dorfl 0.14.2 → 0.15.0

package/src/integration-core.ts

@@ -27,16 +27,21 @@ import {
 	formatBlockReason,
 	reviewRoundsExhaustedReason,
 } from './review-gate.js';
-import {type IntegrateResult, type ReviewProvider} from './integrator.js';
+import {
+	type IntegrateResult,
+	type ReviewProvider,
+	proposeRequestNotOpened,
+} from './integrator.js';
 import {extractDecisionsBlock} from './agent-stop.js';
 import {ledgerWrite} from './ledger-write.js';
 import {selectProvider} from './github.js';
 import type {IntegrationMode} from './config.js';
-import {parseFrontmatter} from './frontmatter.js';
+import {parseFrontmatter, unquoteYamlScalar} from './frontmatter.js';
 import {git, run, runAsync, type RunResult} from './git.js';
 import {realSleep, type Sleep} from './retry-backoff.js';
 import {workBranchRef} from './slug-namespace.js';
 import {isAncestor} from './gc.js';
+import {clearOwnQuestionResidueOnLand} from './land-question-residue.js';
 import {
 	detectColocatedSidecars,
 	formatSidecarGuardReason,
@@ -204,6 +209,16 @@ export interface IntegrationLifecycle {
 	 * WHICH lifecycle landed; it gates nothing.
 	 */
 	commitTag?: string;
+	/**
+	 * The reviewer POINTER line heading the propose-mode PR body (task
+	 * `propose-pr-bodies-point-at-the-real-item`): it names the item's REAL resting
+	 * path after this lifecycle lands, so a reviewer can open the file the PR
+	 * carries. The task build default (`Task: work/tasks/done/<slug>.md`) is wrong
+	 * for a lifecycle (a tasked spec rests in `work/specs/tasked/`, an intake
+	 * document in its staged folder), so every lifecycle states its own. Compose it
+	 * with {@link proposePointer}.
+	 */
+	proposeHeader: string;
 }
 
 /**
@@ -429,6 +444,14 @@ export interface IntegrationCoreInput {
 	reviewModel?: string;
 	/** Bound the revise↔review loop (Gate 2). Defaults to 2. */
 	reviewMaxRounds?: number;
+	/**
+	 * The approved review prose of a review that already ran ELSEWHERE, set only
+	 * by the CI tasking apply phase (task `ci-split-tasking`): the task-set review
+	 * ran in the agent phase, so this land runs with `review` off and posts that
+	 * prose as the PR comment instead. Ignored when this band's own review runs
+	 * and approves (its verdict's prose wins). Unset everywhere else.
+	 */
+	approvedReviewProse?: string;
 	/** Integration mode the caller REQUESTED (`propose` default, or `merge`). */
 	mode: IntegrationMode;
 	/**
@@ -681,7 +704,6 @@ export async function performIntegration(
 	const arbiter = input.arbiter;
 	const slug = input.slug;
 	const source = input.source;
-	const recovering = input.recovering;
 	const note = input.note ?? (() => {});
 	// The work branch: the caller is on it (it carries the namespaced identity).
 	// Prefer the explicit `branch`; else read the branch HEAD is on; only fall
@@ -1119,6 +1141,19 @@ export async function performIntegration(
 		transcribeDecisionsIntoDoneRecord({cwd, slug, output: input.body, note});
 	}
 
+	// 2c. CLEAR THE TASK'S OWN STALE QUESTION STATE in the SAME done-move commit
+	//     (task `a-recovered-task-lands-without-stale-question-state`). A task that
+	//     was surfaced to needs-attention and then recovered carries
+	//     `needsAnswers: true` + its `work/questions/task-<slug>.md` sidecar on
+	//     this branch; the done-move makes both moot, so they leave in the commit
+	//     that makes them moot rather than on some later claim's reconcile. A
+	//     normal land is untouched. Residue that only ARRIVES with the rebase (the
+	//     surface landed on `main` after this branch was cut) is folded in after
+	//     the rebase instead ({@link foldQuestionResidueIntoTip}).
+	if (!lifecycle) {
+		clearOwnQuestionResidueOnLand({cwd, slug, note});
+	}
+
 	// 3. Commit: git add -A (the agent's uncommitted work + the move) into ONE
 	//    atomic commit. Nothing to commit is FATAL (no-op-is-fatal, like claim.sh).
 	await gitHard(['add', '-A'], cwd, env);
@@ -1150,6 +1185,29 @@ export async function performIntegration(
 	await gitHard(['commit', '-q', '-m', commitMessage], cwd, env);
 	note(`Committed: ${commitMessage}`);
 
+	// The rebase-to-integrate TAIL (step 4 fetch+rebase → step 5 integrate) is the
+	// ONLY region serialised per repo under the `run` concurrency seam: it is the
+	// land-on-`main` band where two concurrent SAME-repo merge jobs would otherwise
+	// race (the loser pushing a non-fast-forward `${branch}:main`). Wrapping ONLY
+	// this tail keeps the front-of-band gate (`prepare`+`verify`) and the Gate-2
+	// review agent CONCURRENT across same-repo jobs (run's parallelism); inside the
+	// lock the loser re-fetches + rebases onto the winner's now-advanced main, so
+	// its push is a clean fast-forward (a genuine conflict routes ONE to
+	// needs-attention). Single-job callers pass no lock ⇒ the tail runs directly,
+	// byte-for-byte unchanged. The lock is keyed per repo, so cross-repo
+	// integration stays fully concurrent.
+	const reconcileCtx: RebaseReconcileContext = {
+		cwd,
+		arbiter,
+		slug,
+		branch,
+		lifecycle: lifecycle !== undefined,
+		source,
+		surfaceArbiter: input.surfaceArbiter,
+		commitMessage,
+		env,
+		note,
+	};
 	// The rebase-to-integrate TAIL (step 4 fetch+rebase → step 5 integrate) is the
 	// ONLY region serialised per repo under the `run` concurrency seam: it is the
 	// land-on-`main` band where two concurrent SAME-repo merge jobs would otherwise
@@ -1162,223 +1220,12 @@ export async function performIntegration(
 	// byte-for-byte unchanged. The lock is keyed per repo, so cross-repo
 	// integration stays fully concurrent.
 	const runRebaseToIntegrateTail = async (): Promise<IntegrationCoreResult> => {
-		// The step-4 rebase-onto-`<arbiter>/main` (with BOTH reconciliation arms: the
-		// sibling-slug ledger arm and the divergent-done-move recovery), factored so it
-		// can run ONCE before the gate AND be RE-RUN in the Race-1 merge-push retry loop
-		// (a sibling advancing main mid-push needs the SAME reconcile, not a bare
-		// rebase). Returns `{}` on a clean rebase (fall through to gate/integrate) or
-		// `{route}` when a genuine conflict / invariant violation must stop the tail.
-		const rebaseOntoMainWithReconcile = async (): Promise<{
-			route?: IntegrationCoreResult;
-		}> => {
-			// 4. Rebase-before-integrate (ADR §10): rebase the work branch onto the
-			//    latest <arbiter>/main. Clean → continue. Conflict → abort + stop.
-			//
-			//    RECOVERY reconciliation: post the per-item-lock cut-over, a stuck item's
-			//    body never moved into a `needs-attention/` folder (stuck is the lock
-			//    `state: stuck`; the body rests in `backlog/`), so a recovery `complete`'s
-			//    kept branch carries NO historical `in-progress → needs-attention`
-			//    move-only commit to drop and `<arbiter>/main` holds no surface move to
-			//    conflict with. The old recovery drop (`rebaseDroppingNeedsAttentionSurface`,
-			//    drop-bookkeeping-rebase) is deleted; recovery is now the SAME plain replay
-			//    onto `<arbiter>/main` as any other build (see the plain-rebase note below).
-			// Fetch the arbiter's `main` into the `<arbiter>/main` remote-tracking ref
-			// EXPLICITLY. A `run` JOB WORKTREE is cut from a bare hub mirror whose remote
-			// has no fetch refspec (so `<arbiter>/main` would not otherwise resolve / would
-			// be stale, causing a spurious rebase conflict); a regular clone (`do`/
-			// `complete`) already has it, where the explicit refspec is harmless (the same
-			// refspec `rebaseOntoArbiterMain` used before the convergence).
-			await gitHard(
-				[
-					'fetch',
-					'--quiet',
-					arbiter,
-					`+refs/heads/main:refs/remotes/${arbiter}/main`,
-				],
-				cwd,
-				env,
-			);
-			// ONE-SLUG-ONE-FOLDER guard + divergent-base PRE-CHECK, read from the
-			// freshly-fetched `<arbiter>/main` (a READ of the tracking ref the fetch above
-			// just populated — NO new fetch, so no shared-mirror race). It (a) FAILS LOUD if
-			// the arbiter already holds the slug in >1 status folder with differing content
-			// (a corrupt ledger; never publish over it), and (b) detects the DIVERGENT base
-			// — the arbiter holds the slug's source in a DIFFERENT folder than our local
-			// done-move removed — which is the case that turns the rebased "move" into a
-			// "copy" (PR #86). The tasking lifecycle is exempt (its move is not a task
-			// done-move).
-			// CONTINUE-BUILD EXEMPTION (task
-			// `complete-builds-on-already-done-moved-continue`): on `source: 'done'`
-			// there was no first-time move on this commit (the slug was already in
-			// `done/` on the kept branch + on the arbiter), so the divergent-done-move
-			// reconcile reasoning does not apply. Skip the arbiter ledger placement
-			// pre-check too: it is structurally an instrument FOR that reconcile, and a
-			// continue-build is by construction already in `done/` on both sides.
-			if (!lifecycle && source !== 'done') {
-				const arbiterPlacement = readArbiterLedgerPlacement(
-					cwd,
-					arbiter,
-					slug,
-					env,
-				);
-				if (arbiterPlacement.error) {
-					note(arbiterPlacement.error);
-					return {
-						route: {
-							outcome: 'invariant-violation',
-							routedToNeedsAttention: false,
-							branch,
-							reason: arbiterPlacement.error,
-						},
-					};
-				}
-			}
-			// PLAIN rebase. After the per-item-lock cut-over (spec
-			// `ledger-status-per-item-lock-refs`, tasks 9a–9d) no transient status
-			// lands on a work branch: needs-attention is the lock `state: stuck` (not a
-			// `git mv` to `needs-attention/`), the body rests in `backlog/` while
-			// claimed, and the tasking/advancing markers are gone. So a recovery
-			// complete's kept branch carries NO historical route-to-needs-attention
-			// move-only commit to drop — the old `rebaseDroppingNeedsAttentionSurface`
-			// (drop-bookkeeping-rebase) is deleted and BOTH recovering and lifecycle
-			// rebases are the same plain replay onto `<arbiter>/main`.
-			void recovering;
-			void lifecycle;
-			// RENAME-DETECTION-OFF (task
-			// `disable-rename-detection-on-continue-rebase`): scope
-			// `-c merge.directoryRenames=false` to THIS rebase invocation, so a single
-			// durable folder-transition `git mv` out of a SPARSE work/<from>/ folder is
-			// NOT misread by git's directory-rename heuristic as a whole-DIRECTORY
-			// rename `work/<from>/ → work/<to>/` (which would spuriously flag every
-			// sibling file `<arbiter>/main` added into that folder as `CONFLICT (file
-			// location)` and force a FALSE needs-attention). Content-rename detection
-			// (`-Xno-renames`/`merge.renames`/`diff.renames`) is the wrong knob and
-			// does NOT suppress this directory-rename conflict; only
-			// `merge.directoryRenames=false` does. NEVER a persistent `git config`
-			// write — the repo's config stays clean so a user's interactive
-			// `git rebase` is unaffected. A GENUINE content conflict still surfaces
-			// and still routes via `rebaseConflictRoute()` below.
-			const rebase = await gitSoft(
-				['-c', 'merge.directoryRenames=false', 'rebase', `${arbiter}/main`],
-				cwd,
-				env,
-			);
-			if (rebase.status !== 0) {
-				// NEVER auto-resolve a genuine CODE conflict. But FIRST, a SIBLING-SLUG
-				// LEDGER conflict (the replay conflicts ONLY on OTHER slugs'
-				// `work/<status>/<otherslug>.md` ledger files — a sibling job landed its own
-				// status-folder move on `<arbiter>/main` between our base and this rebase) is
-				// a benign ledger-only divergence with NO semantic judgement: the reconcile
-				// ABORTS the rebase, then redoes OUR work as one clean commit on top of
-				// `<arbiter>/main` (taking the arbiter's version of every sibling ledger file
-				// automatically). It is scoped STRICTLY to other slugs' ledger files — a
-				// conflict touching ANY code file, or THIS slug's own ledger, returns `false`
-				// (and leaves the rebase in progress), so the divergent-done-move recovery /
-				// needs-attention route below handles it; it NEVER widens to code. The tasking
-				// lifecycle is exempt (its move is not a task done-move).
-				const siblingReconciled = lifecycle
-					? false
-					: await reconcileSiblingLedgerConflict({
-							cwd,
-							arbiter,
-							slug,
-							env,
-							note,
-						});
-				if (siblingReconciled) {
-					// The branch is now cleanly on top of `<arbiter>/main` with OUR work + the
-					// arbiter's sibling-ledger files — fall through to the fresh-gate + integrate
-					// band. THIS slug's own move is untouched.
-					note(
-						`Reconciled a sibling-slug ledger conflict during the rebase onto ` +
-							`${arbiter}/main (took the arbiter's version of the other slugs' ` +
-							`work/<status>/<slug>.md ledger files; no code file was touched).`,
-					);
-				} else if (!lifecycle && source !== 'done') {
-					// NEVER auto-resolve a genuine CODE conflict: abort the rebase. But FIRST, a
-					// DIVERGENT-LEDGER conflict (the arbiter holds the slug's source in a folder
-					// our local done-move did not remove — PR #86) is auto-RECONCILABLE without
-					// any semantic judgement: redo the done-move arbiter-resolved (remove the
-					// arbiter's actual source folder, add `done/`) on top of `<arbiter>/main`. We
-					// only do this when the post-abort tree's ONLY divergence is the slug's ledger
-					// file; a real code conflict still routes to needs-attention untouched.
-					await gitSoft(['rebase', '--abort'], cwd, env);
-					const recovered = await reconcileDivergentDoneMove({
-						cwd,
-						arbiter,
-						slug,
-						branch,
-						localSource: source,
-						env,
-						note,
-					});
-					if (recovered) {
-						// The branch is now cleanly on top of `<arbiter>/main` with the slug in
-						// `done/` ONLY — fall through to integrate (skip the needs-attention
-						// route below).
-						note(
-							`Reconciled the done-move against ${arbiter}/main: '${slug}' is in ` +
-								'work/done/ ONLY (the divergent source folder was removed; the move ' +
-								'is a move, not a copy).',
-						);
-					} else {
-						return {route: await rebaseConflictRoute()};
-					}
-				} else {
-					await gitSoft(['rebase', '--abort'], cwd, env);
-					return {route: await rebaseConflictRoute()};
-				}
-			}
-			// Clean rebase (or a reconciled one): fall through to the gate + integrate.
-			return {};
-		};
-
 		// Run the step-4 rebase ONCE up front (before the slow fresh gate).
-		const firstRebase = await rebaseOntoMainWithReconcile();
+		const firstRebase = await rebaseOntoMainWithReconcile(reconcileCtx);
 		if (firstRebase.route) {
 			return firstRebase.route;
 		}
 
