dorfl 0.14.2 → 0.15.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command, Option } from 'commander';
+import { Command, InvalidArgumentError, Option } from 'commander';
 import { createInterface } from 'node:readline';
 import { fileURLToPath } from 'node:url';
 import { realpathSync, mkdirSync, rmSync, readFileSync } from 'node:fs';
@@ -26,7 +26,7 @@ import { performAdvance } from './advance.js';
 import { performAdvanceAuto, performAdvanceArgs, runAdvanceTickWithTreelessPublish, } from './advance-drivers.js';
 import { performAdvanceIsolated, performAdvanceIsolatedAuto, performAdvanceIsolatedArgs, } from './advance-isolated.js';
 import { advanceRegistrySetRunTick } from './advance-loop-driver.js';
-import { performIntake, resolveIntakeIntegrationModes } from './intake.js';
+import { performIntake, resolveIntakeIntegrationModes, } from './intake.js';
 import { workFolderPrefix } from './work-layout.js';
 import { performDoAuto, performDoArgs, } from './do-autopick.js';
 import { createHarness } from './pi-harness.js';
@@ -35,6 +35,7 @@ import { shouldUseColor } from './output.js';
 import { resolveRepoConfig, resolveRepoConfigFromLoaded, loadRepoConfigFromContent, REPO_CONFIG_FILENAME, } from './repo-config.js';
 import { ensureMirrorMain, readRepoConfigFromMirrorMain, encodeRepoKey, } from './repo-mirror.js';
 import { identityEnv } from './identity.js';
+import { runMergeQuestionTick } from './merge-question-tick.js';
 import { harnessFlagOverrides, doFlagOverrides, doNeedsAgentCmd, NO_AGENT_CMD_MESSAGE, reviewFlagOverrides, freshWorktreeGateFlagOverrides, mergeRetriesFlagOverrides, noPRFlagOverrides, triageModelFlagOverrides, } from './do-config.js';
 import { harnessReviewGate, harnessTaskAcceptanceGate } from './review-gate.js';
 import { harnessSurfaceGate } from './surface-gate.js';
@@ -47,7 +48,7 @@ import { resolvePromptGuidance, applyModelFallbacks } from './config.js';
 import { gc, resolveArbiterKeyFromCwd, enumerateWorkspaceArbiters, RETAIN_REASON_TEXT, } from './gc.js';
 import { runPrdToSpec, } from './prd-to-spec.js';
 import { resyncProtocol } from './resync-protocol.js';
-import { sweepRemoteMergedBranches } from './reap-branches.js';
+import { sweepRemoteMergedBranches, sweepTerminalItemLocks, } from './reap-branches.js';
 import { sweepOrphanSidecars } from './orphan-sidecar.js';
 import { sweepLedgerDuplicates, formatLedgerSweep } from './ledger-lint.js';
 import { status, formatStatus } from './status.js';
@@ -66,6 +67,50 @@ import { GitHubCIContext } from './install-ci-github.js';
 import { loadCapabilityRegistry } from './install-ci-core.js';
 import { performCloseMergedIssues } from './close-job.js';
 import { installSkills } from './install-skills.js';
+import { parsePhase, PhaseUsageError } from './phase.js';
+import { activateProcessPhase } from './phase-recorder.js';
+import { performBuildPhase } from './ci-phase-build.js';
+import { performIntakePhase } from './ci-phase-intake.js';
+import { performTaskingPhase } from './ci-phase-tasking.js';
+import { advancePhasePath, performTreelessPhase } from './ci-phase-treeless.js';
+import { AgentResultUsageError, parseAgentJobResult, parseAgentTimeoutMinutes, } from './ci-agent-result.js';
+import { singleJobWarning } from './single-job-warning.js';
+/**
+ * Resolve the ARBITER SCOPE of a `--reconcile-locks` write for `status` or `scan`
+ * (tasks `reconcile-locks-stays-within-the-current-arbiter` and
+ * `status-no-arbiter-is-honoured`). Like `gc`, the drain is arbiter-scoped by
+ * DEFAULT: the hub key of the arbiter resolved from the cwd (its `--arbiter`
+ * remote, else the configured `defaultArbiter`), so a drain run in repo A never
+ * releases repo B's locks. `--all-arbiters` is the explicit, loud global opt-in
+ * and returns `undefined` (= every mirror). With neither a resolvable cwd arbiter
+ * nor the flag this REFUSES (exit 1) rather than silently widening the write.
+ * Returns `undefined` too when `--reconcile-locks` is absent (the key is then
+ * ignored by the report builders).
+ */
+function resolveReconcileArbiterKey(verb, flags, defaultArbiter) {
+    if (flags.reconcileLocks !== true) {
+        return undefined;
+    }
+    if (flags.allArbiters === true) {
+        console.error('>> --all-arbiters: releasing stale per-item locks GLOBALLY across ' +
+            'ALL registered arbiters (NOT scoped to the current repo).');
+        return undefined;
+    }
+    // `typeof` guard: on `status`, `--no-arbiter` is commander's negation of
+    // `--arbiter`, so it arrives as `arbiter: false`, not a remote name.
+    const remote = typeof flags.arbiter === 'string' ? flags.arbiter : defaultArbiter;
+    const key = resolveArbiterKeyFromCwd(process.cwd(), remote, process.env);
+    if (key === undefined) {
+        console.error(`refusing: \`${verb} --reconcile-locks\` is ARBITER-SCOPED and could ` +
+            `not resolve an arbiter from the current directory (no '${remote}' ` +
+            'git remote, or not inside a repo). It will NOT fall back to ' +
+            'releasing locks on every arbiter. Run it from a repo with an ' +
+            'arbiter remote, pass --arbiter <remote>, or --all-arbiters to ' +
+            'reconcile every registered arbiter.');
+        process.exit(1);
+    }
+    return key;
+}
 /**
  * Whether `--auto-build` / `--no-auto-build` was explicitly passed on the command
  * line. Commander gives a negatable boolean option a default of `true`, so we
@@ -758,6 +803,207 @@ function resolvePackageVersion() {
         return 'unknown';
     }
 }
+/**
+ * The hidden, CI-only `--phase lock|agent|apply` option shared by `intake`,
+ * `advance` and `do` (spec `ci-agent-job-without-write-token`, see `phase.ts`).
+ * Validated at PARSE time ({@link parsePhase}): an unknown value, or any value
+ * outside GitHub Actions, is a commander usage error before the action runs.
+ * Absent ⇒ today's single process.
+ */
+function phaseOption() {
+    return new Option('--phase <phase>', '(CI-only) run as one job of the split CI item workflow: lock, agent or apply. Requires GITHUB_ACTIONS=true.')
+        .hideHelp()
+        .argParser((raw) => {
+        try {
+            return parsePhase(raw);
+        }
+        catch (err) {
+            if (err instanceof PhaseUsageError) {
+                throw new InvalidArgumentError(err.message);
+            }
+            throw err;
+        }
+    });
+}
+/**
+ * Enter the `--phase` for this one-shot process (a no-op without one): the phase
+ * guards fire from here on, and the agent phase records its write seams.
+ */
+function enterCliPhase(phase) {
+    if (phase !== undefined) {
+        activateProcessPhase(phase);
+    }
+}
+/**
+ * The hidden, CI-only handoff-directory options of the phase mode: the agent
+ * phase writes the handoff to `--handoff-out`, the apply phase reads it from
+ * `--handoff-in` (task `ci-split-build-path`).
