engineering-memory 1.11.24 → 1.11.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.24",
+  "version": "1.11.26",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/build.json

@@ -1,3 +1,3 @@
 {
-  "gitHead": "8d3dfecc2ad6ed7593bb48fa0dbed384acac1a64"
+  "gitHead": "0f86f662e39b6ace530d89827a5b14018f1b68fe"
 }

package/runtime/dist/src/git/git-inspector.js

@@ -10,8 +10,10 @@ export const temporaryScaffoldingMarker = 'ENGINEERING-MEMORY-TEMPORARY';
 export const temporaryScaffoldingPattern = `${temporaryScaffoldingMarker}:`;
 export class GitInspector {
     runner;
-    constructor(runner = new NativeCommandRunner()) {
+    knownReservations;
+    constructor(runner = new NativeCommandRunner(), knownReservations) {
         this.runner = runner;
+        this.knownReservations = knownReservations;
     }
     async findRoot(startPath) {
         const result = await this.runner.run('git', ['rev-parse', '--show-toplevel'], {
@@ -49,7 +51,7 @@ export class GitInspector {
             : null;
     }
     branchStore(repoRoot) {
-        return new TaskBranchStore(repoRoot, this.runner);
+        return new TaskBranchStore(repoRoot, this.runner, this.knownReservations);
     }
     async validateBranch(repoRoot, name) {
         const result = await this.runner.run('git', ['check-ref-format', '--branch', name], {
@@ -373,10 +375,10 @@ export class GitInspector {
             diffHash: sha256(`${head ?? '<unborn>'}\n${stableStringify(hashManifest)}\n`),
         };
     }
-    async manifestAgainst(repoRoot, baseCommit) {
+    async manifestAgainst(repoRoot, baseCommit, from = baseCommit) {
         const root = await this.findRoot(repoRoot);
         const head = await this.gitValue(root, ['rev-parse', 'HEAD']);
-        const changedPaths = await this.changedPathsAgainstHead(root, baseCommit);
+        const changedPaths = await this.changedPathsAgainstHead(root, from);
         const hashManifest = canonicalHashManifest(changedPaths);
         return {
             repoRoot: root,
@@ -384,9 +386,26 @@ export class GitInspector {
             baseCommit,
             changedPaths,
             worktreeHash: sha256(`${stableStringify(hashManifest)}\n`),
-            diffHash: sha256(`${baseCommit}\n${head ?? '<unborn>'}\n${stableStringify(hashManifest)}\n`),
+            diffHash: sha256(`${from}\n${head ?? '<unborn>'}\n${stableStringify(hashManifest)}\n`),
         };
     }
+    async taskBase(repoRoot, baseCommit, branch) {
+        const listed = await this.runner.run('git', ['rev-list', '--boundary', 'HEAD', '--not', baseCommit, `--exclude=*/${branch}`, '--remotes'], { cwd: repoRoot });
+        if (listed.exitCode !== 0)
+            return baseCommit;
+        const upstream = [];
+        for (const line of listed.stdout.split(/\r?\n/)) {
+            if (line.startsWith('-') && (await this.isAncestor(repoRoot, baseCommit, line.slice(1))))
+                upstream.push(line.slice(1));
+        }
+        if (upstream.length === 0)
+            return baseCommit;
+        const newest = await this.runner.run('git', ['merge-base', '--independent', ...upstream], {
+            cwd: repoRoot,
+        });
+        const tips = newest.exitCode === 0 ? newest.stdout.split(/\r?\n/).filter(Boolean) : [];
+        return tips.length === 1 ? tips[0] : baseCommit;
+    }
     async isAncestor(repoRoot, ancestor, descendant = 'HEAD') {
         const result = await this.runner.run('git', ['merge-base', '--is-ancestor', ancestor, descendant], { cwd: repoRoot });
         return result.exitCode === 0;
@@ -401,12 +420,6 @@ export class GitInspector {
             'refs/remotes/',
         ]);
     }
-    async committedPaths(repoRoot, baseCommit) {
-        const result = await this.runner.run('git', ['diff', '--name-only', '-z', '--find-renames', baseCommit, 'HEAD', '--'], { cwd: repoRoot });
-        if (result.exitCode !== 0)
-            throw new Error(`Git committed diff failed: ${result.stderr.trim()}`);
-        return result.stdout.split('\0').filter(Boolean).map(normalizeGitPath).sort();
-    }
     async stagedManifest(repoRoot) {
         const root = await this.findRoot(repoRoot);
         let result = await this.runner.run('git', ['diff', '--cached', '--name-status', '-z', '--find-renames', '--find-copies', 'HEAD', '--'], { cwd: root });