-		// The rebase-conflict needs-attention route, factored so the divergent-ledger
-		// recovery above can fall through to integrate while a genuine code conflict
-		// still routes here.
-		async function rebaseConflictRoute(): Promise<IntegrationCoreResult> {
-			// Then mark the item stuck on its per-item lock with the conflict reason
-			// (ADR §12) THROUGH the ledger write seam's needs-attention transition,
-			// rather than leaving it dangling. Post lock-cutover this is a lock amend
-			// (`state: stuck` + the reason on the lock entry, no `done/ →
-			// needs-attention/` folder move); the done-move already committed above
-			// stands. No partial state.
-			const reason = `rebase onto ${arbiter}/main conflicted (aborted, never auto-resolved)`;
-			const routed = await ledgerWrite.applyNeedsAttentionTransition({
-				cwd,
-				slug,
-				reason,
-				// Autonomous caller (`do`) passes the arbiter so the seam both surfaces the
-				// conflict on `main` (OBSERVABLE) AND pushes the `work/<slug>` branch
-				// (RECOVERABLE, cross-machine). The human `complete` leaves it unset →
-				// no surface, no push, local-only. The push lives in the seam (HEAD's
-				// branch is `work/<slug>` here) — no bolted-on push.
-				arbiter: input.surfaceArbiter,
-				env,
-				note,
-			});
-			return {
-				outcome: 'rebase-conflict',
-				routedToNeedsAttention: routed.moved,
-				branch,
-				commitMessage,
-				reason: routed.moved
-					? `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
-						`aborted (never auto-resolved) and '${slug}' was marked stuck on ` +
-						'its per-item lock (surfaced by status). Resolve against the latest ' +
-						'main, then `requeue` to release the stuck lock and re-run.'
-					: `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
-						'aborted (never auto-resolved). Resolve against the latest main, ' +
-						'then re-run complete.',
-			};
-		}
-
 		// 4c. FRESH-WORKTREE GATE (task `gate-on-rebased-tip-fresh-worktree`): when ON,
 		//     the acceptance gate (`prepare` then `verify`) runs HERE — on the work
 		//     branch tip the rebase above just produced (the would-be-integrated tip) —
@@ -1510,220 +1357,627 @@ export async function performIntegration(
 			}
 		}
 
