || (opts.humanOverride === true
+                // override 只绕过 provenance/ack，不绕过本次认领的 gate 代际：并发 RC 转 fixing 即失效
+                ? fresh.status !== 'merge-ready'
+                : (fresh.status !== 'merge-ready' && fresh.status !== 'ready'))
+            || fresh.latestHeadSha !== opts.expectedHeadSha
+            || fresh.pendingRedispatch === true) {
+            throw new Error(`merge blocked: task left its merge gate (status=${fresh?.status ?? 'gone'})`);
+        }
+        try {
+            await driver.runOp('merge', { prNumber, expectedHeadSha: opts.expectedHeadSha });
+        }
+        catch (err) {
+            if (err instanceof DriverOpError && err.info.errorClass === 'MERGE_BLOCKED') {
+                let mergeStatus;
+                try {
+                    const [fresh] = await driver.runOp('prView', { prNumber });
+                    if (typeof fresh?.detailedMergeStatus === 'string')
+                        mergeStatus = fresh.detailedMergeStatus;
+                }
+                catch {
+                    // 归因查询失败不遮蔽原始错误
+                }
+                throw new Error(`merge blocked by platform${mergeStatus ? ` (${mergeStatus})` : ''}: ${err.message}`);
+            }
+            throw err;
+        }
+    }
+    mintReviewTokenPair() {
+        const passToken = createSignalToken();
+        let failToken = createSignalToken();
+        while (failToken === passToken)
+            failToken = createSignalToken();
+        return { passToken, failToken };
     }
     async listTasksByProject(projectId) {
         return this.taskStore.list({ projectId });
@@ -3684,6 +4623,7 @@ export class AgentManager {
                 return null;
             if (!guard.fromStatus.includes(previousStatus))
                 return null;
+            // 代际 CAS（spec §7）：校验后提交前的并发换代（push/重派轮换 token+pair）使旧 verdict 失效
             if (guard.expectSignalToken !== undefined && task.signalToken !== guard.expectSignalToken)
                 return null;
             if (patch?.branch && patch.branch !== task.branch) {
@@ -3704,16 +4644,21 @@ export class AgentManager {
             return { task, previousStatus };
         });
     }
-    async bumpReviewRoundIfStillAt(taskId, expectedRound) {
+    // 送达即计轮：flag 是唯一入账凭据，与 verdict 公式（round + flag）按 token CAS 互斥消费，
+    // successor 换代或 verdict 先行都自然跳过，恰好一次
+    // 不设终态守卫：只写轮次不写 status（无复活风险），而终态任务的 recheck 派发是受支持的能力，
+    // 其送达的轮次同样要入账
+    async consumeReviewRoundIntent(taskId, expectedToken) {
         await this.withTaskLock(async () => {
-            const task = await this.taskStore.get(taskId);
-            if (!task || TERMINAL_STATUSES.includes(task.status))
-                return;
-            if ((task.reviewRound ?? 0) !== expectedRound)
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh || fresh.signalToken !== expectedToken || fresh.reviewRoundPending !== true)
                 return;
-            task.reviewRound = expectedRound + 1;
-            task.updatedAt = new Date().toISOString();
-            await this.taskStore.set(task);
+            await this.taskStore.set({
+                ...fresh,
+                reviewRound: fresh.reviewRound + 1,
+                reviewRoundPending: undefined,
+                updatedAt: new Date().toISOString(),
+            });
         });
     }
     createRunnerFor(agent) {
@@ -3743,6 +4688,9 @@ export class AgentManager {
         return this.repoCache;
     }
     async rollbackFailedDispatch(taskId, agentId, reason, expectedLockToken) {
+        // Pin the incarnation: task rollback / intervention below await, and a DELETE→same-id recreate in that
+        // window must not let the final state write-back resurrect the deleted agent.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const existing = await this.agentStore.get(agentId);
         if (existing && existing.taskId !== undefined && existing.taskId !== taskId) {
             console.warn(`[AgentManager] rollback: agent ${agentId} taskId mismatch (expected ${taskId}, got ${existing.taskId}); ` +
@@ -3789,12 +4737,16 @@ export class AgentManager {
         else {
             const now = new Date().toISOString();
             await this.agentStore.update(agentId, (latest) => {
-                if (latest?.taskId === taskId && latest.lockToken !== expectedLockToken)
+                // Never resurrect a deleted/recreated incarnation: if the state is gone or the generation moved
+                // since entry, this rollback is stale — clear nothing rather than rebuild from the old snapshot.
+                if (!latest || !this.deletionGateOpen(agentId, genAtEntry))
                     return AGENT_STORE_NOOP;
-                if (latest?.taskId !== undefined && latest.taskId !== taskId)
+                if (latest.taskId === taskId && latest.lockToken !== expectedLockToken)
+                    return AGENT_STORE_NOOP;
+                if (latest.taskId !== undefined && latest.taskId !== taskId)
                     return AGENT_STORE_NOOP;
                 return {
-                    ...(latest ?? existing ?? { id: agentId, projectId, updatedAt: now }),
+                    ...latest,
                     id: agentId,
                     projectId,
                     taskId: undefined,
@@ -3871,6 +4823,7 @@ export class AgentManager {
                 branch: taskBranch,
                 branchCreatedByBaxian,
                 reviewMode: this.effectiveReviewMode(projectId),
+                ...this.platformBindingFields(projectId),
                 createdAt: now,
                 updatedAt: now,
                 ...(imageFilenames ? { images: imageFilenames } : {}),
@@ -3884,6 +4837,8 @@ export class AgentManager {
                 };
                 return this.persistQueuedTask(unassigned, 'unassigned');
             }
+            // Capture generation before the first config/group read so a DELETE→same-id recreate in the read→commit window fails the gate.
+            const genAtEntry = this.deletionGenerationOf(input.preferredAgentId);
             const target = await this.pickAgent(projectId, input.preferredAgentId);
             const targetConfig = this.getAgentConfig(input.preferredAgentId);
             const group = this.findAgentGroup(input.preferredAgentId);
@@ -3895,6 +4850,12 @@ export class AgentManager {
             const researchFields = research
                 ? { researchAgentId: research.id, phase: 'research' }
                 : {};
+            // Pin EVERY participant's generation: a member (e.g. QA) deleted→reintroduced after the snapshot leaves isDeletionInFlight false and the preferred generation unchanged, yet the task would still carry its stale id.
+            const participantGens = new Map([dev.id, ...(qa ? [qa.id] : []), ...(research ? [research.id] : [])]
+                .map(id => [id, this.deletionGenerationOf(id)]));
+            const participantsFresh = () => this.deletionGenerationOf(input.preferredAgentId) === genAtEntry
+                && !this.isDeletionInFlight(input.preferredAgentId)
+                && [...participantGens].every(([id, gen]) => this.deletionGenerationOf(id) === gen && !this.isDeletionInFlight(id));
             const queued = {
                 ...taskBase,
                 agentId: '',
@@ -3903,12 +4864,81 @@ export class AgentManager {
                 status: 'pending',
                 ...(qa ? { qaAgentId: qa.id } : {}),
             };
+            // A DELETE→recreate of the preferred OR any participant after the group snapshot must not persist a
+            // pending task carrying its stale devAgentId/qaAgentId; reject and let the client re-select.
+            const persistQueuedOrReject = (reason) => {
+                if (!participantsFresh()) {
+                    throw new ApiError(409, `Agent ${input.preferredAgentId} or a group member is being deleted or recreated during task creation; please retry`);
+                }
+                return this.persistQueuedTask(queued, reason, input.preferredAgentId);
+            };
             if (!target) {
-                return this.persistQueuedTask(queued, 'preferred_agent_busy', input.preferredAgentId);
+                return persistQueuedOrReject('preferred_agent_busy');
+            }
+            if (this.isDeletionInFlight(target.id)) {
+                return persistQueuedOrReject('agent_locked');
             }
             const lockToken = await this.lockManager.acquire(target.id, taskId);
             if (!lockToken) {
-                return this.persistQueuedTask(queued, 'agent_locked', input.preferredAgentId);
+                return persistQueuedOrReject('agent_locked');
+            }
+            // Three-step transaction (queued task → binding → in_progress): any failure leaves at worst a queued task and/or a stale binding to it, both reclaimable — never an active task with no binding.
+            const releaseLock = async () => {
+                try {
+                    await this.lockManager.releaseIfOwner(target.id, taskId, lockToken);
+                }
+                catch (releaseErr) {
+                    console.warn(`[AgentManager] createTask(${taskId}): lock release after failed assignment also failed:`, releaseErr);
+                }
+            };
+            try {
+                await this.taskStore.set(queued);
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            let commit;
+            try {
+                commit = await this.agentStore.update(target.id, (existing) => {
+                    if (existing === null && !this.bindingInitPredicate(target.id, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    if (!this.deletionGateOpen(target.id, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    return {
+                        id: target.id,
+                        projectId,
+                        taskId,
+                        lockToken,
+                        bootstrappingTaskId: taskId,
+                        updatedAt: now,
+                        ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
+                        ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
+                        ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
+                    };
+                });
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            if (commit !== 'committed') {
+                await releaseLock();
+                return (await this.taskStore.get(taskId)) ?? queued;
+            }
+            // Binding-before-active: a DELETE slipping in after the binding commit sees a still-'pending' task and can rotate the lock; re-verify lock ownership + preferred/participant generations before the active write, else roll back.
+            if (this.isDeletionInFlight(target.id)
+                || !this.deletionGateOpen(target.id, genAtEntry)
+                || !participantsFresh()
+                || !(await this.lockManager.isOwner(target.id, taskId, lockToken))) {
+                await this.agentStore.update(target.id, (existing) => {
+                    if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                        return AGENT_STORE_NOOP;
+                    const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                    return { ...rest, updatedAt: new Date().toISOString() };
+                });
+                await releaseLock();
+                return (await this.taskStore.get(taskId)) ?? queued;
             }
             const task = {
                 ...taskBase,
@@ -3918,18 +4948,24 @@ export class AgentManager {
                 ...researchFields,
                 status: 'in_progress',
             };
-            await this.taskStore.set(task);
-            await this.agentStore.update(target.id, (existing) => ({
-                id: target.id,
-                projectId,
-                taskId,
-                lockToken,
-                bootstrappingTaskId: taskId,
-                updatedAt: now,
-                ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
-                ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
-                ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
-            }));
+            try {
+                await this.taskStore.set(task);
+            }
+            catch (err) {
+                try {
+                    await this.agentStore.update(target.id, (existing) => {
+                        if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                            return AGENT_STORE_NOOP;
+                        const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                        return { ...rest, updatedAt: new Date().toISOString() };
+                    });
+                }
+                catch (rollbackErr) {
+                    console.warn(`[AgentManager] createTask(${taskId}): binding rollback after task write failure also failed (stale-binding path will reclaim):`, rollbackErr);
+                }
+                await releaseLock();
+                throw err;
+            }
             await this.safeEmit({
                 id: '',
                 type: 'task.assigned',
@@ -3946,7 +4982,7 @@ export class AgentManager {
         const task = await this.createTask(projectId, input);
         if (task.status === 'in_progress' && task.agentId) {
             const signalToken = createSignalToken();
-            await this.updateTask(task.id, { signalToken });
+            await this.updateTask(task.id, this.dispatchTokenFields(task, signalToken));
             const dispatchLockToken = (await this.agentStore.get(task.agentId))?.lockToken;
             const start = this.startCreatedTaskSession(task.id, task.agentId, signalToken, dispatchLockToken);
             if (opts.background) {
@@ -4037,6 +5073,9 @@ export class AgentManager {
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new ApiError(404, `Unknown agent: ${agentId}`);
+        // Pin the incarnation before reading paneId: paneId equality is ABA-blind (a recreate reuses %0), so a
+        // DELETE→same-id recreate during the upload would otherwise paste the stale image into the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         const paneId = state?.paneId;
         if (!paneId)
@@ -4046,6 +5085,9 @@ export class AgentManager {
         }
         try {
             const assertUploadStillValid = async () => {
+                if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                    throw new ApiError(409, `Agent ${agentId} was deleted or recreated while uploading; image paste aborted`);
+                }
                 const held = await this.agentStore.get(agentId);
                 if (!held || held.paneId !== paneId) {
                     throw new ApiError(409, `Agent ${agentId} session changed while uploading; image paste aborted`);
@@ -4065,7 +5107,10 @@ export class AgentManager {
             await writeImageToHost(runner, path, bytes);
             await assertUploadStillValid();
             const tmux = new TmuxManager(runner);
-            await tmux.injectPrompt(paneId, `${path} `, agentId);
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
+            // resolveClaimedPane resolved by the CURRENT same-name session; re-verify once more before injecting so a DELETE→recreate in that gap can't take the paste.
