dorfl 0.14.2 → 0.15.0

package/dist/integration-core.js

@@ -5,14 +5,16 @@ import { LEDGER_STATUS_FOLDERS, workItemPath, workItemRel, workFolderPath, workF
 import { runVerify } from './verify.js';
 import { ensurePrepared } from './prepare.js';
 import { ReviewParseError, formatBlockReason, reviewRoundsExhaustedReason, } from './review-gate.js';
+import { proposeRequestNotOpened, } from './integrator.js';
 import { extractDecisionsBlock } from './agent-stop.js';
 import { ledgerWrite } from './ledger-write.js';
 import { selectProvider } from './github.js';
-import { parseFrontmatter } from './frontmatter.js';
+import { parseFrontmatter, unquoteYamlScalar } from './frontmatter.js';
 import { git, run, runAsync } from './git.js';
 import { realSleep } from './retry-backoff.js';
 import { workBranchRef } from './slug-namespace.js';
 import { isAncestor } from './gc.js';
+import { clearOwnQuestionResidueOnLand } from './land-question-residue.js';
 import { detectColocatedSidecars, formatSidecarGuardReason, } from './sidecar-guard.js';
 /**
  * Build the human-facing CONTEXT tail appended to an `acceptance gate failed`
@@ -156,7 +158,6 @@ export async function performIntegration(input) {
     const arbiter = input.arbiter;
     const slug = input.slug;
     const source = input.source;
-    const recovering = input.recovering;
     const note = input.note ?? (() => { });
     // The work branch: the caller is on it (it carries the namespaced identity).
     // Prefer the explicit `branch`; else read the branch HEAD is on; only fall
@@ -574,6 +575,18 @@ export async function performIntegration(input) {
     if (!lifecycle) {
         transcribeDecisionsIntoDoneRecord({ cwd, slug, output: input.body, note });
     }
+    // 2c. CLEAR THE TASK'S OWN STALE QUESTION STATE in the SAME done-move commit
+    //     (task `a-recovered-task-lands-without-stale-question-state`). A task that
+    //     was surfaced to needs-attention and then recovered carries
+    //     `needsAnswers: true` + its `work/questions/task-<slug>.md` sidecar on
+    //     this branch; the done-move makes both moot, so they leave in the commit
+    //     that makes them moot rather than on some later claim's reconcile. A
+    //     normal land is untouched. Residue that only ARRIVES with the rebase (the
+    //     surface landed on `main` after this branch was cut) is folded in after
+    //     the rebase instead ({@link foldQuestionResidueIntoTip}).
+    if (!lifecycle) {
+        clearOwnQuestionResidueOnLand({ cwd, slug, note });
+    }
     // 3. Commit: git add -A (the agent's uncommitted work + the move) into ONE
     //    atomic commit. Nothing to commit is FATAL (no-op-is-fatal, like claim.sh).
     await gitHard(['add', '-A'], cwd, env);
@@ -612,205 +625,35 @@ export async function performIntegration(input) {
     // needs-attention). Single-job callers pass no lock ⇒ the tail runs directly,
     // byte-for-byte unchanged. The lock is keyed per repo, so cross-repo
     // integration stays fully concurrent.
+    const reconcileCtx = {
+        cwd,
+        arbiter,
+        slug,
+        branch,
+        lifecycle: lifecycle !== undefined,
+        source,
+        surfaceArbiter: input.surfaceArbiter,
+        commitMessage,
+        env,
+        note,
+    };
+    // The rebase-to-integrate TAIL (step 4 fetch+rebase → step 5 integrate) is the
+    // ONLY region serialised per repo under the `run` concurrency seam: it is the
+    // land-on-`main` band where two concurrent SAME-repo merge jobs would otherwise
+    // race (the loser pushing a non-fast-forward `${branch}:main`). Wrapping ONLY
+    // this tail keeps the front-of-band gate (`prepare`+`verify`) and the Gate-2
+    // review agent CONCURRENT across same-repo jobs (run's parallelism); inside the
+    // lock the loser re-fetches + rebases onto the winner's now-advanced main, so
+    // its push is a clean fast-forward (a genuine conflict routes ONE to
+    // needs-attention). Single-job callers pass no lock ⇒ the tail runs directly,
+    // byte-for-byte unchanged. The lock is keyed per repo, so cross-repo
+    // integration stays fully concurrent.
     const runRebaseToIntegrateTail = async () => {
-        // The step-4 rebase-onto-`<arbiter>/main` (with BOTH reconciliation arms: the
-        // sibling-slug ledger arm and the divergent-done-move recovery), factored so it
-        // can run ONCE before the gate AND be RE-RUN in the Race-1 merge-push retry loop
-        // (a sibling advancing main mid-push needs the SAME reconcile, not a bare
-        // rebase). Returns `{}` on a clean rebase (fall through to gate/integrate) or
-        // `{route}` when a genuine conflict / invariant violation must stop the tail.
-        const rebaseOntoMainWithReconcile = async () => {
-            // 4. Rebase-before-integrate (ADR §10): rebase the work branch onto the
-            //    latest <arbiter>/main. Clean → continue. Conflict → abort + stop.
-            //
-            //    RECOVERY reconciliation: post the per-item-lock cut-over, a stuck item's
-            //    body never moved into a `needs-attention/` folder (stuck is the lock
-            //    `state: stuck`; the body rests in `backlog/`), so a recovery `complete`'s
-            //    kept branch carries NO historical `in-progress → needs-attention`
-            //    move-only commit to drop and `<arbiter>/main` holds no surface move to
-            //    conflict with. The old recovery drop (`rebaseDroppingNeedsAttentionSurface`,
-            //    drop-bookkeeping-rebase) is deleted; recovery is now the SAME plain replay
-            //    onto `<arbiter>/main` as any other build (see the plain-rebase note below).
-            // Fetch the arbiter's `main` into the `<arbiter>/main` remote-tracking ref
-            // EXPLICITLY. A `run` JOB WORKTREE is cut from a bare hub mirror whose remote
-            // has no fetch refspec (so `<arbiter>/main` would not otherwise resolve / would
-            // be stale, causing a spurious rebase conflict); a regular clone (`do`/
-            // `complete`) already has it, where the explicit refspec is harmless (the same
-            // refspec `rebaseOntoArbiterMain` used before the convergence).
-            await gitHard([
-                'fetch',
-                '--quiet',
-                arbiter,
-                `+refs/heads/main:refs/remotes/${arbiter}/main`,
-            ], cwd, env);
-            // ONE-SLUG-ONE-FOLDER guard + divergent-base PRE-CHECK, read from the
-            // freshly-fetched `<arbiter>/main` (a READ of the tracking ref the fetch above
-            // just populated — NO new fetch, so no shared-mirror race). It (a) FAILS LOUD if
-            // the arbiter already holds the slug in >1 status folder with differing content
-            // (a corrupt ledger; never publish over it), and (b) detects the DIVERGENT base
-            // — the arbiter holds the slug's source in a DIFFERENT folder than our local
-            // done-move removed — which is the case that turns the rebased "move" into a
-            // "copy" (PR #86). The tasking lifecycle is exempt (its move is not a task
-            // done-move).
-            // CONTINUE-BUILD EXEMPTION (task
-            // `complete-builds-on-already-done-moved-continue`): on `source: 'done'`
-            // there was no first-time move on this commit (the slug was already in
-            // `done/` on the kept branch + on the arbiter), so the divergent-done-move
-            // reconcile reasoning does not apply. Skip the arbiter ledger placement
-            // pre-check too: it is structurally an instrument FOR that reconcile, and a
-            // continue-build is by construction already in `done/` on both sides.
-            if (!lifecycle && source !== 'done') {
-                const arbiterPlacement = readArbiterLedgerPlacement(cwd, arbiter, slug, env);
-                if (arbiterPlacement.error) {
-                    note(arbiterPlacement.error);
-                    return {
-                        route: {
-                            outcome: 'invariant-violation',
-                            routedToNeedsAttention: false,
-                            branch,
-                            reason: arbiterPlacement.error,
-                        },
-                    };
-                }
-            }
-            // PLAIN rebase. After the per-item-lock cut-over (spec
-            // `ledger-status-per-item-lock-refs`, tasks 9a–9d) no transient status
-            // lands on a work branch: needs-attention is the lock `state: stuck` (not a
-            // `git mv` to `needs-attention/`), the body rests in `backlog/` while
-            // claimed, and the tasking/advancing markers are gone. So a recovery
-            // complete's kept branch carries NO historical route-to-needs-attention
-            // move-only commit to drop — the old `rebaseDroppingNeedsAttentionSurface`
-            // (drop-bookkeeping-rebase) is deleted and BOTH recovering and lifecycle
-            // rebases are the same plain replay onto `<arbiter>/main`.
-            void recovering;
-            void lifecycle;
-            // RENAME-DETECTION-OFF (task
-            // `disable-rename-detection-on-continue-rebase`): scope
-            // `-c merge.directoryRenames=false` to THIS rebase invocation, so a single
-            // durable folder-transition `git mv` out of a SPARSE work/<from>/ folder is
-            // NOT misread by git's directory-rename heuristic as a whole-DIRECTORY
-            // rename `work/<from>/ → work/<to>/` (which would spuriously flag every
-            // sibling file `<arbiter>/main` added into that folder as `CONFLICT (file
-            // location)` and force a FALSE needs-attention). Content-rename detection
-            // (`-Xno-renames`/`merge.renames`/`diff.renames`) is the wrong knob and
-            // does NOT suppress this directory-rename conflict; only
-            // `merge.directoryRenames=false` does. NEVER a persistent `git config`
-            // write — the repo's config stays clean so a user's interactive
-            // `git rebase` is unaffected. A GENUINE content conflict still surfaces
-            // and still routes via `rebaseConflictRoute()` below.