-		// 5. Integrate per mode through the ledger write seam's COMPLETE transition
-		//    (ADR §6 + `docs/adr/claim-ledger-vs-protected-main.md`). The rebase above
-		//    already brought the branch up to date, so the seam's sole strategy uses
-		//    `integrate` (not `integrateWithRebase`) and never --forces. Provider
-		//    selection: an injected `openPr` wins (legacy bridge); otherwise pick by
-		//    the arbiter's remote URL (a GitHub remote ⇒ `gh pr create`, else push-only
-		//    `none`) — PURELY arbiter-derived, no override axis. A missing/unauthenticated
-		//    `gh` degrades to push-only at runtime — never a hard failure (and the
-		//    start-of-run unauthed case is caught UP FRONT by the pre-flight `gh` probe).
-		//    The seam is storage-agnostic: we hand it the work branch, the integration
-		//    mode, the provider, and the PR-INTENT (`noPR`) — `main` lives only in the
-		//    strategy.
-		// Provider precedence: an injected fully-formed provider wins (the `run`
-		// stubbed-provider seam, carrying title/body/url); else the legacy `openPr`
-		// bridge; else select PURELY from the arbiter URL (no override). The orthogonal
-		// `noPR` INTENT (suppress the PR) is threaded SEPARATELY — it does NOT pick a
-		// provider, the integrator simply skips `openRequest` when it is set.
-		const provider =
-			input.providerInstance ??
-			(input.openPr
-				? bridgeProvider(input.openPr)
-				: selectProvider({
-						arbiterUrl: await arbiterUrl(cwd, arbiter, env),
-					}));
-		// Race-1 (claim-vs-integrate, task
-		// `run-fleet-claim-integrate-and-sibling-rebase-concurrency-safe`): integrate,
-		// and on a non-fast-forward `${branch}:main` push (a SIBLING same-repo CLAIM —
-		// under the SEPARATE claim lock — or a sibling integrate advanced
-		// `<arbiter>/main` during our push window) RE-RUN the step-4 rebase (which
-		// carries the sibling-ledger + divergent-done-move reconcile arms — a bare
-		// re-rebase would MISS them) and RETRY the push, up to a small cap. INSTANT
-		// retry (contention, not an outage; see `claim-cas.ts`). We NEVER `--force`
-		// main: each retry re-rebases to a clean fast-forward. A genuine code conflict
-		// on a re-rebase routes to needs-attention via the SAME `route` the up-front
-		// rebase uses. A persistent non-fast-forward past the cap also routes (never a
-		// silent drop). `input.mergeRetries` overrides the cap (tests; `0` ⇒ no retry).
-		//
-		// **C2 rebase-until-real-conflict (task `c2-rebase-until-real-on-durable-main-
-		// promotions`):** the loop's TERMINATION CHANGED. A CLEAN re-rebase no longer
-		// counts against a tiny give-up budget — only a GENUINE conflict surfaced by
-		// `rebaseOntoMainWithReconcile` (a `route` ⇒ `rebase-conflict` or
-		// `invariant-violation`) stops the loop. The step-4 rebase IS the source-folder
-		// precondition recheck reused verbatim: if the slug is GONE from its expected
-		// source folder on the new `main` (a concurrent legitimate same-item winner
-		// already moved it), the `git mv` replay fails and `rebaseConflictRoute` routes
-		// definitively — never a silent re-push that would clobber the winner. The
-		// `maxMergeRetries` cap survives ONLY as a large liveness ceiling on the
-		// pathological livelock tail (default {@link DEFAULT_MERGE_RETRIES} = 1000);
-		// modest jitter on the refetch desynchronises a herd so the tail is not
-		// reached under sustained parallel load.
-		const maxMergeRetries = input.mergeRetries ?? DEFAULT_MERGE_RETRIES;
-		const mergeJitterMs = input.mergeJitterMs ?? DEFAULT_MERGE_JITTER_MS;
-		let integration!: IntegrateResult;
-		for (let mergeAttempt = 0; ; mergeAttempt++) {
-			integration = await ledgerWrite.applyCompleteTransition({
+		// 5. The LAND half (`landIntegration`, reached through the `integrationLand`
+		//    seam): integrate per mode with the merge-mode CAS loop, then the review
+		//    comment. The CI agent phase records this call as its boundary; the apply
+		//    phase resumes here (task `ci-split-build-path`).
+		return await integrationLand.land({
+			...reconcileCtx,
+			mode,
+			noPR: input.noPR,
+			providerInstance: input.providerInstance,
+			openPr: input.openPr,
+			title: prTitle,
+			body: composeProposeBody({
+				slug,
+				body: input.body,
+				header: lifecycle?.proposeHeader,
+			}),
+			reviewProse: approvedVerdict?.review ?? input.approvedReviewProse,
+			mergeRetries: input.mergeRetries,
+			mergeJitterMs: input.mergeJitterMs,
+		});
+	};
+
+	// Serialise ONLY this tail per repo when the `run` seam is wired; absent ⇒ run
+	// it directly (an un-contended no-op, single-job behaviour unchanged).
+	return input.integrateLock && input.integrateLockKey !== undefined
+		? await input.integrateLock(
+				input.integrateLockKey,
+				runRebaseToIntegrateTail,
+			)
+		: await runRebaseToIntegrateTail();
+}
+
+/**
+ * What {@link rebaseOntoMainWithReconcile} (and its conflict route) needs: the
+ * work branch in `cwd`, the arbiter, and which ledger reconcile arms apply.
+ */
+export interface RebaseReconcileContext {
+	/** The checkout / worktree the work branch is checked out in. */
+	cwd: string;
+	/** Name of the arbiter git remote (valid in `cwd`). */
+	arbiter: string;
+	slug: string;
+	/** The work branch (checked out in `cwd`). */
+	branch: string;
+	/**
+	 * True for a lifecycle (tasking / intake) transition: the task done-move
+	 * reconcile arms are exempt.
+	 */
+	lifecycle: boolean;
+	/** The done-move source folder (`done` exempts the ledger reconcile arms). */
+	source: IntegrationCoreInput['source'];
+	/** The arbiter a conflict surfaces on (the autonomous path); unset ⇒ local-only. */
+	surfaceArbiter?: string;
+	/** The completion commit's message (reported on the result). */
+	commitMessage: string;
+	env?: NodeJS.ProcessEnv;
+	note: (message: string) => void;
+}
+
+/** The inputs of {@link landIntegration}, the land half of the tail. */
+export interface IntegrationLandInput extends RebaseReconcileContext {
+	/** The resolved integration mode. */
+	mode: IntegrationMode;
+	/** PR-INTENT: push the branch but open no PR (propose). */
+	noPR?: boolean;
+	/** An injected fully-formed provider (tests / embeddings); else selected from the arbiter URL. */
+	providerInstance?: ReviewProvider;
+	/** The legacy `openPr` bridge. */
+	openPr?: IntegrationCoreInput['openPr'];
+	/** The single-line propose PR title. */
+	title: string;
+	/** The composed propose PR body (header + summary); undefined ⇒ `--fill`. */
+	body?: string;
+	/** The approved Gate-2 review prose, posted as a PR comment after a propose. */
+	reviewProse?: string;
+	/** The merge-mode CAS-loop liveness ceiling ({@link DEFAULT_MERGE_RETRIES}). */
+	mergeRetries?: number;
+	/** The merge-mode refetch jitter ({@link DEFAULT_MERGE_JITTER_MS}). */
+	mergeJitterMs?: number;
+	/**
+	 * The tip the acceptance gate ran on, set ONLY by the CI apply phase (the
+	 * validated bundle tip, `ci-phase-build.ts`). When set, a merge-mode land
+	 * whose landed tree differs from this tip's tree reports "landed without
+	 * re-gate after N lost races" in the run output and in a
+	 * {@link LANDED_WITHOUT_REGATE_TRAILER} trailer on the landed commit (ADR
+	 * `ci-agent-job-holds-no-write-token` decision 2). Unset (every non-phase
+	 * land: `do`, `complete`, `run`) ⇒ no report and no rewrite, today's
+	 * behaviour unchanged.
+	 */
+	gatedTip?: string;
+}
+
+/**
+ * The seam `performIntegration` reaches the land half through: a process-wide
+ * object (like `ledgerWrite`) so the CI agent phase can RECORD the land as the
+ * boundary (`phase-recorder.ts`) instead of performing it, and the apply phase
+ * can resume at it (`ci-phase-build.ts`).
+ */
+export interface IntegrationLandSeam {
+	land(input: IntegrationLandInput): Promise<IntegrationCoreResult>;
+}
+
+/** The process-wide {@link IntegrationLandSeam} (replaced only by the phase recorder). */
+export const integrationLand: IntegrationLandSeam = {
+	land: (input) => landIntegration(input),
+};
+
+/**
+ * The step-4 rebase-onto-`<arbiter>/main` (with BOTH reconciliation arms: the
+ * sibling-slug ledger arm and the divergent-done-move recovery), factored so it
+ * can run ONCE before the gate AND be RE-RUN in the Race-1 merge-push retry loop
+ * (a sibling advancing main mid-push needs the SAME reconcile, not a bare
+ * rebase). Returns `{}` on a clean rebase (fall through to gate/integrate) or
+ * `{route}` when a genuine conflict / invariant violation must stop the tail.
+ * Module-level (not a closure) so BOTH halves of the rebase-to-integrate tail
+ * reach it: the agent half runs it once before the fresh gate, and the land
+ * half ({@link landIntegration}) re-runs it in the merge-mode CAS loop.
+ */
+async function rebaseOntoMainWithReconcile(
+	ctx: RebaseReconcileContext,
+): Promise<{route?: IntegrationCoreResult}> {
+	const {cwd, arbiter, slug, branch, lifecycle, source, env} = ctx;
+	const note = ctx.note;
+	// 4. Rebase-before-integrate (ADR §10): rebase the work branch onto the
+	//    latest <arbiter>/main. Clean → continue. Conflict → abort + stop.
+	//
+	//    RECOVERY reconciliation: post the per-item-lock cut-over, a stuck item's
+	//    body never moved into a `needs-attention/` folder (stuck is the lock
+	//    `state: stuck`; the body rests in `backlog/`), so a recovery `complete`'s
+	//    kept branch carries NO historical `in-progress → needs-attention`
+	//    move-only commit to drop and `<arbiter>/main` holds no surface move to
+	//    conflict with. The old recovery drop (`rebaseDroppingNeedsAttentionSurface`,
+	//    drop-bookkeeping-rebase) is deleted; recovery is now the SAME plain replay
+	//    onto `<arbiter>/main` as any other build (see the plain-rebase note below).
+	// Fetch the arbiter's `main` into the `<arbiter>/main` remote-tracking ref
+	// EXPLICITLY. A `run` JOB WORKTREE is cut from a bare hub mirror whose remote
+	// has no fetch refspec (so `<arbiter>/main` would not otherwise resolve / would
+	// be stale, causing a spurious rebase conflict); a regular clone (`do`/
+	// `complete`) already has it, where the explicit refspec is harmless (the same
+	// refspec `rebaseOntoArbiterMain` used before the convergence).
+	await gitHard(
+		[
+			'fetch',
+			'--quiet',
+			arbiter,
+			`+refs/heads/main:refs/remotes/${arbiter}/main`,
+		],
+		cwd,
+		env,
+	);
+	// ONE-SLUG-ONE-FOLDER guard + divergent-base PRE-CHECK, read from the
+	// freshly-fetched `<arbiter>/main` (a READ of the tracking ref the fetch above
+	// just populated — NO new fetch, so no shared-mirror race). It (a) FAILS LOUD if
+	// the arbiter already holds the slug in >1 status folder with differing content
+	// (a corrupt ledger; never publish over it), and (b) detects the DIVERGENT base
+	// — the arbiter holds the slug's source in a DIFFERENT folder than our local
+	// done-move removed — which is the case that turns the rebased "move" into a
+	// "copy" (PR #86). The tasking lifecycle is exempt (its move is not a task
+	// done-move).
+	// CONTINUE-BUILD EXEMPTION (task
+	// `complete-builds-on-already-done-moved-continue`): on `source: 'done'`
+	// there was no first-time move on this commit (the slug was already in
+	// `done/` on the kept branch + on the arbiter), so the divergent-done-move
+	// reconcile reasoning does not apply. Skip the arbiter ledger placement
+	// pre-check too: it is structurally an instrument FOR that reconcile, and a
+	// continue-build is by construction already in `done/` on both sides.
+	if (!lifecycle && source !== 'done') {
+		const arbiterPlacement = readArbiterLedgerPlacement(
+			cwd,
+			arbiter,
+			slug,
+			env,
+		);
+		if (arbiterPlacement.error) {
+			note(arbiterPlacement.error);
+			return {
+				route: {
+					outcome: 'invariant-violation',
+					routedToNeedsAttention: false,
+					branch,
+					reason: arbiterPlacement.error,
+				},
+			};
+		}
+	}
+	// PLAIN rebase. After the per-item-lock cut-over (spec
+	// `ledger-status-per-item-lock-refs`, tasks 9a–9d) no transient status
+	// lands on a work branch: needs-attention is the lock `state: stuck` (not a
+	// `git mv` to `needs-attention/`), the body rests in `backlog/` while
+	// claimed, and the tasking/advancing markers are gone. So a recovery
+	// complete's kept branch carries NO historical route-to-needs-attention
+	// move-only commit to drop — the old `rebaseDroppingNeedsAttentionSurface`
+	// (drop-bookkeeping-rebase) is deleted and BOTH recovering and lifecycle
+	// rebases are the same plain replay onto `<arbiter>/main`.
+	// RENAME-DETECTION-OFF (task
+	// `disable-rename-detection-on-continue-rebase`): scope
+	// `-c merge.directoryRenames=false` to THIS rebase invocation, so a single
+	// durable folder-transition `git mv` out of a SPARSE work/<from>/ folder is
+	// NOT misread by git's directory-rename heuristic as a whole-DIRECTORY
+	// rename `work/<from>/ → work/<to>/` (which would spuriously flag every
+	// sibling file `<arbiter>/main` added into that folder as `CONFLICT (file
+	// location)` and force a FALSE needs-attention). Content-rename detection
+	// (`-Xno-renames`/`merge.renames`/`diff.renames`) is the wrong knob and
+	// does NOT suppress this directory-rename conflict; only
+	// `merge.directoryRenames=false` does. NEVER a persistent `git config`
+	// write — the repo's config stays clean so a user's interactive
+	// `git rebase` is unaffected. A GENUINE content conflict still surfaces
+	// and still routes via `rebaseConflictRoute(ctx)` below.
+	const rebase = await gitSoft(
+		['-c', 'merge.directoryRenames=false', 'rebase', `${arbiter}/main`],
+		cwd,
+		env,
+	);
+	if (rebase.status !== 0) {
+		// NEVER auto-resolve a genuine CODE conflict. But FIRST, a SIBLING-SLUG
+		// LEDGER conflict (the replay conflicts ONLY on OTHER slugs'
+		// `work/<status>/<otherslug>.md` ledger files — a sibling job landed its own
+		// status-folder move on `<arbiter>/main` between our base and this rebase) is
+		// a benign ledger-only divergence with NO semantic judgement: the reconcile
+		// ABORTS the rebase, then redoes OUR work as one clean commit on top of
+		// `<arbiter>/main` (taking the arbiter's version of every sibling ledger file
+		// automatically). It is scoped STRICTLY to other slugs' ledger files — a
+		// conflict touching ANY code file, or THIS slug's own ledger, returns `false`
+		// (and leaves the rebase in progress), so the divergent-done-move recovery /
+		// needs-attention route below handles it; it NEVER widens to code. The tasking
+		// lifecycle is exempt (its move is not a task done-move).
+		const siblingReconciled = lifecycle
+			? false
+			: await reconcileSiblingLedgerConflict({
+					cwd,
+					arbiter,
+					slug,
+					env,
+					note,
+				});
+		if (siblingReconciled) {
+			// The branch is now cleanly on top of `<arbiter>/main` with OUR work + the
+			// arbiter's sibling-ledger files — fall through to the fresh-gate + integrate
+			// band. THIS slug's own move is untouched.
+			note(
+				`Reconciled a sibling-slug ledger conflict during the rebase onto ` +
+					`${arbiter}/main (took the arbiter's version of the other slugs' ` +
+					`work/<status>/<slug>.md ledger files; no code file was touched).`,
+			);
+		} else if (!lifecycle && source !== 'done') {
+			// NEVER auto-resolve a genuine CODE conflict: abort the rebase. But FIRST, a
+			// DIVERGENT-LEDGER conflict (the arbiter holds the slug's source in a folder
+			// our local done-move did not remove — PR #86) is auto-RECONCILABLE without
+			// any semantic judgement: redo the done-move arbiter-resolved (remove the
+			// arbiter's actual source folder, add `done/`) on top of `<arbiter>/main`. We
+			// only do this when the post-abort tree's ONLY divergence is the slug's ledger
+			// file; a real code conflict still routes to needs-attention untouched.
+			await gitSoft(['rebase', '--abort'], cwd, env);
+			const recovered = await reconcileDivergentDoneMove({
+				cwd,
 				arbiter,
+				slug,
 				branch,
-				mode,
-				provider,
-				// PR-INTENT: when set (propose mode), push the branch but skip the PR.
-				noPR: input.noPR,
-				// Half A: an explicit single-line PR title (propose mode), so `gh` no longer
-				// derives a run-on title from the commit subject via `--fill`.
-				title: prTitle,
-				// Half B: the propose-mode PR body — the agent's summary under a deterministic
-				// runner header (task pointer). Undefined when no body was supplied (the
-				// header is only scaffolded when there IS a body) ⇒ today's `--fill` (no
-				// regression). Ignored in merge mode by the provider/integrator.
-				body: composeProposeBody({slug, body: input.body}),
-				// Part (b) of the merged-branch hygiene task: when WE perform the merge
-				// (this resolved `merge` mode), reap the remote `work/<slug>` HEAD branch
-				// INLINE right after the merge lands — the commits are now on `main`, so the
-				// head is provably merged and safe to delete (ancestor-guarded inside the
-				// integrator). Idempotent no-op when no remote head exists (the plain
-				// `${branch}:main` push opened none); ignored in `propose` mode (its branch is
-				// the review surface, reaped later by `gc --remote-branches`). NEVER `--force`.
-				deleteMergedHead: true,
-				cwd,
+				localSource: source,
 				env,
+				note,
 			});
-			// Only the merge push can be non-fast-forward (propose pushes its own ref).
-			if (integration.mergeNonFastForward !== true) {
-				break;
-			}
-			if (mergeAttempt >= maxMergeRetries) {
-				// LIVENESS CEILING hit (default 1000; previously the small Race-1 cap of 5,
-				// now reinterpreted by C2 as the pathological-livelock-tail bound, NOT a
-				// false-contention budget). Route to needs-attention rather than looping
-				// forever or force-pushing main. A RARE outcome under realistic load thanks
-				// to the jitter below + the rebase-until-real-conflict semantics; tests
-				// reach it deterministically by injecting a small `mergeRetries`.
-				return await mergeNonFastForwardRoute(
-					`integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-						`non-fast-forward push (a sibling advanced main ${mergeAttempt + 1} ` +
-						`times); gave up cleanly without --force`,
+			if (recovered) {
+				// The branch is now cleanly on top of `<arbiter>/main` with the slug in
+				// `done/` ONLY — fall through to integrate (skip the needs-attention
+				// route below).
+				note(
+					`Reconciled the done-move against ${arbiter}/main: '${slug}' is in ` +
+						'work/done/ ONLY (the divergent source folder was removed; the move ' +
+						'is a move, not a copy).',
 				);
+			} else {
+				return {route: await rebaseConflictRoute(ctx)};
 			}
-			// Modest jitter on the refetch (C2): an instant lockstep refetch→re-push loop
-			// maximises mutual rejection under sustained parallel load (thundering herd).
-			// A uniformly-random `[0, mergeJitterMs]` ms sleep desynchronises the herd.
-			// Skipped when `mergeJitterMs === 0` (the test seam).
-			if (mergeJitterMs > 0) {
-				await sleepMs(Math.floor(Math.random() * (mergeJitterMs + 1)));
-			}
-			// A sibling advanced main: re-run the step-4 rebase (with the reconcile arms)
-			// before retrying the push. A genuine conflict on the re-rebase routes via
-			// `rebaseOntoMainWithReconcile`'s `route` (the existing source-folder /
-			// one-slug placement recheck IS the genuine-conflict terminator — see the
-			// `DEFAULT_MERGE_RETRIES` docstring for the C2 SCOPE box). A clean re-rebase
-			// (no route) loops without counting against a small budget.
-			const reRebase = await rebaseOntoMainWithReconcile();
-			if (reRebase.route) {
-				return reRebase.route;
-			}
+		} else {
+			await gitSoft(['rebase', '--abort'], cwd, env);
+			return {route: await rebaseConflictRoute(ctx)};
 		}
+	}
+	// Clean rebase (or a reconciled one): fold any question residue the rebase
+	// brought in into the tip, then fall through to the gate + integrate.
+	if (!lifecycle) {
+		await foldQuestionResidueIntoTip(ctx);
+	}
+	return {};
+}
 