package/runtime/dist/src/git/verification-gate.js

@@ -155,9 +155,8 @@ export class VerificationGate {
             receipt.source &&
             actualSource &&
             actualSource.sourceCommit !== receipt.source.sourceCommit &&
-            (await this.git.isAncestor(repository.repoRoot, receipt.source.sourceCommit)) &&
-            (await this.git.committedPaths(repository.repoRoot, receipt.source.sourceCommit)).every((path) => receipt.taskChanges.some((change) => change.path === path))
-            ? await this.git.manifestAgainst(repository.repoRoot, receipt.source.sourceCommit)
+            (await this.git.isAncestor(repository.repoRoot, receipt.source.sourceCommit))
+            ? await this.git.manifestAgainst(repository.repoRoot, receipt.source.sourceCommit, await this.git.taskBase(repository.repoRoot, receipt.source.sourceCommit, receipt.branch))
             : null;
         const committedAhead = ahead?.diffHash === receipt.diffHash;
         const current = ahead && committedAhead ? ahead : manifest;

package/runtime/dist/src/mcp/delivery-tools.js

@@ -39,6 +39,7 @@ const closedSchema = z.object({
             pushUrl: z.string().nullable(),
             headCommit: z.string().nullable(),
         }),
+        alreadyDelivered: z.object({ commit: z.string(), ref: z.string() }).optional(),
     }),
     deliveryRecord: z
         .object({
@@ -119,6 +120,16 @@ export function registerDeliveryTools(server, service) {
         const data = parsed.data;
         if (data.deliveryContext.mode === 'read_only')
             return output(closed);
+        const delivered = data.delivery.alreadyDelivered;
+        if (delivered)
+            return output({
+                ok: true,
+                data: {
+                    ...closed.data,
+                    deliveryStatus: 'delivered',
+                    nextAction: `Everything this task changed was already committed and pushed by hand: ${delivered.ref.replace(/^refs\/remotes\//, '')} contains ${delivered.commit.slice(0, 12)}. There is nothing left to deliver, so no delivery question is asked, and the delivery is recorded for the project. Call worktree.release in this folder with deliveryOutcome delivered to settle the folder.`,
+                },
+            });
         const destination = data.delivery.destination;
         if (!destination.branch)
             return output({