-            const rebase = await gitSoft(['-c', 'merge.directoryRenames=false', 'rebase', `${arbiter}/main`], cwd, env);
-            if (rebase.status !== 0) {
-                // NEVER auto-resolve a genuine CODE conflict. But FIRST, a SIBLING-SLUG
-                // LEDGER conflict (the replay conflicts ONLY on OTHER slugs'
-                // `work/<status>/<otherslug>.md` ledger files — a sibling job landed its own
-                // status-folder move on `<arbiter>/main` between our base and this rebase) is
-                // a benign ledger-only divergence with NO semantic judgement: the reconcile
-                // ABORTS the rebase, then redoes OUR work as one clean commit on top of
-                // `<arbiter>/main` (taking the arbiter's version of every sibling ledger file
-                // automatically). It is scoped STRICTLY to other slugs' ledger files — a
-                // conflict touching ANY code file, or THIS slug's own ledger, returns `false`
-                // (and leaves the rebase in progress), so the divergent-done-move recovery /
-                // needs-attention route below handles it; it NEVER widens to code. The tasking
-                // lifecycle is exempt (its move is not a task done-move).
-                const siblingReconciled = lifecycle
-                    ? false
-                    : await reconcileSiblingLedgerConflict({
-                        cwd,
-                        arbiter,
-                        slug,
-                        env,
-                        note,
-                    });
-                if (siblingReconciled) {
-                    // The branch is now cleanly on top of `<arbiter>/main` with OUR work + the
-                    // arbiter's sibling-ledger files — fall through to the fresh-gate + integrate
-                    // band. THIS slug's own move is untouched.
-                    note(`Reconciled a sibling-slug ledger conflict during the rebase onto ` +
-                        `${arbiter}/main (took the arbiter's version of the other slugs' ` +
-                        `work/<status>/<slug>.md ledger files; no code file was touched).`);
-                }
-                else if (!lifecycle && source !== 'done') {
-                    // NEVER auto-resolve a genuine CODE conflict: abort the rebase. But FIRST, a
-                    // DIVERGENT-LEDGER conflict (the arbiter holds the slug's source in a folder
-                    // our local done-move did not remove — PR #86) is auto-RECONCILABLE without
-                    // any semantic judgement: redo the done-move arbiter-resolved (remove the
-                    // arbiter's actual source folder, add `done/`) on top of `<arbiter>/main`. We
-                    // only do this when the post-abort tree's ONLY divergence is the slug's ledger
-                    // file; a real code conflict still routes to needs-attention untouched.
-                    await gitSoft(['rebase', '--abort'], cwd, env);
-                    const recovered = await reconcileDivergentDoneMove({
-                        cwd,
-                        arbiter,
-                        slug,
-                        branch,
-                        localSource: source,
-                        env,
-                        note,
-                    });
-                    if (recovered) {
-                        // The branch is now cleanly on top of `<arbiter>/main` with the slug in
-                        // `done/` ONLY — fall through to integrate (skip the needs-attention
-                        // route below).
-                        note(`Reconciled the done-move against ${arbiter}/main: '${slug}' is in ` +
-                            'work/done/ ONLY (the divergent source folder was removed; the move ' +
-                            'is a move, not a copy).');
-                    }
-                    else {
-                        return { route: await rebaseConflictRoute() };
-                    }
-                }
-                else {
-                    await gitSoft(['rebase', '--abort'], cwd, env);
-                    return { route: await rebaseConflictRoute() };
-                }
-            }
-            // Clean rebase (or a reconciled one): fall through to the gate + integrate.
-            return {};
-        };
         // Run the step-4 rebase ONCE up front (before the slow fresh gate).
-        const firstRebase = await rebaseOntoMainWithReconcile();
+        const firstRebase = await rebaseOntoMainWithReconcile(reconcileCtx);
         if (firstRebase.route) {
             return firstRebase.route;
         }
-        // The rebase-conflict needs-attention route, factored so the divergent-ledger
-        // recovery above can fall through to integrate while a genuine code conflict
-        // still routes here.
-        async function rebaseConflictRoute() {
-            // Then mark the item stuck on its per-item lock with the conflict reason
-            // (ADR §12) THROUGH the ledger write seam's needs-attention transition,
-            // rather than leaving it dangling. Post lock-cutover this is a lock amend
-            // (`state: stuck` + the reason on the lock entry, no `done/ →
-            // needs-attention/` folder move); the done-move already committed above
-            // stands. No partial state.
-            const reason = `rebase onto ${arbiter}/main conflicted (aborted, never auto-resolved)`;
-            const routed = await ledgerWrite.applyNeedsAttentionTransition({
-                cwd,
-                slug,
-                reason,
-                // Autonomous caller (`do`) passes the arbiter so the seam both surfaces the
-                // conflict on `main` (OBSERVABLE) AND pushes the `work/<slug>` branch
-                // (RECOVERABLE, cross-machine). The human `complete` leaves it unset →
-                // no surface, no push, local-only. The push lives in the seam (HEAD's
-                // branch is `work/<slug>` here) — no bolted-on push.
-                arbiter: input.surfaceArbiter,
-                env,
-                note,
-            });
-            return {
-                outcome: 'rebase-conflict',
-                routedToNeedsAttention: routed.moved,
-                branch,
-                commitMessage,
-                reason: routed.moved
-                    ? `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
-                        `aborted (never auto-resolved) and '${slug}' was marked stuck on ` +
-                        'its per-item lock (surfaced by status). Resolve against the latest ' +
-                        'main, then `requeue` to release the stuck lock and re-run.'
-                    : `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
-                        'aborted (never auto-resolved). Resolve against the latest main, ' +
-                        'then re-run complete.',
-            };
-        }
         // 4c. FRESH-WORKTREE GATE (task `gate-on-rebased-tip-fresh-worktree`): when ON,
         //     the acceptance gate (`prepare` then `verify`) runs HERE — on the work
         //     branch tip the rebase above just produced (the would-be-integrated tip) —
@@ -934,209 +777,513 @@ export async function performIntegration(input) {
                 }
             }
         }
-        // 5. Integrate per mode through the ledger write seam's COMPLETE transition
-        //    (ADR §6 + `docs/adr/claim-ledger-vs-protected-main.md`). The rebase above
-        //    already brought the branch up to date, so the seam's sole strategy uses
-        //    `integrate` (not `integrateWithRebase`) and never --forces. Provider
-        //    selection: an injected `openPr` wins (legacy bridge); otherwise pick by
-        //    the arbiter's remote URL (a GitHub remote ⇒ `gh pr create`, else push-only
-        //    `none`) — PURELY arbiter-derived, no override axis. A missing/unauthenticated
-        //    `gh` degrades to push-only at runtime — never a hard failure (and the
-        //    start-of-run unauthed case is caught UP FRONT by the pre-flight `gh` probe).
-        //    The seam is storage-agnostic: we hand it the work branch, the integration
-        //    mode, the provider, and the PR-INTENT (`noPR`) — `main` lives only in the
-        //    strategy.
-        // Provider precedence: an injected fully-formed provider wins (the `run`
-        // stubbed-provider seam, carrying title/body/url); else the legacy `openPr`
-        // bridge; else select PURELY from the arbiter URL (no override). The orthogonal
-        // `noPR` INTENT (suppress the PR) is threaded SEPARATELY — it does NOT pick a
-        // provider, the integrator simply skips `openRequest` when it is set.
-        const provider = input.providerInstance ??
-            (input.openPr
-                ? bridgeProvider(input.openPr)
-                : selectProvider({
-                    arbiterUrl: await arbiterUrl(cwd, arbiter, env),
-                }));
-        // Race-1 (claim-vs-integrate, task
-        // `run-fleet-claim-integrate-and-sibling-rebase-concurrency-safe`): integrate,
-        // and on a non-fast-forward `${branch}:main` push (a SIBLING same-repo CLAIM —
-        // under the SEPARATE claim lock — or a sibling integrate advanced
-        // `<arbiter>/main` during our push window) RE-RUN the step-4 rebase (which
-        // carries the sibling-ledger + divergent-done-move reconcile arms — a bare
-        // re-rebase would MISS them) and RETRY the push, up to a small cap. INSTANT
-        // retry (contention, not an outage; see `claim-cas.ts`). We NEVER `--force`
-        // main: each retry re-rebases to a clean fast-forward. A genuine code conflict
-        // on a re-rebase routes to needs-attention via the SAME `route` the up-front
-        // rebase uses. A persistent non-fast-forward past the cap also routes (never a
-        // silent drop). `input.mergeRetries` overrides the cap (tests; `0` ⇒ no retry).
-        //
-        // **C2 rebase-until-real-conflict (task `c2-rebase-until-real-on-durable-main-
-        // promotions`):** the loop's TERMINATION CHANGED. A CLEAN re-rebase no longer
-        // counts against a tiny give-up budget — only a GENUINE conflict surfaced by
-        // `rebaseOntoMainWithReconcile` (a `route` ⇒ `rebase-conflict` or
-        // `invariant-violation`) stops the loop. The step-4 rebase IS the source-folder
-        // precondition recheck reused verbatim: if the slug is GONE from its expected
-        // source folder on the new `main` (a concurrent legitimate same-item winner
-        // already moved it), the `git mv` replay fails and `rebaseConflictRoute` routes
-        // definitively — never a silent re-push that would clobber the winner. The
-        // `maxMergeRetries` cap survives ONLY as a large liveness ceiling on the
-        // pathological livelock tail (default {@link DEFAULT_MERGE_RETRIES} = 1000);
-        // modest jitter on the refetch desynchronises a herd so the tail is not
-        // reached under sustained parallel load.