-		// The Race-1 needs-attention route for a merge that could not land (a genuine
-		// re-rebase conflict is handled by `rebaseOntoMainWithReconcile`'s `route`; this
-		// covers the cap-exhausted persistent-contention case). Mirrors
-		// `rebaseConflictRoute`: the done-move was already committed (steps 2–3), so the
-		// slug sits in work/done/ and the seam bounces it from there.
-		async function mergeNonFastForwardRoute(
-			reason: string,
-		): Promise<IntegrationCoreResult> {
-			const routed = await ledgerWrite.applyNeedsAttentionTransition({
+/**
+ * After a rebase onto `<arbiter>/main`, CLEAR the landing task's own stale
+ * question state that the rebase BROUGHT IN, and AMEND it into the tip commit
+ * (the completion commit), so the land still carries it in the done-move commit
+ * itself (task `a-recovered-task-lands-without-stale-question-state`).
+ *
+ * This is the half step 2c cannot see: a kept branch cut BEFORE the item was
+ * surfaced (a re-dispatch continuing from the kept branch, a stranded-branch
+ * finish) replays its `git mv ... → tasks/done/` over a `main` whose body now
+ * carries `needsAnswers: true` and a sidecar, and git carries the flag into
+ * `tasks/done/` and keeps the sidecar. Runs on every rebase of the land: the
+ * build path's first rebase, the merge CAS loop's re-rebase (so the CI apply
+ * phase is covered), and the stranded-recovery tail.
+ *
+ * A no-op (no amend) when there is nothing to clear, and when the tip is already
+ * on `main` (never rewrite a commit that is not ours). Best-effort: a fault is
+ * reported and the land proceeds; the claim-time reconcile remains the backstop.
+ */
+async function foldQuestionResidueIntoTip(params: {
+	cwd: string;
+	arbiter: string;
+	slug: string;
+	env?: NodeJS.ProcessEnv;
+	note: (message: string) => void;
+}): Promise<void> {
+	const {cwd, arbiter, slug, env, note} = params;
+	try {
+		if (isAncestor(cwd, 'HEAD', `${arbiter}/main`, env)) {
+			return; // no commit of ours on top of main to fold into.
+		}
+		const cleared = clearOwnQuestionResidueOnLand({cwd, slug, note});
+		if (cleared.changed.length === 0) {
+			return;
+		}
+		await gitHard(['add', '-A', '--', ...cleared.changed], cwd, env);
+		await gitHard(['commit', '-q', '--amend', '--no-edit'], cwd, env);
+	} catch (err) {
+		note(
+			`Could not fold the stale question state of '${slug}' into its land ` +
+				`(${err instanceof Error ? err.message : String(err)}); the next ` +
+				'claim reconcile will drain it.',
+		);
+	}
+}
+
+// The rebase-conflict needs-attention route, factored so the divergent-ledger
+// recovery above can fall through to integrate while a genuine code conflict
+// still routes here.
+async function rebaseConflictRoute(
+	ctx: RebaseReconcileContext,
+): Promise<IntegrationCoreResult> {
+	const {cwd, arbiter, slug, branch, commitMessage, env, note} = ctx;
+	// Then mark the item stuck on its per-item lock with the conflict reason
+	// (ADR §12) THROUGH the ledger write seam's needs-attention transition,
+	// rather than leaving it dangling. Post lock-cutover this is a lock amend
+	// (`state: stuck` + the reason on the lock entry, no `done/ →
+	// needs-attention/` folder move); the done-move already committed above
+	// stands. No partial state.
+	const reason = `rebase onto ${arbiter}/main conflicted (aborted, never auto-resolved)`;
+	const routed = await ledgerWrite.applyNeedsAttentionTransition({
+		cwd,
+		slug,
+		reason,
+		// Autonomous caller (`do`) passes the arbiter so the seam both surfaces the
+		// conflict on `main` (OBSERVABLE) AND pushes the `work/<slug>` branch
+		// (RECOVERABLE, cross-machine). The human `complete` leaves it unset →
+		// no surface, no push, local-only. The push lives in the seam (HEAD's
+		// branch is `work/<slug>` here) — no bolted-on push.
+		arbiter: ctx.surfaceArbiter,
+		env,
+		note,
+	});
+	return {
+		outcome: 'rebase-conflict',
+		routedToNeedsAttention: routed.moved,
+		branch,
+		commitMessage,
+		reason: routed.moved
+			? `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
+				`aborted (never auto-resolved) and '${slug}' was marked stuck on ` +
+				'its per-item lock (surfaced by status). Resolve against the latest ' +
+				'main, then `requeue` to release the stuck lock and re-run.'
+			: `Rebasing ${branch} onto ${arbiter}/main conflicted; the rebase was ` +
+				'aborted (never auto-resolved). Resolve against the latest main, ' +
+				'then re-run complete.',
+	};
+}
+
+/**
+ * **The LAND half of the rebase-to-integrate tail** (task `ci-split-build-path`,
+ * spec `ci-agent-job-without-write-token` §8): integrate per mode through
+ * `ledgerWrite.applyCompleteTransition`, with the merge-mode compare-and-swap
+ * loop (a non-fast-forward push re-runs {@link rebaseOntoMainWithReconcile} and
+ * retries, never `--force`), then post the approved Gate-2 review prose on the
+ * opened PR. It launches no agent and runs no `prepare` / `verify`: the fresh
+ * gate ran once, before it, in the other half. `performIntegration` reaches it
+ * through the {@link integrationLand} seam, so the CI agent phase RECORDS this
+ * call (the first write of the success path) and the apply phase resumes here
+ * with trusted inputs and the validated work-branch tip.
+ */
+export async function landIntegration(
+	input: IntegrationLandInput,
+): Promise<IntegrationCoreResult> {
+	const {cwd, arbiter, slug, branch, mode, commitMessage, env} = input;
+	const note = input.note;
+	// 5. Integrate per mode through the ledger write seam's COMPLETE transition
+	//    (ADR §6 + `docs/adr/claim-ledger-vs-protected-main.md`). The rebase above
+	//    already brought the branch up to date, so the seam's sole strategy uses
+	//    `integrate` (not `integrateWithRebase`) and never --forces. Provider
+	//    selection: an injected `openPr` wins (legacy bridge); otherwise pick by
+	//    the arbiter's remote URL (a GitHub remote ⇒ `gh pr create`, else push-only
+	//    `none`) — PURELY arbiter-derived, no override axis. A missing/unauthenticated
+	//    `gh` degrades to push-only at runtime — never a hard failure (and the
+	//    start-of-run unauthed case is caught UP FRONT by the pre-flight `gh` probe).
+	//    The seam is storage-agnostic: we hand it the work branch, the integration
+	//    mode, the provider, and the PR-INTENT (`noPR`) — `main` lives only in the
+	//    strategy.
+	// Provider precedence: an injected fully-formed provider wins (the `run`
+	// stubbed-provider seam, carrying title/body/url); else the legacy `openPr`
+	// bridge; else select PURELY from the arbiter URL (no override). The orthogonal
+	// `noPR` INTENT (suppress the PR) is threaded SEPARATELY — it does NOT pick a
+	// provider, the integrator simply skips `openRequest` when it is set.
+	const provider =
+		input.providerInstance ??
+		(input.openPr
+			? bridgeProvider(input.openPr)
+			: selectProvider({
+					arbiterUrl: await arbiterUrl(cwd, arbiter, env),
+				}));
+	// Race-1 (claim-vs-integrate, task
+	// `run-fleet-claim-integrate-and-sibling-rebase-concurrency-safe`): integrate,
+	// and on a non-fast-forward `${branch}:main` push (a SIBLING same-repo CLAIM —
+	// under the SEPARATE claim lock — or a sibling integrate advanced
+	// `<arbiter>/main` during our push window) RE-RUN the step-4 rebase (which
+	// carries the sibling-ledger + divergent-done-move reconcile arms — a bare
+	// re-rebase would MISS them) and RETRY the push, up to a small cap. INSTANT
+	// retry (contention, not an outage; see `claim-cas.ts`). We NEVER `--force`
+	// main: each retry re-rebases to a clean fast-forward. A genuine code conflict
+	// on a re-rebase routes to needs-attention via the SAME `route` the up-front
+	// rebase uses. A persistent non-fast-forward past the cap also routes (never a
+	// silent drop). `input.mergeRetries` overrides the cap (tests; `0` ⇒ no retry).
+	//
+	// **C2 rebase-until-real-conflict (task `c2-rebase-until-real-on-durable-main-
+	// promotions`):** the loop's TERMINATION CHANGED. A CLEAN re-rebase no longer
+	// counts against a tiny give-up budget — only a GENUINE conflict surfaced by
+	// `rebaseOntoMainWithReconcile` (a `route` ⇒ `rebase-conflict` or
+	// `invariant-violation`) stops the loop. The step-4 rebase IS the source-folder
+	// precondition recheck reused verbatim: if the slug is GONE from its expected
+	// source folder on the new `main` (a concurrent legitimate same-item winner
+	// already moved it), the `git mv` replay fails and `rebaseConflictRoute` routes
+	// definitively — never a silent re-push that would clobber the winner. The
+	// `maxMergeRetries` cap survives ONLY as a large liveness ceiling on the
+	// pathological livelock tail (default {@link DEFAULT_MERGE_RETRIES} = 1000);
+	// modest jitter on the refetch desynchronises a herd so the tail is not
+	// reached under sustained parallel load.
+	const maxMergeRetries = input.mergeRetries ?? DEFAULT_MERGE_RETRIES;
+	const mergeJitterMs = input.mergeJitterMs ?? DEFAULT_MERGE_JITTER_MS;
+	// The landed-vs-gated report (ADR `ci-agent-job-holds-no-write-token`
+	// decision 2, task `ci-split-landed-vs-gated-report`), scoped to the CI apply
+	// phase: only it sets `gatedTip` (the validated bundle tip the agent job
+	// gated). The CAS loop below never re-gates, so a re-rebase after a lost race
+	// can land a tree the gate never saw: {@link stampLandedWithoutRegate}
+	// records that on the landed commit. Without `gatedTip` (every non-phase
+	// land) the loop is exactly today's: no tree compare, no message rewrite.
+	const gatedTree =
+		input.gatedTip === undefined
+			? undefined
+			: await treeOf(cwd, input.gatedTip, env);
+	let regateReport: string | undefined;
+	let integration!: IntegrateResult;
+	for (let mergeAttempt = 0; ; mergeAttempt++) {
+		integration = await ledgerWrite.applyCompleteTransition({
+			arbiter,
+			branch,
+			mode,
+			provider,
+			// PR-INTENT: when set (propose mode), push the branch but skip the PR.
+			noPR: input.noPR,
+			// Half A: an explicit single-line PR title (propose mode), so `gh` no longer
+			// derives a run-on title from the commit subject via `--fill`.
+			title: input.title,
+			// Half B: the propose-mode PR body — the agent's summary under a deterministic
+			// runner header (task pointer). Undefined when no body was supplied (the
+			// header is only scaffolded when there IS a body) ⇒ today's `--fill` (no
+			// regression). Ignored in merge mode by the provider/integrator.
+			body: input.body,
+			// Part (b) of the merged-branch hygiene task: when WE perform the merge
+			// (this resolved `merge` mode), reap the remote `work/<slug>` HEAD branch
+			// INLINE right after the merge lands — the commits are now on `main`, so the
+			// head is provably merged and safe to delete (ancestor-guarded inside the
+			// integrator). Idempotent no-op when no remote head exists (the plain
+			// `${branch}:main` push opened none); ignored in `propose` mode (its branch is
+			// the review surface, reaped later by `gc --remote-branches`). NEVER `--force`.
+			deleteMergedHead: true,
+			cwd,
+			env,
+		});
+		// Only the merge push can be non-fast-forward (propose pushes its own ref).
+		if (integration.mergeNonFastForward !== true) {
+			break;
+		}
+		if (mergeAttempt >= maxMergeRetries) {
+			// LIVENESS CEILING hit (default 1000; previously the small Race-1 cap of 5,
+			// now reinterpreted by C2 as the pathological-livelock-tail bound, NOT a
+			// false-contention budget). Route to needs-attention rather than looping
+			// forever or force-pushing main. A RARE outcome under realistic load thanks
+			// to the jitter below + the rebase-until-real-conflict semantics; tests
+			// reach it deterministically by injecting a small `mergeRetries`.
+			return await mergeNonFastForwardRoute(
+				`integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+					`non-fast-forward push (a sibling advanced main ${mergeAttempt + 1} ` +
+					`times); gave up cleanly without --force`,
+			);
+		}
+		// Modest jitter on the refetch (C2): an instant lockstep refetch→re-push loop
+		// maximises mutual rejection under sustained parallel load (thundering herd).
+		// A uniformly-random `[0, mergeJitterMs]` ms sleep desynchronises the herd.
+		// Skipped when `mergeJitterMs === 0` (the test seam).
+		if (mergeJitterMs > 0) {
+			await sleepMs(Math.floor(Math.random() * (mergeJitterMs + 1)));
+		}
+		// A sibling advanced main: re-run the step-4 rebase (with the reconcile arms)
+		// before retrying the push. A genuine conflict on the re-rebase routes via
+		// `rebaseOntoMainWithReconcile`'s `route` (the existing source-folder /
+		// one-slug placement recheck IS the genuine-conflict terminator — see the
+		// `DEFAULT_MERGE_RETRIES` docstring for the C2 SCOPE box). A clean re-rebase
+		// (no route) loops without counting against a small budget.
+		const reRebase = await rebaseOntoMainWithReconcile(input);
+		if (reRebase.route) {
+			return reRebase.route;
+		}
+		if (gatedTree !== undefined) {
+			regateReport = await stampLandedWithoutRegate({
 				cwd,
-				slug,
-				reason,
-				arbiter: input.surfaceArbiter,
+				branch,
+				gatedTree,
+				lostRaces: mergeAttempt + 1,
 				env,
-				note,
 			});
-			return {
-				outcome: 'rebase-conflict',
-				routedToNeedsAttention: routed.moved,
-				branch,
-				commitMessage,
-				reason: routed.moved
-					? `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-						`non-fast-forward push (a sibling advanced main); '${slug}' was ` +
-						`marked stuck on its per-item lock (surfaced by status). Resolve ` +
-						`against the latest main, then \`requeue\` to release the stuck ` +
-						`lock and re-run.`
-					: `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
-						`non-fast-forward push (a sibling advanced main). Resolve against the ` +
-						`latest main, then re-run complete.`,
-			};
-		}
-
-		// 6. Make the Gate-2 review VISIBLE on the PR (task `review-comment-prose-field`,
-		//    refining `review-gate-pr-comment`): AFTER the propose integrate, where the
-		//    approved verdict (with its deliberately-authored `review` prose), the
-		//    resolved `provider`, AND the opened PR url (`integration.url`) are ALL in
-		//    scope, post `verdict.review` as a comment on that PR — INCLUDING on approve
-		//    (the audit trail; decided 2026-06-06). The `review` field is a first-class
-		//    AUTHORED review (the prompt requires it), NOT the residue around the JSON
-		//    — posting the residue was the bug
-		//    (`work/findings/review-comment-posts-agent-thinking-not-a-review.md`). It
-		//    reuses the SAME `provider` the integrate used (the core never imports `gh`).
-		//    The comment is ADVISORY: it changes no gate/verdict/merge/integration logic
-		//    — by here the verdict has ALREADY routed (block never reaches this point; it
-		//    routed to needs-attention above) and the integrate has ALREADY happened.
-		//    The PR identity is resolved in PRECEDENCE: a parsed `integration.url` wins
-		//    (the normal path — post on it directly); else, when a PR WAS opened but its
-		//    url was unparseable (`integration.requestOpened` true, `url` undefined — the
-		//    `gh pr create` exit-0-but-unparseable-stdout degradation), FALL BACK to the
-		//    BRANCH-resolved comment (task `review-comment-fallback-on-unparsed-pr-url`):
-		//    the provider resolves the branch's open PR and comments on it, instead of
-		//    silently dropping a review on a PR that genuinely exists. Only when NO PR was
-		//    opened at all (merge mode, or a degraded/push-only propose ⇒ `requestOpened`
-		//    false) is it the honest clean no-op — and the branch-resolved fallback's own
-		//    "no PR resolvable" path is a clean no-op too (it tries first). Either way
-		//    `postPRComment*` never throws; the review stays in the run output. Because
-		//    this lives in the shared core, BOTH `do`/`complete` AND `run` post the
-		//    comment — no per-caller wiring.
-		if (approvedVerdict?.review !== undefined) {
-			if (integration.url !== undefined) {
-				const posted = provider.postPRComment({
-					cwd,
-					url: integration.url,
-					body: approvedVerdict.review,
-					env,
-				});
-				note(posted.instruction);
-			} else if (integration.requestOpened) {
-				// A PR opened but its url was unparseable — resolve it from the branch
-				// rather than dropping the review (the audit-trail fallback).
-				const posted = provider.postPRCommentOnBranch({
-					cwd,
-					branch,
-					body: approvedVerdict.review,
-					env,
-				});
-				note(posted.instruction);
-			}
 		}
-
+	}
+	if (regateReport !== undefined && integration.mergedToMain === true) {
+		note(`${branch} ${regateReport}.`);
+	}
+	noteRequestNotOpened(integration, branch, note);
+
+	// The Race-1 needs-attention route for a merge that could not land (a genuine
+	// re-rebase conflict is handled by `rebaseOntoMainWithReconcile`'s `route`; this
+	// covers the cap-exhausted persistent-contention case). Mirrors
+	// `rebaseConflictRoute`: the done-move was already committed (steps 2–3), so the
+	// slug sits in work/done/ and the seam bounces it from there.
+	async function mergeNonFastForwardRoute(
+		reason: string,
+	): Promise<IntegrationCoreResult> {
+		const routed = await ledgerWrite.applyNeedsAttentionTransition({
+			cwd,
+			slug,
+			reason,
+			arbiter: input.surfaceArbiter,
+			env,
+			note,
+		});
 		return {
-			outcome: 'completed',
-			routedToNeedsAttention: false,
+			outcome: 'rebase-conflict',
+			routedToNeedsAttention: routed.moved,
 			branch,
 			commitMessage,
-			integration,
+			reason: routed.moved
+				? `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+					`non-fast-forward push (a sibling advanced main); '${slug}' was ` +
+					`marked stuck on its per-item lock (surfaced by status). Resolve ` +
+					`against the latest main, then \`requeue\` to release the stuck ` +
+					`lock and re-run.`
+				: `Integrating ${branch} onto ${arbiter}/main kept hitting a ` +
+					`non-fast-forward push (a sibling advanced main). Resolve against the ` +
+					`latest main, then re-run complete.`,
 		};
-	};
+	}
 