+            await assertUploadStillValid();
+            await tmux.injectPrompt(pane, `${path} `, agentId);
             return { path };
         }
         finally {
@@ -4097,9 +5142,10 @@ export class AgentManager {
                 }
             };
             const tmux = new TmuxManager(this.createRunnerFor(cfg));
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
             const waitReady = async () => {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, cfg.runtime, this.manualCompactWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, cfg.runtime, this.manualCompactWaitMs);
                 }
                 catch (err) {
                     const detail = err instanceof Error ? err.message : String(err);
@@ -4108,13 +5154,13 @@ export class AgentManager {
             };
             await waitReady();
             await assertSessionUnchanged();
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             await waitReady();
             await assertSessionUnchanged();
-            await tmux.sendKeysLiteral(paneId, command);
-            await tmux.sendEnter(paneId);
+            await tmux.sendKeysLiteral(pane, command);
+            await tmux.sendEnter(pane);
             guardHandedOff = true;
-            void this.waitForReplPromptReady(tmux, paneId, cfg.runtime, this.compactIdleWaitMs)
+            void this.waitForReplPromptReady(tmux, pane, cfg.runtime, this.compactIdleWaitMs)
                 .catch(err => {
                 console.warn(`[AgentManager] sendSlashCommand(${agentId}, ${command}) post idle wait failed:`, err);
             })
@@ -4133,25 +5179,98 @@ export class AgentManager {
     async clearAgent(agentId) {
         return this.sendSlashCommand(agentId, '/clear');
     }
-    async clearRuntimeForTaskBoundary(tmux, paneId, agentId, runtime, revalidate) {
+    registerPendingDispatchRetry(taskId, entry, budgetOverride) {
+        const prev = this.pendingDispatchRetryByTask.get(taskId);
+        // 预算随登记代走：同 kind 但 pass 换代（token/agent 变化）时必须重置 since 与告警标志。
+        // budgetOverride 供对账内部重排延续同一笔欠投递的预算——它只经 startSession 的 armedToken
+        // fence 注入，外部 successor 的登记结构上拿不到
+        const sameGeneration = prev?.kind === entry.kind
+            && prev.agentId === entry.agentId
+            && prev.signalToken === entry.signalToken;
+        const since = sameGeneration ? prev.since : (budgetOverride?.since ?? Date.now());
+        const budgetAlerted = sameGeneration
+            ? prev.budgetAlerted === true
+            : budgetOverride?.budgetAlerted === true;
+        this.pendingDispatchRetryByTask.set(taskId, {
+            ...entry,
+            since,
+            ...(budgetAlerted ? { budgetAlerted: true } : {}),
+        });
+    }
+    getPendingDispatchRetry(taskId) {
+        return this.pendingDispatchRetryByTask.get(taskId);
+    }
+    listPendingDispatchRetries() {
+        return this.pendingDispatchRetryByTask;
+    }
+    clearPendingDispatchRetry(taskId) {
+        this.pendingDispatchRetryByTask.delete(taskId);
+    }
+    clearPendingDispatchRetryIfMatches(taskId, expected) {
+        const entry = this.pendingDispatchRetryByTask.get(taskId);
+        if (entry?.agentId === expected.agentId && entry.signalToken === expected.signalToken) {
+            this.pendingDispatchRetryByTask.delete(taskId);
+        }
+    }
+    markPendingDispatchRetryBudgetAlerted(taskId, expected) {
+        const entry = this.pendingDispatchRetryByTask.get(taskId);
+        if (entry?.agentId === expected.agentId && entry.signalToken === expected.signalToken) {
+            this.pendingDispatchRetryByTask.set(taskId, { ...entry, budgetAlerted: true });
+        }
+    }
+    async queueQaBusyPendingRetry(taskId, agentId, phase, createdSession, err, dispatch) {
+        if (!(err instanceof ReplNotReadyError))
+            return null;
+        if (phase !== 'review' && phase !== 'recheck')
+            return null;
+        // 无本次派发的 pass 令牌就不登记（宁走既有失败路径，不造无 fence 重试）；
+        // 令牌漂移说明 pass 已被接管，忙碌属于旧派发，不得登记到 successor 上
+        const passToken = dispatch.passToken;
+        if (!passToken)
+            return null;
+        let current;
+        try {
+            current = await this.taskStore.get(taskId);
+        }
+        catch (readErr) {
+            console.warn(`[AgentManager] startSession[${phase}]: busy on task ${taskId} but pass token could not be verified; ` +
+                `falling back to the non-pending failure path:`, readErr);
+            return null;
+        }
+        if (current?.signalToken !== passToken) {
+            console.warn(`[AgentManager] startSession[${phase}]: busy on task ${taskId} but the review pass was superseded ` +
+                `(expected ${passToken}, now ${current?.signalToken ?? 'gone'}); not queueing a pending retry`);
+            return null;
+        }
+        this.registerPendingDispatchRetry(taskId, {
+            kind: 'qa-recheck',
+            agentId,
+            signalToken: passToken,
+            qaPhase: phase,
+        }, dispatch.pendingBudget);
+        console.warn(`[AgentManager] startSession[${phase}]: QA pane busy for task ${taskId}; ` +
+            `${phase} queued for redispatch when idle (${(err.message.split('\n')[0])})`);
+        return new EnsureSessionError({ createdSession, agentId, handled: true, busyPending: true }, `QA REPL busy; ${phase} dispatch for task ${taskId} queued for redispatch when idle`);
+    }
+    async clearRuntimeForTaskBoundary(tmux, pane, agentId, runtime, revalidate) {
         await this.acquireCompactGuard(agentId);
         try {
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.cleanComposerWaitMs);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.cleanComposerWaitMs, { stableIdle: true });
             await revalidate();
-            await tmux.clearComposerDraft(paneId);
-            const baseline = await tmux.captureSettledSnapshot(paneId, {
+            await tmux.clearComposerDraft(pane);
+            const baseline = await tmux.captureSettledSnapshot(pane, {
                 timeoutMs: this.dispatchSettleTimeoutMs,
             });
-            const baselineTitle = await tmux.readPaneTitle(paneId);
-            await tmux.sendKeysLiteral(paneId, '/clear');
-            await tmux.sendEnter(paneId);
-            await tmux.waitSubmitAck(paneId, baseline, runtime, {
+            const baselineTitle = await tmux.readPaneTitle(pane);
+            await tmux.sendKeysLiteral(pane, '/clear');
+            await tmux.sendEnter(pane);
+            await tmux.waitSubmitAck(pane, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
                 acceptComposerChange: true,
             });
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.dispatchAckTimeoutMs);
-            if (await this.hasRuntimeSlashCommandRejection(tmux, paneId, '/clear')) {
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.dispatchAckTimeoutMs, { stableIdle: true });
+            if (await this.hasRuntimeSlashCommandRejection(tmux, pane, '/clear')) {
                 throw new Error('Runtime rejected /clear at the task boundary; refusing to reuse prior task context');
             }
             await revalidate();
@@ -4228,6 +5347,8 @@ export class AgentManager {
                     error: `Task ${taskId} has no preferredAgentId; agentId is required in request body`,
                 };
             }
+            // Capture generation before the first config/state read so a DELETE→same-id recreate in the read→commit window fails the gate.
+            const genAtEntry = this.deletionGenerationOf(agentId);
             const cfg = this.getAgentConfig(agentId);
             if (!cfg)
                 return { task: fresh, errorCode: 400, error: `Unknown agent: ${agentId}` };
@@ -4248,6 +5369,9 @@ export class AgentManager {
             if (!canDispatchWithBinding(state)) {
                 return { task: fresh, errorCode: 409, error: `Agent ${agentId} is busy or awaiting human` };
             }
+            if (this.isDeletionInFlight(agentId)) {
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
             const lockToken = await this.lockManager.acquire(agentId, taskId);
             if (!lockToken) {
                 return { task: fresh, errorCode: 409, error: `Agent ${agentId} lock acquisition failed` };
@@ -4266,6 +5390,10 @@ export class AgentManager {
                 ? group?.find(agent => agent.role === 'qa')?.id
                 : fresh.qaAgentId;
             const researchId = initiallyUnassigned && cfg.role === 'research' ? cfg.id : fresh.researchAgentId;
+            // Pin every participant's generation (mirror createTask) so a member deleted→recreated before the active write isn't baked in.
+            const participantGens = new Map([devId, ...(qaId ? [qaId] : []), ...(researchId ? [researchId] : [])]
+                .map(pid => [pid, this.deletionGenerationOf(pid)]));
+            const participantsFresh = () => [...participantGens].every(([pid, gen]) => this.deletionGenerationOf(pid) === gen && !this.isDeletionInFlight(pid));
             const claimedTask = {
                 ...fresh,
                 preferredAgentId: agentId,
@@ -4277,18 +5405,76 @@ export class AgentManager {
                 status: 'in_progress',
                 updatedAt: now,
             };
-            await this.taskStore.set(claimedTask);
-            await this.agentStore.update(agentId, (existing) => ({
-                id: agentId,
-                projectId: cfg.projectId,
-                taskId,
-                lockToken,
-                bootstrappingTaskId: taskId,
-                updatedAt: now,
-                ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
-                ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
-                ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
-            }));
+            // Binding-first: the fresh task snapshot already exists on disk, so a failure at any later
+            // step leaves at worst a stale binding to a still-unclaimed task — an existing reclaimable state.