package/runtime/dist/src/runtime/bridge-service.js

@@ -1105,7 +1105,7 @@ export class BridgeService {
                     body: {
                         sessionId: input.sessionId,
                         repoFingerprint: repository.repoFingerprint,
-                        source: (await this.checkoutSource(repository, pointer.source)) ?? null,
+                        source: (await this.checkoutSource(await this.taskRepository(repository, pointer), pointer.source)) ?? null,
                         afterSequence: 0,
                     },
                 })).data);
@@ -2388,6 +2388,7 @@ export class BridgeService {
                         taskChanges,
                     });
                     await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint, input.taskId);
+                    await this.dependencies.activeContexts.updateTaskSnapshot(input.taskId, taskVersion, pointer.lastSequence);
                 }
                 else {
                     await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint, input.taskId);
@@ -2412,11 +2413,12 @@ export class BridgeService {
     }
     async validationWaiverSubject(input) {
         return await this.execute(async () => {
-            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
-            const pointer = await this.requireActivePointer(repository.repoFingerprint, input.taskId, false, 'verify');
+            const checkout = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            const pointer = await this.requireActivePointer(checkout.repoFingerprint, input.taskId, false, 'verify');
             if (!pointer.changeBaseline) {
                 throw refuse('This task has no local change baseline, so what it changed cannot be measured. The baseline is restored from the task record.', 'session.resume');
             }
+            const repository = await this.taskRepository(checkout, pointer);
             const response = await this.dependencies.client.request(endpoints.sessionResume, {
                 method: 'POST',
                 body: {
@@ -4866,10 +4868,12 @@ export class BridgeService {
             !pointer.changeBaseline ||
             typeof pointer.branch !== 'string' ||
             (await git.currentBranch(repository.repoRoot)) !== pointer.branch ||
-            !(await git.isAncestor(repository.repoRoot, base)) ||
-            !pathsContainAll(pointer.changeBaseline.leasePaths, await git.committedPaths(repository.repoRoot, base)))
+            !(await git.isAncestor(repository.repoRoot, base)))
             return repository;
-        return { ...repository, git: await git.manifestAgainst(repository.repoRoot, base) };
+        return {
+            ...repository,
+            git: await git.manifestAgainst(repository.repoRoot, base, await git.taskBase(repository.repoRoot, base, pointer.branch)),
+        };
     }
     async checkoutSource(repository, expected, task) {
         const current = await this.dependencies.repositories.git.sourceIdentity(repository.repoRoot);
@@ -4881,8 +4885,15 @@ export class BridgeService {
                 repository.git.baseCommit === expected.sourceCommit &&
                 repository.git.head === current.sourceCommit)
                 return { ...expected };
-            const branch = await this.dependencies.repositories.git.currentBranch(repository.repoRoot);
-            throw refuse(`The checkout no longer matches this task source. ${task?.taskSlug ? 'Task ' + task.taskSlug : 'This task'} was opened${task?.branch ? ' on ' + task.branch : ''} at commit ${expected.sourceCommit.slice(0, 12)}; this checkout is on ${branch ?? 'detached HEAD'} at ${current?.sourceCommit.slice(0, 12) ?? 'no commit'}, which is not the task's own work committed on top of its source. Ask the user through the native questionnaire which way to go: switch this checkout back to ${task?.branch ?? 'that commit'} and continue the task, or end it with task.abandon.`, 'task.abandon');
+            const git = this.dependencies.repositories.git;
+            const branch = await git.currentBranch(repository.repoRoot);
+            const rewritten = branch !== null &&
+                branch === task?.branch &&
+                !(await git.isAncestor(repository.repoRoot, expected.sourceCommit));
+            const way = rewritten
+                ? `${branch} no longer contains that commit: it was rewritten onto another history (a rebase, reset or amend). Nothing of the task is lost and nothing has to be abandoned: once ${branch} contains that commit again, for example after rebasing it back onto the branch it started from if the user wants that, call session.resume and the task continues where it stopped.`
+                : `Nothing of the task is lost: switch this checkout back to ${task?.branch ?? 'a branch that contains that commit'} and call session.resume, and the task continues where it stopped. Commits, merges and rebases made on the task branch itself stay the task's work.`;
+            throw refuse(`The checkout no longer matches this task source. ${task?.taskSlug ? 'Task ' + task.taskSlug : 'This task'} was opened${task?.branch ? ' on ' + task.branch : ''} at commit ${expected.sourceCommit.slice(0, 12)}; this checkout is on ${branch ?? 'detached HEAD'} at ${current?.sourceCommit.slice(0, 12) ?? 'no commit'}. ${way}`, 'session.resume');
         }
         if (current && repository.git.head !== current.sourceCommit) {
             throw refuse('The Git source changed during the request. Retry session.resume with a stable checkout.', 'session.resume');