-	// Serialise ONLY this tail per repo when the `run` seam is wired; absent ⇒ run
-	// it directly (an un-contended no-op, single-job behaviour unchanged).
-	return input.integrateLock && input.integrateLockKey !== undefined
-		? await input.integrateLock(
-				input.integrateLockKey,
-				runRebaseToIntegrateTail,
-			)
-		: await runRebaseToIntegrateTail();
+	// 6. Make the Gate-2 review VISIBLE on the PR (task `review-comment-prose-field`,
+	//    refining `review-gate-pr-comment`): AFTER the propose integrate, where the
+	//    approved verdict (with its deliberately-authored `review` prose), the
+	//    resolved `provider`, AND the opened PR url (`integration.url`) are ALL in
+	//    scope, post `verdict.review` as a comment on that PR — INCLUDING on approve
+	//    (the audit trail; decided 2026-06-06). The `review` field is a first-class
+	//    AUTHORED review (the prompt requires it), NOT the residue around the JSON
+	//    — posting the residue was the bug
+	//    (`work/findings/review-comment-posts-agent-thinking-not-a-review.md`). It
+	//    reuses the SAME `provider` the integrate used (the core never imports `gh`).
+	//    The comment is ADVISORY: it changes no gate/verdict/merge/integration logic
+	//    — by here the verdict has ALREADY routed (block never reaches this point; it
+	//    routed to needs-attention above) and the integrate has ALREADY happened.
+	//    The PR identity is resolved in PRECEDENCE: a parsed `integration.url` wins
+	//    (the normal path — post on it directly); else, when a PR WAS opened but its
+	//    url was unparseable (`integration.requestOpened` true, `url` undefined — the
+	//    `gh pr create` exit-0-but-unparseable-stdout degradation), FALL BACK to the
+	//    BRANCH-resolved comment (task `review-comment-fallback-on-unparsed-pr-url`):
+	//    the provider resolves the branch's open PR and comments on it, instead of
+	//    silently dropping a review on a PR that genuinely exists. Only when NO PR was
+	//    opened at all (merge mode, or a degraded/push-only propose ⇒ `requestOpened`
+	//    false) is it the honest clean no-op — and the branch-resolved fallback's own
+	//    "no PR resolvable" path is a clean no-op too (it tries first). Either way
+	//    `postPRComment*` never throws; the review stays in the run output. Because
+	//    this lives in the shared core, BOTH `do`/`complete` AND `run` post the
+	//    comment — no per-caller wiring.
+	if (input.reviewProse !== undefined) {
+		if (integration.url !== undefined) {
+			const posted = provider.postPRComment({
+				cwd,
+				url: integration.url,
+				body: input.reviewProse,
+				env,
+			});
+			note(posted.instruction);
+		} else if (integration.requestOpened) {
+			// A PR opened but its url was unparseable — resolve it from the branch
+			// rather than dropping the review (the audit-trail fallback).
+			const posted = provider.postPRCommentOnBranch({
+				cwd,
+				branch,
+				body: input.reviewProse,
+				env,
+			});
+			note(posted.instruction);
+		}
+	}
+
+	return {
+		outcome: 'completed',
+		routedToNeedsAttention: false,
+		branch,
+		commitMessage,
+		integration,
+	};
 }
 