+            const releaseLock = async () => {
+                try {
+                    await this.lockManager.releaseIfOwner(agentId, taskId, lockToken);
+                }
+                catch (releaseErr) {
+                    console.warn(`[AgentManager] claimTask(${taskId}): lock release after failed claim also failed:`, releaseErr);
+                }
+            };
+            let commit;
+            try {
+                commit = await this.agentStore.update(agentId, (existing) => {
+                    if (existing === null && !this.bindingInitPredicate(agentId, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    if (!this.deletionGateOpen(agentId, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    return {
+                        id: agentId,
+                        projectId: cfg.projectId,
+                        taskId,
+                        lockToken,
+                        bootstrappingTaskId: taskId,
+                        updatedAt: now,
+                        ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
+                        ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
+                        ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
+                    };
+                });
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            if (commit !== 'committed') {
+                await releaseLock();
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
+            // Re-verify lock ownership + preferred/participant generations before the active write, else a DELETE after the binding commit orphans it.
+            if (this.isDeletionInFlight(agentId)
+                || !this.deletionGateOpen(agentId, genAtEntry)
+                || !participantsFresh()
+                || !(await this.lockManager.isOwner(agentId, taskId, lockToken))) {
+                await this.agentStore.update(agentId, (existing) => {
+                    if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                        return AGENT_STORE_NOOP;
+                    const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                    return { ...rest, updatedAt: new Date().toISOString() };
+                });
+                await releaseLock();
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
+            try {
+                await this.taskStore.set(claimedTask);
+            }
+            catch (err) {
+                try {
+                    await this.agentStore.update(agentId, (existing) => {
+                        if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                            return AGENT_STORE_NOOP;
+                        const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                        return { ...rest, updatedAt: new Date().toISOString() };
+                    });
+                }
+                catch (rollbackErr) {
+                    console.warn(`[AgentManager] claimTask(${taskId}): binding rollback after task write failure also failed (stale-binding path will reclaim):`, rollbackErr);
+                }
+                await releaseLock();
+                throw err;
+            }
             await this.safeEmit({
                 id: '',
                 type: 'task.assigned',
@@ -4306,7 +5492,7 @@ export class AgentManager {
             return claim;
         const claimed = claim.task;
         const signalToken = createSignalToken();
-        await this.updateTask(claimed.id, { signalToken });
+        await this.updateTask(claimed.id, this.dispatchTokenFields(claimed, signalToken));
         let started = false;
         let dispatchErr = null;
         const initialDispatch = this.resolveInitialDispatch(claimed);
@@ -4388,6 +5574,8 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             throw new Error(`Unknown agent: ${agentId}`);
+        // Pin the incarnation: a DELETE completing during dispatch bumps this, and every gated commit/side-effect below refuses the stale generation.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const task = await this.taskStore.get(taskId);
         if (!task)
             throw new Error(`Unknown task: ${taskId}`);
@@ -4433,6 +5621,11 @@ export class AgentManager {
             return false;
         }
         const assertOwner = async () => {
+            // Also gate on the entry generation: a DELETE→same-id recreate can pass the task/lock check on the
+            // reused binding, so every Workdir/runtime side-effect guarded by assertOwner must fail closed on it.
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new Error(`Agent ${agentId} is being deleted or was recreated for task ${taskId}; operation aborted`);
+            }
             const stateNow = await this.agentStore.get(agentId);
             if (stateNow?.taskId !== taskId || stateNow.lockToken !== lockToken) {
                 throw new Error(`Agent ${agentId} binding changed for task ${taskId}; operation aborted`);
@@ -4443,10 +5636,10 @@ export class AgentManager {
         const dialogFailFromStatuses = opts.dialogFailFromStatuses ?? PHASE_EXPECTED_STATUS[phase] ?? [...ACTIVE_TASK_STATUSES];
         let ensure;
         try {
-            ensure = await this.ensureSession(agentId, 'runtime');
+            ensure = await this.ensureSession(agentId, 'runtime', { expectedGeneration: genAtEntry });
         }
         catch (err) {
-            if (await this.handleDialogPendingFromRuntime(agentId, err, { expectedFromStatuses: dialogFailFromStatuses })) {
+            if (await this.handleDialogPendingFromRuntime(agentId, err, { expectedFromStatuses: dialogFailFromStatuses, expectedGeneration: genAtEntry })) {
                 throw err;
             }
             if (err instanceof EnsureSessionError && err.partial.createdSession) {
@@ -4464,7 +5657,7 @@ export class AgentManager {
             }
             throw err;
         }
-        const { paneId, workdir } = ensure;
+        const { paneId, pane, workdir } = ensure;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const branchManager = new BranchManager(runner);
@@ -4472,7 +5665,15 @@ export class AgentManager {
         if (!lockState || lockState.taskId !== taskId || lockState.lockToken !== lockToken)
             return false;
         await assertOwner();
-        await this.waitForReplPromptReady(tmux, paneId, agent.runtime, this.cleanComposerWaitMs);
+        try {
+            await this.waitForReplPromptReady(tmux, pane, agent.runtime, this.cleanComposerWaitMs, { stableIdle: true });
+        }
+        catch (err) {
+            const busyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (busyPend)
+                throw busyPend;
+            throw err;
+        }
         const isServerQaPhase = phase === 'server-review' || phase === 'server-recheck' || phase === 'server-spec-review';
         const isServerCodeReviewPhase = phase === 'server-review' || phase === 'server-recheck';
         let reviewCheckout;
@@ -4508,12 +5709,15 @@ export class AgentManager {
             }
             await assertOwner();
             if (!ensure.freshRuntime) {
-                await this.clearRuntimeForTaskBoundary(tmux, paneId, agentId, agent.runtime, assertOwner);
+                await this.clearRuntimeForTaskBoundary(tmux, pane, agentId, agent.runtime, assertOwner);
                 if (ensure.skillsStale)
                     await this.tagSessionSkillsVersion(tmux, agentId, ensure.sessionRef);
             }
         }
         catch (err) {
+            const busyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (busyPend)
+                throw busyPend;
             const message = err instanceof Error ? err.message : String(err);
             const holdPhase = err instanceof DirtyWorkdirError
                 ? 'dirty-workdir'
@@ -4658,12 +5862,20 @@ export class AgentManager {
         let agentMarkedRunning = false;
         try {
             let cancelHoldWon = false;
-            await this.agentStore.update(agentId, (existing) => {
+            let deletedDuringDispatch = false;
+            const runningCommit = await this.agentStore.update(agentId, (existing) => {
                 if (isCancelCleanupHold(existing)) {
                     cancelHoldWon = true;
                     return AGENT_STORE_NOOP;
                 }
+                // Binding must already exist and still hold our lock; never re-create a deleted agent's state nor write under a bumped deletion generation (ABA).
+                if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken
+                    || !this.deletionGateOpen(agentId, genAtEntry)) {
+                    deletedDuringDispatch = true;
+                    return AGENT_STORE_NOOP;
+                }
                 return {
+                    ...existing,
                     id: agentId,
                     projectId: agent.projectId,
                     paneId,
@@ -4673,7 +5885,6 @@ export class AgentManager {
                     startedAt: now,
                     bootstrappingTaskId: taskId,
                     updatedAt: now,
-                    ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
                 };
             });
             if (cancelHoldWon) {
@@ -4682,8 +5893,39 @@ export class AgentManager {
                 await cleanupCheckoutOrHold();
                 return false;
             }
+            if (deletedDuringDispatch || runningCommit !== 'committed') {
+                console.warn(`[AgentManager] startSession[${phase}]: agent ${agentId} binding vanished or was deleted/recreated ` +
+                    `during dispatch; not marking running (no orphan state)`);
+                return false;
+            }
             agentMarkedRunning = true;
-            await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime);
+            // armed pass 的 fence 延伸到最终 paste：checkout//clear/artifacts 的 await 窗口里 pass 可被
+            // push/其他 dispatcher 轮换，旧 prompt 不得注入 successor；guard 在 composer/paste/Enter
+            // 的 task-mutation 队列槽内复核（与轮换串行），漂移即放弃投递。
+            // cancel 只写终态不轮换 token，故 fence 须同时复核任务仍处本相位的可投递状态
+            const passDeliverableStatuses = opts.dialogFailFromStatuses ?? PHASE_EXPECTED_STATUS[phase] ?? [...ACTIVE_TASK_STATUSES];
+            const passStillArmed = opts.dispatchPassToken !== undefined
+                ? async () => {
+                    const freshTask = await this.taskStore.get(taskId);
+                    if (!freshTask || freshTask.signalToken !== opts.dispatchPassToken)
+                        return false;
+                    return passDeliverableStatuses.includes(freshTask.status);
+                }
+                : undefined;
+            if (passStillArmed && !(await passStillArmed())) {
+                console.warn(`[AgentManager] startSession[${phase}]: review pass superseded before injection for task ${taskId}; aborting paste`);
+                return false;
+            }
+            const injectResult = await this.injectAndAwaitAck(tmux, pane, prompt, agentId, agent.runtime, passStillArmed);
+            if (injectResult.aborted === true) {
+                console.warn(`[AgentManager] startSession[${phase}]: injection fenced off (pass superseded) for task ${taskId}`);
+                return false;
+            }
+            // prompt 已确认投递：只 CAS 清理本次派发那一代的登记；successor 在窗口内登记的新 pending 不受影响，
+            // 且清理先于可失败的审计事件——事件写失败不能把已投递的 prompt 重新变回 pending
+            if (opts.dispatchPassToken !== undefined) {
+                this.clearPendingDispatchRetryIfMatches(taskId, { agentId, signalToken: opts.dispatchPassToken });
+            }
             try {
                 await this.clearBootstrapMarker(agentId, taskId);
             }
@@ -4707,6 +5949,11 @@ export class AgentManager {
             return true;
         }
         catch (err) {
+            // 注入阶段的忙碌（预注入活回合检查）仍在任何按键之前：登记 pending 并保持 checkout/绑定原样，
+            // 在途回合还在使用该工作树，park/release 会拽走它
+            const injectBusyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (injectBusyPend)
+                throw injectBusyPend;
             const isAckUnknown = err instanceof DispatchTerminalError && err.reason === 'ack_unknown';
             if (!isAckUnknown) {
                 await cleanupCheckoutOrHold();
@@ -4749,7 +5996,7 @@ export class AgentManager {
             throw err;
         }
     }
-    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime, guardBeforePaste) {
+    async injectAndAwaitAck(tmux, pane, prompt, agentId, runtime, guardBeforePaste) {
         const before = await this.agentStore.get(agentId);
         const beforeLockToken = before?.taskId
             ? await this.resolveTaskLockToken(before, before.taskId)
@@ -4801,21 +6048,22 @@ export class AgentManager {
             if (guardBeforePaste && !(await guardBeforePaste())) {
                 return { acked: false, composerDelivered: false, aborted: true };
             }
-            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste);
+            return await this.injectAndAwaitAckSteps(tmux, pane, prompt, agentId, runtime, revalidate, guardBeforePaste);
         }
         finally {
             this.compactInFlight.delete(agentId);
         }
     }
-    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste) {
+    async injectAndAwaitAckSteps(tmux, pane, prompt, agentId, runtime, revalidate, guardBeforePaste) {
+        const paneId = pane.paneId;
         // 静态忙信号（文本忙样式/working title）可能是残稿或 stale title 冒充，一律由帧活性仲裁；ready 视图覆盖 stale title。
-        const preTitle = await tmux.readPaneTitle(paneId);
-        const preFrame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+        const preTitle = await tmux.readPaneTitle(pane);
+        const preFrame = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
         const staticBusy = hasOscTitleWorking(preTitle)
             ? (runtimeBusyCheck(preFrame, runtime) || !hasRuntimeReadyView(preFrame, runtime))
             : runtimeBusyCheck(preFrame, runtime);
-        if (staticBusy && await this.paneHasLiveTurn(tmux, paneId, runtime)) {
-            throw new Error(`pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
+        if (staticBusy && await this.paneHasLiveTurn(tmux, pane, runtime)) {
+            throw new ReplNotReadyError(paneId, runtime, preFrame, `pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
         }
         await revalidate?.();
         if (guardBeforePaste) {
@@ -4830,7 +6078,7 @@ export class AgentManager {
                 pasted = await this.withTaskLock(async () => {
                     if (!(await guardBeforePaste()))
                         return false;
-                    await tmux.clearComposerDraft(paneId);
+                    await tmux.clearComposerDraft(pane);
                     await tmux.pasteStagedBuffer(paneId, staged.buf);
                     return true;
                 });
@@ -4847,7 +6095,7 @@ export class AgentManager {
                 }
                 if (bufferConsumed) {
                     try {
-                        await tmux.clearComposerDraft(paneId);
+                        await tmux.clearComposerDraft(pane);
                     }
                     catch (clearErr) {
                         console.warn(`[AgentManager] composer scrub after unknown paste outcome failed for pane ${paneId}:`, clearErr);
@@ -4866,26 +6114,26 @@ export class AgentManager {
             }
         }
         else {
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             await revalidate?.();
-            await tmux.injectPrompt(paneId, prompt, agentId);
+            await tmux.injectPrompt(pane, prompt, agentId);
         }
         let baseline;
         let baselineTitle = '';
         try {
-            baseline = await tmux.captureSettledSnapshot(paneId, { timeoutMs: this.dispatchSettleTimeoutMs });
-            baselineTitle = await tmux.readPaneTitle(paneId);
+            baseline = await tmux.captureSettledSnapshot(pane, { timeoutMs: this.dispatchSettleTimeoutMs });
+            baselineTitle = await tmux.readPaneTitle(pane);
             if (guardBeforePaste) {
                 // The Enter is the actual submission; it takes the same fenced queue slot.