@@ -5170,6 +5181,19 @@ export class BridgeService {
             await this.dependencies.repositories.git
                 .branchStore(repository.repoRoot)
                 .release(String(body.taskId));
+        const git = this.dependencies.repositories.git;
+        const head = repository.git.head;
+        const onBranch = Boolean(head && head !== sourceFromContext(body.source)?.sourceCommit);
+        const clean = onBranch && (await git.manifest(repository.repoRoot)).changedPaths.length === 0;
+        const onRemote = clean && head ? await git.remoteRefContaining(repository.repoRoot, head) : null;
+        if (onRemote && head && repository.projectId && closedTask.deliveryRecord)
+            await this.reportDeliveryOutcome({
+                projectId: repository.projectId,
+                taskId: String(body.taskId),
+                outcome: 'delivered',
+                commit: head,
+                pushed: true,
+            });
         return asJsonValue({
             ...closedTask,
             repository: publicRepository(repository),
@@ -5180,7 +5204,7 @@ export class BridgeService {
                 diffHash: String(body.diffHash),
                 mode: normalizeTaskMode(closedPointer?.mode),
             },
-            delivery: deliveryQuestion(touchedContract, await this.dependencies.repositories.git.pushDestination(repository.repoRoot), objectValue(closedTask.sourcePublication)?.applicable === true),
+            delivery: deliveryQuestion(touchedContract, await git.pushDestination(repository.repoRoot), objectValue(closedTask.sourcePublication)?.applicable === true, { onBranch, clean, onRemote }),
         });
     }
     async seedResumeSnapshot(pointer, backendPatch) {
@@ -5591,9 +5615,24 @@ function entryNextAction(authenticated, decision) {
     }
     return 'Ask which organization and then which project, whatever the user asked for, listing what they already have with the option to create a new one last. Switching Engineering Memory off in this repository is the other answer, and it is remembered.';
 }
-function deliveryQuestion(touchedContract, destination, publishApplicable) {
+function deliveryQuestion(touchedContract, destination, publishApplicable, committed) {
     const { branch, remote, pushUrl, remoteDefaultBranch, headCommit } = destination;
+    const afterCommit = publishApplicable
+        ? "After the authorized delivery, call worktree.release in this folder with deliveryOutcome delivered: it publishes this task's source memory and then records the delivery for the project. Its sourcePublication says whether publication happened; call memory.publish_task only when it names a reason you can fix. A task without a worktree to release calls memory.publish_task after the commit instead."
+        : 'This task has nothing to publish (see sourcePublication on the close response); do not call memory.publish_task.';
+    if (committed.onRemote && headCommit)
+        return asJsonValue({
+            required: false,
+            destination,
+            alreadyDelivered: { commit: headCommit, ref: committed.onRemote },
+            afterCommit,
+        });
     const onto = branch ? `branch ${branch}` : 'a detached HEAD, which is on no branch';
+    const state = committed.clean
+        ? `Everything this task changed is already committed on ${onto}; nothing is left to commit.`
+        : committed.onBranch
+            ? `Part of this task's work is already committed on ${onto}; the rest is not committed yet.`
+            : 'The task is closed and nothing has been committed.';
     const target = branch && remote ? `${remote} (${pushUrl ?? 'no push URL'}) branch ${branch}` : null;
     const head = headCommit ? `, on top of ${headCommit.slice(0, 12)}` : '';
     const pushed = target ? `, and a push goes to ${target}` : '';
@@ -5609,7 +5648,7 @@ function deliveryQuestion(touchedContract, destination, publishApplicable) {
             : '');
     return asJsonValue({
         required: true,
-        question: `The task is closed and nothing has been committed. The commit goes on ${onto}${head}${pushed}. If the user already said in their own message which of these they want, that is the answer; do not ask it again. Otherwise ask, and do only what they choose.`,
+        question: `${state} The commit goes on ${onto}${head}${pushed}. If the user already said in their own message which of these they want, that is the answer; do not ask it again. Otherwise ask, and do only what they choose.`,
         destination,
         options: [
             { id: 'commit', label: `Commit on ${onto}` },
@@ -5631,9 +5670,7 @@ function deliveryQuestion(touchedContract, destination, publishApplicable) {
             }
             : {}),
         afterPullRequest: 'Do not end the turn once a pull request exists. Check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything.',
-        afterCommit: publishApplicable
-            ? "After the authorized delivery, call worktree.release in this folder with deliveryOutcome delivered: it publishes this task's source memory and then records the delivery for the project. Its sourcePublication says whether publication happened; call memory.publish_task only when it names a reason you can fix. A task without a worktree to release calls memory.publish_task after the commit instead."
-            : 'This task has nothing to publish (see sourcePublication on the close response); do not call memory.publish_task.',
+        afterCommit,
     });
 }
 function cleanJson(value) {