+ */
+function handoffDirOptions() {
+    return [
+        new Option('--handoff-out <dir>', '(CI-only, --phase agent) write the handoff artifact to this directory').hideHelp(),
+        new Option('--handoff-in <dir>', '(CI-only, --phase apply) read the handoff artifact from this directory (under $RUNNER_TEMP)').hideHelp(),
+    ];
+}
+/**
+ * The hidden, CI-only agent-result options of the apply phase (task
+ * `ci-split-agent-result-and-reruns`, decision 5): `--agent-result` is
+ * `needs.agent.result` (only `success` reads the handoff), and
+ * `--agent-timeout-minutes` is the lock job's trusted `agentTimeoutMinutes`,
+ * which tells a timed-out agent job from a cancelled one.
+ */
+function agentResultOptions() {
+    const parse = (fn) => (raw) => {
+        try {
+            return fn(raw);
+        }
+        catch (err) {
+            if (err instanceof AgentResultUsageError) {
+                throw new InvalidArgumentError(err.message);
+            }
+            throw err;
+        }
+    };
+    return [
+        new Option('--agent-result <result>', '(CI-only, --phase apply) the agent job result (needs.agent.result): success, failure, cancelled or skipped')
+            .hideHelp()
+            .argParser(parse(parseAgentJobResult)),
+        new Option('--agent-timeout-minutes <n>', "(CI-only, --phase apply) the agent job's timeout, the lock job's agentTimeoutMinutes output")
+            .hideHelp()
+            .argParser(parse(parseAgentTimeoutMinutes)),
+    ];
+}
+/**
+ * Run ONE phase of the split build path (`do <slug>` / `advance task:<slug>`)
+ * or tasking path (`do spec:<slug>` / `advance spec:<slug>`, task
+ * `ci-split-tasking`) for a single named item with `--phase`, and exit with its
+ * code. The lock phase
+ * reads its trusted facts back from nowhere (it produces them); the agent and
+ * apply phases read them from `DORFL_LOCK_OUTPUTS` (see `ci-lock-outputs.ts`).
+ */
+async function runBuildPhaseAndExit(verb, args, flags, options) {
+    const phase = flags.phase;
+    if (args.length !== 1) {
+        console.error(`error: --phase runs ONE CI item; name exactly one item (got ${args.length}).`);
+        process.exit(1);
+    }
+    const handoffDir = phase === 'agent' ? flags.handoffOut : flags.handoffIn;
+    if (phase !== 'lock' && handoffDir === undefined) {
+        console.error(`error: --phase ${phase} needs ${phase === 'agent' ? '--handoff-out' : '--handoff-in'} <dir>.`);
+        process.exit(1);
+    }
+    if (phase === 'apply' && flags.agentResult === undefined) {
+        console.error('error: --phase apply needs --agent-result <result> (needs.agent.result).');
+        process.exit(1);
+    }
+    // A `spec:<slug>` item is the TASKING path (task `ci-split-tasking`); every
+    // other item is the build path, which refuses a non-task itself.
+    const result = parseSlugArg(args[0]).explicit === 'spec'
+        ? await performTaskingPhase({
+            ...options,
+            arg: args[0],
+            phase,
+            verb,
+            handoffDir,
+            agentResult: flags.agentResult,
+            agentTimeoutMinutes: flags.agentTimeoutMinutes,
+        })
+        : await performBuildPhase({
+            ...options,
+            arg: args[0],
+            phase,
+            verb,
+            handoffDir,
+            allowBacklog: flags.allowBacklog === true,
+            agentResult: flags.agentResult,
+            agentTimeoutMinutes: flags.agentTimeoutMinutes,
+        });
+    if (result.exitCode !== 0) {
+        console.error(`error: ${result.message}`);
+    }
+    else {
+        console.error(`>> ${result.message}`);
+    }
+    process.exit(result.exitCode);
+}
+/**
+ * Run ONE phase of `advance <item> --phase` and exit with its code. The item's
+ * rung picks the split path ({@link advancePhasePath}): the build and tasking
+ * paths as before ({@link runBuildPhaseAndExit}), and the tree-less rungs
+ * (surface, triage, apply; task `ci-split-treeless-rungs`) through
+ * {@link performTreelessPhase} with the same advance context the laptop tick
+ * gets.
+ */
+async function runAdvancePhaseAndExit(args, flags, doOptions, advanceContext) {
+    const phase = flags.phase;
+    if (args.length === 1) {
+        const path = await advancePhasePath({
+            phase,
+            arg: args[0],
+            cwd: advanceContext.cwd,
+            arbiter: advanceContext.arbiter,
+            env: identityEnv(doOptions.identity, process.env),
+        });
+        if (path === 'treeless') {
+            const handoffDir = phase === 'agent' ? flags.handoffOut : flags.handoffIn;
+            if (phase !== 'lock' && handoffDir === undefined) {
+                console.error(`error: --phase ${phase} needs ${phase === 'agent' ? '--handoff-out' : '--handoff-in'} <dir>.`);
+                process.exit(1);
+            }
+            if (phase === 'apply' && flags.agentResult === undefined) {
+                console.error('error: --phase apply needs --agent-result <result> (needs.agent.result).');
+                process.exit(1);
+            }
+            const result = await performTreelessPhase({
+                ...advanceContext,
+                arg: args[0],
+                phase,
+                identity: doOptions.identity,
+                handoffDir,
+                agentResult: flags.agentResult,
+                agentTimeoutMinutes: flags.agentTimeoutMinutes,
+            });
+            if (result.exitCode !== 0) {
+                console.error(`error: ${result.message}`);
+            }
+            else {
+                console.error(`>> ${result.message}`);
+            }
+            process.exit(result.exitCode);
+        }
+    }
+    return runBuildPhaseAndExit('advance', args, flags, doOptions);
+}
+/**
+ * Run ONE phase of the split intake path (`intake <N> --phase`) and exit with
+ * its code (task `ci-split-intake`). The agent and apply phases read the lock
+ * job's facts from `DORFL_LOCK_OUTPUTS`.
+ */
+async function runIntakePhaseAndExit(flags, options) {
+    const phase = flags.phase;
+    const handoffDir = phase === 'agent' ? flags.handoffOut : flags.handoffIn;
+    if (phase !== 'lock' && handoffDir === undefined) {
+        console.error(`error: --phase ${phase} needs ${phase === 'agent' ? '--handoff-out' : '--handoff-in'} <dir>.`);
+        process.exit(1);
+    }
+    if (phase === 'apply' && flags.agentResult === undefined) {
+        console.error('error: --phase apply needs --agent-result <result> (needs.agent.result).');
+        process.exit(1);
+    }
+    const result = await performIntakePhase({
+        ...options,
+        phase,
+        handoffDir,
+        agentResult: flags.agentResult,
+    });
+    if (result.exitCode !== 0) {
+        console.error(`error: ${result.message}`);
+    }
+    else {
+        console.error(`>> ${result.message}`);
+    }
+    process.exit(result.exitCode);
+}
 export function buildProgram() {
     const program = new Command();
     program
@@ -805,7 +1051,8 @@ export function buildProgram() {
         .option('--arbiter-remote <name>', `the current repo's arbiter remote to fetch + diff its local section against (default: ${DEFAULT_ARBITER_REMOTE})`)
         .option('--arbiter <remote>', 'the COORDINATION arbiter remote whose per-item lock refs (refs/dorfl/lock/*) gate the cwd selection pool (held in-flight items are subtracted); default: origin (the same remote claim/do use, NOT the --arbiter-remote divergence name)')
         .option('--here', 'report ONLY the current repo (the cwd working tree, fetch-first): skip the cross-repo registry loop entirely. The fast, focused path — no N-mirror fetches.')