-        const maxMergeRetries = input.mergeRetries ?? DEFAULT_MERGE_RETRIES;
-        const mergeJitterMs = input.mergeJitterMs ?? DEFAULT_MERGE_JITTER_MS;
-        let integration;
-        for (let mergeAttempt = 0;; mergeAttempt++) {
-            integration = await ledgerWrite.applyCompleteTransition({
-                arbiter,
-                branch,
-                mode,
-                provider,
-                // PR-INTENT: when set (propose mode), push the branch but skip the PR.
-                noPR: input.noPR,
-                // Half A: an explicit single-line PR title (propose mode), so `gh` no longer
-                // derives a run-on title from the commit subject via `--fill`.
-                title: prTitle,
-                // Half B: the propose-mode PR body — the agent's summary under a deterministic
-                // runner header (task pointer). Undefined when no body was supplied (the
-                // header is only scaffolded when there IS a body) ⇒ today's `--fill` (no
-                // regression). Ignored in merge mode by the provider/integrator.
-                body: composeProposeBody({ slug, body: input.body }),
-                // Part (b) of the merged-branch hygiene task: when WE perform the merge
-                // (this resolved `merge` mode), reap the remote `work/<slug>` HEAD branch
-                // INLINE right after the merge lands — the commits are now on `main`, so the
-                // head is provably merged and safe to delete (ancestor-guarded inside the
-                // integrator). Idempotent no-op when no remote head exists (the plain
-                // `${branch}:main` push opened none); ignored in `propose` mode (its branch is
-                // the review surface, reaped later by `gc --remote-branches`). NEVER `--force`.
-                deleteMergedHead: true,
+        // 5. The LAND half (`landIntegration`, reached through the `integrationLand`
+        //    seam): integrate per mode with the merge-mode CAS loop, then the review
+        //    comment. The CI agent phase records this call as its boundary; the apply
+        //    phase resumes here (task `ci-split-build-path`).
+        return await integrationLand.land({
+            ...reconcileCtx,
+            mode,
+            noPR: input.noPR,
+            providerInstance: input.providerInstance,
+            openPr: input.openPr,
+            title: prTitle,
+            body: composeProposeBody({
+                slug,
+                body: input.body,
+                header: lifecycle?.proposeHeader,
+            }),
+            reviewProse: approvedVerdict?.review ?? input.approvedReviewProse,
+            mergeRetries: input.mergeRetries,
+            mergeJitterMs: input.mergeJitterMs,
+        });
+    };
+    // Serialise ONLY this tail per repo when the `run` seam is wired; absent ⇒ run
+    // it directly (an un-contended no-op, single-job behaviour unchanged).
+    return input.integrateLock && input.integrateLockKey !== undefined
+        ? await input.integrateLock(input.integrateLockKey, runRebaseToIntegrateTail)
+        : await runRebaseToIntegrateTail();
+}
+/** The process-wide {@link IntegrationLandSeam} (replaced only by the phase recorder). */
+export const integrationLand = {
+    land: (input) => landIntegration(input),
+};
+/**
+ * The step-4 rebase-onto-`<arbiter>/main` (with BOTH reconciliation arms: the
+ * sibling-slug ledger arm and the divergent-done-move recovery), factored so it
+ * can run ONCE before the gate AND be RE-RUN in the Race-1 merge-push retry loop
+ * (a sibling advancing main mid-push needs the SAME reconcile, not a bare
+ * rebase). Returns `{}` on a clean rebase (fall through to gate/integrate) or
+ * `{route}` when a genuine conflict / invariant violation must stop the tail.
+ * Module-level (not a closure) so BOTH halves of the rebase-to-integrate tail
+ * reach it: the agent half runs it once before the fresh gate, and the land
+ * half ({@link landIntegration}) re-runs it in the merge-mode CAS loop.
+ */
+async function rebaseOntoMainWithReconcile(ctx) {
+    const { cwd, arbiter, slug, branch, lifecycle, source, env } = ctx;
+    const note = ctx.note;
+    // 4. Rebase-before-integrate (ADR §10): rebase the work branch onto the
+    //    latest <arbiter>/main. Clean → continue. Conflict → abort + stop.
+    //
+    //    RECOVERY reconciliation: post the per-item-lock cut-over, a stuck item's
+    //    body never moved into a `needs-attention/` folder (stuck is the lock
+    //    `state: stuck`; the body rests in `backlog/`), so a recovery `complete`'s
+    //    kept branch carries NO historical `in-progress → needs-attention`
+    //    move-only commit to drop and `<arbiter>/main` holds no surface move to
+    //    conflict with. The old recovery drop (`rebaseDroppingNeedsAttentionSurface`,
+    //    drop-bookkeeping-rebase) is deleted; recovery is now the SAME plain replay
+    //    onto `<arbiter>/main` as any other build (see the plain-rebase note below).
+    // Fetch the arbiter's `main` into the `<arbiter>/main` remote-tracking ref
+    // EXPLICITLY. A `run` JOB WORKTREE is cut from a bare hub mirror whose remote
+    // has no fetch refspec (so `<arbiter>/main` would not otherwise resolve / would
+    // be stale, causing a spurious rebase conflict); a regular clone (`do`/
+    // `complete`) already has it, where the explicit refspec is harmless (the same
+    // refspec `rebaseOntoArbiterMain` used before the convergence).
+    await gitHard([
+        'fetch',
+        '--quiet',
+        arbiter,
+        `+refs/heads/main:refs/remotes/${arbiter}/main`,
+    ], cwd, env);
+    // ONE-SLUG-ONE-FOLDER guard + divergent-base PRE-CHECK, read from the
+    // freshly-fetched `<arbiter>/main` (a READ of the tracking ref the fetch above
+    // just populated — NO new fetch, so no shared-mirror race). It (a) FAILS LOUD if
+    // the arbiter already holds the slug in >1 status folder with differing content
+    // (a corrupt ledger; never publish over it), and (b) detects the DIVERGENT base
+    // — the arbiter holds the slug's source in a DIFFERENT folder than our local
+    // done-move removed — which is the case that turns the rebased "move" into a
+    // "copy" (PR #86). The tasking lifecycle is exempt (its move is not a task
+    // done-move).
+    // CONTINUE-BUILD EXEMPTION (task
+    // `complete-builds-on-already-done-moved-continue`): on `source: 'done'`
+    // there was no first-time move on this commit (the slug was already in
+    // `done/` on the kept branch + on the arbiter), so the divergent-done-move
+    // reconcile reasoning does not apply. Skip the arbiter ledger placement
+    // pre-check too: it is structurally an instrument FOR that reconcile, and a
+    // continue-build is by construction already in `done/` on both sides.
+    if (!lifecycle && source !== 'done') {
+        const arbiterPlacement = readArbiterLedgerPlacement(cwd, arbiter, slug, env);
+        if (arbiterPlacement.error) {
+            note(arbiterPlacement.error);
+            return {
+                route: {
+                    outcome: 'invariant-violation',
+                    routedToNeedsAttention: false,
+                    branch,
+                    reason: arbiterPlacement.error,
+                },
+            };
+        }
+    }
+    // PLAIN rebase. After the per-item-lock cut-over (spec
+    // `ledger-status-per-item-lock-refs`, tasks 9a–9d) no transient status
+    // lands on a work branch: needs-attention is the lock `state: stuck` (not a
+    // `git mv` to `needs-attention/`), the body rests in `backlog/` while
+    // claimed, and the tasking/advancing markers are gone. So a recovery
+    // complete's kept branch carries NO historical route-to-needs-attention
+    // move-only commit to drop — the old `rebaseDroppingNeedsAttentionSurface`
+    // (drop-bookkeeping-rebase) is deleted and BOTH recovering and lifecycle
+    // rebases are the same plain replay onto `<arbiter>/main`.
+    // RENAME-DETECTION-OFF (task
+    // `disable-rename-detection-on-continue-rebase`): scope
+    // `-c merge.directoryRenames=false` to THIS rebase invocation, so a single
+    // durable folder-transition `git mv` out of a SPARSE work/<from>/ folder is
+    // NOT misread by git's directory-rename heuristic as a whole-DIRECTORY
+    // rename `work/<from>/ → work/<to>/` (which would spuriously flag every
+    // sibling file `<arbiter>/main` added into that folder as `CONFLICT (file
+    // location)` and force a FALSE needs-attention). Content-rename detection
+    // (`-Xno-renames`/`merge.renames`/`diff.renames`) is the wrong knob and
+    // does NOT suppress this directory-rename conflict; only
+    // `merge.directoryRenames=false` does. NEVER a persistent `git config`
+    // write — the repo's config stays clean so a user's interactive
+    // `git rebase` is unaffected. A GENUINE content conflict still surfaces
+    // and still routes via `rebaseConflictRoute(ctx)` below.
+    const rebase = await gitSoft(['-c', 'merge.directoryRenames=false', 'rebase', `${arbiter}/main`], cwd, env);
+    if (rebase.status !== 0) {
+        // NEVER auto-resolve a genuine CODE conflict. But FIRST, a SIBLING-SLUG
+        // LEDGER conflict (the replay conflicts ONLY on OTHER slugs'
+        // `work/<status>/<otherslug>.md` ledger files — a sibling job landed its own
+        // status-folder move on `<arbiter>/main` between our base and this rebase) is
+        // a benign ledger-only divergence with NO semantic judgement: the reconcile
+        // ABORTS the rebase, then redoes OUR work as one clean commit on top of
+        // `<arbiter>/main` (taking the arbiter's version of every sibling ledger file
+        // automatically). It is scoped STRICTLY to other slugs' ledger files — a
+        // conflict touching ANY code file, or THIS slug's own ledger, returns `false`
+        // (and leaves the rebase in progress), so the divergent-done-move recovery /
+        // needs-attention route below handles it; it NEVER widens to code. The tasking
+        // lifecycle is exempt (its move is not a task done-move).