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -46,9 +46,20 @@ export function createBridgeService(options = {}) {
         liveHeader: (path) => live.header(path),
     });
     const live = new LiveSignals(client);
-    const git = new GitInspector();
-    const outbox = new OfflineOutbox(stateRoot);
     const activeContexts = new ActiveContextStore(stateRoot);
+    const knownReservations = async (repoRoot) => (await activeContexts.list((await repositories.resolveIdentity(repoRoot)).repoFingerprint)).flatMap((pointer) => pointer.branch === undefined
+        ? []
+        : [
+            {
+                projectId: pointer.projectId,
+                externalTaskId: pointer.taskSlug,
+                branch: pointer.branch,
+                taskId: pointer.taskId,
+            },
+        ]);
+    const git = new GitInspector(undefined, knownReservations);
+    const repositories = new RepositoryResolver(git, config.markerSchemaVersion, stateRoot);
+    const outbox = new OfflineOutbox(stateRoot);
     const repositoryDecisions = new RepositoryDecisionStore(stateRoot);
     const updateChoices = new UpdateChoiceStore(stateRoot);
     const shadowNotices = new ShadowNoticeStore(stateRoot);
@@ -64,6 +75,7 @@ export function createBridgeService(options = {}) {
                 (await outbox.listForTask(entry.taskId)).length);
         },
         onDeliveryOutcome: async (report) => service?.reportDeliveryOutcome(report),
+        knownReservations,
     });
     const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
     const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
@@ -76,7 +88,7 @@ export function createBridgeService(options = {}) {
         client,
         credentials,
         browserAuth: new BrowserAuthCoordinator(client, credentials, () => languages.read(sha256('anonymous'))),
-        repositories: new RepositoryResolver(git, config.markerSchemaVersion, stateRoot),
+        repositories,
         journal: new JournalStore(stateRoot),
         outbox,
         gate,