                 const submitted = await this.withTaskLock(async () => {
                     if (!(await guardBeforePaste()))
                         return false;
-                    await tmux.sendEnter(paneId);
+                    await tmux.sendEnter(pane);
                     return true;
                 });
                 if (!submitted) {
                     try {
-                        await tmux.clearComposerDraft(paneId);
+                        await tmux.clearComposerDraft(pane);
                     }
                     catch (err) {
                         // Fail closed: a submit-ready stale prompt could not be confirmed gone.
@@ -4896,18 +6144,18 @@ export class AgentManager {
                 }
             }
             else {
-                await tmux.sendEnter(paneId);
+                await tmux.sendEnter(pane);
             }
         }
         catch (preAckErr) {
-            if (await this.clearComposerForReuse(tmux, paneId, agentId))
+            if (await this.clearComposerForReuse(tmux, pane, agentId))
                 throw preAckErr;
             const message = preAckErr instanceof Error ? preAckErr.message : String(preAckErr);
             throw new DispatchTerminalError('ack_unknown', `pre-ack failure left an unconfirmed composer on live pane ${paneId}: ${message}`);
         }
         let staleDuringResend = false;
         try {
-            await tmux.waitSubmitAck(paneId, baseline, runtime, {
+            await tmux.waitSubmitAck(pane, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
                 resend: guardBeforePaste
@@ -4916,13 +6164,13 @@ export class AgentManager {
                         const resent = await this.withTaskLock(async () => {
                             if (!(await guardBeforePaste()))
                                 return false;
-                            await tmux.sendEnter(paneId);
+                            await tmux.sendEnter(pane);
                             return true;
                         });
                         if (!resent)
                             staleDuringResend = true;
                     }
-                    : () => tmux.sendEnter(paneId),
+                    : () => tmux.sendEnter(pane),
                 resendIntervalMs: this.dispatchAckResendIntervalMs,
             });
             return { acked: true, composerDelivered: true };
@@ -4934,7 +6182,7 @@ export class AgentManager {
             }
             if (staleDuringResend) {
                 try {
-                    await tmux.clearComposerDraft(paneId);
+                    await tmux.clearComposerDraft(pane);
                 }
                 catch (scrubErr) {
                     const scrubMessage = scrubErr instanceof Error ? scrubErr.message : String(scrubErr);
@@ -4956,9 +6204,10 @@ export class AgentManager {
             return { acked: false, composerDelivered };
         }
     }
-    async clearComposerForReuse(tmux, paneId, agentId) {
+    async clearComposerForReuse(tmux, pane, agentId) {
+        const paneId = pane.paneId;
         try {
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             return true;
         }
         catch (err) {
@@ -5035,7 +6284,7 @@ export class AgentManager {
             }
             throw err;
         }
-        const { paneId } = ensure;
+        const { paneId, pane } = ensure;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const stateAfterEnsure = await this.agentStore.get(agentId);
@@ -5238,7 +6487,7 @@ export class AgentManager {
             console.warn(`[AgentManager] continueSession[${phase}]: pre-inject guard rejected the paste for task ${taskId}; skipping`);
             return false;
         }
-        const delivery = await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime, guardBeforeInject);
+        const delivery = await this.injectAndAwaitAck(tmux, pane, prompt, agentId, agent.runtime, guardBeforeInject);
         if (delivery.aborted) {
             console.warn(`[AgentManager] continueSession[${phase}]: pre-paste guard rejected the inject for task ${taskId}; skipping`);
             return false;
@@ -5385,6 +6634,13 @@ export class AgentManager {
         }
     }
     async recover() {
+        // 'git' outbox 重投先行：崩溃于「效果已写、通知未达」的窗口由此闭合（spec §6），legacy 任务零涉
+        await this.flushGitOutbox().catch(err => {
+            console.warn('[AgentManager] recover: git outbox flush failed:', err);
+        });
+        await this.retryGitRemoteBranchCleanup().catch(err => {
+            console.warn('[AgentManager] recover: git remote branch cleanup retry failed:', err);
+        });
         const states = await this.agentStore.list();
         await this.releaseOrphanedLocks(states);
         const deferredCleanups = [];
@@ -5423,7 +6679,7 @@ export class AgentManager {
                     continue;
                 if (state.creationToken && !state.taskId) {
                     const ct = state.creationToken;
-                    const pane = result.paneId;
+                    const pane = result.pane;
                     const cfg = agentConfig;
                     const agentId = state.id;
                     void (async () => {
@@ -5432,7 +6688,7 @@ export class AgentManager {
                                 if (!latest || latest.creationToken !== ct)
                                     return AGENT_STORE_NOOP;
                                 const { creationToken: _ct, status: _s, awaitingPhase: _ap, awaitingReason: _ar, awaitingSince: _as, ...ready } = latest;
-                                return { ...ready, paneId: pane, updatedAt: new Date().toISOString() };
+                                return { ...ready, paneId: pane.paneId, updatedAt: new Date().toISOString() };
                             });
                         }
                         else {
@@ -5775,7 +7031,11 @@ export class AgentManager {
             }
             const project = this.getProjectConfig(result.projectId);
             try {
-                if (project) {
+                if (project && result.reviewMode === 'git') {
+                    // close 不附评论（spec §10 有意差异）；deleteBranch 由 isAutoDeletableTaskBranch 守卫
+                    await this.platformClosePr(taskId, { deleteBranch: true });
+                }
+                else if (project) {
                     const close = await execNetwork(this.platformRunner, `gh pr close ${publishedCleanup.prNumber} --repo ${shellQuote(repoSlug(project.repo))} ` +
                         `--comment ${shellQuote('Task cancelled in baxian; closing the published PR.')}`, GH_NET);
                     if (close.exitCode !== 0)
@@ -5784,6 +7044,26 @@ export class AgentManager {
             }
             catch (err) {
                 console.warn(`[AgentManager] cancelTask remote retirement failed for ${taskId}:`, err);
+                if (result.reviewMode === 'git') {
+                    await this.withTaskLock(async () => {
+                        const fresh = await this.taskStore.get(taskId);
+                        if (!fresh)
+                            return;
+                        await this.taskStore.set({
+                            ...fresh,
+                            branchCleanupPending: {
+                                agentId: fresh.devAgentId,
+                                reason: err instanceof PlatformCloseError && err.step === 'close'
+                                    ? 'remote-close-failed'
+                                    : 'remote-delete-failed',
+                                updatedAt: new Date().toISOString(),
+                            },
+                            updatedAt: new Date().toISOString(),
+                        });
+                    }).catch(persistErr => {
+                        console.warn(`[AgentManager] cancelTask cleanup marker persist failed for ${taskId}:`, persistErr);
+                    });
+                }
                 await this.emitIntervention(result.projectId, undefined, taskId, {
                     phase: 'cancel-published-artifact-cleanup-failed',
                     afterDone: publishedCleanup.afterDone,
@@ -5826,19 +7106,22 @@ export class AgentManager {
     async dispatchReviewToQa(taskId, opts = {}) {
         const claim = await this.withTaskLock(async () => {
             if (this.manualReviewInFlight.has(taskId)) {
-                throw new ApiError(409, `Manual review already in progress for task ${taskId}`);
+                throw new ApiError(409, `Manual review already in progress for task ${taskId}`, 'dispatch-in-flight');
             }
             if (this.markCompleteInFlight.has(taskId)) {
-                throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`);
+                throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`, 'dispatch-in-flight');
             }
             const task = await this.taskStore.get(taskId);
             if (!task)
                 throw new ApiError(404, `Task ${taskId} not found`);
             if (opts.fromStatus && !opts.fromStatus.includes(task.status)) {
-                throw new ApiError(409, `Task ${taskId} status is ${task.status}; review dispatch requires ${opts.fromStatus.join('/')}`);
+                throw new ApiError(409, `Task ${taskId} status is ${task.status}; review dispatch requires ${opts.fromStatus.join('/')}`, 'dispatch-superseded');
             }
             if (opts.expectSignalToken !== undefined && task.signalToken !== opts.expectSignalToken) {
-                throw new ApiError(409, `Task ${taskId} review pass changed during redispatch (signalToken rotated); aborting`);
+                throw new ApiError(409, `Task ${taskId} review pass changed during redispatch (signalToken rotated); aborting`, 'dispatch-superseded');
+            }
+            if (opts.expectReviewDispatchPending === true && task.reviewDispatchPending !== true) {
+                throw new ApiError(409, `Task ${taskId} review dispatch pending was already consumed; aborting stale sweep`, 'dispatch-superseded');
             }
             if (task.reviewMode === 'server' || isSpecStagePhase(task.phase)) {
                 if (!MANUAL_SERVER_REVIEW_STATUSES.includes(task.status)) {
@@ -5879,17 +7162,33 @@ export class AgentManager {
                 throw new ApiError(409, `Task ${taskId} QA participant ${qaId} is unavailable`);
             }
             this.manualReviewInFlight.add(taskId);
-            return { mode: 'github', qaId, devAgentId: task.agentId, taskStatusAtClaim: task.status };
+            return {
+                mode: 'github',
+                qaId,
+                devAgentId: task.agentId,
+                taskStatusAtClaim: task.status,
+                signalTokenAtClaim: task.signalToken,
+                reviewRoundAtClaim: task.reviewRound,
+            };
         });
         if (claim.mode === 'server') {
             return this.runManualServerReview(taskId, claim);
         }
         try {
-            const { qaId, devAgentId, taskStatusAtClaim } = claim;
+            const { qaId, devAgentId, taskStatusAtClaim, signalTokenAtClaim, reviewRoundAtClaim } = claim;
             const isTerminal = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            const qaPhase = taskStatusAtClaim === 'pending' || taskStatusAtClaim === 'in_progress'
-                ? 'review'
-                : 'recheck';
+            // 相位恢复归标准入口自己（手工 review API 与各补派方一视同仁）：同代 pending 登记的
+            // 原始相位最权威；重启丢登记时以持久化 round=0 兜底——轮次送达才入账，故 0 即首评从未送达
+            const pendingEntry = this.getPendingDispatchRetry(taskId);