-        .option('--reconcile-locks', 'WRITE: release the per-item locks whose item is already at rest in a terminal folder on the arbiter’s main (e.g. a merged propose PR left its lock behind). Without this flag `scan` is strictly read-only. Not normally needed, the claim path releases them automatically on every unit of work. An item that is NOT terminal on main (a live build, an open PR, a stuck item) is NEVER released, with or without the flag.')
+        .option('--reconcile-locks', 'WRITE: release the per-item locks whose item is already at rest in a terminal folder on the arbiter’s main (e.g. a merged propose PR left its lock behind). Without this flag `scan` is strictly read-only. SCOPE: by DEFAULT this is ARBITER-SCOPED, like gc and `status --reconcile-locks`: it releases locks ONLY on the arbiter resolved from the current directory (its --arbiter remote, default: the configured defaultArbiter), so a drain run in repo A never touches repo B’s locks (other repos’ stale locks are still classified). Pass --all-arbiters to release across EVERY registered arbiter. Refuses when no arbiter resolves from the cwd and --all-arbiters is not given. Not normally needed, the claim path releases them automatically on every unit of work. An item that is NOT terminal on main (a live build, an open PR, a stuck item) is NEVER released, with or without the flag.')
+        .option('--all-arbiters', 'with --reconcile-locks: release stale locks across EVERY registered arbiter (loud + global), not just the current repo’s. No effect on the read-only report, which always covers every registered repo.')
         .option('--json', 'output the raw report as JSON')
         .action(async (flags, command) => {
         const fileConfig = loadConfig(flags.config);
@@ -836,10 +1083,15 @@ export function buildProgram() {
             }
             return;
         }
+        // SCOPE of the registry-loop `--reconcile-locks` WRITE: arbiter-scoped by
+        // default, `--all-arbiters` for the global drain, refusal when neither
+        // resolves (the SAME rule `status --reconcile-locks` applies).
+        const reconcileArbiterKey = resolveReconcileArbiterKey('scan', flags, config.defaultArbiter);
         const report = await scan(config, {
             warn,
             override,
             reconcileLocks: flags.reconcileLocks === true,
+            reconcileArbiterKey,
         });
         // The cwd-local section: resolve it ONLY when a participating cwd is NOT
         // already covered by a registered mirror. A FETCH-FREE pre-check
@@ -1449,7 +1701,13 @@ export function buildProgram() {
         .option('--fresh-worktree-gate', 'run the acceptance gate (prepare then verify) against the REBASED tip in a CLEAN throwaway worktree (the tree that actually integrates), so a green gate provably describes the merged artifact. ON by default. Resolved flag > env > per-repo > global > default on.')
         .option('--no-fresh-worktree-gate', "run the acceptance gate in the agent's build worktree (the pre-rebase tree) as before — the opt-out for when the per-gate install cost is too high")
         .option('--merge-retries <n>', 'cross-job merge-serialiser CAS-retry cap (see `run --help`); resolved flag > env > per-repo > global > default 1000.')
+        .addOption(phaseOption())
+        .addOption(handoffDirOptions()[0])
+        .addOption(handoffDirOptions()[1])
+        .addOption(agentResultOptions()[0])
+        .addOption(agentResultOptions()[1])
         .action(async (rawSlugs, flags) => {
+        enterCliPhase(flags.phase);
         // Variadic grammar (`do-autopick`): zero args = AUTO-PICK; one = the single
         // named item; many = those, IN SEQUENCE. `-n <x>` is the auto-pick count.
         const args = rawSlugs ?? [];
@@ -1791,6 +2049,7 @@ export function buildProgram() {
         // sequential `performDo` (do-autopick runs the EXISTING pipeline per item).
         const baseDoOptions = {
             cwd,
+            phase: flags.phase,
             arbiter: flags.arbiter ?? config.defaultArbiter,
             // The host-only runner IDENTITY (a bot): scopes the runner's git/provider
             // ops (claim, push, integrate, `gh`) — NEVER the agent launch. Absent ⇒
@@ -1897,6 +2156,11 @@ export function buildProgram() {
                 `the pool). Name a single task: dorfl do task:<slug> --allow-backlog.`);
             process.exit(1);
         }
+        // CI PHASE MODE (task `ci-split-build-path`): `--phase` runs ONE job of the
+        // split item workflow for a single named task or spec, on the SAME pipeline.
+        if (flags.phase !== undefined) {
+            await runBuildPhaseAndExit('do', args, flags, baseDoOptions);
+        }
         // DISPATCH the variadic grammar (in-place forms):
         //   zero args         -> AUTO-PICK `count` (default 1) across the two pools
         //                        (ordered by selectionOrder; default drain = tasks-first)
@@ -1948,7 +2212,7 @@ export function buildProgram() {
     program
         .command('advance')
         .helpGroup(HEADLINE_GROUP)
-        .description('Advance work/ item(s) one lifecycle rung toward ready/built (SPEC advance-loop), the SEQUENTIAL one-shot driver over the advance tick. advance <slug> (bare = the task) | advance spec:<slug> (the spec tasking rung) | advance obs:<slug> (triage an observation) | advance (auto-pick one eligible) | advance <a> <b> (those, in sequence) | advance -n <x> (x eligible, in sequence). Each item: classify (read-only, no model, no lock) → take the `advancing` CAS lock → dispatch winner-only — build/task rungs ORCHESTRATE `do`/`do spec:`, surface/apply always run, triage respects observationTriage (off|ask|auto). The bare/`-n` selection respects the per-action gates (build→autoBuild, task→autoTask, triage→observationTriage); `-n` is ALWAYS sequential (parallelism is `run` / the CI matrix).')
+        .description('Advance work/ item(s) one lifecycle rung toward ready/built (SPEC advance-loop), the SEQUENTIAL one-shot driver over the advance tick. advance <slug> (bare = the task) | advance spec:<slug> (the spec tasking rung) | advance obs:<slug> (triage an observation) | advance (auto-pick one eligible) | advance <a> <b> (those, in sequence) | advance -n <x> (x eligible, in sequence). Each item: classify (read-only, no model, no lock) → take the `advancing` CAS lock → dispatch winner-only — build/task rungs ORCHESTRATE `do`/`do spec:`, surface/apply always run, triage respects observationTriage (off|ask|auto). The bare/`-n` selection respects the per-action gates (build→autoBuild, task→autoTask, triage→observationTriage); `-n` is ALWAYS sequential (parallelism is `run` / the CI matrix). Before it selects, the bare/`-n` form also asks a merge question for each unmerged work/task-<slug> branch with no open PR and no live build (the `surface-merge-questions` pass; gated by mergeQuestions off|ask).')
         .argument('[slugs...]', 'the item(s) to advance: bare (= the task), task:<slug>, spec:<slug>, or obs:<slug> (an observation). Zero args = auto-pick one eligible; multiple = advance them in sequence.')