package/runtime/dist/src/runtime/task-branch-store.js

@@ -1,13 +1,18 @@
+import { createHash } from 'node:crypto';
 import { NativeCommandRunner } from '../utilities/process.js';
 import { assertSafeToPersist } from './offline-outbox.js';
 import { BridgeRecoveryError } from './recovery-error.js';
 const decisionRef = 'refs/worktree/engineering-memory-task';
+const keptRef = (oid) => 'refs/engineering-memory/task-reservations/' + oid;
+const kept = new Set();
 export class TaskBranchStore {
     repoRoot;
     runner;
-    constructor(repoRoot, runner = new NativeCommandRunner()) {
+    known;
+    constructor(repoRoot, runner = new NativeCommandRunner(), known) {
         this.repoRoot = repoRoot;
         this.runner = runner;
+        this.known = known;
     }
     async read() {
         const reference = await this.runner.run('git', ['rev-parse', '--verify', '--quiet', decisionRef], { cwd: this.repoRoot });
@@ -17,8 +22,12 @@ export class TaskBranchStore {
             throw new BridgeRecoveryError('Git could not read the worktree task reservation. Retry the branch operation.', 'task.branch');
         const oid = reference.stdout.trim();
         const blob = await this.runner.run('git', ['cat-file', 'blob', oid], { cwd: this.repoRoot });
-        if (blob.exitCode !== 0)
-            throw new BridgeRecoveryError('Git could not read the recorded branch decision. Retry the branch operation.', 'task.branch');
+        if (blob.exitCode !== 0) {
+            const found = await this.runner.run('git', ['cat-file', '-e', oid], { cwd: this.repoRoot });
+            if (found.exitCode !== 1 || !this.known)
+                throw new BridgeRecoveryError('Git could not read the recorded branch decision. Retry the branch operation.', 'task.branch');
+            return await this.restore(oid, await this.known(this.repoRoot));
+        }
         let decision;
         try {
             decision = JSON.parse(blob.stdout);
@@ -33,6 +42,7 @@ export class TaskBranchStore {
             !(decision.branch === null || typeof decision.branch === 'string')) {
             throw new BridgeRecoveryError('The worktree branch record is invalid. Use a separate worktree to continue this task.', 'task.branch');
         }
+        await this.keep(oid);
         return { oid, decision };
     }
     async reserve(decision) {
@@ -43,7 +53,10 @@ export class TaskBranchStore {
             return;
         }
         const oid = await this.hash(decision);
-        const written = await this.runner.run('git', ['update-ref', '--no-deref', decisionRef, oid, '0'.repeat(oid.length)], { cwd: this.repoRoot });
+        const written = await this.update([
+            `create ${decisionRef} ${oid}`,
+            `update ${keptRef(oid)} ${oid}`,
+        ]);
         if (written.exitCode !== 0) {
             const winner = await this.read();
             if (winner) {
@@ -62,7 +75,11 @@ export class TaskBranchStore {
         if (current.decision.taskId === taskId)
             return;
         const oid = await this.hash({ ...current.decision, taskId });
-        const result = await this.runner.run('git', ['update-ref', '--no-deref', decisionRef, oid, current.oid], { cwd: this.repoRoot });
+        const result = await this.update([
+            `update ${decisionRef} ${oid} ${current.oid}`,
+            `update ${keptRef(oid)} ${oid}`,
+            `delete ${keptRef(current.oid)}`,
+        ]);
         if (result.exitCode !== 0) {
             const latest = await this.read();
             if (latest?.decision.taskId !== taskId)
@@ -76,7 +93,7 @@ export class TaskBranchStore {
             current.decision.projectId !== projectId ||
             current.decision.externalTaskId !== externalTaskId)
             return;
-        const result = await this.runner.run('git', ['update-ref', '--no-deref', '-d', decisionRef, current.oid], { cwd: this.repoRoot });
+        const result = await this.remove(current.oid);
         if (result.exitCode !== 0 && (await this.read())?.oid === current.oid)
             throw new BridgeRecoveryError('The failed branch operation could not release its reservation. Retry task.branch with the same task identifier.', 'task.branch');
     }
@@ -84,7 +101,7 @@ export class TaskBranchStore {
         const current = await this.read();
         if (!current || current.decision.taskId !== taskId)
             return;
-        const result = await this.runner.run('git', ['update-ref', '--no-deref', '-d', decisionRef, current.oid], { cwd: this.repoRoot });
+        const result = await this.remove(current.oid);
         if (result.exitCode !== 0 && (await this.read())?.decision.taskId === taskId) {
             throw new BridgeRecoveryError('The task has finished but its worktree reservation could not be released. Resume the task to retry cleanup.', 'session.resume');
         }
@@ -98,7 +115,7 @@ export class TaskBranchStore {
             current.decision.externalTaskId !== expected.externalTaskId ||
             current.decision.taskId !== expected.taskId)
             throw changed();
-        const result = await this.runner.run('git', ['update-ref', '--no-deref', '-d', decisionRef, oid], { cwd: this.repoRoot });
+        const result = await this.remove(oid);
         if (result.exitCode !== 0) {
             if ((await this.read())?.oid !== oid)
                 throw changed();
@@ -114,6 +131,48 @@ export class TaskBranchStore {
             throw new BridgeRecoveryError(`This task selected ${current.branch ?? 'detached HEAD'}. Return to that branch before continuing.`, 'task.branch');
         }
     }
+    async restore(oid, known) {
+        for (const task of known) {
+            const unopened = {
+                projectId: task.projectId,
+                externalTaskId: task.externalTaskId,
+                branch: task.branch,
+            };
+            for (const decision of [{ ...unopened, taskId: task.taskId }, unopened]) {
+                const body = Buffer.from(JSON.stringify(decision));
+                const id = createHash(oid.length === 64 ? 'sha256' : 'sha1')
+                    .update(`blob ${body.length}\0`)
+                    .update(body)
+                    .digest('hex');
+                if (id !== oid)
+                    continue;
+                await this.hash(decision);
+                await this.keep(oid);
+                return { oid, decision };
+            }
+        }
+        if ((await this.remove(oid)).exitCode !== 0)
+            throw new BridgeRecoveryError('Git could not read the recorded branch decision. Retry the branch operation.', 'task.branch');
+        return null;
+    }
+    async keep(oid) {
+        if (kept.has(this.repoRoot + '\n' + oid))
+            return;
+        const result = await this.runner.run('git', ['update-ref', keptRef(oid), oid], {
+            cwd: this.repoRoot,
+        });
+        if (result.exitCode === 0)
+            kept.add(this.repoRoot + '\n' + oid);
+    }
+    async remove(oid) {
+        return await this.update([`delete ${decisionRef} ${oid}`, `delete ${keptRef(oid)}`]);
+    }
+    async update(commands) {
+        return await this.runner.run('git', ['update-ref', '--no-deref', '--stdin'], {
+            cwd: this.repoRoot,
+            input: commands.join('\n') + '\n',
+        });
+    }
     async hash(decision) {
         const result = await this.runner.run('git', ['hash-object', '-w', '--stdin'], {
             cwd: this.repoRoot,