+        const siblingReconciled = lifecycle
+            ? false
+            : await reconcileSiblingLedgerConflict({
                 cwd,
+                arbiter,
+                slug,
                 env,
+                note,
             });
-            // Only the merge push can be non-fast-forward (propose pushes its own ref).
-            if (integration.mergeNonFastForward !== true) {
-                break;
-            }
-            if (mergeAttempt >= maxMergeRetries) {
-                // LIVENESS CEILING hit (default 1000; previously the small Race-1 cap of 5,
-                // now reinterpreted by C2 as the pathological-livelock-tail bound, NOT a
-                // false-contention budget). Route to needs-attention rather than looping
-                // forever or force-pushing main. A RARE outcome under realistic load thanks
-                // to the jitter below + the rebase-until-real-conflict semantics; tests
-                // reach it deterministically by injecting a small `mergeRetries`.
-                return await mergeNonFastForwardRoute(`integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-                    `non-fast-forward push (a sibling advanced main ${mergeAttempt + 1} ` +
-                    `times); gave up cleanly without --force`);
-            }
-            // Modest jitter on the refetch (C2): an instant lockstep refetch→re-push loop
-            // maximises mutual rejection under sustained parallel load (thundering herd).
-            // A uniformly-random `[0, mergeJitterMs]` ms sleep desynchronises the herd.
-            // Skipped when `mergeJitterMs === 0` (the test seam).
-            if (mergeJitterMs > 0) {
-                await sleepMs(Math.floor(Math.random() * (mergeJitterMs + 1)));
-            }
-            // A sibling advanced main: re-run the step-4 rebase (with the reconcile arms)
-            // before retrying the push. A genuine conflict on the re-rebase routes via
-            // `rebaseOntoMainWithReconcile`'s `route` (the existing source-folder /
-            // one-slug placement recheck IS the genuine-conflict terminator — see the
-            // `DEFAULT_MERGE_RETRIES` docstring for the C2 SCOPE box). A clean re-rebase
-            // (no route) loops without counting against a small budget.
-            const reRebase = await rebaseOntoMainWithReconcile();
-            if (reRebase.route) {
-                return reRebase.route;
-            }
+        if (siblingReconciled) {
+            // The branch is now cleanly on top of `<arbiter>/main` with OUR work + the
+            // arbiter's sibling-ledger files — fall through to the fresh-gate + integrate
+            // band. THIS slug's own move is untouched.
+            note(`Reconciled a sibling-slug ledger conflict during the rebase onto ` +
+                `${arbiter}/main (took the arbiter's version of the other slugs' ` +
+                `work/<status>/<slug>.md ledger files; no code file was touched).`);
         }
-        // The Race-1 needs-attention route for a merge that could not land (a genuine
-        // re-rebase conflict is handled by `rebaseOntoMainWithReconcile`'s `route`; this
-        // covers the cap-exhausted persistent-contention case). Mirrors
-        // `rebaseConflictRoute`: the done-move was already committed (steps 2–3), so the
-        // slug sits in work/done/ and the seam bounces it from there.
-        async function mergeNonFastForwardRoute(reason) {
-            const routed = await ledgerWrite.applyNeedsAttentionTransition({
+        else if (!lifecycle && source !== 'done') {
+            // NEVER auto-resolve a genuine CODE conflict: abort the rebase. But FIRST, a
+            // DIVERGENT-LEDGER conflict (the arbiter holds the slug's source in a folder
+            // our local done-move did not remove — PR #86) is auto-RECONCILABLE without
+            // any semantic judgement: redo the done-move arbiter-resolved (remove the
+            // arbiter's actual source folder, add `done/`) on top of `<arbiter>/main`. We
+            // only do this when the post-abort tree's ONLY divergence is the slug's ledger
+            // file; a real code conflict still routes to needs-attention untouched.
+            await gitSoft(['rebase', '--abort'], cwd, env);
+            const recovered = await reconcileDivergentDoneMove({
                 cwd,
+                arbiter,
                 slug,
-                reason,
-                arbiter: input.surfaceArbiter,
+                branch,
+                localSource: source,
                 env,
                 note,
             });
-            return {
-                outcome: 'rebase-conflict',
-                routedToNeedsAttention: routed.moved,
-                branch,
-                commitMessage,
-                reason: routed.moved
-                    ? `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-                        `non-fast-forward push (a sibling advanced main); '${slug}' was ` +
-                        `marked stuck on its per-item lock (surfaced by status). Resolve ` +
-                        `against the latest main, then \`requeue\` to release the stuck ` +
-                        `lock and re-run.`
-                    : `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-                        `non-fast-forward push (a sibling advanced main). Resolve against the ` +
-                        `latest main, then re-run complete.`,
-            };
-        }
-        // 6. Make the Gate-2 review VISIBLE on the PR (task `review-comment-prose-field`,
-        //    refining `review-gate-pr-comment`): AFTER the propose integrate, where the
-        //    approved verdict (with its deliberately-authored `review` prose), the
-        //    resolved `provider`, AND the opened PR url (`integration.url`) are ALL in
-        //    scope, post `verdict.review` as a comment on that PR — INCLUDING on approve
-        //    (the audit trail; decided 2026-06-06). The `review` field is a first-class
-        //    AUTHORED review (the prompt requires it), NOT the residue around the JSON
-        //    — posting the residue was the bug
-        //    (`work/findings/review-comment-posts-agent-thinking-not-a-review.md`). It
-        //    reuses the SAME `provider` the integrate used (the core never imports `gh`).
-        //    The comment is ADVISORY: it changes no gate/verdict/merge/integration logic
-        //    — by here the verdict has ALREADY routed (block never reaches this point; it
-        //    routed to needs-attention above) and the integrate has ALREADY happened.
-        //    The PR identity is resolved in PRECEDENCE: a parsed `integration.url` wins
-        //    (the normal path — post on it directly); else, when a PR WAS opened but its
-        //    url was unparseable (`integration.requestOpened` true, `url` undefined — the
-        //    `gh pr create` exit-0-but-unparseable-stdout degradation), FALL BACK to the
-        //    BRANCH-resolved comment (task `review-comment-fallback-on-unparsed-pr-url`):
-        //    the provider resolves the branch's open PR and comments on it, instead of
-        //    silently dropping a review on a PR that genuinely exists. Only when NO PR was
-        //    opened at all (merge mode, or a degraded/push-only propose ⇒ `requestOpened`
-        //    false) is it the honest clean no-op — and the branch-resolved fallback's own
-        //    "no PR resolvable" path is a clean no-op too (it tries first). Either way
-        //    `postPRComment*` never throws; the review stays in the run output. Because
-        //    this lives in the shared core, BOTH `do`/`complete` AND `run` post the
-        //    comment — no per-caller wiring.
-        if (approvedVerdict?.review !== undefined) {
-            if (integration.url !== undefined) {
-                const posted = provider.postPRComment({
-                    cwd,
-                    url: integration.url,
-                    body: approvedVerdict.review,
-                    env,
-                });
-                note(posted.instruction);
+            if (recovered) {
+                // The branch is now cleanly on top of `<arbiter>/main` with the slug in
+                // `done/` ONLY — fall through to integrate (skip the needs-attention
+                // route below).
+                note(`Reconciled the done-move against ${arbiter}/main: '${slug}' is in ` +
+                    'work/done/ ONLY (the divergent source folder was removed; the move ' +
+                    'is a move, not a copy).');
             }
-            else if (integration.requestOpened) {
-                // A PR opened but its url was unparseable — resolve it from the branch
-                // rather than dropping the review (the audit-trail fallback).
-                const posted = provider.postPRCommentOnBranch({
-                    cwd,
-                    branch,
-                    body: approvedVerdict.review,
-                    env,
-                });
-                note(posted.instruction);
+            else {
+                return { route: await rebaseConflictRoute(ctx) };
             }
         }
+        else {
+            await gitSoft(['rebase', '--abort'], cwd, env);
+            return { route: await rebaseConflictRoute(ctx) };
+        }
+    }
+    // Clean rebase (or a reconciled one): fold any question residue the rebase
+    // brought in into the tip, then fall through to the gate + integrate.
+    if (!lifecycle) {
+        await foldQuestionResidueIntoTip(ctx);
+    }
+    return {};
+}
+/**
+ * After a rebase onto `<arbiter>/main`, CLEAR the landing task's own stale
+ * question state that the rebase BROUGHT IN, and AMEND it into the tip commit
+ * (the completion commit), so the land still carries it in the done-move commit
+ * itself (task `a-recovered-task-lands-without-stale-question-state`).
+ *
+ * This is the half step 2c cannot see: a kept branch cut BEFORE the item was
+ * surfaced (a re-dispatch continuing from the kept branch, a stranded-branch
+ * finish) replays its `git mv ... → tasks/done/` over a `main` whose body now
+ * carries `needsAnswers: true` and a sidecar, and git carries the flag into
+ * `tasks/done/` and keeps the sidecar. Runs on every rebase of the land: the
+ * build path's first rebase, the merge CAS loop's re-rebase (so the CI apply
+ * phase is covered), and the stranded-recovery tail.