         .option('-c, --config <path>', 'config file path', defaultConfigPath())
         .option('--arbiter <remote>', 'name of the arbiter git remote (default: per-repo/global defaultArbiter)')
@@ -1958,14 +2222,19 @@ export function buildProgram() {
         .option('--observation-triage <mode>', 'the observation-inbox gate (off|ask|auto): off (default) leaves observations untouched (the triage pool is dropped from auto-pick); ask surfaces a promote/keep/delete question for each untriaged observation; auto auto-disposes the no-question cases (duplicate/map) and asks about the rest. Resolved flag > env > per-repo > global > default. An explicit `advance obs:<slug>` bypasses the selection gate and runs in ask-mode (auto-disposes only under `auto`).')
         .option('--surface-blockers', 'the declared-blocked-work gate (the orthogonal peer of --observation-triage): render a task/spec carrying needsAnswers:true into an answerable question sidecar (the needsAnswers-blocked pool is enumerated into auto-pick). Resolved flag > env > per-repo > global > default off. An explicit `advance <slug>`/`advance spec:<slug>` bypasses this selection gate and surfaces regardless. Does NOT gate apply (an answered sidecar still applies) or needs-attention (always on).')
         .option('--no-surface-blockers', 'leave a needsAnswers:true task/spec silently blocked (default; the blocked pool is dropped from auto-pick)')
-        .option('--strict-merge-approval', 'opt in to the host-agnostic "dismiss stale approvals on base change" discipline (spec `land-time-reverify-and-parallel-merge-ceiling` sidecar OQ6): when the merge-base CHANGED between the human’s merge-answer and the apply step, RE-SURFACE the merge-question (clear the answer back to no-answer; re-author the question on main/runner under the advancing lock) instead of auto-landing on a green re-verify. Default OFF (a green re-verify is trusted as sufficient; honour the prior answer). Story #16’s RED-re-verify refusal is UNCHANGED and independent of this flag. Resolved flag > env > per-repo > global > default off.')
-        .option('--no-strict-merge-approval', 'honour the prior merge-answer and land when the rebased tip re-verifies GREEN even if the merge-base changed (default; the cheap green-re-verify-is-enough path)')
-        .option('--merge-questions <mode>', 'the merge-question SURFACER gate (off|ask|auto): off drops the surfacer (only for a repo that lands by some other means); ask (default) enumerates unmerged `work/*` branches and surfaces a merge-question sidecar a human answers; auto self-supplies the `merge` answer and lands via the SAME deterministic apply-time re-verify (the merge-mode-like fast path). SEPARATE axis from --observation-triage with a HIGHER default (a dropped merge-question means pushed work never lands). Resolved flag > env > per-repo > global > default ask.')
+        .option('--strict-merge-approval', 'opt in to the host-agnostic "dismiss stale approvals on base change" discipline (spec `land-time-reverify-and-parallel-merge-ceiling` sidecar OQ6): when `main`’s code (anything outside `work/`) moved since the merge-question was asked (the `askedAtMain` it records), RE-SURFACE the merge-question (append a follow-up asked against the current `main`, under the advancing lock) instead of auto-landing on a green re-verify. A question written before `askedAtMain` existed never re-stales. Default OFF (a green re-verify is trusted as sufficient; honour the prior answer). Story #16’s RED-re-verify refusal is UNCHANGED and independent of this flag. Resolved flag > env > per-repo > global > default off.')
+        .option('--no-strict-merge-approval', 'honour the prior merge-answer and land when the rebased tip re-verifies GREEN even if `main` moved since the question was asked (default; the cheap green-re-verify-is-enough path)')
         .option('--merge', 'integrate the advanced item(s) in merge mode this invocation (mutually exclusive with --propose; overrides config). The CI merge shape is a SINGLE SEQUENTIAL job, so this rides the `-n`/named-sequence path, never the matrix.')
         .option('--propose', 'integrate the advanced item(s) in propose mode this invocation (default; mutually exclusive with --merge; overrides config). The CI propose shape is the parallel matrix (one PR per item).')
         .option('--tasks-land-in <where>', 'where `advance spec:<slug>` tasking output lands: `backlog` (staged) or `ready` (the agent POOL). The EXPLICIT operator override at the top of the placement precedence. Resolved flag > env (DORFL_TASKS_LAND_IN) > per-repo > global > built-in.')
         .option('--watch', "stream the build agent's high-signal events live by tailing the pi session log (requires harness: pi; READ-ONLY observer — does not change outcome/gate/git). The same view `do --watch` gives, threaded through the build rung; CI uses it so the job log shows the agent working instead of freezing.")
+        .addOption(phaseOption())
+        .addOption(handoffDirOptions()[0])
+        .addOption(handoffDirOptions()[1])
+        .addOption(agentResultOptions()[0])
+        .addOption(agentResultOptions()[1])
         .action(async (rawSlugs, flags) => {
+        enterCliPhase(flags.phase);
         // Variadic grammar (mirrors `do`): zero args = AUTO-PICK; one = the single
         // named item; many = those, IN SEQUENCE. `-n <x>` is the auto-pick count
         // (ALWAYS sequential, US #25).
@@ -2207,6 +2476,7 @@ export function buildProgram() {
         // hands the resolved arg to `performDo`, never re-implementing it.
         const doOptions = {
             cwd,
+            phase: flags.phase,
             // `--watch`: stream the build agent's session live (pi harness only;
             // validated in `performDo`). Threaded through the orchestrated build rung
             // so `advance --watch` (and CI) shows the agent working, not a frozen log.
@@ -2269,6 +2539,7 @@ export function buildProgram() {
         // Surface + apply stay ALWAYS allowed regardless of the gate family.
         const advanceContext = {
             cwd,
+            phase: flags.phase,
             arbiter: flags.arbiter ?? config.defaultArbiter,
             doOptions,
             surfaceGate: harnessSurfaceGate({ harness, agentCmd: config.agentCmd }),
@@ -2278,6 +2549,14 @@ export function buildProgram() {
             observationTriage: config.observationTriage,
             triageGate: harnessTriageGate({ harness, agentCmd: config.agentCmd }),
             triageModel: config.triageModel,
+            // The answered-merge land (the apply rung's `kind: merge` action) cuts
+            // its job worktree under `workspacesDir` and gates the rebased tip with
+            // `prepare` / `verify`; without them an answered `merge` is refused
+            // as a usage error (task `wire-merge-questions-into-the-advance-tick`).
+            workspacesDir: config.workspacesDir,
+            prepare: config.prepare,
+            verify: config.verify,
+            strictMergeApproval: config.strictMergeApproval,
             note: (message) => console.error(`>> ${message}`),
         };
         // `--watch` tails ONE pi session, so it only fits the single-named-item form
@@ -2285,6 +2564,23 @@ export function buildProgram() {
         // ticks in sequence and would tail several logs; reject rather than silently
         // stream only one. The CI propose matrix names a single item per leg, so it
         // satisfies this; the `-n` merge job must NOT pass `--watch`.
+        // CI PHASE MODE (task `ci-split-build-path`): `--phase` runs ONE job of the
+        // split item workflow: the build, tasking and tree-less (surface, triage,
+        // apply) paths are split (task `ci-split-treeless-rungs`), and the apply
+        // rung's answered merge action with them (task
+        // `ci-split-answered-merge-action`), whose agent job checks the branch
+        // out through `createJob` under `workspacesDir` and gates the rebased tip
+        // with the repo's `prepare` / `verify`. Threaded for the phase mode ONLY:
+        // the in-place laptop tick below keeps today's context.