package/runtime/dist/src/runtime/worktree-pool.js

@@ -131,7 +131,7 @@ export class WorktreePool {
         this.stateRoot = stateRoot;
         this.ownerId = options.ownerId ?? randomUUID();
         this.runner = options.runner ?? new NativeCommandRunner();
-        this.git = new GitInspector(this.runner);
+        this.git = new GitInspector(this.runner, options.knownReservations);
         this.now = options.now ?? Date.now;
         this.alive = options.processAlive ?? processAlive;
         this.documents = options.documentsRoot;
@@ -1169,9 +1169,11 @@ export class WorktreePool {
     }
     async assertIdentity(entry, allowBranchChange = false) {
         if (key(await this.git.findRoot(entry.repoRoot)) !== key(await canonicalPath(entry.repoRoot)) ||
-            (await this.commonDirectory(entry.repoRoot)) !== entry.commonDir ||
-            (!allowBranchChange && (await this.git.currentBranch(entry.repoRoot)) !== entry.branch))
+            (await this.commonDirectory(entry.repoRoot)) !== entry.commonDir)
             throw refuse('The worktree Git identity changed. Reconcile it before continuing; the task was not moved or reset.');
+        const branch = allowBranchChange ? entry.branch : await this.git.currentBranch(entry.repoRoot);
+        if (branch !== entry.branch)
+            throw new BridgeRecoveryError(`This folder is on ${branch ?? 'a detached HEAD'}, but its task works on ${entry.branch ?? 'a detached HEAD'}. Nothing of the task is lost: switch this folder back to ${entry.branch ?? 'the commit the task started from'} and call session.resume, and the task continues where it stopped.`, 'session.resume');
         const reservation = await this.git.branchStore(entry.repoRoot).read();
         if (reservation &&
             (reservation.decision.projectId !== entry.projectId ||

package/skill/references/lifecycle.md

@@ -214,6 +214,10 @@ proved against the current commit. When it cannot prove it, resume reports
 list, and do not edit the pointer file: say what happened, and let the user decide between
 reopening the task and abandoning it.
 