+ *
+ * A no-op (no amend) when there is nothing to clear, and when the tip is already
+ * on `main` (never rewrite a commit that is not ours). Best-effort: a fault is
+ * reported and the land proceeds; the claim-time reconcile remains the backstop.
+ */
+async function foldQuestionResidueIntoTip(params) {
+    const { cwd, arbiter, slug, env, note } = params;
+    try {
+        if (isAncestor(cwd, 'HEAD', `${arbiter}/main`, env)) {
+            return; // no commit of ours on top of main to fold into.
+        }
+        const cleared = clearOwnQuestionResidueOnLand({ cwd, slug, note });
+        if (cleared.changed.length === 0) {
+            return;
+        }
+        await gitHard(['add', '-A', '--', ...cleared.changed], cwd, env);
+        await gitHard(['commit', '-q', '--amend', '--no-edit'], cwd, env);
+    }
+    catch (err) {
+        note(`Could not fold the stale question state of '${slug}' into its land ` +
+            `(${err instanceof Error ? err.message : String(err)}); the next ` +
+            'claim reconcile will drain it.');
+    }
+}
+// The rebase-conflict needs-attention route, factored so the divergent-ledger
+// recovery above can fall through to integrate while a genuine code conflict
+// still routes here.
+async function rebaseConflictRoute(ctx) {
+    const { cwd, arbiter, slug, branch, commitMessage, env, note } = ctx;
+    // Then mark the item stuck on its per-item lock with the conflict reason
+    // (ADR §12) THROUGH the ledger write seam's needs-attention transition,
+    // rather than leaving it dangling. Post lock-cutover this is a lock amend
+    // (`state: stuck` + the reason on the lock entry, no `done/ →
+    // needs-attention/` folder move); the done-move already committed above
+    // stands. No partial state.
+    const reason = `rebase onto ${arbiter}/main conflicted (aborted, never auto-resolved)`;
+    const routed = await ledgerWrite.applyNeedsAttentionTransition({
+        cwd,
+        slug,
+        reason,
+        // Autonomous caller (`do`) passes the arbiter so the seam both surfaces the
+        // conflict on `main` (OBSERVABLE) AND pushes the `work/<slug>` branch
+        // (RECOVERABLE, cross-machine). The human `complete` leaves it unset →
+        // no surface, no push, local-only. The push lives in the seam (HEAD's
+        // branch is `work/<slug>` here) — no bolted-on push.
+        arbiter: ctx.surfaceArbiter,
+        env,
+        note,
+    });
+    return {
+        outcome: 'rebase-conflict',
+        routedToNeedsAttention: routed.moved,
+        branch,
+        commitMessage,
+        reason: routed.moved
+            ? `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
+                `aborted (never auto-resolved) and '${slug}' was marked stuck on ` +
+                'its per-item lock (surfaced by status). Resolve against the latest ' +
+                'main, then `requeue` to release the stuck lock and re-run.'
+            : `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
+                'aborted (never auto-resolved). Resolve against the latest main, ' +
+                'then re-run complete.',
+    };
+}
+/**
+ * **The LAND half of the rebase-to-integrate tail** (task `ci-split-build-path`,
+ * spec `ci-agent-job-without-write-token` §8): integrate per mode through
+ * `ledgerWrite.applyCompleteTransition`, with the merge-mode compare-and-swap
+ * loop (a non-fast-forward push re-runs {@link rebaseOntoMainWithReconcile} and
+ * retries, never `--force`), then post the approved Gate-2 review prose on the
+ * opened PR. It launches no agent and runs no `prepare` / `verify`: the fresh
+ * gate ran once, before it, in the other half. `performIntegration` reaches it
+ * through the {@link integrationLand} seam, so the CI agent phase RECORDS this
+ * call (the first write of the success path) and the apply phase resumes here
+ * with trusted inputs and the validated work-branch tip.
+ */
+export async function landIntegration(input) {
+    const { cwd, arbiter, slug, branch, mode, commitMessage, env } = input;
+    const note = input.note;
+    // 5. Integrate per mode through the ledger write seam's COMPLETE transition
+    //    (ADR §6 + `docs/adr/claim-ledger-vs-protected-main.md`). The rebase above
+    //    already brought the branch up to date, so the seam's sole strategy uses
+    //    `integrate` (not `integrateWithRebase`) and never --forces. Provider
+    //    selection: an injected `openPr` wins (legacy bridge); otherwise pick by
+    //    the arbiter's remote URL (a GitHub remote ⇒ `gh pr create`, else push-only
+    //    `none`) — PURELY arbiter-derived, no override axis. A missing/unauthenticated
+    //    `gh` degrades to push-only at runtime — never a hard failure (and the
+    //    start-of-run unauthed case is caught UP FRONT by the pre-flight `gh` probe).
+    //    The seam is storage-agnostic: we hand it the work branch, the integration
+    //    mode, the provider, and the PR-INTENT (`noPR`) — `main` lives only in the
+    //    strategy.
+    // Provider precedence: an injected fully-formed provider wins (the `run`
+    // stubbed-provider seam, carrying title/body/url); else the legacy `openPr`
+    // bridge; else select PURELY from the arbiter URL (no override). The orthogonal
+    // `noPR` INTENT (suppress the PR) is threaded SEPARATELY — it does NOT pick a
+    // provider, the integrator simply skips `openRequest` when it is set.
+    const provider = input.providerInstance ??
+        (input.openPr
+            ? bridgeProvider(input.openPr)
+            : selectProvider({
+                arbiterUrl: await arbiterUrl(cwd, arbiter, env),
+            }));
+    // Race-1 (claim-vs-integrate, task
+    // `run-fleet-claim-integrate-and-sibling-rebase-concurrency-safe`): integrate,
+    // and on a non-fast-forward `${branch}:main` push (a SIBLING same-repo CLAIM —
+    // under the SEPARATE claim lock — or a sibling integrate advanced
+    // `<arbiter>/main` during our push window) RE-RUN the step-4 rebase (which
+    // carries the sibling-ledger + divergent-done-move reconcile arms — a bare
+    // re-rebase would MISS them) and RETRY the push, up to a small cap. INSTANT
+    // retry (contention, not an outage; see `claim-cas.ts`). We NEVER `--force`
+    // main: each retry re-rebases to a clean fast-forward. A genuine code conflict
+    // on a re-rebase routes to needs-attention via the SAME `route` the up-front
+    // rebase uses. A persistent non-fast-forward past the cap also routes (never a
+    // silent drop). `input.mergeRetries` overrides the cap (tests; `0` ⇒ no retry).
+    //
+    // **C2 rebase-until-real-conflict (task `c2-rebase-until-real-on-durable-main-
+    // promotions`):** the loop's TERMINATION CHANGED. A CLEAN re-rebase no longer
+    // counts against a tiny give-up budget — only a GENUINE conflict surfaced by
+    // `rebaseOntoMainWithReconcile` (a `route` ⇒ `rebase-conflict` or
+    // `invariant-violation`) stops the loop. The step-4 rebase IS the source-folder
+    // precondition recheck reused verbatim: if the slug is GONE from its expected
+    // source folder on the new `main` (a concurrent legitimate same-item winner
+    // already moved it), the `git mv` replay fails and `rebaseConflictRoute` routes
+    // definitively — never a silent re-push that would clobber the winner. The
+    // `maxMergeRetries` cap survives ONLY as a large liveness ceiling on the
+    // pathological livelock tail (default {@link DEFAULT_MERGE_RETRIES} = 1000);
+    // modest jitter on the refetch desynchronises a herd so the tail is not
+    // reached under sustained parallel load.
+    const maxMergeRetries = input.mergeRetries ?? DEFAULT_MERGE_RETRIES;
+    const mergeJitterMs = input.mergeJitterMs ?? DEFAULT_MERGE_JITTER_MS;
+    // The landed-vs-gated report (ADR `ci-agent-job-holds-no-write-token`
+    // decision 2, task `ci-split-landed-vs-gated-report`), scoped to the CI apply
+    // phase: only it sets `gatedTip` (the validated bundle tip the agent job
+    // gated). The CAS loop below never re-gates, so a re-rebase after a lost race
+    // can land a tree the gate never saw: {@link stampLandedWithoutRegate}
+    // records that on the landed commit. Without `gatedTip` (every non-phase
+    // land) the loop is exactly today's: no tree compare, no message rewrite.
+    const gatedTree = input.gatedTip === undefined
+        ? undefined
+        : await treeOf(cwd, input.gatedTip, env);
+    let regateReport;
+    let integration;
+    for (let mergeAttempt = 0;; mergeAttempt++) {
+        integration = await ledgerWrite.applyCompleteTransition({
+            arbiter,
+            branch,
+            mode,
+            provider,
+            // PR-INTENT: when set (propose mode), push the branch but skip the PR.
+            noPR: input.noPR,
+            // Half A: an explicit single-line PR title (propose mode), so `gh` no longer
+            // derives a run-on title from the commit subject via `--fill`.
+            title: input.title,
+            // Half B: the propose-mode PR body — the agent's summary under a deterministic
+            // runner header (task pointer). Undefined when no body was supplied (the
+            // header is only scaffolded when there IS a body) ⇒ today's `--fill` (no
+            // regression). Ignored in merge mode by the provider/integrator.
+            body: input.body,
+            // Part (b) of the merged-branch hygiene task: when WE perform the merge
+            // (this resolved `merge` mode), reap the remote `work/<slug>` HEAD branch
+            // INLINE right after the merge lands — the commits are now on `main`, so the
+            // head is provably merged and safe to delete (ancestor-guarded inside the
+            // integrator). Idempotent no-op when no remote head exists (the plain
+            // `${branch}:main` push opened none); ignored in `propose` mode (its branch is
+            // the review surface, reaped later by `gc --remote-branches`). NEVER `--force`.