+        if (flags.phase !== undefined) {
+            await runAdvancePhaseAndExit(args, flags, doOptions, {
+                ...advanceContext,
+                workspacesDir: config.workspacesDir,
+                prepare: config.prepare,
+                verify: config.verify,
+                strictMergeApproval: config.strictMergeApproval,
+            });
+        }
         const advanceMulti = args.length === 0 || count !== undefined || args.length > 1;
         if (advanceMulti && flags.watch === true) {
             console.error('error: --watch streams ONE session; it does not combine with the ' +
@@ -2353,11 +2649,11 @@ export function buildProgram() {
         .option('--yes', 'confirm a destructive --force sweep non-interactively')
         .option('--ledger [repoPath]', 'SWEEP the work/ lifecycle LEDGER instead of job worktrees: REPORT (never delete) every slug present in more than one work/ status folder (the one-slug-one-folder belt-and-suspenders), with its folders + candidate canonical folder, for a HUMAN to resolve. Defaults to the cwd repo.')
         .option('--reap-stale-locks', '(with --ledger) OPT-IN: also CLEAR every ORPHAN lock the report finds via the SAME leased delete `release-lock` uses, so one command sweeps all orphaned locks instead of N hand-run release-locks. Reaps the `cleared-stale` class: a held `active` lock that is EITHER terminal on `<arbiter>/main` (stranded between the durable move and the release) OR non-terminal + SURFACED (`needsAnswers:true` + sidecar on `<arbiter>/main`) = the crash-window orphan the ordered bounce transition leaves when step 1 lands but step 2 never runs. A `kept-in-flight` (active + non-terminal + NOT surfaced — a healthy build) is NEVER reaped, even with this flag. A concurrent change to a lock ref makes its leased delete REJECT (reported), never --force. WITHOUT this flag `gc --ledger` stays report-only (fail-loud, deletes nothing).')
-        .option('--remote-branches', 'SWEEP the arbiter’s remote work/* BRANCHES instead of job worktrees: delete (via git push --delete, NEVER --force) exactly those PROVABLY MERGED into <arbiter>/main (git merge-base --is-ancestor, the SAME predicate the worktree reaper uses), and RETAIN the rest with a reason. An in-flight/un-merged branch (the recovery point) is NEVER touched. Provider-agnostic plain git — works on a --bare arbiter. The merged-only complement of `requeue --reset`.')
+        .option('--remote-branches', 'SWEEP the arbiter’s remote work/* BRANCHES instead of job worktrees: delete (via git push --delete, NEVER --force) exactly those PROVABLY MERGED into <arbiter>/main (git merge-base --is-ancestor, the SAME predicate the worktree reaper uses), and RETAIN the rest with a reason. An in-flight/un-merged branch (the recovery point) is NEVER touched. Provider-agnostic plain git — works on a --bare arbiter. The merged-only complement of `requeue --reset`. The same run ALSO releases every per-item lock whose item is TERMINAL on <arbiter>/main (the `status --reconcile-locks` reconcile: leased on the sha it read, never forced; a lock whose item is not terminal is never touched), so the locks merged propose PRs leave behind do not accumulate.')
         .option('--arbiter <remote-or-url>', 'SCOPE the worktree sweep to a SPECIFIC arbiter (a remote NAME resolved from --cwd, or a direct arbiter URL) instead of the cwd\u2019s. (With --remote-branches / --ledger it names the arbiter git remote whose work/* branches / locks to sweep; default there: origin.)')
         .option('--all-arbiters', 'GLOBAL, LOUD override: sweep worktrees across EVERY arbiter under workspacesDir/work/* (today\u2019s pre-scoping behaviour), not just the cwd\u2019s. Prints a banner naming every arbiter it will act on before doing anything; combining it with --force still requires --yes. This is the destructive cross-repo path \u2014 opt into it explicitly.')
         .option('--cwd <dir>', '(with --remote-branches) the local repo/clone whose --arbiter remote points at the arbiter to sweep (default: cwd); only remote refs are read + deleted, never the working tree')
-        .option('--dry-run', '(with --remote-branches) REPORT which merged branches WOULD be reaped without deleting anything (a read-only preview)')
+        .option('--dry-run', '(with --remote-branches) REPORT which merged branches WOULD be reaped (and which terminal-item locks WOULD be released) without deleting anything (a read-only preview)')
         .option('--json', 'output the raw result as JSON')
         .action(async (flags) => {
         const config = resolveGlobalConfig(loadConfig(flags.config), {});
@@ -2496,8 +2792,22 @@ export function buildProgram() {
                 dryRun: flags.dryRun === true,
                 note: (message) => console.error(`>> ${message}`),
             });
+            // The TERMINAL-LOCK release (task `ci-releases-locks-of-terminal-items`)
+            // rides this SAME invocation for the same reason the orphan sweep does: the
+            // scheduled `reap-merged-branches` CI job runs exactly this command, and a
+            // merged propose item is never claimed again, so without it the lock a
+            // merged PR leaves behind accumulates on the arbiter for ever. It is the
+            // `status --reconcile-locks` reconcile (terminal-on-main only, leased on
+            // the sha it read, never forced), scoped to the one `--arbiter` swept
+            // here. Honours `--dry-run` (report-only preview).
+            const locks = await sweepTerminalItemLocks({
+                cwd: sweepCwd,
+                arbiter: flags.arbiter ?? 'origin',
+                dryRun: flags.dryRun === true,
+                note: (message) => console.error(`>> ${message}`),
+            });
             if (flags.json) {
-                console.log(JSON.stringify({ ...sweep, orphanSidecars: orphans }, null, 2));
+                console.log(JSON.stringify({ ...sweep, orphanSidecars: orphans, terminalLocks: locks }, null, 2));
                 return;
             }
             if (flags.dryRun === true) {
@@ -2507,6 +2817,9 @@ export function buildProgram() {
                 for (const w of orphans.wouldReap) {
                     console.log(`  [would-reap] ${w.path} \u2014 orphan sidecar`);
                 }
+                for (const entry of locks.wouldRelease) {
+                    console.log(`  [would-release] lock ${entry} \u2014 item terminal on main`);
+                }
             }
             else {
                 for (const r of sweep.reaped) {
@@ -2515,6 +2828,12 @@ export function buildProgram() {
                 for (const r of orphans.reaped) {
                     console.log(`  [reaped]   ${r.path} \u2014 orphan sidecar`);
                 }
+                for (const entry of locks.released) {
+                    console.log(`  [released] lock ${entry} \u2014 item terminal on main`);
+                }
+            }
+            for (const e of locks.errors) {
+                console.log(`  [kept]     lock ${e.entry} \u2014 ${e.message}`);
             }
             for (const ret of sweep.retained) {
                 console.log(`  [retained] ${ret.branch} \u2014 ${ret.reasonText}`);
@@ -2523,7 +2842,16 @@ export function buildProgram() {
                 ? sweep.wouldReap.length + orphans.wouldReap.length
                 : sweep.reaped.length + orphans.reaped.length;
             const verb = flags.dryRun === true ? 'would reap' : 'reaped';
-            console.log(`Summary: ${reapedCount} ${verb}, ${sweep.retained.length} retained.`);
+            const releasedLocks = flags.dryRun === true
+                ? locks.wouldRelease.length
+                : locks.released.length;
+            const releaseVerb = flags.dryRun === true ? 'would release' : 'released';
+            console.log(`Summary: ${reapedCount} ${verb}, ${sweep.retained.length} retained; ` +
+                `${releasedLocks} terminal-item lock(s) ${releaseVerb}` +
+                (locks.errors.length > 0
+                    ? `, ${locks.errors.length} kept on error`
+                    : '') +
+                '.');
             return;
         }
         // SCOPE RESOLUTION (this task): the worktree reaper is ARBITER-SCOPED by
@@ -2617,7 +2945,8 @@ export function buildProgram() {
             console.log(`  [reaped]   ${reaped.slug} \u2014 ${how}`);
         }
         for (const retained of result.retained) {
-            console.log(`  [retained] ${retained.slug} \u2014 ${RETAIN_REASON_TEXT[retained.reason]}`);
+            console.log(`  [retained] ${retained.slug} \u2014 ${RETAIN_REASON_TEXT[retained.reason]}` +
+                (retained.hint ? ` (${retained.hint})` : ''));
         }
         for (const orphan of result.sweptOrphans) {
             console.log(`  [swept]    ${orphan.dir} \u2014 ${orphan.kind}`);
@@ -2716,7 +3045,8 @@ export function buildProgram() {
         .option('--arbiter <remote>', 'the COORDINATION arbiter remote whose per-item lock refs gate the cwd selection pool (held in-flight items are subtracted); default: origin')
         .option('--no-arbiter', "skip the current repo's arbiter section")
         .option('--here', 'report ONLY the current repo (the cwd working tree, fetch-first): skip the jobs, registry-mirror, and arbiter sections entirely. "This repo, nothing else" — the fast, focused path.')