+## Work committed, merged or rebased by hand
+
+Anything Engineering Memory does in Git the developer may do by hand while the task is open: commit on the task branch, merge the base branch into it, rebase it, push it. None of that loses the task, and none of it is a reason to abandon or reset anything. The task's changes are measured the way a pull request of the task branch shows them: against the newest commit the branch took in from the remote's other branches, so a merged-in `develop` is not counted as the task's work, while the task's own commits and its uncommitted files still are. When the checkout is on another branch or a detached HEAD, the refusal names the task branch to switch back to; switch back and call `session.resume`, and the task continues where it stopped. Do not call `worktree.reconcile` for it: that quarantines the folder. When the task branch itself was rewritten so that it no longer contains the commit the task started from (a rebase onto another history, a reset, an amend of that commit), the refusal says so; once that commit is back in the branch, `session.resume` continues the task. When everything the task changed is already committed and a remote branch contains it, `task.close` asks no delivery question: it reports `deliveryStatus: 'delivered'` and records the delivery for the project, and `worktree.release` with `deliveryOutcome:'delivered'` settles the folder.
+
 ## Change Preparation
 
 Skip change preparation for a read-only task. Do not request an edit lease, send changed paths, record `pre_edit`, or reconcile code resources in that mode. If the user later authorizes a change, call `context.prepare_change` with `transitionToWrite: true`, the bridge-owned current task version, intended paths, and current baseline diff. Continue only after the bridge returns the updated write task and lease.
@@ -280,6 +284,8 @@ When `context.prepare_change`'s `requirements` list a path under `mappings`, dra
 
 Record `handoff_before`, then call `task.verify`. For a write task, verify the exact changed paths, current diff hash, validations, session, and lease. For a read-only task, send no changed paths, lease, or write baseline; the bridge supplies the current Git diff hash and the backend compares it with the baseline captured at bootstrap while also verifying bootstrap, discovery, validation-before, validation-after, handoff, pinned read receipts, and synchronized outbox evidence. If verification fails, the refusal lists every unmet requirement at once; resolve all of them, then verify again. When `session.resume` reports `context_refresh_required`, call `context.refresh`, then `context.prepare_change` for the same paths; resume alone never reactivates a stale session, and the task baseline does not change. `context.refresh` sends in full only the revisions that changed since the session pinned them and lists the rest in `unchangedResources`; reread one of those with `memory.read_revisions` only when its text is no longer in view. Do not state that the task is complete while verification is failing, and do not carry on writing code with the failure unaddressed — a task that never verifies never closes, and everything that depends on closing, including the commit gate, silently never happens.
 
+A verified task is not frozen. When a change is needed after verification — a product manager's update, a fix the user asks for, a correction — call `context.prepare_change` for the paths it touches: that reopens the task and keeps everything recorded so far. A correction, a checkpoint or a self review reopens it as well. `task.reconcile` and `memory.propose_revision` on a verified task refuse with `Task already verified` and recovery `context.prepare_change`; call it, then repeat the refused call. Make the change, review it with `task.self_review`, run the validations again with `validation_before`, `validation_after` and `handoff_before` recorded around them, and verify again before `task.close`.
+
 When a task adds a structure the system did not have — a cache, a broker, a read replica, a second deployable, a projection, an event store — name it in `introducedStructures` at verification. The backend refuses any the project profile has not recorded under `architecture.adopted`, with the pressure it relieves, and refuses with the stated reason any the project recorded as deliberately declined. Recording it is a project profile revision like any other: propose, have the user approve, reconcile. Do not reach for the structure first and record it afterwards — the point of the record is that somebody decided.
 
 A new screen or component fails verification until its memory exists, which takes four steps in order: `memory.propose_revision` for each new path, the user's explicit approval, `memory.review_proposal`, then `task.reconcile`. The error names the paths. Walk the chain rather than retrying the same verification.