+            const queuedPhase = pendingEntry?.kind === 'qa-recheck'
+                && pendingEntry.signalToken === signalTokenAtClaim
+                ? pendingEntry.qaPhase
+                : undefined;
+            const qaPhase = opts.qaPhase
+                ?? queuedPhase
+                ?? (taskStatusAtClaim === 'pending' || taskStatusAtClaim === 'in_progress' || reviewRoundAtClaim === 0
+                    ? 'review'
+                    : 'recheck');
             const prevQa = await this.agentStore.get(qaId);
             const resumingHeldDispatch = prevQa?.taskId === taskId && prevQa.status === 'awaiting_human';
             if (prevQa?.taskId === taskId) {
@@ -5914,12 +7213,13 @@ export class AgentManager {
                     throw new ApiError(409, `QA agent ${qaId} could not be released from task ${taskId}${holdNote}; review dispatch aborted`);
                 }
             }
-            const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase);
+            let acquiredLockToken;
+            const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase, {
+                onAcquired: (lockToken) => { acquiredLockToken = lockToken; },
+            });
             if (!acquired) {
                 throw new ApiError(409, `QA agent ${qaId} is busy or unavailable`);
             }
-            const acquiredClaim = await this.lockManager.claimOf(qaId);
-            const acquiredLockToken = acquiredClaim?.taskId === taskId ? acquiredClaim.token : undefined;
             const releaseOwnAcquire = acquiredLockToken !== undefined
                 ? { expectedLockToken: acquiredLockToken }
                 : {};
@@ -5946,22 +7246,64 @@ export class AgentManager {
                 signalToken: pre?.signalToken,
                 reviewHeadAnchorSha: pre?.reviewHeadAnchorSha,
                 reviewDispatchedAt: pre?.reviewDispatchedAt,
+                reviewRoundPending: pre?.reviewRoundPending,
+                passToken: pre?.passToken,
+                failToken: pre?.failToken,
             };
             const isTerminalAtClaim = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮
-            const bumpRound = opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review');
+            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮。
+            // 显式 bumpRound:true 是补派方读到 reviewRoundPending 后的权威意图（该轮从未计数），越过恢复期抑制
+            const bumpRound = opts.bumpRound === true
+                || (opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review'));
             // 回滚在锁内判定 pass 是否已被并发接管并返回；仅未被接管时才释放本次 acquire 的 QA，
             // 否则会误清接管方 re-acquire 的同一 QA 绑定（同 task 同 agent，绕过 release 的 mismatch 保护）
             const abortDispatch = async (dispatchToken) => {
-                const takenOver = await this.rollbackDispatchReviewPhase1(taskId, taskStatusAtClaim, isTerminalAtClaim, snapshot, bumpRound, dispatchToken);
+                const takenOver = await this.rollbackDispatchReviewPhase1(taskId, taskStatusAtClaim, isTerminalAtClaim, snapshot, dispatchToken);
                 if (!takenOver)
-                    await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => undefined);
+                    await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                 if (devParked)
                     await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
             };
             let transitionToken;
+            let reviewAnchor;
             if (!isTerminalAtClaim) {
-                const reviewAnchor = await this.fetchPrHeadSha(taskId).catch(() => undefined);
+                let gitDispatchBlocked;
+                const anchorViaDriver = async () => {
+                    const preTask = await this.taskStore.get(taskId);
+                    if (preTask?.prNumber === undefined) {
+                        gitDispatchBlocked = 'no bound PR';
+                        return undefined;
+                    }
+                    // 与收编/pr-fixed/merge 同一完整谓词：closed/draft/retarget 的 PR 派出去只会造出
+                    // 不可裁决的评审轮（spec §6 统一谓词）
+                    const verify = await this.platformVerifyPrBinding(taskId, preTask.prNumber);
+                    if (!verify.ok) {
+                        gitDispatchBlocked = `binding ${verify.reason}`;
+                        return undefined;
+                    }
+                    return PLATFORM_HEAD_SHA_RE.test(verify.headSha) ? verify.headSha : undefined;
+                };
+                const isGitDispatch = (await this.taskStore.get(taskId))?.reviewMode === 'git';
+                reviewAnchor = await (isGitDispatch ? anchorViaDriver() : this.fetchPrHeadSha(taskId))
+                    .catch(() => undefined);
+                if (isGitDispatch && reviewAnchor === undefined) {
+                    // 无锚评审轮不可裁决（verdictEligible 要求 anchorSha 且 pane verdict 已退役）：
+                    // 派出去只会卡死在 review，fail loud 让调用方看到确定性原因或重试瞬态失败
+                    const released = await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => false);
+                    if (!released) {
+                        // 预检失败叠加释放失败：QA 仍绑定会让下一次派发报 busy，必须显式暴露
+                        const blockedTask = await this.taskStore.get(taskId);
+                        await this.emitIntervention(blockedTask?.projectId ?? '', qaId, taskId, {
+                            phase: 'qa-release-failed-after-precheck',
+                            qaAgentId: qaId,
+                        }).catch(() => undefined);
+                    }
+                    if (devParked)
+                        await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
+                    throw gitDispatchBlocked !== undefined
+                        ? new ApiError(409, `Cannot dispatch git review for ${taskId}: ${gitDispatchBlocked}`)
+                        : new ApiError(502, `Cannot anchor the review round for ${taskId}: platform prView failed`);
+                }
                 const preDispatched = await this.transitionTaskStatus(taskId, 'review', {
                     fromStatus: [taskStatusAtClaim],
                     // 入口 claim 到此处之间 pass 可能被并发轮换；expect token 必须与写入同一原子段复核
@@ -5970,13 +7312,18 @@ export class AgentManager {
                     reviewHeadAnchorSha: reviewAnchor,
                     reviewDispatchedAt: new Date().toISOString(),
                     signalToken: createSignalToken(),
+                    // 未计轮 intent 与进入 review 同一原子写：两写之间崩溃会留下「有派发可重放、却无轮次可补计」
+                    // 的状态，恢复后首评仍停在旧轮
+                    ...(bumpRound ? { reviewRoundPending: true } : {}),
+                    // pair/pending 与新轮锚点同一原子写可见（spec §7）：两写之间崩溃不得留下无 pending 的新轮
+                    ...(isGitDispatch ? { ...this.mintReviewTokenPair(), reviewDispatchPending: true } : {}),
                 });
                 if (!preDispatched) {
                     // fence 拒绝可能源于 successor 已换代并 re-acquire 同一 QA；释放必须钉在本次 acquire 的锁代上
                     await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                     if (devParked)
                         await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
-                    throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`);
+                    throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`, 'dispatch-superseded');
                 }
                 transitionToken = preDispatched.task.signalToken;
             }
@@ -5990,10 +7337,18 @@ export class AgentManager {
                 if (!isTerminalAtClaim && (fresh.status !== 'review' || fresh.signalToken !== transitionToken)) {
                     return { ok: false, reason: fresh.status !== 'review' ? `status=${fresh.status}` : 'pass superseded' };
                 }
+                // 并发 push 在 prView 读取与本提交之间前进 head 时，本次手动锚点已陈旧（TOCTOU）
+                if (fresh.reviewMode === 'git' && fresh.latestHeadSha !== undefined
+                    && reviewAnchor !== undefined && fresh.latestHeadSha !== reviewAnchor) {
+                    return { ok: false, reason: 'head advanced past the manual anchor' };
+                }
                 await this.taskStore.set({
                     ...fresh,
-                    reviewRound: bumpRound ? fresh.reviewRound + 1 : fresh.reviewRound,
+                    // 计轮送达时才落账：claim 段只持久化「未计轮」intent（与 push 直派链路同构），
+                    // busy/hold/崩溃等一切未送达出口都保留 intent，任何补派方（含重启后）恰好补计一次
+                    ...(bumpRound ? { reviewRoundPending: true } : {}),
                     signalToken: armedToken,
+                    ...(fresh.reviewMode === 'git' ? { reviewDispatchPending: true } : {}),
                     updatedAt: new Date().toISOString(),
                 });
                 return { ok: true };
@@ -6001,9 +7356,14 @@ export class AgentManager {
             if (!claim2.ok) {
                 // 未写入 armedToken：task 仍持 transitionToken，或已被接管方 rotate/漂移 → 用 transitionToken 判 takeover
                 await abortDispatch(transitionToken);
-                throw new ApiError(409, `Task ${taskId} left its review pass during dispatch (${claim2.reason})`);
+                throw new ApiError(409, `Task ${taskId} left its review pass during dispatch (${claim2.reason})`, 'dispatch-superseded');
+            }
+            opts.onPassArmed?.(armedToken);
+            const dispatchTaskAfterClaim = await this.taskStore.get(taskId);
+            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken, dispatchTaskAfterClaim?.reviewMode === 'git' ? { replaceScope: 'agent' } : {});
+            if (armed && dispatchTaskAfterClaim?.reviewMode === 'git') {
+                await this.rearmGitReconciliationWatcher(taskId);
             }
-            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken);
             if (!armed) {
                 await abortDispatch(armedToken);
                 throw new ApiError(500, `Failed to arm review verdict watcher for ${taskId}`);
@@ -6013,7 +7373,7 @@ export class AgentManager {
                 const preStart = await this.taskStore.get(taskId);
                 if (!preStart || !opts.fromStatus.includes(preStart.status) || preStart.signalToken !== armedToken) {
                     await abortDispatch(armedToken);
-                    throw new ApiError(409, `Task ${taskId} left ${opts.fromStatus.join('/')} during dispatch (now ${preStart?.status ?? 'gone'})`);
+                    throw new ApiError(409, `Task ${taskId} left ${opts.fromStatus.join('/')} during dispatch (now ${preStart?.status ?? 'gone'})`, 'dispatch-superseded');
                 }
             }
             let started = false;
@@ -6021,6 +7381,8 @@ export class AgentManager {
                 started = await this.startSession(taskId, qaId, qaPhase, {
                     bypassTaskStatusGate: true,
                     dialogFailFromStatuses: [isTerminalAtClaim ? taskStatusAtClaim : 'review'],
+                    dispatchPassToken: armedToken,
+                    ...(opts.pendingBudget !== undefined ? { dispatchPendingBudget: opts.pendingBudget } : {}),
                 });
             }
             catch (err) {
@@ -6034,6 +7396,13 @@ export class AgentManager {
                     }
                     throw err;
                 }
+                if (err instanceof EnsureSessionError && err.partial.busyPending) {
+                    // 遇忙不算失败：pass 保持 armed、QA 保持绑定、未计轮 intent 原样在库（送达时才消费），
+                    // 由对账按 pending 登记补派
+                    console.warn(`[AgentManager] dispatchReviewToQa: QA busy for ${taskId}; dispatch queued (${err.message})`);
+                    const pending = await this.taskStore.get(taskId);