 /**
@@ -1944,7 +2198,10 @@ async function recoverAlreadyCommitted(params: {
 	for (;;) {
 		const rebase = await gitSoft(rebaseArgs(), cwd, env);
 		if (rebase.status === 0) {
-			break; // clean rebase ⇒ fall through to integrate
+			// Clean rebase ⇒ fold in any question residue it brought (the kept
+			// branch predates a surface on `main`), then fall through to integrate.
+			await foldQuestionResidueIntoTip({cwd, arbiter, slug, env, note});
+			break;
 		}
 		// ALWAYS abort on conflict — never leave mid-rebase between attempts.
 		await gitSoft(['rebase', '--abort'], cwd, env);
@@ -2134,6 +2391,7 @@ async function recoverAlreadyCommitted(params: {
 					`(absorbed a moving ${arbiter}/main across ${attempt} re-fetch+re-` +
 					`rebase attempt${attempt === 1 ? '' : 's'}).`,
 	);
+	noteRequestNotOpened(integration, branch, note);
 	// Post the Gate-2 review as a PR comment (task `committed-recovery-always-
 	// reviews`): the SAME post-integrate audit trail the build path keeps — the
 	// approved verdict's authored `review` prose, on the opened PR. Advisory only
@@ -2168,6 +2426,26 @@ async function recoverAlreadyCommitted(params: {
 	};
 }
 