-        .option('--reconcile-locks', 'WRITE: release the per-item locks reported as "Completed, lock not yet released" (item already at rest in a terminal folder on the arbiter’s main, e.g. a merged propose PR). Without this flag `status` is strictly read-only and only REPORTS them. Not normally needed, the claim path releases them automatically on every unit of work; this is the manual “drain them now” lever. An item that is NOT terminal on main (a live build, an open PR, a stuck item) is NEVER released, with or without the flag.')
+        .option('--reconcile-locks', 'WRITE: release the per-item locks reported as "Completed, lock not yet released" (item already at rest in a terminal folder on the arbiter’s main, e.g. a merged propose PR). Without this flag `status` is strictly read-only and only REPORTS them. SCOPE: by DEFAULT this is ARBITER-SCOPED, like gc: it releases locks ONLY on the arbiter resolved from the current directory (its --arbiter remote, default: the configured defaultArbiter), so a drain run in repo A never touches repo B’s locks (other repos’ stale locks are still REPORTED). Pass --all-arbiters to release across EVERY registered arbiter. Refuses when no arbiter resolves from the cwd and --all-arbiters is not given. Not normally needed, the claim path releases them automatically on every unit of work; this is the manual “drain them now” lever. An item that is NOT terminal on main (a live build, an open PR, a stuck item) is NEVER released, with or without the flag.')
+        .option('--all-arbiters', 'with --reconcile-locks: release stale locks across EVERY registered arbiter (loud + global), not just the current repo’s. No effect on the read-only report, which always covers every registered repo.')
         .option('--json', 'output the raw report as JSON')
         .action(async (flags) => {
         const config = resolveGlobalConfig(loadConfig(flags.config), {});
@@ -2728,7 +3058,9 @@ export function buildProgram() {
             config,
             override,
             arbiterRemote: flags.arbiterRemote ?? DEFAULT_ARBITER_REMOTE,
-            lockArbiterRemote: flags.arbiter ?? 'origin',
+            // `--no-arbiter` arrives as `arbiter: false` (commander negation):
+            // never pass `false` on as a remote name.
+            lockArbiterRemote: typeof flags.arbiter === 'string' ? flags.arbiter : 'origin',
             reconcileLocks: flags.reconcileLocks === true,
             warn,
         });
@@ -2756,9 +3088,18 @@ export function buildProgram() {
         // REGISTERED HUB MIRROR (the registry), read from its bare `main` ref
         // through the read seam (mirrors have no working tree).
         const mirrorPaths = listMirrors({ workspacesDir }).map((m) => m.path);
+        // SCOPE of the `--reconcile-locks` WRITE (task
+        // `reconcile-locks-stays-within-the-current-arbiter`): ARBITER-SCOPED by
+        // default, resolved from the cwd exactly like `gc`, so a drain in repo A
+        // never releases repo B's locks. `--all-arbiters` is the explicit, loud
+        // global opt-in. With neither a resolvable cwd arbiter nor the flag we
+        // REFUSE rather than silently widening the write to every arbiter.
+        const reconcileArbiterKey = resolveReconcileArbiterKey('status', flags, config.defaultArbiter);
         // Fold in the current repo's arbiter state (the old `arbiter status`, ADR
         // §1/§7) unless --no-arbiter. Read-only; tolerates not being in a repo.
-        const arbiter = flags.noArbiter === true
+        // Commander treats `--no-arbiter` as the NEGATION of `--arbiter <remote>`
+        // (one `arbiter` key): it sets `arbiter: false`, never a `noArbiter` key.
+        const arbiter = flags.arbiter === false
             ? undefined
             : arbiterStatus({
                 cwd: process.cwd(),
@@ -2783,6 +3124,7 @@ export function buildProgram() {
             arbiter,
             cwd: cwdSection,
             reconcileLocks: flags.reconcileLocks === true,
+            reconcileArbiterKey,
             warn,
         });
         if (flags.json) {
@@ -2795,7 +3137,7 @@ export function buildProgram() {
     program
         .command('requeue <slug>')
         .helpGroup(HEADLINE_GROUP)
-        .description('Requeue a STUCK task to the backlog for re-claiming (ADR §12/§14). Recovers a task whose per-item lock is held — stuck (the resolved-recovery path: a previously-routed needs-attention item, now lock `state: stuck`) OR active (a claim that never surfaced — an un-surfaced abort, a killed run, or an in-place requeue note). The body rests in work/tasks/backlog/<slug>.md (claim never moves it under the per-item-lock model); requeue releases the lock so the item is claimable again. The release is published as a TREE-LESS compare-and-swap to the arbiter ref, EXACTLY like claim — it NEVER stages or commits in the cwd working tree, so a requeue in a shared checkout can never sweep up a concurrent writer’s uncommitted files. Escalation ladder (least to most destructive): (1) DEFAULT = keep + continue: leave the work/<slug> branch UNTOUCHED so the next claim CONTINUES from its tip (rebased onto fresh main at onboard-time); if the work/<slug> branch is not on the arbiter (never pushed, or a prior --reset already deleted it), default requeue succeeds anyway with a fresh-claim note. (2) --reconcile (alias --rebase) = NON-DESTRUCTIVE recovery: re-sync the mirror to the arbiter (prune-fetch) and RETRY the rebase of the kept branch onto latest arbiter/main in a scratch worktree; on a clean rebase, push the reconciled tip back (--force-with-lease, work branch only) and release the lock; on a genuine content conflict AFTER the clean re-sync, leave the item stuck and the branch UNTOUCHED (nothing deleted) so the human can retry when the churn settles. NEVER deletes the remote branch. (3) --reset = DESTRUCTIVE last resort: delete the remote work/<slug> branch FIRST (then release the lock) so the next claim starts fresh (guarded; never the default). -m/--message appends a dated handoff note to the item body (all modes; append-only).')