+                    return pending;
+                }
                 if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                     await abortDispatch(armedToken);
                 }
@@ -6043,6 +7412,8 @@ export class AgentManager {
                 await abortDispatch(armedToken);
                 throw new ApiError(500, `Failed to start QA review session for ${taskId}`);
             }
+            await this.consumeReviewRoundIntent(taskId, armedToken);
+            await this.clearReviewDispatchPending(taskId, armedToken);
             const final = await this.taskStore.get(taskId);
             return final;
         }
@@ -6182,7 +7553,7 @@ export class AgentManager {
     // 返回 qaTakenOverInReview：仍在 review 但 token 已换代 = 另一 dispatcher 已 release+acquire 同一 QA
     // （同 task 同 agent，releaseAgentForTask 的 mismatch 保护不设防），此时调用方不得再 release QA。
     // 判定在回滚同一锁段内基于 fresh 完成，是那一刻的权威结论——不受本函数随后恢复 snapshot token 的影响。
-    async rollbackDispatchReviewPhase1(taskId, originalStatus, isTerminalAtClaim, snapshot, roundBumped, dispatchToken) {
+    async rollbackDispatchReviewPhase1(taskId, originalStatus, isTerminalAtClaim, snapshot, dispatchToken) {
         let qaTakenOverInReview = false;
         await this.withTaskLock(async () => {
             const fresh = await this.taskStore.get(taskId);
@@ -6192,24 +7563,25 @@ export class AgentManager {
             if (!isTerminalAtClaim && TERMINAL_STATUSES.includes(fresh.status))
                 return;
             // transition 后的中间态恒为 review 且持有本次 dispatch 的 token；status 漂移（如 REQUEST_CHANGES→fixing）
-            // 或 review 内 token 换代（push recheck 接管）都表示 pass 已归并发推进方所有，只撤本次 dispatch 的轮次残留
+            // 或 review 内 token 换代（push recheck 接管）都表示 pass 已归并发推进方所有。
+            // 计轮送达时才落账，claim 段无轮次残留可撤——drift 后不覆盖接管方的任何写入
             const passTakenOver = dispatchToken !== undefined && fresh.signalToken !== dispatchToken;
             qaTakenOverInReview = !isTerminalAtClaim && fresh.status === 'review' && passTakenOver;
             const drifted = !isTerminalAtClaim && (fresh.status !== 'review' || passTakenOver);
-            // 只在本次 dispatch 仍拥有该 pass（未 drift）且确实 bump 过时才撤回 +1；
-            // drift 后 reviewRound 归接管方所有（它可能基于此再 bump），一律不减
-            const rolledRound = (!drifted && roundBumped) ? Math.max(0, fresh.reviewRound - 1) : fresh.reviewRound;
-            const next = drifted
-                ? { ...fresh, reviewRound: rolledRound, updatedAt: new Date().toISOString() }
-                : {
-                    ...fresh,
-                    reviewRound: rolledRound,
-                    qaAgentId: snapshot.qaAgentId,
-                    signalToken: snapshot.signalToken,
-                    reviewDispatchedAt: snapshot.reviewDispatchedAt,
-                    updatedAt: new Date().toISOString(),
-                };
-            if (!isTerminalAtClaim && !drifted) {
+            if (drifted)
+                return;
+            const next = {
+                ...fresh,
+                qaAgentId: snapshot.qaAgentId,
+                signalToken: snapshot.signalToken,
+                reviewDispatchedAt: snapshot.reviewDispatchedAt,
+                reviewRoundPending: snapshot.reviewRoundPending,
+                // 本代新铸的 pair 从未交付 QA：不随快照恢复会让旧 QA 的在途 verdict 被拒、新 pair 无人知
+                passToken: snapshot.passToken,
+                failToken: snapshot.failToken,
+                updatedAt: new Date().toISOString(),
+            };
+            if (!isTerminalAtClaim) {
                 next.status = originalStatus;
                 next.reviewHeadAnchorSha = snapshot.reviewHeadAnchorSha;
             }
@@ -6224,8 +7596,10 @@ export class AgentManager {
             return qaTakenOverInReview;
         }
         if (afterRollback?.status === 'approved') {
-            const completion = await this.postApproveStore.get(taskId);
-            const task = await this.taskStore.get(taskId);
+            const completion = afterRollback.reviewMode === 'git'
+                ? this.gitCompletionOf(afterRollback)
+                : await this.postApproveStore.get(taskId);
+            const task = afterRollback;
             if (completion && task) {
                 try {
                     await this.startPhaseSignalWatch({
@@ -6246,21 +7620,30 @@ export class AgentManager {
         const restored = await this.taskStore.get(taskId);
         if (!restored || !restored.signalToken)
             return qaTakenOverInReview;
-        const mapped = this.mapTaskStateToExpectedWatcher(restored);
-        if (!mapped)
+        const mappings = this.mapTaskStateToExpectedWatchers(restored);
+        if (mappings.length === 0)
             return qaTakenOverInReview;
+        for (const mapped of mappings) {
+            try {
+                await this.startPhaseSignalWatch({
+                    taskId,
+                    projectId: restored.projectId,
+                    agentId: mapped.agentId,
+                    expectedKinds: mapped.expectedKinds,
+                    token: mapped.token ?? restored.signalToken,
+                    ...(mappings.length > 1 ? { replaceScope: 'agent' } : {}),
+                });
+            }
+            catch (err) {
+                console.warn(`[AgentManager] rollback: re-establish ${mapped.expectedKinds.join(',')} failed for task=${taskId}:`, err);
+            }
+        }
+        // 回滚路径不得因 tearDown 探测失败上抛：那会顶替调用方本应抛出的 ApiError 并跳过 QA 释放
         try {
-            await this.startPhaseSignalWatch({
-                taskId,
-                projectId: restored.projectId,
-                agentId: mapped.agentId,
-                expectedKinds: mapped.expectedKinds,
-                token: restored.signalToken,
-            });
             await this.tearDownWatcherIfTaskTerminal(taskId);
         }
         catch (err) {
-            console.warn(`[AgentManager] rollback: re-establish ${mapped.expectedKinds.join(',')} failed for task=${taskId}:`, err);
+            console.warn(`[AgentManager] rollback: terminal watcher teardown failed for task=${taskId}:`, err);
         }
         return qaTakenOverInReview;
     }
@@ -6282,6 +7665,22 @@ export class AgentManager {
             return { phase: 'research', kinds: ['spec-done'] };
         return { phase: 'develop', kinds: this.devInitialSignalKinds(task.reviewMode) };
     }
+    mapTaskStateToExpectedWatchers(task) {
+        const single = this.mapTaskStateToExpectedWatcher(task);
+        const mappings = single ? [single] : [];
+        // review 窗口内 dev/QA 双条目并存：review 之外 dev 侧另有 pr-fixed/pr-merge-ready 同 agent
+        // 期望，(taskId, agentId) 基数无法同 agent 双 token 并存——错过窗口按 fail-closed 交人工（spec §5.3 ④）
+        if (task.reviewMode === 'git' && task.status === 'review'
+            && task.replyActorStatus !== 'verified' && task.pendingPrSignalToken !== undefined
+            && task.devAgentId && task.prNumber !== undefined) {
+            mappings.push({
+                expectedKinds: ['pr-created'],
+                agentId: task.devAgentId,
+                token: task.pendingPrSignalToken,
+            });
+        }
+        return mappings;
+    }
     mapTaskStateToExpectedWatcher(task) {
         if (task.reviewMode === 'server')
             return this.mapServerTaskToExpectedWatcher(task);
@@ -6334,8 +7733,9 @@ export class AgentManager {
         const task = await this.taskStore.get(taskId);
         if (!task?.signalToken)
             return false;
-        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, task.signalToken, {
+        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, opts.tokenOverride ?? task.signalToken, {
             skipSnapshot: opts.skipSnapshot ?? false,
+            ...(opts.replaceScope ? { replaceScope: opts.replaceScope } : {}),
         });
     }
     async emitManualReviewDevParkedQaFailedIntervention(agentId, expectedTaskId) {
@@ -6443,6 +7843,17 @@ export class AgentManager {
         if (!project) {
             throw new Error(`mergePr: unknown project ${task.projectId}`);
         }
+        if (task.reviewMode === 'git') {
+            const expectedHeadSha = opts.matchHeadSha ?? task.latestHeadSha;
+            if (!expectedHeadSha)
+                throw new Error(`mergePr: no expected head sha for git task ${taskId}`);
+            // max_rounds 的 Mark complete 在调用前已被转成 merge-ready：override 必须显式随调用链传入
+            await this.platformConfirmMerge(taskId, {
+                expectedHeadSha,
+                ...(opts.humanOverride === true || task.status === 'max_rounds' ? { humanOverride: true } : {}),
+            });
+            return;
+        }
         const matchHead = opts.matchHeadSha
             ? ` --match-head-commit ${shellQuote(opts.matchHeadSha)}`
             : '';
@@ -6517,7 +7928,8 @@ export class AgentManager {
                 throw new ApiError(409, `Task ${taskId} changed status during mark-complete; aborted`);
             }
             try {
-                await this.mergePr(taskId);
+                // 从 max_rounds 认领而来：人工兜底 override 必须显式随调用链传入（此刻 status 已是 merge-ready）
+                await this.mergePr(taskId, { humanOverride: true });
             }
             catch (err) {
                 await this.transitionTaskStatus(taskId, 'max_rounds', { fromStatus: ['merge-ready'] })
@@ -6567,6 +7979,9 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             return;
+        // Pin the incarnation before the first state/paneId read: paneId equality is ABA-blind (a recreated
+        // agent reuses %0), so a DELETE→same-id recreate would otherwise let post-merge /clear hit a new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         if (!state)
             return;
@@ -6581,12 +7996,16 @@ export class AgentManager {
             return;
         }
         if (!state.taskId) {
+            if (this.isDeletionInFlight(agentId))
+                return;
             const lockToken = await this.lockManager.acquire(agentId, ctx.taskId);
             if (!lockToken)
                 return;
-            await this.agentStore.update(agentId, (existing) => {
+            const commit = await this.agentStore.update(agentId, (existing) => {
                 if (!existing)
                     return AGENT_STORE_NOOP;
+                if (!this.deletionGateOpen(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
                 if (existing.taskId && existing.taskId !== ctx.taskId)
                     return AGENT_STORE_NOOP;
                 if (existing.creationToken)
@@ -6601,17 +8020,35 @@ export class AgentManager {
                     lockToken,
                     updatedAt: new Date().toISOString(),
                 };
+            }).catch(async (err) => {
+                await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken).catch((releaseErr) => {
+                    console.warn(`[AgentManager] postMergeCleanup(${agentId}): lock release after commit failure also failed:`, releaseErr);
+                });
+                throw err;
             });
+            if (commit !== 'committed') {
+                await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken);
+                return;
+            }
             const fresh = await this.agentStore.get(agentId);
             if (fresh?.taskId !== ctx.taskId || fresh.lockToken !== lockToken) {
                 await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken);
                 return;
             }
         }
+        // A DELETE→recreate (gen bump) before this pane work must skip it, or /clear lands on the new incarnation's reused pane.