+/**
+ * Say so when a propose land opened NO review request (task
+ * `intake-reports-the-pr-it-actually-opened`): the branch is pushed, but the
+ * provider could not (or was told not to) open a PR, so the log prints the
+ * provider's instruction (the real `gh` error + the manual `gh pr create`
+ * command) instead of leaving it unread. Every land (build, tasking, intake,
+ * recovery) passes through here, so no caller has to remember to print it. A
+ * merge land, an opened request and an already-landed no-op print nothing.
+ */
+function noteRequestNotOpened(
+	integration: IntegrateResult,
+	branch: string,
+	note: (message: string) => void,
+): void {
+	const reason = proposeRequestNotOpened(integration);
+	if (reason !== undefined) {
+		note(`No PR was opened for ${branch}: ${reason}`);
+	}
+}
+
 /**
  * Resolve the work branch the integration runs on: the branch HEAD is currently
  * on (the caller is ALWAYS on the work branch — the agent built there / the
@@ -2377,20 +2655,34 @@ export function synthesiseProposeTitle(input: {
  * header that points a reviewer back to the task file. Returns `undefined` when
  * no body was supplied — so the provider degrades to today's `gh ... --fill` (no
  * regression); the header is ONLY scaffolded when there IS prose to carry.
+ * `header` overrides the default task-build pointer (`Task: work/tasks/done/<slug>.md`)
+ * for a non-task lifecycle (tasking, intake), whose item rests elsewhere.
  * Exported for unit tests of the header + pointer.
  */
 export function composeProposeBody(input: {
 	slug: string;
 	body?: string;
+	header?: string;
 }): string | undefined {
 	const prose = input.body?.trim();
 	if (!prose) {
 		return undefined;
 	}
-	const header = `Task: \`${workItemRel('done', `${input.slug}.md`)}\``;
+	const header =
+		input.header ??
+		proposePointer('Task', workItemRel('done', `${input.slug}.md`));
 	return `${header}\n\n${prose}`;
 }
 
+/**
+ * The one-line reviewer pointer a propose PR body opens with: `<label>: `<path>``,
+ * where `path` is the repo-relative file the PR carries (task
+ * `propose-pr-bodies-point-at-the-real-item`).
+ */
+export function proposePointer(label: 'Task' | 'Spec', path: string): string {
+	return `${label}: \`${path}\``;
+}
+
 /**
  * On a review APPROVE that carries ≥1 NON-BLOCKING finding, write ONE per-run
  * observation `work/notes/observations/review-nits-<slug>-<YYYY-MM-DD>.md` capturing all
@@ -2502,23 +2794,14 @@ function readTitle(content: string): string | undefined {
 		const match = /^title\s*:\s*(.*)$/.exec(line);
 		if (match) {
 			const value = match[1].trim();
-			return value === '' ? undefined : unquote(value);
+			// The shared frontmatter unquoter, so a title written by
+			// `quoteYamlScalar` (`''` for a literal `'`) reads back verbatim.
+			return value === '' ? undefined : unquoteYamlScalar(value);
 		}
 	}
 	return undefined;
 }
 
-function unquote(value: string): string {
-	if (value.length >= 2) {
-		const first = value[0];
-		const last = value[value.length - 1];
-		if ((first === '"' || first === "'") && last === first) {
-			return value.slice(1, -1);
-		}
-	}
-	return value;
-}
-
 function escapeRegExp(value: string): string {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -3068,6 +3351,97 @@ type Gate2ReviewOutcome =
 			verdict: ReviewVerdict | undefined;
 	  };
 
+/** The outcome of {@link runReviewRounds}: the verdict data, with no routing done. */
+export type ReviewRoundsOutcome =
+	| {kind: 'approved'; verdict: ReviewVerdict | undefined}
+	| {kind: 'blocked'; verdict: ReviewVerdict | undefined}
+	| {
+			kind: 'unparseable';
+			/** The needs-attention reason (names the parse failure, a transient class). */
+			reason: string;
+	  };
+
+/**
+ * Run a review gate for up to `maxRounds` rounds on ONE tree and return the
+ * verdict as DATA, writing nothing (the WRITE-FREE core of {@link runGate2Review},
+ * which adds the needs-attention routing). Factored out so the CI tasking agent
+ * phase (task `ci-split-tasking`) runs the one-round task-set review the SAME
+ * way `performIntegration` does, in the job that may launch agents, without the
+ * routing writes (the apply phase routes). A non-parse error is re-thrown.
+ */
+export async function runReviewRounds(params: {
+	reviewGate: ReviewGate;
+	slug: string;
+	/** The tree the review AGENT inspects. */
+	reviewCwd: string;
+	maxRounds: number;
+	reviewModel?: string;
+	watch?: boolean;
+	watchSink?: (line: string) => void;
+	color?: boolean;
+	sessionsDir?: string;
+	/** The AGENT env (ambient, never the identity-scoped one). */
+	env: NodeJS.ProcessEnv | undefined;
+}): Promise<ReviewRoundsOutcome> {
+	const {reviewGate, slug, reviewCwd, maxRounds} = params;
+	// CORROBORATED-APPROVAL semantics (NOT retry-until-pass): the gate runs the
+	// reviewer up to `reviewMaxRounds` times on the SAME tip and approves ONLY if
+	// EVERY round approves. A `block` is TERMINAL — it short-circuits the loop and
+	// is never re-rolled, because the reviewer is stochastic and re-reviewing an
+	// UNCHANGED tip after a block would just be a dice re-roll that could launder a
+	// real reject into a pass. The extra rounds therefore exist to make a FALSE
+	// APPROVE harder to slip through (a second reviewer gets a veto), never to give
+	// blocked work a second chance. (A future builder-REVISE step that mutates the
+	// tree between rounds is the ONLY thing that should make a block retryable; it
+	// would change the artifact under review and is not implemented here.)
+	let approved = false;
+	let lastVerdict: ReviewVerdict | undefined;
+	for (let round = 1; round <= maxRounds; round++) {
+		let verdict: ReviewVerdict;
+		try {
+			verdict = await reviewGate({
+				slug,
+				cwd: reviewCwd,
+				reviewModel: params.reviewModel,
+				round,
+				watch: params.watch,
+				watchSink: params.watchSink,
+				color: params.color,
+				sessionsDir: params.sessionsDir,
+				env: params.env,
+			});
+		} catch (err) {
+			if (!(err instanceof ReviewParseError)) {
+				// Anything else (a harness/connection throw, a programmer bug) is NOT this
+				// gate's concern: re-throw so the existing catch sites classify it.
+				throw err;
+			}
+			// A parse failure in ANY round is TERMINAL (never re-roll the remaining
+			// rounds). The reason carries the parse-failure phrase the
+			// `failure-cause.ts` signature matches (a transient class).
+			return {
+				kind: 'unparseable',
+				reason:
+					`PR/code review (Gate 2) ran but its verdict could not be parsed: ` +
+					`${err.message}`,
+			};
+		}
+		lastVerdict = verdict;
+		if (verdict.verdict !== 'approve') {
+			// A `block` is TERMINAL: stop now (never re-roll an unchanged tip) and route
+			// the blocking findings to needs-attention below. `approved` stays false.
+			approved = false;
+			break;
+		}
+		// An `approve`: provisionally approved, but keep going — every remaining round
+		// must ALSO approve for the gate to pass (corroboration, not first-approve-wins).
+		approved = true;
+	}
+	return approved
+		? {kind: 'approved', verdict: lastVerdict}
+		: {kind: 'blocked', verdict: lastVerdict};
+}
+
 /**
  * Run the Gate-2 PR/code REVIEW gate against a given tree ({@param reviewCwd}) and
  * route a BLOCK to needs-attention, returning DATA the caller acts on. Factored out
@@ -3112,105 +3486,75 @@ async function runGate2Review(params: {
 				`for '${slug}' (this is a wiring bug; the gate must not be skipped).`,
 		);
 	}
-	const maxRounds = Math.max(1, input.reviewMaxRounds ?? 2);
 	note('Running the PR/code review gate (Gate 2)…');
-	// CORROBORATED-APPROVAL semantics (NOT retry-until-pass): the gate runs the
-	// reviewer up to `reviewMaxRounds` times on the SAME tip and approves ONLY if
-	// EVERY round approves. A `block` is TERMINAL — it short-circuits the loop and
-	// is never re-rolled, because the reviewer is stochastic and re-reviewing an
-	// UNCHANGED tip after a block would just be a dice re-roll that could launder a
-	// real reject into a pass. The extra rounds therefore exist to make a FALSE
-	// APPROVE harder to slip through (a second reviewer gets a veto), never to give
-	// blocked work a second chance. (A future builder-REVISE step that mutates the
-	// tree between rounds is the ONLY thing that should make a block retryable; it
-	// would change the artifact under review and is not implemented here.)
-	let approved = false;
-	let lastVerdict: ReviewVerdict | undefined;
-	for (let round = 1; round <= maxRounds; round++) {
-		let verdict: ReviewVerdict;
-		try {
-			verdict = await reviewGate({
-				slug,
-				cwd: reviewCwd,
-				reviewModel: input.reviewModel,
-				round,
-				// `--watch` threading (task `watch-review-session`): when on, the production
-				// gate tails the review session live. OFF ⇒ the plain sync launch, unchanged.
-				watch: input.watch,
-				watchSink: input.watchSink,
-				color: input.color,
-				sessionsDir: input.sessionsDir,
-				// The review AGENT launches with the AMBIENT env, never the identity-scoped
-				// `env` (an agent must not act as the bot). Falls back to `env` when no
-				// identity is configured (unchanged for non-identity callers).
-				env: input.agentEnv ?? env,
-			});
-		} catch (err) {
-			if (!(err instanceof ReviewParseError)) {
-				// Anything else (a harness/connection throw, a programmer bug) is NOT this
-				// gate's concern — re-throw so the existing catch sites classify it.
-				throw err;
-			}
-			// THE GATE RAN BUT ITS VERDICT WAS UNREADABLE (direction 1, the safety net):
-			// the reviewer did NOT block — the gate's OUTPUT could not be parsed (a
-			// malformed JSON verdict, common on large diffs + weaker models, AFTER the
-			// direction-2 repair pass could not salvage it). WITHOUT this catch the throw
-			// escapes the core and `performComplete` maps it to the generic `usage-error`
-			// (verbatim, no push, no surface) AFTER the green build but BEFORE the
-			// done-move/push — STRANDING the lock + work branch with no PR.
-			//
-			// A parse failure in ANY round is TERMINAL: route IMMEDIATELY, never re-roll
-			// the remaining rounds (mirroring the block-is-terminal rule — re-reviewing
-			// the same tip would just be the dice re-roll the corroboration loop forbids).
-			// We route through the SAME work-preserving `applyNeedsAttentionTransition`
-			// seam the block path uses (it PUSHES the work branch + surfaces the item on
-			// `surfaceArbiter` for the autonomous path), targeting `cwd` (the work branch +
-			// ledger), NOT the throwaway `reviewCwd` — so BOTH the direct `!freshWorktreeGate`
-			// path AND the fresh-worktree `review:` callback are covered by this ONE catch.
-			// The recorded reason carries the parse-failure phrase the `failure-cause.ts`
-			// signature matches → the `do`/`run` tail classifies it `transient-infra`
-			// (retry the SAME work: the gate output is STOCHASTIC, so a re-run CAN differ,
-			// and the direction-2 repair makes a re-run far more likely to parse). NEVER a
-			// silent approve.
-			const reason =
-				`PR/code review (Gate 2) ran but its verdict could not be parsed: ` +
-				`${err.message}`;
-			const routed = await ledgerWrite.applyNeedsAttentionTransition({
-				cwd,
-				slug,
+	const maxRounds = Math.max(1, input.reviewMaxRounds ?? 2);
+	const rounds = await runReviewRounds({
+		reviewGate,
+		slug,
+		reviewCwd,
+		maxRounds,
+		reviewModel: input.reviewModel,
+		// `--watch` threading (task `watch-review-session`): when on, the production
+		// gate tails the review session live. OFF ⇒ the plain sync launch, unchanged.
+		watch: input.watch,
+		watchSink: input.watchSink,
+		color: input.color,
+		sessionsDir: input.sessionsDir,
+		// The review AGENT launches with the AMBIENT env, never the identity-scoped
+		// `env` (an agent must not act as the bot). Falls back to `env` when no
+		// identity is configured (unchanged for non-identity callers).
+		env: input.agentEnv ?? env,
+	});
+	if (rounds.kind === 'unparseable') {
+		// THE GATE RAN BUT ITS VERDICT WAS UNREADABLE (direction 1, the safety net):
+		// the reviewer did NOT block — the gate's OUTPUT could not be parsed (a
+		// malformed JSON verdict, common on large diffs + weaker models, AFTER the
+		// direction-2 repair pass could not salvage it). WITHOUT this catch the throw
+		// escapes the core and `performComplete` maps it to the generic `usage-error`
+		// (verbatim, no push, no surface) AFTER the green build but BEFORE the
+		// done-move/push — STRANDING the lock + work branch with no PR.
+		//
+		// A parse failure in ANY round is TERMINAL: route IMMEDIATELY, never re-roll
+		// the remaining rounds (mirroring the block-is-terminal rule — re-reviewing
+		// the same tip would just be the dice re-roll the corroboration loop forbids).
+		// We route through the SAME work-preserving `applyNeedsAttentionTransition`
+		// seam the block path uses (it PUSHES the work branch + surfaces the item on
+		// `surfaceArbiter` for the autonomous path), targeting `cwd` (the work branch +
+		// ledger), NOT the throwaway `reviewCwd` — so BOTH the direct `!freshWorktreeGate`
+		// path AND the fresh-worktree `review:` callback are covered by this ONE catch.
+		// The recorded reason carries the parse-failure phrase the `failure-cause.ts`
+		// signature matches → the `do`/`run` tail classifies it `transient-infra`
+		// (retry the SAME work: the gate output is STOCHASTIC, so a re-run CAN differ,
+		// and the direction-2 repair makes a re-run far more likely to parse). NEVER a
+		// silent approve.
+		const reason = rounds.reason;
+		const routed = await ledgerWrite.applyNeedsAttentionTransition({
+			cwd,
+			slug,
+			reason,
+			arbiter: input.surfaceArbiter,
+			env,
+			note,
+		});
+		const message = routed.moved
+			? `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
+				'marked it stuck on its per-item lock (work branch pushed + lock ' +
+				'surfaced; transient-infra — re-run). NOT integrated.'
+			: `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
+				'NOT integrating.';
+		note(message);
+		return {
+			kind: 'blocked',
+			result: {
+				outcome: 'review-unparseable',
+				routedToNeedsAttention: routed.moved,
+				branch,
 				reason,
-				arbiter: input.surfaceArbiter,
-				env,
-				note,
-			});
-			const message = routed.moved
-				? `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
-					'marked it stuck on its per-item lock (work branch pushed + lock ' +
-					'surfaced; transient-infra — re-run). NOT integrated.'
-				: `PR/code review (Gate 2) produced an UNPARSEABLE verdict for '${slug}'; ` +
-					'NOT integrating.';
-			note(message);
-			return {
-				kind: 'blocked',
-				result: {
-					outcome: 'review-unparseable',
-					routedToNeedsAttention: routed.moved,
-					branch,
-					reason,
-				},
-			};
-		}
-		lastVerdict = verdict;
-		if (verdict.verdict !== 'approve') {
-			// A `block` is TERMINAL: stop now (never re-roll an unchanged tip) and route
-			// the blocking findings to needs-attention below. `approved` stays false.
-			approved = false;
-			break;
-		}
-		// An `approve`: provisionally approved, but keep going — every remaining round
-		// must ALSO approve for the gate to pass (corroboration, not first-approve-wins).
-		approved = true;
+			},
+		};
 	}
+	const lastVerdict = rounds.verdict;
+	const approved = rounds.kind === 'approved';
 	if (!approved) {
 		// NON-approve verdict: route to needs-attention via the SAME seam the red gate
 		// uses, NEVER integrate. We reach here EITHER because a round returned a
@@ -3403,6 +3747,113 @@ async function runFreshWorktreeGate(params: {
 	}
 }
 