+        .description('Requeue a STUCK task to the backlog for re-claiming (ADR §12/§14). Recovers a task whose per-item lock is held — stuck (the resolved-recovery path: a previously-routed needs-attention item, now lock `state: stuck`) OR active (a claim that never surfaced — an un-surfaced abort, a killed run, or an in-place requeue note). The body rests in work/tasks/backlog/<slug>.md (claim never moves it under the per-item-lock model); requeue releases the lock so the item is claimable again. The release is published as a TREE-LESS compare-and-swap to the arbiter ref, EXACTLY like claim — it NEVER stages or commits in the cwd working tree, so a requeue in a shared checkout can never sweep up a concurrent writer’s uncommitted files. Escalation ladder (least to most destructive): (1) DEFAULT = keep + continue: leave the work/<slug> branch UNTOUCHED so the next claim CONTINUES from its tip (rebased onto fresh main at onboard-time); if the work/<slug> branch is not on the arbiter (never pushed, or a prior --reset already deleted it), default requeue succeeds anyway with a fresh-claim note. (2) --reconcile (alias --rebase) = NON-DESTRUCTIVE recovery: re-sync the mirror to the arbiter (prune-fetch) and RETRY the rebase of the kept branch onto latest arbiter/main in a scratch worktree; on a clean rebase, push the reconciled tip back (--force-with-lease, work branch only) and release the lock; on a genuine content conflict AFTER the clean re-sync, leave the item stuck and the branch UNTOUCHED (nothing deleted) so the human can retry when the churn settles. NEVER deletes the remote branch. (3) --reset = DESTRUCTIVE last resort: delete the remote work/<slug> branch FIRST (then release the lock) so the next claim starts fresh (guarded; never the default). RELEASED LOCK: a surfaced item (question sidecar on main) has its lock already released by the surface; if its body rests in the pool and its work/<slug> branch is on the arbiter, --reconcile and --reset still act on it, taking a short per-item lock for the operation and releasing it on every outcome; plain requeue on such an item is a no-op (the next claim already continues from the kept branch). -m/--message adds a dated handoff note to the item body, just before its `## Acceptance criteria` so it cannot collide with a kept branch’s done-move tail on the continue rebase (all modes; additive). CRASHED RUN: when the lock is held and a DEAD run left its retained job worktree (workspacesDir/work/*) with commits or uncommitted files the arbiter’s work/<slug> lacks, requeue first commits the residue as a wip commit and pushes the branch (plain push, never --force), so the next claim continues from it; if that save fails, the lock and the worktree are KEPT and requeue says why (not on --reset, which discards the work by design).')
         .option('-c, --config <path>', 'config file path', defaultConfigPath())
         .option('--cwd <dir>', 'the repo/working clone whose work/ tree the arbiter remote is resolved FROM (default: cwd) — an ORIGIN SOURCE only; the move is published to the arbiter, never to this tree')
         .option('--arbiter <remote>', 'the arbiter git remote the tree-less move is CAS-published to (default: origin). --cwd resolves this remote; the move is never written to the cwd tree.')
@@ -2825,6 +3167,11 @@ export function buildProgram() {
                 '(non-destructive recovery vs destructive last resort). Pick one.');
             process.exit(1);
         }
+        // Where `do --isolated` retains job worktrees: a CRASHED run's retained
+        // worktree may hold local-only commits, which requeue saves (pushes to the
+        // work branch) before it releases the lock (task
+        // `a-crashed-runs-local-work-is-saved-before-its-lock-is-released`).
+        const { workspacesDir } = resolveGlobalConfig(loadConfig(flags.config), {});
         const result = await ledgerWrite.applyReturnToBacklogTransition({
             cwd,
             slug,
@@ -2832,6 +3179,7 @@ export function buildProgram() {
             // arbiter to `origin` so the common case Just Works; `--arbiter` overrides.
             // `--cwd` is purely the ORIGIN SOURCE the remote is resolved from.
             arbiter: flags.arbiter ?? 'origin',
+            workspacesDir,
             reset: flags.reset,
             reconcile,
             message: flags.message,
@@ -2847,7 +3195,10 @@ export function buildProgram() {
             : result.reconciled
                 ? ` (--reconcile: re-synced mirror + rebased ${workBranchRef('task', slug)} onto latest main and pushed the reconciled tip back; next claim continues from it)`
                 : ' (kept the work branch; next claim continues from its tip)';
-        console.log(`Requeued '${slug}' to backlog for re-claiming.${how}`);
+        const saved = result.crashedRunSave?.kind === 'saved'
+            ? ` Saved the crashed run's local work from ${result.crashedRunSave.dir} to ${result.crashedRunSave.branch} first.`
+            : '';
+        console.log(`Requeued '${slug}' to backlog for re-claiming.${how}${saved}`);
     });
     // `promote [item]` (spec `staging-pool-position-gate-and-trust-model`, tasks
     // `pre-backlog-staging-folder-and-promote-step-a` /
@@ -3097,7 +3448,13 @@ export function buildProgram() {
         .option('--harness <adapter>', 'harness adapter that launches the decision agent: null (default) or pi')
         .option('--pi-bin <path>', 'pi CLI binary the pi harness invokes (default: pi on PATH)')
         .option('--sessions-dir <dir>', 'HOST-ONLY root folder under which the pi session file is generated')
+        .addOption(phaseOption())
+        .addOption(handoffDirOptions()[0])
+        .addOption(handoffDirOptions()[1])
+        .addOption(agentResultOptions()[0])
+        .addOption(agentResultOptions()[1])
         .action(async (rawNumber, flags) => {
+        enterCliPhase(flags.phase);
         const issueNumber = Number(rawNumber);
         if (rawNumber.trim() === '' ||
             !Number.isInteger(issueNumber) ||
@@ -3188,9 +3545,10 @@ export function buildProgram() {
             console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
             process.exit(1);
         }
-        const result = await performIntake({
+        const intakeOptions = {
             issueNumber,
             cwd,
+            phase: flags.phase,
             arbiter: flags.arbiter ?? config.defaultArbiter,
             integration: modes,
             // The resolved cross-job CAS-retry cap (config `mergeRetries`). `intake`
@@ -3230,7 +3588,13 @@ export function buildProgram() {
             // decision/review AGENT launches); absent ⇒ ambient.
             identity: config.identity,
             note: (message) => console.error(`>> ${message}`),
-        });
+        };
+        // CI PHASE MODE (task `ci-split-intake`): `--phase` runs ONE job of the
+        // split item workflow for `issue:<N>`, on the SAME intake pipeline.
+        if (flags.phase !== undefined) {
+            await runIntakePhaseAndExit(flags, intakeOptions);
+        }
+        const result = await performIntake(intakeOptions);
         if (result.exitCode !== 0) {
             console.error(`error: ${result.message}`);
         }
@@ -3249,7 +3613,7 @@ export function buildProgram() {
     program
         .command('close-merged-issues')
         .helpGroup(ADVANCED_GROUP)
-        .description('Close source issues whose work has landed on main (CI capability E, spec runner-in-ci). Resolves each closing issue from the work/ tree (resolveClosingIssue: a lone task closes its own `issue:`; a fanned task reaches the number via `task.spec: → spec issue:`), runs the existing "spec complete?" query for the spec case (closes ONLY when ALL its spec:<slug> tasks are in work/done/), and closes via the IssueProvider seam (atomic comment+close; NO direct gh). Re-implements NONE of the resolution/query/close — it WIRES them. Invoked by the emitted close-job workflow on a merge to main; DEGRADES (never crashes) on a missing/unauthenticated gh.')