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const runtime = agentRuntimeKindFor(agent);
-        void this.runPostMergeCompaction(tmux, state.paneId, agentId, ctx.taskId, runtime).catch(err => console.warn(`[AgentManager] runPostMergeCompaction(${agentId}) failed:`, err));
+        const expectedPaneId = state.paneId;
+        void (async () => {
+            if (!this.deletionGateOpen(agentId, genAtEntry))
+                return;
+            const pane = await this.resolveClaimedPane(tmux, agentId, expectedPaneId);
+            await this.runPostMergeCompaction(tmux, pane, agentId, ctx.taskId, runtime);
+        })().catch(err => console.warn(`[AgentManager] runPostMergeCompaction(${agentId}) failed:`, err));
     }
     async releasePostMergeAgent(agentId, taskId) {
         const state = await this.agentStore.get(agentId);
@@ -6624,10 +8061,10 @@ export class AgentManager {
             console.warn(`[AgentManager] releasePostMergeAgent: releaseAgentForTask(${agentId}, ${taskId}) failed:`, err);
         }
     }
-    async runPostMergeCompaction(tmux, paneId, agentId, originalTaskId, runtime) {
+    async runPostMergeCompaction(tmux, pane, agentId, originalTaskId, runtime) {
         await this.acquireCompactGuard(agentId);
         try {
-            await this.runPostMergeCompactionSteps(tmux, paneId, agentId, originalTaskId, runtime);
+            await this.runPostMergeCompactionSteps(tmux, pane, agentId, originalTaskId, runtime);
         }
         finally {
             this.compactInFlight.delete(agentId);
@@ -6653,7 +8090,8 @@ export class AgentManager {
         this.compactInFlight.add(agentId);
         return true;
     }
-    async runPostMergeCompactionSteps(tmux, paneId, agentId, originalTaskId, runtime) {
+    async runPostMergeCompactionSteps(tmux, pane, agentId, originalTaskId, runtime) {
+        const paneId = pane.paneId;
         const initial = await this.agentStore.get(agentId);
         if (!initial || initial.taskId !== originalTaskId || initial.paneId !== paneId)
             return;
@@ -6673,13 +8111,13 @@ export class AgentManager {
         let cleared = false;
         let clearError;
         try {
-            cleared = await this.sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, bindingStillOurs);
+            cleared = await this.sendPostMergeSlashCommand(tmux, pane, agentId, runtime, bindingStillOurs);
         }
         catch (err) {
             clearError = err;
         }
         if (!cleared) {
-            if (await this.recoverPostMergeExitedRuntime(tmux, paneId, agentId, originalTaskId, lockToken, runtime)) {
+            if (await this.recoverPostMergeExitedRuntime(tmux, pane, agentId, originalTaskId, lockToken, runtime)) {
                 cleared = true;
             }
             else if (!await bindingStillOurs()) {
@@ -6688,7 +8126,7 @@ export class AgentManager {
             else if (clearError instanceof Error
                 && clearError.message.includes('runtime rejected /clear')) {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
                 }
                 catch (err) {
                     clearError = err;
@@ -6706,10 +8144,11 @@ export class AgentManager {
         }
         await this.releasePostMergeAgent(agentId, originalTaskId);
     }
-    async recoverPostMergeExitedRuntime(tmux, paneId, agentId, taskId, lockToken, runtime) {
+    async recoverPostMergeExitedRuntime(tmux, pane, agentId, taskId, lockToken, runtime) {
+        const paneId = pane.paneId;
         let paneExists = true;
         try {
-            if (hasReplProcTitle(await tmux.displayMessage(paneId, '#{pane_current_command}'), runtime))
+            if (hasReplProcTitle(await tmux.displayMessage(pane, '#{pane_current_command}'), runtime))
                 return false;
         }
         catch (err) {
@@ -6728,7 +8167,7 @@ export class AgentManager {
             return false;
         try {
             if (paneExists)
-                await tmux.sendKeysToPane(paneId, 'C-c');
+                await tmux.sendKeysToPane(pane, 'C-c');
             const ensure = await this.ensureSession(agentId, 'runtime');
             if (!ensure.freshRuntime)
                 return false;
@@ -6757,22 +8196,22 @@ export class AgentManager {
             return false;
         }
     }
-    async sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, bindingStillOurs) {
+    async sendPostMergeSlashCommand(tmux, pane, agentId, runtime, bindingStillOurs) {
         let rejection;
         for (let attempt = 1; attempt <= 2; attempt++) {
             if (!await bindingStillOurs())
                 return false;
-            await tmux.clearComposerDraft(paneId);
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+            await tmux.clearComposerDraft(pane);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
             if (!await bindingStillOurs())
                 return false;
-            await tmux.sendKeysLiteral(paneId, '/clear');
-            await tmux.sendEnter(paneId);
+            await tmux.sendKeysLiteral(pane, '/clear');
+            await tmux.sendEnter(pane);
             await new Promise(r => setTimeout(r, this.compactIdlePollMs));
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
             if (!await bindingStillOurs())
                 return false;
-            if (!await this.hasRuntimeSlashCommandRejection(tmux, paneId, '/clear'))
+            if (!await this.hasRuntimeSlashCommandRejection(tmux, pane, '/clear'))
                 return true;
             rejection = new Error('runtime rejected /clear because a task is still in progress');
             if (attempt < 2) {
@@ -6782,29 +8221,33 @@ export class AgentManager {
         }
         throw rejection ?? new Error('runtime rejected /clear');
     }
-    async hasRuntimeSlashCommandRejection(tmux, paneId, command) {
-        const cap = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+    async hasRuntimeSlashCommandRejection(tmux, pane, command) {
+        const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
         return this.runtimeSlashCommandRejectedPattern(command).test(cap);
     }
     runtimeSlashCommandRejectedPattern(command) {
         return new RegExp(`["'“”‘’]?${command}["'“”‘’]?\\s+is disabled while a task is in progress\\.`, 'gi');
     }
-    async waitForReplPromptReady(tmux, paneId, runtime, timeoutMs) {
+    async waitForReplPromptReady(tmux, pane, runtime, timeoutMs, opts = {}) {
+        if (opts.stableIdle) {
+            return this.waitForReplPromptStableIdle(tmux, pane, runtime, timeoutMs);
+        }
+        const paneId = pane.paneId;
         const deadline = Date.now() + timeoutMs;
-        await tmux.waitReplReady(paneId, runtime, {
+        await tmux.waitReplReady(pane, runtime, {
             timeoutMs,
             intervalMs: this.compactIdlePollMs,
             titleIdleFastPath: true,
         });
         await new Promise(r => setTimeout(r, this.compactIdlePollMs));
         while (true) {
-            const current = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            const current = await tmux.displayMessage(pane, '#{pane_current_command}');
             if (!hasReplProcTitle(current, runtime)) {
                 throw new Error(`waitForReplPromptReady: pane ${paneId} pane_current_command=${current.trim()} (not runtime, REPL may have exited)`);
             }
-            const cap = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+            const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
             const ready = hasRuntimeReadyView(cap, runtime)
-                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(paneId), runtime));
+                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(pane), runtime));
             if (detectRuntimeMenu(cap) || (!ready && detectStartupDialog(cap, runtime))) {
                 throw new Error(`waitForReplPromptReady: pane ${paneId} shows menu/dialog, not a ready REPL prompt`);
             }
@@ -6815,11 +8258,41 @@ export class AgentManager {
                 return;
             }
             if (Date.now() >= deadline) {
-                throw new Error(`waitForReplPromptReady: pane ${paneId} stayed busy past ${timeoutMs}ms`);
+                // 与 stableIdle 分支同一类型：忙碌超时是「常态忙」而非故障，调用方（release/派发）
+                // 据此延后重排；菜单/对话框/REPL 退出等仍是普通 Error，不得被当成可延后
+                throw new ReplNotReadyError(paneId, runtime, cap, `stayed busy past ${timeoutMs}ms`);
             }
             await new Promise(r => setTimeout(r, this.compactIdlePollMs));
         }
     }
+    // 注入前置门：codex 忙碌回合的工具间隙会闪现单帧 idle footer（#558 事故放大器），
+    // 连续 K 帧稳定就绪才放行，任何忙碌/不确定帧清零计数；超时按忙碌分类抛 ReplNotReadyError。
+    async waitForReplPromptStableIdle(tmux, pane, runtime, timeoutMs) {
+        const paneId = pane.paneId;
+        const samples = Math.max(1, this.readyStableSamples);
+        const spacing = this.readyStableSpacingMs;
+        const deadline = Date.now() + timeoutMs + (samples - 1) * spacing;
+        let streak = 0;
+        while (true) {
+            const current = await tmux.displayMessage(pane, '#{pane_current_command}');
+            if (!hasReplProcTitle(current, runtime)) {
+                throw new Error(`waitForReplPromptReady: pane ${paneId} pane_current_command=${current.trim()} (not runtime, REPL may have exited)`);
+            }
+            const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+            const ready = hasRuntimeReadyView(cap, runtime)
+                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(pane), runtime));
+            if (detectRuntimeMenu(cap) || (!ready && detectStartupDialog(cap, runtime))) {
+                throw new Error(`waitForReplPromptReady: pane ${paneId} shows menu/dialog, not a ready REPL prompt`);
+            }
+            streak = ready && !runtimeBusyCheck(cap, runtime) ? streak + 1 : 0;
+            if (streak >= samples)
+                return;
+            if (Date.now() >= deadline) {
+                throw new ReplNotReadyError(paneId, runtime, cap, `stable idle not confirmed within ${timeoutMs}ms (+${(samples - 1) * spacing}ms stability window)`);
+            }
+            await new Promise(r => setTimeout(r, spacing));
+        }
+    }
     stopPhaseSignalWatcher(taskId) {
         this.phaseSignalWatcher?.stop(taskId);
     }
@@ -6847,6 +8320,7 @@ export class AgentManager {
                 token,
                 skipSnapshot: opts.skipSnapshot ?? false,
                 ...(opts.onlyReplaceOwnToken ? { onlyReplaceOwnToken: true } : {}),
+                ...(opts.replaceScope ? { replaceScope: opts.replaceScope } : {}),
                 ...(opts.onReadFile ? { onReadFile: opts.onReadFile } : {}),
             });
         }
@@ -6867,10 +8341,40 @@ export class AgentManager {
         const label = (Array.isArray(expectedKinds) ? [...expectedKinds] : [expectedKinds]).join(',');
         await this.markAwaitingHuman(agentId, `signal-arm-failed:${label}`, 'Pane-signal watcher failed to arm after dispatch; the prompt expects a signal with no consumer. Cancel the task or delete the agent to retry.', { expectedTaskId: taskId });
     }
+    // git 任务的初始 dev 派发把 pr-created 期望 token 独立持久化：评审轮轮换不得使 late
+    // publish 信号失去 reconciliation 凭据（spec §5.3 ④）。
+    dispatchTokenFields(task, signalToken) {
+        const wantsPrCreated = task.reviewMode === 'git'
+            && this.devInitialSignalKinds(task.reviewMode).includes('pr-created');
+        return { signalToken, ...(wantsPrCreated ? { pendingPrSignalToken: signalToken } : {}) };
+    }
+    // review 窗口内 QA verdict arm 之后重建 dev reconciliation 条目（spec §5.3 ④）：approval 路径的