+            deleteMergedHead: true,
+            cwd,
+            env,
+        });
+        // Only the merge push can be non-fast-forward (propose pushes its own ref).
+        if (integration.mergeNonFastForward !== true) {
+            break;
+        }
+        if (mergeAttempt >= maxMergeRetries) {
+            // LIVENESS CEILING hit (default 1000; previously the small Race-1 cap of 5,
+            // now reinterpreted by C2 as the pathological-livelock-tail bound, NOT a
+            // false-contention budget). Route to needs-attention rather than looping
+            // forever or force-pushing main. A RARE outcome under realistic load thanks
+            // to the jitter below + the rebase-until-real-conflict semantics; tests
+            // reach it deterministically by injecting a small `mergeRetries`.
+            return await mergeNonFastForwardRoute(`integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+                `non-fast-forward push (a sibling advanced main ${mergeAttempt + 1} ` +
+                `times); gave up cleanly without --force`);
+        }
+        // Modest jitter on the refetch (C2): an instant lockstep refetch→re-push loop
+        // maximises mutual rejection under sustained parallel load (thundering herd).
+        // A uniformly-random `[0, mergeJitterMs]` ms sleep desynchronises the herd.
+        // Skipped when `mergeJitterMs === 0` (the test seam).
+        if (mergeJitterMs > 0) {
+            await sleepMs(Math.floor(Math.random() * (mergeJitterMs + 1)));
+        }
+        // A sibling advanced main: re-run the step-4 rebase (with the reconcile arms)
+        // before retrying the push. A genuine conflict on the re-rebase routes via
+        // `rebaseOntoMainWithReconcile`'s `route` (the existing source-folder /
+        // one-slug placement recheck IS the genuine-conflict terminator — see the
+        // `DEFAULT_MERGE_RETRIES` docstring for the C2 SCOPE box). A clean re-rebase
+        // (no route) loops without counting against a small budget.
+        const reRebase = await rebaseOntoMainWithReconcile(input);
+        if (reRebase.route) {
+            return reRebase.route;
+        }
+        if (gatedTree !== undefined) {
+            regateReport = await stampLandedWithoutRegate({
+                cwd,
+                branch,
+                gatedTree,
+                lostRaces: mergeAttempt + 1,
+                env,
+            });
+        }
+    }
+    if (regateReport !== undefined && integration.mergedToMain === true) {
+        note(`${branch} ${regateReport}.`);
+    }
+    noteRequestNotOpened(integration, branch, note);
+    // The Race-1 needs-attention route for a merge that could not land (a genuine
+    // re-rebase conflict is handled by `rebaseOntoMainWithReconcile`'s `route`; this
+    // covers the cap-exhausted persistent-contention case). Mirrors
+    // `rebaseConflictRoute`: the done-move was already committed (steps 2–3), so the
+    // slug sits in work/done/ and the seam bounces it from there.
+    async function mergeNonFastForwardRoute(reason) {
+        const routed = await ledgerWrite.applyNeedsAttentionTransition({
+            cwd,
+            slug,
+            reason,
+            arbiter: input.surfaceArbiter,
+            env,
+            note,
+        });
         return {
-            outcome: 'completed',
-            routedToNeedsAttention: false,
+            outcome: 'rebase-conflict',
+            routedToNeedsAttention: routed.moved,
             branch,
             commitMessage,
-            integration,
+            reason: routed.moved
+                ? `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+                    `non-fast-forward push (a sibling advanced main); '${slug}' was ` +
+                    `marked stuck on its per-item lock (surfaced by status). Resolve ` +
+                    `against the latest main, then \`requeue\` to release the stuck ` +
+                    `lock and re-run.`
+                : `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+                    `non-fast-forward push (a sibling advanced main). Resolve against the ` +
+                    `latest main, then re-run complete.`,
         };
+    }
+    // 6. Make the Gate-2 review VISIBLE on the PR (task `review-comment-prose-field`,
+    //    refining `review-gate-pr-comment`): AFTER the propose integrate, where the
+    //    approved verdict (with its deliberately-authored `review` prose), the
+    //    resolved `provider`, AND the opened PR url (`integration.url`) are ALL in
+    //    scope, post `verdict.review` as a comment on that PR — INCLUDING on approve
+    //    (the audit trail; decided 2026-06-06). The `review` field is a first-class
+    //    AUTHORED review (the prompt requires it), NOT the residue around the JSON
+    //    — posting the residue was the bug
+    //    (`work/findings/review-comment-posts-agent-thinking-not-a-review.md`). It
+    //    reuses the SAME `provider` the integrate used (the core never imports `gh`).
+    //    The comment is ADVISORY: it changes no gate/verdict/merge/integration logic
+    //    — by here the verdict has ALREADY routed (block never reaches this point; it
+    //    routed to needs-attention above) and the integrate has ALREADY happened.
+    //    The PR identity is resolved in PRECEDENCE: a parsed `integration.url` wins
+    //    (the normal path — post on it directly); else, when a PR WAS opened but its
+    //    url was unparseable (`integration.requestOpened` true, `url` undefined — the
+    //    `gh pr create` exit-0-but-unparseable-stdout degradation), FALL BACK to the
+    //    BRANCH-resolved comment (task `review-comment-fallback-on-unparsed-pr-url`):
+    //    the provider resolves the branch's open PR and comments on it, instead of
+    //    silently dropping a review on a PR that genuinely exists. Only when NO PR was
+    //    opened at all (merge mode, or a degraded/push-only propose ⇒ `requestOpened`
+    //    false) is it the honest clean no-op — and the branch-resolved fallback's own
+    //    "no PR resolvable" path is a clean no-op too (it tries first). Either way
+    //    `postPRComment*` never throws; the review stays in the run output. Because
+    //    this lives in the shared core, BOTH `do`/`complete` AND `run` post the
+    //    comment — no per-caller wiring.
+    if (input.reviewProse !== undefined) {
+        if (integration.url !== undefined) {
+            const posted = provider.postPRComment({
+                cwd,
+                url: integration.url,
+                body: input.reviewProse,
+                env,
+            });
+            note(posted.instruction);
+        }
+        else if (integration.requestOpened) {
+            // A PR opened but its url was unparseable — resolve it from the branch
+            // rather than dropping the review (the audit-trail fallback).
+            const posted = provider.postPRCommentOnBranch({
+                cwd,
+                branch,
+                body: input.reviewProse,
+                env,
+            });
+            note(posted.instruction);
+        }
+    }
+    return {
+        outcome: 'completed',
+        routedToNeedsAttention: false,
+        branch,
+        commitMessage,
+        integration,
     };
-    // Serialise ONLY this tail per repo when the `run` seam is wired; absent ⇒ run
-    // it directly (an un-contended no-op, single-job behaviour unchanged).
-    return input.integrateLock && input.integrateLockKey !== undefined
-        ? await input.integrateLock(input.integrateLockKey, runRebaseToIntegrateTail)
-        : await runRebaseToIntegrateTail();
 }
 /**
  * RECOVER an already-committed, already-done-moved STRANDED branch (spec
@@ -1275,7 +1422,10 @@ async function recoverAlreadyCommitted(params) {
     for (;;) {
         const rebase = await gitSoft(rebaseArgs(), cwd, env);
         if (rebase.status === 0) {
-            break; // clean rebase ⇒ fall through to integrate
+            // Clean rebase ⇒ fold in any question residue it brought (the kept
+            // branch predates a surface on `main`), then fall through to integrate.
+            await foldQuestionResidueIntoTip({ cwd, arbiter, slug, env, note });
+            break;
         }
         // ALWAYS abort on conflict — never leave mid-rebase between attempts.
         await gitSoft(['rebase', '--abort'], cwd, env);
@@ -1451,6 +1601,7 @@ async function recoverAlreadyCommitted(params) {
         : `Recovered '${slug}': integrated the kept commit from ${branch} ` +
             `(absorbed a moving ${arbiter}/main across ${attempt} re-fetch+re-` +
             `rebase attempt${attempt === 1 ? '' : 's'}).`);
+    noteRequestNotOpened(integration, branch, note);
     // Post the Gate-2 review as a PR comment (task `committed-recovery-always-
     // reviews`): the SAME post-integrate audit trail the build path keeps — the
     // approved verdict's authored `review` prose, on the opened PR. Advisory only
@@ -1485,6 +1636,21 @@ async function recoverAlreadyCommitted(params) {
         integration,
     };
 }
+/**
+ * Say so when a propose land opened NO review request (task
+ * `intake-reports-the-pr-it-actually-opened`): the branch is pushed, but the
+ * provider could not (or was told not to) open a PR, so the log prints the
+ * provider's instruction (the real `gh` error + the manual `gh pr create`
+ * command) instead of leaving it unread. Every land (build, tasking, intake,
+ * recovery) passes through here, so no caller has to remember to print it. A
+ * merge land, an opened request and an already-landed no-op print nothing.
+ */
+function noteRequestNotOpened(integration, branch, note) {
+    const reason = proposeRequestNotOpened(integration);
+    if (reason !== undefined) {
+        note(`No PR was opened for ${branch}: ${reason}`);
+    }
+}
 /**
  * Resolve the work branch the integration runs on: the branch HEAD is currently
  * on (the caller is ALWAYS on the work branch — the agent built there / the
@@ -1665,6 +1831,8 @@ export function synthesiseProposeTitle(input) {
  * header that points a reviewer back to the task file. Returns `undefined` when
  * no body was supplied — so the provider degrades to today's `gh ... --fill` (no
  * regression); the header is ONLY scaffolded when there IS prose to carry.