+        .description('Close source issues whose work has landed on main (CI capability E, spec runner-in-ci). Resolves each closing issue from the work/ tree (resolveClosingIssue: a lone task closes its own `issue:`; a fanned task reaches the number via `task.spec: → spec issue:`), runs the existing "spec complete?" query for the spec case (closes ONLY when ALL its spec:<slug> tasks are in work/done/), and closes via the IssueProvider seam (atomic comment+close; NO direct gh). Re-implements NONE of the resolution/query/close — it WIRES them. Invoked by the emitted close-job workflow on a merge to main and hourly (a land the CI pushes itself triggers no workflow); an issue that is already closed is skipped (`already-closed`), not closed again. DEGRADES (never crashes) on a missing/unauthenticated gh.')
         .option('--cwd <dir>', 'the repo working dir whose work/ tree to scan (default: cwd)')
         .option('--gh-bin <bin>', 'the gh CLI binary (default: gh on PATH)')
         .option('--json', 'output the raw result as JSON')
@@ -3268,6 +3632,9 @@ export function buildProgram() {
                 if (c.decision === 'closed') {
                     console.error(`>> closed issue #${c.issueNumber} (${c.via} ${c.slug}).`);
                 }
+                else if (c.decision === 'already-closed') {
+                    console.error(`>> issue #${c.issueNumber} (${c.via} ${c.slug}) already closed.`);
+                }
                 else if (c.decision === 'close-failed') {
                     console.error(`>> issue #${c.issueNumber} (${c.via} ${c.slug}) NOT closed: ${c.reason}`);
                 }
@@ -3281,6 +3648,45 @@ export function buildProgram() {
         // crash (exit 0), exactly like intake's bounce close.
         process.exit(0);
     });
+    // `surface-merge-questions` (task `wire-merge-questions-into-the-advance-tick`,
+    // decision 5): the no-agent entry point the generated `advance-lifecycle`
+    // workflow's `surface-merge-questions` job runs. It asks, in the current
+    // checkout of `main`, a merge question for every unmerged `work/task-<slug>`
+    // branch with no open PR and no live build, and publishes the questions to
+    // `<arbiter>/main`. Gated by `mergeQuestions` (`off` does nothing). The laptop
+    // bare `advance` runs the SAME pass before it selects.
+    program
+        .command('surface-merge-questions')
+        .helpGroup(ADVANCED_GROUP)
+        .description('Ask a merge question (a `kind: merge` sidecar entry, answered `merge | hold | drop`) for every unmerged `work/task-<slug>` branch on the arbiter that has no open PR (GitHub), whose task rests in tasks/ready/ or tasks/backlog/, whose lock is free or kept by its finished propose build, and whose tip carries the done-move; then publish the questions to <arbiter>/main (never --force). Fetches the arbiter first. Runs no agent. Gated by `mergeQuestions` (off|ask, default ask; DORFL_MERGE_QUESTIONS > dorfl.json > global): `off` surfaces nothing. The CI `advance-lifecycle` workflow runs it as its `surface-merge-questions` job; the bare laptop `advance` runs the same pass before it selects.')
+        .option('--arbiter <name>', 'the arbiter remote whose work branches to ask about (default: the configured defaultArbiter)')
+        .option('--gh-bin <bin>', 'the gh CLI binary (default: gh on PATH)')
+        .option('-c, --config <path>', 'config file path', defaultConfigPath())
+        .action(async (flags) => {
+        const cwd = process.cwd();
+        const { global, override } = loadGlobalAndOverride(flags.config);
+        let config;
+        try {
+            config = resolveRepoConfig({ repoPath: cwd, global, override }).config;
+        }
+        catch (err) {
+            console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        const pass = await runMergeQuestionTick({
+            cwd,
+            arbiter: flags.arbiter ?? config.defaultArbiter,
+            mergeQuestions: config.mergeQuestions,
+            ghBin: flags.ghBin,
+            env: identityEnv(config.identity, process.env),
+            note: (message) => console.error(`>> ${message}`),
+        });
+        // A failed pass (fetch, lock read, or the GitHub open-PR listing) is
+        // an `error:` line and a non-zero exit, so a CI job cannot go green
+        // while asking about no branch.
+        console.error(pass.failed ? `error: ${pass.message}` : `>> ${pass.message}`);
+        process.exit(pass.failed ? 1 : 0);
+    });
     // The REGISTRY command group (ADR §1): the registered set of targets IS the
     // hub-mirror set on disk. `remote add --local` absorbs the old `arbiter init`;
     // `arbiter status` is folded into `status`. There is no standalone `arbiter`
@@ -3408,7 +3814,7 @@ export function buildProgram() {
     program
         .command('install-ci')
         .helpGroup(ADVANCED_GROUP)
-        .description('Scaffold the CI auth/setup foundation (a one-time, human-run SCAFFOLDER): write the shared composite setup action (`dorfl-setup`) + provider auth (models.json default, or auth.json + GH_PAT + OAuth refresh) and set the provider secrets via the GitHub seam. Interactive wizard, or `--config <file>` for a non-interactive reproduction; `--export-config` round-trips the config; `--fake` writes to `.fake/` (never `.github/`) and sets NO real secret (a snapshot dry-run).')
+        .description('Scaffold the CI auth/setup foundation (a one-time, human-run SCAFFOLDER): write the shared composite setup action (`dorfl-setup`) + provider auth (a generated models.json; put rotating credentials such as OAuth behind a proxy provider `baseUrl`) and set the provider secrets via the GitHub seam. Interactive wizard, or `--config <file>` for a non-interactive reproduction; `--export-config` round-trips the config; `--fake` writes to `.fake/` (never `.github/`) and sets NO real secret (a snapshot dry-run).')
         .option('--config <file>', 'non-interactive: load the CI config from this JSON file (skips the wizard)')
         .option('--export-config <file>', 'write the gathered config as JSON to this path instead of generating artifacts')
         .option('--include-secrets', '(with --export-config) also gather + include the secret values in the export')
@@ -3485,6 +3891,25 @@ export function buildProgram() {
         const result = installSkills({ global: flags.local !== true });
         console.log(formatSkillsAddReport(result, flags.local === true));
     });
+    // Decision 9 (task `ci-split-warn-single-job-workflows`): warn before an
+    // agent-spawning verb runs in an old single-job CI workflow (GitHub Actions,
+    // no `--phase`, a credential persisted in the checkout's git config).
+    // Warn-only: the action still runs.
+    program.hook('preAction', (_program, actionCommand) => {
+        if (actionCommand.parent !== program) {
+            return;
+        }
+        const phase = actionCommand.opts().phase;
+        const warning = singleJobWarning({
+            verb: actionCommand.name(),
+            phase,
+            env: process.env,
+            cwd: process.cwd(),
+        });
+        if (warning !== undefined) {
+            console.error(warning);
+        }
+    });
     return program;
 }
 /**