+    // stop(taskId) 与 fix 轮的同键替换都会拆掉它，重入 review 时在此恢复；skipSnapshot=false 让仍在
+    // 面板滚动区的迟到信号立即重放。
+    async rearmGitReconciliationWatcher(taskId, opts = {}) {
+        const task = await this.taskStore.get(taskId);
+        if (!task || task.reviewMode !== 'git' || task.status !== 'review')
+            return;
+        if (task.replyActorStatus === 'verified' || task.pendingPrSignalToken === undefined)
+            return;
+        if (!task.devAgentId || task.prNumber === undefined)
+            return;
+        await this.setupPhaseSignalWatcher(taskId, task.devAgentId, ['pr-created'], task.pendingPrSignalToken, {
+            replaceScope: 'agent',
+            ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+        }).catch(() => false);
+    }
     async rotateAndSetupPhaseSignal(taskId, agentId, expectedKinds) {
         const newToken = createSignalToken();
+        const task = await this.taskStore.get(taskId);
+        const kinds = typeof expectedKinds === 'string' ? [expectedKinds] : [...expectedKinds];
+        const isGit = task?.reviewMode === 'git';
+        // pair 的重铸已随「进入 review 的 transition」单写落盘（spec §7 与新轮可见性原子）；
+        // 这里只轮换 signal token 并布防
         await this.updateTask(taskId, { signalToken: newToken });
-        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken);
+        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken, isGit ? { replaceScope: 'agent' } : {});
+        if (armed && isGit && kinds.includes('pr-approved'))
+            await this.rearmGitReconciliationWatcher(taskId);
         return { token: newToken, armed };
     }
     async rollbackVerdictArmFailure(taskId, restore, opts = {}) {
@@ -6890,6 +8394,10 @@ export class AgentManager {
                 signalToken: restore.signalToken,
                 reviewHeadAnchorSha: restore.reviewHeadAnchorSha,
                 reviewDispatchedAt: restore.reviewDispatchedAt,
+                reviewRoundPending: restore.reviewRoundPending,
+                ...(restore.restorePair === true
+                    ? { passToken: restore.passToken, failToken: restore.failToken }
+                    : {}),
                 updatedAt: new Date().toISOString(),
             });
             return true;
@@ -6907,10 +8415,16 @@ export class AgentManager {
             return;
         if (TERMINAL_STATUSES.includes(task.status))
             return;
-        const mapped = this.mapTaskStateToExpectedWatcher(task);
-        if (!mapped)
+        const mappings = this.mapTaskStateToExpectedWatchers(task);
+        if (mappings.length === 0)
             return;
-        await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds, opts.skipSnapshot ? { skipSnapshot: true } : undefined);
+        for (const mapped of mappings) {
+            await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds, {
+                ...(opts.skipSnapshot ? { skipSnapshot: true } : {}),
+                ...(mappings.length > 1 ? { replaceScope: 'agent' } : {}),
+                ...(mapped.token !== undefined ? { tokenOverride: mapped.token } : {}),
+            });
+        }
         await this.tearDownWatcherIfTaskTerminal(taskId);
     }
     async parkTaskAtSpecReady(taskId, opts = {}) {
@@ -7328,7 +8842,7 @@ export class AgentManager {
         const acquiredLockToken = (await this.agentStore.get(devAgentId))?.lockToken;
         const newToken = createSignalToken();
         // spec 阶段的扩轮决策不延续到 code 评审：cap 共享字段，进入编码时归零
-        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready', 'max_rounds'] }, { agentId: devAgentId, phase: 'code', signalToken: newToken, maxRoundsContinues: 0 });
+        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready', 'max_rounds'] }, { agentId: devAgentId, phase: 'code', maxRoundsContinues: 0, ...this.dispatchTokenFields({ ...task, phase: 'code' }, newToken) });
         if (!transition) {
             await this.releaseAgentForTask(devAgentId, taskId, 'idle', { allowAwaitingHuman: true })
                 .catch(() => undefined);
@@ -7753,7 +9267,7 @@ export class AgentManager {
             // Callers without a baseSha (publish) run long after the review diff was
             // read; refresh origin/HEAD first or upstream commits merged since then
             // would linger in base..HEAD and flag tasks that leak nothing.
-            const fetch = await execNetwork(runner, `${GIT_NET_ENV} git -C ${shellQuote(workdir)} fetch origin --quiet`);
+            const fetch = await execNetwork(runner, `${canonicalSelfGuard(workdir)} && ${GIT_NET_ENV} git -C ${shellQuote(workdir)} fetch origin --quiet`);
             if (fetch.exitCode !== 0) {
                 throw new Error(`lineage fetch failed in ${workdir}: ${fetch.stderr.trim()}`);
             }
@@ -7884,6 +9398,8 @@ export class AgentManager {
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`injectTextToAgent: unknown agent ${agentId}`);
+        // Pin the incarnation before reading state so a DELETE→recreate reusing %0 can't route the text to the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         await this.acquireCompactGuard(agentId);
         try {
             const state = await this.agentStore.get(agentId);
@@ -7918,8 +9434,18 @@ export class AgentManager {
                 await this.assertTaskLockOwner(agentId, taskId, lockToken);
             }
             const tmux = new TmuxManager(this.createRunnerFor(cfg));
-            await tmux.injectPrompt(paneId, text, agentId);
-            await tmux.sendEnter(paneId);
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
+            // resolveClaimedPane resolved by the CURRENT same-name session; re-verify incarnation + binding before paste (same as the image path).
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new Error(`injectTextToAgent: agent ${agentId} was deleted or recreated before paste`);
+            }
+            const afterResolve = await this.agentStore.get(agentId);
+            if (!afterResolve || afterResolve.paneId !== paneId || afterResolve.taskId !== taskId
+                || (taskId !== undefined && afterResolve.lockToken !== lockToken)) {
+                throw new Error(`injectTextToAgent: agent ${agentId} binding changed before paste`);
+            }
+            await tmux.injectPrompt(pane, text, agentId);
+            await tmux.sendEnter(pane);
         }
         finally {
             this.compactInFlight.delete(agentId);
@@ -8007,6 +9533,38 @@ export class AgentManager {
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
+            if (err instanceof PlatformMergeRecheckError && task.reviewMode === 'git' && task.status === 'merge-ready') {
+                // 复核类失效（provenance 撤销/未 ack 反馈）没有「再 Confirm」的出路：退回 approved 置
+                // durable pending 重入 post-approve 闭环（计划 Task 8），把失效授权留在 gate 只剩 Cancel
+                const retreated = await this.withTaskLock(async () => {
+                    const fresh = await this.taskStore.get(task.id);
+                    if (!fresh || fresh.status !== 'merge-ready')
+                        return false;
+                    const approvedHead = typeof fresh.latestHeadSha === 'string' && PLATFORM_HEAD_SHA_RE.test(fresh.latestHeadSha)
+                        ? fresh.latestHeadSha
+                        : undefined;
+                    if (approvedHead === undefined)
+                        return false;
+                    await this.taskStore.set({
+                        ...fresh,
+                        status: 'approved',
+                        postApproveHeadSha: approvedHead,
+                        pendingRedispatch: true,
+                        updatedAt: new Date().toISOString(),
+                    });
+                    return true;
+                });
+                await this.emitIntervention(task.projectId, undefined, task.id, {
+                    phase: 'confirm-merge-recheck-failed',
+                    gate: task.status,
+                    error: message,
+                    retreated,
+                    note: retreated
+                        ? 'Accepted pass no longer verifies; task returned to approved for the post-approve loop to re-settle.'
+                        : 'Accepted pass no longer verifies and the task could not be returned automatically; inspect and re-dispatch.',
+                });
+                throw new ApiError(409, `Merge blocked for task ${task.id}: ${message}`);
+            }
             await this.emitIntervention(task.projectId, undefined, task.id, {
                 phase: 'confirm-merge-failed',
                 gate: task.status,
@@ -8044,14 +9602,17 @@ export class AgentManager {
     }
     startCompactionThenRelease(agentId, state, taskId) {
         // 人工介入/重建中的 pane 不发 /clear;confirm 语义要求解绑,落回直接释放
-        if (!state.paneId || state.status === 'awaiting_human' || state.creationToken)
+        const expectedPaneId = state.paneId;
+        if (!expectedPaneId || state.status === 'awaiting_human' || state.creationToken)
             return false;
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             return false;
         const tmux = new TmuxManager(this.createRunnerFor(cfg));
-        void this.runPostMergeCompaction(tmux, state.paneId, agentId, taskId, agentRuntimeKindFor(cfg))
-            .catch(err => console.warn(`[AgentManager] releaseTaskAgents compaction(${agentId}) failed:`, err));
+        void (async () => {
+            const pane = await this.resolveClaimedPane(tmux, agentId, expectedPaneId);
+            await this.runPostMergeCompaction(tmux, pane, agentId, taskId, agentRuntimeKindFor(cfg));
+        })().catch(err => console.warn(`[AgentManager] releaseTaskAgents compaction(${agentId}) failed:`, err));
         return true;
     }
     repoMergeQueue = new Map();
@@ -8067,13 +9628,15 @@ export class AgentManager {
         const runner = this.createRunnerFor(dev);
         const prev = this.repoMergeQueue.get(task.projectId) ?? Promise.resolve();
         const run = prev.then(async () => {
+            // fetch/push reach a remote derived from THIS Workdir; a rebound Workdir would redirect the push to a foreign repo, so each mutation carries the canonical self-guard in its own command.
+            const guard = `${canonicalSelfGuard(workdir)} && `;
             const cd = `cd ${shellQuote(workdir)} && `;
             const db = await runner.exec(`${cd}git symbolic-ref --short refs/remotes/origin/HEAD`);
             const defaultBranch = db.stdout.trim().replace(/^origin\//, '');
             if (db.exitCode !== 0 || defaultBranch === '') {
                 throw new Error(`ffMergeBranch: cannot resolve default branch: ${db.stderr.trim() || 'empty origin/HEAD'}`);
             }
-            const fetch = await execNetwork(runner, `${cd}${GIT_NET_ENV} git fetch origin`);
+            const fetch = await execNetwork(runner, `${guard}${cd}${GIT_NET_ENV} git fetch origin`);
             if (fetch.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [git fetch] failed: ${fetch.stderr.trim()}`);
             }
@@ -8087,7 +9650,7 @@ export class AgentManager {
             else {
                 throw new Error(`ffMergeBranch: no reviewed head recorded for task ${task.id}; cannot safely merge`);
             }
-            const push = await execNetwork(runner, `${cd}${GIT_NET_ENV} git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
+            const push = await execNetwork(runner, `${guard}${cd}${GIT_NET_ENV} git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
             if (push.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [push] failed: ${push.stderr.trim() || push.stdout.trim()}`);
             }