+/**
+ * The git trailer key that marks a merge-mode land whose tree differs from the
+ * gated tree (ADR `ci-agent-job-holds-no-write-token` decision 2). Its value is
+ * the report, e.g. `landed without re-gate after 2 lost races`. A git trailer
+ * like `CAS-Nonce` (`ledger-write.ts`), so `git log --format=%(trailers)`
+ * reads it back.
+ */
+export const LANDED_WITHOUT_REGATE_TRAILER = 'Landed-Without-Regate';
+
+/** The landed-vs-gated report for `lostRaces` lost pushes. */
+export function landedWithoutRegateReport(lostRaces: number): string {
+	return (
+		`landed without re-gate after ${lostRaces} lost ` +
+		(lostRaces === 1 ? 'race' : 'races')
+	);
+}
+
+/** The tree id of `rev` in `cwd`. */
+async function treeOf(
+	cwd: string,
+	rev: string,
+	env: NodeJS.ProcessEnv | undefined,
+): Promise<string> {
+	return (
+		await gitHard(['rev-parse', `${rev}^{tree}`], cwd, env)
+	).stdout.trim();
+}
+
+/**
+ * After the merge-mode CAS loop re-rebased `branch` for the `lostRaces`-th
+ * time, rewrite its tip so its message carries exactly the right
+ * {@link LANDED_WITHOUT_REGATE_TRAILER}: set (with this count) when the tip's
+ * tree differs from `gatedTree`, removed when it is equal again. A previous
+ * attempt's trailer rides the re-rebase as part of the message, which is why an
+ * existing one is always replaced, never appended to. Only the message changes:
+ * the tree, the parents and the author are the tip's own, and the branch ref
+ * moves by a compare-and-swap `update-ref` (the working tree and the index
+ * already match that tree). Returns the report when the trailer is set.
+ */
+async function stampLandedWithoutRegate(params: {
+	cwd: string;
+	branch: string;
+	gatedTree: string;
+	lostRaces: number;
+	env: NodeJS.ProcessEnv | undefined;
+}): Promise<string | undefined> {
+	const {cwd, branch, gatedTree, lostRaces, env} = params;
+	const ref = `refs/heads/${branch}`;
+	const FIELD_SEP = '\u0000';
+	const raw = (
+		await gitHard(
+			['log', '-1', '--format=%H%x00%T%x00%P%x00%an%x00%ae%x00%aI%x00%B', ref],
+			cwd,
+			env,
+		)
+	).stdout;
+	const [head, tree, parentList, authorName, authorEmail, authorDate, body] =
+		raw.split(FIELD_SEP);
+	const report =
+		tree.trim() === gatedTree
+			? undefined
+			: landedWithoutRegateReport(lostRaces);
+	const original = (body ?? '').replace(/\s+$/, '');
+	const prefix = `${LANDED_WITHOUT_REGATE_TRAILER}:`;
+	const stripped = original
+		.split('\n')
+		.filter((line) => !line.startsWith(prefix))
+		.join('\n')
+		.replace(/\s+$/, '');
+	const message =
+		report === undefined
+			? stripped
+			: (
+					await gitHard(
+						[
+							'interpret-trailers',
+							'--trailer',
+							`${LANDED_WITHOUT_REGATE_TRAILER}: ${report}`,
+						],
+						cwd,
+						env,
+						`${stripped}\n`,
+					)
+				).stdout.replace(/\s+$/, '');
+	if (message === original) return report;
+	const parents = parentList
+		.trim()
+		.split(/\s+/)
+		.filter((p) => p !== '')
+		.flatMap((p) => ['-p', p]);
+	const rewritten = (
+		await gitHard(
+			['commit-tree', tree.trim(), ...parents, '-F', '-'],
+			cwd,
+			{
+				...(env ?? process.env),
+				GIT_AUTHOR_NAME: authorName,
+				GIT_AUTHOR_EMAIL: authorEmail,
+				GIT_AUTHOR_DATE: authorDate,
+			},
+			`${message}\n`,
+		)
+	).stdout.trim();
+	await gitHard(['update-ref', ref, rewritten, head.trim()], cwd, env);
+	return report;
+}
+
 /** Run git, returning the raw result (no throw) — for soft checks. */
 function gitSoft(
 	args: string[],
@@ -3417,8 +3868,9 @@ async function gitHard(
 	args: string[],
 	cwd: string,
 	env: NodeJS.ProcessEnv | undefined,
+	input?: string,
 ): Promise<RunResult> {
-	const result = await runAsync('git', args, cwd, {env});
+	const result = await runAsync('git', args, cwd, {env, input});
 	if (result.status !== 0) {
 		throw new Error(
 			`git ${args.join(' ')} failed (exit ${result.status}): ${result.stderr.trim()}`,