+ * `header` overrides the default task-build pointer (`Task: work/tasks/done/<slug>.md`)
+ * for a non-task lifecycle (tasking, intake), whose item rests elsewhere.
  * Exported for unit tests of the header + pointer.
  */
 export function composeProposeBody(input) {
@@ -1672,9 +1840,18 @@ export function composeProposeBody(input) {
     if (!prose) {
         return undefined;
     }
-    const header = `Task: \`${workItemRel('done', `${input.slug}.md`)}\``;
+    const header = input.header ??
+        proposePointer('Task', workItemRel('done', `${input.slug}.md`));
     return `${header}\n\n${prose}`;
 }
+/**
+ * The one-line reviewer pointer a propose PR body opens with: `<label>: `<path>``,
+ * where `path` is the repo-relative file the PR carries (task
+ * `propose-pr-bodies-point-at-the-real-item`).
+ */
+export function proposePointer(label, path) {
+    return `${label}: \`${path}\``;
+}
 /**
  * On a review APPROVE that carries ≥1 NON-BLOCKING finding, write ONE per-run
  * observation `work/notes/observations/review-nits-<slug>-<YYYY-MM-DD>.md` capturing all
@@ -1769,21 +1946,13 @@ function readTitle(content) {
         const match = /^title\s*:\s*(.*)$/.exec(line);
         if (match) {
             const value = match[1].trim();
-            return value === '' ? undefined : unquote(value);
+            // The shared frontmatter unquoter, so a title written by
+            // `quoteYamlScalar` (`''` for a literal `'`) reads back verbatim.
+            return value === '' ? undefined : unquoteYamlScalar(value);
         }
     }
     return undefined;
 }
-function unquote(value) {
-    if (value.length >= 2) {
-        const first = value[0];
-        const last = value[value.length - 1];
-        if ((first === '"' || first === "'") && last === first) {
-            return value.slice(1, -1);
-        }
-    }
-    return value;
-}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -2216,39 +2385,15 @@ async function reconcileDivergentDoneMove(params) {
     return true;
 }
 /**
- * Run the Gate-2 PR/code REVIEW gate against a given tree ({@param reviewCwd}) and
- * route a BLOCK to needs-attention, returning DATA the caller acts on. Factored out
- * of {@link performIntegration} so the SAME gate can run in TWO places without
- * forking its logic (MAINTAINER DECISION 2, task `gate-on-rebased-tip-fresh-worktree`):
- *
- *   - fresh-worktree gate OFF: the caller invokes it at the FRONT on the pre-rebase
- *     `cwd`, right after the front `verify` (today's order, byte-for-byte);
- *   - fresh-worktree gate ON: the caller invokes it on the REBASED TIP (the fresh
- *     gate worktree), right AFTER the rebased-tip `verify` passes — so
- *     verify-THEN-review holds on the SAME merged tree.
- *
- * The review AGENT inspects {@param reviewCwd} (the tree under review); the
- * needs-attention ROUTING always targets `params.cwd` (where the work branch +
- * ledger live), so the routing is identical whichever tree was reviewed — ONLY the
- * source of the reviewed tree moved, not the verdict handling.
- *
- * It NEVER mutates `mode` or writes the nits observation itself (those are the
- * caller's concern, because WHEN they happen differs by path — pre-commit on OFF,
- * post-commit-amend on ON); it returns the verdict and lets the caller place those
- * effects correctly for its band position.
+ * Run a review gate for up to `maxRounds` rounds on ONE tree and return the
+ * verdict as DATA, writing nothing (the WRITE-FREE core of {@link runGate2Review},
+ * which adds the needs-attention routing). Factored out so the CI tasking agent
+ * phase (task `ci-split-tasking`) runs the one-round task-set review the SAME
+ * way `performIntegration` does, in the job that may launch agents, without the
+ * routing writes (the apply phase routes). A non-parse error is re-thrown.
  */
-async function runGate2Review(params) {
-    const { reviewCwd, input, slug, branch, cwd, env, note } = params;
-    const reviewGate = input.reviewGate;
-    if (!reviewGate) {
-        // `review` on with no gate wired is a usage error — the floor must never be
-        // silently skipped. (Production always wires `harnessReviewGate`.) The caller's
-        // try/catch maps a thrown error to its usage-error outcome.
-        throw new Error(`review is on but no review gate is configured — cannot run Gate 2 ` +
-            `for '${slug}' (this is a wiring bug; the gate must not be skipped).`);
-    }
-    const maxRounds = Math.max(1, input.reviewMaxRounds ?? 2);
-    note('Running the PR/code review gate (Gate 2)…');
+export async function runReviewRounds(params) {
+    const { reviewGate, slug, reviewCwd, maxRounds } = params;
     // CORROBORATED-APPROVAL semantics (NOT retry-until-pass): the gate runs the
     // reviewer up to `reviewMaxRounds` times on the SAME tip and approves ONLY if
     // EVERY round approves. A `block` is TERMINAL — it short-circuits the loop and
@@ -2267,72 +2412,28 @@ async function runGate2Review(params) {
             verdict = await reviewGate({
                 slug,
                 cwd: reviewCwd,
-                reviewModel: input.reviewModel,
+                reviewModel: params.reviewModel,
                 round,
-                // `--watch` threading (task `watch-review-session`): when on, the production
-                // gate tails the review session live. OFF ⇒ the plain sync launch, unchanged.
-                watch: input.watch,
-                watchSink: input.watchSink,
-                color: input.color,
-                sessionsDir: input.sessionsDir,
-                // The review AGENT launches with the AMBIENT env, never the identity-scoped
-                // `env` (an agent must not act as the bot). Falls back to `env` when no
-                // identity is configured (unchanged for non-identity callers).
-                env: input.agentEnv ?? env,
+                watch: params.watch,
+                watchSink: params.watchSink,
+                color: params.color,
+                sessionsDir: params.sessionsDir,
+                env: params.env,
             });
         }
         catch (err) {
             if (!(err instanceof ReviewParseError)) {
                 // Anything else (a harness/connection throw, a programmer bug) is NOT this
-                // gate's concern — re-throw so the existing catch sites classify it.
+                // gate's concern: re-throw so the existing catch sites classify it.
                 throw err;
             }
-            // THE GATE RAN BUT ITS VERDICT WAS UNREADABLE (direction 1, the safety net):
-            // the reviewer did NOT block — the gate's OUTPUT could not be parsed (a
-            // malformed JSON verdict, common on large diffs + weaker models, AFTER the
-            // direction-2 repair pass could not salvage it). WITHOUT this catch the throw
-            // escapes the core and `performComplete` maps it to the generic `usage-error`
-            // (verbatim, no push, no surface) AFTER the green build but BEFORE the
-            // done-move/push — STRANDING the lock + work branch with no PR.
-            //
-            // A parse failure in ANY round is TERMINAL: route IMMEDIATELY, never re-roll
-            // the remaining rounds (mirroring the block-is-terminal rule — re-reviewing
-            // the same tip would just be the dice re-roll the corroboration loop forbids).
-            // We route through the SAME work-preserving `applyNeedsAttentionTransition`
-            // seam the block path uses (it PUSHES the work branch + surfaces the item on
-            // `surfaceArbiter` for the autonomous path), targeting `cwd` (the work branch +
-            // ledger), NOT the throwaway `reviewCwd` — so BOTH the direct `!freshWorktreeGate`
-            // path AND the fresh-worktree `review:` callback are covered by this ONE catch.
-            // The recorded reason carries the parse-failure phrase the `failure-cause.ts`
-            // signature matches → the `do`/`run` tail classifies it `transient-infra`
-            // (retry the SAME work: the gate output is STOCHASTIC, so a re-run CAN differ,
-            // and the direction-2 repair makes a re-run far more likely to parse). NEVER a
-            // silent approve.
-            const reason = `PR/code review (Gate 2) ran but its verdict could not be parsed: ` +
-                `${err.message}`;
-            const routed = await ledgerWrite.applyNeedsAttentionTransition({
-                cwd,
-                slug,
-                reason,
-                arbiter: input.surfaceArbiter,
-                env,
-                note,
-            });
-            const message = routed.moved
-                ? `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
-                    'marked it stuck on its per-item lock (work branch pushed + lock ' +
-                    'surfaced; transient-infra — re-run). NOT integrated.'
-                : `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
-                    'NOT integrating.';
-            note(message);
+            // A parse failure in ANY round is TERMINAL (never re-roll the remaining
+            // rounds). The reason carries the parse-failure phrase the
+            // `failure-cause.ts` signature matches (a transient class).
             return {
-                kind: 'blocked',
-                result: {
-                    outcome: 'review-unparseable',
-                    routedToNeedsAttention: routed.moved,
-                    branch,
-                    reason,
-                },
+                kind: 'unparseable',
+                reason: `PR/code review (Gate 2) ran but its verdict could not be parsed: ` +
+                    `${err.message}`,
             };
         }
         lastVerdict = verdict;
@@ -2346,6 +2447,111 @@ async function runGate2Review(params) {
         // must ALSO approve for the gate to pass (corroboration, not first-approve-wins).
         approved = true;
     }
+    return approved
+        ? { kind: 'approved', verdict: lastVerdict }
+        : { kind: 'blocked', verdict: lastVerdict };
+}
+/**
+ * Run the Gate-2 PR/code REVIEW gate against a given tree ({@param reviewCwd}) and
+ * route a BLOCK to needs-attention, returning DATA the caller acts on. Factored out
+ * of {@link performIntegration} so the SAME gate can run in TWO places without
+ * forking its logic (MAINTAINER DECISION 2, task `gate-on-rebased-tip-fresh-worktree`):
+ *
+ *   - fresh-worktree gate OFF: the caller invokes it at the FRONT on the pre-rebase
+ *     `cwd`, right after the front `verify` (today's order, byte-for-byte);
+ *   - fresh-worktree gate ON: the caller invokes it on the REBASED TIP (the fresh
+ *     gate worktree), right AFTER the rebased-tip `verify` passes — so
+ *     verify-THEN-review holds on the SAME merged tree.
+ *
+ * The review AGENT inspects {@param reviewCwd} (the tree under review); the
+ * needs-attention ROUTING always targets `params.cwd` (where the work branch +
+ * ledger live), so the routing is identical whichever tree was reviewed — ONLY the
+ * source of the reviewed tree moved, not the verdict handling.
+ *
+ * It NEVER mutates `mode` or writes the nits observation itself (those are the
+ * caller's concern, because WHEN they happen differs by path — pre-commit on OFF,
+ * post-commit-amend on ON); it returns the verdict and lets the caller place those
+ * effects correctly for its band position.
+ */
+async function runGate2Review(params) {
+    const { reviewCwd, input, slug, branch, cwd, env, note } = params;
+    const reviewGate = input.reviewGate;
+    if (!reviewGate) {
+        // `review` on with no gate wired is a usage error — the floor must never be
+        // silently skipped. (Production always wires `harnessReviewGate`.) The caller's
+        // try/catch maps a thrown error to its usage-error outcome.
+        throw new Error(`review is on but no review gate is configured — cannot run Gate 2 ` +
+            `for '${slug}' (this is a wiring bug; the gate must not be skipped).`);
+    }
+    note('Running the PR/code review gate (Gate 2)…');
+    const maxRounds = Math.max(1, input.reviewMaxRounds ?? 2);
+    const rounds = await runReviewRounds({
+        reviewGate,
+        slug,
+        reviewCwd,
+        maxRounds,
+        reviewModel: input.reviewModel,
+        // `--watch` threading (task `watch-review-session`): when on, the production
+        // gate tails the review session live. OFF ⇒ the plain sync launch, unchanged.
+        watch: input.watch,
+        watchSink: input.watchSink,
+        color: input.color,
+        sessionsDir: input.sessionsDir,
+        // The review AGENT launches with the AMBIENT env, never the identity-scoped
+        // `env` (an agent must not act as the bot). Falls back to `env` when no
+        // identity is configured (unchanged for non-identity callers).
+        env: input.agentEnv ?? env,
+    });
+    if (rounds.kind === 'unparseable') {
+        // THE GATE RAN BUT ITS VERDICT WAS UNREADABLE (direction 1, the safety net):
+        // the reviewer did NOT block — the gate's OUTPUT could not be parsed (a
+        // malformed JSON verdict, common on large diffs + weaker models, AFTER the
+        // direction-2 repair pass could not salvage it). WITHOUT this catch the throw
+        // escapes the core and `performComplete` maps it to the generic `usage-error`
+        // (verbatim, no push, no surface) AFTER the green build but BEFORE the
+        // done-move/push — STRANDING the lock + work branch with no PR.
+        //
+        // A parse failure in ANY round is TERMINAL: route IMMEDIATELY, never re-roll
+        // the remaining rounds (mirroring the block-is-terminal rule — re-reviewing
+        // the same tip would just be the dice re-roll the corroboration loop forbids).
+        // We route through the SAME work-preserving `applyNeedsAttentionTransition`
+        // seam the block path uses (it PUSHES the work branch + surfaces the item on
+        // `surfaceArbiter` for the autonomous path), targeting `cwd` (the work branch +
+        // ledger), NOT the throwaway `reviewCwd` — so BOTH the direct `!freshWorktreeGate`
+        // path AND the fresh-worktree `review:` callback are covered by this ONE catch.
+        // The recorded reason carries the parse-failure phrase the `failure-cause.ts`
+        // signature matches → the `do`/`run` tail classifies it `transient-infra`
+        // (retry the SAME work: the gate output is STOCHASTIC, so a re-run CAN differ,
+        // and the direction-2 repair makes a re-run far more likely to parse). NEVER a
+        // silent approve.
+        const reason = rounds.reason;
+        const routed = await ledgerWrite.applyNeedsAttentionTransition({
+            cwd,
+            slug,
+            reason,
+            arbiter: input.surfaceArbiter,
+            env,
+            note,
+        });
+        const message = routed.moved
+            ? `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
+                'marked it stuck on its per-item lock (work branch pushed + lock ' +
+                'surfaced; transient-infra — re-run). NOT integrated.'
+            : `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
+                'NOT integrating.';
+        note(message);
+        return {
+            kind: 'blocked',
+            result: {
+                outcome: 'review-unparseable',
+                routedToNeedsAttention: routed.moved,
+                branch,
+                reason,
+            },
+        };
+    }
+    const lastVerdict = rounds.verdict;
+    const approved = rounds.kind === 'approved';
     if (!approved) {
         // NON-approve verdict: route to needs-attention via the SAME seam the red gate
         // uses, NEVER integrate. We reach here EITHER because a round returned a
@@ -2488,13 +2694,80 @@ async function runFreshWorktreeGate(params) {
         }
     }
 }
+/**
+ * The git trailer key that marks a merge-mode land whose tree differs from the
+ * gated tree (ADR `ci-agent-job-holds-no-write-token` decision 2). Its value is
+ * the report, e.g. `landed without re-gate after 2 lost races`. A git trailer
+ * like `CAS-Nonce` (`ledger-write.ts`), so `git log --format=%(trailers)`
+ * reads it back.
+ */
+export const LANDED_WITHOUT_REGATE_TRAILER = 'Landed-Without-Regate';
+/** The landed-vs-gated report for `lostRaces` lost pushes. */
+export function landedWithoutRegateReport(lostRaces) {
+    return (`landed without re-gate after ${lostRaces} lost ` +
+        (lostRaces === 1 ? 'race' : 'races'));
+}
+/** The tree id of `rev` in `cwd`. */
+async function treeOf(cwd, rev, env) {
+    return (await gitHard(['rev-parse', `${rev}^{tree}`], cwd, env)).stdout.trim();
+}
+/**
+ * After the merge-mode CAS loop re-rebased `branch` for the `lostRaces`-th
+ * time, rewrite its tip so its message carries exactly the right
+ * {@link LANDED_WITHOUT_REGATE_TRAILER}: set (with this count) when the tip's
+ * tree differs from `gatedTree`, removed when it is equal again. A previous
+ * attempt's trailer rides the re-rebase as part of the message, which is why an
+ * existing one is always replaced, never appended to. Only the message changes:
+ * the tree, the parents and the author are the tip's own, and the branch ref
+ * moves by a compare-and-swap `update-ref` (the working tree and the index
+ * already match that tree). Returns the report when the trailer is set.
+ */
+async function stampLandedWithoutRegate(params) {
+    const { cwd, branch, gatedTree, lostRaces, env } = params;
+    const ref = `refs/heads/${branch}`;
+    const FIELD_SEP = '\u0000';
+    const raw = (await gitHard(['log', '-1', '--format=%H%x00%T%x00%P%x00%an%x00%ae%x00%aI%x00%B', ref], cwd, env)).stdout;
+    const [head, tree, parentList, authorName, authorEmail, authorDate, body] = raw.split(FIELD_SEP);
+    const report = tree.trim() === gatedTree
+        ? undefined
+        : landedWithoutRegateReport(lostRaces);
+    const original = (body ?? '').replace(/\s+$/, '');
+    const prefix = `${LANDED_WITHOUT_REGATE_TRAILER}:`;
+    const stripped = original
+        .split('\n')
+        .filter((line) => !line.startsWith(prefix))
+        .join('\n')
+        .replace(/\s+$/, '');
+    const message = report === undefined
+        ? stripped
+        : (await gitHard([
+            'interpret-trailers',
+            '--trailer',
+            `${LANDED_WITHOUT_REGATE_TRAILER}: ${report}`,
+        ], cwd, env, `${stripped}\n`)).stdout.replace(/\s+$/, '');
+    if (message === original)
+        return report;
+    const parents = parentList
+        .trim()
+        .split(/\s+/)
+        .filter((p) => p !== '')
+        .flatMap((p) => ['-p', p]);
+    const rewritten = (await gitHard(['commit-tree', tree.trim(), ...parents, '-F', '-'], cwd, {
+        ...(env ?? process.env),
+        GIT_AUTHOR_NAME: authorName,
+        GIT_AUTHOR_EMAIL: authorEmail,
+        GIT_AUTHOR_DATE: authorDate,
+    }, `${message}\n`)).stdout.trim();
+    await gitHard(['update-ref', ref, rewritten, head.trim()], cwd, env);
+    return report;
+}
 /** Run git, returning the raw result (no throw) — for soft checks. */
 function gitSoft(args, cwd, env) {
     return runAsync('git', args, cwd, { env });
 }
 /** Run git; throw on non-zero (genuinely unexpected plumbing failures). */
-async function gitHard(args, cwd, env) {
-    const result = await runAsync('git', args, cwd, { env });
+async function gitHard(args, cwd, env, input) {
+    const result = await runAsync('git', args, cwd, { env, input });
     if (result.status !== 0) {
         throw new Error(`git ${args.join(' ')} failed (exit ${result.status}): ${result.stderr.trim()}`);
     }